Purpose

This repository is used to demonstrate an unexpected behaviour of Docker Compose.

Initial position

A Dockerfile
A Compose file with 2 services, namely:
- A local service, which builds an image from the Dockerfile, without any image: tag
- A remote service, which uses an image from a registry

Compose command

Run the following commands:

$ docker compose build
$ docker compose up -d --no-build --pull always

Expected behaviour

First command (build):

The image for the local service is built in the first command (i.e. build)
The image for the remote service is ignored, since it has not to be built

Second command (up):

The image for the remote service is pulled (because of --pull always)
The image for the local service isn't built (because of --no-build) or pulled (since there's no image: there)
Both containers are started

Actual behaviour

No issues with the first command.

For the second command, Docker tries to pull the local image without having an image: tag defined at all:

$ docker compose up -d --pull always --no-build
[+] Running 2/2
 ✘ local Error 
 ✔ remote Pulled 
Error response from daemon: pull access denied for docker-pull-test-local, repository does not exist or may require 'docker login': denied: requested access to the resource is denied

More testing

Using only the --no-build flag works:

$ docker compose up -d --no-build
[+] Running 2/2
 ✔ Container docker-pull-test-local-1   Started
 ✔ Container docker-pull-test-remote-1  Started

Using only the --pull always flag works:

$ docker compose up -d --pull always
[+] Running 1/1
 ✔ remote Pulled
[+] Building 0.0s (0/0)
[+] Running 3/3
 ✔ Network docker-pull-test_default     Created
 ✔ Container docker-pull-test-local-1   Started
 ✔ Container docker-pull-test-remote-1  Started

Interestingly, --no-build --pull policy also fails:

$ docker compose up -d --pull policy --no-build
[+] Running 2/2
 ✘ local Error
 ✔ remote Pulled
Error response from daemon: pull access denied for docker-pull-test-local, repository does not exist or may require 'docker login': denied: requested access to the resource is denied

Another bug

More interestingly, on another system, the --pull policy flag errors:

docker compose up -d --pull policy --no-build
invalid --pull option "policy"

The help states it should be working (it is on the other system):

 docker compose up -h
Flag shorthand -h has been deprecated, please use --help

Usage:  docker compose up [OPTIONS] [SERVICE...]

Create and start containers

Options:
~snip~
      --pull string               Pull image before running ("always"|"policy"|"never") (default "policy")
~snap~

Environment

I tried to run this on:

Debian 12 (amd64)
Docker version 24.0.7, build afdd53b
Docker Compose version v2.21.0

The system where the --pull policy fails, is this:

macOS 13.5.2 (arm)
Docker version 24.0.6, build ed223bc
Docker Compose version v2.23.0-desktop.1

GitHub issue

I've created a GitHub issue for this problem.

confirm/docker-pull-test