From 8021219e4051d7ac8d425335bfedc351df45897d Mon Sep 17 00:00:00 2001 From: CrazyMax <1951866+crazy-max@users.noreply.github.com> Date: Wed, 19 Aug 2026 12:39:15 +0200 Subject: [PATCH] BuildKit proxy network opt-in Add a buildkit-proxy-network input to the build and bake reusable workflows and pass it into the BuildKit daemon config. Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com> --- .github/workflows/.test-bake.yml | 10 ++++++++++ .github/workflows/.test-build.yml | 9 +++++++++ .github/workflows/bake.yml | 17 +++++++++++++++++ .github/workflows/build.yml | 17 +++++++++++++++++ README.md | 2 ++ test/docker-bake.hcl | 4 ++++ test/proxy-network.Dockerfile | 3 +++ 7 files changed, 62 insertions(+) create mode 100644 test/proxy-network.Dockerfile diff --git a/.github/workflows/.test-bake.yml b/.github/workflows/.test-bake.yml index d4aff1fc..78cbdac7 100644 --- a/.github/workflows/.test-bake.yml +++ b/.github/workflows/.test-bake.yml @@ -85,6 +85,16 @@ jobs: const builderOutputs = JSON.parse(core.getInput('builder-outputs')); core.info(JSON.stringify(builderOutputs, null, 2)); + bake-proxy-network: + uses: ./.github/workflows/bake.yml + permissions: + contents: read + with: + context: test + output: local + target: proxy-network + buildkit-proxy-network: true + bake-ecr-public: uses: ./.github/workflows/bake.yml if: ${{ github.event_name != 'pull_request' }} diff --git a/.github/workflows/.test-build.yml b/.github/workflows/.test-build.yml index 75b395e1..e803d615 100644 --- a/.github/workflows/.test-build.yml +++ b/.github/workflows/.test-build.yml @@ -84,6 +84,15 @@ jobs: const builderOutputs = JSON.parse(core.getInput('builder-outputs')); core.info(JSON.stringify(builderOutputs, null, 2)); + build-proxy-network: + uses: ./.github/workflows/build.yml + permissions: + contents: read + with: + file: test/proxy-network.Dockerfile + output: local + buildkit-proxy-network: true + build-ecr-public: uses: ./.github/workflows/build.yml if: ${{ github.event_name != 'pull_request' }} diff --git a/.github/workflows/bake.yml b/.github/workflows/bake.yml index fc82d851..58a2269b 100644 --- a/.github/workflows/bake.yml +++ b/.github/workflows/bake.yml @@ -139,6 +139,12 @@ on: type: string description: "Bake target name for metadata (defaults to docker-metadata-action)" required: false + # buildkit config + buildkit-proxy-network: + type: boolean + description: "Enable BuildKit proxy network mode" + required: false + default: false secrets: registry-auths: description: "Raw authentication to registries, defined as YAML objects (for image output)" @@ -210,6 +216,7 @@ jobs: sign: ${{ steps.set.outputs.sign }} privateRepo: ${{ steps.set.outputs.privateRepo }} ghaCacheSign: ${{ steps.set.outputs.ghaCacheSign }} + proxyNetwork: ${{ steps.set.outputs.proxyNetwork }} steps: - name: Install dependencies @@ -315,6 +322,7 @@ jobs: INPUT_TARGET: ${{ inputs.target }} INPUT_VARS: ${{ inputs.vars }} INPUT_GITHUB-TOKEN: ${{ secrets.github-token || github.token }} + INPUT_BUILDKIT-PROXY-NETWORK: ${{ inputs.buildkit-proxy-network }} with: script: | const os = require('os'); @@ -342,6 +350,7 @@ jobs: const inpSign = core.getInput('sign'); const inpTarget = core.getInput('target'); const inpGitHubToken = core.getInput('github-token'); + const inpProxyNetwork = core.getBooleanInput('buildkit-proxy-network'); const parseRunnerConfig = value => { const lines = value.map(line => line.trim()).filter(line => line.length > 0); @@ -564,6 +573,12 @@ jobs: core.info(`privateRepo: ${privateRepo}`); core.setOutput('privateRepo', privateRepo); }); + + await core.group(`Set proxyNetwork output`, async () => { + const proxyNetwork = inpProxyNetwork ? 'true' : 'false'; + core.info(`proxyNetwork: ${proxyNetwork}`); + core.setOutput('proxyNetwork', proxyNetwork); + }); await core.group(`Set includes output`, async () => { const withJobNamePrefix = include => { @@ -719,6 +734,8 @@ jobs: env.ACTIONS_ID_TOKEN_REQUEST_TOKEN=${{ steps.github-runtime.outputs.actions-id-token-request-token }} env.ACTIONS_ID_TOKEN_REQUEST_URL=${{ steps.github-runtime.outputs.actions-id-token-request-url }} buildkitd-config-inline: | + proxyNetwork = ${{ needs.prepare.outputs.proxyNetwork }} + [cache] [cache.gha] [cache.gha.sign] diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 5e5ce885..1a4fd81b 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -150,6 +150,12 @@ on: type: string description: "Flavor defines a global behavior for meta-tags" required: false + # buildkit config + buildkit-proxy-network: + type: boolean + description: "Enable BuildKit proxy network mode" + required: false + default: false secrets: registry-auths: description: "Raw authentication to registries, defined as YAML objects (for image output)" @@ -221,6 +227,7 @@ jobs: sign: ${{ steps.set.outputs.sign }} privateRepo: ${{ steps.set.outputs.privateRepo }} ghaCacheSign: ${{ steps.set.outputs.ghaCacheSign }} + proxyNetwork: ${{ steps.set.outputs.proxyNetwork }} steps: - name: Install dependencies @@ -311,6 +318,7 @@ jobs: INPUT_PLATFORMS: ${{ inputs.platforms }} INPUT_PUSH: ${{ inputs.push }} INPUT_SIGN: ${{ inputs.sign }} + INPUT_BUILDKIT-PROXY-NETWORK: ${{ inputs.buildkit-proxy-network }} with: script: | const { GitHub } = require('@docker/github-builder-runtime/lib/github/github'); @@ -328,6 +336,7 @@ jobs: const inpOutput = core.getInput('output'); const inpPush = core.getBooleanInput('push'); const inpSign = core.getInput('sign'); + const inpProxyNetwork = core.getBooleanInput('buildkit-proxy-network'); const parseRunnerConfig = value => { const lines = value.map(line => line.trim()).filter(line => line.length > 0); @@ -458,6 +467,12 @@ jobs: core.setOutput('privateRepo', privateRepo); }); + await core.group(`Set proxyNetwork output`, async () => { + const proxyNetwork = inpProxyNetwork ? 'true' : 'false'; + core.info(`proxyNetwork: ${proxyNetwork}`); + core.setOutput('proxyNetwork', proxyNetwork); + }); + const metaImages = inpMetaImages.map(image => image.toLowerCase()); await core.group(`Set metaImages output`, async () => { core.info(JSON.stringify(metaImages, null, 2)); @@ -617,6 +632,8 @@ jobs: env.ACTIONS_ID_TOKEN_REQUEST_TOKEN=${{ steps.github-runtime.outputs.actions-id-token-request-token }} env.ACTIONS_ID_TOKEN_REQUEST_URL=${{ steps.github-runtime.outputs.actions-id-token-request-url }} buildkitd-config-inline: | + proxyNetwork = ${{ needs.prepare.outputs.proxyNetwork }} + [cache] [cache.gha] [cache.gha.sign] diff --git a/README.md b/README.md index 279b8f65..eef3005f 100644 --- a/README.md +++ b/README.md @@ -252,6 +252,7 @@ jobs: | `meta-labels` | List | | [List of custom labels](https://github.com/docker/metadata-action?tab=readme-ov-file#overwrite-labels-and-annotations) | | `meta-annotations` | List | | [List of custom annotations](https://github.com/docker/metadata-action?tab=readme-ov-file#overwrite-labels-and-annotations) | | `meta-flavor` | List | | [Flavor](https://github.com/docker/metadata-action?tab=readme-ov-file#flavor-input) defines a global behavior for `meta-tags` | +| `buildkit-proxy-network` | Bool | `false` | Enable BuildKit proxy network mode for default Dockerfile `RUN` networking. | ### Secrets @@ -364,6 +365,7 @@ jobs: | `meta-labels` | List | | [List of custom labels](https://github.com/docker/metadata-action?tab=readme-ov-file#overwrite-labels-and-annotations) | | `meta-annotations` | List | | [List of custom annotations](https://github.com/docker/metadata-action?tab=readme-ov-file#overwrite-labels-and-annotations) | | `meta-flavor` | List | | [Flavor](https://github.com/docker/metadata-action?tab=readme-ov-file#flavor-input) defines a global behavior for `meta-tags` | +| `buildkit-proxy-network` | Bool | `false` | Enable BuildKit proxy network mode for default Dockerfile `RUN` networking. | ### Secrets diff --git a/test/docker-bake.hcl b/test/docker-bake.hcl index fbea740c..a782ca74 100644 --- a/test/docker-bake.hcl +++ b/test/docker-bake.hcl @@ -38,6 +38,10 @@ target "hello-cross" { platforms = ["linux/amd64", "linux/arm64"] } +target "proxy-network" { + dockerfile = "proxy-network.Dockerfile" +} + target "go-cross-with-contexts" { inherits = ["go-cross"] contexts = { diff --git a/test/proxy-network.Dockerfile b/test/proxy-network.Dockerfile new file mode 100644 index 00000000..1c3d3db2 --- /dev/null +++ b/test/proxy-network.Dockerfile @@ -0,0 +1,3 @@ +FROM alpine +RUN grep -q "buildkit proxy CA begin" /etc/ssl/certs/ca-certificates.crt +RUN --network=none ! grep -q "buildkit proxy CA begin" /etc/ssl/certs/ca-certificates.crt