{"record":{"id":"cadecdf6bc6b8856","repo":"docker/compose","slug":"the-classic-builder-doesn-t-support-secrets-set-d","errorCode":null,"errorMessage":"the classic builder doesn't support secrets, set DOCKER_BUILDKIT=1 to use BuildKit","messagePattern":"the classic builder doesn't support secrets, set DOCKER_BUILDKIT=1 to use BuildKit","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/compose/build_classic.go","lineNumber":146,"sourceCode":"\t\tdockerfileCtx io.ReadCloser\n\t\tcontextDir    string\n\t\trelDockerfile string\n\t)\n\n\tif len(service.Build.Platforms) > 1 {\n\t\treturn \"\", fmt.Errorf(\"the classic builder doesn't support multi-arch build, set DOCKER_BUILDKIT=1 to use BuildKit\")\n\t}\n\tif service.Build.Privileged {\n\t\treturn \"\", fmt.Errorf(\"the classic builder doesn't support privileged mode, set DOCKER_BUILDKIT=1 to use BuildKit\")\n\t}\n\tif len(service.Build.AdditionalContexts) > 0 {\n\t\treturn \"\", fmt.Errorf(\"the classic builder doesn't support additional contexts, set DOCKER_BUILDKIT=1 to use BuildKit\")\n\t}\n\tif len(service.Build.SSH) > 0 {\n\t\treturn \"\", fmt.Errorf(\"the classic builder doesn't support SSH keys, set DOCKER_BUILDKIT=1 to use BuildKit\")\n\t}\n\tif len(service.Build.Secrets) > 0 {\n\t\treturn \"\", fmt.Errorf(\"the classic builder doesn't support secrets, set DOCKER_BUILDKIT=1 to use BuildKit\")\n\t}\n\n\tif service.Build.Labels == nil {\n\t\tservice.Build.Labels = make(map[string]string)\n\t}\n\tservice.Build.Labels[api.ImageBuilderLabel] = \"classic\"\n\n\tdockerfileName := dockerFilePath(service.Build.Context, service.Build.Dockerfile)\n\tspecifiedContext := service.Build.Context\n\tprogBuff := s.stdout()\n\tbuildBuff := s.stdout()\n\n\tcontextType, err := build.DetectContextType(specifiedContext)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\tswitch contextType {","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/docker/compose/blob/ddc4b044b62e9f715212ea4143fa830fac76382f/pkg/compose/build_classic.go#L128-L164","documentation":"Returned by doBuildClassic when a service's build section declares secrets (`build.secrets`) and the classic builder path was selected. The classic builder cannot mount secret files into the build container; only BuildKit's `RUN --mount=type=secret` supports this. Compose fails fast instead of silently building without the secrets.","triggerScenarios":"`docker compose build` with `build.secrets` entries (e.g. `secrets: - my_token`) while DOCKER_BUILDKIT=0 or an environment where BuildKitEnabled() returns false routes the build to doBuildClassic.","commonSituations":"Teams migrating builds to use secret mounts while CI still exports DOCKER_BUILDKIT=0; air-gapped environments with legacy daemons where BuildKit cannot be enabled; copy-pasted Compose files using secrets with an old Docker install.","solutions":["Enable BuildKit: export DOCKER_BUILDKIT=1 (and unset any DOCKER_BUILDKIT=0), then rebuild","Upgrade Docker CLI/daemon to >= 18.09 (modern installs default to BuildKit, no env var needed)","If stuck on classic, drop `build.secrets` and pass sensitive data another way (e.g. pre-fetch into the context and rely on .dockerignore, or bake at image publish time)"],"exampleFix":"# before\n# DOCKER_BUILDKIT=0 docker compose build  -> error\n\n# after\nexport DOCKER_BUILDKIT=1\ndocker compose build","handlingStrategy":"validation","validationCode":"if len(svc.Build.Secrets) > 0 {\n    if bk, _ := dockerCli.BuildKitEnabled(); !bk {\n        return fmt.Errorf(\"service %s requires BuildKit for build.secrets\", svc.Name)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Document the BuildKit requirement next to any build.secrets usage in the repo README","In CI, assert `docker buildx version` succeeds before running docker compose build"],"tags":["build","buildkit","secrets","classic-builder"],"backgroundTag":null,"analyzedSha":"ddc4b044b62e9f715212ea4143fa830fac76382f","analyzedAt":"2026-08-15T13:31:42.319Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}