nprasad2077/docker-docs
1
0 Fork 0
mirror of https://github.com/docker/docs.git synced 2026-11-04 10:01:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #26311 from docker-tools-robot/dispatch/buildx-ref-v0.38.0

Browse Source 
Update buildx reference to v0.38.0
This commit is contained in:
David Karlsson authored and GitHub committed 2026-10-08 09:18:51 +02:00
2 parents 7ba25eeb0c 79edc94fd7
commit 2c8a358489
14 files changed
+755 -59
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

_vendor/github.com/docker/buildx/docs/bake-reference.md
Generated
+2 -2
View File
@@ -228,7 +228,7 @@ The following table shows the complete list of attributes that you can assign to
| [`dockerfile-inline`](#targetdockerfile-inline) | String | Inline Dockerfile string |
| [`dockerfile`](#targetdockerfile) | String | Dockerfile location |
| [`entitlements`](#targetentitlements) | List | Permissions that the build process requires to run |
| [`extra-hosts`](#targetextra-hosts) | List | Customs host-to-IP mapping |
| [`extra-hosts`](#targetextra-hosts) | List | Custom host-to-IP mapping |
| [`inherits`](#targetinherits) | List | Inherit attributes from other targets |
| [`labels`](#targetlabels) | Map | Metadata for images |
| [`matrix`](#targetmatrix) | Map | Define a set of variables that forks a target into multiple targets. |
@@ -594,7 +594,7 @@ Entitlements are enabled with a two-step process. First, a target must declare t
### `target.extra-hosts`
Use the `extra-hosts` attribute to define customs host-to-IP mapping for the
Use the `extra-hosts` attribute to define custom host-to-IP mapping for the
target. This has the same effect as passing a [`--add-host`][add-host] flag to
the build command.
_vendor/github.com/moby/buildkit/docs/attestations/slsa-definitions.md
Generated
+15 -3
View File
@@ -180,9 +180,21 @@ field for every step.
}
```
BuildKit sets the `builderPlatform` of the build machine. Note that this is not
necessarily the platform of the build result that can be determined from the
`in-toto` subject field.
BuildKit sets the `builderPlatform` of the build machine. This is not
necessarily the platform of the build result, which is recorded separately in
`targetPlatform`.
### `buildDefinition.internalParameters.targetPlatform`
* Ref: https://slsa.dev/spec/v1.1/provenance#internalParameters
* Included with `mode=min` and `mode=max`.
The `targetPlatform` is the platform associated with this build result, for
example `linux/arm64`. It is set even when the request does not specify a
platform. For a multi-platform build, each result's provenance contains its
own target platform. For binary artifacts, this value describes the declared
result platform; BuildKit does not inspect the output binary to determine its
architecture.
### `buildDefinition.resolvedDependencies`
_vendor/github.com/moby/buildkit/docs/buildkitd.toml.md
Generated
+49 -14
View File
@@ -7,7 +7,8 @@ list of global settings followed by a series of sections for specific areas
of daemon configuration.
The file path is `/etc/buildkit/buildkitd.toml` for rootful mode,
`~/.config/buildkit/buildkitd.toml` for rootless mode.
`~/.config/buildkit/buildkitd.toml` for rootless mode. A different path can be
set with the `--config` flag or the `BUILDKITD_CONFIG` environment variable.
The following is a complete `buildkitd.toml` configuration example.
Note that some configuration options are only useful in edge cases.
@@ -71,6 +72,29 @@ provenanceEnvDir = "/etc/buildkit/provenance.d"
# active-build events. Existing records remain available until normal GC.
maxEntries = 50
[compaction]
# Opt-in metadata database maintenance, independent of cache GC.
enabled = false
# Committed write transactions between automatic eligibility checks.
writesPerCheck = 10000
# Database size is sampled at most every five minutes after committed writes.
# Initial minimum database size for growth-triggered eligibility checks.
sizeWatermark = 134217728
# After compaction, grow the next size watermark from the compacted size by
# this percentage.
sizeGrowthPercent = 100
# Either threshold can trigger compaction, subject to the percentage floor.
minReclaimBytes = 268435456
# Percentage of the database file estimated to be reclaimable.
minReclaimPercent = 30
# Minimum reclaimable percentage, even when minReclaimBytes is reached.
minReclaimPercentFloor = 10
# Wait for no active transactions and this interval without database activity.
idleTimeout = "1m"
# Cancel this many attempts for arriving writers, then let the next copy finish.
# Writers may wait for the full copy duration. Zero forces the first attempt.
maxRetry = 3
[worker.oci]
enabled = true
# platforms is manually configure platforms, detected automatically if unset.
@@ -163,6 +187,8 @@ provenanceEnvDir = "/etc/buildkit/provenance.d"
cniPoolSize = 16
# defaultCgroupParent sets the parent cgroup of all containers.
defaultCgroupParent = "buildkit"
# hypervIsolation enables Hyper-V isolation for Windows containers.
hypervIsolation = false
[worker.containerd.labels]
"foo" = "bar"
@@ -222,19 +248,28 @@ provenanceEnvDir = "/etc/buildkit/provenance.d"
# maxRegistryConcurrency sets the maximum number of concurrent connections
# per registry. If unset, the default concurrency limit is used.
maxRegistryConcurrency = 4
# sessionAuthTimeout sets the timeout for daemon-side authentication
# round-trips with the buildx client session (resolving credentials and
# fetching auth tokens from the session). Can be a duration string
# (e.g. "60s") or a bare integer treated as seconds. If unset, the default
# timeout of 60s is used. A value of zero or less disables the timeout
# entirely.
sessionAuthTimeout = "60s"
# optional signed cache configuration for GitHub Actions backend
[ghacache.sign]
# command that signs the payload in stdin and outputs the signature to stdout. Normally you want cosign to produce the signature bytes.
cmd = ""
[ghacache.verify]
required = false
[ghacache.verify.policy]
timestampThreshold = 1
tlogThreshold = 1
# cetificate properties that need to match. Simple wildcards (*) are supported.
certificateIssuer = ""
subjectAlternativeName = ""
buildSignerURI = ""
# [cache.gha.sign]
# # command that signs the payload in stdin and outputs the signature to stdout.
# # Normally you want cosign to produce the signature bytes.
# command = ""
#
# [cache.gha.verify]
# required = false
#
# [cache.gha.verify.policy]
# timestampThreshold = 1
# tlogThreshold = 1
# # certificate properties that need to match. Simple wildcards (*) are supported.
# certificateIssuer = ""
# subjectAlternativeName = ""
# buildSignerURI = ""
```
_vendor/github.com/moby/buildkit/frontend/dockerfile/docs/reference.md
Generated
+18 -2
View File
@@ -883,6 +883,15 @@ performance. Your build should work with any contents of the cache directory as
another build may overwrite the files or GC may clean it if more storage space
is needed.
> [!NOTE]
> Cache mounts are stored in the builder's local storage. They are not
> included in [exported build cache](https://docs.docker.com/build/cache/backends/)
> (`--cache-to`), and are not restored by `--cache-from`. If each build runs
> on a new builder (e.g. on CI runners that provision a fresh machine
> for each job), cache mounts start empty on every build. For a workaround on
> GitHub Actions, see
> [Cache mounts](https://docs.docker.com/build/ci/github-actions/cache/#cache-mounts).
#### Example: cache Go packages
```dockerfile
@@ -1904,11 +1913,16 @@ Sets ownership of copied files. Without this flag, files are created with UID
and GID of 0.
The flag accepts usernames, group names, UIDs, or GIDs in any combination.
If you specify only a user, the GID is set to the same numeric value as the UID.
If you omit the group, either as `--chown=<user>` or `--chown=<user>:`, a
username uses the primary GID from its `/etc/passwd` entry. A numeric UID uses
the same numeric value for the GID, without looking up `/etc/passwd`. For example,
`--chown=1000:` sets both the UID and GID to 1000, even if that user's primary
GID in `/etc/passwd` is different.
```dockerfile
COPY --chown=55:mygroup files* /somedir/
COPY --chown=bin files* /somedir/
COPY --chown=bin: files* /somedir/
COPY --chown=1 files* /somedir/
COPY --chown=10:11 files* /somedir/
COPY --chown=myuser:mygroup --chmod=644 files* /somedir/
@@ -1917,7 +1931,9 @@ COPY --chown=myuser:mygroup --chmod=644 files* /somedir/
When using names instead of numeric IDs, BuildKit resolves them using
`/etc/passwd` and `/etc/group` in the container's root filesystem. If these
files are missing or don't contain the specified names, the build fails.
Numeric IDs don't require this lookup.
Numeric IDs don't require this lookup. When combined with
[`--link`](#copy---link), files are copied into an empty filesystem, so names
can't be resolved and `--chown` must use numeric IDs.
The `--chown` flag is not supported when building Windows containers.
_vendor/modules.txt
Generated
+2 -2
View File
@@ -1,6 +1,6 @@
# github.com/moby/moby/api v1.56.1
# github.com/moby/buildkit v0.33.1
# github.com/docker/buildx v0.37.2
# github.com/moby/buildkit v0.34.0
# github.com/docker/buildx v0.38.0
# github.com/docker/cli v29.8.2+incompatible
# github.com/docker/compose/v5 v5.6.0
# github.com/docker/model-runner v1.1.36
data/cli/buildx/docker_buildx.yaml
Generated
+2
View File
@@ -18,6 +18,7 @@ cname:
- docker buildx ls
- docker buildx policy
- docker buildx prune
- docker buildx replay
- docker buildx rm
- docker buildx stop
- docker buildx use
@@ -36,6 +37,7 @@ clink:
- docker_buildx_ls.yaml
- docker_buildx_policy.yaml
- docker_buildx_prune.yaml
- docker_buildx_replay.yaml
- docker_buildx_rm.yaml
- docker_buildx_stop.yaml
- docker_buildx_use.yaml
data/cli/buildx/docker_buildx_bake.yaml
Generated
+135 -34
View File
@@ -7,11 +7,6 @@ long: |-
Read [High-level build options with Bake](/build/bake/)
guide for introduction to writing bake files.
> [!NOTE]
> `buildx bake` command may receive backwards incompatible features in the future
> if needed. We are looking for feedback on improving the command and extending
> the functionality further.
usage: docker buildx bake [OPTIONS] [TARGET...]
pname: docker buildx
plink: docker_buildx.yaml
@@ -60,6 +55,18 @@ options:
experimentalcli: false
kubernetes: false
swarm: false
- option: jobs
shorthand: j
value_type: string
default_value: fail-fast
description: 'Set target execution behavior (format: `N` or `mode[,parallel=N]`)'
details_url: '#jobs'
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: list
value_type: string
description: List targets or variables
@@ -331,6 +338,66 @@ examples: |-
Same as [`build --check`](/reference/cli/docker/buildx/build/#check).
### Configure target execution behavior (--jobs, -j) {#jobs}
```text
--jobs=N
--jobs=[mode,]parallel=N
--jobs=mode
```
The `--jobs` flag (shorthand `-j`) controls target concurrency, output
synchronization, and how Bake handles target failures. It accepts an integer
as shorthand for `parallel=N`, or comma-separated mode and parallel options.
For example, `-j=2` is equivalent to `--jobs=parallel=2`, and
`--jobs=defer-error,parallel=2` combines a mode with a concurrency limit.
The mode can also be written as `mode=defer-error`.
The default mode is `fail-fast`, which stops the build when a target
fails and cancels targets that are still running. Outputs already written by
successful targets are not removed.
The `defer-output` mode waits until all participating targets have successfully
evaluated their build results before any target begins exporting output. This is
useful when multiple targets produce related artifacts and you want to withhold
their outputs if a build fails. Exports are not transactional: an export failure
can still leave partial output, and completed exports are not rolled back.
For multi-node targets, `defer-output` applies to the BuildKit solve and export
boundary for each target. Any manifest list merge or registry push that Buildx
performs after the per-node solves complete is not part of this synchronization
barrier.
The `defer-error` mode allows independent targets to keep running after another
target fails. Bake still returns an error after all possible targets complete,
but successful targets can finish and write their outputs. Targets that depend
on a failed target cannot complete successfully. When `--metadata-file` is set,
Bake writes metadata for successful targets even if another target fails.
```console
$ docker buildx bake --jobs=defer-output # wait for all build results before exporting
$ docker buildx bake --jobs=defer-error # let independent targets finish before returning an error
```
The `parallel` option limits how many Bake targets run at the same time. It
requires a non-negative integer. When omitted or set to `0`, Bake doesn't apply
a target concurrency limit. This controls target scheduling, not BuildKit's
internal parallelism for build steps within a target. Specify the mode and limit
in the same flag value; repeating `--jobs` replaces the previous value.
```console
$ docker buildx bake -j=2 # run at most two targets at the same time
$ docker buildx bake --jobs=parallel=1 # run targets sequentially
$ docker buildx bake --jobs=defer-error,parallel=2 # limit concurrency and let independent targets finish after a failure
```
With `defer-output`, every participating target must be able to reach the output
boundary before any target completes. A nonzero jobs limit smaller than the
number of participating targets is therefore rejected. The same restriction
applies when linked targets are present, because their solves may need to be
active together. The count includes implicit targets referenced through
`target:` contexts.
### Specify a build definition file (-f, --file) {#file}
Use the `-f` / `--file` option to specify the build definition file to use.
@@ -622,80 +689,114 @@ examples: |-
is defined in https://golang.org/pkg/path/#Match.
```console
$ docker buildx bake --set target.args.mybuildarg=value
$ docker buildx bake --set target.arg.mybuildarg=value
$ docker buildx bake --set target.platform=linux/arm64
$ docker buildx bake --set foo*.args.mybuildarg=value # overrides build arg for all targets starting with 'foo'
$ docker buildx bake --set *.platform=linux/arm64 # overrides platform for all targets
$ docker buildx bake --set foo*.arg.mybuildarg=value # overrides build arg for all targets starting with 'foo'
$ docker buildx bake --set *.platform=linux/arm64 # overrides platforms for all targets
$ docker buildx bake --set foo*.no-cache # bypass caching only for targets starting with 'foo'
$ docker buildx bake --set target.platform+=linux/arm64 # appends 'linux/arm64' to the platform list
$ docker buildx bake --set target.contexts.bar=../bar # overrides 'bar' named context
$ docker buildx bake --set target.resources.memory=2g # overrides memory resource limit
$ docker buildx bake --set target.resource.memory=2g # overrides memory resource limit
$ docker buildx bake --set target.secret.aws=env=AWS # overrides source for an existing secret
$ docker buildx bake --set target.tag= # clears all tag values
```
> [!NOTE]
>
> `--set` is a repeatable flag. For array fields such as `tags`, repeat `--set`
> `--set` is a repeatable flag. For array fields such as `tag`, repeat `--set`
> to provide multiple values or use the `+=` operator to append without
> replacing. Array literal syntax like `--set target.tags=[a,b]` is not
> supported.
> replacing. Array literal syntax like `--set target.tag=[a,b]` is not
> supported. For array fields, a non-append assignment with an empty value
> clears values from the Bake definition and earlier `--set` flags. Subsequent
> assignments or appends add values to the cleared array.
You can override the following fields:
* `annotations`
* `annotation`
* `attest`
* `args`
* `arg.<name>`
* `cache-from`
* `cache-to`
* `call`
* `context`
* `contexts`
* `contexts.<name>`
* `dockerfile`
* `entitlements`
* `extra-hosts`
* `labels`
* `entitlement`
* `extra-host.<hostname>`
* `label.<name>`
* `load`
* `no-cache`
* `no-cache-filter`
* `network`
* `output`
* `platform`
* `policy`
* `pull`
* `push`
* `resources`
* `resource.<field>`
* `secret`
* `secret.<id>`
* `secrets`
* `shm-size`
* `ssh`
* `tags`
* `tag`
* `target`
* `ulimit`
You can append using `+=` operator for the following fields:
* `annotations`¹
* `annotation`¹
* `attest`¹
* `cache-from`
* `cache-to`
* `entitlements`¹
* `entitlement`¹
* `no-cache-filter`
* `output`
* `platform`
* `secrets`
* `policy`
* `secret`
* `ssh`
* `tags`
* `tag`
* `ulimit`
> [!NOTE]
> ¹ These fields already append by default.
Override keys use singular names. Existing plural Bake field names and
historical `--set` spellings remain supported as aliases:
| Alias | Canonical key |
|----------------|---------------|
| `annotations` | `annotation` |
| `args` | `arg` |
| `entitlements` | `entitlement` |
| `extra-hosts` | `extra-host` |
| `labels` | `label` |
| `platforms` | `platform` |
| `resources` | `resource` |
| `secrets` | `secret` |
| `tags` | `tag` |
| `ulimits` | `ulimit` |
Aliases are normalized before overrides are applied, so they can be mixed
with canonical keys in repeated `--set` options. `context` and `contexts` are
not aliases: `context` sets the build context, while `contexts.<name>` sets a
named context. `secret.<id>` also has separate semantics: it changes the
source of a secret that is already declared by the target. The plural alias
does not support this form; `secrets.<id>` is invalid.
#### Inline values for composable attributes
Some fields, such as `ssh`, `secret`, `output`, `cache-to`, `cache-from`,
`attest`, and `annotations`, are composable attributes that accept a list of
object values in a Bake file. When you override these fields with `--set`, you
provide each value using the same inline string syntax as the corresponding
build flag, not the HCL object form. The `--set` override replaces or appends
to the list as a whole; it doesn't address individual sub-fields with a
sub-selector. Only the map-valued fields `args`, `contexts`, `labels`, and
`extra-hosts` support targeting a specific entry with a sub-key (for example
`--set target.args.MYARG=value`).
Composable fields such as `ssh`, `secret`, `output`, `cache-to`, `cache-from`,
`attest`, and `annotation` accept a list of object values in a Bake file. When
you override these fields with `--set`, provide each value using the same
inline string syntax as the corresponding build flag, not the HCL object
form. The override replaces or appends to the list as a whole and does not
address individual object fields with a subkey.
Only `arg`, `contexts`, `extra-host`, `label`, `resource`, and `secret` support
entry-addressed subkeys. For example, use `--set target.arg.MYARG=value` to
override one build argument. As described above, `secret.<id>` changes the
source of an existing secret rather than an object field.
For example, to set the SSH agent socket or key for a target, use the same
`id=path` form accepted by [`build --ssh`](/reference/cli/docker/buildx/build/#ssh):
data/cli/buildx/docker_buildx_create.yaml
Generated
+3
View File
@@ -300,6 +300,9 @@ examples: |-
Uses Kubernetes pods. With this driver, you can spin up pods with defined
BuildKit container image to build your images.
Rootless mode (`--driver-opt rootless=true`) requires Kubernetes v1.30 or later
with support for `securityContext.appArmorProfile`, which is stable in v1.31.
Unlike `docker` driver, built images will not automatically appear in
`docker images` and [`build --load`](/reference/cli/docker/buildx/build/#load) needs to be used
to achieve that.
data/cli/buildx/docker_buildx_replay.yaml
Generated
+65
View File
@@ -0,0 +1,65 @@
command: docker buildx replay
short: Replay a build from its provenance
long: |-
`buildx replay` reads the SLSA provenance attestation of an existing build and
reproduces the build with the recorded frontend, options, and source digests.
Replay runs on the selected builder and requires BuildKit v0.27 or later.
Subjects are accepted in three forms:
- `docker-image://<ref>` or a bare `<ref>` — resolve through the registry.
- `oci-layout://<path>[:<tag>]` — read from a local OCI layout.
- A local attestation file: an in-toto statement (`.intoto.jsonl`), an
unsigned DSSE envelope, a Sigstore bundle, or a bare SLSA provenance
predicate.
A build can be replayed when:
- its provenance was recorded with `mode=max`
(`--provenance=mode=max` or `--attest=type=provenance,mode=max`). `mode=min`
provenance omits the build arguments, secrets, and SSH needed for replay;
- its build context was a Git repository or an HTTP(S) URL. Builds that used
local directories, stdin, OCI layouts, or other Bake targets as build
contexts cannot be replayed;
- it did not use `--network=host`, unless a different `--network` is passed
to replay;
- the recorded sources are still available.
Replay rebuilds one platform at a time. For a multi-platform image, select the
platform with `--platform`. By default, the only platform of the image or the
default platform of the builder is used.
usage: docker buildx replay
pname: docker buildx
plink: docker_buildx.yaml
cname:
- docker buildx replay build
clink:
- docker_buildx_replay_build.yaml
inherited_options:
- option: builder
value_type: string
description: Override the configured builder instance
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: debug
shorthand: D
value_type: bool
default_value: "false"
description: Enable debug logging
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
deprecated: false
hidden: false
experimental: false
experimentalcli: true
kubernetes: false
swarm: false
data/cli/buildx/docker_buildx_replay_build.yaml
Generated
+201
View File
@@ -0,0 +1,201 @@
command: docker buildx replay build
short: Rebuild an image from provenance and pinned materials
long: |-
`replay build` reconstructs an image from the provenance attestation attached
to an existing subject.
The replay mode controls how sources are resolved:
- `materials` (default) pins every source to the digest recorded in the
provenance. A source that is not recorded, or whose content changed, fails
the build.
- `frontend` replays the recorded frontend and options, but resolves sources
again, so the result can differ from the original build.
Replayed builds do not add new provenance or SBOM attestations. Local outputs
with `mode=delete` are not supported.
usage: docker buildx replay build [OPTIONS] SUBJECT
pname: docker buildx replay
plink: docker_buildx_replay.yaml
options:
- option: dry-run
value_type: bool
default_value: "false"
description: Print a plan of the replay without solving or exporting
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: format
value_type: string
default_value: pretty
description: Format dry-run output (`pretty` | `json`)
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: load
value_type: bool
default_value: "false"
description: Shorthand for `--output=type=docker`
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: materials
value_type: stringArray
default_value: '[]'
description: |
Materials store (repeatable; format: `provenance` | `oci-layout://<path>[:<tag>]` | `<absolute-path>` | `<key>=<value>`)
deprecated: false
hidden: true
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: network
value_type: string
description: |
Network mode for RUN instructions (`default` | `none`; defaults to the mode of the original build)
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: output
shorthand: o
value_type: stringArray
default_value: '[]'
description: 'Output destination (format: `type=local,dest=path`)'
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: platform
value_type: stringArray
default_value: '[]'
description: |
Platform of the subject to replay (defaults to the only platform of the subject or the builder default platform)
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: progress
value_type: string
default_value: auto
description: |
Set type of progress output (`auto` | `plain` | `tty` | `quiet` | `rawjson`)
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: push
value_type: bool
default_value: "false"
description: Shorthand for `--output=type=registry,unpack=false`
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: replay-mode
value_type: string
default_value: materials
description: Replay mode (`materials` | `frontend`)
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: secret
value_type: stringArray
default_value: '[]'
description: |
Secret to expose to the replayed build (format: `id=mysecret[,src=/local/secret]`)
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: ssh
value_type: stringArray
default_value: '[]'
description: |
SSH agent socket or keys to expose (format: `default|<id>[=<socket>|<key>[,<key>]]`)
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: tag
shorthand: t
value_type: stringArray
default_value: '[]'
description: 'Image identifier (format: `[registry/]repository[:tag]`)'
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
inherited_options:
- option: builder
value_type: string
description: Override the configured builder instance
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: debug
shorthand: D
value_type: bool
default_value: "false"
description: Enable debug logging
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
examples: |-
### Replay a registry image and export to an OCI tar
```console
docker buildx replay build docker-image://example.com/app@sha256:deadbeef \
--output=type=oci,dest=replay.oci.tar
```
### Dry-run a replay to inspect the plan
```console
docker buildx replay build docker-image://example.com/app@sha256:deadbeef --dry-run --format=json | jq
```
Dry-run runs the same checks as a real replay, so a subject that cannot be
replayed fails before any build starts.
deprecated: false
hidden: false
experimental: false
experimentalcli: true
kubernetes: false
swarm: false
data/cli/buildx/docker_buildx_replay_snapshot.yaml
Generated
+132
View File
@@ -0,0 +1,132 @@
command: docker buildx replay snapshot
short: Export replay inputs for a subject as a reusable materials store
long: Export replay inputs for a subject as a reusable materials store
usage: docker buildx replay snapshot [OPTIONS] SUBJECT
pname: docker buildx replay
plink: docker_buildx_replay.yaml
options:
- option: dry-run
value_type: bool
default_value: "false"
description: Print a JSON plan of the snapshot without writing output
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: include-materials
value_type: bool
default_value: "true"
description: Include material content in the snapshot
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: materials
value_type: stringArray
default_value: '[]'
description: |
Materials store (repeatable; format: `provenance` | `oci-layout://<path>[:<tag>]` | `<absolute-path>` | `<key>=<value>`)
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: network
value_type: string
description: |
Network mode for RUN instructions (`default` | `none`; defaults to the mode of the original build)
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: output
shorthand: o
value_type: stringArray
default_value: '[]'
description: |
Output destination (default: `-` — oci tar to stdout; bare `<path>` writes an oci-layout directory; `type=oci,dest=X[,tar=true|false]`)
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: platform
value_type: stringArray
default_value: '[]'
description: |
Platform of the subject to replay (defaults to the only platform of the subject or the builder default platform)
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: progress
value_type: string
default_value: auto
description: |
Set type of progress output (`auto` | `plain` | `tty` | `quiet` | `rawjson`)
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: secret
value_type: stringArray
default_value: '[]'
description: |
Secret to expose to the replayed build (format: `id=mysecret[,src=/local/secret]`)
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: ssh
value_type: stringArray
default_value: '[]'
description: |
SSH agent socket or keys to expose (format: `default|<id>[=<socket>|<key>[,<key>]]`)
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
inherited_options:
- option: builder
value_type: string
description: Override the configured builder instance
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: debug
shorthand: D
value_type: bool
default_value: "false"
description: Enable debug logging
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
deprecated: false
hidden: true
experimental: false
experimentalcli: true
kubernetes: false
swarm: false
data/cli/buildx/docker_buildx_replay_verify.yaml
Generated
+122
View File
@@ -0,0 +1,122 @@
command: docker buildx replay verify
short: Replay a subject and compare the result against the original artifact
long: Replay a subject and compare the result against the original artifact
usage: docker buildx replay verify [OPTIONS] SUBJECT
pname: docker buildx replay
plink: docker_buildx_replay.yaml
options:
- option: compare
value_type: string
default_value: digest
description: Comparison mode (`digest` | `artifact`)
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: materials
value_type: stringArray
default_value: '[]'
description: |
Materials store (repeatable; format: `provenance` | `oci-layout://<path>[:<tag>]` | `<absolute-path>` | `<key>=<value>`)
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: network
value_type: string
description: |
Network mode for RUN instructions (`default` | `none`; defaults to the mode of the original build)
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: output
shorthand: o
value_type: stringArray
default_value: '[]'
description: |
Output destination for the verification result (VSA) (format: `type=local,dest=path`)
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: platform
value_type: stringArray
default_value: '[]'
description: |
Platform of the subject to replay (defaults to the only platform of the subject or the builder default platform)
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: progress
value_type: string
default_value: auto
description: |
Set type of progress output (`auto` | `plain` | `tty` | `quiet` | `rawjson`)
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: secret
value_type: stringArray
default_value: '[]'
description: |
Secret to expose to the replayed build (format: `id=mysecret[,src=/local/secret]`)
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: ssh
value_type: stringArray
default_value: '[]'
description: |
SSH agent socket or keys to expose (format: `default|<id>[=<socket>|<key>[,<key>]]`)
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
inherited_options:
- option: builder
value_type: string
description: Override the configured builder instance
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- option: debug
shorthand: D
value_type: bool
default_value: "false"
description: Enable debug logging
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
deprecated: false
hidden: true
experimental: false
experimentalcli: true
kubernetes: false
swarm: false
go.mod
+2 -2
View File
@@ -8,12 +8,12 @@ go 1.26.8
//
// Make sure to add an entry in the "tools" section when adding a new repository.
require (
github.com/docker/buildx v0.37.2
github.com/docker/buildx v0.38.0
github.com/docker/cli v29.8.2+incompatible
github.com/docker/compose/v5 v5.6.0
github.com/docker/docker-agent v1.126.0
github.com/docker/model-runner v1.1.36
github.com/moby/buildkit v0.33.1
github.com/moby/buildkit v0.34.0
github.com/moby/moby/api v1.56.1
)
go.sum
+7
View File
@@ -99,6 +99,8 @@ github.com/docker/buildx v0.37.1 h1:uFwAbgh1znGPz7YCg/tr6dHuR/+OqxAWc1YMxxAO/m4=
github.com/docker/buildx v0.37.1/go.mod h1:caF6XsZtJ9OAE22LVRsl2OUz5eL+P0+cS2YrnKhuryA=
github.com/docker/buildx v0.37.2 h1:6EYElyvQe7aPnp2yDmCLa4/0jXYs8dAHfWKVO6dsFwA=
github.com/docker/buildx v0.37.2/go.mod h1:3CTKuzEyWIMz4TdAutpRjEfNpAp8mhK62ssOuwLWG4w=
github.com/docker/buildx v0.38.0 h1:LKfznm3wgm0hYaQDkiuoK9hyDS1GU/GChnXYsBr3A00=
github.com/docker/buildx v0.38.0/go.mod h1:4lEDxmaYDJ17HtXTND9A53BaDoHCJbk5WUgcmfipN7Q=
github.com/docker/cli v29.1.2+incompatible h1:s4QI7drXpIo78OM+CwuthPsO5kCf8cpNsck5PsLVTH8=
github.com/docker/cli v29.1.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
github.com/docker/cli v29.1.5+incompatible h1:GckbANUt3j+lsnQ6eCcQd70mNSOismSHWt8vk2AX8ao=
@@ -319,6 +321,8 @@ github.com/moby/buildkit v0.33.0 h1:zBbt1FiMcTB/oFg1iCNcKa83k5Rn8MGcVjXFIcfYhuQ=
github.com/moby/buildkit v0.33.0/go.mod h1:uNKSZnfMk1aSa18JiCR5BT68M/3jIDGo6XuAByUK3ek=
github.com/moby/buildkit v0.33.1 h1:UUrdifmRdRadykO+f5l8BT1CseUXst2sJHV7AmkjjxE=
github.com/moby/buildkit v0.33.1/go.mod h1:584wW8T/WG4O+lpXUCoDaWEc5e+rTGC3iP+l9mNcX8E=
github.com/moby/buildkit v0.34.0 h1:bG5h2y1s5IVvc/uSGo6hVlYbd2eXVFRuADl9Zf+jeJM=
github.com/moby/buildkit v0.34.0/go.mod h1:e+Za70y2a3nL1U2Y0P8TvhPyKp2Ok2NS+Q4siSArDiM=
github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
@@ -383,11 +387,13 @@ github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
github.com/prometheus/client_model v0.6.3 h1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=
github.com/prometheus/common v0.67.1 h1:OTSON1P4DNxzTg4hmKCc37o4ZAZDv0cfXLkOt0oEowI=
github.com/prometheus/common v0.67.1/go.mod h1:RpmT9v35q2Y+lsieQsdOh5sXZ6ajUGC8NjZAmr8vb0Q=
github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=
github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=
github.com/prometheus/common v0.70.1 h1:1HvjP4D5oL3t8RsPlwxA9onvvStjtIHYE5XuuwOi/PY=
github.com/prometheus/common v0.71.0 h1:9KDAKb7Mj3HEVKyFCK6Dc/HIwlBzZIN2l7/lrHl3KK8=
github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg=
github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
github.com/prometheus/procfs v0.17.0 h1:FuLQ+05u4ZI+SS/w9+BWEM2TXiHKsUQ9TADiRH7DuK0=
@@ -536,6 +542,7 @@ golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=