%[1]s %[2]s: %[1]s.driver and %[1]s.file conflict; only use…

Error message

%[1]s %[2]s: %[1]s.driver and %[1]s.file conflict; only use %[1]s.driver

What it means

Returned by loadFileObjectConfig for a non-external secret/config that sets both `driver` (bind-mounted from a driver) and `file` (path to a local file). These are mutually exclusive source modes: a driver-provided object has no local file path and vice-versa.

Solutions

If using a driver, remove `file`.
If using a local file, remove `driver` (and `driver_opts`).

Example fix

# before
secrets:
  token:
    file: ./token.txt
    driver: local
# after
secrets:
  token:
    file: ./token.txt

Defensive patterns

Strategy: validation

Validate before calling

func validateFileObjectSource(objType, name string, obj map[string]any) error {
    ext, _ := obj["external"]
    if ext == true {
        return nil // external handled elsewhere
    }
    _, hasDriver := obj["driver"]
    _, hasFile := obj["file"]
    if hasDriver && hasFile {
        return fmt.Errorf("%s %s: set either driver or file, not both", objType, name)
    }
    return nil
}

Prevention

Choose one source mode per secret/config (file OR driver).
When switching modes, delete the now-unused key.
Lint rendered configs in CI.

When it happens

Trigger: A `secrets:` or `configs:` entry without `external` has both `driver:` and `file:` set.

Common situations: Switching a secret from a file source to a driver (e.g. secrets-bundle) and forgetting to drop `file`; copy-paste between examples.

Related errors

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/61caaa812bdac6ce. Report an issue: GitHub.

Appendix: source

Thrown at cli/compose/loader/loader.go:669

	switch {
	case obj.External.External:
		// handle deprecated external.name
		if obj.External.Name != "" {
			if obj.Name != "" {
				return obj, fmt.Errorf("%[1]s %[2]s: %[1]s.external.name and %[1]s.name conflict; only use %[1]s.name", objType, name)
			}
			if versions.GreaterThanOrEqualTo(details.Version, "3.5") {
				logrus.Warnf("%[1]s %[2]s: %[1]s.external.name is deprecated in favor of %[1]s.name", objType, name)
			}
			obj.Name = obj.External.Name
			obj.External.Name = ""
		} else if obj.Name == "" {
			obj.Name = name
		}
		// if not "external: true"
	case obj.Driver != "":
		if obj.File != "" {
			return obj, fmt.Errorf("%[1]s %[2]s: %[1]s.driver and %[1]s.file conflict; only use %[1]s.driver", objType, name)
		}
	default:
		obj.File = absPath(details.WorkingDir, obj.File)
	}

	return obj, nil
}

func absPath(workingDir string, filePath string) string {
	if filepath.IsAbs(filePath) {
		return filePath
	}
	return filepath.Join(workingDir, filePath)
}

var transformMapStringString TransformerFunc = func(data any) (any, error) {
	switch value := data.(type) {
	case map[string]any:

View on GitHub (pinned to 4f84911bfe)