[BUG] docker compose publish panics with nil map when using `extends`

[karnarokEpoch]

Description

Running docker compose publish on a project that uses extends causes a
panic:

panic: assignment to entry in nil map

goroutine 1 [running]:
github.com/docker/compose/v5/pkg/compose.processFile({0x159ad80, 0xc000416f50}, {0xc00052a700, 0x40}, 0xc0005366e0, 0xc0004f2790, 0x0)
 github.com/docker/compose/v5/pkg/compose/publish.go:255 +0x651
github.com/docker/compose/v5/pkg/compose.processExtends({0x159ad80, 0xc000416f50}, 0xc0005366e0, 0xc0004f2c20)
 github.com/docker/compose/v5/pkg/compose/publish.go:201 +0x1d7
github.com/docker/compose/v5/pkg/compose.(*composeService).createLayers(0xc000522000, {0x159ad80, 0xc000416f50}, 0xc0005366e0, {0x0, 0x0, 0x1, {0x0, 0x0}, 0x0})
 github.com/docker/compose/v5/pkg/compose/publish.go:175 +0x352
github.com/docker/compose/v5/pkg/compose.(*composeService).publish(0xc000522000, {0x159ad80, 0xc000416f50}, 0xc00071e000, {0x7ffc05895230, 0x3a}, {0x0, 0x0, 0x1, {0x0, ...}, ...})
 github.com/docker/compose/v5/pkg/compose/publish.go:69 +0x16c
github.com/docker/compose/v5/pkg/compose.(*composeService).Publish.func1({0x159ad80?, 0xc000416f50?})
 github.com/docker/compose/v5/pkg/compose/publish.go:47 +0x47
github.com/docker/compose/v5/pkg/compose.Run({0x159ad80, 0xc000416f50}, 0xc0004f3658, {0x13887aa, 0x7}, {0x15981b0, 0xc0000cfa70})
 github.com/docker/compose/v5/pkg/compose/progress.go:30 +0x59
github.com/docker/compose/v5/pkg/compose.(*composeService).Publish(0x0?, {0x159ad80?, 0xc000416f50?}, 0x159ad80?, {0x7ffc05895230?, 0x15a7470?}, {0x0, 0x0, 0x1, {0x0, ...}, ...})
 github.com/docker/compose/v5/pkg/compose/publish.go:46 +0xab
github.com/docker/compose/v5/cmd/compose.runPublish({0x159ad80, 0xc000416f50}, {0x15a7470, 0xc0003c9e00}, 0x47a805?, {0xc000163340, 0x0, {0x0, 0x0}, 0x1, ...}, ...)
 github.com/docker/compose/v5/cmd/compose/publish.go:95 +0x282
github.com/docker/compose/v5/cmd/compose.publishCommand.func1({0x159ad80?, 0xc000416f50?}, {0xc000596f00?, 0xc000002380?, 0xfe2da5?})
 github.com/docker/compose/v5/cmd/compose/publish.go:51 +0x5f
github.com/docker/compose/v5/cmd/compose.publishCommand.Adapt.func3({0x159ad80?, 0xc000416f50?}, 0x2?, {0xc000596f00?, 0xc000169680?, 0xc0000a5080?})
 github.com/docker/compose/v5/cmd/compose/compose.go:136 +0x30
github.com/docker/compose/v5/cmd/compose.publishCommand.Adapt.AdaptCmd.func5(0xc00007d208, {0xc000596f00, 0x1, 0x2})
 github.com/docker/compose/v5/cmd/compose/compose.go:120 +0x13d
github.com/docker/cli/cli-plugins/plugin.RunPlugin.func1.1.2(0xc00007d208, {0xc000596f00, 0x1, 0x2})
 github.com/docker/cli@v29.2.1+incompatible/cli-plugins/plugin/plugin.go:65 +0x64
github.com/docker/compose/v5/cmd/cmdtrace.Setup.wrapRunE.func2(0xc00007d208?, {0xc000596f00?, 0x1?, 0x2?})
 github.com/docker/compose/v5/cmd/cmdtrace/cmd_span.go:88 +0x63
github.com/spf13/cobra.(*Command).execute(0xc00007d208, {0xc000354260, 0x2, 0x2})
 github.com/spf13/cobra@v1.10.2/command.go:1015 +0xb02
github.com/spf13/cobra.(*Command).ExecuteC(0xc0001e1508)
 github.com/spf13/cobra@v1.10.2/command.go:1148 +0x465
github.com/spf13/cobra.(*Command).Execute(...)
 github.com/spf13/cobra@v1.10.2/command.go:1071
github.com/docker/cli/cli-plugins/plugin.RunPlugin(0xc0003c9e00, 0xc0000bc908, {{0x1385bdb, 0x5}, {0x138d7fc, 0xb}, {0x158577c, 0x6}, {0x0, 0x0}, ...})
 github.com/docker/cli@v29.2.1+incompatible/cli-plugins/plugin/plugin.go:80 +0x145
github.com/docker/cli/cli-plugins/plugin.Run(0x141d5e8, {{0x1385bdb, 0x5}, {0x138d7fc, 0xb}, {0x158577c, 0x6}, {0x0, 0x0}, {0x0, ...}, ...}, ...)
 github.com/docker/cli@v29.2.1+incompatible/cli-plugins/plugin/plugin.go:99 +0x145
main.pluginMain()
 github.com/docker/compose/v5/cmd/main.go:38 +0x15a
main.main()
 github.com/docker/compose/v5/cmd/main.go:84 +0x19e

Minimal reproducer:

# compose.yaml
services:
 whoami:
 extends:
 file: base.yaml
 service: whoami

# base.yaml
services:
 whoami:
 image: docker.io/traefik/whoami:v1.11
 env_file:
 - path: ./.env
 required: false

docker compose up works fine. The publish path's processExtends does not
initialise the target map before writing into it.

Steps To Reproduce

1. Create the files:

cat > base.yaml <<EOF
services:
 whoami:
 image: docker.io/traefik/whoami:v1.11
 env_file:
 - path: ./.env
 required: false
EOF

cat > compose.yaml <<EOF
services:
 whoami:
 extends:
 file: base.yaml
 service: whoami
EOF

cat > .env <<EOF
FOO=BAR
EOF

2. Publish:

docker compose publish --with-env <registry>/<image>:<tag>

The panic occurs with or without the env_file stanza in base.yaml; extends
alone is sufficient to trigger it. Note: .env must be a non-empty text file —
an empty file causes a separate error (is not a text file). Flattening both
files into a single compose.yaml (no extends) publishes successfully.

Compose Version

$ docker-compose version
Command 'docker-compose' not found, but can be installed with:
sudo snap install docker # version 28.4.0, or
sudo apt install docker-compose # version 1.29.2-6
See 'snap info docker' for additional versions.

$ docker compose version
Docker Compose version v5.1.0

Docker Environment

$ docker info
Client: Docker Engine - Community
 Version: 29.3.0
 Context: default
 Debug Mode: false
 Plugins:
 buildx: Docker Buildx (Docker Inc.)
 Version: v0.31.1
 Path: /usr/libexec/docker/cli-plugins/docker-buildx
 compose: Docker Compose (Docker Inc.)
 Version: v5.1.0
 Path: /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 0
 Running: 0
 Paused: 0
 Stopped: 0
 Images: 119
 Server Version: 4.9.3
 Storage Driver: overlay
 Supports d_type: true
 Native Overlay Diff: true
 Using metacopy: false
 Supports shifting: false
 Supports volatile: true
 Backing Filesystem: extfs
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
 Volume: local
 Network: bridge macvlan ipvlan
 Log: k8s-file none passthrough journald
 Swarm: inactive
 Runtimes: crun ocijail runsc crun-wasm kata krun runc runj youki
 Default Runtime: crun
 Init Binary: 
 containerd version: 
 runc version: 
 init version: 
 Security Options:
 seccomp
 Profile: default
 rootless
 Kernel Version: 6.6.87.2-microsoft-standard-WSL2
 Operating System: ubuntu
 OSType: linux
 Architecture: amd64
 CPUs: 8
 Total Memory: 7.557GiB
 Name: DENEC1
 ID: 22893162-076d-4bf1-b265-666029302de0
 Docker Root Dir: /home/karna/.local/share/containers/storage
 Debug Mode: false
 Experimental: true
 Live Restore Enabled: false
 Product License: Apache-2.0

Anything else?

I'm using podman with docker-compose-plugin. Docker Engine is not installed.
Docker CLI use podman thanks to export DOCKER_HOST="unix://${XDG_RUNTIME_DIR}podman/podman.sock"
I don't think it change anything but for transparentsy.

I have used an AWS ECS for my test.