Draft
Conversation
use local context and disable image push if not upstream repo
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Since the change to replace uses of context.WithCancel with WithCancelCause, we've also begun wrapping all cancellations using errors.WithStack. This means that these would not directly match context.Canceled, so we need to make sure to use errors.Is. Signed-off-by: Justin Chadwell <me@jedevc.com>
Signed-off-by: Justin Chadwell <me@jedevc.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
A cache ID should not have any impact on whether or not a step should be re-run any more than the content of that cache does (or rather, doesn't). Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Signed-off-by: Justin Chadwell <me@jedevc.com>
Signed-off-by: Justin Chadwell <me@jedevc.com>
Signed-off-by: Justin Chadwell <me@jedevc.com>
Signed-off-by: Justin Chadwell <me@jedevc.com>
Signed-off-by: Justin Chadwell <me@jedevc.com>
chore: remove noisy rootlesskit cni log
docs: tiny improvements
solver: use errors.Is when checking context.Cause()
oci: fix error handling on submount calls
- pkg/system: return even richer xattr errors full diff: moby/moby@v25.0.0...v25.0.1 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
No changes in vendored code full diff: docker/cli@v25.0.0...v25.0.1 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
vendor: update docker/docker and docker/cli to v25.0.1
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
The solver has a Close method to shutdown the scheduler, which releases a goroutine. We should call it on shutdown. While in the area, we can also close the sysSampler. Signed-off-by: Justin Chadwell <me@jedevc.com>
chore: close solver resources on shutdown
…hemap Do not include a cache mount's ID in the ExecOp's cachemap
chore: start to improve cachechains readability
Signed-off-by: Leandro Santiago <leandrosansilva@gmail.com>
Signed-off-by: Leandro Santiago <leandrosansilva@gmail.com>
It will need to be removed in a follow up PR. Signed-off-by: Leandro Santiago <leandrosansilva@gmail.com>
fix lease management with flightcontrol
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
docs: typo in windows.md
…factor docs: restructure descriptions for add, copy, run flags
Default changed in Moby25 archive package. Setting this bool restores the previous behavior. Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
file: use best-effort xattr behavior on unpacking
file: fix idmap passed to unpack when userns enabled
On some systems this causes permission error if userns enabled. Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
vendor: update github.com/Masterminds/semver to v3.2.1
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
test: switch to golang.org/x/mod to check containerd version constraint
move network sample to resources types
gateway: mount metadata with nodev
Instead of ignoring the flag and copying wrong files the build should error if labs is not enabled. Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
dockerfile: don't silently ignore --parents if not labs
Signed-off-by: yzewei <yangzewei@loongson.cn> (cherry picked from commit 736c35ad3561f709876bfcb52e2644f71b05c805)
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com> (cherry picked from commit 0356194de0e1a32082c08519e23ae7b6b6e0ea0e)
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com> (cherry picked from commit 9944a5c47598dda0fc293920d693a1adb7b29cc7)
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com> (cherry picked from commit c35d98cef913769483043b465d6b42b5ab1198c2)
This replicates similar functionality in rsync. Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com> (cherry picked from commit 6f8bd4cb0e7ccf773d692beb9bc89032099881b2)
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com> (cherry picked from commit d1446a4748e692c99a388a2372cd1b7e79f760b5)
This adds `ContainerAdministrator` as the default user to guarantee a uniform experience on all the platforms. The previous guide would fail on WS2022 but work on WS2019 and Windows 11. The issue is being investigated here #4731 Signed-off-by: Anthony Nandaa <profnandaa@gmail.com> (cherry picked from commit 2aa80d749c9c6e750b4a6e66df38e0fc8443183b)
[v0.13] cherry-picks for v0.13.0
|
| Branch | Total Count |
|---|---|
| main | 217 |
| This PR | 219 |
| Difference | +2 (0.92%) |
📁 Changes by file type:
| File Type | Change |
|---|---|
| Go files (.go) | ❌ +2 |
| Documentation (.md) | ➖ No change |
| Earthfiles | ➖ No change |
Keep up the great work migrating from Earthly to Earthbuild! 🚀
💡 Tips for finding more occurrences
Run locally to see detailed breakdown:
./.github/scripts/count-earthly.shNote that the goal is not to reach 0.
There is anticipated to be at least some occurences of earthly in the source code due to backwards compatibility with config files and language constructs.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+27
to
+69
| runs-on: ubuntu-22.04 | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| os: | ||
| # - ubuntu-22.04 | ||
| # - macOS-11 | ||
| - windows-2022 | ||
| platform: | ||
| - windows/amd64 | ||
| - freebsd/amd64 | ||
| steps: | ||
| - | ||
| name: Prepare | ||
| run: | | ||
| platform=${{ matrix.platform }} | ||
| echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV | ||
| - | ||
| name: Checkout | ||
| uses: actions/checkout@v4 | ||
| - | ||
| name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
| - | ||
| name: Build | ||
| uses: docker/bake-action@v4 | ||
| with: | ||
| provenance: false | ||
| targets: binaries-for-test | ||
| set: | | ||
| *.platform=${{ matrix.platform }} | ||
| *.cache-from=type=gha,scope=binaries-for-test-${{ env.PLATFORM_PAIR }} | ||
| *.cache-to=type=gha,scope=binaries-for-test-${{ env.PLATFORM_PAIR }} | ||
| - | ||
| name: List artifacts | ||
| run: | | ||
| tree -nh ${{ env.DESTDIR }} | ||
| - | ||
| name: Upload artifacts | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: buildkit-${{ env.PLATFORM_PAIR }} | ||
| path: ${{ env.DESTDIR }}/* | ||
| if-no-files-found: error | ||
| retention-days: 1 | ||
|
|
||
| test-windows-amd64: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium test
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 13 days ago
In general, to fix this problem you add a permissions section either at the top (workflow-wide) or per job, granting only the scopes actually needed. For a typical CI workflow that just reads code, builds, tests, and uploads artifacts, a minimal safe starting point is contents: read. Additional scopes (like id-token: write or packages: read) are only added if clearly necessary.
For this specific workflow (.github/workflows/test-os.yml), nothing in the shown snippet writes to the repository or manipulates issues/PRs; it only checks out code, uses Docker/buildx, runs tests on different OSes, and uploads artifacts. Those operations work with the default GITHUB_TOKEN plus contents: read. Therefore, the best fix without altering behavior is to define a workflow-level permissions block directly under the name field, setting contents: read. This applies to all jobs (build, test-windows-amd64, test-freebsd-amd64, etc.) that don’t define their own permissions and satisfies CodeQL’s recommendation.
Concretely: in .github/workflows/test-os.yml, insert
permissions:
contents: readbetween lines 1 and 3 (after name: test-os and before concurrency:). No additional imports or external definitions are required.
Suggested changeset
1
.github/workflows/test-os.yml
| @@ -1,5 +1,8 @@ | ||
| name: test-os | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.ref }} | ||
| cancel-in-progress: true |
Copilot is powered by AI and may make mistakes. Always verify output.
Comment on lines
+65
to
+89
| runs-on: ubuntu-22.04 | ||
| # TODO: enable when binutils-loongarch64-linux-gnu pkg is available for aarch64 arch | ||
| # https://github.com/moby/buildkit/pull/4392#issuecomment-1938223235 | ||
| if: false | ||
| steps: | ||
| - | ||
| name: Checkout | ||
| uses: actions/checkout@v4 | ||
| - | ||
| name: Set up QEMU | ||
| uses: docker/setup-qemu-action@v3 | ||
| - | ||
| name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
| with: | ||
| version: ${{ env.SETUP_BUILDX_VERSION }} | ||
| driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }} | ||
| buildkitd-flags: --debug | ||
| - | ||
| name: Validate | ||
| uses: docker/bake-action@v4 | ||
| with: | ||
| targets: validate-archutil | ||
| set: | | ||
| *.platform=linux/arm64 |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 13 days ago
In general, to fix this issue you add an explicit permissions block either at the root of the workflow (so it applies to all jobs that don’t override it) or on the specific job flagged. The block should grant only the minimal scopes required, typically contents: read for build/CI jobs that just check out code and run tools.
For this workflow, the safest and simplest fix that preserves existing behavior is to add a top-level permissions block with contents: read. All shown jobs only need to read the repository (for actions/checkout) and then run Docker-related actions; none of them appears to need to write to the repository or other GitHub resources. Adding this block right after the name: validate line (and before concurrency:) makes it clear and keeps the structure clean. No additional imports or code constructs are necessary; this is purely a YAML configuration change.
Concretely:
-
Edit
.github/workflows/validate.yml. -
Insert:
permissions: contents: read
directly under the workflow
name:key. -
Leave the rest of the jobs unchanged; they will now inherit this least-privilege permission set automatically.
Suggested changeset
1
.github/workflows/validate.yml
| @@ -1,5 +1,8 @@ | ||
| name: validate | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.ref }} | ||
| cancel-in-progress: true |
Copilot is powered by AI and may make mistakes. Always verify output.
| if err != nil { | ||
| return 0 | ||
| } | ||
| return int(id) |
Check failure
Code scanning / CodeQL
Incorrect conversion between integer types High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 13 days ago
In general, when parsing integers from strings, you should either parse them directly to the exact target type/bit‑size or enforce explicit upper/lower bounds before converting to a smaller type. Here, we parse with bit size 64 and then convert to int; on 32‑bit systems this can truncate. The safest fix is to constrain the parsed value to the range of int before conversion, using constants from the math package.
Concretely, in session/filesync/filesync.go, in fsSyncAttachable.chooser, after strconv.ParseInt(values[0], 10, 64) succeeds, add a range check that ensures id lies between math.MinInt and math.MaxInt. If it does not, treat it as invalid metadata and return 0 (the same sentinel used when parsing fails or metadata is missing). This preserves existing semantics for all valid, in‑range IDs while preventing truncation on 32‑bit builds. To implement this, we need to import "math" at the top of the file and add the conditional before return int(id).
Suggested changeset
1
session/filesync/filesync.go
| @@ -9,6 +9,7 @@ | ||
| "strconv" | ||
| "strings" | ||
| "unicode" | ||
| "math" | ||
|
|
||
| "github.com/moby/buildkit/session" | ||
| "github.com/moby/buildkit/util/bklog" | ||
| @@ -328,6 +329,9 @@ | ||
| if err != nil { | ||
| return 0 | ||
| } | ||
| if id < int64(math.MinInt) || id > int64(math.MaxInt) { | ||
| return 0 | ||
| } | ||
| return int(id) | ||
| } | ||
|
|
Copilot is powered by AI and may make mistakes. Always verify output.
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request integrates version v0.13.0 of moby/buildkit, focusing on enhancing cross-platform compatibility and refining core functionalities. Key efforts included adapting Earthly-specific components to the updated Buildkit APIs, ensuring the persistence of custom Earthly features, and resolving macOS build issues. The changes also introduce support for multiple exporters in a single build, improve context management for cancellations and timeouts, and enhance Dockerfile parsing capabilities. These updates collectively contribute to a more robust and versatile build system, verified for both Linux and macOS environments. Highlights
Changelog
Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request successfully merges version v0.13.0 of the upstream moby/buildkit repository. The changes are substantial and well-integrated, encompassing significant API updates, feature enhancements, and robustness improvements.
Key changes include:
- API Evolution: The move to support multiple exporters by deprecating singular
Exporterfields in favor of a pluralExportersslice is a major and well-handled update, with backward compatibility in mind. - Code Modernization: The adoption of
context.WithCancelCauseandcontext.Causethroughout the codebase aligns with modern Go practices for clearer cancellation semantics. - Robustness: The introduction of lease management for content store resources and safer subpath mounting techniques significantly improves the reliability and safety of the system.
- Features: New features like the
--excludeflag forCOPY/ADDand enhanced shell parameter expansions are valuable additions.
Overall, this is a high-quality merge that brings in a host of improvements and new capabilities. The new documentation and project guides are also a welcome addition for the community.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
19 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
EXPERIMENTAL (GEMINI FLASH 3.0)
Walkthrough: Buildkit v0.13.0 Merge Resolution
Successfully merged
moby/buildkitversionv0.13.0intoEarthBuild/buildkit, resolving all conflicts and restoring cross-platform build compatibility.Key Accomplishments
1. API Alignment for v0.13.0
Aligned Earthly-specific components with the updated core Buildkit APIs:
sourceresolver.Optandcontent.InfoReaderProvider.provenancetypespackage and method signatures.filesynccalls in exporter/earthlyoutputs/export.go to include the new exporter ID requirement.2. Restoration of Earthly-Specific Features
Ensured that critical Earthly additions were not lost during the merge:
ExporterInlineCacheconstant in exporter/containerimage/exptypes/types.go.contentCacheand SockOpt fields in solver/pb/ops.proto.3. macOS Build Compatibility Fixes
Addressed several regressions in v0.13.0 that broke the native Darwin build:
Stat_tfield accessors for Darwin.UTIME_OMITconstant.Verification Results
Build Verification
buildctlandbuildkitd(GOOS=linux).buildctlandbuildkitdafter platform-specific refactoring.Git Merge Status
The merge was finalized using
git merge --continue. All conflicts in source code, protocol buffers, and vendor dependencies have been resolved and committed.[chore-merge-v0.13.0 082581ca4] Merge tag 'v0.13.0' into chore-merge-v0.13.0