What causes "invalid type %T for secret" in docker/cli?

Use the short form: `secrets: [token]`.

invalid type %T for secret

Error message

invalid type %T for secret

What it means

Thrown by transformStringSourceMap, the transformer for a single service `secrets`/`configs` entry (the short form). Each entry must be a string (source name) or a map (long form); anything else is rejected.

Solutions

Use the short form: `secrets: [token]`.
Or the long form: `secrets: [ { source: token } ]`.

Example fix

# before
web:
  secrets:
    - token: mytoken
# after
web:
  secrets:
    - source: mytoken

Defensive patterns

Strategy: type-guard

Validate before calling

func validateSecretEntries(field string, entries any) error {
    list, ok := entries.([]any)
    if !ok {
        return nil
    }
    for i, e := range list {
        switch e.(type) {
        case string, map[string]any:
        default:
            return fmt.Errorf("%s[%d]: invalid type %T", field, i, e)
        }
    }
    return nil
}

Type guard

func isSecretEntry(v any) bool {
    switch v.(type) {
    case string, map[string]any:
        return true
    }
    return false
}

Prevention

Use short (`- token`) or long (`- source: token`) form for each entry.
Watch indentation so a long-form map stays a single map entry.
Lint rendered output.

When it happens

Trigger: A service's `secrets:` or `configs:` list contains an element that is neither a string nor a map — e.g. an int, a list, or null.

Common situations: Bad indentation collapsing a long-form map into a bare value; templating emitting null entries.

Related errors

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/534683abc2458df8. Report an issue: GitHub.

Appendix: source

Thrown at cli/compose/loader/loader.go:747

				ports = append(ports, value)
			default:
				return data, fmt.Errorf("invalid type %T for port", value)
			}
		}
		return ports, nil
	default:
		return data, fmt.Errorf("invalid type %T for port", entries)
	}
}

var transformStringSourceMap TransformerFunc = func(data any) (any, error) {
	switch value := data.(type) {
	case string:
		return map[string]any{"source": value}, nil
	case map[string]any:
		return data, nil
	default:
		return data, fmt.Errorf("invalid type %T for secret", value)
	}
}

var transformBuildConfig TransformerFunc = func(data any) (any, error) {
	switch value := data.(type) {
	case string:
		return map[string]any{"context": value}, nil
	case map[string]any:
		return data, nil
	default:
		return data, fmt.Errorf("invalid type %T for service build", value)
	}
}

var transformServiceVolumeConfig TransformerFunc = func(data any) (any, error) {
	switch value := data.(type) {
	case string:
		return volumespec.Parse(value)

View on GitHub (pinned to 4f84911bfe)