Build contexts get mixed up

[dmytro-GL]

Issue Description

In some cases, files end up in a wrong image when building multiple services via compose.

Steps to reproduce the issue

$ tree --charset=ascii
.
|-- apps
|   |-- bar
|   |   |-- Dockerfile
|   |   `-- data
|   `-- foo
|       |-- Dockerfile
|       `-- data
`-- compose.yaml

4 directories, 5 files

$ cat apps/foo/Dockerfile
FROM docker.io/alpine:3.24.1 AS build

RUN mkdir /out
RUN --mount=source=./data,target=data \
    cp data /out


FROM docker.io/alpine:3.24.1

COPY --from=build /out /out

ENTRYPOINT ["cat", "/out/data"]

$ cat apps/bar/Dockerfile
FROM docker.io/alpine:3.24.1 AS build

RUN mkdir /out
RUN --mount=source=./data,target=data \
    cp data /out


FROM docker.io/alpine:3.24.1

COPY --from=build /out /out

ENTRYPOINT ["cat", "/out/data"]

$ cat apps/foo/data
DATA: foo

$ cat apps/bar/data
DATA: bar

$ cat compose.yaml
services:
  foo:
    build:
      context: ./apps/foo
  bar:
    build:
      context: ./apps/bar

Describe the results you received

$ podman compose up --build --force-recreate --remove 2>&1 | grep DATA
[bar] | DATA: bar
[foo] | DATA: foo

$ podman compose up --build --force-recreate --remove 2>&1 | grep DATA
[bar] | DATA: bar
[foo] | DATA: bar

$ podman compose up --build --force-recreate --remove 2>&1 | grep DATA
[bar] | DATA: bar
[foo] | DATA: bar

$ podman compose down
>>>> Executing external compose provider "/nix/store/ppwj4hj2rkxhrvg95mwbb34walh3q48j-podman-compose-1.6.0/bin/podman-compose". Please see podman-compose(1) for how to disable this message. <<<<

test_foo_1
test_bar_1
test_bar_1
test_foo_1
326bbf15e58a8b05908274611c5869ad209d3fa236b5b213ded45a272d328ac2
test_default

$ podman system prune -f 2>&1 >/dev/null

$ podman compose up --build --force-recreate --remove 2>&1 | grep DATA
[foo] | DATA: foo
[bar] | DATA: bar

$ podman compose up --build --force-recreate --remove 2>&1 | grep DATA
[foo] | DATA: foo
[bar] | DATA: foo

$ podman compose up --build --force-recreate --remove 2>&1 | grep DATA
[foo] | DATA: foo
[bar] | DATA: foo

Describe the results you expected

Files should be copied from the right context.

podman info output

$ podman info
host:
  arch: amd64
  buildahVersion: 1.44.0
  cdiSpecDirs:
  - /etc/cdi
  - /var/run/cdi
  cgroupControllers:
  - cpu
  - io
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: Unknown
    path: /nix/store/h6my01ir1pl92315z23ymr10b3b6asg2-podman-helper-binary-wrapper/bin/conmon
    version: 'conmon version 2.2.1, commit: c8cc2c4db27531bd4e084ce7857f73cd21ee639d'
  cpuUtilization:
    idlePercent: 89.16
    systemPercent: 2.05
    userPercent: 8.79
  cpus: 8
  databaseBackend: sqlite
  distribution:
    codename: yarara
    distribution: nixos
    version: "26.05"
  eventLogger: journald
  freeLocks: 2030
  hostname: work
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 100
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
  kernel: 6.18.36
  linkmode: dynamic
  logDriver: journald
  memFree: 1995509760
  memTotal: 33014988800
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    defaultNetwork: podman
    dns:
      package: Unknown
      path: /nix/store/ls4r52263z48i1gh2kmsasxmd7r636gg-podman-6.0.0/libexec/podman/aardvark-dns
      version: aardvark-dns 2.0.0
    package: Unknown
    path: /nix/store/ls4r52263z48i1gh2kmsasxmd7r636gg-podman-6.0.0/libexec/podman/netavark
    version: netavark 2.0.0
  ociRuntime:
    name: crun
    package: Unknown
    path: /nix/store/h6my01ir1pl92315z23ymr10b3b6asg2-podman-helper-binary-wrapper/bin/crun
    version: |-
      crun version 1.27.1
      commit: 3ec076b3b6714ec2f1a10533cf18d5605a6de637
      rundir: /run/user/1000/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +YAJL
  os: linux
  pasta:
    executable: /nix/store/ls4r52263z48i1gh2kmsasxmd7r636gg-podman-6.0.0/libexec/podman/pasta
    package: Unknown
    version: |
      pasta 2025_09_19.623dbf6
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /run/user/1000/podman/podman.sock
  rootlessNetworkCmd: pasta
  rootlessPortForwarder: rootlessport
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: ""
    selinuxEnabled: false
  serviceIsRemote: false
  swapFree: 0
  swapTotal: 0
  uptime: 265h 57m 24.00s (Approximately 11.04 days)
  variant: ""
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries: {}
store:
  containerStore:
    number: 3
    paused: 0
    running: 0
    stopped: 3
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /home/dmytro/.local/share/containers/storage
  graphRootAllocated: 274861129728
  graphRootUsed: 161695076352
  graphStatus:
    Backing Filesystem: btrfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Supports shifting: "false"
    Supports volatile: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 456
  runRoot: /run/user/1000/containers
  transientStore: false
  volumePath: /home/dmytro/.local/share/containers/storage/volumes
version:
  APIVersion: 6.0.0
  Built: 315532800
  BuiltTime: Tue Jan  1 00:00:00 1980
  GitCommit: ""
  GoVersion: go1.26.4
  Os: linux
  OsArch: linux/amd64
  Version: 6.0.0

Podman in a container

No

Privileged Or Rootless

None

Upstream Latest Release

Yes

Additional environment details

Additional environment details

Additional information

Additional information like issue happens only occasionally or issue happens with a particular architecture or on a particular setting

[dmytro-GL]

On second thought, I guess this should be submitted to https://github.com/containers/podman-compose.

[dmytro-GL]

Looks like this is a podman issue after all. I can reproduce it without compose:

$ podman build -t foo apps/foo && podman run --rm foo
[1/2] STEP 1/3: FROM docker.io/alpine:3.24.1 AS build
[1/2] STEP 2/3: RUN mkdir /out
--> 153c2bb1f6b5
[1/2] STEP 3/3: RUN --mount=source=./data,target=data     cp data /out
--> 4f7cb4a3831c
[2/2] STEP 1/4: FROM docker.io/alpine:3.24.1
[2/2] STEP 2/4: COPY --from=build /out /out
--> 258ff80a515d
[2/2] STEP 3/4: RUN true
--> aad88599c0e3
[2/2] STEP 4/4: ENTRYPOINT ["cat", "/out/data"]
[2/2] COMMIT foo
--> 42df2949f348
Successfully tagged localhost/foo:latest
42df2949f348005b4a26d49805c438f98d5ef3f1fe6d69a0733c3689286b8133
DATA: foo

$ podman build -t bar apps/bar && podman run --rm bar
[1/2] STEP 1/3: FROM docker.io/alpine:3.24.1 AS build
[1/2] STEP 2/3: RUN mkdir /out
--> Using cache 153c2bb1f6b56ec8d9ce0c678dafa70a26c331b816d7b8b9a5ad057253007e78
--> 153c2bb1f6b5
[1/2] STEP 3/3: RUN --mount=source=./data,target=data     cp data /out
--> Using cache 4f7cb4a3831cb562902ce35b80773e0d64a818df3823c3d83cad62e1bef40ced
--> 4f7cb4a3831c
[2/2] STEP 1/3: FROM docker.io/alpine:3.24.1
[2/2] STEP 2/3: COPY --from=build /out /out
--> Using cache 258ff80a515dedde12b3ac35dcdddf3d96ac7440c80cc63a97a751499bb023d3
--> 258ff80a515d
[2/2] STEP 3/3: ENTRYPOINT ["cat", "/out/data"]
[2/2] COMMIT bar
--> 2b9da5c8742c
Successfully tagged localhost/bar:latest
2b9da5c8742c5eb60a181770fe526a17dc87343bad20560be8785b440f5f31a0
DATA: foo

So it looks like the second build uses the cached RUN --mount=source=./data even though it is a different file.

[MayukhSobo]

I can work on it. Can it be assigned to me?

[MayukhSobo]

Hey @dmytro-GL and @danishprakash, so I dug into this and good news — it's not actually a podman bug, it's coming from buildah (vendored in here).

Here's what's going on: when you write RUN --mount=source=./data,target=data without explicitly adding type=bind (which is completely normal — bind is the default when you don't say otherwise), there's a spot in buildah's caching code that figures out the mount type for cache-key purposes, and it doesn't apply that same "no type = bind" default. So it ends up treating your mount as "not a bind mount" and skips hashing the file's contents — which is exactly the check that's supposed to catch cases like foo and bar having different data files. Since that checksum never happens, the two builds end up with identical cache keys even though the underlying file is different, and that's the mixup you're seeing.

I reproduced it locally and confirmed a fix (just making that one default match what the rest of buildah already does). Since the actual bug lives upstream, I'm going to open a PR against buildah directly rather than patching it here — I'll follow up on this issue with the buildah PR link, and again with the podman-side vendor bump once it's merged and released. Thanks for the clear repro, by the way — made this way easier to track down.