Merge branch 'docker:main' into 12381-compact-top

.github/workflows/ci.yml

@@ -56,7 +56,7 @@ jobs:
         uses: actions/checkout@v4
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
       -
         name: Run
         run: |
@@ -81,13 +81,13 @@ jobs:
         uses: actions/checkout@v4
       -
         name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
       -
         name: Build
-        uses: docker/bake-action@v2
+        uses: docker/bake-action@v5
         with:
           targets: release
           set: |
@@ -110,10 +110,10 @@ jobs:
         uses: actions/checkout@v4
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
       -
         name: Test
-        uses: docker/bake-action@v2
+        uses: docker/bake-action@v5
         with:
           targets: test
           set: |
@@ -141,10 +141,9 @@ jobs:
           - plugin
           - standalone
         engine:
-          - 24.0.9
-          - 25.0.5
-          - 26.1.4
-          - 27.4.0-rc.4
+          - 25
+          - 26
+          - 27
     steps:
       - name: Prepare
         run: |
@@ -165,7 +164,7 @@ jobs:
         run: docker --version
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
       -
         name: Set up Go
         uses: actions/setup-go@v5
@@ -175,7 +174,7 @@ jobs:
           cache: true
       -
         name: Build
-        uses: docker/bake-action@v2
+        uses: docker/bake-action@v5
         with:
           targets: binary-with-coverage
           set: |

.github/workflows/merge.yml

@@ -84,14 +84,14 @@ jobs:
         uses: actions/checkout@v4
       -
         name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
       -
         name: Docker meta
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           images: |
             ${{ env.REPO_SLUG }}
@@ -102,13 +102,13 @@ jobs:
       -
         name: Login to DockerHub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERPUBLICBOT_USERNAME }}
           password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}
       -
         name: Build and push image
-        uses: docker/bake-action@v2
+        uses: docker/bake-action@v5
         id: bake
         with:
           files: |
@@ -129,14 +129,15 @@ jobs:
       -
         name: Generate Token
         id: generate_token
-        uses: tibdex/github-app-token@v1
+        uses: tibdex/github-app-token@3eb77c7243b85c65e84acfa93fdbac02fb6bd532 # v2.1.0
         with:
           app_id: ${{ vars.DOCKERDESKTOP_APP_ID }}
           private_key: ${{ secrets.DOCKERDESKTOP_APP_PRIVATEKEY }}
-          repository: docker/${{ secrets.DOCKERDESKTOP_REPO }}
+          repositories: >-
+            [docker/${{ secrets.DOCKERDESKTOP_REPO }}]
       -
         name: Trigger Docker Desktop e2e with edge version
-        uses: actions/github-script@v6
+        uses: actions/github-script@v7
         with:
           github-token: ${{ steps.generate_token.outputs.token }}
           script: |

.github/workflows/scorecards.yml

@@ -22,12 +22,12 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3.0.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v4.4.2
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@99c53751e09b9529366343771cc321ec74e9bd3d # tag=v2.0.6
+        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # tag=v2.4.0
         with:
           results_file: results.sarif
           results_format: sarif
@@ -41,14 +41,14 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # tag=v3.0.0
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # tag=v4.5.0
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@5f532563584d71fdef14ee64d17bafb34f751ce5 # tag=v1.0.26
+        uses: github/codeql-action/upload-sarif@3096afedf9873361b2b2f65e1445b13272c83eb8 # tag=v2.20.00
         with:
           sarif_file: results.sarif

Dockerfile

@@ -15,7 +15,7 @@
 #   See the License for the specific language governing permissions and
 #   limitations under the License.
 
-ARG GO_VERSION=1.22.8
+ARG GO_VERSION=1.22.10
 ARG XX_VERSION=1.6.1
 ARG GOLANGCI_LINT_VERSION=v1.60.2
 ARG ADDLICENSE_VERSION=v1.0.0

cmd/compose/run.go

@@ -154,6 +154,7 @@ func runCommand(p *ProjectOptions, dockerCli command.Cli, backend api.Service) *
 					options.noTty = !options.tty
 				}
 			}
+			createOpts.pullChanged = cmd.Flags().Changed("pull")
 			return nil
 		}),
 		RunE: Adapt(func(ctx context.Context, args []string) error {
@@ -188,6 +189,7 @@ func runCommand(p *ProjectOptions, dockerCli command.Cli, backend api.Service) *
 	flags.StringArrayVarP(&options.publish, "publish", "p", []string{}, "Publish a container's port(s) to the host")
 	flags.BoolVar(&options.useAliases, "use-aliases", false, "Use the service's network useAliases in the network(s) the container connects to")
 	flags.BoolVarP(&options.servicePorts, "service-ports", "P", false, "Run command with all service's ports enabled and mapped to the host")
+	flags.StringVar(&createOpts.Pull, "pull", "policy", `Pull image before running ("always"|"missing"|"never")`)
 	flags.BoolVar(&options.quietPull, "quiet-pull", false, "Pull without printing progress information")
 	flags.BoolVar(&createOpts.Build, "build", false, "Build image before starting container")
 	flags.BoolVar(&options.removeOrphans, "remove-orphans", false, "Remove containers for services not defined in the Compose file")

docs/reference/compose_run.md

@@ -57,29 +57,30 @@ specified in the service configuration.
 
 ### Options
 
-| Name                    | Type          | Default | Description                                                                      |
-|:------------------------|:--------------|:--------|:---------------------------------------------------------------------------------|
-| `--build`               | `bool`        |         | Build image before starting container                                            |
-| `--cap-add`             | `list`        |         | Add Linux capabilities                                                           |
-| `--cap-drop`            | `list`        |         | Drop Linux capabilities                                                          |
-| `-d`, `--detach`        | `bool`        |         | Run container in background and print container ID                               |
-| `--dry-run`             | `bool`        |         | Execute command in dry run mode                                                  |
-| `--entrypoint`          | `string`      |         | Override the entrypoint of the image                                             |
-| `-e`, `--env`           | `stringArray` |         | Set environment variables                                                        |
-| `-i`, `--interactive`   | `bool`        | `true`  | Keep STDIN open even if not attached                                             |
-| `-l`, `--label`         | `stringArray` |         | Add or override a label                                                          |
-| `--name`                | `string`      |         | Assign a name to the container                                                   |
-| `-T`, `--no-TTY`        | `bool`        | `true`  | Disable pseudo-TTY allocation (default: auto-detected)                           |
-| `--no-deps`             | `bool`        |         | Don't start linked services                                                      |
-| `-p`, `--publish`       | `stringArray` |         | Publish a container's port(s) to the host                                        |
-| `--quiet-pull`          | `bool`        |         | Pull without printing progress information                                       |
-| `--remove-orphans`      | `bool`        |         | Remove containers for services not defined in the Compose file                   |
-| `--rm`                  | `bool`        |         | Automatically remove the container when it exits                                 |
-| `-P`, `--service-ports` | `bool`        |         | Run command with all service's ports enabled and mapped to the host              |
-| `--use-aliases`         | `bool`        |         | Use the service's network useAliases in the network(s) the container connects to |
-| `-u`, `--user`          | `string`      |         | Run as specified username or uid                                                 |
-| `-v`, `--volume`        | `stringArray` |         | Bind mount a volume                                                              |
-| `-w`, `--workdir`       | `string`      |         | Working directory inside the container                                           |
+| Name                    | Type          | Default  | Description                                                                      |
+|:------------------------|:--------------|:---------|:---------------------------------------------------------------------------------|
+| `--build`               | `bool`        |          | Build image before starting container                                            |
+| `--cap-add`             | `list`        |          | Add Linux capabilities                                                           |
+| `--cap-drop`            | `list`        |          | Drop Linux capabilities                                                          |
+| `-d`, `--detach`        | `bool`        |          | Run container in background and print container ID                               |
+| `--dry-run`             | `bool`        |          | Execute command in dry run mode                                                  |
+| `--entrypoint`          | `string`      |          | Override the entrypoint of the image                                             |
+| `-e`, `--env`           | `stringArray` |          | Set environment variables                                                        |
+| `-i`, `--interactive`   | `bool`        | `true`   | Keep STDIN open even if not attached                                             |
+| `-l`, `--label`         | `stringArray` |          | Add or override a label                                                          |
+| `--name`                | `string`      |          | Assign a name to the container                                                   |
+| `-T`, `--no-TTY`        | `bool`        | `true`   | Disable pseudo-TTY allocation (default: auto-detected)                           |
+| `--no-deps`             | `bool`        |          | Don't start linked services                                                      |
+| `-p`, `--publish`       | `stringArray` |          | Publish a container's port(s) to the host                                        |
+| `--pull`                | `string`      | `policy` | Pull image before running ("always"\|"missing"\|"never")                         |
+| `--quiet-pull`          | `bool`        |          | Pull without printing progress information                                       |
+| `--remove-orphans`      | `bool`        |          | Remove containers for services not defined in the Compose file                   |
+| `--rm`                  | `bool`        |          | Automatically remove the container when it exits                                 |
+| `-P`, `--service-ports` | `bool`        |          | Run command with all service's ports enabled and mapped to the host              |
+| `--use-aliases`         | `bool`        |          | Use the service's network useAliases in the network(s) the container connects to |
+| `-u`, `--user`          | `string`      |          | Run as specified username or uid                                                 |
+| `-v`, `--volume`        | `stringArray` |          | Bind mount a volume                                                              |
+| `-w`, `--workdir`       | `string`      |          | Working directory inside the container                                           |
 
 
 <!---MARKER_GEN_END-->

docs/reference/docker_compose_run.yaml

@@ -180,6 +180,16 @@ options:
       experimentalcli: false
       kubernetes: false
       swarm: false
+    - option: pull
+      value_type: string
+      default_value: policy
+      description: Pull image before running ("always"|"missing"|"never")
+      deprecated: false
+      hidden: false
+      experimental: false
+      experimentalcli: false
+      kubernetes: false
+      swarm: false
     - option: quiet-pull
       value_type: bool
       default_value: "false"

go.mod

@@ -1,8 +1,8 @@
 module github.com/docker/compose/v2
 
-go 1.22.7
+go 1.22.10
 
-toolchain go1.23.3
+toolchain go1.23.4
 
 require (
 	github.com/AlecAivazis/survey/v2 v2.3.7

pkg/compose/watch.go

@@ -147,13 +147,13 @@ func (s *composeService) watch(ctx context.Context, syncChannel chan bool, proje
 
 		var paths, pathLogs []string
 		for _, trigger := range config.Watch {
-			if trigger.Action != types.WatchActionRebuild && checkIfPathAlreadyBindMounted(trigger.Path, service.Volumes) {
+			if isSync(trigger) && checkIfPathAlreadyBindMounted(trigger.Path, service.Volumes) {
 				logrus.Warnf("path '%s' also declared by a bind mount volume, this path won't be monitored!\n", trigger.Path)
 				continue
 			} else {
 				var initialSync bool
 				success, err := trigger.Extensions.Get("x-initialSync", &initialSync)
-				if err == nil && success && initialSync && (trigger.Action == types.WatchActionSync || trigger.Action == types.WatchActionSyncRestart) {
+				if err == nil && success && initialSync && isSync(trigger) {
 					// Need to check initial files are in container that are meant to be synched from watch action
 					err := s.initialSync(ctx, project, service, trigger, ignore, syncer)
 					if err != nil {
@@ -204,6 +204,10 @@ func (s *composeService) watch(ctx context.Context, syncChannel chan bool, proje
 	}
 }
 
+func isSync(trigger types.Trigger) bool {
+	return trigger.Action == types.WatchActionSync || trigger.Action == types.WatchActionSyncRestart
+}
+
 func (s *composeService) watchEvents(ctx context.Context, project *types.Project, name string, options api.WatchOptions, watcher watch.Notify, syncer sync.Syncer, triggers []types.Trigger) error {
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()

pkg/e2e/compose_run_test.go

@@ -169,4 +169,14 @@ func TestLocalComposeRun(t *testing.T) {
 		assert.Assert(t, !strings.Contains(res.Combined(), "Pull complete"), res.Combined())
 		assert.Assert(t, strings.Contains(res.Combined(), "Pulled"), res.Combined())
 	})
+
+	t.Run("--pull", func(t *testing.T) {
+		res := c.RunDockerComposeCmd(t, "-f", "./fixtures/run-test/pull.yaml", "down", "--rmi", "all")
+		res.Assert(t, icmd.Success)
+
+		res = c.RunDockerComposeCmd(t, "-f", "./fixtures/run-test/pull.yaml", "run", "--pull", "always", "backend")
+		assert.Assert(t, strings.Contains(res.Combined(), "backend Pulling"), res.Combined())
+		assert.Assert(t, strings.Contains(res.Combined(), "Download complete"), res.Combined())
+		assert.Assert(t, strings.Contains(res.Combined(), "backend Pulled"), res.Combined())
+	})
 }

pkg/e2e/fixtures/run-test/pull.yaml

@@ -0,0 +1,4 @@
+services:
+  backend:
+    image: nginx
+    command: nginx -t