{"record":{"id":"4f13c8121d00200f","repo":"docker/compose","slug":"the-classic-builder-doesn-t-support-privileged-mod","errorCode":null,"errorMessage":"the classic builder doesn't support privileged mode, set DOCKER_BUILDKIT=1 to use BuildKit","messagePattern":"the classic builder doesn't support privileged mode, set DOCKER_BUILDKIT=1 to use BuildKit","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/compose/build_classic.go","lineNumber":137,"sourceCode":"\t\t}\n\t}\n\treturn imageIDs, err\n}\n\n//nolint:gocyclo\nfunc (s *composeService) doBuildImage(ctx context.Context, project *types.Project, service types.ServiceConfig, options api.BuildOptions) (string, error) {\n\tvar (\n\t\tbuildCtx      io.ReadCloser\n\t\tdockerfileCtx io.ReadCloser\n\t\tcontextDir    string\n\t\trelDockerfile string\n\t)\n\n\tif len(service.Build.Platforms) > 1 {\n\t\treturn \"\", fmt.Errorf(\"the classic builder doesn't support multi-arch build, set DOCKER_BUILDKIT=1 to use BuildKit\")\n\t}\n\tif service.Build.Privileged {\n\t\treturn \"\", fmt.Errorf(\"the classic builder doesn't support privileged mode, set DOCKER_BUILDKIT=1 to use BuildKit\")\n\t}\n\tif len(service.Build.AdditionalContexts) > 0 {\n\t\treturn \"\", fmt.Errorf(\"the classic builder doesn't support additional contexts, set DOCKER_BUILDKIT=1 to use BuildKit\")\n\t}\n\tif len(service.Build.SSH) > 0 {\n\t\treturn \"\", fmt.Errorf(\"the classic builder doesn't support SSH keys, set DOCKER_BUILDKIT=1 to use BuildKit\")\n\t}\n\tif len(service.Build.Secrets) > 0 {\n\t\treturn \"\", fmt.Errorf(\"the classic builder doesn't support secrets, set DOCKER_BUILDKIT=1 to use BuildKit\")\n\t}\n\n\tif service.Build.Labels == nil {\n\t\tservice.Build.Labels = make(map[string]string)\n\t}\n\tservice.Build.Labels[api.ImageBuilderLabel] = \"classic\"\n\n\tdockerfileName := dockerFilePath(service.Build.Context, service.Build.Dockerfile)\n\tspecifiedContext := service.Build.Context","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/docker/compose/blob/ddc4b044b62e9f715212ea4143fa830fac76382f/pkg/compose/build_classic.go#L119-L155","documentation":"On the classic (non-BuildKit) build path, doBuildImage rejects build.privileged: true. Privileged builds are a BuildKit feature (running the builder with extended permissions for e.g. nested container runtimes); the legacy API has no equivalent switch, so the request is refused with guidance to set DOCKER_BUILDKIT=1.","triggerScenarios":"A service sets build.privileged: true and the build routes to the classic builder — DOCKER_BUILDKIT=0 in the environment, COMPOSE_BAKE=false, or buildx unavailable.","commonSituations":"Building images that launch containers inside the build (systemd, K8s-in-docker, qemu binfmt installers) with privileged enabled, on hosts where BuildKit was disabled to dodge a proxy/cache issue; air-gapped environments lacking buildx.","solutions":["Enable BuildKit: unset DOCKER_BUILDKIT, unset COMPOSE_BAKE, and confirm buildx is installed","If the legacy builder is mandatory, remove build.privileged and restructure the build to avoid privileged steps (do them at runtime instead)","Install/upgrade the buildx plugin so compose can select the BuildKit path automatically"],"exampleFix":"# before\n$ DOCKER_BUILDKIT=0 docker compose build   # build.privileged: true\n# after\n$ unset DOCKER_BUILDKIT\n$ docker compose build\n","handlingStrategy":"validation","validationCode":"// Guard before a classic-path build:\nfor name, svc := range project.Services {\n\tif svc.Build != nil && svc.Build.Privileged && classicBuilder() {\n\t\treturn fmt.Errorf(\"service %s requires BuildKit for build.privileged\", name)\n\t}\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat build.privileged as BuildKit-only; do not attempt legacy-builder fallbacks","Move privileged operations into runtime containers when BuildKit is unavailable","Keep an explicit buildx install step in environment setup"],"tags":["classic-builder","buildkit","privileged","build"],"backgroundTag":null,"analyzedSha":"ddc4b044b62e9f715212ea4143fa830fac76382f","analyzedAt":"2026-08-15T13:31:42.319Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}