[BUG] --yes or -y flag not being respected on docker compose publish

[louis-marchant]

Description

The docker compose publish command is not respecting the -y or --yes flag as indicated in the documentation.

Steps To Reproduce

1. Create a yml file with:

services:
  bindwarn:
    image: busybox:latest
    command: ["sh", "-c", "sleep 5"]
    volumes:
      - .:/data:ro # bind mount to trigger the prompt

2. Run docker compose -f compose.yml publish -y "some-upstream-url"
   (the same happens if you use --yes)

3. You will see the output:

you are about to publish bind mounts declaration within your OCI artifact.
only the bind mount declarations will be added to the OCI artifact (not content)
please double check that you are not mounting potential user's sensitive directories or data
bindwarn
/Users/dkloumar/work/docker-bug:/data:ro
? Are you ok to publish these bind mount declarations? [y/N]:  (y/N) 

Indicating that the -y flag was not respected.

Compose Version

Docker Compose version v2.39.1-desktop.1

Docker Environment

Client:
 Version:    28.3.2
 Context:    desktop-linux
 Debug Mode: false
 Plugins:
  ai: Docker AI Agent - Ask Gordon (Docker Inc.)
    Version:  v1.9.11
    Path:     /Users/dkloumar/.docker/cli-plugins/docker-ai
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.26.1-desktop.1
    Path:     /Users/dkloumar/.docker/cli-plugins/docker-buildx
  cloud: Docker Cloud (Docker Inc.)
    Version:  v0.4.11
    Path:     /Users/dkloumar/.docker/cli-plugins/docker-cloud
  compose: Docker Compose (Docker Inc.)
    Version:  v2.39.1-desktop.1
    Path:     /Users/dkloumar/.docker/cli-plugins/docker-compose
  debug: Get a shell into any image or container (Docker Inc.)
    Version:  0.0.42
    Path:     /Users/dkloumar/.docker/cli-plugins/docker-debug
  desktop: Docker Desktop commands (Docker Inc.)
    Version:  v0.2.0
    Path:     /Users/dkloumar/.docker/cli-plugins/docker-desktop
  extension: Manages Docker extensions (Docker Inc.)
    Version:  v0.2.29
    Path:     /Users/dkloumar/.docker/cli-plugins/docker-extension
  init: Creates Docker-related starter files for your project (Docker Inc.)
    Version:  v1.4.0
    Path:     /Users/dkloumar/.docker/cli-plugins/docker-init
  mcp: Docker MCP Plugin (Docker Inc.)
    Version:  v0.13.0
    Path:     /Users/dkloumar/.docker/cli-plugins/docker-mcp
  model: Docker Model Runner (EXPERIMENTAL) (Docker Inc.)
    Version:  v0.1.36
    Path:     /Users/dkloumar/.docker/cli-plugins/docker-model
  sbom: View the packaged-based Software Bill Of Materials (SBOM) for an image (Anchore Inc.)
    Version:  0.6.0
    Path:     /Users/dkloumar/.docker/cli-plugins/docker-sbom
  scout: Docker Scout (Docker Inc.)
    Version:  v1.18.2
    Path:     /Users/dkloumar/.docker/cli-plugins/docker-scout
WARNING: Plugin "/Users/dkloumar/.docker/cli-plugins/docker-dev" is not valid: failed to fetch metadata: fork/exec /Users/dkloumar/.docker/cli-plugins/docker-dev: no such file or directory
WARNING: Plugin "/Users/dkloumar/.docker/cli-plugins/docker-feedback" is not valid: failed to fetch metadata: fork/exec /Users/dkloumar/.docker/cli-plugins/docker-feedback: no such file or directory

Server:
 Containers: 3
  Running: 1
  Paused: 0
  Stopped: 2
 Images: 938
 Server Version: 28.3.2
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Discovered Devices:
  cdi: docker.com/gpu=webgpu
 Swarm: active
  NodeID: zw20rpgacoskfirm5ao246dwx
  Is Manager: true
  ClusterID: j8wfv1pu96ng336m9c7rgwxf7
  Managers: 1
  Nodes: 1
  Default Address Pool: 10.0.0.0/8  
  SubnetSize: 24
  Data Path Port: 4789
  Orchestration:
   Task History Retention Limit: 5
  Raft:
   Snapshot Interval: 10000
   Number of Old Snapshots to Retain: 0
   Heartbeat Tick: 1
   Election Tick: 10
  Dispatcher:
   Heartbeat Period: 5 seconds
  CA Configuration:
   Expiry Duration: 3 months
   Force Rotate: 0
  Autolock Managers: false
  Root Rotation In Progress: false
  Node Address: 192.168.65.3
  Manager Addresses:
   192.168.65.3:2377
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 05044ec0a9a75232cad458027ca83437aae3f4da
 runc version: v1.2.5-0-g59923ef
 init version: de40ad0
 Security Options:
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.10.14-linuxkit
 Operating System: Docker Desktop
 OSType: linux
 Architecture: aarch64
 CPUs: 8
 Total Memory: 7.751GiB
 Name: docker-desktop
 ID: 7d561ec8-1368-4297-8e53-e8048cdd959b
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 HTTP Proxy: http.docker.internal:3128
 HTTPS Proxy: http.docker.internal:3128
 No Proxy: hubproxy.docker.internal
 Labels:
  com.docker.desktop.address=unix:///Users/dkloumar/Library/Containers/com.docker.docker/Data/docker-cli.sock
 Experimental: false
 Insecure Registries:
  hubproxy.docker.internal:5555
  ::1/128
  127.0.0.0/8
 Live Restore Enabled: false

WARNING: DOCKER_INSECURE_NO_IPTABLES_RAW is set

Anything else?

No response

[louis-marchant]

It does indeed seem that the if options.AssumeYes check is happening after the checkForBindMount runs and this means it is ignoring the -y flag. Is this intentional?

compose/pkg/compose/publish.go

Lines 235 to 256 in 7c999d7

	func (s *composeService) preChecks(project *types.Project, options api.PublishOptions) (bool, error) {
	if ok, err := s.checkOnlyBuildSection(project); !ok || err != nil {
	return false, err
	}
	bindMounts := s.checkForBindMount(project)
	if len(bindMounts) > 0 {
	fmt.Println("you are about to publish bind mounts declaration within your OCI artifact.\n" +
	"only the bind mount declarations will be added to the OCI artifact (not content)\n" +
	"please double check that you are not mounting potential user's sensitive directories or data")
	for key, val := range bindMounts {
	_, _ = fmt.Fprintln(s.dockerCli.Out(), key)
	for _, v := range val {
	_, _ = fmt.Fprintf(s.dockerCli.Out(), "%s\n", v.String())
	}
	}
	if ok, err := acceptPublishBindMountDeclarations(s.dockerCli); err != nil || !ok {
	return false, err
	}
	}
	if options.AssumeYes {
	return true, nil
	}

[cruizba]

Same issue. I can't automate the publish of a docker compose because of this!

[glours]

#13151 was merged