fix(docker): let compose builds read the Features Dockerfile

Building a compose configuration now goes through `docker compose
build`, as in TS. Compose builds through bake, and bake on buildx 0.38
and later refuses the Features Dockerfile, written under the cache
folder outside the build context, unless --allow=fs.read is passed,
which compose cannot do. TestE2E_ComposeBuildLabel failed that way on
the runners. The compose processes this CLI starts get
BUILDX_BAKE_ENTITLEMENTS_FS=0 unless the variable is already set. The
reference fails there; docs/DIVERGENCES.md records it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: aledbf

docs/DIVERGENCES.md

@@ -27,6 +27,13 @@ touches a compared surface, reflected in the parity matrix.
   Dockerfile as it is (`TestEnsureFinalStageNameReadsAContinuedFrom`,
   `internal/docker/testdata/ts-oracle/dockerfile.json`). Every other FROM line is
   handled exactly as TS handles it.
+- **Compose builds may read the Features Dockerfile outside the build context.** Compose
+  builds through bake, and bake on buildx 0.38 and later refuses to read a file outside the
+  context unless the caller passes `--allow=fs.read`, which `docker compose build` cannot.
+  The reference writes the Features Dockerfile under its cache folder and fails there with
+  "additional privileges requested". This CLI starts its `docker compose` processes with
+  `BUILDX_BAKE_ENTITLEMENTS_FS=0` unless the variable is already set
+  (`TestWithBakeFSEntitlement`, `TestE2E_ComposeBuildLabel`).
 - **`--override-config` deep-merges** the override onto the base config, whereas TS
   replaces the config wholesale (`readDocument(overrideConfigFile ?? configFile)`). With
   no readable base, the override stands alone — identical to TS. This lets an orchestrator

internal/docker/compose.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"os"
 	osexec "os/exec"
 	"slices"
 	"strconv"
@@ -45,7 +46,7 @@ func NewComposeClient(dockerPath, composePath string, env []string, logger log.L
 		return &ComposeClient{
 			Command: []string{dockerPath, "compose"},
 			Version: parseComposeVersion(strings.TrimSpace(string(out))),
-			Env:     env,
+			Env:     withBakeFSEntitlement(env, os.LookupEnv),
 			Log:     logger,
 		}, nil
 	}
@@ -55,6 +56,24 @@ func NewComposeClient(dockerPath, composePath string, env []string, logger log.L
 	return nil, fmt.Errorf("'docker compose' (v2) not found")
 }
 
+// bakeFSEntitlement turns off bake's filesystem entitlement check for the
+// compose processes this CLI starts. Compose builds through bake, and bake on
+// buildx 0.38 and later refuses to read a Dockerfile outside the build context
+// unless the caller passes --allow=fs.read, which `docker compose build` cannot;
+// the Features Dockerfile this CLI writes lives in its cache folder, outside the
+// context. The reference passes nothing and fails there ("additional privileges
+// requested"); docs/DIVERGENCES.md records the difference.
+const bakeFSEntitlement = "BUILDX_BAKE_ENTITLEMENTS_FS"
+
+// withBakeFSEntitlement is env plus BUILDX_BAKE_ENTITLEMENTS_FS=0, unless env or
+// the process environment (lookup) already sets it.
+func withBakeFSEntitlement(env []string, lookup func(string) (string, bool)) []string {
+	if _, ok := lookup(bakeFSEntitlement); ok || slices.ContainsFunc(env, func(kv string) bool { return strings.HasPrefix(kv, bakeFSEntitlement+"=") }) {
+		return env
+	}
+	return append(slices.Clone(env), bakeFSEntitlement+"=0")
+}
+
 // Run executes a compose command and captures output (no live streaming).
 func (c *ComposeClient) Run(ctx context.Context, args ...string) (*ExecResult, error) {
 	return c.run(ctx, false, args...)

internal/docker/compose_test.go

@@ -1,6 +1,7 @@
 package docker
 
 import (
+	"slices"
 	"testing"
 )
 
@@ -135,3 +136,24 @@ func TestBuildGlobalArgs_NoEnvFile(t *testing.T) {
 		t.Errorf("args = %v", args)
 	}
 }
+
+// The compose processes get BUILDX_BAKE_ENTITLEMENTS_FS=0 so bake reads the
+// Features Dockerfile outside the build context, unless the user set it.
+func TestWithBakeFSEntitlement(t *testing.T) {
+	unset := func(string) (string, bool) { return "", false }
+	if got := withBakeFSEntitlement([]string{"A=1"}, unset); !slices.Equal(got, []string{"A=1", "BUILDX_BAKE_ENTITLEMENTS_FS=0"}) {
+		t.Errorf("unset: %q", got)
+	}
+	if got := withBakeFSEntitlement(nil, func(k string) (string, bool) { return "1", k == "BUILDX_BAKE_ENTITLEMENTS_FS" }); len(got) != 0 {
+		t.Errorf("set in the process: %q, want it left alone", got)
+	}
+	if got := withBakeFSEntitlement([]string{"BUILDX_BAKE_ENTITLEMENTS_FS=1"}, unset); !slices.Equal(got, []string{"BUILDX_BAKE_ENTITLEMENTS_FS=1"}) {
+		t.Errorf("set in env: %q", got)
+	}
+	env := make([]string, 1, 4)
+	env[0] = "A=1"
+	withBakeFSEntitlement(env, unset)
+	if env[:2][1] != "" {
+		t.Error("the caller's env was written to")
+	}
+}