BuildKit proxy network opt-in

.github/workflows/.test-bake.yml

@@ -85,6 +85,16 @@ jobs:
             const builderOutputs = JSON.parse(core.getInput('builder-outputs'));
             core.info(JSON.stringify(builderOutputs, null, 2));
 
+  bake-proxy-network:
+    uses: ./.github/workflows/bake.yml
+    permissions:
+      contents: read
+    with:
+      context: test
+      output: local
+      target: proxy-network
+      buildkit-proxy-network: true
+
   bake-ecr-public:
     uses: ./.github/workflows/bake.yml
     if: ${{ github.event_name != 'pull_request' }}

.github/workflows/.test-build.yml

@@ -84,6 +84,15 @@ jobs:
             const builderOutputs = JSON.parse(core.getInput('builder-outputs'));
             core.info(JSON.stringify(builderOutputs, null, 2));
 
+  build-proxy-network:
+    uses: ./.github/workflows/build.yml
+    permissions:
+      contents: read
+    with:
+      file: test/proxy-network.Dockerfile
+      output: local
+      buildkit-proxy-network: true
+
   build-ecr-public:
     uses: ./.github/workflows/build.yml
     if: ${{ github.event_name != 'pull_request' }}

.github/workflows/bake.yml

@@ -139,6 +139,12 @@ on:
         type: string
         description: "Bake target name for metadata (defaults to docker-metadata-action)"
         required: false
+      # buildkit config
+      buildkit-proxy-network:
+        type: boolean
+        description: "Enable BuildKit proxy network mode"
+        required: false
+        default: false
     secrets:
       registry-auths:
         description: "Raw authentication to registries, defined as YAML objects (for image output)"
@@ -210,6 +216,7 @@ jobs:
       sign: ${{ steps.set.outputs.sign }}
       privateRepo: ${{ steps.set.outputs.privateRepo }}
       ghaCacheSign: ${{ steps.set.outputs.ghaCacheSign }}
+      proxyNetwork: ${{ steps.set.outputs.proxyNetwork }}
     steps:
       -
         name: Install dependencies
@@ -315,6 +322,7 @@ jobs:
           INPUT_TARGET: ${{ inputs.target }}
           INPUT_VARS: ${{ inputs.vars }}
           INPUT_GITHUB-TOKEN: ${{ secrets.github-token || github.token }}
+          INPUT_BUILDKIT-PROXY-NETWORK: ${{ inputs.buildkit-proxy-network }}
         with:
           script: |
             const os = require('os');
@@ -342,6 +350,7 @@ jobs:
             const inpSign = core.getInput('sign');
             const inpTarget = core.getInput('target');
             const inpGitHubToken = core.getInput('github-token');
+            const inpProxyNetwork = core.getBooleanInput('buildkit-proxy-network');
 
             const parseRunnerConfig = value => {
               const lines = value.map(line => line.trim()).filter(line => line.length > 0);
@@ -564,6 +573,12 @@ jobs:
               core.info(`privateRepo: ${privateRepo}`);
               core.setOutput('privateRepo', privateRepo);
             });
+
+            await core.group(`Set proxyNetwork output`, async () => {
+              const proxyNetwork = inpProxyNetwork ? 'true' : 'false';
+              core.info(`proxyNetwork: ${proxyNetwork}`);
+              core.setOutput('proxyNetwork', proxyNetwork);
+            });
 
             await core.group(`Set includes output`, async () => {
               const withJobNamePrefix = include => {
@@ -719,6 +734,8 @@ jobs:
             env.ACTIONS_ID_TOKEN_REQUEST_TOKEN=${{ steps.github-runtime.outputs.actions-id-token-request-token }}
             env.ACTIONS_ID_TOKEN_REQUEST_URL=${{ steps.github-runtime.outputs.actions-id-token-request-url }}
           buildkitd-config-inline: |
+            proxyNetwork = ${{ needs.prepare.outputs.proxyNetwork }}
+
             [cache]
               [cache.gha]
                 [cache.gha.sign]

.github/workflows/build.yml

@@ -150,6 +150,12 @@ on:
         type: string
         description: "Flavor defines a global behavior for meta-tags"
         required: false
+      # buildkit config
+      buildkit-proxy-network:
+        type: boolean
+        description: "Enable BuildKit proxy network mode"
+        required: false
+        default: false
     secrets:
       registry-auths:
         description: "Raw authentication to registries, defined as YAML objects (for image output)"
@@ -221,6 +227,7 @@ jobs:
       sign: ${{ steps.set.outputs.sign }}
       privateRepo: ${{ steps.set.outputs.privateRepo }}
       ghaCacheSign: ${{ steps.set.outputs.ghaCacheSign }}
+      proxyNetwork: ${{ steps.set.outputs.proxyNetwork }}
     steps:
       -
         name: Install dependencies
@@ -311,6 +318,7 @@ jobs:
           INPUT_PLATFORMS: ${{ inputs.platforms }}
           INPUT_PUSH: ${{ inputs.push }}
           INPUT_SIGN: ${{ inputs.sign }}
+          INPUT_BUILDKIT-PROXY-NETWORK: ${{ inputs.buildkit-proxy-network }}
         with:
           script: |
             const { GitHub } = require('@docker/github-builder-runtime/lib/github/github');
@@ -328,6 +336,7 @@ jobs:
             const inpOutput = core.getInput('output');
             const inpPush = core.getBooleanInput('push');
             const inpSign = core.getInput('sign');
+            const inpProxyNetwork = core.getBooleanInput('buildkit-proxy-network');
 
             const parseRunnerConfig = value => {
               const lines = value.map(line => line.trim()).filter(line => line.length > 0);
@@ -458,6 +467,12 @@ jobs:
               core.setOutput('privateRepo', privateRepo);
             });
 
+            await core.group(`Set proxyNetwork output`, async () => {
+              const proxyNetwork = inpProxyNetwork ? 'true' : 'false';
+              core.info(`proxyNetwork: ${proxyNetwork}`);
+              core.setOutput('proxyNetwork', proxyNetwork);
+            });
+
             const metaImages = inpMetaImages.map(image => image.toLowerCase());
             await core.group(`Set metaImages output`, async () => {
               core.info(JSON.stringify(metaImages, null, 2));
@@ -617,6 +632,8 @@ jobs:
             env.ACTIONS_ID_TOKEN_REQUEST_TOKEN=${{ steps.github-runtime.outputs.actions-id-token-request-token }}
             env.ACTIONS_ID_TOKEN_REQUEST_URL=${{ steps.github-runtime.outputs.actions-id-token-request-url }}
           buildkitd-config-inline: |
+            proxyNetwork = ${{ needs.prepare.outputs.proxyNetwork }}
+
             [cache]
               [cache.gha]
                 [cache.gha.sign]

README.md

@@ -252,6 +252,7 @@ jobs:
 | `meta-labels`             | List     |                                       | [List of custom labels](https://github.com/docker/metadata-action?tab=readme-ov-file#overwrite-labels-and-annotations)                                                                                                                                                                                         |
 | `meta-annotations`        | List     |                                       | [List of custom annotations](https://github.com/docker/metadata-action?tab=readme-ov-file#overwrite-labels-and-annotations)                                                                                                                                                                                    |
 | `meta-flavor`             | List     |                                       | [Flavor](https://github.com/docker/metadata-action?tab=readme-ov-file#flavor-input) defines a global behavior for `meta-tags`                                                                                                                                                                                  |
+| `buildkit-proxy-network`  | Bool     | `false`                               | Enable BuildKit proxy network mode for default Dockerfile `RUN` networking.                                                                                                                                                                                                                                    |
 
 ### Secrets
 
@@ -364,6 +365,7 @@ jobs:
 | `meta-labels`             | List   |                                       | [List of custom labels](https://github.com/docker/metadata-action?tab=readme-ov-file#overwrite-labels-and-annotations)                                                                                                                                                                               |
 | `meta-annotations`        | List   |                                       | [List of custom annotations](https://github.com/docker/metadata-action?tab=readme-ov-file#overwrite-labels-and-annotations)                                                                                                                                                                          |
 | `meta-flavor`             | List   |                                       | [Flavor](https://github.com/docker/metadata-action?tab=readme-ov-file#flavor-input) defines a global behavior for `meta-tags`                                                                                                                                                                        |
+| `buildkit-proxy-network`  | Bool   | `false`                               | Enable BuildKit proxy network mode for default Dockerfile `RUN` networking.                                                                                                                                                                                                                          |
 
 ### Secrets
 

test/docker-bake.hcl

@@ -38,6 +38,10 @@ target "hello-cross" {
   platforms = ["linux/amd64", "linux/arm64"]
 }
 
+target "proxy-network" {
+  dockerfile = "proxy-network.Dockerfile"
+}
+
 target "go-cross-with-contexts" {
   inherits = ["go-cross"]
   contexts = {

test/proxy-network.Dockerfile

@@ -0,0 +1,3 @@
+FROM alpine
+RUN grep -q "buildkit proxy CA begin" /etc/ssl/certs/ca-certificates.crt
+RUN --network=none ! grep -q "buildkit proxy CA begin" /etc/ssl/certs/ca-certificates.crt