{"record":{"id":"d4306d8acd3b373e","repo":"docker/compose","slug":"unsupported-external-secret-s","errorCode":null,"errorMessage":"unsupported external secret %s","messagePattern":"unsupported external secret (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/compose/create.go","lineNumber":1219,"sourceCode":"\t}\n\treturn values, nil\n}\n\nfunc buildContainerSecretMounts(p types.Project, s types.ServiceConfig) ([]mount.Mount, error) {\n\tmounts := map[string]mount.Mount{}\n\n\tsecretsDir := \"/run/secrets/\"\n\tfor _, secret := range s.Secrets {\n\t\ttarget := secret.Target\n\t\tif secret.Target == \"\" {\n\t\t\ttarget = secretsDir + secret.Source\n\t\t} else if !isAbsTarget(secret.Target) {\n\t\t\ttarget = secretsDir + secret.Target\n\t\t}\n\n\t\tdefinedSecret := p.Secrets[secret.Source]\n\t\tif definedSecret.External {\n\t\t\treturn nil, fmt.Errorf(\"unsupported external secret %s\", definedSecret.Name)\n\t\t}\n\n\t\tif definedSecret.Driver != \"\" {\n\t\t\treturn nil, errors.New(\"Docker Compose does not support secrets.*.driver\") //nolint:staticcheck\n\t\t}\n\t\tif definedSecret.TemplateDriver != \"\" {\n\t\t\treturn nil, errors.New(\"Docker Compose does not support secrets.*.template_driver\") //nolint:staticcheck\n\t\t}\n\n\t\tif definedSecret.Environment != \"\" {\n\t\t\tcontinue\n\t\t}\n\n\t\tif secret.UID != \"\" || secret.GID != \"\" || secret.Mode != nil {\n\t\t\tlogrus.Warn(\"secrets `uid`, `gid` and `mode` are not supported, they will be ignored\")\n\t\t}\n\n\t\tif _, err := os.Stat(definedSecret.File); os.IsNotExist(err) {","sourceCodeStart":1201,"sourceCodeEnd":1237,"githubUrl":"https://github.com/docker/compose/blob/ddc4b044b62e9f715212ea4143fa830fac76382f/pkg/compose/create.go#L1201-L1237","documentation":"Secrets counterpart of the external-config check: when a service mounts a secret declared 'external: true', compose v2 cannot resolve it (no Swarm secret store lookup) and fails with the secret's resolved name. It needs the secret defined in the project via file or environment.","triggerScenarios":"Top-level secrets: entry with external: true (or {external: true, name: X}) referenced from a service's secrets: list during container creation.","commonSituations":"Swarm stack files reused with compose; secrets created with 'docker secret create' expected to be picked up; multi-environment YAML sharing.","solutions":["Drop 'external: true' and provide the secret with file: or environment:","If the secret lives outside the project, copy/bind-mount it as a file and reference that path","Use 'docker stack deploy' if Swarm-managed secrets are required"],"exampleFix":"# before\nsecrets:\n  db_password:\n    external: true\n# after\nsecrets:\n  db_password:\n    file: ./secrets/db_password.txt","handlingStrategy":"validation","validationCode":"for name, sec := range project.Secrets {\n    if sec.External {\n        return fmt.Errorf(\"secret %s is external; provide file: or environment:\", name)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err != compose.Up(...); err != nil && strings.Contains(err.Error(), \"unsupported external secret\") { /* inline the secret as a file and retry */ }","preventionTips":["Run docker compose config as a CI gate","Convert Swarm secrets to file-backed secrets when migrating","Never commit secret material; mount via file: from a secret manager checkout"],"tags":["secrets","compose-file","swarm-migration"],"backgroundTag":null,"analyzedSha":"ddc4b044b62e9f715212ea4143fa830fac76382f","analyzedAt":"2026-08-15T13:31:42.319Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}