alextab93/buildx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

policy: verify BuildKit builder images

Browse Source 
Extend the built-in policy to validate signed moby/buildkit release and
floating tags before docker-container builders are created.

Pull the image first, inspect it through Docker, and bind verification to the
descriptor digest. Resolve signature attestations through the BuildKit API
embedded in the Docker daemon.

If pulling fails, use a local image while applying the same verification when
the containerd image store exposes an immutable descriptor. Keep the classic
image-store behavior unchanged because no descriptor is available.

Allow unmanaged repositories and digest-only references unchanged. Add the
allow-untrusted-image driver option as an explicit verification bypass.

Document the behavior and add policy, digest-pinning, and local fallback
coverage.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
This commit is contained in:
Tonis Tiigi
2026-07-20 18:22:41 -07:00
parent 8035347c81
commit acaf251f0b
16 changed files with 920 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
policy/default.rego
+80 -2
View File
@@ -1,18 +1,26 @@
package docker
# Default policy embedded in Buildx. It verifies trust for images shipped
# by Docker that may be implicitly loaded during a build:
# by Docker that may be implicitly loaded during a build or used to run a
# build:
#
# - docker/dockerfile
# - docker/dockerfile-upstream
# - docker/buildkit-syft-scanner
# - moby/buildkit
#
# Any image outside this managed set is allowed and passes through to user
# policies unchanged. Access by digest is always allowed. For tag-based
# access the rules below enforce a signed release from the expected GitHub
# source repository using the existing docker_github_builder_signature
# helper from builtins.rego.
#
# The moby/buildkit rules also apply when Buildx pulls the image to create a
# container builder; the docker-container driver evaluates this same policy
# before creating the builder and pins the image to the digest the evaluation
# resolved. Only known tags and their variants require a matching signature;
# releases that predate signing (before v0.27.0) and unrecognized tags pass
# through like any unmanaged image.
is_dockerfile if {
input.image
input.image.fullRepo == "docker.io/docker/dockerfile"
@@ -28,6 +36,11 @@ is_syft_scanner if {
input.image.fullRepo == "docker.io/docker/buildkit-syft-scanner"
}
is_buildkit_image if {
input.image
input.image.fullRepo == "docker.io/moby/buildkit"
}
dockerfile_floating_tag(tag) if tag == "latest"
dockerfile_floating_tag(tag) if tag == "labs"
dockerfile_floating_tag(tag) if tag == "master"
@@ -40,6 +53,40 @@ syft_scanner_floating_tag(tag) if tag == "latest"
syft_scanner_tag_requires_sig(tag) if syft_scanner_floating_tag(tag)
syft_scanner_tag_requires_sig(tag) if version_tag_ge(tag, 1, 10)
# moby/buildkit floating tags are a closed enumeration, not prefix wildcards,
# so tags like master-cache (a cache manifest, not a runnable image) are not
# subjected to a signature check they could never pass.
buildkit_floating_tag(tag) if tag in {
"latest", "latest-ubuntu", "rootless",
"master", "master-rootless", "master-ubuntu",
"nightly", "nightly-rootless", "nightly-ubuntu",
}
buildkit_floating_tag(tag) if regex.match(`^buildx-stable-\d+(?:-rootless|-gpu)?$`, tag)
# buildkit_release_version returns the vX.Y.Z[-rcN] release a version tag
# refers to, with the image variant suffix stripped. Release tags carry a
# signature whose source repository ref names exactly this version.
buildkit_release_version(tag) := v if {
m := regex.find_all_string_submatch_n(`^(v\d+\.\d+\.\d+(?:-rc\d+)?)(?:-rootless|-ubuntu)?$`, tag, 1)
count(m) == 1
v := m[0][1]
}
# v0.27.0 is the first signed moby/buildkit release.
buildkit_version_signed(version) if {
m := regex.find_all_string_submatch_n(`^v(\d+)\.(\d+)\.`, version, 1)
count(m) == 1
to_number(m[0][1]) > 0
}
buildkit_version_signed(version) if {
m := regex.find_all_string_submatch_n(`^v(\d+)\.(\d+)\.`, version, 1)
count(m) == 1
to_number(m[0][1]) == 0
to_number(m[0][2]) >= 27
}
default_policy_deny_msgs contains msg if {
is_dockerfile
@@ -59,6 +106,37 @@ default_policy_deny_msgs contains msg if {
msg := sprintf("image %s is not allowed by default policy: a verified docker-github-builder signature is required for %s tag", [input.image.ref, input.image.tag])
}
default_policy_deny_msgs contains msg if {
is_buildkit_image
tag := input.image.tag
tag != ""
buildkit_floating_tag(tag)
not buildkit_floating_sig_ok
msg := sprintf("image %s is not allowed by default policy: a verified docker-github-builder signature is required for %s tag", [input.image.ref, tag])
}
default_policy_deny_msgs contains msg if {
is_buildkit_image
tag := input.image.tag
tag != ""
not buildkit_floating_tag(tag)
version := buildkit_release_version(tag)
buildkit_version_signed(version)
not buildkit_release_sig_ok(version)
msg := sprintf("image %s is not allowed by default policy: a verified docker-github-builder signature is required for %s tag", [input.image.ref, tag])
}
buildkit_floating_sig_ok if {
some sig in input.image.signatures
docker_github_builder_signature(sig, "moby/buildkit")
}
buildkit_release_sig_ok(version) if {
some sig in input.image.signatures
docker_github_builder_signature(sig, "moby/buildkit")
sig.signer.sourceRepositoryRef == sprintf("refs/tags/%s", [version])
}
dockerfile_sig_ok(tag) if {
dockerfile_floating_tag(tag)
some sig in input.image.signatures