compose-support.md

Compose Specification support

d2k runs the real docker compose CLI (and Portainer's compose library) unchanged: compose reads the compose file on the client and sends d2k Docker Engine API calls, which d2k translates to Kubernetes. Every attribute of the Compose Specification is listed here, and test/e2e/compose_spec.py checks each row against a cluster: an attribute either works, or docker compose up warns or fails. None is dropped silently.

• Supported: translated to Kubernetes.
• Partial: translated, with the limits noted; the rest warns.
• Not supported: docker compose up warns (the setting is ignored) or fails.
• Compose: handled by compose on the client; d2k sees its effect.

Services

Attribute	Support	Notes
image	Supported
command	Supported	Becomes the container's args.
command.string	Supported	See command. A string is split shell-style by compose before it reaches d2k.
entrypoint	Supported	Becomes the container's command.
entrypoint.string	Supported	See entrypoint. A string is split shell-style by compose before it reaches d2k.
environment	Supported
environment.list	Supported	See environment. The list form.
environment.value_syntax	Supported	See environment. A value may itself contain = and spaces.
env_file	Compose	Read by compose; arrives as environment.
env_file.syntax	Compose	See env_file. Comments and quoted values are stripped by compose before they reach d2k.
working_dir	Supported
user	Partial	Numeric uid[:gid] becomes runAsUser/runAsGroup. User names need the image's /etc/passwd, which Kubernetes does not read: they are ignored with a warning.
user.name	Partial	See user.
tty	Supported
stdin_open	Supported
stop_grace_period	Supported	Becomes terminationGracePeriodSeconds.
stop_signal	Not supported	Kubernetes always stops containers with SIGTERM.
init	Not supported	Kubernetes has no init process injection.
healthcheck	Partial	Becomes a readiness probe, which docker ps and depends_on: service_healthy read. start_interval is ignored with a warning: probes have one period.
healthcheck.start_interval	Partial	See healthcheck.
healthcheck.test_string	Partial	See healthcheck. A string test runs under CMD-SHELL.
healthcheck.test_shell	Partial	See healthcheck.
restart	Supported	always and unless-stopped containers run as a Deployment's replica, which restarts. no (the default) runs the container once in a pod (restartPolicy: Never), and on-failure in a pod with restartPolicy: OnFailure; a maximum retry count is ignored with a warning. Such pods are not rescheduled if their node fails.
restart.no	Supported	See restart.
restart.on_failure_max	Partial	See restart.
restart.unless_stopped	Supported	See restart.
post_start	Partial	Run with exec once the container runs. Hooks with a user, working_dir, environment or privileged fail: Kubernetes exec runs as the container's process does.
post_start.user	Partial	See post_start.
pre_start	Not supported	Not yet in a compose release.
pre_stop	Partial	Run with exec before the container stops; same limits as post_start.
container_name	Supported	The Docker name is kept; the Kubernetes name is derived from it.
labels	Supported	Kept verbatim; also set as Kubernetes labels where the value is valid.
labels.list	Supported	See labels. The list form.
labels.long_key	Supported	See labels. A key over 63 characters is kept verbatim on the Docker label but is not a valid Kubernetes label key, so it is not also set there.
label_file	Compose	Read by compose; arrives as labels.
annotations	Partial	Set on the pod. Container runtimes receive pod annotations only where configured to.
hostname	Not supported	A compose service's pod hostname is its service name, which service DNS needs: ignored with a warning. (docker run --hostname sets the pod hostname.)
domainname	Not supported
mac_address	Not supported	The cluster network assigns pod addresses.
platform	Not supported	The node's container runtime picks the image platform.
pull_policy	Compose	Compose decides whether to pull; d2k's pull is a no-op and the kubelet pulls the image (IfNotPresent). Compose prints a Pulling/Pulled progress line either way; older compose releases (tested: v2.40.3) print it per-service instead of per-image.
pull_refresh_after	Compose	As pull_policy.
profiles	Compose
extends	Compose
attach	Compose
depends_on	Supported
depends_on.service_started	Supported	The map form with the default condition.
depends_on.service_healthy	Supported	Waits on the dependency's healthcheck.
depends_on.service_completed_successfully	Supported	The dependency runs once (restart: "no") and compose waits for it to exit with code 0.
scale	Compose	Compose creates one container per replica.
deploy.replicas	Compose	As scale.
deploy.resources	Supported	Limits and reservations of CPU and memory become limits and requests.
deploy.resources.limits_only	Supported	See deploy.resources.
deploy.resources.reservations_only	Compose	See deploy.resources. Compose does not forward a CPU reservation outside Swarm mode; only reservations.memory reaches d2k.
deploy.restart_policy	Supported	As restart.
deploy.placement	Compose	Ignored by compose outside Swarm mode.
cpus	Supported	CPU limit.
cpu_quota	Supported	With cpu_period, a CPU limit.
cpu_period	Supported	See cpu_quota.
cpu_shares	Supported	A CPU request (1024 shares = 1 CPU).
mem_limit	Supported	Memory limit.
mem_reservation	Supported	Memory request.
gpus	Partial	A GPU limit on the resource named by D2K_GPU_RESOURCE_NAME (such as nvidia.com/gpu); all requests one. Ignored with a warning when D2K_GPU_RESOURCE_NAME is not set.
cpu_count	Not supported	Windows only.
cpu_percent	Not supported	Windows only.
cpu_rt_period	Not supported
cpu_rt_runtime	Not supported
cpuset	Not supported	Use the kubelet's CPU manager instead.
memswap_limit	Not supported
mem_swappiness	Not supported
oom_kill_disable	Not supported
oom_score_adj	Not supported	The kubelet sets it from the pod's QoS class.
pids_limit	Not supported	A kubelet setting, not a pod one.
blkio_config	Not supported
ulimits	Not supported	Kubernetes has no per-container ulimits.
shm_size	Supported	A memory-backed emptyDir at /dev/shm with that size limit.
cap_add	Supported
cap_drop	Supported
privileged	Supported	Subject to the namespace's pod security policy.
read_only	Supported
security_opt	Partial	no-new-privileges sets allowPrivilegeEscalation: false; seccomp=unconfined, apparmor=<profile> and `label=user
security_opt.seccomp_profile	Partial	See security_opt.
group_add	Partial	Numeric groups become supplementalGroups; group names are ignored with a warning.
sysctls	Supported	Pod sysctls. Kubernetes allows its safe sysctls; others need the kubelet's allowlist, or the container fails to start with an error.
userns_mode	Not supported
credential_spec	Not supported	Windows only; compose does not send it to a Linux engine.
isolation	Not supported	Windows only.
runtime	Not supported	Not yet translated.
pid	Not supported
ipc	Not supported
uts	Not supported
cgroup	Not supported
cgroup_parent	Not supported
devices	Not supported	Use a device plugin and resource requests.
device_cgroup_rules	Not supported
storage_opt	Not supported
use_api_socket	Not supported	There is no Docker socket to share: compose's bind mount of it is ignored with a warning.
ports	Partial	Published ports get a LoadBalancer Service. A port with no published port is published on its container port. A host_ip is ignored with a warning.
ports.range	Supported
ports.host_ip	Partial	See ports.
ports.container_only	Partial	See ports. A bare container port with no host port published.
ports.udp	Partial	See ports.
ports.dual_protocol	Partial	See ports. The same port published for both protocols.
ports.long_syntax	Partial	See ports. The long syntax; mode: host has no Kubernetes equivalent (every published port already reaches every node) and is ignored.
ports.wildcard_host	Partial	See ports. host_ip: 0.0.0.0 with no host port: a random host port, explicitly bound to every interface.
expose	Supported	The ports are reachable within the namespace.
networks	Partial	Containers resolve the services of their compose project by name. The namespace network is flat: networks do not isolate containers.
networks.map	Partial	See networks. The map form with no per-network settings.
networks.aliases	Not supported	Containers resolve by compose service name only.
networks.ipv4_address	Not supported	The cluster network assigns pod addresses.
networks.mac_address	Not supported
networks.priority	Not supported
network_mode	Not supported	host, none, service: and container: modes: the container joins the namespace network.
network_mode.service	Not supported	See network_mode.
links	Not supported	Use the service name, which resolves within the project.
external_links	Not supported
extra_hosts	Supported	Becomes hostAliases. host-gateway is ignored with a warning.
dns	Not supported	The cluster DNS server must answer first for service names to resolve: ignored with a warning.
dns_opt	Supported	Added to the pod's DNS options, after d2k's own.
dns_search	Supported	Searched after the compose project's and the namespace's domains.
volumes	Partial	Named volumes are PersistentVolumeClaims; tmpfs mounts are memory-backed emptyDirs. Bind, image and npipe mounts are ignored with a warning: pods cannot reach the client's files. Anonymous volumes (volumes: [/data]) are ignored with a warning: their data stays in the container.
volumes.anonymous	Not supported	See volumes.
volumes.bind	Not supported	See volumes.
volumes.bind_absolute	Not supported	See volumes. An absolute client path.
volumes.read_only	Supported	The long syntax's read_only becomes the mount's readOnly.
volumes.tmpfs	Supported	A memory-backed emptyDir, with tmpfs.size as its size limit.
volumes.image	Not supported
volumes.subpath	Supported	Becomes the mount's subPath.
volumes.nocopy	Supported	d2k never copies image content into a new volume, so every volume behaves as nocopy.
volumes_from	Not supported
tmpfs	Partial	Memory-backed emptyDirs; a size= option is the size limit, other options are ignored with a warning.
secrets	Partial	Secrets from environment (and configs from content or environment) are stored in a Secret owned by the container and mounted read-only at their target with their mode; uid and gid are not kept, and they total 1 MiB at most. Secrets from a file are ignored with a warning: the file is on the client.
secrets.file	Not supported	See secrets.
secrets.long_syntax	Partial	See secrets. The long syntax's target and mode.
configs	Partial	As secrets.
configs.file	Not supported	See configs.
configs.long_syntax	Partial	See configs. The long syntax's target and mode.
logging	Partial	Logs are read from Kubernetes. Drivers other than json-file and log options are ignored with a warning: the kubelet rotates logs.
logging.options	Partial	See logging.
build	Not supported	d2k cannot build images: build and push them, then use image.
develop	Not supported	compose watch needs a writable container filesystem and builds.
models	Not supported	Needs Docker Model Runner.
provider	Compose	Runs a provider plugin on the client.

Top-level elements

Attribute	Support	Notes
networks.internal	Not supported	Not enforced; reported on the containers that join the network.
networks.ipam	Not supported	Reported on the containers that join the network.
networks.driver	Not supported	macvlan and ipvlan are refused: pods have no Layer 2 attachment.
networks.enable_ipv6	Not supported	Pods get the cluster's address families; reported on joining containers.
networks.enable_ipv4	Not supported	IPv4 cannot be disabled; reported on joining containers.
networks.driver_opts	Not supported	Reported on the containers that join the network.
networks.attachable	Supported	Every container can join every network.
networks.labels	Supported
networks.name	Supported
networks.external	Supported
volumes.labels	Supported	Name, labels and driver options are kept verbatim.
volumes.driver	Not supported	Volumes are PersistentVolumeClaims of the default StorageClass; NFS driver_opts select an NFS CSI StorageClass. Other drivers are refused.
volumes.driver_opts	Partial	size sets the claim's size; NFS options (type: nfs, o: addr=...) select an NFS CSI StorageClass. Others are kept on the volume.
volumes.name	Supported
volumes.external	Supported
secrets.environment	Partial	See secrets.
secrets.file	Not supported	See secrets.
secrets.driver	Compose	Compose rejects secret drivers outside Swarm mode.
secrets.template_driver	Compose	As driver.
configs.content	Partial	See secrets.
configs.environment	Partial	See secrets.
configs.file	Not supported	See configs.
configs.external	Compose	Compose rejects external configs outside Swarm mode.
secrets.external	Compose	Compose rejects external secrets outside Swarm mode.