Nested bind mounts broken on macOS arm64 since Docker Desktop 4.67.0

[HilSny]

Bug description

After upgrading from Docker Desktop 4.66.1 to 4.67.0, nested/overlapping bind mounts no longer work on macOS Apple Silicon. The child mount appears empty inside the container — it shows the host's empty placeholder directory rather than the overlaid content. Downgrading to 4.66.1 resolves the issue immediately.

Reproduction steps

1. Create the following structure:

mkdir -p project/src/shared
echo "console.log('hello')" > project/src/index.js
mkdir -p _shared/utils
echo "module.exports = 'works'" > _shared/utils/index.js

2. Create docker-compose.yml:

services:
  app:
    image: node:24-alpine
    working_dir: /app
    command: node -e "require('./src/shared/utils')"
    volumes:
      - ./project/src:/app/src
      - ./_shared:/app/src/shared

3. Run docker compose up

Expected: The require succeeds because /app/src/shared contains the overlaid _shared content.

Actual: /app/src/shared is empty inside the container. The child mount is not overlaying the parent mount.

Volume declaration order (parent-first vs child-first) makes no difference. docker compose config and docker inspect both show the correct mount configuration, but the filesystem inside the container does not reflect the child overlay.

Workaround

Downgrade to Docker Desktop 4.66.1.

[HilSny]

The 4.67.0 release notes mention a fix for "race condition between Rosetta binfmt registration and virtiofs device availability" on Apple Silicon. This may have changed mount ordering/timing and could be related to this regression.

[mat007]

Hi! Thanks for raising this issue.
We believe a fix for it will be released in Docker Desktop 4.68 that will ship early next week.
In the meanwhile you can verify this by installing this RC build for Mac Arm.

[HilSny]

Update on 4.68.0 (223183): Still reproducing. I tested more thoroughly and found:

• docker run with the same bind mounts works correctly (both orderings)
• docker compose up does NOT work — the child mount is always empty regardless of declaration order
• docker inspect shows the correct bind configuration
• The mounts appear correct in metadata, but the filesystem inside the container shows an empty directory for the child mount

This appears to be a Docker Compose (v5.1.1) issue rather than a Docker Engine issue — the engine handles nested mounts correctly when called directly via docker run, but Compose is not setting them up properly.

Reproduction with docker run (works):

docker run --rm \
  -v ./project/src:/app/src \
  -v ./_shared:/app/src/shared \
  node:24-alpine ls /app/src/shared/
# outputs files correctly

Reproduction with docker compose up (broken):

services:
  app:
    image: node:24-alpine
    working_dir: /app
    command: ls src/shared/
    volumes:
      - ./project/src:/app/src
      - ./_shared:/app/src/shared

docker compose up
# src/shared/ is empty

Still on Docker Desktop 4.68.0 (223183), Compose v5.1.1.

[HilSny]

@mat007 tagging you on the update above — still reproducing on the 4.68.0 RC. It looks like the issue is in the Compose layer rather than the engine, since docker run with the same bind mounts works correctly.

[spalx]

@mat007 tagging you on the update above — still reproducing on the 4.68.0 RC. It looks like the issue is in the Compose layer rather than the engine, since docker run with the same bind mounts works correctly.

I can confirm that the issue also exists when using docker run, so it is not only at compose layer.

[rinatkhaziev]

@mat007 In case this helps with ya'lls debugging - I just wanted to point out this is only present when FS set to VirtioFS, gRPC and osxfs legacy work as expected.

[mat007]

I’m having trouble reproducing it. @HilSny here is the script I’m running on Docker Desktop RC linked above 4.68.0 (223183), based on your repro instructions:

#!/bin/bash
set -euo pipefail

mkdir -p project/src/shared
echo "console.log('hello')" > project/src/index.js
mkdir -p _shared/utils
echo "module.exports = 'works'" > _shared/utils/index.js

cat > compose.yaml <<'YAML'
services:
  app:
    image: node:24-alpine
    working_dir: /app
    command: ls src/shared/
    volumes:
      - ./project/src:/app/src
      - ./_shared:/app/src/shared
YAML

docker compose up --abort-on-container-exit
docker compose down

Does it look right to you?

Here is my output:

$ ./repro-264.sh 
[+] up 2/2
 ✔ Network repro_default Created
 ✔ Container repro-app-1 Created
Attaching to app-1
app-1  | utils
app-1 exited with code 0
Aborting on container exit...
Container repro-app-1 Stopping 
Container repro-app-1 Stopped
[+] down 2/2
 ✔ Container repro-app-1 Removed
 ✔ Network repro_default Removed

What does it print for you?
(run it in an empty folder)

Thanks!