[BUG] config --hash does not match container config-hash for services using env_file

[JeanneD4RK]

Description

Description

For a service using env_file, the output of:

docker compose config --hash <service>

does not match the com.docker.compose.config-hash label written to a newly created container.

This happens even immediately after docker compose up --force-recreate, so the difference is not caused by an outdated container.

Actual behavior

The hashes differ, and the final test command returns non-zero.

Removing env_file and declaring the same environment variable inline avoids the discrepancy.

Expected behavior

Immediately after forcing container recreation, docker compose config --hash app should match the container's com.docker.compose.config-hash label.

This comparison previously worked and was reported in:

#9211

Suspected regression

The following commit added cli.WithoutEnvironmentResolution to several config --... operations, including runHash:

ab81db5

It was introduced in Compose v2.22.0 through:

#11025

As a result:

• config --hash hashes the service without resolving its service-level env_file.
• Container creation hashes the resolved service environment before writing com.docker.compose.config-hash.

Skipping env_file resolution makes sense for commands such as config --services and config --volumes, but it prevents config --hash from representing the configuration used to create the container.

Version comparison

• v2.21.0: last release where runHash still resolved env_file.
• v2.22.0: first release containing the suspected regression.
• v5.2.0: still affected.

Steps To Reproduce

Create compose.yaml:

services:
  app:
    image: alpine:latest
    command: ["sh", "-c", "while true; do sleep 3600; done"]
    env_file:
      - app.env

Create app.env:

EXAMPLE=value

Run:

docker compose up -d --force-recreate

config_hash="$(
  docker compose config --hash app |
  awk '{print $2}'
)"

container_hash="$(
  docker inspect \
    --format '{{index .Config.Labels "com.docker.compose.config-hash"}}' \
    "$(docker compose ps --quiet app)"
)"

printf 'config hash:    %s\ncontainer hash: %s\n' \
  "$config_hash" "$container_hash"

test "$config_hash" = "$container_hash"

Compose Version

5.2.0

Docker Environment

Client: Docker Engine - Community
 Version:    29.6.0
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.35.0
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.21.0
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 12
  Running: 12
  Paused: 0
  Stopped: 0
 Images: 19
 Server Version: 29.6.0
 Storage Driver: overlayfs
  driver-type: io.containerd.snapshotter.v1
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: e53c7c1516c3b2bff98eb76f1f4117477e6f4e66
 runc version: v1.3.6-0-g491b69ba
 init version: de40ad0
 Security Options:
  apparmor
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.1.0-50-cloud-amd64
 Operating System: Debian GNU/Linux 12 (bookworm)
 OSType: linux
 Architecture: x86_64
 CPUs: 4
 Total Memory: 15.63GiB
 Name: pintazu1s-vdocker01
 ID: c9874c8c-6294-47f2-aac0-10c3de282fe1
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 HTTP Proxy: http://10.1.10.5:8888
 HTTPS Proxy: http://10.1.10.5:8888
 Experimental: false
 Insecure Registries:
  ::1/128
  127.0.0.0/8
 Live Restore Enabled: false
 Default Address Pools:
   Base: 172.16.0.0/12, Size: 27
 Firewall Backend: iptables
  EnableUserlandProxy: true
  UserlandProxyPath: /usr/bin/docker-proxy

Anything else?

No response