docker compose pull fails with non zero if it contains image that needs to be built

[logopk]

docker compose pull fails with non zero if it contains image that needs to be built

that leads to a problem with my update chain:

docker-compose pull && docker-compose build && docker-compose up -d

Steps to reproduce the issue:

1. compose file with two images, one which just is pulled, one with build section
2. docker-compose pull && docker-compose build && docker-compose up -d

[+] Running 1/2
 ⠿ app Error                                                                                                                                                                                        2.8s
 ⠿ db Pulled                                                                                                                                                                                        1.4s
WARNING: Some service image(s) must be built from source by running:
    docker compose build app
Error response from daemon: pull access denied for my/nextcloud, repository does not exist or may require 'docker login': denied: requested access to the resource is denied

version: '3'


services:
 db:
   image: mariadb
   command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW --innodb_read_only_compressed=OFF

 app:
   build:
     context: ./
     dockerfile: Dockerfile
   image: my/nextcloud
   links:
     - db

Dockerfile:

FROM nextcloud:apache

RUN apt-get update && apt-get install -y --no-install-recommends smbclient && rm -rf /var/lib/apt/lists/*

RUN mkdir -p /var/run/samba/msg.lock

Describe the results you received:
docker-compose pull fails with RC=18 and && commands are not run

Describe the results you expected:
docker-compose pull skips build image, returns true and && commands are run

Output of docker compose version:

Docker Compose version 2.0.1

Output of docker info:

Client:
 Context:    default
 Debug Mode: false

Server:
 Containers: 39
  Running: 39
  Paused: 0
  Stopped: 0
 Images: 276
 Server Version: 20.10.9
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 1
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 io.containerd.runtime.v1.linux runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 5b46e404f6b9f661a205e28d59c982d3634148f8
 runc version: v1.0.2-0-g52b36a2d
 init version: de40ad0
 Security Options:
  seccomp
   Profile: default
 Kernel Version: 4.19.208-boot2docker
 Operating System: Boot2Docker 20.10.9 (TCL 11.1)
 OSType: linux
 Architecture: x86_64
 CPUs: 4
 Total Memory: 5.328GiB
 Name: default
 ID: ITSY:AOS3:IXMP:2MZO:7B5U:3EPB:NTL7:E3TU:PPCF:IRHI:5T6I:OOB7
 Docker Root Dir: /mnt/sda1/var/lib/docker
 Debug Mode: false
 Registry: https://index.docker.io/v1/
 Labels:
  provider=vmwarefusion
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false
 Product License: Community Engine
 Default Address Pools:
   Base: 172.16.0.0/16, Size: 24

Additional environment details:

[back-2-95]

I can confirm this, both for 2.0.0 and 2.0.1.

If I have any image which should be build locally and does not exist on Docker Hub, fails with repository does not exist.

Workaround is indeed to run with docker-compose...

[ndeloof]

You can use --ignore-pull-failures flag for this purpose

[logopk]

Ok, but why is the behavior changed. Shouldn't the two versions be functionally equal?

[ndeloof]

sure, I just suggested this as a temporary workaround.
Issue is still open and valid

[komputerwiz]

Ran into this issue today on v2.2.3 while spinning up a dev/test environment for a project I'm working on.

Here's my docker-compose.yml file:

version: '3'

services:
  db:
    image: 'mcr.microsoft.com/mssql/server:2019-CU10-ubuntu-20.04'
    environment:
      ACCEPT_EULA: Y
      SA_PASSWORD: ${DB_PWD}
      TZ: America/Chicago
    ports:
      - '127.0.0.1:1433:1433'
    volumes:
      - './db/data:/var/opt/mssql/data:rw'
      - './db/log:/var/opt/mssql/log:rw'
      - './db/secrets:/var/opt/mssql/secrets:rw'

  mq:
    image: rabbitmq:3.8-management-alpine
    environment:
      TZ: America/Chicago
    ports:
      - '127.0.0.1:5672:5672'
      - '127.0.0.1:15672:15672'
    volumes:
      - './mq:/var/lib/rabbitmq:rw'

  ctl:
    build: ./build
    image: app
    depends_on: [db, mq]
    environment: &env
      TZ: America/Chicago
      DB_PWD: ${DB_PWD}
      DB_HOST: db
      RABBIT_MQ_HOST: mq
      SERVER_MODE: CONTROLLER
    ports:
      - '127.0.0.1:8080:8080'

  wk1: &worker
    image: app
    depends_on: [ctl, db, mq]
    environment:
      <<: *env
      SERVER_MODE: WORKER

  wk2: *worker
  wk3: *worker
  wk4: *worker

Starting from a fresh state,

• docker compose up fails without building ctl service image (I seem to remember docker-compose detecting this situation and building automatically, but I'm not sure):

  [+] Running 0/5
   ⠿ wk4 Error
   ⠿ wk1 Error
   ⠿ ctl Error
   ⠿ wk2 Error
   ⠿ wk3 Error
  WARNING: Some service image(s) must be built from source by running:
      docker compose build ctl
  Error response from daemon: pull access denied for app, repository does not exist or may require `docker login`: denied: requested access to the resource is denied
  

• docker compose build builds ctl image as expected
• docker compose pull fails for ctl service and dependent wk* services:

  [+] Running 2/7
   ⠿ ctl Error
   ⠿ wk3 Error
   ⠿ db Pulled
   ⠿ mq Pulled
   ⠿ wk4 Error
   ⠿ wk2 Error
   ⠿ wk1 Error
  WARNING: Some service image(s) must be built from source by running:
      docker compose build ctl
  Error response from daemon: pull access denied for app, repository does not exist or may require `docker login`: denied: requested access to the resource is denied
  

• just for completeness, docker compose pull --ignore-pull-failures gives an error for each locally-built service:

  [+] Running 2/7
   ⠿ ctl Error
   ⠿ wk3 Error
   ⠿ db Pulled
   ⠿ mq Pulled
   ⠿ wk4 Error
   ⠿ wk2 Error
   ⠿ wk1 Error
  Pulling ctl: Error response from daemon: pull access denied for app, repository does not exist or may require 'docker login': denied: requested access to the resource is denied
  Pulling wk3: Error response from daemon: pull access denied for app, repository does not exist or may require 'docker login': denied: requested access to the resource is denied
  Pulling wk1: Error response from daemon: pull access denied for app, repository does not exist or may require 'docker login': denied: requested access to the resource is denied
  Pulling wk4: Error response from daemon: pull access denied for app, repository does not exist or may require 'docker login': denied: requested access to the resource is denied
  Pulling wk2: Error response from daemon: pull access denied for app, repository does not exist or may require 'docker login': denied: requested access to the resource is denied
  

• docker compose up now works as expected

Summary:

• It seems compose is attempting to pull all services with an image: key instead of ignoring those that also have a build: key.
• Pulling should also ignore services that use images defined in docker-compose.yml.
• The warning about service images needing to be built locally seems spurious if they have already been built.

Thanks for everything you've already done: docker and compose have greatly simplified my workflow. Keep up the great work!

[mbrodala]

I can easily confirm this issue:

docker-compose.yml

version: '3'

services:
  original:
    image: hello-world

  local:
    build: .
    image: foo/bar:v1

Dockerfile

FROM hello-world

Running docker compose pull (Docker Compose 2.x):

$ docker compose version
Docker Compose version v2.6.0
$ docker compose pull
[+] Running 1/2
 ⠿ local Error                                                                                                               1.6s
 ⠿ original Pulled                                                                                                           1.4s
WARNING: Some service image(s) must be built from source by running:
    docker compose build local
Error response from daemon: pull access denied for foo/bar, repository does not exist or may require 'docker login': denied: requested access to the resource is denied

When adding pull_policy: never to the local service the error can be avoided:

$ docker compose pull
[+] Running 2/2
 ⠿ local Skipped                                                                                                             0.0s
 ⠿ original Pulled                                                       

(This fortunately only affects pull, but not build --pull, so fetching the latest version of images used in a Dockerfile will continue to work.)

For comparison running docker-compose pull (Docker Compose 1.x):

$ docker-compose version
docker-compose version 1.29.0, build 07737305
docker-py version: 5.0.0
CPython version: 3.7.10
OpenSSL version: OpenSSL 1.1.0l  10 Sep 2019
$ docker-compose pull
Pulling original ... done
Pulling local    ... done
WARNING: Some service image(s) must be built from source by running:
    docker-compose build local

[kalaomer]

I have this issue too. I'm using AWS Elastic Beanstalk and it forces to use "docker compose pull" command. I can not edit or manipulate this step, and therefore my build breaks every time. Because of this I have downgrade my platform version which using 1.29.2 version for Docker Compose.

If someone has this error in AWS Elastic Beanstalk like me, use "Docker running on 64bit Amazon Linux 2/3.5.9" platform version.

Is there any progress for this?

[ndeloof]

@kalaomer why not use --ignore-buildable flag ?

[kalaomer]

@kalaomer why not use --ignore-buildable flag ?

I can not use it, it is handled by elastic beanstalk's deployment operation. I can not manipulate this command.