What causes "failed to scan compose file %s: %w" in docker/compose?

Run docker compose config on the same file set to confirm the files parse and serialize without errors.

failed to scan compose file %s: %w

Error message

failed to scan compose file %s: %w

What it means

Thrown by checkForSensitiveData when the secret scanner fails while reading a compose file's re-serialized YAML content. The compose file is loaded unresolved, marshalled back to YAML, and fed to ScanReader; any scanner-level failure (malformed input, reader error) produces this wrapped error.

Source

Thrown at pkg/compose/publish.go:699

			allFindings[serviceName] = bindMounts
		}
	}
	return allFindings
}

func (s *composeService) checkForSensitiveData(ctx context.Context, project *types.Project) ([]secrets.DetectedSecret, error) {
	var allFindings []secrets.DetectedSecret
	scan := scanner.NewDefaultScanner()
	// Check all compose files
	for _, file := range project.ComposeFiles {
		in, err := composeFileAsByteReader(ctx, file, project)
		if err != nil {
			return nil, err
		}

		findings, err := scan.ScanReader(in)
		if err != nil {
			return nil, fmt.Errorf("failed to scan compose file %s: %w", file, err)
		}
		allFindings = append(allFindings, findings...)
	}
	for _, service := range project.Services {
		// Check env files
		for _, envFile := range service.EnvFiles {
			if _, statErr := os.Stat(envFile.Path); statErr != nil {
				if !os.IsNotExist(statErr) {
					return nil, fmt.Errorf("failed to access env file %s: %w", envFile.Path, statErr)
				}
				if envFile.Required {
					return nil, fmt.Errorf("env file %s not found", envFile.Path)
				}
				continue
			}
			findings, err := scan.ScanFile(envFile.Path)
			if err != nil {
				return nil, fmt.Errorf("failed to scan env file %s: %w", envFile.Path, err)

View on GitHub (pinned to ddc4b044b6)

Solutions

Run docker compose config on the same file set to confirm the files parse and serialize without errors.
Simplify the constructs in the failing file (custom tags, anchors/aliases, merge keys) that may not round-trip through the loader.
Check scanner/CLI version compatibility — update docker compose to the latest release in case the marshalling/scanner pair has a known bug.
If the file is machine-generated, regenerate it with clean YAML.

Defensive patterns

Strategy: try-catch

Try / catch

res, err := publish(ctx, opts)
if err != nil && strings.Contains(err.Error(), "failed to scan compose file") {
    // run docker compose config to find the offending construct, simplify YAML, retry
    return handleScanFailure(err)
}

Prevention

Prefer plain YAML constructs; avoid exotic tags and deep alias chains in files destined for publish.
Machine-generate compose files with a stable serializer and validate round-tripping in CI.
Keep docker compose updated to pick up loader/scanner fixes.

When it happens

Trigger: Publishing a project where ScanReader returns an error on one of project.ComposeFiles — typically YAML that cannot be re-marshalled cleanly or content that breaks the scanner's parser.

Common situations: Unusual or malformed YAML constructs that parse individually but fail re-serialization, binary junk in a compose file, or corrupted files on disk. Rare in practice; most malformed YAML is caught earlier by the loader.

Related errors

AI-assisted analysis of docker/compose@ddc4b044b6 (2026-08-15). Data as JSON: /api/errors/2da171cb928e69ca. Report an issue: GitHub.