Add the ":authority" dial option to the default client options instead of
appending it after the caller-provided options, so that an authority
explicitly passed by the caller takes precedence over the driver default.
Signed-off-by: MohammadHasan Akbari <jarqvi.jarqvi@gmail.com>
When the servername driver-opt is set it is also used for TLS SNI and
certificate validation, so use it for the gRPC ":authority" pseudo-header
as well, falling back to the endpoint host otherwise. This matches how the
buildkit client derives the authority from the server name when TLS
credentials are supplied.
Since the driver terminates TLS in its own dialer, the authority is set
explicitly via client.WithGRPCDialOption(grpc.WithAuthority(...)).
Signed-off-by: MohammadHasan Akbari <jarqvi.jarqvi@gmail.com>
The remote driver created the buildkit client with an empty address:
client.New(ctx, "", opts...)
With an empty address the buildkit client falls back to the system
default address (the local unix socket) and derives the gRPC
":authority" pseudo-header from it, which ends up being "localhost".
The actual connection was still correct because the remote driver
provides its own dialer, but the wrong authority broke HTTP/2 reverse
proxies (such as Envoy) that route based on ":authority".
Pass the configured endpoint address to client.New so the authority is
derived from the remote endpoint hostname (e.g.
my-buildkit.example.com:443). The custom dialer is preserved, so the
dial target and TLS/SNI behavior are unchanged.
Fixes#3880
Signed-off-by: MohammadHasan Akbari <jarqvi.jarqvi@gmail.com>
In this mode buildkit can push directly so pushing manually
with docker would result in pushing image twice.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Because remote driver implements Info() by calling
Client() internally, two instances on Client are created
backed by separate TCP connection. This hack avoids it
and improves performance.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
This refactors the driver handle to initialize the tracer delegate
inside of the driver handle instead of the individual plugins.
This provides more uniformity to how the tracer delegate is created by
allowing the driver handle to pass additional client options to the
drivers when they create the client. It also avoids creating the tracer
delegate client multiple times because the driver handle will only
initialize the client once. This prevents some drivers, like the remote
driver, from accidentally registering multiple clients as tracer
delegates.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
With the new dial-stdio command the dialer is split
from `Client` function in order to access it directly.
This breaks the custom connhelpers functionality
as support for connhelpers is a feature of the default
dialer. If client defines a custom dialer then only
it is used without extra modifications. This means
that remote driver dialer needs to detect the
connhelpers on its own.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
This allows the buildx CLI to act a proxy to the configured instance.
It allows external code to use buildx itself as a driver for connecting
to buildkitd instances.
Instance and node selection should follow the same semantics as as
`buildx build`, including taking into account the `BUILDX_BUILDER` env
var and the `--builder` global flag.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
This adds status reporting for the remote driver so it shows the length
of time it is spending waiting for the connection. If the service is
already present, this logger isn't shown but it should help provide a
message to show the user why the build is stalled.
A timeout of 20 seconds has been added to the bootstrap.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Adds a new HostGatewayIP entry in the Driver interface so we can
move Features and HostGatewayIP handling with cache to the very
specific driver (docker).
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
This native implementation uses GRPC level waiting, instead of starting
a busy loop. We also a manual max backoff of one second to improve
responsiveness.
Signed-off-by: Justin Chadwell <me@jedevc.com>
There is no reason why one can't make a docker tarball or
load to Docker instance from remote driver.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Previously, we would explicitly error if all TLS parameters were not
available. However, it is a perfectly valid use case to connect to a
buildkit server that only provides TLS in one direction to verify the
server (which is possible today with buildctl).
To support this use case, we only need to error if only one of key or
cert is set, and the other is not - if both are unspecified, the client
will not present a certificate to the server.
Signed-off-by: Justin Chadwell <me@jedevc.com>
This patch completes the work started in creating a remote driver:
- Renames the env driver to the remote driver (an alternative suggestion
that should be more user-friendly)
- Adds support for TLS to encrypt connections with buildkitd
- Fixes outstanding review comments
- Reworks the buildx create command endpoint construction to be clearer
and include better support for this new driver.
Signed-off-by: Justin Chadwell <me@jedevc.com>
MohammadHasan Akbari