cannot share network namespace with service %s: container mi

Error message

cannot share network namespace with service %s: container missing

What it means

resolveSharedNamespaces handles network_mode values of the form 'service:<name>': it must replace the service reference with the actual container ID (container:<id>) before container creation. If the referenced service has no containers in containersByService, the mode cannot be resolved and the error is returned.

Source

Thrown at pkg/compose/convergence.go:97

		if spec[0] == "container" {
			service.VolumesFrom[i] = spec[1]
			continue
		}
		name := spec[0]
		dependencies := containersByService[name]
		if len(dependencies) == 0 {
			return fmt.Errorf("cannot share volume with service %s: container missing", name)
		}
		service.VolumesFrom[i] = dependencies.sorted()[0].ID
	}
	return nil
}

func resolveSharedNamespaces(service *types.ServiceConfig, containersByService map[string]Containers) error {
	if name := getDependentServiceFromMode(service.NetworkMode); name != "" {
		dependencies := containersByService[name]
		if len(dependencies) == 0 {
			return fmt.Errorf("cannot share network namespace with service %s: container missing", name)
		}
		service.NetworkMode = types.ContainerPrefix + dependencies.sorted()[0].ID
	}

	if name := getDependentServiceFromMode(service.Ipc); name != "" {
		dependencies := containersByService[name]
		if len(dependencies) == 0 {
			return fmt.Errorf("cannot share IPC namespace with service %s: container missing", name)
		}
		service.Ipc = types.ContainerPrefix + dependencies.sorted()[0].ID
	}

	if name := getDependentServiceFromMode(service.Pid); name != "" {
		dependencies := containersByService[name]
		if len(dependencies) == 0 {
			return fmt.Errorf("cannot share PID namespace with service %s: container missing", name)
		}
		service.Pid = types.ContainerPrefix + dependencies.sorted()[0].ID

View on GitHub (pinned to ddc4b044b6)

Solutions

Start the provider service too: `docker compose up -d vpn app` (or add depends_on: [vpn])
Diagnose why the provider has no container: `docker compose ps -a vpn`, check image pull and crash logs
Ensure the provider isn't behind an inactive profile, or activate the profile with `--profile`

Example fix

# before
services:
  vpn:
    profile: [net]
  app:
    network_mode: "service:vpn"

# after (activate profile / depends_on)
# docker compose --profile net up -d
services:
  vpn:
    profile: [net]
  app:
    depends_on: [vpn]
    network_mode: "service:vpn"

Defensive patterns

Strategy: validation

Validate before calling

if name := getDependentServiceFromMode(svc.NetworkMode); name != "" {
    if len(containersByService[name]) == 0 {
        return fmt.Errorf("network_mode service:%s has no containers", name)
    }
}

Prevention

Always start namespace-provider services together with dependents (depends_on or explicit up list)
Keep providers out of inactive profiles when dependents reference them via service: modes

When it happens

Trigger: `docker compose up` with `network_mode: "service:vpn"` where the vpn service has no containers — not started, crashed, or excluded from the current selection (e.g. started with an explicit service list that omits it).

Common situations: Sidecar-pattern files (share network with a VPN/proxy container) where the sidecar fails to pull or exits instantly; starting only the dependent service (`docker compose up app`) without its namespace provider; profile-gated providers not activated.

Related errors

AI-assisted analysis of docker/compose@ddc4b044b6 (2026-08-15). Data as JSON: /api/errors/0ca2701d838419cb. Report an issue: GitHub.