The mounts for exec operations was misconstruing most input names as the
root mount because it was using the wrong input index to match with the
exec mounts.
The correct input index is now being used so bind mounts and other types
of mounts should now show the correct mount destination rather than only
showing the root mount.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Fixes#2668
When Kubernetes marks nodes as "Ready" before their Certificate Signing
Requests (CSRs) are approved, the buildx kubernetes driver can fail to
connect to builder pods with transient TLS errors like:
- "tls: internal error"
- "context deadline exceeded"
- "use of closed network connection"
- "i/o timeout"
This is particularly problematic on EKS clusters with ARM64 nodes under
heavy load, where multiple builders are being spawned simultaneously.
This commit adds retry logic with exponential backoff to the Dial()
function in the kubernetes driver. The implementation:
- Attempts up to 5 connection retries
- Uses exponential backoff starting at 500ms, capped at 10s
- Only retries on known transient connection errors
- Uses errors.Is/errors.As for proper error type checking
- Logs retry attempts using logrus for visibility
- Respects context cancellation
This allows buildx to gracefully handle the race condition where pods
are marked as Running before their TLS certificates are fully ready.
Signed-off-by: guimove <dasilva.guillaume@live.fr>
This adds integration tests for the `dap build` command to test various
behavior associated with the command. We start the build and the
integration test acts as a dap client to send requests and check that
the output is what we expect.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
The -D/--debug flag was not enabling debug logging in standalone mode.
Root cause: debug.Enable() was called before dockerCli.Initialize(),
but Initialize() calls SetLogLevel("") which resets logrus level to
Info, and since options.Debug was false, it wasn't re-enabled.
Fix: Pass opt.debug to options.Debug before Initialize() so it
properly enables debug level after SetLogLevel().
Signed-off-by: Sergei Khomenkov <sergey@homenkow.ru>
The upstream PR that used the pseudo-versions was merged so this no
longer causes an upgrade of those dependencies to pseudo-versions so the
exclude is no longer needed.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Directly convert to a int32 instead of later conversion so that
we can return an error if the value is out of range.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
full diff: https://github.com/golang/crypto/compare/v0.44.0...v0.45.0
Hello gophers,
We have tagged version v0.45.0 of golang.org/x/crypto in order to address two
security issues.
This version fixes a vulnerability in the golang.org/x/crypto/ssh package and a
vulnerability in the golang.org/x/crypto/ssh/agent package which could cause
programs to consume unbounded memory or panic respectively.
SSH servers parsing GSSAPI authentication requests don't validate the number of
mechanisms specified in the request, allowing an attacker to cause unbounded
memory consumption.
Thanks to Jakub Ciolek for reporting this issue.
This is CVE-2025-58181 and Go issue https://go.dev/issue/76363.
SSH Agent servers do not validate the size of messages when processing new
identity requests, which may cause the program to panic if the message is
malformed due to an out of bounds read.
Thanks to Jakub Ciolek for reporting this issue.
This is CVE-2025-47914 and Go issue https://go.dev/issue/76364.
Cheers, Go Security team
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
