validating ...\q4\compose.yaml: services.web.environment.ALLOWED_ORIGINS must be a boolean, null, number or string means one environment variable was given a YAML list as its value. An environment variable is a single piece of text. Join the items into one string, for example separated by commas, and let the application split it.

The message names the variable, here ALLOWED_ORIGINS, so the line to change is that key under the service's environment.

The error

PS> docker compose -f compose.yaml config
validating ...\q4\compose.yaml: services.web.environment.ALLOWED_ORIGINS must be a boolean, null, number or string

The file (the long path in the message is shortened above):

name: fix10-cy-q4
services:
  web:
    image: alpine
    command: ["sleep", "1"]
    environment:
      ALLOWED_ORIGINS:
        - https://app.example.test
        - https://admin.example.test

Why it happens

A process receives its environment as name and text pairs; there is no list type there. The message names four types a value under environment may have; the one tested here, a list, is not among them. The two dash lines make the value of ALLOWED_ORIGINS a list, so validation stops at that key, before any container is created.

The shape is tempting because the setting really is a list in the application, and the rest of the Compose file writes lists with dashes. Under environment, though, every value must arrive in the container as one string. The check runs on docker compose config, which printed the message and exited with code 1, so you can test the file this way after each edit without creating a container or a network.

The fix

name: fix10-cy-q4
services:
  web:
    image: alpine
    command: ["sleep", "1"]
    environment:
      ALLOWED_ORIGINS: "https://app.example.test,https://admin.example.test"
PS> docker compose -f compose.fixed.yaml config
...
    environment:
      ALLOWED_ORIGINS: https://app.example.test,https://admin.example.test
...

With both origins in one quoted string, the file validates and config shows the variable as a single value. A test service that echoed the variable printed it as one value, without the quotes, which belong to the YAML: 

PS> docker compose -f compose.run.yaml up
...
web-1  | [https://app.example.test,https://admin.example.test]
...

Splitting it on the comma is then the application's job.

How it was reproduced

Docker Desktop on Windows 11, Docker Compose v5.7.0, engine 29.9.3, Windows PowerShell 5.1. A one-service compose.yaml with ALLOWED_ORIGINS given a two-item list gave the message above on docker compose -f compose.yaml config with exit code 1; with one comma-separated string the same command printed the model with exit code 0, and a test service on the cached alpine image echoed the value and was removed with down. The project name fix10-cy-q4 and the .test hosts are the test's own.

Frequently asked

What does environment must be a boolean, null, number or string mean in docker compose?
One variable under environment was given a list as its value. An environment variable holds one value, so join the items into one string.
How do I pass a list in a docker compose environment variable?
As one string, for example comma-separated, which the application splits. In the test ALLOWED_ORIGINS with two comma-separated origins validated.
Which line does the compose environment error point to?
The key it names after environment, here services.web.environment.ALLOWED_ORIGINS, in the service web.

More decoded errors in the Fixes category. When the whole environment block has the wrong shape, Compose prints a different message, shown in depends_on must be a array.