[BUG] error decoding: invalid label ["backup"] in Docker Compose version v2.24.1

[modem7]

Description

Since upgrading to v2.24.1 from v2.21.0, I'm having issues with labels.

1 error(s) decoding:

* error decoding 'services[ntp].labels': invalid label ["autoheal=true" "backup"]

On my larger config, the issue is worse:

28 error(s) decoding:

* error decoding 'services[authentikserver].labels': invalid label ["backup" "autoheal=true" "traefik.enable=true" "traefik.http.routers.authentik-rtr.entrypoints=https" "traefik.http.routers.authentik-rtr.rule=Host(`authentik.mydomain.com`)" "traefik.http.routers.authentik-rtr.tls=true" "traefik.http.routers.authentik-rtr.priority=99" "traefik.http.routers.authentik-rtr.middlewares=chain-no-auth@file" "traefik.http.routers.authentik-rtr.service=authentik-svc" "traefik.http.services.authentik-svc.loadbalancer.server.port=9000" "homepage.name=Authentik" "homepage.group=System" "homepage.icon=authentik" "homepage.href=https://authentik.mydomain.com"]
* error decoding 'services[autoheal].labels': invalid label ["backup"]
* error decoding 'services[bazarr].labels': invalid label ["backup" "autoheal=true" "traefik.enable=true" "traefik.http.routers.bazarr-rtr-bypass.entrypoints=https" "traefik.http.routers.bazarr-rtr-bypass.rule=Host(`bazarr.mydomain.com`) && (Headers(`X-Api-Key`, `2381d2e5307d03d338403a6f513cb0d7`) || Query(`apikey`, `2381d2e5307d03d338403a6f513cb0d7`))" "traefik.http.routers.bazarr-rtr-bypass.priority=100" "traefik.http.routers.bazarr-rtr-bypass.tls=true" "traefik.http.routers.bazarr-rtr.entrypoints=https" "traefik.http.routers.bazarr-rtr.rule=Host(`bazarr.mydomain.com`)" "traefik.http.routers.bazarr-rtr.priority=99" "traefik.http.routers.bazarr-rtr.tls=true" "traefik.http.routers.bazarr-rtr-bypass.middlewares=chain-no-auth@file" "traefik.http.routers.bazarr-rtr.middlewares=chain-oauth-admins@file" "traefik.http.routers.bazarr-rtr.service=bazarr-svc" "traefik.http.services.bazarr-svc.loadbalancer.server.port=6767" "homepage.name=Bazarr" "homepage.group=Media Management" "homepage.icon=bazarr" "homepage.href=https://bazarr.mydomain.com" "homepage.widget.type=bazarr" "homepage.widget.url=http://bazarr:6767" "homepage.widget.key=2381d2e5307d03d338403a6f513cb0d7"]
* error decoding 'services[bitwarden].labels': invalid label ["backup" "autoheal=true" "traefik.enable=true" "traefik.http.routers.bitwarden-rtr.entrypoints=https" "traefik.http.routers.bitwarden-admin.entrypoints=https" "traefik.http.routers.bitwarden-rtr.rule=Host(`bitwarden.mydomain.com`)" "traefik.http.routers.bitwarden-admin.rule=Host(`bitwarden.mydomain.com`) && Path(`/admin`)" "traefik.http.routers.bitwarden-rtr.tls=true" "traefik.http.routers.bitwarden-admin.tls=true" "traefik.http.routers.bitwarden-admin.middlewares=chain-oauth-admins@file" "traefik.http.routers.bitwarden-rtr.middlewares=chain-no-auth@file" "traefik.http.routers.bitwarden-rtr.service=bitwarden-svc" "traefik.http.routers.bitwarden-admin.service=bitwarden-admin-svc" "traefik.http.services.bitwarden-svc.loadbalancer.server.port=80" "traefik.http.services.bitwarden-admin-svc.loadbalancer.server.port=80" "homepage.name=Bitwarden" "homepage.group=System" "homepage.icon=bitwarden" "homepage.href=https://bitwarden.mydomain.com"]
* error decoding 'services[bookstack].labels': invalid label ["backup" "autoheal=true" "traefik.enable=true" "traefik.http.routers.bookstack-rtr.entrypoints=https" "traefik.http.routers.bookstack-rtr.rule=Host(`bookstack.mydomain.com`) || Host(`omegawiki.mydomain.com`) || Host(`www.mydomain.com`) || Host(`mydomain.com`)" "traefik.http.routers.bookstack-rtr.middlewares=chain-no-auth@file" "traefik.http.middlewares.bookstack-redirect.redirectregex.regex=^https?://mydomain.com/(.*)" "traefik.http.middlewares.bookstack-redirect.redirectregex.replacement=https://www.mydomain.com/${1}" "traefik.http.middlewares.bookstack-redirect.redirectregex.permanent=true" "traefik.http.routers.bookstack-rtr.service=bookstack-svc" "traefik.http.services.bookstack-svc.loadbalancer.server.port=80" "homepage.name=Bookstack" "homepage.group=Tools" "homepage.icon=bookstack" "homepage.href=https://mydomain.com"]
* error decoding 'services[bookstackdb].labels': invalid label ["backup" "autoheal=true"]
* error decoding 'services[cloudflare-bouncer].labels': invalid label ["backup"]
* error decoding 'services[crowdsec].labels': invalid label ["backup" "homepage.name=Crowdsec" "homepage.group=System" "homepage.icon=crowdsec" "homepage.href=https://app.crowdsec.net/security-engines"]
* error decoding 'services[grafana].labels': invalid label ["backup" "autoheal=true" "traefik.enable=true" "traefik.http.routers.grafana-rtr.entrypoints=https" "traefik.http.routers.grafana-rtr.rule=Host(`grafana.mydomain.com`)" "traefik.http.routers.grafana-rtr.tls=true" "traefik.http.routers.grafana-rtr.middlewares=chain-no-auth@file" "traefik.http.routers.grafana-rtr.service=grafana-svc" "traefik.http.services.grafana-svc.loadbalancer.server.port=3000" "homepage.name=Grafana" "homepage.group=System" "homepage.icon=grafana" "homepage.href=https://grafana.mydomain.com"]
* error decoding 'services[influxdb].labels': invalid label ["backup" "autoheal=true"]
* error decoding 'services[keycloak].labels': invalid label ["backup" "autoheal=true" "traefik.enable=true" "traefik.http.routers.keycloak-rtr.entrypoints=https" "traefik.http.routers.keycloak-rtr.rule=Host(`auth.mydomain.com`)" "traefik.http.routers.keycloak-rtr.tls=true" "traefik.http.routers.keycloak-rtr.priority=99" "traefik.http.routers.keycloak-rtr.middlewares=chain-no-auth@file" "traefik.http.routers.keycloak-rtr.service=keycloak-svc" "traefik.http.services.keycloak-svc.loadbalancer.server.port=8080" "homepage.name=Keycloak" "homepage.group=System" "homepage.icon=keycloak" "homepage.href=https://auth.mydomain.com/admin"]
* error decoding 'services[keycloakdb].labels': invalid label ["backup" "autoheal=true"]
* error decoding 'services[monocker].labels': invalid label ["backup"]
* error decoding 'services[oauth2proxyadmins].labels': invalid label ["backup" "traefik.enable=true" "traefik.http.routers.oauth2-rtr.entrypoints=https" "traefik.http.routers.oauth2-rtr.rule=Host(`oauth.mydomain.com`)" "traefik.http.routers.oauth2-rtr.tls=true" "traefik.http.routers.oauth2-rtr.service=oauth2-svc@docker" "traefik.http.services.oauth2-svc.loadbalancer.server.port=4180" "traefik.http.routers.oauth2-rtr.middlewares=chain-no-auth@file"]
* error decoding 'services[oauth2proxyusers].labels': invalid label ["backup" "traefik.enable=true" "traefik.http.routers.oauth2-rtr.entrypoints=https" "traefik.http.routers.oauth2-rtr.rule=Host(`oauth.mydomain.com`)" "traefik.http.routers.oauth2-rtr.tls=true" "traefik.http.routers.oauth2-rtr.service=oauth2-svc@docker" "traefik.http.services.oauth2-svc.loadbalancer.server.port=4180" "traefik.http.routers.oauth2-rtr.middlewares=chain-no-auth@file"]
* error decoding 'services[overseer].labels': invalid label ["backup" "autoheal=true" "traefik.enable=true" "traefik.http.routers.overseer-rtr.entrypoints=https" "traefik.http.routers.overseer-rtr.rule=Host(`overseer.mydomain.com`)" "traefik.http.routers.overseer-rtr.tls=true" "traefik.http.routers.overseer-rtr.middlewares=chain-no-auth@file" "traefik.http.routers.overseer-rtr.service=overseer-svc" "traefik.http.services.overseer-svc.loadbalancer.server.port=5055" "homepage.name=Overseer" "homepage.group=Media" "homepage.icon=overseerr" "homepage.href=https://overseer.mydomain.com" "homepage.widget.type=overseerr" "homepage.widget.url=http://overseer:5055" "homepage.widget.key=MTYwODQyODYxMTkxMTMyZjM5NmZkLWU5ODgtNDg4My04M2ZjLTIxNWJjYmRiMDMzYSk="]
* error decoding 'services[plex].labels': invalid label ["backup" "autoheal=true" "traefik.enable=true" "traefik.http.routers.plexms-rtr.entrypoints=https" "traefik.http.routers.plexms-rtr.rule=Host(`plex.mydomain.com`)" "traefik.http.routers.plexms-rtr.middlewares=chain-no-auth@file" "traefik.http.routers.plexms-rtr.service=plexms-svc" "traefik.http.services.plexms-svc.loadbalancer.server.port=32400" "homepage.name=Plex" "homepage.group=Media" "homepage.icon=https://raw.githubusercontent.com/modem7/MiscAssets/master/Icons/HeimdallIcons/plex.png" "homepage.href=https://plex.mydomain.com" "homepage.widget.type=plex" "homepage.widget.url=http://plex:32400" "homepage.widget.key=563tXXC-stMHPtPPsnyU"]
* error decoding 'services[prowlarr].labels': invalid label ["backup" "autoheal=true" "traefik.enable=true" "traefik.http.routers.prowlarr-rtr-bypass.entrypoints=https" "traefik.http.routers.prowlarr-rtr-bypass.rule=Host(`prowlarr.mydomain.com`) && (Headers(`X-Api-Key`, `aef894ad351c46da82da51dbd23c3bad`) || Query(`apikey`, `aef894ad351c46da82da51dbd23c3bad`))" "traefik.http.routers.prowlarr-rtr-bypass.priority=100" "traefik.http.routers.prowlarr-rtr-ping.entrypoints=https" "traefik.http.routers.prowlarr-rtr-ping.rule=Host(`prowlarr.mydomain.com`) && Path(`/ping`)" "traefik.http.routers.prowlarr-rtr-ping.priority=99" "traefik.http.routers.prowlarr-rtr.entrypoints=https" "traefik.http.routers.prowlarr-rtr.rule=Host(`prowlarr.mydomain.com`)" "traefik.http.routers.prowlarr-rtr.priority=98" "traefik.http.routers.prowlarr-rtr-bypass.middlewares=chain-no-auth@file" "traefik.http.routers.prowlarr-rtr-ping.middlewares=chain-no-auth@file" "traefik.http.routers.prowlarr-rtr.middlewares=chain-oauth-admins@file" "traefik.http.routers.prowlarr-rtr.service=prowlarr-svc" "traefik.http.routers.prowlarr-rtr-bypass.service=prowlarr-svc" "traefik.http.routers.prowlarr-rtr-ping.service=prowlarr-svc" "traefik.http.services.prowlarr-svc.loadbalancer.server.port=9696" "homepage.name=Prowlarr" "homepage.group=Download + Search" "homepage.icon=prowlarr" "homepage.href=https://prowlarr.mydomain.com" "homepage.widget.type=prowlarr" "homepage.widget.url=http://prowlarr:9696" "homepage.widget.key=aef894ad351c46da82da51dbd23c3bad"]
* error decoding 'services[radarr].labels': invalid label ["backup" "autoheal=true" "traefik.enable=true" "traefik.http.routers.radarr-rtr-bypass.entrypoints=https" "traefik.http.routers.radarr-rtr-bypass.rule=Host(`radarr.mydomain.com`) && (Headers(`X-Api-Key`, `e65338f8d66b44099349ffe01dfe2c55`) || Query(`apikey`, `e65338f8d66b44099349ffe01dfe2c55`))" "traefik.http.routers.radarr-rtr-bypass.priority=100" "traefik.http.routers.radarr-rtr.entrypoints=https" "traefik.http.routers.radarr-rtr.rule=Host(`radarr.mydomain.com`)" "traefik.http.routers.radarr-rtr.priority=99" "traefik.http.routers.radarr-rtr-bypass.middlewares=chain-no-auth@file" "traefik.http.routers.radarr-rtr.middlewares=chain-authentik@file" "traefik.http.routers.radarr-rtr.service=radarr-svc" "traefik.http.routers.radarr-rtr-bypass.service=radarr-svc" "traefik.http.services.radarr-svc.loadbalancer.server.port=7878" "homepage.name=Radarr" "homepage.group=Media Management" "homepage.icon=radarr" "homepage.href=https://radarr.mydomain.com" "homepage.widget.type=radarr" "homepage.widget.url=http://radarr:7878" "homepage.widget.key=e65338f8d66b44099349ffe01dfe2c55"]
* error decoding 'services[sonarr].labels': invalid label ["backup" "autoheal=true" "traefik.enable=true" "traefik.http.routers.sonarr-rtr-bypass.entrypoints=https" "traefik.http.routers.sonarr-rtr-bypass.rule=Host(`sonarr.mydomain.com`) && (Headers(`X-Api-Key`, `305e032974834e6482702bd70edbd5d1`) || Query(`apikey`, `305e032974834e6482702bd70edbd5d1`))" "traefik.http.routers.sonarr-rtr-bypass.priority=100" "traefik.http.routers.sonarr-rtr.entrypoints=https" "traefik.http.routers.sonarr-rtr.rule=Host(`sonarr.mydomain.com`)" "traefik.http.routers.sonarr-rtr.priority=98" "traefik.http.routers.sonarr-rtr-bypass.middlewares=chain-no-auth@file" "traefik.http.routers.sonarr-rtr.middlewares=chain-authentik@file" "traefik.http.routers.sonarr-rtr.service=sonarr-svc" "traefik.http.routers.sonarr-rtr-bypass.service=sonarr-svc" "traefik.http.services.sonarr-svc.loadbalancer.server.port=8989" "homepage.name=Sonarr" "homepage.group=Media Management" "homepage.icon=sonarr" "homepage.href=https://sonarr.mydomain.com" "homepage.widget.type=sonarr" "homepage.widget.url=http://sonarr:8989" "homepage.widget.key=305e032974834e6482702bd70edbd5d1"]
* error decoding 'services[speedtest].labels': invalid label ["backup" "autoheal=true" "traefik.enable=true" "traefik.http.routers.speedtest-rtr.entrypoints=https" "traefik.http.routers.speedtest-rtr.rule=Host(`speedtest.mydomain.com`)" "traefik.http.routers.speedtest-rtr.tls=true" "traefik.http.routers.speedtest-rtr.middlewares=chain-no-auth@file" "traefik.http.routers.speedtest-rtr.service=speedtest-svc" "traefik.http.services.speedtest-svc.loadbalancer.server.port=80" "homepage.name=Speedtest Tracker" "homepage.group=System" "homepage.icon=openspeedtest" "homepage.href=https://speedtest.mydomain.com" "homepage.widget.type=speedtest" "homepage.widget.url=http://speedtest"]
* error decoding 'services[spotify].labels': invalid label ["backup" "autoheal=true" "traefik.enable=true" "traefik.http.routers.spotify-rtr.entrypoints=https" "traefik.http.routers.spotify-rtr.rule=Host(`spotify.mydomain.com`)" "traefik.http.routers.spotify-rtr.tls=true" "traefik.http.routers.spotify-rtr.middlewares=chain-no-auth@file" "traefik.http.routers.spotify-rtr.service=spotify-svc" "traefik.http.services.spotify-svc.loadbalancer.server.port=80" "homepage.name=Spotify" "homepage.group=Other" "homepage.icon=https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/your_spotify-logo.png" "homepage.href=https://spotify.mydomain.com"]
* error decoding 'services[tautulli].labels': invalid label ["backup" "autoheal=true" "traefik.enable=true" "traefik.http.routers.tautulli-rtr.entrypoints=https" "traefik.http.routers.tautulli-rtr.rule=Host(`tautulli.mydomain.com`)" "traefik.http.routers.tautulli-rtr.tls=true" "traefik.http.routers.tautulli-rtr.middlewares=chain-no-auth@file" "traefik.http.routers.tautulli-rtr.service=tautulli-svc" "traefik.http.services.tautulli-svc.loadbalancer.server.port=8181" "homepage.name=Tautulli" "homepage.group=Media" "homepage.icon=tautulli" "homepage.href=https://tautulli.mydomain.com" "homepage.widget.type=tautulli" "homepage.widget.url=http://tautulli:8181/tautulli" "homepage.widget.key=669aee4bab1f43d2b658ef4a9516c845"]
* error decoding 'services[tdarr].labels': invalid label ["backup" "autoheal=true" "traefik.enable=true" "traefik.http.routers.tdarr-rtr.entrypoints=https" "traefik.http.routers.tdarr-rtr.rule=Host(`tdarr.mydomain.com`)" "traefik.http.routers.tdarr-rtr.tls=true" "traefik.http.routers.tdarr-rtr.middlewares=chain-oauth-admins@file" "traefik.http.routers.tdarr-rtr.service=tdarr-svc" "traefik.http.services.tdarr-svc.loadbalancer.server.port=8265" "homepage.name=Tdarr" "homepage.group=Media Management" "homepage.icon=tdarr" "homepage.href=http://hda:8265" "homepage.widget.type=tdarr" "homepage.widget.url=http://tdarr:8265"]
* error decoding 'services[telegraf].labels': invalid label ["backup"]
* error decoding 'services[timetagger].labels': invalid label ["backup" "autoheal=true" "traefik.enable=true" "traefik.http.routers.timetagger-rtr.entrypoints=https" "traefik.http.routers.timetagger-rtr.rule=Host(`time.mydomain.com`)" "traefik.http.routers.timetagger-rtr.tls=true" "traefik.http.routers.timetagger-rtr.middlewares=chain-no-auth@file" "traefik.http.routers.timetagger-rtr.service=timetagger-svc" "traefik.http.services.timetagger-svc.loadbalancer.server.port=80" "homepage.name=Timetagger" "homepage.group=Other" "homepage.icon=timetagger-light" "homepage.href=https://time.mydomain.com"]
* error decoding 'services[traefik-bouncer].labels': invalid label ["backup"]
* error decoding 'services[varken].labels': invalid label ["backup"]

Tried it on multiple different configs, and there definitely seems to be an issue with labels

Steps To Reproduce

 #######
 ##NTP##
 #######

  ntp:
    image: cturra/ntp:latest
    container_name: NTP
    hostname: NTP-Slave
    restart: always
    network_mode: "host"
    read_only: true
    tmpfs:
      - /etc/chrony:rw,mode=1750
      - /run/chrony:rw,mode=1750
      - /var/lib/chrony:rw,mode=1750
    environment:
      - NTP_SERVERS="time.cloudflare.com,uk.pool.ntp.org,ntp.my-inbox.co.uk,ntp2.ja.net,ubnt.pool.ntp.org"
    labels: 
      - "autoheal=true"
      - backup
    logging:
      driver: "local"
      options:
        max-size: 10m
        max-file: "3"
    depends_on:
      - pihole
    mem_limit: 50m

docker compose --project-directory /mnt/docker/HDA up -d --remove-orphans

Compose Version

Docker Compose version v2.24.1

Docker Environment

Client: Docker Engine - Community
 Version:    25.0.0
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.12.1
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.24.1
    Path:     /usr/libexec/docker/cli-plugins/docker-compose
  sbom: View the packaged-based Software Bill Of Materials (SBOM) for an image (Anchore Inc.)
    Version:  0.6.1
    Path:     /home/alex/.docker/cli-plugins/docker-sbom

Server:
 Containers: 60
  Running: 60
  Paused: 0
  Stopped: 0
 Images: 55
 Server Version: 25.0.0
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: local
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 Swarm: inactive
 Runtimes: runc io.containerd.runc.v2 nvidia
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: a1496014c916f9e62104b33d1bb5bd03b0858e59
 runc version: v1.1.11-0-g4bccb38
 init version: de40ad0
 Security Options:
  apparmor
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 5.15.0-91-generic
 Operating System: Ubuntu 22.04.3 LTS
 OSType: linux
 Architecture: x86_64
 CPUs: 20
 Total Memory: 39.13GiB
 Name: HDA
 ID: a33723b5-cba7-4b9c-9d66-05f2c3aff5da
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Username: modem7
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false

Larger environment

https://paste.modem7.com/cjSKz-R9kFD

Additional notes

If I downgrade to 2.21.0-1~ubuntu.22.04~jammy, everything works again.

[modem7]

This may have something to do with:

compose-spec/compose-go#536, compose-spec/compose-go#475, #11133 and compose-spec/compose-go#534

[atrias]

I have the same issue after the same upgrade in ubuntu bookworm

Unpacking docker-compose-plugin (2.24.1-1~debian.12~bookworm) over (2.21.0-1~debian.12~bookworm) ...

[vialjoris]

fix :

labels: 
      - "autoheal=true"
      - "backup=true"

currently empty labels not work

[modem7]

fix :

labels: 
      - "autoheal=true"
      - "backup=true"

currently empty labels not work

Unfortunately that would break a lot of scripting that relies on the labels as they are.

For now I'll stick with the the older version until a fix can be created/released (looks like it's already in the pipeline looking at the PR's).

[ndeloof]

AFAICT this is a dupicate for compose-spec/compose-go#534, fixed in next release (to be published soon)