Repository navigation
fix(start): give a started use_api_socket service its config file - #14393
Merged
Merged
Conversation
A container created beforehand and only started by `compose start` (`create` then `start`, `up --no-start` then `start`, or a dependency named to `start`) came up with DOCKER_CONFIG pointing at /run/secrets/docker and no file there: use_api_socket is applied by rewriting the project, and the config file it adds is injected when a container starts, from the project the start works on. Create and run applied the rewriting, start did not. start() now applies it too, on the copy it already makes of the project, so the caller's is left alone, and a project already rewritten (a dependency started by run) is not rewritten twice. The rewriting tolerates a project without environment or configs maps, as the one `compose start` loads. up -d, a foreground up, scale and run already provided the file. Signed-off-by: Nicolas De Loof <nicolas.deloof@gmail.com>
…_socket writes into The project `compose start` loads has no environment nor configs map, which the rewriting used to write into; a project built with empty maps is the other shape. Both are started with the config file in place, and neither caller's project is written to. Signed-off-by: Nicolas De Loof <nicolas.deloof@gmail.com>
…e comments - a project that already went through use_api_socket, as the one `run` hands to the dependencies it starts, is injected once by start(): rewriting it again would duplicate the config entry, and the file would be copied twice. The first test also checks that the option was applied; - the comments say which maps the rewriting may find nil: the service Environment in the project `compose start` loads, the Configs of a programmatic one, and that a project rebuilt from the labels knows nothing of the option. Signed-off-by: Nicolas De Loof <nicolas.deloof@gmail.com>
docker-agent
left a comment
docker-agent
left a comment
Contributor
There was a problem hiding this comment.
Assessment: 🟢 APPROVE
docker-agent
left a comment
docker-agent
left a comment
Contributor
There was a problem hiding this comment.
Assessment: 🟢 APPROVE
dock-tor
approved these changes
Oct 26, 2026
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does, in one sentence
compose startnow gives ause_api_socketservice the config file the option promises, when its container was created beforehand.Context
A service with
use_api_socket: trueis meant to find a Docker client configuration at/run/secrets/docker/config.json, withDOCKER_CONFIGpointing there (#14386).up -dand the foregroundupprovide it since #14290 and #14305. What was left is a container that is created first and started later:createthenstart,up --no-startthenstart, orstart <service>for a dependency. It came up withDOCKER_CONFIGset and nothing at that path.The option works by rewriting the project (a
#apisocketconfig, the socket bind and the environment variable), and the file is injected when a container starts, from the service the start plan carries.createandrunapplied the rewriting,startdid not: the environment variable was set at creation, the file never injected.What the PR brings
startapplies the rewriting likecreateandrundo, on the copy of the project it already makes, so the caller's project is left alone. A project that was already rewritten, such as the onerunhands to the dependencies it starts, is not rewritten twice. The rewriting also tolerates a project without a service environment or without a configs map, which is whatcompose startloads (it resolves no environment): the first version of this fix panicked there, and an end-to-end scenario caught it.Nothing changes for a project that does not use the option. Worth knowing:
compose startnow looks up the credentials for a project that uses the option, ascreate,upandrunalready do, even when everything is already running.read_only: trueservice using the option failscompose startwith the errorup -dalready gives it: the file cannot be created in a read-only service.compose -p <name> startwithout a compose file rebuilds the services from the container labels, which do not carry the option: the file is still missing in that mode.compose restartof a container that was never started injects no configs or secrets at all, this one included. It predates this change and is a separate matter.Fixes #14386.
🤖 Generated with Claude Code