fix: ensure deterministic variable interpolation (#13712)

[yunus25jmi1]

Description

This fixes the non-deterministic behavior when multiple required variables (e.g., ${TIMEZONE:?}, ${TRAEFIK_ACME_PATH:?}) are missing in docker-compose.yaml.

Root Cause

Go's map iteration order is randomized. When iterating over service environment variables or volumes during interpolation, different keys can be processed in different orders on each run. This causes the error message for missing required variables to vary between runs.

Fix

The fix adds sort.Strings(keys) before map iteration in the compose-go library's interpolation.go file to ensure deterministic processing order.

Changes:

1. compose-go fix (already pushed to https://github.com/yunus25jmi1/compose-go):

   • Added sort import to interpolation.go
   • Sort map keys before iteration in Interpolate() function
   • Sort map keys before iteration in recursiveInterpolate() function

2. docker/compose (this PR):

   • Added replace directive to use the fixed compose-go fork

Testing

• go build: passes
• go vet: passes
• go fmt: passes
• Unit tests: pass

Related

• Fixes [BUG] docker compose config --quiet produces non-deterministic result for required variables #13712

[Copilot]

Pull request overview

This PR addresses non-deterministic “missing required variable” interpolation errors by switching Docker Compose to a compose-go variant that sorts map keys during interpolation, making error reporting deterministic across runs.

Changes:

• Add a replace directive to use a forked compose-go module that includes deterministic key ordering.
• Update go.sum to reflect the forked compose-go module version/checksums.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
go.mod	Replaces upstream compose-go with a forked module version to pick up deterministic interpolation behavior.
go.sum	Removes upstream compose-go sums and adds sums for the forked compose-go module.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The new replace directive pins compose-go to a personal fork (github.com/yunus25jmi1/compose-go). This creates a supply-chain/maintenance risk (availability/review process is now tied to an external fork) and it also won’t help downstream modules that import github.com/docker/compose/v5 as a dependency (replace directives are only honored in the main module). Prefer updating to an upstream github.com/compose-spec/compose-go/v2 commit/release once the fix is merged, or (if this must be temporary) add a TODO comment with a tracking link and a clear plan to remove the replace.

Suggested change

replace github.com/compose-spec/compose-go/v2 => github.com/yunus25jmi1/compose-go/v2 v2.0.0-20260404194456-e694d656b965

[yunus25jmi1]

Thank you for the review! You raise valid concerns about the replace directive approach.

Plan:

1. The compose-go fix is in PR fix: ensure deterministic variable interpolation compose-spec/compose-go#860 - once merged, we will update docker/compose to use the official compose-go version
2. This replace directive is a temporary measure to validate the fix works
3. After compose-go PR merges, I will create a follow-up PR to:
   • Remove the replace directive
   • Update the compose-go dependency to the version with the fix

The current approach allows testing the fix while waiting for upstream compose-go merge. I will add a TODO comment with a tracking link as suggested.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The new replace points at a personal fork (github.com/yunus25jmi1/compose-go). That creates a supply-chain and long-term availability risk (module can change/disappear, and builds become dependent on a non-org-owned repo). Prefer pinning to an upstream commit/branch in compose-spec/compose-go if possible, or hosting the temporary fork under an org-owned namespace (e.g., github.com/docker/...) until the upstream PR is merged and a release is cut.

[yunus25jmi1]

Hi @ndeloof @glours and docker/compose-maintainers,

I've updated this PR to address the supply-chain risk concern raised in the review. The replace directive pointing to the personal fork (github.com/yunus25jmi1/compose-go/v2) has been removed, and we're now using the official compose-go v2.10.2 from upstream.

This eliminates the supply-chain risk of depending on a personal fork.

Note: The deterministic interpolation fix from compose-spec/compose-go#860 is not yet merged upstream. Once that PR is merged and released, we'll need to update to the version that includes the fix.

Please review the updated changes.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[glours]

@yunus25jmi1 What do you want us to review? PR is empty