{"record":{"id":"6375f7f2256bbbbf","repo":"docker/compose","slug":"docker-compose-does-not-support-secrets-template","errorCode":null,"errorMessage":"Docker Compose does not support secrets.*.template_driver","messagePattern":"Docker Compose does not support secrets\\.\\*\\.template_driver","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/compose/create.go","lineNumber":1226,"sourceCode":"\tsecretsDir := \"/run/secrets/\"\n\tfor _, secret := range s.Secrets {\n\t\ttarget := secret.Target\n\t\tif secret.Target == \"\" {\n\t\t\ttarget = secretsDir + secret.Source\n\t\t} else if !isAbsTarget(secret.Target) {\n\t\t\ttarget = secretsDir + secret.Target\n\t\t}\n\n\t\tdefinedSecret := p.Secrets[secret.Source]\n\t\tif definedSecret.External {\n\t\t\treturn nil, fmt.Errorf(\"unsupported external secret %s\", definedSecret.Name)\n\t\t}\n\n\t\tif definedSecret.Driver != \"\" {\n\t\t\treturn nil, errors.New(\"Docker Compose does not support secrets.*.driver\") //nolint:staticcheck\n\t\t}\n\t\tif definedSecret.TemplateDriver != \"\" {\n\t\t\treturn nil, errors.New(\"Docker Compose does not support secrets.*.template_driver\") //nolint:staticcheck\n\t\t}\n\n\t\tif definedSecret.Environment != \"\" {\n\t\t\tcontinue\n\t\t}\n\n\t\tif secret.UID != \"\" || secret.GID != \"\" || secret.Mode != nil {\n\t\t\tlogrus.Warn(\"secrets `uid`, `gid` and `mode` are not supported, they will be ignored\")\n\t\t}\n\n\t\tif _, err := os.Stat(definedSecret.File); os.IsNotExist(err) {\n\t\t\tlogrus.Warnf(\"secret file %s does not exist\", definedSecret.Name)\n\t\t}\n\n\t\tmnt, err := buildMount(p, types.ServiceVolumeConfig{\n\t\t\tType:     types.VolumeTypeBind,\n\t\t\tSource:   definedSecret.File,\n\t\t\tTarget:   target,","sourceCodeStart":1208,"sourceCodeEnd":1244,"githubUrl":"https://github.com/docker/compose/blob/ddc4b044b62e9f715212ea4143fa830fac76382f/pkg/compose/create.go#L1208-L1244","documentation":"Like configs, secrets with a `template_driver:` require SwarmKit to invoke a driver plugin to render the secret value. Compose's file-based secret delivery has no plugin step, so container creation rejects the service as soon as the secret definition is resolved.","triggerScenarios":"Top-level secrets entry containing `template_driver:` (e.g. template_driver: golang) used by a service during compose up/create.","commonSituations":"Templated secrets from Swarm stacks ({{.Task.Slot}} style templates) reused in compose; local dev against a Swarm-designed compose file.","solutions":["Pre-render the templated secret to a static file and reference it with `file:`","Strip Swarm-only keys into a stack-specific override file used only with docker stack deploy","Move dynamic values to `environment:` interpolation instead of secret templates"],"exampleFix":"# before\nsecrets:\n  app-tls:\n    template_driver: golang\n    file: ./tls.tmpl\n# after\nsecrets:\n  app-tls:\n    file: ./tls-rendered.pem","handlingStrategy":"validation","validationCode":"python3 - <<'EOF'\nimport yaml,sys\ncfg=yaml.safe_load(open('compose.yaml'))\nfor n,s in (cfg.get('secrets') or {}).items():\n    if 'template_driver' in s: sys.exit(f\"secret {n} uses unsupported template_driver\")\nprint('ok')\nEOF","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pre-render templated secrets in CI into a secrets/ directory","Gate Swarm-only services behind profiles so they never load under compose up"],"tags":["secrets","compose-file","swarm","container-create"],"backgroundTag":null,"analyzedSha":"ddc4b044b62e9f715212ea4143fa830fac76382f","analyzedAt":"2026-08-15T13:31:42.319Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}