Docker Compose external secrets gives "unsupported external secret"

[hoshsadiq]

Issue Description

When using a Docker Compose file with secrets configured as external (using external: true), Docker Compose returns an error:

unsupported external secret

Steps to reproduce the issue

Steps to reproduce the issue

1. $ cat <<'EOF' > docker-compose.yml
   services:
     postgres:
       image: postgres:latest
       secrets:
         - postgres_admin_password
   
   secrets:
     postgres_admin_password:
       external: true
   EOF
   

2. $ echo "test" | podman secret create postgres_admin_password -
   

3. $ docker compose up
   

Describe the results you received

I get an error:

$ docker compose up
[+] Running 0/1
 ⠙ Container wot-postgres-1  Creating                                                                                                                                            1.1s
unsupported external secret postgres_admin_password

Describe the results you expected

The desired behaviour is to have the container created, and an externally managed secret to be added, similar to Docker Swarm’s functionality.

podman info output

host:
  arch: amd64
  buildahVersion: 1.39.4
  cgroupControllers:
  - cpu
  - io
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-2.1.13-1.fc41.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.13, commit: '
  cpuUtilization:
    idlePercent: 90.9
    systemPercent: 2.06
    userPercent: 7.04
  cpus: 20
  databaseBackend: boltdb
  distribution:
    distribution: fedora
    variant: kde
    version: "41"
  eventLogger: journald
  freeLocks: 2003
  hostname: fedora-laptop
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 524288
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 524288
      size: 65536
  kernel: 6.13.9-200.fc41.x86_64
  linkmode: dynamic
  logDriver: journald
  memFree: 928440320
  memTotal: 33282330624
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: aardvark-dns-1.14.0-1.fc41.x86_64
      path: /usr/libexec/podman/aardvark-dns
      version: aardvark-dns 1.14.0
    package: netavark-1.14.1-1.fc41.x86_64
    path: /usr/libexec/podman/netavark
    version: netavark 1.14.1
  ociRuntime:
    name: crun
    package: crun-1.21-1.fc41.x86_64
    path: /usr/bin/crun
    version: |-
      crun version 1.21
      commit: 10269840aa07fb7e6b7e1acff6198692d8ff5c88
      rundir: /run/user/1000/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +WASM:wasmedge +YAJL
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt-0^20250320.g32f6212-2.fc41.x86_64
    version: ""
  remoteSocket:
    exists: true
    path: /run/user/1000/podman/podman.sock
  rootlessNetworkCmd: pasta
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: true
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.3.1-1.fc41.x86_64
    version: |-
      slirp4netns version 1.3.1
      commit: e5e368c4f5db6ae75c2fce786e31eef9da6bf236
      libslirp: 4.8.0
      SLIRP_CONFIG_VERSION_MAX: 5
      libseccomp: 2.5.5
  swapFree: 31696281600
  swapTotal: 34359734272
  uptime: 4h 51m 45.00s (Approximately 0.17 days)
  variant: ""
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - registry.fedoraproject.org
  - registry.access.redhat.com
  - docker.io
store:
  configFile: /home/hsadiq/.config/containers/storage.conf
  containerStore:
    number: 23
    paused: 0
    running: 0
    stopped: 23
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /home/hsadiq/.local/share/containers/storage
  graphRootAllocated: 1022488477696
  graphRootUsed: 265888624640
  graphStatus:
    Backing Filesystem: btrfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Supports shifting: "false"
    Supports volatile: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 362
  runRoot: /run/user/1000/containers
  transientStore: false
  volumePath: /home/hsadiq/.local/share/containers/storage/volumes
version:
  APIVersion: 5.4.2
  BuildOrigin: Fedora Project
  Built: 1743552000
  BuiltTime: Wed Apr  2 01:00:00 2025
  GitCommit: be85287fcf4590961614ee37be65eeb315e5d9ff
  GoVersion: go1.23.7
  Os: linux
  OsArch: linux/amd64
  Version: 5.4.2

Podman in a container

No

Privileged Or Rootless

Rootless

Upstream Latest Release

Yes

Additional environment details

N/A

Additional information

N/A

[hoshsadiq]

I image this can also possibly be an error the compose returns. But unsure. For context, I'm running docker compose version:

$ docker compose version
Docker Compose version v2.29.1

[mheon]

That error string does not appear anywhere in Podman, but that does not mean it's not a Podman issue. I suspect it's a gap in our secrets support versus Docker.

[hoshsadiq]

Actually, this seems to be a limitation in docker compose. I should have looked before. Also tested it out on docker, and seems to be the same issue. Going to close this since Podman can't do anything about this.