Images loaded into Docker's containerd image store are identified by
their manifest or index digest, while the legacy graphdriver store uses
the config digest.
buildx prefers containerimage.config.digest when the Moby exporter
returns both digests.
Some exporter responses still produce a usable iidfile, but affected
builds, such as those with attestations disabled, write a config digest
that Docker image commands cannot resolve.
Expose the Docker driver's image-store mode as a feature and set
prefer-image-digest for containerd-backed Moby exports.
Signed-off-by: Paweł Gronowski <git@grono.dev>
Parse schemaVersion and descriptor fields in a single pass instead of
calling json.Unmarshal twice.
Signed-off-by: amarkdotdev <amarkdotdev@users.noreply.github.com>
Return a clear error when -f contains a manifest or index instead of an OCI
content descriptor, and reject descriptors missing a valid digest. Avoids
a nil-pointer panic when piping inspect --raw output into imagetools create.
Fixes#2091
Signed-off-by: amarkdotdev <amarkdotdev@users.noreply.github.com>
Port of moby/buildkit#6569 to buildx. Adds --memory, --memory-swap,
--cpu-shares, --cpu-period, --cpu-quota, --cpuset-cpus, and --cpuset-mems
flags to build, plus the equivalent bake target attributes and compose
x-bake fields.
Signed-off-by: Jiří Moravčík <jiri.moravcik@gmail.com>
Avoids the call to `os.Getenv` when it is unnecessary because it would
be overwritten anyway.
Removes the comments about moving environment variable parsing to a
method for use by library consumers. That method exists in containerd
and this set of code doesn't actually perform any parsing since the
parsing of this time is done within buildkit and not on the client.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Allow passing policy content through stdin by specifying
"--file -" in the eval command. This enables piping policy
data without requiring a file on disk.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Allow buildx policy eval to accept an explicit target platform and skip
worker platform discovery when the flag is provided.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Removes the experimental flags and bits for dap and deletes some dead
code that somehow made its way this far without anyone noticing.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Pass the exit code through the exited event back to the client and
ensure that the printed text is printed completely.
Previously, the exited event just had a big todo and the printer would
sometimes fail to send messages to the connected client. This moves the
printer wait to before the debug adapter is closed to ensure that all
messages get sent through the connection to the editor. While there, I
also plumbed in the exit code to exited. It's not necessarily the real
exit code but it will produce a zero on build success and a non-zero
code on build failure so that should be good enough.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Reuse a single ingester per target repository when imagetools create
copies multiple manifests in parallel.
This lets the pushing ingester serialize same-digest pushes and avoids
racing duplicate blob uploads against registries to work around bug in
Registry v3.0.0 (and possibly others).
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add oci-layout:// source and target support to imagetools create and
inspect while keeping merge, filter, and referrer logic shared.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
The context used for serving the dap server was being canceled too early
because it used defer which would initiate at the end of the function
while every other cleanup function used `t.Cleanup` which executes in
its own goroutine.
One possible solution was to move the cancel to the cleanup, but the
context being passed to serve and start doesn't make sense because if it
ever does get canceled, it'll likely cause a similar race condition with
`Stop`.
This removes the context from the methods that were causing this issue
in favor of just relying on the caller calling `Stop` when they are done
with the adapter and server.
This seems to have only affected tests and I don't believe it affected
the actual dap command.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Track fields reloaded during eval --print resolution loops and filter
final invalid-field warnings against that set.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Turn the current utility used by policy helper commands that
allows getting gateway.Client lazily into reusable package.
This is preparation for using this utility also in the policy
verification, outside of commands.
Only expose SourceMetaResolver as other methods of gateway client
are not needed atm by any callers.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Make the code more unified between validation and
test command. Normalize to key without the input prefix.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add metrics associated with the debugger that are reported through the
metrics writer. This adds a few attributes that are only added when a
debugger is used with either the `debug` command or `dap` command.
At the moment, these metrics show up the exact same as a build and we
can't identify if something is using `dap` or `debug` since they use the
same code path.
This also adds a new available metric that can be utilized by plugins to
report additional information. The metrics will check if an environment
variable `BUILDX_DAP_USER_AGENT` is sent and that will get included in
the metrics if they are enabled.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
When creating resulting image index it is wasteful
to check for attestations for the descriptors in original
index what were already attestation for subject manifest.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Currently needed manifests were filtered out and then
copied in a loop, but for each copy still the full
unfiltered descriptor was copied instead of single
manifest, resulting multiple push attempts for same
descriptor.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Paweł Gronowski