Extend the built-in policy to validate signed moby/buildkit release and
floating tags before docker-container builders are created.
Pull the image first, inspect it through Docker, and bind verification to the
descriptor digest. Resolve signature attestations through the BuildKit API
embedded in the Docker daemon.
If pulling fails, use a local image while applying the same verification when
the containerd image store exposes an immutable descriptor. Keep the classic
image-store behavior unchanged because no descriptor is available.
Allow unmanaged repositories and digest-only references unchanged. Add the
allow-untrusted-image driver option as an explicit verification bypass.
Document the behavior and add policy, digest-pinning, and local fallback
coverage.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Port of moby/buildkit#6569 to buildx. Adds --memory, --memory-swap,
--cpu-shares, --cpu-period, --cpu-quota, --cpuset-cpus, and --cpuset-mems
flags to build, plus the equivalent bake target attributes and compose
x-bake fields.
Signed-off-by: Jiří Moravčík <jiri.moravcik@gmail.com>
Allow passing policy content through stdin by specifying
"--file -" in the eval command. This enables piping policy
data without requiring a file on disk.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Removes the experimental flags and bits for dap and deletes some dead
code that somehow made its way this far without anyone noticing.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Expand the buildx build doc to include details on the supported input
options for the --file flag: local file path, remote URL, and stdin. Add
examples for each input type to enhance user understanding.
Signed-off-by: Akhil Manoj <akhil.manoj2003@gmail.com>
Signed-off-by: Akhil Manoj <manoja2@vcu.edu>
This provides alternative way to set values for Bake
variables without adding them the global environment variables.
This can also be used then environment variable access
is disabled with BUILDX_BAKE_DISABLE_VARS_ENV_LOOKUP.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Automatically set `unpack=false` for registry exports unless explicitly
overridden by the user.
This applies to:
- `registry` exporter type (converted to `image` exporter with `push=true`)
- `--push` flag usage with image exporters
Users can still explicitly set `unpack=true` if they need local image
storage alongside registry push.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Allows specifying platforms that should be included
in the new image, making it possible to reduce platforms
of existing multi-arch image. Previously the individual
image manifests needed to be used as sources, but that
dropped their related attestation manifests.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Currently there is no way to completely suppress the progress output.
We have --progress=quiet but it has additional effect of printing
image ID as a progress for historical reasons. --progress=none
behaves like quiet but without this extra output printing depending
on build output.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Adds some entry-level and developer-friendly docs for the debug adapter.
The one in `docs/dap.md` is meant for someone trying to use the debugger
while the one in `docs/reference/buildx_dap_build.md` is more focused on
documenting the command to be integrated in a debugger extension.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
This will configure the default behavior when beginning to evaluate a
build target. When `stopOnEntry` is used, it will default to `stepNext`.
Otherwise, `stepContinue` will be used.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Adds a simple implementation of the debug adapter that supports the very
basics of a debug adapter.
It supports the launch request, the configuration done request, the
creation of threads, stopping, resuming, and disconnecting from server.
It does not support custom breakpoints, stack traces, or variable
inspection yet. These are planned to be added in the future.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Tonis Tiigi