alextab93/buildx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

build: gate local delete outputs

Browse Source 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
This commit is contained in:
CrazyMax
2026-06-10 16:41:10 +02:00
parent 473c6ef306
commit b6e1b7328f
14 changed files with 380 additions and 148 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/bake-reference.md
+1 -1
View File
@@ -902,7 +902,7 @@ target "default" {
```
> [!NOTE]
> Local outputs with `mode=delete` require granting `--allow=local-output-delete`
> Local outputs with `mode=delete` require granting `--allow=buildx.local.delete`
> when invoking `docker buildx bake`.
### `target.policy`
docs/reference/buildx_bake.md
+1 -1
View File
@@ -85,7 +85,7 @@ The `fs` entitlements take a path value (relative or absolute) to a directory
on the filesystem. Alternatively, you can pass a wildcard (`*`) to allow Bake
to access the entire filesystem.
Bake also supports `--allow=local-output-delete` to grant local outputs
Bake also supports `--allow=buildx.local.delete` to grant local outputs
permission to delete stale files when `mode=delete` is set.
### Example: fs.read
docs/reference/buildx_build.md
+13 -3
View File
@@ -16,7 +16,7 @@ Start a build
| Name | Type | Default | Description |
|:----------------------------------------|:--------------|:----------|:-------------------------------------------------------------------------------------------------------------------------------------------------|
| [`--add-host`](#add-host) | `stringSlice` | | Add a custom host-to-IP mapping (format: `host:ip`) |
| [`--allow`](#allow) | `stringArray` | | Allow extra privileged entitlement (e.g., `network.host`, `security.insecure`, `device`) |
| [`--allow`](#allow) | `stringArray` | | Allow extra privileged entitlement (e.g., `network.host`, `security.insecure`, `device`, `buildx.local.delete`) |
| [`--annotation`](#annotation) | `stringArray` | | Add annotation to the image |
| [`--attest`](#attest) | `stringArray` | | Attestation parameters (format: `type=sbom,generator=image`) |
| [`--build-arg`](#build-arg) | `stringArray` | | Set build-time variables |
@@ -179,9 +179,14 @@ Allow extra privileged entitlement. List of entitlements:
- `--allow device` - Grants access to all devices.
- `--allow device=kind|name` - Grants access to a specific device.
- `--allow device=kind|name,alias=kind|name` - Grants access to a specific device, with optional aliasing.
- `buildx.local.delete` - Allows local outputs using `mode=delete` to delete
stale destination files when the destination is the current working directory
or outside it.
For entitlements to be enabled, the BuildKit daemon also needs to allow them
with `--allow-insecure-entitlement` (see [`create --buildkitd-flags`](buildx_create.md#buildkitd-flags)).
For BuildKit entitlements to be enabled, the BuildKit daemon also needs to allow
them with `--allow-insecure-entitlement` (see [`create --buildkitd-flags`](buildx_create.md#buildkitd-flags)).
The `buildx.local.delete` entitlement is checked by Buildx and isn't sent to the
BuildKit daemon.
```console
$ docker buildx create --use --name insecure-builder --buildkitd-flags '--allow-insecure-entitlement security.insecure'
@@ -753,6 +758,11 @@ will be put in subdirectories by their platform.
Attribute key:
- `dest` - destination directory where files will be written
- `mode` - write mode, either `copy` or `delete`. The default is `copy`.
`delete` removes stale files from the destination after exporting the build
result. It can be used without `--allow` when `dest` resolves to a
subdirectory of the current working directory. If `dest` is the current working
directory or resolves outside it, pass `--allow=buildx.local.delete`.
For more information, see
[Local and tar exporters](https://docs.docker.com/build/exporters/local-tar/).
docs/reference/buildx_dap_build.md
+1 -1
View File
@@ -8,7 +8,7 @@ Start a build
| Name | Type | Default | Description |
|:--------------------|:--------------|:----------|:-------------------------------------------------------------------------------------------------------------------------------------------------|
| `--add-host` | `stringSlice` | | Add a custom host-to-IP mapping (format: `host:ip`) |
| `--allow` | `stringArray` | | Allow extra privileged entitlement (e.g., `network.host`, `security.insecure`, `device`) |
| `--allow` | `stringArray` | | Allow extra privileged entitlement (e.g., `network.host`, `security.insecure`, `device`, `buildx.local.delete`) |
| `--annotation` | `stringArray` | | Add annotation to the image |
| `--attest` | `stringArray` | | Attestation parameters (format: `type=sbom,generator=image`) |
| `--build-arg` | `stringArray` | | Set build-time variables |
docs/reference/buildx_debug_build.md
+1 -2
View File
@@ -12,7 +12,7 @@ Start a build
| Name | Type | Default | Description |
|:--------------------|:--------------|:----------|:-------------------------------------------------------------------------------------------------------------------------------------------------|
| `--add-host` | `stringSlice` | | Add a custom host-to-IP mapping (format: `host:ip`) |
| `--allow` | `stringArray` | | Allow extra privileged entitlement (e.g., `network.host`, `security.insecure`, `device`) |
| `--allow` | `stringArray` | | Allow extra privileged entitlement (e.g., `network.host`, `security.insecure`, `device`, `buildx.local.delete`) |
| `--annotation` | `stringArray` | | Add annotation to the image |
| `--attest` | `stringArray` | | Attestation parameters (format: `type=sbom,generator=image`) |
| `--build-arg` | `stringArray` | | Set build-time variables |
@@ -51,4 +51,3 @@ Start a build
<!---MARKER_GEN_END-->