Pre start init containers

go.mod

@@ -152,3 +152,5 @@ exclude (
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
 )
+
+replace github.com/compose-spec/compose-go/v2 => github.com/glours/compose-go/v2 v2.0.0-20260616130530-4d8d8518aa44

go.sum

@@ -38,8 +38,6 @@ github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg
 github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
 github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb h1:EDmT6Q9Zs+SbUoc7Ik9EfrFqcylYqgPZ9ANSbTAntnE=
 github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb/go.mod h1:ZjrT6AXHbDs86ZSdt/osfBi5qfexBrKUdONk989Wnk4=
-github.com/compose-spec/compose-go/v2 v2.11.0 h1:xoq/ootgIL6TsHmbJHrkuh7+bzjhPV3NHftHRPPyVXM=
-github.com/compose-spec/compose-go/v2 v2.11.0/go.mod h1:ZU6zlcweCZKyiB7BVfCizQT9XmkEIMFE+PRZydVcsZg=
 github.com/containerd/cgroups/v3 v3.1.3 h1:eUNflyMddm18+yrDmZPn3jI7C5hJ9ahABE5q6dyLYXQ=
 github.com/containerd/cgroups/v3 v3.1.3/go.mod h1:PKZ2AcWmSBsY/tJUVhtS/rluX0b1uq1GmPO1ElCmbOw=
 github.com/containerd/console v1.0.5 h1:R0ymNeydRqH2DmakFNdmjR2k0t7UPuiOV/N/27/qqsc=
@@ -118,6 +116,8 @@ github.com/fsnotify/fsevents v0.2.0 h1:BRlvlqjvNTfogHfeBOFvSC9N0Ddy+wzQCQukyoD7o
 github.com/fsnotify/fsevents v0.2.0/go.mod h1:B3eEk39i4hz8y1zaWS/wPrAP4O6wkIl7HQwKBr1qH/w=
 github.com/fvbommel/sortorder v1.1.0 h1:fUmoe+HLsBTctBDoaBwpQo5N+nrCp8g/BjKb/6ZQmYw=
 github.com/fvbommel/sortorder v1.1.0/go.mod h1:uk88iVf1ovNn1iLfgUVU2F9o5eO30ui720w+kxuqRs0=
+github.com/glours/compose-go/v2 v2.0.0-20260616130530-4d8d8518aa44 h1:XDtwWZnY8HX5rxRvC1g2oAuZibFDm45iBLCpp4KzQ7k=
+github.com/glours/compose-go/v2 v2.0.0-20260616130530-4d8d8518aa44/go.mod h1:ZU6zlcweCZKyiB7BVfCizQT9XmkEIMFE+PRZydVcsZg=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=

pkg/compose/containers.go

@@ -162,6 +162,10 @@ func isNotOneOff(c container.Summary) bool {
 	return !ok || v == "False"
 }
 
+func isNotRunning(c container.Summary) bool {
+	return c.State != container.StateRunning
+}
+
 // filter return Containers with elements to match predicate
 func (containers Containers) filter(predicates ...containerPredicate) Containers {
 	var filtered Containers

pkg/compose/convergence.go

@@ -537,37 +537,50 @@ func (s *composeService) startService(ctx context.Context,
 		return fmt.Errorf("service %q has no container to start", service.Name)
 	}
 
-	for _, ctr := range containers.filter(isService(service.Name)) {
-		if ctr.State == container.StateRunning {
-			continue
-		}
+	serviceContainers := containers.filter(isService(service.Name), isNotOneOff)
+	toStart := serviceContainers.filter(isNotRunning)
+	if len(toStart) == 0 {
+		return nil
+	}
 
-		err = s.injectSecrets(ctx, project, service, ctr.ID)
-		if err != nil {
+	// pre_start runs once per service, only when no replica is already running
+	// (e.g. initial up, force-recreate, or spec change). per_replica: false is
+	// the only currently supported mode.
+	if len(service.PreStart) > 0 && len(serviceContainers) == len(toStart) {
+		if err := s.runPreStart(ctx, project, service, toStart[0], listener); err != nil {
 			return err
 		}
+	}
 
-		err = s.injectConfigs(ctx, project, service, ctr.ID)
-		if err != nil {
+	for _, ctr := range toStart {
+		if err := s.startServiceContainer(ctx, project, service, ctr, listener); err != nil {
 			return err
 		}
+	}
+	return nil
+}
 
-		eventName := getContainerProgressName(ctr)
-		s.events.On(newEvent(eventName, api.Working, api.StatusStarting))
-		_, err = s.apiClient().ContainerStart(ctx, ctr.ID, client.ContainerStartOptions{})
-		if err != nil {
-			return err
-		}
+func (s *composeService) startServiceContainer(ctx context.Context, project *types.Project, service types.ServiceConfig, ctr container.Summary, listener api.ContainerEventListener) error {
+	if err := s.injectSecrets(ctx, project, service, ctr.ID); err != nil {
+		return err
+	}
+	if err := s.injectConfigs(ctx, project, service, ctr.ID); err != nil {
+		return err
+	}
 
-		for _, hook := range service.PostStart {
-			err = s.runHook(ctx, ctr, service, hook, listener)
-			if err != nil {
-				return err
-			}
-		}
+	eventName := getContainerProgressName(ctr)
+	s.events.On(newEvent(eventName, api.Working, api.StatusStarting))
+	if _, err := s.apiClient().ContainerStart(ctx, ctr.ID, client.ContainerStartOptions{}); err != nil {
+		return err
+	}
 
-		s.events.On(newEvent(eventName, api.Done, api.StatusStarted))
+	for _, hook := range service.PostStart {
+		if err := s.runHook(ctx, ctr, service, hook, listener); err != nil {
+			return err
+		}
 	}
+
+	s.events.On(newEvent(eventName, api.Done, api.StatusStarted))
 	return nil
 }
 

pkg/compose/pre_start.go

@@ -0,0 +1,219 @@
+/*
+   Copyright 2020 Docker Compose CLI authors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package compose
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/compose-spec/compose-go/v2/types"
+	"github.com/moby/moby/api/pkg/stdcopy"
+	"github.com/moby/moby/api/types/container"
+	"github.com/moby/moby/client"
+	"github.com/moby/moby/client/pkg/versions"
+
+	"github.com/docker/compose/v5/pkg/api"
+	"github.com/docker/compose/v5/pkg/utils"
+)
+
+// runPreStart executes the service's pre_start hooks sequentially, in declared
+// order. Each hook runs as an ephemeral container that shares the service
+// container's volumes via VolumesFrom and is attached to the same networks.
+// A non-zero exit gates service start.
+//
+// With per_replica: false (the only currently supported mode), the hook sees
+// the volumes of the first non-running replica only — anonymous volumes and
+// tmpfs mounts are per-replica and not shared. Use named volumes or bind
+// mounts for data the hook produces.
+func (s *composeService) runPreStart(ctx context.Context, project *types.Project, service types.ServiceConfig, ctr container.Summary, listener api.ContainerEventListener) error {
+	// Validate every hook up front so an unsupported entry never triggers any I/O.
+	for i, hook := range service.PreStart {
+		if hook.PerReplica {
+			return fmt.Errorf("service %q pre_start[%d]: per_replica is not yet supported; remove per_replica or set it to false", service.Name, i)
+		}
+	}
+	for i, hook := range service.PreStart {
+		if err := s.runPreStartHook(ctx, project, service, ctr, i, hook, listener); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (s *composeService) runPreStartHook(
+	ctx context.Context, project *types.Project, service types.ServiceConfig,
+	ctr container.Summary, index int, hook types.ServiceHook, listener api.ContainerEventListener,
+) error {
+	created, err := s.createPreStartContainer(ctx, project, service, ctr, hook)
+	if err != nil {
+		return err
+	}
+
+	// Subscribe to wait before start to avoid missing the exit event for short-lived hooks.
+	// WaitConditionNotRunning would match immediately because the container is still in
+	// "created" state, so use WaitConditionNextExit to block until the run actually finishes.
+	waitRes := s.apiClient().ContainerWait(ctx, created.ID, client.ContainerWaitOptions{
+		Condition: container.WaitConditionNextExit,
+	})
+
+	// Open the log stream before ContainerStart so AutoRemove cannot race us
+	// to a 404 on a fast-exiting hook.
+	logsDone := s.streamPreStartLogs(ctx, created.ID, service, index, listener)
+
+	if _, err := s.apiClient().ContainerStart(ctx, created.ID, client.ContainerStartOptions{}); err != nil {
+		<-logsDone
+		return err
+	}
+
+	waitErr := waitPreStart(ctx, service.Name, index, waitRes)
+	<-logsDone
+	return waitErr
+}
+
+func (s *composeService) createPreStartContainer(
+	ctx context.Context, project *types.Project, service types.ServiceConfig,
+	ctr container.Summary, hook types.ServiceHook,
+) (client.ContainerCreateResult, error) {
+	image := hook.Image
+	if image == "" {
+		image = api.GetImageNameOrDefault(service, project.Name)
+	}
+
+	cfg := &container.Config{
+		Image:      image,
+		Cmd:        hook.Command,
+		User:       hook.User,
+		WorkingDir: hook.WorkingDir,
+		Env:        append(ToMobyEnv(service.Environment), ToMobyEnv(hook.Environment)...),
+	}
+	hostCfg := &container.HostConfig{
+		AutoRemove:  true,
+		Privileged:  hook.Privileged,
+		VolumesFrom: []string{ctr.ID},
+	}
+
+	apiVersion, err := s.RuntimeAPIVersion(ctx)
+	if err != nil {
+		return client.ContainerCreateResult{}, err
+	}
+
+	networkMode, networkingConfig, err := defaultNetworkSettings(project, service, 0, nil, true, apiVersion)
+	if err != nil {
+		return client.ContainerCreateResult{}, err
+	}
+	hostCfg.NetworkMode = networkMode
+
+	created, err := s.apiClient().ContainerCreate(ctx, client.ContainerCreateOptions{
+		Config:           cfg,
+		HostConfig:       hostCfg,
+		NetworkingConfig: networkingConfig,
+	})
+	if err != nil {
+		return client.ContainerCreateResult{}, err
+	}
+
+	if versions.LessThan(apiVersion, apiVersion144) {
+		if err := s.connectPreStartExtraNetworks(ctx, project, service, created.ID, networkMode); err != nil {
+			return client.ContainerCreateResult{}, err
+		}
+	}
+	return created, nil
+}
+
+// connectPreStartExtraNetworks mirrors the createMobyContainer fallback path for
+// older API versions: ContainerCreate only accepts one EndpointsConfig, so extra
+// networks have to be attached via NetworkConnect after creation.
+func (s *composeService) connectPreStartExtraNetworks(ctx context.Context, project *types.Project, service types.ServiceConfig, containerID string, primary container.NetworkMode) error {
+	for _, networkKey := range service.NetworksByPriority() {
+		mobyNetworkName := project.Networks[networkKey].Name
+		if string(primary) == mobyNetworkName {
+			continue
+		}
+		eps, err := createEndpointSettings(project, service, 0, networkKey, nil, true)
+		if err != nil {
+			return err
+		}
+		if _, err := s.apiClient().NetworkConnect(ctx, mobyNetworkName, client.NetworkConnectOptions{
+			Container:      containerID,
+			EndpointConfig: eps,
+		}); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func waitPreStart(ctx context.Context, serviceName string, index int, waitRes client.ContainerWaitResult) error {
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	case err := <-waitRes.Error:
+		return err
+	case res := <-waitRes.Result:
+		if res.Error != nil {
+			return fmt.Errorf("service %q pre_start[%d] wait error: %s", serviceName, index, res.Error.Message)
+		}
+		if res.StatusCode != 0 {
+			return fmt.Errorf("service %q pre_start[%d] exited with code %d", serviceName, index, res.StatusCode)
+		}
+	}
+	return nil
+}
+
+// streamPreStartLogs returns a channel that is closed once the hook log stream
+// has been fully drained (or never opened). Callers must wait on it before
+// returning so the goroutine cannot outlive the hook.
+func (s *composeService) streamPreStartLogs(ctx context.Context, containerID string, service types.ServiceConfig, index int, listener api.ContainerEventListener) <-chan struct{} {
+	done := make(chan struct{})
+	if listener == nil {
+		close(done)
+		return done
+	}
+	source := fmt.Sprintf("%s pre_start[%d] ->", service.Name, index)
+	logs, err := s.apiClient().ContainerLogs(ctx, containerID, client.ContainerLogsOptions{
+		ShowStdout: true,
+		ShowStderr: true,
+		Follow:     true,
+	})
+	if err != nil {
+		listener(api.ContainerEvent{
+			Type:    api.HookEventLog,
+			Source:  source,
+			ID:      containerID,
+			Service: service.Name,
+			Line:    fmt.Sprintf("warning: could not attach pre_start log stream: %s", err),
+		})
+		close(done)
+		return done
+	}
+	go func() {
+		defer close(done)
+		defer logs.Close() //nolint:errcheck
+		w := utils.GetWriter(func(line string) {
+			listener(api.ContainerEvent{
+				Type:    api.HookEventLog,
+				Source:  source,
+				ID:      containerID,
+				Service: service.Name,
+				Line:    line,
+			})
+		})
+		defer w.Close() //nolint:errcheck
+		_, _ = stdcopy.StdCopy(w, w, logs)
+	}()
+	return done
+}