[BUG] permission denied on .env file in current directory lead to error

[Ptipoi-jf]

Description

my current use case is using a sudo command to execute a tool that execute some docker commands...

to simplify the problem, running the following command fail with a permission denied (and btw the .env file did not exists)

[root@myhost ~]# sudo -u myuser docker compose -p myproject ps -a --format "{{.ID}}|{{title .Status}}|{{.Ports}}"
stat /root/.env: permission denied
[root@myhost ~]# sudo -u myuser docker compose ps -a --format "{{.ID}}|{{title .Status}}|{{.Ports}}"
stat /root/.env: permission denied

With current working directory changes it work as expected (no .env file in the /tmp directory)

[root@myhost ~]# cd /tmp
[root@myhost tmp]# sudo -u myuser docker compose ps -a --format "{{.ID}}|{{title .Status}}|{{.Ports}}"
no configuration file provided: not found
[root@myhost tmp]# sudo -u myuser docker compose -p myproject ps -a --format "{{.ID}}|{{title .Status}}|{{.Ports}}"
29ddbf36662e|Exited (0) 4 Minutes Ago|
05ed8afdf90d|Exited (0) 4 Minutes Ago|
797d87bcc51e|Exited (0) 4 Minutes Ago|
6be65b4385c5|Exited (0) 4 Minutes Ago|

Why do not just print a warning for this permission denied ?
Is there an acceptable workarround for this ?

Thanks fj

Compose Version

docker-compose-plugin-5.5.0-1.el9.x86_64

Docker Environment

RedHat 9
container-selinux-2.235.0-1.el9_6.noarch
docker-ce-cli-29.7.2-1.el9.x86_64
containerd.io-2.3.4-1.el9.x86_64
docker-ce-rootless-extras-29.7.2-1.el9.x86_64
docker-ce-29.7.2-1.el9.x86_64

Anything else?

i didn't test in different system, i guess it working like this

[ndeloof]

Thanks — confirmed, and this is a real bug. What happens: without an explicit --env-file, compose probes <cwd>/.env as an implicit convenience. Under sudo -u myuser your cwd stays /root (mode 0700), so the probe fails with EACCES — and that failure is treated as fatal even though you never asked for an env file (and ps -p <project> doesn't need one at all).

Fix: compose-spec/compose-go#925 — a permission error on the implicit default .env probe now logs a warning and skips it (an explicit --env-file keeps failing hard). It will reach compose with the next compose-go bump.

Workarounds until then:

• COMPOSE_DISABLE_ENV_FILE=1 — disables exactly that implicit .env lookup:

  sudo -u myuser COMPOSE_DISABLE_ENV_FILE=1 docker compose -p myproject ps -a
  

• or run from a directory myuser can read (cd /tmp), as you found.