{"record":{"id":"e828697d8e5e6c21","repo":"docker/cli","slug":"failed-to-update-service-s-w","errorCode":null,"errorMessage":"failed to update service %s: %w","messagePattern":"failed to update service (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/stack/deploy_composefile.go","lineNumber":274,"sourceCode":"\t\t\tdefault:\n\t\t\t\tif image == svc.Spec.Labels[convert.LabelImage] {\n\t\t\t\t\t// image has not changed; update the serviceSpec with the\n\t\t\t\t\t// existing information that was set by QueryRegistry on the\n\t\t\t\t\t// previous deploy. Otherwise this will trigger an incorrect\n\t\t\t\t\t// service update.\n\t\t\t\t\tserviceSpec.TaskTemplate.ContainerSpec.Image = svc.Spec.TaskTemplate.ContainerSpec.Image\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Stack deploy does not have a `--force` option. Preserve existing\n\t\t\t// ForceUpdate value so that tasks are not re-deployed if not updated.\n\t\t\t// TODO move this to API client?\n\t\t\tserviceSpec.TaskTemplate.ForceUpdate = svc.Spec.TaskTemplate.ForceUpdate\n\n\t\t\tupdateOpts.Spec = serviceSpec\n\t\t\tresponse, err := apiClient.ServiceUpdate(ctx, svc.ID, updateOpts)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"failed to update service %s: %w\", name, err)\n\t\t\t}\n\n\t\t\tfor _, warning := range response.Warnings {\n\t\t\t\t_, _ = fmt.Fprintln(dockerCLI.Err(), warning)\n\t\t\t}\n\n\t\t\tserviceIDs = append(serviceIDs, svc.ID)\n\t\t} else {\n\t\t\t_, _ = fmt.Fprintln(out, \"Creating service\", name)\n\n\t\t\t// query registry if flag disabling it was not set\n\t\t\tqueryRegistry := resolveImage == resolveImageAlways || resolveImage == resolveImageChanged\n\n\t\t\tresponse, err := apiClient.ServiceCreate(ctx, client.ServiceCreateOptions{\n\t\t\t\tSpec:                serviceSpec,\n\t\t\t\tEncodedRegistryAuth: encodedAuth,\n\t\t\t\tQueryRegistry:       queryRegistry,\n\t\t\t})","sourceCodeStart":256,"sourceCodeEnd":292,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/stack/deploy_composefile.go#L256-L292","documentation":"Raised by deployServices when updating an existing service and ServiceUpdate fails. The wrapped %w carries the daemon error. This is the redeploy path (the service already exists in the stack namespace) and the update carries the new spec, registry auth, and image-resolution options.","triggerScenarios":"Redeploying a stack where one or more services already exist; ServiceUpdate at deploy_composefile.go:272 returns an error (version conflict, invalid spec, resource constraint, scheduling failure).","commonSituations":"Updating a service with an invalid image reference or mount; concurrent deploys causing version conflicts; daemon-side rejection (e.g. constraint that no node satisfies); referencing a secret/config that doesn't exist yet; changing a field the daemon forbids on update.","solutions":["Read the wrapped error to get the daemon's specific rejection reason.","If 'update out of sequence' / version conflict, retry the deploy.","Verify referenced secrets/configs/networks exist and are correctly named.","Check node availability/constraints with `docker node ls` if scheduling is the issue.","Validate the image reference and registry credentials."],"exampleFix":"// before: referencing a non-existent secret in update\nservices:\n  web:\n    secrets:\n      - missing_secret\n// after: ensure the secret is declared\nsecrets:\n  missing_secret:\n    file: ./secret.txt\nservices:\n  web:\n    secrets:\n      - missing_secret","handlingStrategy":"try-catch","validationCode":"// Pre-validate service spec fields that commonly cause ServiceUpdate rejection\nfor _, svc := range desiredServices {\n    if svc.Image == \"\" { return fmt.Errorf(\"service %s has no image\", svc.Name) }\n    for _, s := range svc.Secrets { if !secretExists(s) { return fmt.Errorf(\"service %s refs missing secret %s\", svc.Name, s) } }\n    for _, c := range svc.Configs { if !configExists(c) { return fmt.Errorf(\"service %s refs missing config %s\", svc.Name, c) } }\n    for _, n := range svc.Networks { if !networkExists(n) { return fmt.Errorf(\"service %s refs missing network %s\", svc.Name, n) } }\n}","typeGuard":null,"tryCatchPattern":"err := stackDeploy(ctx, cli, opts, cfg)\nif err != nil && strings.Contains(err.Error(), \"failed to update service\") {\n    // re-inspect, surface wrapped reason; retry only on version conflicts\n    var se interface{ Unwrap() error }\n    if errors.As(err, &se) {\n        if strings.Contains(se.Unwrap().Error(), \"update out of sequence\") { /* retry */ }\n    }\n}","preventionTips":["Validate referenced secrets/configs/networks exist before deploy.","Ensure images are pushable and registry auth is provided.","Serialize deploys to avoid version conflicts on update."],"tags":["docker","stack","service","swarm","update","deploy"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}