Add the ":authority" dial option to the default client options instead of
appending it after the caller-provided options, so that an authority
explicitly passed by the caller takes precedence over the driver default.
Signed-off-by: MohammadHasan Akbari <jarqvi.jarqvi@gmail.com>
Images loaded into Docker's containerd image store are identified by
their manifest or index digest, while the legacy graphdriver store uses
the config digest.
buildx prefers containerimage.config.digest when the Moby exporter
returns both digests.
Some exporter responses still produce a usable iidfile, but affected
builds, such as those with attestations disabled, write a config digest
that Docker image commands cannot resolve.
Expose the Docker driver's image-store mode as a feature and set
prefer-image-digest for containerd-backed Moby exports.
Signed-off-by: Paweł Gronowski <git@grono.dev>
When the servername driver-opt is set it is also used for TLS SNI and
certificate validation, so use it for the gRPC ":authority" pseudo-header
as well, falling back to the endpoint host otherwise. This matches how the
buildkit client derives the authority from the server name when TLS
credentials are supplied.
Since the driver terminates TLS in its own dialer, the authority is set
explicitly via client.WithGRPCDialOption(grpc.WithAuthority(...)).
Signed-off-by: MohammadHasan Akbari <jarqvi.jarqvi@gmail.com>
The remote driver created the buildkit client with an empty address:
client.New(ctx, "", opts...)
With an empty address the buildkit client falls back to the system
default address (the local unix socket) and derives the gRPC
":authority" pseudo-header from it, which ends up being "localhost".
The actual connection was still correct because the remote driver
provides its own dialer, but the wrong authority broke HTTP/2 reverse
proxies (such as Envoy) that route based on ":authority".
Pass the configured endpoint address to client.New so the authority is
derived from the remote endpoint hostname (e.g.
my-buildkit.example.com:443). The custom dialer is preserved, so the
dial target and TLS/SNI behavior are unchanged.
Fixes#3880
Signed-off-by: MohammadHasan Akbari <jarqvi.jarqvi@gmail.com>
This function was always using `io.Discard` for printing the progress,
so we can use the `Wait()` method, which reads the stream, returning
any error (similar to jsonmessage.DisplayJSONMessagesStream), and
closes the stream either if the context is cancelled, or if the
stream ends.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The k8s driver now supports the `persistent-volume-claim.requests.storage`
option. Setting this option changes the deployment into a statefulset
and creates a persistent volume claim where the buildkit data is stored.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Use sync.OnceValue to initialize the kubeclient scheme, codec factory,
and parameter codec as a single lazy-loaded bundle.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Replace the full generated clientset and global Kubernetes scheme
with a small local REST client layer and minimal scheme registration.
This keeps the existing kubeconfig/auth and remote exec behavior while
significantly reducing the linked and vendored Kubernetes dependency set.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Enables fallback for DHI and Scout registries and
repo/scope specific credentials like supported for builds.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Fixes#2668
When Kubernetes marks nodes as "Ready" before their Certificate Signing
Requests (CSRs) are approved, the buildx kubernetes driver can fail to
connect to builder pods with transient TLS errors like:
- "tls: internal error"
- "context deadline exceeded"
- "use of closed network connection"
- "i/o timeout"
This is particularly problematic on EKS clusters with ARM64 nodes under
heavy load, where multiple builders are being spawned simultaneously.
This commit adds retry logic with exponential backoff to the Dial()
function in the kubernetes driver. The implementation:
- Attempts up to 5 connection retries
- Uses exponential backoff starting at 500ms, capped at 10s
- Only retries on known transient connection errors
- Uses errors.Is/errors.As for proper error type checking
- Logs retry attempts using logrus for visibility
- Respects context cancellation
This allows buildx to gracefully handle the race condition where pods
are marked as Running before their TLS certificates are fully ready.
Signed-off-by: guimove <dasilva.guillaume@live.fr>
Directly convert to a int32 instead of later conversion so that
we can return an error if the value is out of range.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The ResolveDefaultContext function is only used internally by the CLI,
and has no known external users, except for this test in buildx. It was
exported in [cli@f820766] to allow (unit) testing, but did not document
that it was only exported for this purpose.
This patch rewrites the test to allow deprecating / removing the function
in the CLI.
[cli@f820766]: https://github.com/docker/cli/commit/f820766f6ac57188d96c9ca377f2b4627e90da28
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The `#nosec` comment allows ignoring a specific rule; this prevents
potentially other "gosec" linting failulres from being silently ignored.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
In this mode buildkit can push directly so pushing manually
with docker would result in pushing image twice.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
