dilim/buildkit
1
0
Fork 0
mirror of https://github.com/moby/buildkit.git synced 2026-08-09 09:11:45 +00:00
Code Issues Packages Projects Releases Wiki Activity
9,269 Commits 31 Branches 330 Tags
38f8536ee3fd1cb850efd8ae3f79bbee4e9addbc
Commit Graph

9269 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Tonis Tiigi
38f8536ee3 client: split client integration tests by area 
Move client integration test declarations out of the large harness files into
focused files for cache, exporters, sources, mounts, gateway behavior, and
related client features.

Keep registration lists grouped by source file, move non-gateway tests out of
the gateway harness, and remove the now-empty build_test.go. This is intended
as a mechanical split with no test logic changes.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-07-06 22:19:20 -07:00
Tõnis Tiigi
c130a532e6 Merge pull request #6910 from tonistiigi/platforms-id-sanitize 
exporter: sanitize platform IDs in paths
 2026-07-06 15:27:00 -07:00
Tõnis Tiigi
59eeaf87d3 Merge pull request #6930 from tonistiigi/dockerignore-root-fix 
dockerfile: fix CopyIgnoredFile for context root
 2026-07-06 15:06:19 -07:00
Tõnis Tiigi
8b948e0bcf Merge pull request #6853 from thaJeztah/bump_containerd_runc 
Dockerfile: containerd v2.3.2, runc v1.4.3
 2026-07-06 11:49:03 -07:00
Tonis Tiigi
3c2df0f506 dockerfile: fix CopyIgnoredFile for context root 
Avoid treating COPY . . as copying an ignored file named "." when
.dockerignore excludes dotfiles with patterns such as .*.

Keep the warning for catch-all root patterns like *, where copying the
context root would copy only ignored entries.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-07-06 11:20:03 -07:00
CrazyMax
cf8493e8b7 Merge pull request #6929 from moby/dependabot/github_actions/docker/setup-buildx-action-4.2.0 
build(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0
 2026-07-06 10:34:05 +02:00
CrazyMax
e8008ef124 Merge pull request #6928 from moby/dependabot/github_actions/github/codeql-action/upload-sarif-4.36.3 
build(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.36.3
 2026-07-06 10:33:53 +02:00
CrazyMax
a775a2cd69 Merge pull request #6927 from moby/dependabot/github_actions/docker/login-action-4.4.0 
build(deps): bump docker/login-action from 4.2.0 to 4.4.0
 2026-07-06 10:33:43 +02:00
dependabot[bot]
fe18ebdb90 build(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 4.1.0 to 4.2.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](d7f5e7f509...bb05f3f551)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-06 00:26:00 +00:00
dependabot[bot]
34bfea50e6 build(deps): bump github/codeql-action/upload-sarif 
Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.36.2 to 4.36.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](8aad20d150...54f647b7e1)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.36.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-06 00:25:21 +00:00
dependabot[bot]
826e7fe652 build(deps): bump docker/login-action from 4.2.0 to 4.4.0 
Bumps [docker/login-action](https://github.com/docker/login-action) from 4.2.0 to 4.4.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](650006c6eb...af1e73f918)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-06 00:24:01 +00:00
CrazyMax
ca5552d9fe Merge pull request #6922 from moby/dependabot/github_actions/docker/bake-action/subaction/matrix-7.3.0 
build(deps): bump docker/bake-action/subaction/matrix from 7.2.0 to 7.3.0
 2026-07-03 16:25:12 +02:00
CrazyMax
d8ac204807 Merge pull request #6921 from moby/dependabot/github_actions/docker/setup-qemu-action-4.2.0 
build(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0
 2026-07-03 16:24:50 +02:00
dependabot[bot]
f39e82e962 build(deps): bump docker/bake-action/subaction/matrix 
Bumps [docker/bake-action/subaction/matrix](https://github.com/docker/bake-action) from 7.2.0 to 7.3.0.
- [Release notes](https://github.com/docker/bake-action/releases)
- [Commits](6614cfa25e...d3418bd7d0)

---
updated-dependencies:
- dependency-name: docker/bake-action/subaction/matrix
  dependency-version: 7.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-03 13:51:03 +00:00
dependabot[bot]
39f2f6203f build(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 4.1.0 to 4.2.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](06116385d9...96fe6ef7f3)

---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-03 13:50:36 +00:00
CrazyMax
2197e6aa6b Merge pull request #6923 from moby/dependabot/github_actions/docker/bake-action-7.3.0 
build(deps): bump docker/bake-action from 7.2.0 to 7.3.0
 2026-07-03 15:50:22 +02:00
CrazyMax
42c9b3079b Merge pull request #6920 from moby/dependabot/github_actions/docker/build-push-action-7.3.0 
build(deps): bump docker/build-push-action from 7.2.0 to 7.3.0
 2026-07-03 15:49:34 +02:00
CrazyMax
6608791717 Merge pull request #6925 from crazy-max/fix-vagrant-install 
ci: remove vagrant dependency workaround
 2026-07-03 15:47:17 +02:00
CrazyMax
719caf38b7 ci: remove vagrant dependency workaround 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-07-03 10:54:33 +02:00
Tõnis Tiigi
f60603bc1c Merge pull request #6914 from crazy-max/oci-artifact-attestation-default 
exporter: default attestations to OCI artifacts
 2026-07-02 18:21:33 -07:00
Tõnis Tiigi
4e0085c239 Merge pull request #6804 from ngebremariam-msft/master 
Updated Coverage (provenance,mount,outline,exclude_patterns,and jobs)
 2026-07-02 17:39:58 -07:00
dependabot[bot]
5579588d06 build(deps): bump docker/bake-action from 7.2.0 to 7.3.0 
Bumps [docker/bake-action](https://github.com/docker/bake-action) from 7.2.0 to 7.3.0.
- [Release notes](https://github.com/docker/bake-action/releases)
- [Commits](6614cfa25e...d3418bd7d0)

---
updated-dependencies:
- dependency-name: docker/bake-action
  dependency-version: 7.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-03 00:25:34 +00:00
Tonis Tiigi
77b65abf49 exporter: sanitize platform IDs in paths 
Replace Windows path separators and drive separators when platform IDs are
used as local and tar exporter path components. Add a regression test for tar
exporter output generated from frontend-controlled platform metadata.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-07-02 17:24:55 -07:00
dependabot[bot]
b548d9db91 build(deps): bump docker/build-push-action from 7.2.0 to 7.3.0 
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 7.2.0 to 7.3.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](f9f3042f7e...53b7df96c9)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-version: 7.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-03 00:23:38 +00:00
Tõnis Tiigi
d91ba97ccd Merge pull request #6917 from tonistiigi/solver-readlock 
solver: use read locks for state snapshots
 2026-07-02 11:39:05 -07:00
Tõnis Tiigi
338d30c53d Merge pull request #6916 from tonistiigi/fix-concurrent-map-write 
solver: fix job value iteration race
 2026-07-02 11:38:48 -07:00
Tonis Tiigi
ac7b75553c solver: use read locks for state snapshots 
Change solver state locking to RWMutex and use read locks for read-only
snapshots of jobs, resolver caches, cache managers, and metadata.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-06-30 18:04:41 -07:00
Tonis Tiigi
9866e2ceb3 solver: fix job value iteration race 
Snapshot the state's job set under state.mu before walking job values.
This matches the lock used by job attach and discard paths and avoids
concurrent map iteration when op resolution loads shared job values.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-06-30 17:45:47 -07:00
Tõnis Tiigi
2d85d549c1 Merge pull request #6894 from thaJeztah/bump_moby_user 
vendor: github.com/moby/sys/user v0.4.1
 2026-06-30 17:27:45 -07:00
CrazyMax
9a16a73a42 exporter: default attestations to OCI artifacts 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-06-30 18:35:50 +02:00
Sebastiaan van Stijn
d42880744d Dockerfile: containerd v2.3.2, runc v1.4.3 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-30 16:50:08 +02:00
Tõnis Tiigi
1b593c4e01 Merge pull request #6903 from tonistiigi/file-validation 
fs: reject special files for ref reads
 2026-06-29 16:34:06 -07:00
CrazyMax
bfd776dde3 Merge pull request #6907 from moby/dependabot/github_actions/crazy-max-dot-github-4a02dcc1dd 
build(deps): bump the crazy-max-dot-github group across 1 directory with 2 updates
 2026-06-29 11:33:48 +02:00
dependabot[bot]
d21eb8002b build(deps): bump the crazy-max-dot-github group across 1 directory with 2 updates 
Bumps the crazy-max-dot-github group with 2 updates in the / directory: [crazy-max/.github/.github/workflows/pr-assign-author.yml](https://github.com/crazy-max/.github) and [crazy-max/.github/.github/workflows/zizmor.yml](https://github.com/crazy-max/.github).


Updates `crazy-max/.github/.github/workflows/pr-assign-author.yml` from 1.10.0 to 1.10.1
- [Release notes](https://github.com/crazy-max/.github/releases)
- [Commits](716fd1c51a...46267a6e61)

Updates `crazy-max/.github/.github/workflows/zizmor.yml` from 1.10.0 to 1.10.1
- [Release notes](https://github.com/crazy-max/.github/releases)
- [Commits](716fd1c51a...46267a6e61)

---
updated-dependencies:
- dependency-name: crazy-max/.github/.github/workflows/pr-assign-author.yml
  dependency-version: 1.10.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: crazy-max-dot-github
- dependency-name: crazy-max/.github/.github/workflows/zizmor.yml
  dependency-version: 1.10.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: crazy-max-dot-github
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-29 08:55:36 +00:00
CrazyMax
e6a21b77af Merge pull request #6906 from moby/dependabot/github_actions/actions/cache-6.1.0 
build(deps): bump actions/cache from 5.0.5 to 6.1.0
 2026-06-29 10:54:09 +02:00
CrazyMax
9c621b23b4 Merge pull request #6899 from moby/dependabot/github_actions/actions/setup-go-6.5.0 
build(deps): bump actions/setup-go from 6.4.0 to 6.5.0
 2026-06-29 10:53:39 +02:00
CrazyMax
03052c08fd Merge pull request #6889 from moby/dependabot/github_actions/softprops/action-gh-release-3.0.1 
build(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1
 2026-06-29 10:53:17 +02:00
CrazyMax
67b860f2cc Merge pull request #6873 from moby/dependabot/github_actions/crazy-max/dot-github-1.10.1 
build(deps): bump crazy-max/.github from 1.10.0 to 1.10.1
 2026-06-29 10:52:51 +02:00
dependabot[bot]
549c2e14cd build(deps): bump actions/cache from 5.0.5 to 6.1.0 
Bumps [actions/cache](https://github.com/actions/cache) from 5.0.5 to 6.1.0.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](27d5ce7f10...55cc834586)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-29 00:23:08 +00:00
Tõnis Tiigi
8e99dc1f10 Merge pull request #6891 from AkihiroSuda/fix-6890 
Dockerfile: allow cross-compilation without binfmt helper
 2026-06-26 16:51:20 -07:00
Tõnis Tiigi
587d308bea Merge pull request #6895 from gilescope/giles-fix-sshkeyscan-nonstandard-port 
feat: not fail on non-default ports
 2026-06-26 16:42:33 -07:00
Sebastiaan van Stijn
64dc21e3f7 vendor: github.com/moby/sys/user v0.4.1 
- user: prevent possible DoS via unbounded parsing of user and group
  database files in GHSA-mjcv-p78q-w5fw. This fixes a similar issue
  as CVE-2026-47262 in containerd.
- user: prevent falling back to looking up numeric usernames
  Improve handling of numeric user/group to prevent looking up numeric
  values as usernames. This fixes a similar issue as [CVE-2026-46680] in
  containerd.
- user: update minimum go version to go1.18
- assorted testing and linting fixes.

[CVE-2026-46680]: https://github.com/advisories/GHSA-fqw6-gf59-qr4w

full diff: https://github.com/moby/sys/compare/user/v0.4.0...user/v0.4.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-26 13:31:16 +02:00
Tonis Tiigi
9cdf642943 fs: reject special files for ref reads 
Ref and rootfs helpers may read paths supplied by frontends or build outputs.
Reject non-regular files before reading them into memory so device and FIFO
paths cannot feed no-EOF streams into parsers or bundle injection logic.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-06-26 00:02:39 -07:00
Tõnis Tiigi
c17738edb7 Merge pull request #6897 from tonistiigi/fixes-from-v0.31.1 
forward port fixes from v0.31.1
 2026-06-25 21:33:36 -07:00
dependabot[bot]
2f147a7d3b build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.4.0 to 6.5.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](4a3601121d...924ae3a1cd)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 6.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-25 00:24:08 +00:00
Akihiro Suda
33278a31c2 Dockerfile: allow cross-compilation without binfmt helper 
Fix issue 6890

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2026-06-25 04:21:22 +09:00
Tonis Tiigi
408266e4ba user: limit size of parsed passwd/group files 
Resolving a username to uid/gid read /etc/passwd and /etc/group via
os.Open with no upper bound, letting a crafted image force unbounded
memory use during user resolution. Cap reads at 10MiB and reject
non-regular files in both the OCI executor and the chown user resolver.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit 83cfc1e0ea1dcf8816f259ee6720b8694ab874e5)
 2026-06-24 10:56:53 -07:00
Tonis Tiigi
64bbec89ca security: validate exec security modes 
Reject unknown SecurityMode values before generating executor specs. Ensure
only SecurityMode_INSECURE takes the insecure path, while validated non-insecure
modes keep sandbox security options. Add gateway, raw LLB, and LLB marshal
regression coverage for invalid enum values.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit 972895718f963c71388aeebb7cff423ef6963a92)
 2026-06-24 10:56:46 -07:00
Giles Cope
6678be5be2 feat: not fail on non-default ports 
Signed-off-by: Giles Cope <gilescope@gmail.com>
 2026-06-24 06:30:57 +01:00
Tõnis Tiigi
28fb74fa00 Merge pull request #6874 from thaJeztah/rm_deprecated_otel_envs 
util/tracing: remove fallbacks for OTEL_TRACE_PARENT, OTEL_TRACE_STATE
 2026-06-22 23:57:29 -07:00