alextab93/buildx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity
4,367 Commits 1 Branch 1 Tag
4e15a5aca0e63b9c504b8a1c4e67993bc3e289b3
Commit Graph
4367 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tõnis TiigiandGitHub 4e15a5aca0 Merge pull request #3968 from tonistiigi/vendor-buildkit-v0.32.0-rc1 
vendor: update buildkit to v0.32.0-rc1
 2026-07-22 16:17:59 -07:00
Tonis Tiigi 9869706843 hack: build lint from source to avoid go version error 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-07-22 15:48:20 -07:00
Tonis Tiigi e1d77f39e1 commands: filter noisy fsverity support warning 
containerd v2 (vendored via buildkit v0.32.0-rc1) now logs a warning
when opening a local content store on a filesystem without fsverity
support, which it probes by trying to enable verity on a temp file.
This fails on overlayfs, tmpfs, and similar filesystems common in
container and CI environments, so every imagetools oci-layout inspect
or create emitted an alarming but non-actionable warning.

Add the message to the existing logutil filter (extended to Warn level)
so it is kept out of user output, matching how other containerd/buildkit
log noise is already suppressed.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-07-22 15:37:44 -07:00
Tonis Tiigi 0cf7592d41 vendor: update buildkit to v0.32.0-rc1 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-07-22 15:27:47 -07:00
Tõnis TiigiandGitHub efd9aa1dea Merge pull request #3965 from crazy-max/docs-bake-output-fix 
docs: fix typo for bake output override
 2026-07-22 10:25:28 -07:00
Tõnis TiigiandGitHub 40962144b8 Merge pull request #3961 from tonistiigi/buildkit-default-policy 
policy: verify BuildKit builder images
 2026-07-22 10:25:06 -07:00
CrazyMax 178013a423 docs: fix typo for bake output override 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-07-22 15:08:57 +02:00
CrazyMaxandGitHub 5c10fb7184 Merge pull request #3962 from crazy-max/bake-secret-source-override 
bake: allow overriding declared secret sources
 2026-07-22 14:36:50 +02:00
CrazyMaxandGitHub 26f3b06d8d Merge pull request #3963 from docker/dependabot/github_actions/actions/labeler-7.0.0 
build(deps): bump actions/labeler from 6.2.0 to 7.0.0
 2026-07-22 14:36:15 +02:00
Tõnis TiigiandGitHub 4a44f8092f Merge pull request #3944 from crazy-max/policy-windows-policy-paths 
policy: normalize local policy paths
 2026-07-21 18:58:20 -07:00
Tõnis TiigiandGitHub 0206f2f593 Merge pull request #3935 from crazy-max/bake-file-relative-paths 
bake: add file-relative path opt-in
 2026-07-21 18:44:27 -07:00
dependabot[bot]andGitHub e3098fba5d build(deps): bump actions/labeler from 6.2.0 to 7.0.0 
Bumps [actions/labeler](https://github.com/actions/labeler) from 6.2.0 to 7.0.0.
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](https://github.com/actions/labeler/compare/b8dd2d9be0f68b860e7dae5dae7d772984eacd6d...bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13)

---
updated-dependencies:
- dependency-name: actions/labeler
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-21 18:38:13 +00:00
CrazyMaxandGitHub b0ec760812 Merge pull request #3928 from jarqvi/fix-remote-driver-authority 
remote: use endpoint address for buildkit client authority
 2026-07-21 18:32:48 +02:00
CrazyMax febb45afe2 bake: allow overriding declared secret sources 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-07-21 12:20:36 +02:00
CrazyMax aac040df56 bake: fix file-relative target references 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-07-21 11:25:56 +02:00
CrazyMax b1f1ac27bd bake: fix inherited file-relative contexts 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-07-21 11:25:56 +02:00
CrazyMax bc32533b6e bake: align compose path base with compose 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-07-21 11:25:55 +02:00
CrazyMax 1dc55abd89 bake: make file-relative paths definition-scoped 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-07-21 11:25:55 +02:00
CrazyMaxandCrazyMax b38d1004e3 bake: add file-relative path opt-in 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-07-21 11:25:55 +02:00
CrazyMaxandGitHub 9618d82eff Merge pull request #3960 from docker/dependabot/github_actions/actions/checkout-7.0.1 
build(deps): bump actions/checkout from 7.0.0 to 7.0.1
 2026-07-21 09:36:35 +02:00
CrazyMaxandGitHub cb27fae430 Merge pull request #3959 from docker/dependabot/github_actions/codeql-actions-c5945cc316 
build(deps): bump the codeql-actions group with 4 updates
 2026-07-21 09:35:36 +02:00
Tonis Tiigi acaf251f0b policy: verify BuildKit builder images 
Extend the built-in policy to validate signed moby/buildkit release and
floating tags before docker-container builders are created.

Pull the image first, inspect it through Docker, and bind verification to the
descriptor digest. Resolve signature attestations through the BuildKit API
embedded in the Docker daemon.

If pulling fails, use a local image while applying the same verification when
the containerd image store exposes an immutable descriptor. Keep the classic
image-store behavior unchanged because no descriptor is available.

Allow unmanaged repositories and digest-only references unchanged. Add the
allow-untrusted-image driver option as an explicit verification bypass.

Document the behavior and add policy, digest-pinning, and local fallback
coverage.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-07-20 18:22:41 -07:00
dependabot[bot]andGitHub 445ef5df52 build(deps): bump actions/checkout from 7.0.0 to 7.0.1 
Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-20 18:39:03 +00:00
dependabot[bot]andGitHub 0505ba48d6 build(deps): bump the codeql-actions group with 4 updates 
Bumps the codeql-actions group with 4 updates: [github/codeql-action/upload-sarif](https://github.com/github/codeql-action), [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action).


Updates `github/codeql-action/upload-sarif` from 4.37.0 to 4.37.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a)

Updates `github/codeql-action/init` from 4.37.0 to 4.37.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a)

Updates `github/codeql-action/autobuild` from 4.37.0 to 4.37.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a)

Updates `github/codeql-action/analyze` from 4.37.0 to 4.37.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.37.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-20 18:38:21 +00:00
CrazyMaxandGitHub a6718dc753 Merge pull request #3958 from docker/dependabot/github_actions/actions/setup-go-7.0.0 
build(deps): bump actions/setup-go from 6.5.0 to 7.0.0
 2026-07-20 09:21:11 +02:00
dependabot[bot]andGitHub 232475f0a5 build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.5.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/924ae3a1cded613372ab5595356fb5720e22ba16...b7ad1dad31e06c5925ef5d2fc7ad053ef454303e)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-17 18:37:32 +00:00
CrazyMaxandGitHub 8035347c81 Merge pull request #3954 from docker/dependabot/github_actions/docker/github-builder/dot-github/workflows/bake.yml-1.14.0 
build(deps): bump docker/github-builder/.github/workflows/bake.yml from 1.13.0 to 1.14.0
 2026-07-17 16:38:19 +02:00
CrazyMaxandGitHub 55e166449f Merge pull request #3953 from docker/dependabot/github_actions/softprops/action-gh-release-3.0.2 
build(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2
 2026-07-17 16:38:08 +02:00
CrazyMax bd4ea1bb06 policy: normalize local policy paths 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-07-17 11:29:51 +02:00
Tõnis TiigiandGitHub 59af558217 Merge pull request #3956 from crazy-max/buildkit-0.31.2 
dockerfile: update buildkit to v0.31.2
 2026-07-16 18:23:18 -07:00
CrazyMax 274cfcebaa dockerfile: update buildkit to v0.31.2 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-07-16 17:40:10 +02:00
dependabot[bot]andGitHub 0cbd0849f4 build(deps): bump docker/github-builder/.github/workflows/bake.yml 
Bumps [docker/github-builder/.github/workflows/bake.yml](https://github.com/docker/github-builder) from 1.13.0 to 1.14.0.
- [Release notes](https://github.com/docker/github-builder/releases)
- [Commits](https://github.com/docker/github-builder/compare/c4a1b216d96a8c85b45a9974b37857828274c808...3415a188caae9a0da7fba83bc06985776e0b1790)

---
updated-dependencies:
- dependency-name: docker/github-builder/.github/workflows/bake.yml
  dependency-version: 1.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-15 18:38:24 +00:00
dependabot[bot]andGitHub 3120e4f97d build(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.1 to 3.0.2.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](https://github.com/softprops/action-gh-release/compare/718ea10b132b3b2eba29c1007bb80653f286566b...3d0d9888cb7fd7b750713d6e236d1fcb99157228)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-15 18:37:59 +00:00
Tõnis TiigiandGitHub 2adf2bc447 Merge pull request #3861 from areebahmeddd/fix/random-pods 
route bake targets across pods with random loadbalance
 2026-07-15 09:05:30 -07:00
CrazyMaxandGitHub 5633720a6e Merge pull request #3952 from vvoland/fix-iidfile 
build: Fix iidfile for containerd-backed Docker driver
 2026-07-15 16:54:09 +02:00
Tõnis TiigiandGitHub 19fc65a0ab Merge pull request #3943 from crazy-max/policy-handle-leak 
policy: close memoized policy filesystems
 2026-07-13 23:39:07 -07:00
MohammadHasan Akbari b2878907cc remote: set grpc authority as a default option 
Add the ":authority" dial option to the default client options instead of
appending it after the caller-provided options, so that an authority
explicitly passed by the caller takes precedence over the driver default.

Signed-off-by: MohammadHasan Akbari <jarqvi.jarqvi@gmail.com>
 2026-07-14 09:46:00 +04:00
Paweł Gronowski 21de7d2078 build: Fix iidfile for containerd-backed Docker driver 
Images loaded into Docker's containerd image store are identified by
their manifest or index digest, while the legacy graphdriver store uses
the config digest.

buildx prefers containerimage.config.digest when the Moby exporter
returns both digests.
Some exporter responses still produce a usable iidfile, but affected
builds, such as those with attestations disabled, write a config digest
that Docker image commands cannot resolve.

Expose the Docker driver's image-store mode as a feature and set
prefer-image-digest for containerd-backed Moby exports.

Signed-off-by: Paweł Gronowski <git@grono.dev>
 2026-07-13 20:01:34 +02:00
CrazyMaxandGitHub aadce022ac Merge pull request #3950 from docker/dependabot/github_actions/docker/github-builder/dot-github/workflows/bake.yml-1.13.0 
build(deps): bump docker/github-builder/.github/workflows/bake.yml from 1.12.0 to 1.13.0
 2026-07-11 17:14:13 +02:00
CrazyMaxandGitHub 9a2a4c869b Merge pull request #3949 from docker/dependabot/github_actions/codeql-actions-a4f8c6bd69 
build(deps): bump the codeql-actions group with 4 updates
 2026-07-11 17:13:51 +02:00
CrazyMax d5c8b8894c policy: close memoized policy filesystems 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-07-11 16:59:58 +02:00
MohammadHasan Akbari 877de7edf2 remote: prefer servername for grpc authority 
When the servername driver-opt is set it is also used for TLS SNI and
certificate validation, so use it for the gRPC ":authority" pseudo-header
as well, falling back to the endpoint host otherwise. This matches how the
buildkit client derives the authority from the server name when TLS
credentials are supplied.

Since the driver terminates TLS in its own dialer, the authority is set
explicitly via client.WithGRPCDialOption(grpc.WithAuthority(...)).

Signed-off-by: MohammadHasan Akbari <jarqvi.jarqvi@gmail.com>
 2026-07-11 10:17:12 +04:00
dependabot[bot]andGitHub d147db5318 build(deps): bump docker/github-builder/.github/workflows/bake.yml 
Bumps [docker/github-builder/.github/workflows/bake.yml](https://github.com/docker/github-builder) from 1.12.0 to 1.13.0.
- [Release notes](https://github.com/docker/github-builder/releases)
- [Commits](https://github.com/docker/github-builder/compare/5f637c833aa76bc99372a1dc9a6f8bcd8056fb85...c4a1b216d96a8c85b45a9974b37857828274c808)

---
updated-dependencies:
- dependency-name: docker/github-builder/.github/workflows/bake.yml
  dependency-version: 1.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-10 18:38:40 +00:00
dependabot[bot]andGitHub 7443506320 build(deps): bump the codeql-actions group with 4 updates 
Bumps the codeql-actions group with 4 updates: [github/codeql-action/upload-sarif](https://github.com/github/codeql-action), [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action).


Updates `github/codeql-action/upload-sarif` from 4.36.3 to 4.37.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9)

Updates `github/codeql-action/init` from 4.36.3 to 4.37.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9)

Updates `github/codeql-action/autobuild` from 4.36.3 to 4.37.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9)

Updates `github/codeql-action/analyze` from 4.36.3 to 4.37.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-10 18:38:19 +00:00
CrazyMaxandGitHub 1f2cef18b8 Merge pull request #3947 from docker/dependabot/github_actions/actions/labeler-6.2.0 
build(deps): bump actions/labeler from 6.1.0 to 6.2.0
 2026-07-10 16:17:37 +02:00
dependabot[bot]andGitHub 331907ac99 build(deps): bump actions/labeler from 6.1.0 to 6.2.0 
Bumps [actions/labeler](https://github.com/actions/labeler) from 6.1.0 to 6.2.0.
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](https://github.com/actions/labeler/compare/f27b608878404679385c85cfa523b85ccb86e213...b8dd2d9be0f68b860e7dae5dae7d772984eacd6d)

---
updated-dependencies:
- dependency-name: actions/labeler
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-09 18:38:00 +00:00
CrazyMaxandGitHub 32a1eb033a Merge pull request #3946 from thaJeztah/rm_go_reportcard 
README: remove Go Report Card badge
 2026-07-09 09:48:25 +02:00
Sebastiaan van Stijn ade3d75607 README: remove Go Report Card badge 
The project was sunset;

> After more than a decade of serving the ecosystem, the time
> has come to sunset Go Report Card. Following the loss of our
> primary infrastructure sponsor, maintaining the web app is
> no longer sustainable.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-07-09 01:04:56 +02:00
Tõnis TiigiandGitHub 5964c80ed3 Merge pull request #3913 from thaJeztah/bump_opa 
vendor: github.com/open-policy-agent/opa v1.14.1
 2026-07-08 08:54:57 -07:00
Areeb Ahmed ec41ad745d fix random pod spread 
Signed-off-by: Areeb Ahmed <areebahmed0709@gmail.com>
 2026-07-08 15:44:39 +03:00