Track denied source identifiers during policy evaluation and flag the policy
progress vertex as failed when BuildKit returns a matching DENY error pattern.
This improves the progress output of policy error and shows last
policy logs with the build error.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Allows avoiding the case where two separate builds using
same context name would use the same destination directory
for upload.
Requires updated frontend to handle these new keys.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Fix the policy logger being open for the whole build.
In new logic logger is opened on-demand if there are logs,
remains open until timeout and is restarted if new logs
come after.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Automatically set `unpack=false` for registry exports unless explicitly
overridden by the user.
This applies to:
- `registry` exporter type (converted to `image` exporter with `push=true`)
- `--push` flag usage with image exporters
Users can still explicitly set `unpack=true` if they need local image
storage alongside registry push.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The buildx command line will now handle `@` symbols in the
`oci-layout://` path when used with named contexts. Instead of
assuming the `@` symbol is part of the reference digest, it will first
check that it is a valid reference digest. Otherwise, it will assume
it's part of the file path.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Note that nil targets still do not work as buildkit
does not currently support build inputs with nil values.
But this gives cleaner error from buildkit instead of
panic on the client side.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Persist attestation manifest and any manifest cosign-based
signatures when creating new images.
When creating index from single-arch manifests where attestation
manifest is not inlined, it can be loaded from referrers API.
Note that for this to work the attestation manifest needs to be
in artifact type when image was built.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit aab8171f824d13d703e869107e1720ad71d24bff)
Allows specifying platforms that should be included
in the new image, making it possible to reduce platforms
of existing multi-arch image. Previously the individual
image manifests needed to be used as sources, but that
dropped their related attestation manifests.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
For the cases where frontend/buildkit doesn't support new
Git Querystring format, allow resolving the URL into LLB
on client side and then build from input.
Note that this produces slightly different provenance
where context is not set as string, so added opt-in
via environment variable for now.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Set gateway `source` to the first part of `BUILDKIT_SYNTAX` and
`cmdline` to the entire raw value to preserve additional options.
Signed-off-by: Dan Duvall <dduvall@wikimedia.org>
This fix allows building with a remote builder where
frontend.dockerfile.v0 enabled = false in the buildkitd yaml file.
Note that this change only allows the usage of BUILDKIT_SYNTAX with
a custom frontend image, and using the #syntax directive in this case
will still fail.
Resolves: docker#3077
Signed-off-by: Will Nonnemaker <wnonnemaker@gmail.com>
Invoking the shell will cause it to persist across the entire build and
to re-execute whenever the builder pauses at another location again.
This still requires using `exec` to launch the shell. Launching by frame
id is also removed since it no longer applies to this version.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
It is now possible to send next and continue as separate signals. When
executing a build, the debug adapter will divide the LLB graph into
regions. Each region corresponds to an uninterrupted chain of
instructions. It will also record which regions depend on which other
ones.
This determines the execution order and it also determines what the
stack traces look like.
When continue is used, we will attempt to evaluate the last leaf node
(the head). If we push next, we will determine which digest would be the
next one to be processed.
In the future, this will be used to also support breakpoints.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
The `#nosec` comment allows ignoring a specific rule; this prevents
potentially other "gosec" linting failulres from being silently ignored.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Adds a simple implementation of the debug adapter that supports the very
basics of a debug adapter.
It supports the launch request, the configuration done request, the
creation of threads, stopping, resuming, and disconnecting from server.
It does not support custom breakpoints, stack traces, or variable
inspection yet. These are planned to be added in the future.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Tonis Tiigi