When we do the build Docker Compose tries to find an image called "app-php" in your local registry, then in Docker Hub and then if it doesn't find it, it resorts to using the provided Dockerfile.

If there was an image called "app-php" in Docker Hub or any other registry you might have configured, then this other image would have been downloaded and used instead of building the expected one.

Isn't this a security risk ?

Wouldn't it make more sense just being explicit and adding something like:

    build:
      context: .
      dockerfile: Dockerfile

Thanks