Skip to main content
DevOps Insightsguides & answers

Docker Compose · troubleshooting

additional privileges requested: pass --allow=fs.read

Since Buildx 0.37.2, docker compose build fails when a Dockerfile, a build secret or an SSH key lives outside the project directory. Bake now enforces its filesystem permissions in the mode Compose uses (30 Sep 2026). The fix is merged in Compose but in no release yet. Until it is, move the file inside the build context, or set BUILDX_BAKE_ENTITLEMENTS_FS=0 for that one trusted build.

First published

New to this? Read what is actually happening first, then come back to the steps.

On this page · 10 sections

Before you start

  • A terminal where docker compose build fails; add --debug to the docker command to see the full message.
  • docker buildx version and docker compose version, to confirm Buildx 0.37.2 or later.
  • Write access to the project if the fix is moving a Dockerfile into the build context.

Run this first

step 1 of 3
docker --debug compose build 2>&1 | grep -i -A2 'privileges'

Look for additional privileges requested: pass "--allow=…"

Without --debug, Compose may print only that bake failed; with it, Bake's message names the exact path or entitlement.

Work out which cause you have

A few questions to narrow the list. Every answer ends in a command that confirms or rules the cause out — this cannot see your cluster, so nothing here is a certainty until you have checked.

Narrow it down

0 answered · nothing is sent anywhere

With docker --debug compose build, what does the message ask you to allow?

Cause space

3 of 3 still possible

  • The Dockerfile is outside the build contextCommon
  • A build secret or SSH key file is outside the projectCommon
  • The build asks for network.hostOccasional

Nothing ruled out yet. Answer the question above and the branches your answer eliminates will strike through here.

Check it with a tool

Or diagnose it manually

In this order. The first command usually contains the whole answer.

  1. Step 1

    docker --debug compose build 2>&1 | grep -i -A2 'privileges'

    Without --debug, Compose may print only that bake failed; with it, Bake's message names the exact path or entitlement.

    Look for additional privileges requested: pass "--allow=…"

  2. Step 2

    docker buildx version
docker compose version

    The error starts with Buildx 0.37.2; the fix lands in a Compose release after v5.6.1.

    Look for Buildx v0.37.2 or later; the Compose version

  3. Step 3

    docker compose config

    Shows every build input Compose hands to Bake, with paths resolved.

    Look for dockerfile:, secrets and ssh paths outside the project directory

Every cause, and how to fix it

Ordered by how often each one turns out to be the answer.

The Dockerfile is outside the build context

Common

build.dockerfile points at a file outside build.context: an absolute path, a ../ path, or the temporary Dockerfile-with-features that Dev Containers generate. Compose does not grant fs.read for it, and Buildx 0.37.2 enforces the check.

Confirm

docker compose config | grep -nE 'context:|dockerfile:'
docker buildx version

A dockerfile: path that is not inside its context:, with Buildx v0.37.2 or later

Fix

  • Move the Dockerfile inside the build context and make dockerfile: a path relative to it. This needs no permission at all.
  • If you cannot (Dev Containers generate the file), run that one build with the check off: BUILDX_BAKE_ENTITLEMENTS_FS=0 docker compose build. Only for a project you trust.
  • Upgrade Compose to the first release that includes #14325 when it ships, and drop the variable.
BUILDX_BAKE_ENTITLEMENTS_FS=0 docker compose build

Trusted projects only, for one command. It turns off a security check.

A build secret or SSH key file is outside the project

Common

A file-based build secret (secrets: with file: ~/.config/…, ~/.m2/settings.xml) or an ssh: key path outside the working directory is also read by Bake, and Compose does not grant it either.

Confirm

docker compose config | grep -nE -A3 'secrets:|ssh:'

file: or key paths under your home directory or another directory outside the project

Fix

  • Pass the secret from an environment variable (secrets: with environment:) instead of a file outside the project, if your Compose version supports it.
  • Or copy the file into a git-ignored directory inside the project for the build, and delete it after.
  • As a last resort for a trusted project: BUILDX_BAKE_ENTITLEMENTS_FS=0 for that build only.

The build asks for network.host

Occasional

build.network: host or build.entitlements: network.host needs the network.host entitlement, which Compose does not pass to Bake. BUILDX_BAKE_ENTITLEMENTS_FS=0 does not help here: it only covers filesystem checks.

Confirm

docker compose config | grep -nE 'network: host|entitlements'

network: host or network.host under build:

Fix

  • Drop network: host from the build if the build does not need the host's network.
  • Otherwise build that image with docker buildx build --allow network.host directly until Compose passes the entitlement.

Understanding it properly

Skip this if you are mid-incident — the working part of the page is above. Worth reading afterwards, because understanding the mechanism is what stops the next one.

In plain terms

Docker Compose v5 builds images through Buildx Bake. Bake has a safety rule: a build may not read files outside your project folder unless you allow it, so a compose file you downloaded cannot quietly copy your SSH keys into an image. Until Buildx 0.37.2 that rule was accidentally skipped in the mode Compose uses. The security fix switched it on, and Compose does not yet pass the permission for every file it hands to Bake, so builds that worked yesterday stop with this message.

Words used on this page

Buildx Bake
Buildx's command for building several images from one definition. Compose v5 builds through it.
Entitlement
A permission a build must be granted to do something potentially unsafe, such as reading files outside the working directory (fs.read) or using the host network (network.host).
Build context
The directory a build is allowed to read by default: build.context in the compose file.
BUILDX_BAKE_ENTITLEMENTS_FS
An environment variable Buildx reads; 0 turns its filesystem entitlement checks off. Buildx itself suggests it in the error output.
What is actually happening

Compose v5 runs docker buildx bake --progress rawjson. Before Buildx 0.37.2 the filesystem entitlement check was skipped under rawjson (GHSA-gwr2-q96m-6682, a high-severity advisory). From 0.37.2 it is enforced, and Bake stops with additional privileges requested: pass "--allow=fs.read=<path>" to grant requested privileges.

Compose grants fs.read only for build.context and build.additional_contexts. A build.dockerfile outside the context, a file-based build secret outside the project, or an SSH key path is not granted, so it is refused. The maintainer's reply lists the same gaps for secrets and for build.entitlements: network.host.

Dev Containers hit this on every Compose service with build:, because the Dev Containers CLI writes Dockerfile-with-features into a temporary directory and points dockerfile: at it.

Compose's fix (#14325, "grant permissions for configured build inputs") was merged on 12 Oct 2026. On 21 Oct 2026 it was not in any released Compose version: v5.6.1, released that day, only updates Go. Watch the Compose releases for the next version.

How to tell this is your problem
WhereWhat you see
docker compose build (with docker --debug)additional privileges requested: pass "--allow=fs.read=/path/to/Dockerfile" to grant requested privileges
docker compose build without --debugOften only: failed to execute bake: exit status 1
Bake's own outputTo disable filesystem entitlements checks, you can set BUILDX_BAKE_ENTITLEMENTS_FS=0 .
VS Code Dev ContainersThe container fails to build, with a path ending in devcontainercli/container-features/…/Dockerfile-with-features

How to know it is actually fixed

  • docker compose build completes without additional privileges requested.
  • After moving the Dockerfile, the build works without BUILDX_BAKE_ENTITLEMENTS_FS set.
  • Once a fixed Compose is installed, unset the variable and the build still works.

Stopping it happening again

  • Keep Dockerfiles inside their build context; a ../Dockerfile is the most common trigger.
  • Pin Docker tooling versions in CI and read the Buildx and Compose release notes before taking a new version.
  • Never set BUILDX_BAKE_ENTITLEMENTS_FS=0 in a CI job that builds code from pull requests.

Security considerations

  • BUILDX_BAKE_ENTITLEMENTS_FS=0 turns off the check that GHSA-gwr2-q96m-6682 restored: without it, a compose or Bake file can read any file your user can, outside the project, without asking. Use it only for projects you trust, for one command, and never set it globally or in CI for code from pull requests.
  • Do not hold Buildx below 0.37.2 to avoid the error: that keeps the vulnerability the release fixed.
  • A build secret that lives outside the project (credentials files under your home directory) is exactly what the check protects. Prefer passing secrets from environment variables or a file inside a directory you control.

Sources

Behaviour described here is drawn from official documentation. Where a figure could not be confirmed on an official page it is attributed in the text rather than stated as canonical.

Did this get you to an answer?

No text box on purpose — please do not paste production logs anywhere

Something wrong or out of date? Report it

Where to go next