containers / containers/podman-compose

podman-compose does not support mounting external secrets (works with plain podman run)

Open
#1,293 1 comment 8 reactions 0 assignees View on GitHub
bug
Dominant language
Python
Stars
6.2k
Forks
622
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**

When trying to use secrets with podman-compose, I get an error even though the same thing works fine with podman run.

**To Reproduce**

`test-alpine.yml`
```yaml
services:
alpine_secret:
image: alpine:latest
secrets:
- source: ssh-private-key
target: /tmp/private_key
mode: 700
uid: 600
gid: 600
entrypoint: ["sh", "-c", "ls -alh /tmp && cat /tmpt/secret_key"]

secrets:
ssh-private-key:
external: true
```
```sh
podman compose -f test-alpine.yml up
```

Error output
```
>>>> Executing external compose provider "/home/vagrant/.local/bin/podman-compose". Please see podman-compose(1) for how to disable this message. <<<<

Error: no container with name or ID "vagrant_alpine_secret_1" found: no such container
Error: no container with ID or name "vagrant_alpine_secret_1" found: no such container
Error: not all containers could be removed from pod ...
...
ValueError: ERROR: Custom name/target reference "/tmp/secret_key" for mounted external secret "secret_key" is not supported
Error: executing /home/vagrant/.local/bin/podman-compose -f test-alpine.yml up: exit status 1
```

What works with plain podman

This works fine when using podman run directly:

```sh
podman run -it --rm \
--secret=ssh-private-key,uid=600,gid=600,mode=700,type=mount,target=/tmp/private_key \
alpine:latest sh -c "ls -alh /tmp && cat /tmp/private_key"
```

Output

```
-rwx------ 1 600 600 411 Aug 19 14:38 private_key
-----BEGIN OPENSSH PRIVATE KEY-----
...
-----END OPENSSH PRIVATE KEY-----
```

**Environment:**

```
$ podman-compose version
podman-compose version 1.5.0
podman version 5.4.0

$ podman version
Client: Podman Engine
Version: 5.4.0
API Version: 5.4.0
Go Version: go1.23.9 (Red Hat 1.23.9-1.el9_6)
Built: Tue Jul 8 03:48:42 2025
OS/Arch: linux/amd64

$ hostnamectl

Static hostname: sipa
Icon name: computer-vm
Chassis: vm 🖴
Machine ID: b9ca0673f9d446d9bedbf42499ce723e
Boot ID: 58018b3af1b7480b9938c93a99c26466
Virtualization: kvm
Operating System: AlmaLinux 9.6 (Sage Margay)
CPE OS Name: cpe:/o:almalinux:almalinux:9::baseos
Kernel: Linux 5.14.0-570.33.2.el9_6.x86_64
Architecture: x86-64
Hardware Vendor: QEMU
Hardware Model: Ubuntu 24.04 PC _i440FX + PIIX, 1996_
Firmware Version: 1.16.3-debian-1.16.3-2
```

**Additional information**

I suppose the problem comes from https://github.com/containers/podman-compose/blob/main/podman_compose.py#L703. I can prepare a MR to fix the condition.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.