This reverts the change from #7012.
Referrer manifests may be pushed before their subject, and the OCI distribution spec requires registries to initially accept a manifest whose subject does not exist yet. Keep BuildKit's default push order aligned with that behavior instead of working around registries that reject this flow.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
OCI artifact attestations carry a subject reference to the image manifest.
Push manifests in an order that keeps child manifests before parent indexes
while also pushing any in-stack subject manifest before the attestation
that references it.
Add an integration test variant with a strict registry proxy to cover
registries that reject manifests whose subject doesn't already exist.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Add a FinalizeExport RPC to pass the combined exporter response back to
the session provider after all exports complete. This lets clients run
completion work while the build's gateway references remain available.
Keep the callback optional for compatibility with existing session
exporters. Ignore unsupported finalization, propagate callback failures,
and support providers that only register a finalization callback.
Signed-off-by: Alberto Garcia Hierro <alberto.hierro@docker.com>
Move client integration test declarations out of the large harness files into
focused files for cache, exporters, sources, mounts, gateway behavior, and
related client features.
Keep registration lists grouped by source file, move non-gateway tests out of
the gateway harness, and remove the now-empty build_test.go. This is intended
as a mechanical split with no test logic changes.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Replace Windows path separators and drive separators when platform IDs are
used as local and tar exporter path components. Add a regression test for tar
exporter output generated from frontend-controlled platform metadata.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Use the worker default provider for proxy UNSET egress so host fallback
is preserved when no CNI config is configured.
Extend proxy integration coverage across default, host, bridge, and
default-no-cni worker network modes.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Keep exec network modes limited to sandbox, host, and none, and pass proxy
network configuration separately through solve and executor runtime state.
Proxy execs now use bridge-style egress by default, host egress only for host
network mode with entitlement, and no proxy for none mode. Add integration
coverage for bridge, host, and none proxy behavior across OCI and containerd
workers.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Apply the oci-mediatypes default at export time so the Docker tar exporter
does not treat variant=docker as implicit oci-mediatypes=false.
Keep Docker tar manifest.json output for legacy compatibility, and preserve
explicit oci-mediatypes=false behavior with test coverage.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add a passthrough LLB op that builds all inputs and exposes selected
inputs as outputs. Add State.Requires as a client shortcut for requiring
dependencies without returning their snapshots.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add a build request option that rewrites default exec networking to an
internal proxy network while preserving explicit none networking.
Route HTTP and HTTPS traffic through a BuildKit-owned proxy namespace, enforce
source policy checks for proxied requests, and inject a temporary CA into Linux
rootfs trust bundles for HTTPS interception.
Share namespace pooling between CNI and proxy providers, and cover proxy mode
with unit and integration tests.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Wait before the second solve so previous local source refs can be released
before the reuse assertion runs.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Allow annotation and attestation exports with OCI media types enabled, fix
the zstd media type map, and update integration tests for the new default.
Keep Docker media types explicit where legacy behavior is under test.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
When support for zstd was introduced, these mediaTypes were not yet
available in released versions of their respective Go packages. That is
no longer the case.
Signed-off-by: Bjorn Neergaard <bjorn.neergaard@docker.com>
Use the resolver-cache ref ID directly when loading a cached HTTP snapshot.
This avoids dereferencing missing metadata for cache entries found during a
concurrent solve.
Reset the unauthorized checksum race request counter per solve iteration so
each retry applies the intended first-request delay.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Clone the existing slow-cache input result when wrapping errors instead of
creating a separate shared owner. This keeps SlowCacheError.Result tied to
the same release chain and avoids releasing the input while the error still
holds it.
Update the containerd cleanup check to ignore empty leases while still
failing on leases that retain resources, and add a deterministic regression.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Avoid storing typed nil HTTP metadata in the resolver cache after failed
metadata resolution. Also make resolver cache release functions consistently
callable when no error is returned.
Add a client integration test covering concurrent same-URL HTTP sources with
and without checksum when the server returns 401.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Update golangci-lint and adjust code for new gosec diagnostics. Use
root-scoped filesystem operations where appropriate, preserve explicit
user path behavior for SSH keys, and avoid background contexts in
request-scoped cleanup paths.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add `reset=true` attribute to the local cache exporter that removes
unreferenced blobs from the cache directory after export, preventing
unbounded growth.
Signed-off-by: Jiří Moravčík <jiri.moravcik@gmail.com>
Support importing git sources from OCI or registry-backed bundle blobs
and exporting resolved checkouts as single-file git bundles.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Bind session RPC contexts to caller lifetime so ongoing RPCs fail when the
session is canceled. Add an integration test that blocks the session tunnel
and verifies the health monitor releases the hung build after timeout.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
ARM64 test compatibility fixes:
- TestRunCacheWithMounts: create marker file (Windows-only) instead of
checking whoami.exe (unavailable in nanoserver ARM64), use forward
slashes for Shlex compat, preserve Linux code path unchanged
- TestDockerfileDirs: use findstr instead of fc /b (unavailable in nanoserver)
- TestExportLocalForcePlatformSplit: normalize platform before comparison
(platforms.Normalize adds v8 variant on ARM64)
Signed-off-by: Dawei Wei <davwei@microsoft.com>
Wrap finalize calls in inBuilderContext with the same vertex
ID used during export, so push status (layers and manifest)
appears under the "exporting to image" vertex in the progress
stream instead of being reported without a parent context.
This broke when pushing was moved to be parallel step after
main export phase.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
