adopt compose-go jobs and container-spec layering

[ndeloof]

Adopts compose-spec/compose-go#866 (jobs top-level element, container specification layered as ContainerSpec/WorkloadSpec, pre_start hooks carrying the full container specification).

This first step adapts the types and gives jobs their first runtime entry point:

• composite literals setting moved fields are wrapped into the embedded ContainerSpec/WorkloadSpec (no behavior change; promoted field access was already source-compatible)

• pre_start handling is typed against PreStartHook; exec hooks (post_start/pre_stop) lose the image field they never honored — now enforced by construction

• up warns about declared jobs (pointing at docker compose run to trigger them) and fails on active (profile-enabled) scheduled jobs with scheduled jobs are not supported in this version: silently not scheduling would break expectations, while manual jobs just wait for an explicit trigger

• docker compose run <job> executes a job exactly like a service: the job — a ContainerSpec+WorkloadSpec, the same layers a service is made of — is materialized as a service for the one-off machinery; its profile is activated, its dependencies start as they would for a service, the exit code flows back. Per the spec, manual execution is always available — scheduled jobs included — unless the job explicitly opts out with triggers.manual: false (tri-state *bool in compose-go), which run rejects. All locked by e2e scenarios (scheduled rejection by up before any resource is created; manual run starting its depends_on services first; manual: false refusal).

• pre_start hooks inherit the whole container specification, resolved at load time: compose-go completes each hook with the service's container-spec attributes while loading (idempotently across config round-trips, thanks to the strictly-identical-entry merge dedup), so the model itself carries the spec a hook runs with and the runtime consumes it as-is through the standard create path — every ContainerSpec attribute (resources, capabilities, dns, sysctls, ...) inherits with zero attribute-specific code, following the exact multi-file merge rules (command replaces, environment merges per key, extra_hosts accumulate). The only deliberate exception is volumes, inherited at runtime through volumes_from (the only way to share anonymous and image volumes), with hook-declared mounts taking precedence per target. This closes the two standing asks against init containers: inheriting/declaring extra_hosts (fixes pre_start containers don't inherit/support extra_hosts #13939) and giving the hook read-write access to a volume the service mounts read-only (fixes pre_start/init-Containers should support own/overwritten Volumes #13934) — both locked by e2e scenarios.

compose-spec/compose-go#866 is merged: go.mod now points at the merged compose-go head (v2.15.1-0.20260910154416-11feead015fc), no replace directive involved — this PR is self-contained and mergeable. Jobs are hereby exposed end to end: declared in the model, warned about and guarded by up (scheduled jobs rejected until a scheduler exists), and runnable through docker compose run <job>. A compose-go tagged release can still substitute the pseudo-version before merge if preferred.

🤖 Generated with Claude Code

---

Update (independent review follow-ups). An adversarial review pass surfaced real gaps, all addressed in the rebuilt stack:

• volumes_from (and service:-scoped network_mode/ipc/pid) inherited into a pre_start hook now resolve to live container IDs like the service create path — the daemon used to receive raw service names and fail up for any service combining volumes_from with a hook (e2e-locked). Hook labels merge into the container's labels (the runtime identification set wins), and the <API 1.44 network fallback joins the hook's own networks.
• A job's env_file/label_file resolve through run: materialization now happens during loading, before environment resolution — and the retry is keyed on "the target is a declared job", never on matching an error message, so a plain typo keeps the precise selection error and unrelated services' env_file still don't need to exist.
• Job→job depends_on executes: the whole job closure materializes, each dependency running to completion through the machinery a service dependency uses (e2e-locked). Materialized jobs carry the standard compose labels — without them their containers were invisible to every label-driven path — and their x-* extensions.
• create and start refuse active scheduled jobs like up does, keeping the "before any resource is created" promise on every entry point.
• publish safeguards and image pinning cover jobs: sensitive-env/env_file/bind-mount/build-only checks, digest override, application index, and config --images.

Note on config hashes: the container-spec layering reorders ServiceConfig fields, which would have changed every service's config-hash (mass recreation on upgrade) — #14215 pins the hash byte layout to its historical form — fully backward compatible, zero recreation — and must land first; this PR then deletes its transient continuity test in the compose-go bump commit, as that test documents.

[glours]

A few things worth fixing before this lands, even given the interim/client-side nature of this jobs support:

cmd/compose/up.go:362 — warnIgnoredJobs iterates project.AllJobs() (includes profile-disabled jobs), while rejectScheduledJobs (up.go:379, also called from create.go:104 and start.go:63) correctly uses project.Jobs (profile-enabled
only). Result: up can warn about jobs that aren't even part of this invocation's profile selection. Should use project.Jobs here too.

cmd/compose/run.go:287-292 — the job-detection fallback now retries the full project load on any narrowed-load error, not just "no such service". Any unrelated load failure (bad include:, interpolation error) now triggers a second full
load — duplicating remote include: fetches and unsupported-attribute warnings — before falling through to the (still correct) original error. Worth narrowing the retry condition back to the selection-failure case, since job detection doesn't
need the broader retry.

pkg/compose/pre_start_test.go — still no test exercising the security-sensitive fields (Privileged, CapAdd/CapDrop, SecurityOpt, ReadOnly, Sysctls) that hooks now inherit from the service by default. This is pre-existing/permanent
hook behavior, not something the interim jobs work will replace — worth covering given what's at stake if inheritance breaks silently.

pkg/compose/publish.go — the new job branches (pushApplicationIndex, generateImageDigestsOverride, collectEnvCheckFindings, checkOnlyBuildSection, checkForBindMount, checkForSensitiveData) are correct on inspection but have zero
dedicated test coverage — publish_test.go's only changes are mechanical ContainerSpec adaptations. This is the secret-scanning gate for publish; a future regression here would go undetected by CI.

Nits, non-blocking:

• pre_start.go: resolveHookServiceReferences rebuilds the per-service container map inline instead of reusing getContainersByService.
• publish.go: findings for a job are still labeled "service %q: ..." in the merged prompt message.