cli/compose/loader: don't drop tcp port when udp uses same published port

cli/compose/loader/merge.go

@@ -123,14 +123,28 @@ func toServiceConfigObjConfigsMap(s any) (map[any]any, error) {
 	return m, nil
 }
 
+// servicePortKey identifies a port during a merge; the same published
+// port may be exposed for both tcp and udp, so the protocol is part of
+// the identity.
+type servicePortKey struct {
+	published uint32
+	protocol  string
+}
+
 func toServicePortConfigsMap(s any) (map[any]any, error) {
 	ports, ok := s.([]types.ServicePortConfig)
 	if !ok {
 		return nil, fmt.Errorf("not a servicePortConfig slice: %v", s)
 	}
 	m := map[any]any{}
 	for _, p := range ports {
-		m[p.Published] = p
+		protocol := p.Protocol
+		if protocol == "" {
+			// long syntax allows the protocol to be omitted, in which
+			// case it defaults to tcp
+			protocol = "tcp"
+		}
+		m[servicePortKey{published: p.Published, protocol: protocol}] = p
 	}
 	return m, nil
 }
@@ -172,7 +186,12 @@ func toServicePortConfigsSlice(dst reflect.Value, m map[any]any) error {
 	for _, v := range m {
 		s = append(s, v.(types.ServicePortConfig))
 	}
-	sort.Slice(s, func(i, j int) bool { return s[i].Published < s[j].Published })
+	sort.Slice(s, func(i, j int) bool {
+		if s[i].Published != s[j].Published {
+			return s[i].Published < s[j].Published
+		}
+		return s[i].Protocol < s[j].Protocol
+	})
 	dst.Set(reflect.ValueOf(s))
 	return nil
 }

cli/compose/loader/merge_test.go

@@ -280,6 +280,58 @@ func TestLoadMultipleServicePorts(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "same_published_different_protocol",
+			portBase: map[string]any{
+				"ports": []any{
+					"443:443",
+					"443:443/udp",
+				},
+			},
+			portOverride: map[string]any{},
+			expected: []types.ServicePortConfig{
+				{
+					Mode:      "ingress",
+					Published: 443,
+					Target:    443,
+					Protocol:  "tcp",
+				},
+				{
+					Mode:      "ingress",
+					Published: 443,
+					Target:    443,
+					Protocol:  "udp",
+				},
+			},
+		},
+		{
+			name: "override_same_published_different_protocol",
+			portBase: map[string]any{
+				"ports": []any{
+					"443:443",
+					"443:443/udp",
+				},
+			},
+			portOverride: map[string]any{
+				"ports": []any{
+					"443:8443/udp",
+				},
+			},
+			expected: []types.ServicePortConfig{
+				{
+					Mode:      "ingress",
+					Published: 443,
+					Target:    443,
+					Protocol:  "tcp",
+				},
+				{
+					Mode:      "ingress",
+					Published: 443,
+					Target:    8443,
+					Protocol:  "udp",
+				},
+			},
+		},
 		{
 			name: "override_same_published",
 			portBase: map[string]any{