Extend the built-in policy to validate signed moby/buildkit release and
floating tags before docker-container builders are created.
Pull the image first, inspect it through Docker, and bind verification to the
descriptor digest. Resolve signature attestations through the BuildKit API
embedded in the Docker daemon.
If pulling fails, use a local image while applying the same verification when
the containerd image store exposes an immutable descriptor. Keep the classic
image-store behavior unchanged because no descriptor is available.
Allow unmanaged repositories and digest-only references unchanged. Add the
allow-untrusted-image driver option as an explicit verification bypass.
Document the behavior and add policy, digest-pinning, and local fallback
coverage.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Images loaded into Docker's containerd image store are identified by
their manifest or index digest, while the legacy graphdriver store uses
the config digest.
buildx prefers containerimage.config.digest when the Moby exporter
returns both digests.
Some exporter responses still produce a usable iidfile, but affected
builds, such as those with attestations disabled, write a config digest
that Docker image commands cannot resolve.
Expose the Docker driver's image-store mode as a feature and set
prefer-image-digest for containerd-backed Moby exports.
Signed-off-by: Paweł Gronowski <git@grono.dev>
Evaluate source policy caps before solve requests so policies can enable
BuildKit proxy networking. Policy can return caps {"exec.proxy": true}
during the caps request to enable proxy network
support for the solve.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Port of moby/buildkit#6569 to buildx. Adds --memory, --memory-swap,
--cpu-shares, --cpu-period, --cpu-quota, --cpuset-cpus, and --cpuset-mems
flags to build, plus the equivalent bake target attributes and compose
x-bake fields.
Signed-off-by: Jiří Moravčík <jiri.moravcik@gmail.com>
Keep policy resolver cleanup in a local variable so explicit error returns
cannot clear it before deferred cleanup runs. This prevents remote policy
progress writers from outliving the build printer.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Emit a final policy progress completion with the solve error even when the
inactivity window already completed the vertex.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Embed an opt-in default source policy for Docker-managed frontend images.
Load it ahead of user policies when enabled, and cover behavior with table-
driven policy tests for signed, unsigned, floating, and labs tags.
Makes sure if there is any attack against the docker/dockerfile
releases, or they accidentally point to worng images, these are automatically detected.
In a future release these should become opt-out.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add oci-layout:// source and target support to imagetools create and
inspect while keeping merge, filter, and referrer logic shared.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Use cleaned DockerfilePath basename for policy env filename and fall back
to Dockerfile when the path resolves to dot or root.
Previously filename could be reported as "." on default cases.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Track denied source identifiers during policy evaluation and flag the policy
progress vertex as failed when BuildKit returns a matching DENY error pattern.
This improves the progress output of policy error and shows last
policy logs with the build error.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Allows avoiding the case where two separate builds using
same context name would use the same destination directory
for upload.
Requires updated frontend to handle these new keys.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Fix the policy logger being open for the whole build.
In new logic logger is opened on-demand if there are logs,
remains open until timeout and is restarted if new logs
come after.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Automatically set `unpack=false` for registry exports unless explicitly
overridden by the user.
This applies to:
- `registry` exporter type (converted to `image` exporter with `push=true`)
- `--push` flag usage with image exporters
Users can still explicitly set `unpack=true` if they need local image
storage alongside registry push.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The buildx command line will now handle `@` symbols in the
`oci-layout://` path when used with named contexts. Instead of
assuming the `@` symbol is part of the reference digest, it will first
check that it is a valid reference digest. Otherwise, it will assume
it's part of the file path.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
For the cases where frontend/buildkit doesn't support new
Git Querystring format, allow resolving the URL into LLB
on client side and then build from input.
Note that this produces slightly different provenance
where context is not set as string, so added opt-in
via environment variable for now.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Set gateway `source` to the first part of `BUILDKIT_SYNTAX` and
`cmdline` to the entire raw value to preserve additional options.
Signed-off-by: Dan Duvall <dduvall@wikimedia.org>
This fix allows building with a remote builder where
frontend.dockerfile.v0 enabled = false in the buildkitd yaml file.
Note that this change only allows the usage of BUILDKIT_SYNTAX with
a custom frontend image, and using the #syntax directive in this case
will still fail.
Resolves: docker#3077
Signed-off-by: Will Nonnemaker <wnonnemaker@gmail.com>
Removes all references to the controller and moves the remaining
sections of code to other packages.
Processes has been moved to monitor where it is used and the data
structs have been removed so buildflags is used directly. The controller
build function has been moved to the commands package.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Prior to this change, the following command emits the wrong image ID when buildx
uses the "docker-container" driver and Docker is configured with the
containerd-snapshotter.
$ docker buildx build --load --iidfile=img.txt
$ docker run --rm "$(cat img.txt)" echo hello
docker: Error response from daemon: No such image: sha256:4ac37e81e00f242010e42f3251094e47de6100e01d25e9bd0feac6b8906976df.
See 'docker run --help'.
The problem is that buildx is outputing the incorrect image ID in this scenario
(it's outputing the container image config digest, instead of the container
image digest used by the containerd-snapshotter).
This commit fixes this. See https://github.com/moby/moby/issues/45458.
Signed-off-by: Cesar Talledo <cesar.talledo@docker.com>
Allow access to CDI Devices in Buildkit v0.20.0+ for
devices that are not automatically allowed to be used by
everyone in BuildKit configuration.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
CrazyMax