docker/compose · error

unexpected git command output: %q

Error message

unexpected git command output: %q

What it means

`git ls-remote` exited 0 (ref found) but produced fewer than 40 bytes of output, too short to contain a commit SHA. The loader expects `<40-hex-sha>\t<ref>` lines and treats shorter output as protocol corruption rather than guessing.

Source

Thrown at pkg/remote/git.go:184

		return fmt.Errorf("git subdirectory escapes base directory: %s", subDir)
	}

	return nil
}

func (g gitRemoteLoader) resolveGitRef(ctx context.Context, path string, ref *gitutil.GitRef) error {
	if !commitSHA.MatchString(ref.Ref) {
		cmd := exec.CommandContext(ctx, "git", "ls-remote", "--exit-code", ref.Remote, ref.Ref)
		cmd.Env = g.gitCommandEnv()
		out, err := cmd.CombinedOutput()
		if err != nil {
			if cmd.ProcessState.ExitCode() == 2 {
				return fmt.Errorf("repository does not contain ref %s, output: %q: %w", path, string(out), err)
			}
			return fmt.Errorf("failed to access repository at %s:\n %s", ref.Remote, out)
		}
		if len(out) < 40 {
			return fmt.Errorf("unexpected git command output: %q", string(out))
		}
		sha := string(out[:40])
		if !commitSHA.MatchString(sha) {
			return fmt.Errorf("invalid commit sha %q", sha)
		}
		ref.Ref = sha
	}
	return nil
}

func (g gitRemoteLoader) checkout(ctx context.Context, path string, ref *gitutil.GitRef) error {
	err := os.MkdirAll(path, 0o700)
	if err != nil {
		return err
	}
	err = exec.CommandContext(ctx, "git", "init", path).Run()
	if err != nil {
		return err

View on GitHub (pinned to ddc4b044b6)

Solutions

1. Run `git ls-remote <remote> <ref>` manually and inspect the raw output length/content
2. Bypass resolution by pinning the include to a 40-char commit SHA (`#<sha>` skips ls-remote)
3. Fix the proxy/server that is truncating git protocol responses

Example fix

# before
include:
  - path: git://git.internal.corp/repo.git#main

# after (pin SHA, skips ls-remote)
include:
  - path: git://git.internal.corp/repo.git#1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b

# sanity-check the server emits a parseable sha line
git ls-remote https://git.internal.corp/repo.git HEAD | head -c40 | grep -qE '^[a-f0-9]{40}$' \
  || echo "WARNING: git server output not SHA-prefixed; pin SHAs in includes"

When it happens

Trigger: A git server or proxy returning an empty/truncated response; unusual git server implementations; output mangled by a wrapper or `GIT_EXTERNAL` tooling in `gitCommandEnv`. Extremely rare with standard git hosts.

Common situations: Self-hosted git servers with non-standard smart-HTTP behavior; broken proxies stripping response bodies; intermediary antivirus rewriting output.

Related errors

• invalid commit sha %q
• COMPOSE_EXPERIMENTAL_GIT_REMOTE environment variable expects
• git remote resource is disabled by %q
• initializing remote resource cache: %w
• git subdirectory must be relative, got: %s

AI-assisted analysis of docker/compose@ddc4b044b6 (2026-08-15). Data as JSON: /api/errors/4b703ba17afac8ea. Report an issue: GitHub.