Releases: moby/buildkit
dockerfile/1.1.6-rc1
Notable Changes
-
Dockerfile frontend now allows inputs to be passed from LLB states/results #1361
-
Update LLB client to BuildKit v0.7.0
v0.6.4
Fixes:
v0.6.3
v0.6.2
Fixes:
- ssh: Fix file descriptor leak when doing SSH forwarding #1150
- contenthash: Fix bug with symlink in source path of a copy operation #1140
- fsutil: Handle copying unix sockets in local sources #1144
- llbsolver: Fix using multiple remote cache importers #1156
- http: Handle missing but unambiguous ETags in response #1159
- solver: Fix possible inefficient parallelization in solver #1166
- executor:
oom_score_adjis no longer set from main process #1139
v0.6.1
v0.6.0
Images
https://hub.docker.com/r/moby/buildkit/tags/
-
docker.io/moby/buildkit:v0.6.0
sha256:f1a5fc2c244c2b3b3dda344f6a0c64796b31aa96aa2ab88c951aeeeb66e23318 -
docker.io/moby/buildkit:v0.6.0-rootless
sha256:d70dd5f1fbaa1e729e380b3a31c394a5f79ec0c19c55e6636cf63e97c390a9f0
Notable Changes
-
Custom DNS configuration and use systemd resolver if enabled #1033 #1040
-
Optional CNI networking support #1073
-
Automatic platform runtime support detection for RISC-V, ppc64le and s390x #1038 #1103
-
Clear previous cache mounts on no-cache builds #1092
-
Fix contention bugs between GC releases and cache import #1007 #1013 #1044
-
Updates on how cgroupfs/sysfs are mounted in privileged security mode #1085
-
Validate LLB not generated by golang package #1049
-
Handle canceled local upload state #1023
-
Provide a workaround for invalid registry responses from gcr.io #1024
Contributors
- Tõnis Tiigi
- Tibor Vass
- Akihiro Suda
- Andrey Smirnov
- Stepan Blyshchak
- Dave Chen
- Stefan Schoof
- Christian Höltje
- Colin Chartier
- Nathan Sullivan
- Sebastiaan van Stijn
- Tomohiro Kusumoto
- Lajos Papp
- Mark Gordon
dockerfile/1.1.2-experimental
This release is currently in staging: docker/dockerfile-upstream:1.1.2-experimental
sha256:702620cd58aea03f8c6c9b65c4eb45899677b9eec97042298a46537da20e145a
-
Allow setting security mode for a process with
RUN --security=sandbox|insecure#1081 -
Allow setting uid/gid for cache mounts #1017
-
Avoid requesting internally linked paths to be pulled to build context #1075
-
Ensure missing cache IDs default to target paths #1093
-
Allow setting namespace for cache mounts with
BUILDKIT_CACHE_MOUNT_NSbuild arg #1094
dockerfile/1.1.2
This release is currently in staging: docker/dockerfile-upstream:1.1.2
sha256:a2c4cc8f44b989b8cf71215cc1ccfcbcc0662edb138ddfd3b3943dc820ee3654
v0.5.1
Images
https://hub.docker.com/r/moby/buildkit/tags/
-
docker.io/moby/buildkit:v0.5.1
sha256:d45d15f3b22fcfc1b112ffafc40fd2f2d530245e63cfe346a65bd75acdc4d346 -
docker.io/moby/buildkit:v0.5.1-rootless
sha256:5a826464a96e11d1c1ee97f35460f8421c6bdafd1d8f20bc11b9d698a179ab0b
Notable Changes
Small bug fixes
Contributors
- Tõnis Tiigi
- Akihiro Suda
- Tibor Vass
v0.5.0
Images
https://hub.docker.com/r/moby/buildkit/tags/
-
docker.io/moby/buildkit:v0.5.0
sha256:ead5be62f4675b37f307e3000e5031644801219585020a6362aa71e02cb61027 -
docker.io/moby/buildkit:v0.5.0-rootless
sha256:5fcb511bf1067a5635b45b8269c05319a8a686460d704e554306f34d098cd440
Notable Changes
FileOp
LLB supports new operation FileOp allowing built-in file operations during build like copying files, creating new files or directories and removing files. Previously ADD/COPY commands used a helper image that ran a custom binary inside a container, now these commands use FileOp directly. This allows better performance and use of these commands in air-gapped environments without preloading the helper image, as well as fixing issues reported with the helper image implementation.
Security entitlements
BuildKit now supports modes for granting builds permissions to execute processes with privileged capabilities. Certain options for running processes with LLB will require users to grant a capability before their build can run.
This enables specific builds to run processes that require system capabilities without compromising on the security of the default builds.
Currently two entitlements are supported:
network.host - Runs a specific process in the host network namespace.
security.insecure - Runs a process with all system capabilities enabled and security modules (eg. seccomp) disabled. Similar to docker run --privileged.
The entitlements need to be enabled both in the daemon configuration file and passed with a build request using --allow to take effect.
New connection helpers for buildctl
Buildctl now has support for connecting to BuildKit daemon running in a Docker container or Kubernetes pod by using docker-container://<name> or kube-pod://<name> as BUILDKIT_HOST value.
Tar exporter
Build output can now be exported to the client as a tarball. Similar to the local exporter but allows preserving the file owner values.
buildctl build -o type=tar,dest=foo.tar ...
buildctl build -o type=tar ... > foo.tar
New progress output formatting
Progress output has been improved. The TTY output now shows the last logs for currently running processes directly in the interactive output. Plain progress has been also updated for better readability.
Contributors
- Tõnis Tiigi
- Akihiro Suda
- Tibor Vass
- Kunal Kushwaha
- Dave Chen
- Sebastiaan van Stijn
- Hao Hu
- Himanshu Pandey
- Hiromu Nakamura
- Michael Crosby
- Tomohiro Kusumoto
- Wei Fu
- Ziv Tsarfati