Docker Compose 5

Apply the Dockerfile 1 prompt first. Use these rules for Docker Compose CLI 5 deploying Linux containers through Docker Engine, including Docker Desktop's Linux backend; they were checked against 5.5.0. Validate Windows containers, Swarm deployments, and other Compose implementations separately.

Version and deployment scope

• Pin the approved Compose CLI and deployment toolchain in automation, record docker compose version and docker version, and maintain a reviewed upgrade path. The obsolete top-level version field does not select or freeze Compose behavior; no Compose 5 release is long-term supported.
• Verify Engine API, kernel, cgroup, and builder support for the settings actually used. Fail deployment when required isolation or limits are unsupported; a valid Compose model does not prove that the runtime enforces it, and deploy does not turn compose up into a Swarm deployment.
• Select the Docker context explicitly and keep DOCKER_CONTEXT, DOCKER_HOST, credentials, and project names under deployment control. Use authenticated SSH or mutually authenticated TLS for remote engines, and isolate mutually untrusted workloads beyond Compose project names.

Configuration and model authority

• Treat Compose files and every transitive include or extends as executable deployment authority. Review authorship and content before loading them; pin remote OCI references to digests and Git references to commits. Configuration loading can fetch dependencies and read host files through env_file, label_file, secrets, configs, and symlinks without confining