Track denied source identifiers during policy evaluation and flag the policy
progress vertex as failed when BuildKit returns a matching DENY error pattern.
This improves the progress output of policy error and shows last
policy logs with the build error.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Allows avoiding the case where two separate builds using
same context name would use the same destination directory
for upload.
Requires updated frontend to handle these new keys.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Fix the policy logger being open for the whole build.
In new logic logger is opened on-demand if there are logs,
remains open until timeout and is restarted if new logs
come after.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Automatically set `unpack=false` for registry exports unless explicitly
overridden by the user.
This applies to:
- `registry` exporter type (converted to `image` exporter with `push=true`)
- `--push` flag usage with image exporters
Users can still explicitly set `unpack=true` if they need local image
storage alongside registry push.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The buildx command line will now handle `@` symbols in the
`oci-layout://` path when used with named contexts. Instead of
assuming the `@` symbol is part of the reference digest, it will first
check that it is a valid reference digest. Otherwise, it will assume
it's part of the file path.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
For the cases where frontend/buildkit doesn't support new
Git Querystring format, allow resolving the URL into LLB
on client side and then build from input.
Note that this produces slightly different provenance
where context is not set as string, so added opt-in
via environment variable for now.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Set gateway `source` to the first part of `BUILDKIT_SYNTAX` and
`cmdline` to the entire raw value to preserve additional options.
Signed-off-by: Dan Duvall <dduvall@wikimedia.org>
This fix allows building with a remote builder where
frontend.dockerfile.v0 enabled = false in the buildkitd yaml file.
Note that this change only allows the usage of BUILDKIT_SYNTAX with
a custom frontend image, and using the #syntax directive in this case
will still fail.
Resolves: docker#3077
Signed-off-by: Will Nonnemaker <wnonnemaker@gmail.com>
Removes all references to the controller and moves the remaining
sections of code to other packages.
Processes has been moved to monitor where it is used and the data
structs have been removed so buildflags is used directly. The controller
build function has been moved to the commands package.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Prior to this change, the following command emits the wrong image ID when buildx
uses the "docker-container" driver and Docker is configured with the
containerd-snapshotter.
$ docker buildx build --load --iidfile=img.txt
$ docker run --rm "$(cat img.txt)" echo hello
docker: Error response from daemon: No such image: sha256:4ac37e81e00f242010e42f3251094e47de6100e01d25e9bd0feac6b8906976df.
See 'docker run --help'.
The problem is that buildx is outputing the incorrect image ID in this scenario
(it's outputing the container image config digest, instead of the container
image digest used by the containerd-snapshotter).
This commit fixes this. See https://github.com/moby/moby/issues/45458.
Signed-off-by: Cesar Talledo <cesar.talledo@docker.com>
Allow access to CDI Devices in Buildkit v0.20.0+ for
devices that are not automatically allowed to be used by
everyone in BuildKit configuration.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
When building from same stream all nodes need to read
data from the same stream. In order to achive that there
is a new SyncMultiReader wrapper that sends the stream
concurrently to all readers. Readers must read at similar
speed or pauses will happen while they wait for each other.
Dockerfiles were already written to disk before sent. Now
the file written by first node is reused for others.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
This is a preparation to shared local sources for bake
targets and makes it possible to have equality check
between locals from different targets.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
When LocalDirs were changed to LocalMounts, this broke the
sharedKey computation that was based on the context directory
path. SharedKey defines if directory is valid candidate for
incremental context transfer and if not set properly then
different directories do metadata-based transfers to same destination.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
This makes the code slightly more idiomatic, but the errors produced will
change slightly to prevent having to path NamedContext as argument.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This package is part of the classic builder, and was currently only used
for the IsURL utility, which is a very rudimentary check for a string having
a "https://" or "http://" scheme.
This patch copies the code as non-exported functions where they're used to
remove the dependency.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
hasDigest would always be true when reaching this code, because the function
would return with an error when failing to resolve the digest;
if !hasDigest {
return nil, errors.Errorf("oci-layout reference %q could not be resolved", v.Path)
}
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Tonis Tiigi