Embed an opt-in default source policy for Docker-managed frontend images.
Load it ahead of user policies when enabled, and cover behavior with table-
driven policy tests for signed, unsigned, floating, and labs tags.
Makes sure if there is any attack against the docker/dockerfile
releases, or they accidentally point to worng images, these are automatically detected.
In a future release these should become opt-out.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
This refines the check for determining whether exec will succeed to work
when an error occurs. This check previously relied on the `Ref` being
populated in the result context but this would only happen if we were
paused from a breakpoint or by stepping. An error would not fill in this
field.
The check is now refined to use the new gateway filesystem exec API so
we can create the container and then check even if we don't have a
returned gateway reference. The logic to determine which mount to check
has also been moved.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Add oci-layout:// source and target support to imagetools create and
inspect while keeping merge, filter, and referrer logic shared.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Use an errgroup helper to evaluate result refs concurrently during forced
evaluation, and fail fast on the first evaluation error.
This mitigates current case in bake where chained targets with
a multi-platform build could miss secrets and other session properties.
The outline for the issue case:
- Base target is solved but only lazily and not really loaded/tracked
in build graph yet.
- Child targets are loaded, base target waits.
- Evaluate is called for base stage (because it might be missing result
condition), child stage is processed as build result. This happens in
parallel.
- Because `Evaluate()` was called synchronously, it may have not been
called yet for the second platform while the child target already
needs to run `RUN --mount=type=secret`.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Use cleaned DockerfilePath basename for policy env filename and fall back
to Dockerfile when the path resolves to dot or root.
Previously filename could be reported as "." on default cases.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Track denied source identifiers during policy evaluation and flag the policy
progress vertex as failed when BuildKit returns a matching DENY error pattern.
This improves the progress output of policy error and shows last
policy logs with the build error.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
The container filesystem request API that has been added to buildkit
allows a container created through the `NewContainer` API to also access
the filesystems. This is useful when an error occurs because it allows
us to grab the mutable state of the mounts used during the actual build
rather than the input version copies which don't contain any files that
were added as part of the failed command.
This gives us a more accurate view of the filesystem that was previously
only accessible through using `exec` and `ls`/`cat` commands that may
not always exist.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Allows avoiding the case where two separate builds using
same context name would use the same destination directory
for upload.
Requires updated frontend to handle these new keys.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Fix the policy logger being open for the whole build.
In new logic logger is opened on-demand if there are logs,
remains open until timeout and is restarted if new logs
come after.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Automatically set `unpack=false` for registry exports unless explicitly
overridden by the user.
This applies to:
- `registry` exporter type (converted to `image` exporter with `push=true`)
- `--push` flag usage with image exporters
Users can still explicitly set `unpack=true` if they need local image
storage alongside registry push.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The buildx command line will now handle `@` symbols in the
`oci-layout://` path when used with named contexts. Instead of
assuming the `@` symbol is part of the reference digest, it will first
check that it is a valid reference digest. Otherwise, it will assume
it's part of the file path.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Note that nil targets still do not work as buildkit
does not currently support build inputs with nil values.
But this gives cleaner error from buildkit instead of
panic on the client side.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Mateusz Gozdek