From 79edc94fd7ac197ce84fc8619888432074b9d8de Mon Sep 17 00:00:00 2001 From: docker-tools-robot <40391885+docker-tools-robot@users.noreply.github.com> Date: Thu, 8 Oct 2026 01:41:54 +0200 Subject: [PATCH] vendor: github.com/docker/buildx v0.38.0 Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --- .../docker/buildx/docs/bake-reference.md | 4 +- .../docs/attestations/slsa-definitions.md | 18 +- .../moby/buildkit/docs/buildkitd.toml.md | 63 ++++-- .../frontend/dockerfile/docs/reference.md | 20 +- _vendor/modules.txt | 4 +- data/cli/buildx/docker_buildx.yaml | 2 + data/cli/buildx/docker_buildx_bake.yaml | 169 ++++++++++++--- data/cli/buildx/docker_buildx_create.yaml | 3 + data/cli/buildx/docker_buildx_replay.yaml | 65 ++++++ .../buildx/docker_buildx_replay_build.yaml | 201 ++++++++++++++++++ .../buildx/docker_buildx_replay_snapshot.yaml | 132 ++++++++++++ .../buildx/docker_buildx_replay_verify.yaml | 122 +++++++++++ go.mod | 4 +- go.sum | 7 + 14 files changed, 755 insertions(+), 59 deletions(-) create mode 100644 data/cli/buildx/docker_buildx_replay.yaml create mode 100644 data/cli/buildx/docker_buildx_replay_build.yaml create mode 100644 data/cli/buildx/docker_buildx_replay_snapshot.yaml create mode 100644 data/cli/buildx/docker_buildx_replay_verify.yaml diff --git a/_vendor/github.com/docker/buildx/docs/bake-reference.md b/_vendor/github.com/docker/buildx/docs/bake-reference.md index 635fd96188..380d0b30fa 100644 --- a/_vendor/github.com/docker/buildx/docs/bake-reference.md +++ b/_vendor/github.com/docker/buildx/docs/bake-reference.md @@ -228,7 +228,7 @@ The following table shows the complete list of attributes that you can assign to | [`dockerfile-inline`](#targetdockerfile-inline) | String | Inline Dockerfile string | | [`dockerfile`](#targetdockerfile) | String | Dockerfile location | | [`entitlements`](#targetentitlements) | List | Permissions that the build process requires to run | -| [`extra-hosts`](#targetextra-hosts) | List | Customs host-to-IP mapping | +| [`extra-hosts`](#targetextra-hosts) | List | Custom host-to-IP mapping | | [`inherits`](#targetinherits) | List | Inherit attributes from other targets | | [`labels`](#targetlabels) | Map | Metadata for images | | [`matrix`](#targetmatrix) | Map | Define a set of variables that forks a target into multiple targets. | @@ -594,7 +594,7 @@ Entitlements are enabled with a two-step process. First, a target must declare t ### `target.extra-hosts` -Use the `extra-hosts` attribute to define customs host-to-IP mapping for the +Use the `extra-hosts` attribute to define custom host-to-IP mapping for the target. This has the same effect as passing a [`--add-host`][add-host] flag to the build command. diff --git a/_vendor/github.com/moby/buildkit/docs/attestations/slsa-definitions.md b/_vendor/github.com/moby/buildkit/docs/attestations/slsa-definitions.md index 0053e1e12d..082227ff9c 100644 --- a/_vendor/github.com/moby/buildkit/docs/attestations/slsa-definitions.md +++ b/_vendor/github.com/moby/buildkit/docs/attestations/slsa-definitions.md @@ -180,9 +180,21 @@ field for every step. } ``` -BuildKit sets the `builderPlatform` of the build machine. Note that this is not -necessarily the platform of the build result that can be determined from the -`in-toto` subject field. +BuildKit sets the `builderPlatform` of the build machine. This is not +necessarily the platform of the build result, which is recorded separately in +`targetPlatform`. + +### `buildDefinition.internalParameters.targetPlatform` + +* Ref: https://slsa.dev/spec/v1.1/provenance#internalParameters +* Included with `mode=min` and `mode=max`. + +The `targetPlatform` is the platform associated with this build result, for +example `linux/arm64`. It is set even when the request does not specify a +platform. For a multi-platform build, each result's provenance contains its +own target platform. For binary artifacts, this value describes the declared +result platform; BuildKit does not inspect the output binary to determine its +architecture. ### `buildDefinition.resolvedDependencies` diff --git a/_vendor/github.com/moby/buildkit/docs/buildkitd.toml.md b/_vendor/github.com/moby/buildkit/docs/buildkitd.toml.md index a7f4312129..bba3961d2a 100644 --- a/_vendor/github.com/moby/buildkit/docs/buildkitd.toml.md +++ b/_vendor/github.com/moby/buildkit/docs/buildkitd.toml.md @@ -7,7 +7,8 @@ list of global settings followed by a series of sections for specific areas of daemon configuration. The file path is `/etc/buildkit/buildkitd.toml` for rootful mode, -`~/.config/buildkit/buildkitd.toml` for rootless mode. +`~/.config/buildkit/buildkitd.toml` for rootless mode. A different path can be +set with the `--config` flag or the `BUILDKITD_CONFIG` environment variable. The following is a complete `buildkitd.toml` configuration example. Note that some configuration options are only useful in edge cases. @@ -71,6 +72,29 @@ provenanceEnvDir = "/etc/buildkit/provenance.d" # active-build events. Existing records remain available until normal GC. maxEntries = 50 +[compaction] + # Opt-in metadata database maintenance, independent of cache GC. + enabled = false + # Committed write transactions between automatic eligibility checks. + writesPerCheck = 10000 + # Database size is sampled at most every five minutes after committed writes. + # Initial minimum database size for growth-triggered eligibility checks. + sizeWatermark = 134217728 + # After compaction, grow the next size watermark from the compacted size by + # this percentage. + sizeGrowthPercent = 100 + # Either threshold can trigger compaction, subject to the percentage floor. + minReclaimBytes = 268435456 + # Percentage of the database file estimated to be reclaimable. + minReclaimPercent = 30 + # Minimum reclaimable percentage, even when minReclaimBytes is reached. + minReclaimPercentFloor = 10 + # Wait for no active transactions and this interval without database activity. + idleTimeout = "1m" + # Cancel this many attempts for arriving writers, then let the next copy finish. + # Writers may wait for the full copy duration. Zero forces the first attempt. + maxRetry = 3 + [worker.oci] enabled = true # platforms is manually configure platforms, detected automatically if unset. @@ -163,6 +187,8 @@ provenanceEnvDir = "/etc/buildkit/provenance.d" cniPoolSize = 16 # defaultCgroupParent sets the parent cgroup of all containers. defaultCgroupParent = "buildkit" + # hypervIsolation enables Hyper-V isolation for Windows containers. + hypervIsolation = false [worker.containerd.labels] "foo" = "bar" @@ -222,19 +248,28 @@ provenanceEnvDir = "/etc/buildkit/provenance.d" # maxRegistryConcurrency sets the maximum number of concurrent connections # per registry. If unset, the default concurrency limit is used. maxRegistryConcurrency = 4 - + # sessionAuthTimeout sets the timeout for daemon-side authentication + # round-trips with the buildx client session (resolving credentials and + # fetching auth tokens from the session). Can be a duration string + # (e.g. "60s") or a bare integer treated as seconds. If unset, the default + # timeout of 60s is used. A value of zero or less disables the timeout + # entirely. + sessionAuthTimeout = "60s" # optional signed cache configuration for GitHub Actions backend -[ghacache.sign] -# command that signs the payload in stdin and outputs the signature to stdout. Normally you want cosign to produce the signature bytes. -cmd = "" -[ghacache.verify] -required = false -[ghacache.verify.policy] -timestampThreshold = 1 -tlogThreshold = 1 -# cetificate properties that need to match. Simple wildcards (*) are supported. -certificateIssuer = "" -subjectAlternativeName = "" -buildSignerURI = "" +# [cache.gha.sign] +# # command that signs the payload in stdin and outputs the signature to stdout. +# # Normally you want cosign to produce the signature bytes. +# command = "" +# +# [cache.gha.verify] +# required = false +# +# [cache.gha.verify.policy] +# timestampThreshold = 1 +# tlogThreshold = 1 +# # certificate properties that need to match. Simple wildcards (*) are supported. +# certificateIssuer = "" +# subjectAlternativeName = "" +# buildSignerURI = "" ``` diff --git a/_vendor/github.com/moby/buildkit/frontend/dockerfile/docs/reference.md b/_vendor/github.com/moby/buildkit/frontend/dockerfile/docs/reference.md index 1b30a383c3..5026981a4a 100644 --- a/_vendor/github.com/moby/buildkit/frontend/dockerfile/docs/reference.md +++ b/_vendor/github.com/moby/buildkit/frontend/dockerfile/docs/reference.md @@ -883,6 +883,15 @@ performance. Your build should work with any contents of the cache directory as another build may overwrite the files or GC may clean it if more storage space is needed. +> [!NOTE] +> Cache mounts are stored in the builder's local storage. They are not +> included in [exported build cache](https://docs.docker.com/build/cache/backends/) +> (`--cache-to`), and are not restored by `--cache-from`. If each build runs +> on a new builder (e.g. on CI runners that provision a fresh machine +> for each job), cache mounts start empty on every build. For a workaround on +> GitHub Actions, see +> [Cache mounts](https://docs.docker.com/build/ci/github-actions/cache/#cache-mounts). + #### Example: cache Go packages ```dockerfile @@ -1904,11 +1913,16 @@ Sets ownership of copied files. Without this flag, files are created with UID and GID of 0. The flag accepts usernames, group names, UIDs, or GIDs in any combination. -If you specify only a user, the GID is set to the same numeric value as the UID. +If you omit the group, either as `--chown=` or `--chown=:`, a +username uses the primary GID from its `/etc/passwd` entry. A numeric UID uses +the same numeric value for the GID, without looking up `/etc/passwd`. For example, +`--chown=1000:` sets both the UID and GID to 1000, even if that user's primary +GID in `/etc/passwd` is different. ```dockerfile COPY --chown=55:mygroup files* /somedir/ COPY --chown=bin files* /somedir/ +COPY --chown=bin: files* /somedir/ COPY --chown=1 files* /somedir/ COPY --chown=10:11 files* /somedir/ COPY --chown=myuser:mygroup --chmod=644 files* /somedir/ @@ -1917,7 +1931,9 @@ COPY --chown=myuser:mygroup --chmod=644 files* /somedir/ When using names instead of numeric IDs, BuildKit resolves them using `/etc/passwd` and `/etc/group` in the container's root filesystem. If these files are missing or don't contain the specified names, the build fails. -Numeric IDs don't require this lookup. +Numeric IDs don't require this lookup. When combined with +[`--link`](#copy---link), files are copied into an empty filesystem, so names +can't be resolved and `--chown` must use numeric IDs. The `--chown` flag is not supported when building Windows containers. diff --git a/_vendor/modules.txt b/_vendor/modules.txt index 8aee7a79e4..69dd0a21fd 100644 --- a/_vendor/modules.txt +++ b/_vendor/modules.txt @@ -1,6 +1,6 @@ # github.com/moby/moby/api v1.56.1 -# github.com/moby/buildkit v0.33.1 -# github.com/docker/buildx v0.37.2 +# github.com/moby/buildkit v0.34.0 +# github.com/docker/buildx v0.38.0 # github.com/docker/cli v29.8.2+incompatible # github.com/docker/compose/v5 v5.6.0 # github.com/docker/model-runner v1.1.36 diff --git a/data/cli/buildx/docker_buildx.yaml b/data/cli/buildx/docker_buildx.yaml index abdde0bd45..9a0edb79d3 100644 --- a/data/cli/buildx/docker_buildx.yaml +++ b/data/cli/buildx/docker_buildx.yaml @@ -18,6 +18,7 @@ cname: - docker buildx ls - docker buildx policy - docker buildx prune + - docker buildx replay - docker buildx rm - docker buildx stop - docker buildx use @@ -36,6 +37,7 @@ clink: - docker_buildx_ls.yaml - docker_buildx_policy.yaml - docker_buildx_prune.yaml + - docker_buildx_replay.yaml - docker_buildx_rm.yaml - docker_buildx_stop.yaml - docker_buildx_use.yaml diff --git a/data/cli/buildx/docker_buildx_bake.yaml b/data/cli/buildx/docker_buildx_bake.yaml index 8ff6ec6a5a..9cbbe2d43f 100644 --- a/data/cli/buildx/docker_buildx_bake.yaml +++ b/data/cli/buildx/docker_buildx_bake.yaml @@ -7,11 +7,6 @@ long: |- Read [High-level build options with Bake](/build/bake/) guide for introduction to writing bake files. - - > [!NOTE] - > `buildx bake` command may receive backwards incompatible features in the future - > if needed. We are looking for feedback on improving the command and extending - > the functionality further. usage: docker buildx bake [OPTIONS] [TARGET...] pname: docker buildx plink: docker_buildx.yaml @@ -60,6 +55,18 @@ options: experimentalcli: false kubernetes: false swarm: false + - option: jobs + shorthand: j + value_type: string + default_value: fail-fast + description: 'Set target execution behavior (format: `N` or `mode[,parallel=N]`)' + details_url: '#jobs' + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false - option: list value_type: string description: List targets or variables @@ -331,6 +338,66 @@ examples: |- Same as [`build --check`](/reference/cli/docker/buildx/build/#check). + ### Configure target execution behavior (--jobs, -j) {#jobs} + + ```text + --jobs=N + --jobs=[mode,]parallel=N + --jobs=mode + ``` + + The `--jobs` flag (shorthand `-j`) controls target concurrency, output + synchronization, and how Bake handles target failures. It accepts an integer + as shorthand for `parallel=N`, or comma-separated mode and parallel options. + For example, `-j=2` is equivalent to `--jobs=parallel=2`, and + `--jobs=defer-error,parallel=2` combines a mode with a concurrency limit. + The mode can also be written as `mode=defer-error`. + + The default mode is `fail-fast`, which stops the build when a target + fails and cancels targets that are still running. Outputs already written by + successful targets are not removed. + + The `defer-output` mode waits until all participating targets have successfully + evaluated their build results before any target begins exporting output. This is + useful when multiple targets produce related artifacts and you want to withhold + their outputs if a build fails. Exports are not transactional: an export failure + can still leave partial output, and completed exports are not rolled back. + + For multi-node targets, `defer-output` applies to the BuildKit solve and export + boundary for each target. Any manifest list merge or registry push that Buildx + performs after the per-node solves complete is not part of this synchronization + barrier. + + The `defer-error` mode allows independent targets to keep running after another + target fails. Bake still returns an error after all possible targets complete, + but successful targets can finish and write their outputs. Targets that depend + on a failed target cannot complete successfully. When `--metadata-file` is set, + Bake writes metadata for successful targets even if another target fails. + + ```console + $ docker buildx bake --jobs=defer-output # wait for all build results before exporting + $ docker buildx bake --jobs=defer-error # let independent targets finish before returning an error + ``` + + The `parallel` option limits how many Bake targets run at the same time. It + requires a non-negative integer. When omitted or set to `0`, Bake doesn't apply + a target concurrency limit. This controls target scheduling, not BuildKit's + internal parallelism for build steps within a target. Specify the mode and limit + in the same flag value; repeating `--jobs` replaces the previous value. + + ```console + $ docker buildx bake -j=2 # run at most two targets at the same time + $ docker buildx bake --jobs=parallel=1 # run targets sequentially + $ docker buildx bake --jobs=defer-error,parallel=2 # limit concurrency and let independent targets finish after a failure + ``` + + With `defer-output`, every participating target must be able to reach the output + boundary before any target completes. A nonzero jobs limit smaller than the + number of participating targets is therefore rejected. The same restriction + applies when linked targets are present, because their solves may need to be + active together. The count includes implicit targets referenced through + `target:` contexts. + ### Specify a build definition file (-f, --file) {#file} Use the `-f` / `--file` option to specify the build definition file to use. @@ -622,80 +689,114 @@ examples: |- is defined in https://golang.org/pkg/path/#Match. ```console - $ docker buildx bake --set target.args.mybuildarg=value + $ docker buildx bake --set target.arg.mybuildarg=value $ docker buildx bake --set target.platform=linux/arm64 - $ docker buildx bake --set foo*.args.mybuildarg=value # overrides build arg for all targets starting with 'foo' - $ docker buildx bake --set *.platform=linux/arm64 # overrides platform for all targets + $ docker buildx bake --set foo*.arg.mybuildarg=value # overrides build arg for all targets starting with 'foo' + $ docker buildx bake --set *.platform=linux/arm64 # overrides platforms for all targets $ docker buildx bake --set foo*.no-cache # bypass caching only for targets starting with 'foo' $ docker buildx bake --set target.platform+=linux/arm64 # appends 'linux/arm64' to the platform list $ docker buildx bake --set target.contexts.bar=../bar # overrides 'bar' named context - $ docker buildx bake --set target.resources.memory=2g # overrides memory resource limit + $ docker buildx bake --set target.resource.memory=2g # overrides memory resource limit $ docker buildx bake --set target.secret.aws=env=AWS # overrides source for an existing secret + $ docker buildx bake --set target.tag= # clears all tag values ``` > [!NOTE] > - > `--set` is a repeatable flag. For array fields such as `tags`, repeat `--set` + > `--set` is a repeatable flag. For array fields such as `tag`, repeat `--set` > to provide multiple values or use the `+=` operator to append without - > replacing. Array literal syntax like `--set target.tags=[a,b]` is not - > supported. + > replacing. Array literal syntax like `--set target.tag=[a,b]` is not + > supported. For array fields, a non-append assignment with an empty value + > clears values from the Bake definition and earlier `--set` flags. Subsequent + > assignments or appends add values to the cleared array. You can override the following fields: - * `annotations` + * `annotation` * `attest` - * `args` + * `arg.` * `cache-from` * `cache-to` * `call` * `context` - * `contexts` + * `contexts.` * `dockerfile` - * `entitlements` - * `extra-hosts` - * `labels` + * `entitlement` + * `extra-host.` + * `label.` * `load` * `no-cache` * `no-cache-filter` + * `network` * `output` * `platform` + * `policy` * `pull` * `push` - * `resources` + * `resource.` + * `secret` * `secret.` - * `secrets` + * `shm-size` * `ssh` - * `tags` + * `tag` * `target` + * `ulimit` You can append using `+=` operator for the following fields: - * `annotations`¹ + * `annotation`¹ * `attest`¹ * `cache-from` * `cache-to` - * `entitlements`¹ + * `entitlement`¹ * `no-cache-filter` * `output` * `platform` - * `secrets` + * `policy` + * `secret` * `ssh` - * `tags` + * `tag` + * `ulimit` > [!NOTE] > ¹ These fields already append by default. + Override keys use singular names. Existing plural Bake field names and + historical `--set` spellings remain supported as aliases: + + | Alias | Canonical key | + |----------------|---------------| + | `annotations` | `annotation` | + | `args` | `arg` | + | `entitlements` | `entitlement` | + | `extra-hosts` | `extra-host` | + | `labels` | `label` | + | `platforms` | `platform` | + | `resources` | `resource` | + | `secrets` | `secret` | + | `tags` | `tag` | + | `ulimits` | `ulimit` | + + Aliases are normalized before overrides are applied, so they can be mixed + with canonical keys in repeated `--set` options. `context` and `contexts` are + not aliases: `context` sets the build context, while `contexts.` sets a + named context. `secret.` also has separate semantics: it changes the + source of a secret that is already declared by the target. The plural alias + does not support this form; `secrets.` is invalid. + #### Inline values for composable attributes - Some fields, such as `ssh`, `secret`, `output`, `cache-to`, `cache-from`, - `attest`, and `annotations`, are composable attributes that accept a list of - object values in a Bake file. When you override these fields with `--set`, you - provide each value using the same inline string syntax as the corresponding - build flag, not the HCL object form. The `--set` override replaces or appends - to the list as a whole; it doesn't address individual sub-fields with a - sub-selector. Only the map-valued fields `args`, `contexts`, `labels`, and - `extra-hosts` support targeting a specific entry with a sub-key (for example - `--set target.args.MYARG=value`). + Composable fields such as `ssh`, `secret`, `output`, `cache-to`, `cache-from`, + `attest`, and `annotation` accept a list of object values in a Bake file. When + you override these fields with `--set`, provide each value using the same + inline string syntax as the corresponding build flag, not the HCL object + form. The override replaces or appends to the list as a whole and does not + address individual object fields with a subkey. + + Only `arg`, `contexts`, `extra-host`, `label`, `resource`, and `secret` support + entry-addressed subkeys. For example, use `--set target.arg.MYARG=value` to + override one build argument. As described above, `secret.` changes the + source of an existing secret rather than an object field. For example, to set the SSH agent socket or key for a target, use the same `id=path` form accepted by [`build --ssh`](/reference/cli/docker/buildx/build/#ssh): diff --git a/data/cli/buildx/docker_buildx_create.yaml b/data/cli/buildx/docker_buildx_create.yaml index e4ce58dcbe..89f59615ec 100644 --- a/data/cli/buildx/docker_buildx_create.yaml +++ b/data/cli/buildx/docker_buildx_create.yaml @@ -300,6 +300,9 @@ examples: |- Uses Kubernetes pods. With this driver, you can spin up pods with defined BuildKit container image to build your images. + Rootless mode (`--driver-opt rootless=true`) requires Kubernetes v1.30 or later + with support for `securityContext.appArmorProfile`, which is stable in v1.31. + Unlike `docker` driver, built images will not automatically appear in `docker images` and [`build --load`](/reference/cli/docker/buildx/build/#load) needs to be used to achieve that. diff --git a/data/cli/buildx/docker_buildx_replay.yaml b/data/cli/buildx/docker_buildx_replay.yaml new file mode 100644 index 0000000000..e111cacb73 --- /dev/null +++ b/data/cli/buildx/docker_buildx_replay.yaml @@ -0,0 +1,65 @@ +command: docker buildx replay +short: Replay a build from its provenance +long: |- + `buildx replay` reads the SLSA provenance attestation of an existing build and + reproduces the build with the recorded frontend, options, and source digests. + Replay runs on the selected builder and requires BuildKit v0.27 or later. + + Subjects are accepted in three forms: + + - `docker-image://` or a bare `` — resolve through the registry. + - `oci-layout://[:]` — read from a local OCI layout. + - A local attestation file: an in-toto statement (`.intoto.jsonl`), an + unsigned DSSE envelope, a Sigstore bundle, or a bare SLSA provenance + predicate. + + A build can be replayed when: + + - its provenance was recorded with `mode=max` + (`--provenance=mode=max` or `--attest=type=provenance,mode=max`). `mode=min` + provenance omits the build arguments, secrets, and SSH needed for replay; + - its build context was a Git repository or an HTTP(S) URL. Builds that used + local directories, stdin, OCI layouts, or other Bake targets as build + contexts cannot be replayed; + - it did not use `--network=host`, unless a different `--network` is passed + to replay; + - the recorded sources are still available. + + Replay rebuilds one platform at a time. For a multi-platform image, select the + platform with `--platform`. By default, the only platform of the image or the + default platform of the builder is used. +usage: docker buildx replay +pname: docker buildx +plink: docker_buildx.yaml +cname: + - docker buildx replay build +clink: + - docker_buildx_replay_build.yaml +inherited_options: + - option: builder + value_type: string + description: Override the configured builder instance + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: debug + shorthand: D + value_type: bool + default_value: "false" + description: Enable debug logging + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +deprecated: false +hidden: false +experimental: false +experimentalcli: true +kubernetes: false +swarm: false + diff --git a/data/cli/buildx/docker_buildx_replay_build.yaml b/data/cli/buildx/docker_buildx_replay_build.yaml new file mode 100644 index 0000000000..ca65b86191 --- /dev/null +++ b/data/cli/buildx/docker_buildx_replay_build.yaml @@ -0,0 +1,201 @@ +command: docker buildx replay build +short: Rebuild an image from provenance and pinned materials +long: |- + `replay build` reconstructs an image from the provenance attestation attached + to an existing subject. + + The replay mode controls how sources are resolved: + + - `materials` (default) pins every source to the digest recorded in the + provenance. A source that is not recorded, or whose content changed, fails + the build. + - `frontend` replays the recorded frontend and options, but resolves sources + again, so the result can differ from the original build. + + Replayed builds do not add new provenance or SBOM attestations. Local outputs + with `mode=delete` are not supported. +usage: docker buildx replay build [OPTIONS] SUBJECT +pname: docker buildx replay +plink: docker_buildx_replay.yaml +options: + - option: dry-run + value_type: bool + default_value: "false" + description: Print a plan of the replay without solving or exporting + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: format + value_type: string + default_value: pretty + description: Format dry-run output (`pretty` | `json`) + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: load + value_type: bool + default_value: "false" + description: Shorthand for `--output=type=docker` + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: materials + value_type: stringArray + default_value: '[]' + description: | + Materials store (repeatable; format: `provenance` | `oci-layout://[:]` | `` | `=`) + deprecated: false + hidden: true + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: network + value_type: string + description: | + Network mode for RUN instructions (`default` | `none`; defaults to the mode of the original build) + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: output + shorthand: o + value_type: stringArray + default_value: '[]' + description: 'Output destination (format: `type=local,dest=path`)' + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: platform + value_type: stringArray + default_value: '[]' + description: | + Platform of the subject to replay (defaults to the only platform of the subject or the builder default platform) + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: progress + value_type: string + default_value: auto + description: | + Set type of progress output (`auto` | `plain` | `tty` | `quiet` | `rawjson`) + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: push + value_type: bool + default_value: "false" + description: Shorthand for `--output=type=registry,unpack=false` + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: replay-mode + value_type: string + default_value: materials + description: Replay mode (`materials` | `frontend`) + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: secret + value_type: stringArray + default_value: '[]' + description: | + Secret to expose to the replayed build (format: `id=mysecret[,src=/local/secret]`) + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: ssh + value_type: stringArray + default_value: '[]' + description: | + SSH agent socket or keys to expose (format: `default|[=|[,]]`) + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: tag + shorthand: t + value_type: stringArray + default_value: '[]' + description: 'Image identifier (format: `[registry/]repository[:tag]`)' + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +inherited_options: + - option: builder + value_type: string + description: Override the configured builder instance + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: debug + shorthand: D + value_type: bool + default_value: "false" + description: Enable debug logging + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +examples: |- + ### Replay a registry image and export to an OCI tar + + ```console + docker buildx replay build docker-image://example.com/app@sha256:deadbeef \ + --output=type=oci,dest=replay.oci.tar + ``` + + ### Dry-run a replay to inspect the plan + + ```console + docker buildx replay build docker-image://example.com/app@sha256:deadbeef --dry-run --format=json | jq + ``` + + Dry-run runs the same checks as a real replay, so a subject that cannot be + replayed fails before any build starts. +deprecated: false +hidden: false +experimental: false +experimentalcli: true +kubernetes: false +swarm: false + diff --git a/data/cli/buildx/docker_buildx_replay_snapshot.yaml b/data/cli/buildx/docker_buildx_replay_snapshot.yaml new file mode 100644 index 0000000000..f2fd2d6900 --- /dev/null +++ b/data/cli/buildx/docker_buildx_replay_snapshot.yaml @@ -0,0 +1,132 @@ +command: docker buildx replay snapshot +short: Export replay inputs for a subject as a reusable materials store +long: Export replay inputs for a subject as a reusable materials store +usage: docker buildx replay snapshot [OPTIONS] SUBJECT +pname: docker buildx replay +plink: docker_buildx_replay.yaml +options: + - option: dry-run + value_type: bool + default_value: "false" + description: Print a JSON plan of the snapshot without writing output + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: include-materials + value_type: bool + default_value: "true" + description: Include material content in the snapshot + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: materials + value_type: stringArray + default_value: '[]' + description: | + Materials store (repeatable; format: `provenance` | `oci-layout://[:]` | `` | `=`) + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: network + value_type: string + description: | + Network mode for RUN instructions (`default` | `none`; defaults to the mode of the original build) + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: output + shorthand: o + value_type: stringArray + default_value: '[]' + description: | + Output destination (default: `-` — oci tar to stdout; bare `` writes an oci-layout directory; `type=oci,dest=X[,tar=true|false]`) + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: platform + value_type: stringArray + default_value: '[]' + description: | + Platform of the subject to replay (defaults to the only platform of the subject or the builder default platform) + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: progress + value_type: string + default_value: auto + description: | + Set type of progress output (`auto` | `plain` | `tty` | `quiet` | `rawjson`) + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: secret + value_type: stringArray + default_value: '[]' + description: | + Secret to expose to the replayed build (format: `id=mysecret[,src=/local/secret]`) + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: ssh + value_type: stringArray + default_value: '[]' + description: | + SSH agent socket or keys to expose (format: `default|[=|[,]]`) + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +inherited_options: + - option: builder + value_type: string + description: Override the configured builder instance + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: debug + shorthand: D + value_type: bool + default_value: "false" + description: Enable debug logging + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +deprecated: false +hidden: true +experimental: false +experimentalcli: true +kubernetes: false +swarm: false + diff --git a/data/cli/buildx/docker_buildx_replay_verify.yaml b/data/cli/buildx/docker_buildx_replay_verify.yaml new file mode 100644 index 0000000000..94de7b5587 --- /dev/null +++ b/data/cli/buildx/docker_buildx_replay_verify.yaml @@ -0,0 +1,122 @@ +command: docker buildx replay verify +short: Replay a subject and compare the result against the original artifact +long: Replay a subject and compare the result against the original artifact +usage: docker buildx replay verify [OPTIONS] SUBJECT +pname: docker buildx replay +plink: docker_buildx_replay.yaml +options: + - option: compare + value_type: string + default_value: digest + description: Comparison mode (`digest` | `artifact`) + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: materials + value_type: stringArray + default_value: '[]' + description: | + Materials store (repeatable; format: `provenance` | `oci-layout://[:]` | `` | `=`) + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: network + value_type: string + description: | + Network mode for RUN instructions (`default` | `none`; defaults to the mode of the original build) + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: output + shorthand: o + value_type: stringArray + default_value: '[]' + description: | + Output destination for the verification result (VSA) (format: `type=local,dest=path`) + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: platform + value_type: stringArray + default_value: '[]' + description: | + Platform of the subject to replay (defaults to the only platform of the subject or the builder default platform) + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: progress + value_type: string + default_value: auto + description: | + Set type of progress output (`auto` | `plain` | `tty` | `quiet` | `rawjson`) + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: secret + value_type: stringArray + default_value: '[]' + description: | + Secret to expose to the replayed build (format: `id=mysecret[,src=/local/secret]`) + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: ssh + value_type: stringArray + default_value: '[]' + description: | + SSH agent socket or keys to expose (format: `default|[=|[,]]`) + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +inherited_options: + - option: builder + value_type: string + description: Override the configured builder instance + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: debug + shorthand: D + value_type: bool + default_value: "false" + description: Enable debug logging + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +deprecated: false +hidden: true +experimental: false +experimentalcli: true +kubernetes: false +swarm: false + diff --git a/go.mod b/go.mod index da2637f5d3..cb16fcc098 100644 --- a/go.mod +++ b/go.mod @@ -8,12 +8,12 @@ go 1.26.8 // // Make sure to add an entry in the "tools" section when adding a new repository. require ( - github.com/docker/buildx v0.37.2 + github.com/docker/buildx v0.38.0 github.com/docker/cli v29.8.2+incompatible github.com/docker/compose/v5 v5.6.0 github.com/docker/docker-agent v1.126.0 github.com/docker/model-runner v1.1.36 - github.com/moby/buildkit v0.33.1 + github.com/moby/buildkit v0.34.0 github.com/moby/moby/api v1.56.1 ) diff --git a/go.sum b/go.sum index 6bc7b4b580..e4f4a9f654 100644 --- a/go.sum +++ b/go.sum @@ -99,6 +99,8 @@ github.com/docker/buildx v0.37.1 h1:uFwAbgh1znGPz7YCg/tr6dHuR/+OqxAWc1YMxxAO/m4= github.com/docker/buildx v0.37.1/go.mod h1:caF6XsZtJ9OAE22LVRsl2OUz5eL+P0+cS2YrnKhuryA= github.com/docker/buildx v0.37.2 h1:6EYElyvQe7aPnp2yDmCLa4/0jXYs8dAHfWKVO6dsFwA= github.com/docker/buildx v0.37.2/go.mod h1:3CTKuzEyWIMz4TdAutpRjEfNpAp8mhK62ssOuwLWG4w= +github.com/docker/buildx v0.38.0 h1:LKfznm3wgm0hYaQDkiuoK9hyDS1GU/GChnXYsBr3A00= +github.com/docker/buildx v0.38.0/go.mod h1:4lEDxmaYDJ17HtXTND9A53BaDoHCJbk5WUgcmfipN7Q= github.com/docker/cli v29.1.2+incompatible h1:s4QI7drXpIo78OM+CwuthPsO5kCf8cpNsck5PsLVTH8= github.com/docker/cli v29.1.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/cli v29.1.5+incompatible h1:GckbANUt3j+lsnQ6eCcQd70mNSOismSHWt8vk2AX8ao= @@ -319,6 +321,8 @@ github.com/moby/buildkit v0.33.0 h1:zBbt1FiMcTB/oFg1iCNcKa83k5Rn8MGcVjXFIcfYhuQ= github.com/moby/buildkit v0.33.0/go.mod h1:uNKSZnfMk1aSa18JiCR5BT68M/3jIDGo6XuAByUK3ek= github.com/moby/buildkit v0.33.1 h1:UUrdifmRdRadykO+f5l8BT1CseUXst2sJHV7AmkjjxE= github.com/moby/buildkit v0.33.1/go.mod h1:584wW8T/WG4O+lpXUCoDaWEc5e+rTGC3iP+l9mNcX8E= +github.com/moby/buildkit v0.34.0 h1:bG5h2y1s5IVvc/uSGo6hVlYbd2eXVFRuADl9Zf+jeJM= +github.com/moby/buildkit v0.34.0/go.mod h1:e+Za70y2a3nL1U2Y0P8TvhPyKp2Ok2NS+Q4siSArDiM= github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0= github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo= github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg= @@ -383,11 +387,13 @@ github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE= +github.com/prometheus/client_model v0.6.3 h1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo= github.com/prometheus/common v0.67.1 h1:OTSON1P4DNxzTg4hmKCc37o4ZAZDv0cfXLkOt0oEowI= github.com/prometheus/common v0.67.1/go.mod h1:RpmT9v35q2Y+lsieQsdOh5sXZ6ajUGC8NjZAmr8vb0Q= github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4= github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw= github.com/prometheus/common v0.70.1 h1:1HvjP4D5oL3t8RsPlwxA9onvvStjtIHYE5XuuwOi/PY= +github.com/prometheus/common v0.71.0 h1:9KDAKb7Mj3HEVKyFCK6Dc/HIwlBzZIN2l7/lrHl3KK8= github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg= github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is= github.com/prometheus/procfs v0.17.0 h1:FuLQ+05u4ZI+SS/w9+BWEM2TXiHKsUQ9TADiRH7DuK0= @@ -536,6 +542,7 @@ golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8= golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o= golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= +golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=