A build still running when its job was discarded stored its results
in states that were already released, leaking them. Keep the states
until the last running build returns, and reject new builds on a
discarded job. Release refs of a gateway solve that returns after the
forwarder was discarded.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
newBridgeForwarder created an os.Pipe pair for every forwarder, but
only serveLLBBridgeForwarder uses it. Forwarders created through
NewBridgeForwarder for client-side frontends never used or closed
the pipe, leaving four fds open until GC cleanup.
Create the pipe in serveLLBBridgeForwarder instead.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Cancellation closed the frontend's stdin and stdout pipe ends from
serve() while the executor could still be starting the frontend.
The runc executor passes stdout to exec.Cmd as an *os.File, so a
concurrent close can free the fd number after StartProcess reads it
and before the child dups it, letting an unrelated file take its
place in the child. The stdout case predates the previous commit.
Make conn.Close() close only the gateway-side pipe ends, and close
the frontend ends in Solve once exec.Run has returned.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Repeated gateway solves of a failed exec with several mounts sharing
a base lost the exit error and returned "releasing already released
reference". Since 2b9717c88 the gateways registered and released the
result wrappers of an exec error. Those wrappers are distinct clones
that share a worker ref ID, and the result proxy released them too, so
the second release failed.
Make ExecError the owner of the original handles. The first Release
wins Borrow, and result proxies and gateways retain the *ExecError
instead of its refs. Each gateway keeps one independent clone per
worker ref ID and releases the retained errors and clones on discard.
If the proxy or gateway is already released or discarded, the error is
released immediately. ExecError.Release now returns the release error
instead of dropping it.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Setting BUILDKIT_DISABLE_ONBUILD skips the ONBUILD triggers of all
base images and stages. It can be passed as a build argument or set
as a global ARG in the Dockerfile.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Allow resetting configuration inherited from the base image with
FROM --reset=<field>[,<field>...]. Fields are named after the
instructions that set them: cmd, entrypoint, env, expose,
healthcheck, label, onbuild, shell, stopsignal, user, volume and
workdir. "all" resets all of them. Resetting onbuild skips the
ONBUILD triggers of the base image.
Available in the labs channel (dfreset build tag).
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Allow removing environment variables, labels and volumes,
including ones inherited from the base image. ENV --unset also
removes a build argument with the same name from the stage.
Available in the labs channel (dfunset build tag).
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
ARG and STOPSIGNAL never called flags.Parse(), so unknown flags
were silently ignored. For example `ARG --unset FOO` declared FOO
instead of failing.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Wait for initial frontend data before starting ServeConn so
container startup does not consume the HTTP/2 preface timeout.
Close pipe descriptors on cancellation to unblock the wait.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
When a build has several exporters, runExporters runs them in parallel
and each one calls the same provenance attestation ContentFunc. Every
call finalized the shared ProvenanceCreator predicate (FinishedOn,
Layers, SysUsage, CompatibilityVersion) while another exporter could be
JSON-encoding it, which the race detector reports as a data race.
Add PredicateJSON, which finalizes and encodes the predicate under a
per-creator mutex and returns the encoded bytes, so no caller keeps a
reference to the shared predicate. Make Predicate unexported so all
callers go through the locked path.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
testSSHFileDescriptorsClosed read ssh-agent's stderr buffer while the
agent was still running and os/exec's copy goroutine was writing to
it, which races when the test binary is built with -race. Kill the
agent and Wait for it before reading; Wait guarantees the copy has
finished and the full output is available.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
withResolveCache set g.CacheError on every ResolveImageConfig call.
Base images of different stages are resolved in parallel, so these
writes raced with each other and with CachedGroup.Do reading the field,
which is documented as not safe to change after the first Do call.
Set it once when the wrapper is created.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Keep sending stdin EOF during cleanup so the gateway can finish its Done
handshake, but ignore send failures when the input copy was interrupted by
closing the pipe. Preserve send errors when the input reaches EOF naturally.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Print executed Git commands in build logs to help diagnose source
resolution, fetch, and checkout behavior, including bundle staging.
Enable tracing with BUILDKIT_GIT_DEBUG_COMMANDS=1 or llb.GitDebugCommands().
Redact URL credentials and HTTP extra headers without changing command
execution or snapshot cache keys. Tracing is disabled by default.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Process receivers only observe their caller context and deregistration,
so Start and Wait can hang after the shared ExecProcess receiver exits.
Transport errors cancel the forwarder context without notifying them;
EOF and cancellation leave even that context live.
Cancel the forwarder on every receive error and let process receivers
return its cause. Preserve normal deregistration and Release semantics,
and use the existing output-handler cleanup to unblock pending stdin.
Exercise EOF and three gRPC status errors over a real stream with two
processes starting or waiting, plus successful completion before stream
termination. Check that Release still reports only failures other than
EOF and cancellation.
Signed-off-by: Kamil Monicz <kamil@monicz.dev>
Returning a gateway frontend result serialized the solved references'
LLB definitions again. The Return handler already resolves those
references by ID [1], so a large definition plus result metadata could
exceed the gRPC message limit after Solve succeeded.
Omit definitions from references serialized in Return. Keep them in
Solve responses and client references so Reference.ToState can still
reconstruct their LLB state.
Prepared by Codex on Tamir's behalf.
[1]: https://github.com/moby/buildkit/blob/64aefaef4d7dbb993156a0839958e4342aeb4c51/frontend/gateway/gateway.go#L1102-L1168
Signed-off-by: Tamir Duberstein <tamird@gmail.com>
Build golangci-lint with Staticcheck v0.8.0-rc.1 to handle the Go 1.27
AST. Disable SA4023 because unsupported platform stubs cause false
positives during multiplatform linting.
Apply Go 1.27 formatting and replace the deprecated plain HTTP resolver
option.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
ExecOp returned failed outputs together with ExecError. When the exec was
canceled, sharedOp dropped those outputs without releasing them, leaving
their cache records in use.
Make Op.Exec return nil outputs on error and move failed ExecOp outputs into
ExecError. sharedOp now retains clones of a cached error's refs until the
vertex is released, so builds sharing a failed vertex can still use its
snapshots after another build is discarded.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
A failed stdout or stderr write returns from output handling without
closing done. The stdin cleanup goroutine remains blocked on that
channel, so process Wait cannot finish or return the write error even
after cancellation.
Close done on every return from output handling. Keep the early close on
Exit so stdin can shut down before the server sends Done.
Cover closed stdout and stderr readers with and without stdin, and a
gateway container whose output consumer closes while stdin stays open.
Signed-off-by: Kamil Monicz <kamil@monicz.dev>
messageForwarder.Send holds the process registry mutex while sending on
the gRPC stream. A flow-controlled send can block the receive loop on
that mutex, preventing it from draining process output. Once the output
pipe fills, an echoing process stops reading stdin and the server stops
draining the client's sends.
Give stream sends their own mutex so receiving output can make progress
without allowing concurrent gRPC sends. This follows the server-side
execProcessServerThreadSafe pattern.
Add a blocked-send regression and an OCI integration case that transfers
16 MiB through cat. With the original locking, the integration case times
out with the sender waiting for write quota and the receiver waiting for
the registry mutex.
Signed-off-by: Kamil Monicz <kamil@monicz.dev>
Match two-component builtin versions against the release minor series.
Exclude labs tags from mainline git describe when both tags share a commit.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Bound gateway reference and container reads before allocation. Apply the same
limit when loading nested LLB definitions.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit 03cfacc0c397eb8e5fe46df962df51131f667cb6)
Close process admission before release waits, preventing concurrent starts from
racing errgroup bookkeeping and container cleanup.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit bc934589afa09090bc685644a6e0156d5617670a)
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit 01e2aff8aa3ae0351dea17c0e42c8289659ef40f)
Bound Dockerfile and ignore-file reads to the gateway message size.
Reject oversized files before parsing to avoid unbounded daemon memory use.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit 2508d93d8a2ac621955f0355258f9a4ec79b02b7)
(cherry picked from commit 69d8a4527d8435c50c1bcce92d7e8f0e7851706c)
Guard worker references and teardown state consistently across gateway
forwarders. This prevents concurrent solve and container requests from
triggering unsafe map access.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit 504b528bf29c7108715400b856788753b6eb3f25)
(cherry picked from commit f3cde0c2610d59c8d9575ba5a46bf0ebb5ee7f86)
Tonis Tiigi