docker/compose · error

Docker Compose does not support secrets.*.template_driver

Error message

Docker Compose does not support secrets.*.template_driver

What it means

Like configs, secrets with a `template_driver:` require SwarmKit to invoke a driver plugin to render the secret value. Compose's file-based secret delivery has no plugin step, so container creation rejects the service as soon as the secret definition is resolved.

Source

Thrown at pkg/compose/create.go:1226

	secretsDir := "/run/secrets/"
	for _, secret := range s.Secrets {
		target := secret.Target
		if secret.Target == "" {
			target = secretsDir + secret.Source
		} else if !isAbsTarget(secret.Target) {
			target = secretsDir + secret.Target
		}

		definedSecret := p.Secrets[secret.Source]
		if definedSecret.External {
			return nil, fmt.Errorf("unsupported external secret %s", definedSecret.Name)
		}

		if definedSecret.Driver != "" {
			return nil, errors.New("Docker Compose does not support secrets.*.driver") //nolint:staticcheck
		}
		if definedSecret.TemplateDriver != "" {
			return nil, errors.New("Docker Compose does not support secrets.*.template_driver") //nolint:staticcheck
		}

		if definedSecret.Environment != "" {
			continue
		}

		if secret.UID != "" || secret.GID != "" || secret.Mode != nil {
			logrus.Warn("secrets `uid`, `gid` and `mode` are not supported, they will be ignored")
		}

		if _, err := os.Stat(definedSecret.File); os.IsNotExist(err) {
			logrus.Warnf("secret file %s does not exist", definedSecret.Name)
		}

		mnt, err := buildMount(p, types.ServiceVolumeConfig{
			Type:     types.VolumeTypeBind,
			Source:   definedSecret.File,
			Target:   target,

View on GitHub (pinned to ddc4b044b6)

Solutions

1. Pre-render the templated secret to a static file and reference it with `file:`
2. Strip Swarm-only keys into a stack-specific override file used only with docker stack deploy
3. Move dynamic values to `environment:` interpolation instead of secret templates

Example fix

# before
secrets:
  app-tls:
    template_driver: golang
    file: ./tls.tmpl
# after
secrets:
  app-tls:
    file: ./tls-rendered.pem

python3 - <<'EOF'
import yaml,sys
cfg=yaml.safe_load(open('compose.yaml'))
for n,s in (cfg.get('secrets') or {}).items():
    if 'template_driver' in s: sys.exit(f"secret {n} uses unsupported template_driver")
print('ok')
EOF

When it happens

Trigger: Top-level secrets entry containing `template_driver:` (e.g. template_driver: golang) used by a service during compose up/create.

Common situations: Templated secrets from Swarm stacks ({{.Task.Slot}} style templates) reused in compose; local dev against a Swarm-designed compose file.

Related errors

• Docker Compose does not support secrets.*.driver
• Docker Compose does not support configs.*.driver
• Docker Compose does not support configs.*.template_driver
• unsupported external secret %s
• cannot publish compose file with local includes

AI-assisted analysis of docker/compose@ddc4b044b6 (2026-08-15). Data as JSON: /api/errors/6375f7f2256bbbbf. Report an issue: GitHub.