docker/compose · error

invalid security-opt: %q

Error message

invalid security-opt: %q

What it means

Error "invalid security-opt: %q" thrown in docker/compose.

Source

Thrown at pkg/compose/create.go:571

// copy/pasted from https://github.com/docker/cli/blob/9de1b162f/cli/command/container/opts.go#L673-L697 + RelativePath
// TODO find so way to share this code with docker/cli
func parseSecurityOpts(p *types.Project, securityOpts []string) ([]string, bool, error) {
	var (
		unconfined bool
		parsed     []string
	)
	for _, opt := range securityOpts {
		if opt == "systempaths=unconfined" {
			unconfined = true
			continue
		}
		con := strings.SplitN(opt, "=", 2)
		if len(con) == 1 && con[0] != "no-new-privileges" {
			if strings.Contains(opt, ":") {
				con = strings.SplitN(opt, ":", 2)
			} else {
				return securityOpts, false, fmt.Errorf("invalid security-opt: %q", opt)
			}
		}
		if con[0] == "seccomp" && con[1] != "unconfined" && con[1] != "builtin" {
			f, err := os.ReadFile(p.RelativePath(con[1]))
			if err != nil {
				return securityOpts, false, fmt.Errorf("opening seccomp profile (%s) failed: %w", con[1], err)
			}
			b := bytes.NewBuffer(nil)
			if err := json.Compact(b, f); err != nil {
				return securityOpts, false, fmt.Errorf("compacting json for seccomp profile (%s) failed: %w", con[1], err)
			}
			parsed = append(parsed, fmt.Sprintf("seccomp=%s", b.Bytes()))
		} else {
			parsed = append(parsed, opt)
		}
	}

	return parsed, unconfined, nil

View on GitHub (pinned to ddc4b044b6)

Solutions

1. Fix the security_opt entry to a valid option such as no-new-privileges:true, seccomp=..., apparmor=..., or label=...
2. Remove the invalid security_opt entry from the compose file.

When it happens

Trigger: A security_opt entry does not follow the expected 'label=value' (or similar key=value) format and cannot be parsed.

Common situations: Missing '=' separator in options such as seccomp, apparmor, no-new-privileges, or label entries under security_opt.

AI-assisted analysis of docker/compose@ddc4b044b6 (2026-08-15). Data as JSON: /api/errors/6241517520b7527a. Report an issue: GitHub.