docker/compose · error

failed to scan config file %s: %w

Error message

failed to scan config file %s: %w

What it means

The pre-publish secret scan failed reading a top-level config entry defined by file (configs.<name>.file). Compose scans config file contents for leaked secrets before publishing; a ScanFile error aborts.

Source

Thrown at pkg/compose/publish.go:728

				if envFile.Required {
					return nil, fmt.Errorf("env file %s not found", envFile.Path)
				}
				continue
			}
			findings, err := scan.ScanFile(envFile.Path)
			if err != nil {
				return nil, fmt.Errorf("failed to scan env file %s: %w", envFile.Path, err)
			}
			allFindings = append(allFindings, findings...)
		}
	}

	// Check configs defined by files
	for _, config := range project.Configs {
		if config.File != "" {
			findings, err := scan.ScanFile(config.File)
			if err != nil {
				return nil, fmt.Errorf("failed to scan config file %s: %w", config.File, err)
			}
			allFindings = append(allFindings, findings...)
		}
	}

	// Check secrets defined by files
	for _, secret := range project.Secrets {
		if secret.File != "" {
			findings, err := scan.ScanFile(secret.File)
			if err != nil {
				return nil, fmt.Errorf("failed to scan secret file %s: %w", secret.File, err)
			}
			allFindings = append(allFindings, findings...)
		}
	}

	return allFindings, nil
}

View on GitHub (pinned to ddc4b044b6)

Solutions

1. Confirm the file referenced by configs.<name>.file exists and is readable by the publishing user.
2. Generate or copy the config file before publishing (add it to the CI pipeline ahead of the publish step).
3. Fix the path — for mount-relative configs ensure it resolves from the project directory as expected.
4. If the config content is meant to travel with the artifact, use inline content: instead of file:.

Example fix

# before
configs:
  nginx-conf:
    file: /etc/nginx/nginx.conf   # absent or unreadable in CI

# after
configs:
  nginx-conf:
    file: ./nginx/nginx.conf       # tracked, readable file

func configFilesPresent(project *types.Project) error {
	for name, cfg := range project.Configs {
		if cfg.File == "" {
			continue
		}
		if fi, err := os.Stat(cfg.File); err != nil || !fi.Mode().IsRegular() {
			return fmt.Errorf("config %s file %q missing or not a regular file", name, cfg.File)
		}
	}
	return nil
}

if err := publish(ctx, opts); err != nil {
    if strings.Contains(err.Error(), "failed to scan config file") {
        // materialize the config file, fix its path, retry
    }
    return err
}

When it happens

Trigger: Publishing a project with a configs: section where config.File points to an unreadable path, a directory, a dangling symlink, or a file that yields an I/O error during read.

Common situations: Config file outside the repo (template generated at deploy time) so CI lacks it; path typos; permission-restricted files; config file replaced concurrently.

Related errors

• failed to scan env file %s: %w
• failed to scan secret file %s: %w
• failed to scan compose file %s: %w
• failed to access env file %s: %w
• failed to load compose file %s: %w

AI-assisted analysis of docker/compose@ddc4b044b6 (2026-08-15). Data as JSON: /api/errors/caf9784855a01132. Report an issue: GitHub.