Bug when merging when TCP and UDP on the same published port

まず compose.yaml と compose.override.yaml で問題を再現し、その後、両方のマージ順序で docker stack config を実行します。短い構文と長い構文を含む、サービスのポートに対する Docker CLI の Compose ファイルのマージ処理を追跡します。override で ports が定義されていない場合に、マージ後の出力で公開ポート 443 の TCP と UDP の両方のエントリが保持されれば完了です。

Description

When merging multiple stack Compose files where one defines a service exposing TCP and UDP on the same published port (e.g., 443), the resulting merged configuration silently drops the first port entry. Even if the override doesn't specify ports. The only work-around I've found is to change the merge order but that's only a viable solution if you're not relying on overriding other values.

This violates the expected behavior where the ports array should remain unchanged if not explicitly overridden.

Reproduce

Given the following files:

# compose.yaml
services:
  web:
    image: caddy
    ports:
      - "80:80"
      - "443:443" # adding /tcp here makes no difference
      - "443:443/udp"

# compose.override.yaml
services:
  web:
    environment:
      FOO: bar

Running the following command:

docker stack config -c compose.yaml -c compose.override.yaml

Returns the following:

version: "3.13"
services:
  web:
    environment:
      FOO: bar
    image: caddy
    ports:
      - mode: ingress
        target: 80
        published: 80
        protocol: tcp
      - mode: ingress
        target: 443
        published: 443
        protocol: udp

Note that the 443 tcp entry is now gone.
The same is true when using long syntax.
Reversing the merge order leaves the ports array intact:

docker stack config -c compose.override.yaml -c compose.yaml

Returns the following:

version: "3.13"
services:
  web:
    environment:
      FOO: bar
    image: caddy
    ports:
      - mode: ingress
        target: 80
        published: 80
        protocol: tcp
      - mode: ingress
        target: 443
        published: 443
        protocol: tcp
      - mode: ingress
        target: 443
        published: 443
        protocol: udp

I've found that merging on a service that uses the same port for both tcp and udp only work as expected if the ports array is only defined in the last file.

Expected behavior

I expect the resulting ports array to be the same (untouched) in the examples above.

docker version

Client: Docker Engine - Community
 Version:           28.0.0
 API version:       1.48
 Go version:        go1.24.0
 Git commit:        f9ced58158
 Built:             Wed Feb 19 22:05:47 2025
 OS/Arch:           darwin/arm64
 Context:           desktop-linux

Server: Docker Desktop 4.43.2 (199162)
 Engine:
  Version:          28.3.2
  API version:      1.51 (minimum version 1.24)
  Go version:       go1.24.5
  Git commit:       e77ff99
  Built:            Wed Jul  9 16:13:56 2025
  OS/Arch:          linux/arm64
  Experimental:     true
 containerd:
  Version:          1.7.27
  GitCommit:        05044ec0a9a75232cad458027ca83437aae3f4da
 runc:
  Version:          1.2.5
  GitCommit:        v1.2.5-0-g59923ef
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

docker info

Client: Docker Engine - Community
 Version:    28.0.0
 Context:    desktop-linux
 Debug Mode: false

Additional Info

No response