{"record":{"id":"c967193778c3c43d","repo":"docker/compose","slug":"docker-compose-does-not-support-secrets-driver","errorCode":null,"errorMessage":"Docker Compose does not support secrets.*.driver","messagePattern":"Docker Compose does not support secrets\\.\\*\\.driver","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/compose/create.go","lineNumber":1223,"sourceCode":"func buildContainerSecretMounts(p types.Project, s types.ServiceConfig) ([]mount.Mount, error) {\n\tmounts := map[string]mount.Mount{}\n\n\tsecretsDir := \"/run/secrets/\"\n\tfor _, secret := range s.Secrets {\n\t\ttarget := secret.Target\n\t\tif secret.Target == \"\" {\n\t\t\ttarget = secretsDir + secret.Source\n\t\t} else if !isAbsTarget(secret.Target) {\n\t\t\ttarget = secretsDir + secret.Target\n\t\t}\n\n\t\tdefinedSecret := p.Secrets[secret.Source]\n\t\tif definedSecret.External {\n\t\t\treturn nil, fmt.Errorf(\"unsupported external secret %s\", definedSecret.Name)\n\t\t}\n\n\t\tif definedSecret.Driver != \"\" {\n\t\t\treturn nil, errors.New(\"Docker Compose does not support secrets.*.driver\") //nolint:staticcheck\n\t\t}\n\t\tif definedSecret.TemplateDriver != \"\" {\n\t\t\treturn nil, errors.New(\"Docker Compose does not support secrets.*.template_driver\") //nolint:staticcheck\n\t\t}\n\n\t\tif definedSecret.Environment != \"\" {\n\t\t\tcontinue\n\t\t}\n\n\t\tif secret.UID != \"\" || secret.GID != \"\" || secret.Mode != nil {\n\t\t\tlogrus.Warn(\"secrets `uid`, `gid` and `mode` are not supported, they will be ignored\")\n\t\t}\n\n\t\tif _, err := os.Stat(definedSecret.File); os.IsNotExist(err) {\n\t\t\tlogrus.Warnf(\"secret file %s does not exist\", definedSecret.Name)\n\t\t}\n\n\t\tmnt, err := buildMount(p, types.ServiceVolumeConfig{","sourceCodeStart":1205,"sourceCodeEnd":1241,"githubUrl":"https://github.com/docker/compose/blob/ddc4b044b62e9f715212ea4143fa830fac76382f/pkg/compose/create.go#L1205-L1241","documentation":"Secrets in Compose are delivered as plain files mounted under /run/secrets; a `driver:` on a secret means 'generate this secret with a SwarmKit driver plugin', which Compose cannot execute. Container creation therefore fails loudly instead of mounting an empty or bogus secret.","triggerScenarios":"A top-level secrets entry with `driver:` (e.g. driver: vault) referenced by a service, hit during `docker compose up`/create.","commonSituations":"Swarm stack files with driver-backed secrets used locally; evaluating Swarm-oriented secret plugins (Vault/AWS secrets drivers) under compose; copy-pasting production Swarm config into a dev compose file.","solutions":["Replace the driver-backed secret with `file:` or `environment:` delivery","Use `external: true` with the secret pre-created if you manage secrets out-of-band","Deploy with `docker stack deploy` if driver plugins are required"],"exampleFix":"# before\nsecrets:\n  db-password:\n    driver: vault\n# after\nsecrets:\n  db-password:\n    file: ./secrets/db-password","handlingStrategy":"validation","validationCode":"python3 - <<'EOF'\nimport yaml,sys\ncfg=yaml.safe_load(open('compose.yaml'))\nfor n,s in (cfg.get('secrets') or {}).items():\n    if 'driver' in s: sys.exit(f\"secret {n} uses unsupported driver\")\nprint('ok')\nEOF","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use file: or environment: based secrets for compose; reserve driver-backed secrets for Swarm deployments","Add a CI guard that diffs compose.yaml against an allowed schema subset"],"tags":["secrets","compose-file","swarm","container-create"],"backgroundTag":null,"analyzedSha":"ddc4b044b62e9f715212ea4143fa830fac76382f","analyzedAt":"2026-08-15T13:31:42.319Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}