fix(hash): recreate container on project config content change

pkg/api/labels.go

@@ -31,6 +31,10 @@ const (
 	ServiceLabel = "com.docker.compose.service"
 	// ConfigHashLabel stores configuration hash for a compose service
 	ConfigHashLabel = "com.docker.compose.config-hash"
+	// ServiceConfigsHash stores configuration hash for a compose service configs
+	ServiceConfigsHash = "com.docker.compose.service.configs-hash"
+	// ServiceSecretsHash stores configuration hash for a compose service secrets
+	ServiceSecretsHash = "com.docker.compose.service.secrets-hash"
 	// ContainerNumberLabel stores the container index of a replicated service
 	ContainerNumberLabel = "com.docker.compose.container-number"
 	// VolumeLabel allow to track resource related to a compose volume

pkg/compose/convergence.go

@@ -123,11 +123,11 @@ func (c *convergence) ensureService(ctx context.Context, project *types.Project,
 
 	sort.Slice(containers, func(i, j int) bool {
 		// select obsolete containers first, so they get removed as we scale down
-		if obsolete, _ := mustRecreate(service, containers[i], recreate); obsolete {
+		if obsolete, _ := mustRecreate(project, service, containers[i], recreate); obsolete {
 			// i is obsolete, so must be first in the list
 			return true
 		}
-		if obsolete, _ := mustRecreate(service, containers[j], recreate); obsolete {
+		if obsolete, _ := mustRecreate(project, service, containers[j], recreate); obsolete {
 			// j is obsolete, so must be first in the list
 			return false
 		}
@@ -154,7 +154,7 @@ func (c *convergence) ensureService(ctx context.Context, project *types.Project,
 			continue
 		}
 
-		mustRecreate, err := mustRecreate(service, container, recreate)
+		mustRecreate, err := mustRecreate(project, service, container, recreate)
 		if err != nil {
 			return err
 		}
@@ -312,20 +312,40 @@ func (c *convergence) resolveSharedNamespaces(service *types.ServiceConfig) erro
 	return nil
 }
 
-func mustRecreate(expected types.ServiceConfig, actual moby.Container, policy string) (bool, error) {
+func mustRecreate(project *types.Project, expected types.ServiceConfig, actual moby.Container, policy string) (bool, error) {
 	if policy == api.RecreateNever {
 		return false, nil
 	}
 	if policy == api.RecreateForce {
 		return true, nil
 	}
-	configHash, err := ServiceHash(expected)
+	serviceHash, err := ServiceHash(expected)
 	if err != nil {
 		return false, err
 	}
-	configChanged := actual.Labels[api.ConfigHashLabel] != configHash
-	imageUpdated := actual.Labels[api.ImageDigestLabel] != expected.CustomLabels[api.ImageDigestLabel]
-	return configChanged || imageUpdated, nil
+
+	if actual.Labels[api.ConfigHashLabel] != serviceHash {
+		return true, nil
+	}
+
+	if actual.Labels[api.ImageDigestLabel] != expected.CustomLabels[api.ImageDigestLabel] {
+		return true, nil
+	}
+
+	serviceConfigsHash, err := ServiceConfigsHash(project, expected)
+	if err != nil {
+		return false, err
+	}
+
+	serviceSecretsHash, err := ServiceSecretsHash(project, expected)
+	if err != nil {
+		return false, err
+	}
+
+	serviceConfigsChanged := actual.Labels[api.ServiceConfigsHash] != serviceConfigsHash
+	serviceSecretsChanged := actual.Labels[api.ServiceSecretsHash] != serviceSecretsHash
+
+	return serviceConfigsChanged || serviceSecretsChanged, nil
 }
 
 func getContainerName(projectName string, service types.ServiceConfig, number int) string {

pkg/compose/create.go

@@ -212,7 +212,7 @@ func (s *composeService) getCreateConfigs(ctx context.Context,
 	inherit *moby.Container,
 	opts createOptions,
 ) (createConfigs, error) {
-	labels, err := s.prepareLabels(opts.Labels, service, number)
+	labels, err := s.prepareLabels(opts.Labels, p, service, number)
 	if err != nil {
 		return createConfigs{}, err
 	}
@@ -498,13 +498,25 @@ func parseSecurityOpts(p *types.Project, securityOpts []string) ([]string, bool,
 	return parsed, unconfined, nil
 }
 
-func (s *composeService) prepareLabels(labels types.Labels, service types.ServiceConfig, number int) (map[string]string, error) {
-	hash, err := ServiceHash(service)
+func (s *composeService) prepareLabels(labels types.Labels, project *types.Project, service types.ServiceConfig, number int) (map[string]string, error) {
+	serviceHash, err := ServiceHash(service)
 	if err != nil {
 		return nil, err
 	}
-	labels[api.ConfigHashLabel] = hash
 
+	serviceConfigsHash, err := ServiceConfigsHash(project, service)
+	if err != nil {
+		return nil, err
+	}
+
+	serviceSecretsHash, err := ServiceSecretsHash(project, service)
+	if err != nil {
+		return nil, err
+	}
+
+	labels[api.ConfigHashLabel] = serviceHash
+	labels[api.ServiceConfigsHash] = serviceConfigsHash
+	labels[api.ServiceSecretsHash] = serviceSecretsHash
 	labels[api.ContainerNumberLabel] = strconv.Itoa(number)
 
 	var dependencies []string

pkg/compose/hash.go

@@ -17,9 +17,13 @@
 package compose
 
 import (
+	"bytes"
 	"encoding/json"
+	"fmt"
+	"time"
 
 	"github.com/compose-spec/compose-go/v2/types"
+	"github.com/docker/compose/v2/pkg/utils"
 	"github.com/opencontainers/go-digest"
 )
 
@@ -34,9 +38,75 @@ func ServiceHash(o types.ServiceConfig) (string, error) {
 	}
 	o.DependsOn = nil
 
-	bytes, err := json.Marshal(o)
+	data, err := json.Marshal(o)
 	if err != nil {
 		return "", err
 	}
-	return digest.SHA256.FromBytes(bytes).Encoded(), nil
+	return digest.SHA256.FromBytes(data).Encoded(), nil
+}
+
+// ServiceConfigsHash computes the configuration hash for service configs.
+func ServiceConfigsHash(project *types.Project, serviceConfig types.ServiceConfig) (string, error) {
+	data := make([]byte, 0)
+	for _, config := range serviceConfig.Configs {
+		file := project.Configs[config.Source]
+		b, err := createTarForConfig(project, types.FileReferenceConfig(config), types.FileObjectConfig(file))
+
+		if err != nil {
+			return "", err
+		}
+
+		data = append(data, b.Bytes()...)
+	}
+
+	return digest.SHA256.FromBytes(data).Encoded(), nil
+}
+
+// ServiceSecretsHash computes the configuration hash for service secrets.
+func ServiceSecretsHash(project *types.Project, serviceConfig types.ServiceConfig) (string, error) {
+	data := make([]byte, 0)
+	for _, secret := range serviceConfig.Secrets {
+		file := project.Secrets[secret.Source]
+		b, err := createTarForConfig(project, types.FileReferenceConfig(secret), types.FileObjectConfig(file))
+
+		if err != nil {
+			return "", err
+		}
+
+		data = append(data, b.Bytes()...)
+	}
+
+	return digest.SHA256.FromBytes(data).Encoded(), nil
+}
+
+func createTarForConfig(
+	project *types.Project,
+	serviceConfig types.FileReferenceConfig,
+	file types.FileObjectConfig,
+) (*bytes.Buffer, error) {
+	// fixed time to ensure the tarball is deterministic
+	modTime := time.Unix(0, 0)
+
+	if serviceConfig.Target == "" {
+		serviceConfig.Target = "/" + serviceConfig.Source
+	}
+
+	switch {
+	case file.Content != "":
+		return bytes.NewBuffer([]byte(file.Content)), nil
+	case file.Environment != "":
+		env, ok := project.Environment[file.Environment]
+		if !ok {
+			return nil, fmt.Errorf(
+				"environment variable %q required by file %q is not set",
+				file.Environment,
+				file.Name,
+			)
+		}
+		return bytes.NewBuffer([]byte(env)), nil
+	case file.File != "":
+		return utils.CreateTarByPath(file.File, modTime)
+	}
+
+	return nil, fmt.Errorf("config %q is empty", file.Name)
 }

pkg/compose/hash_test.go

@@ -23,21 +23,161 @@ import (
 	"gotest.tools/v3/assert"
 )
 
-func TestServiceHash(t *testing.T) {
-	hash1, err := ServiceHash(serviceConfig(1))
+func TestServiceHashWithAllValuesTheSame(t *testing.T) {
+	hash1, err := ServiceHash(serviceConfig("myContext1", "always", 1))
 	assert.NilError(t, err)
-	hash2, err := ServiceHash(serviceConfig(2))
+	hash2, err := ServiceHash(serviceConfig("myContext1", "always", 1))
 	assert.NilError(t, err)
 	assert.Equal(t, hash1, hash2)
 }
 
-func serviceConfig(replicas int) types.ServiceConfig {
+func TestServiceHashWithIgnorableValues(t *testing.T) {
+	hash1, err := ServiceHash(serviceConfig("myContext1", "always", 1))
+	assert.NilError(t, err)
+	hash2, err := ServiceHash(serviceConfig("myContext2", "never", 2))
+	assert.NilError(t, err)
+	assert.Equal(t, hash1, hash2)
+}
+
+func TestServiceConfigsHashWithoutChangesContent(t *testing.T) {
+	hash1, err := ServiceConfigsHash(projectWithConfigs("a", "", ""), serviceConfig("myContext1", "always", 1))
+	assert.NilError(t, err)
+	hash2, err := ServiceConfigsHash(projectWithConfigs("a", "", ""), serviceConfig("myContext2", "never", 2))
+	assert.NilError(t, err)
+	assert.Assert(t, hash1 == hash2)
+}
+
+func TestServiceConfigsHashWithChangedConfigContent(t *testing.T) {
+	hash1, err := ServiceConfigsHash(projectWithConfigs("a", "", ""), serviceConfig("myContext1", "always", 1))
+	assert.NilError(t, err)
+	hash2, err := ServiceConfigsHash(projectWithConfigs("b", "", ""), serviceConfig("myContext2", "never", 2))
+	assert.NilError(t, err)
+	assert.Assert(t, hash1 != hash2)
+}
+
+func TestServiceConfigsHashWithChangedConfigEnvironment(t *testing.T) {
+	hash1, err := ServiceConfigsHash(projectWithConfigs("", "a", ""), serviceConfig("myContext1", "always", 1))
+	assert.NilError(t, err)
+	hash2, err := ServiceConfigsHash(projectWithConfigs("", "b", ""), serviceConfig("myContext2", "never", 2))
+	assert.NilError(t, err)
+	assert.Assert(t, hash1 != hash2)
+}
+
+func TestServiceConfigsHashWithChangedConfigFile(t *testing.T) {
+	hash1, err := ServiceConfigsHash(
+		projectWithConfigs("", "", "./testdata/config1.txt"),
+		serviceConfig("myContext1", "always", 1),
+	)
+	assert.NilError(t, err)
+	hash2, err := ServiceConfigsHash(
+		projectWithConfigs("", "", "./testdata/config2.txt"),
+		serviceConfig("myContext2", "never", 2),
+	)
+	assert.NilError(t, err)
+	assert.Assert(t, hash1 != hash2)
+}
+
+func TestServiceSecretsHashWithoutChangesContent(t *testing.T) {
+	hash1, err := ServiceSecretsHash(projectWithSecrets("a", "", ""), serviceConfig("myContext1", "always", 1))
+	assert.NilError(t, err)
+	hash2, err := ServiceSecretsHash(projectWithSecrets("a", "", ""), serviceConfig("myContext2", "never", 2))
+	assert.NilError(t, err)
+	assert.Assert(t, hash1 == hash2)
+}
+
+func TestServiceSecretsHashWithChangedSecretContent(t *testing.T) {
+	hash1, err := ServiceSecretsHash(projectWithSecrets("a", "", ""), serviceConfig("myContext1", "always", 1))
+	assert.NilError(t, err)
+	hash2, err := ServiceSecretsHash(projectWithSecrets("b", "", ""), serviceConfig("myContext2", "never", 2))
+	assert.NilError(t, err)
+	assert.Assert(t, hash1 != hash2)
+}
+
+func TestServiceSecretsHashWithChangedSecretEnvironment(t *testing.T) {
+	hash1, err := ServiceSecretsHash(projectWithSecrets("", "a", ""), serviceConfig("myContext1", "always", 1))
+	assert.NilError(t, err)
+	hash2, err := ServiceSecretsHash(projectWithSecrets("", "b", ""), serviceConfig("myContext2", "never", 2))
+	assert.NilError(t, err)
+	assert.Assert(t, hash1 != hash2)
+}
+
+func TestServiceSecretsHashWithChangedSecretFile(t *testing.T) {
+	hash1, err := ServiceSecretsHash(
+		projectWithSecrets("", "", "./testdata/config1.txt"),
+		serviceConfig("myContext1", "always", 1),
+	)
+	assert.NilError(t, err)
+	hash2, err := ServiceSecretsHash(
+		projectWithSecrets("", "", "./testdata/config2.txt"),
+		serviceConfig("myContext2", "never", 2),
+	)
+	assert.NilError(t, err)
+	assert.Assert(t, hash1 != hash2)
+}
+
+func projectWithConfigs(configContent, configEnvironmentValue, configFile string) *types.Project {
+	envName := "myEnv"
+
+	if configEnvironmentValue == "" {
+		envName = ""
+	}
+
+	return &types.Project{
+		Environment: types.Mapping{
+			envName: configEnvironmentValue,
+		},
+		Configs: types.Configs{
+			"myConfigSource": types.ConfigObjConfig{
+				Content:     configContent,
+				Environment: envName,
+				File:        configFile,
+			},
+		},
+	}
+}
+
+func projectWithSecrets(secretContent, secretEnvironmentValue, secretFile string) *types.Project {
+	envName := "myEnv"
+
+	if secretEnvironmentValue == "" {
+		envName = ""
+	}
+
+	return &types.Project{
+		Environment: types.Mapping{
+			envName: secretEnvironmentValue,
+		},
+		Secrets: types.Secrets{
+			"mySecretSource": types.SecretConfig{
+				Content:     secretContent,
+				Environment: envName,
+				File:        secretFile,
+			},
+		},
+	}
+}
+
+func serviceConfig(buildContext, pullPolicy string, replicas int) types.ServiceConfig {
 	return types.ServiceConfig{
-		Scale: &replicas,
+		Build: &types.BuildConfig{
+			Context: buildContext,
+		},
+		PullPolicy: pullPolicy,
+		Scale:      &replicas,
 		Deploy: &types.DeployConfig{
 			Replicas: &replicas,
 		},
 		Name:  "foo",
 		Image: "bar",
+		Configs: []types.ServiceConfigObjConfig{
+			{
+				Source: "myConfigSource",
+			},
+		},
+		Secrets: []types.ServiceSecretConfig{
+			{
+				Source: "mySecretSource",
+			},
+		},
 	}
 }