Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bake: additional support for named context on remote inputs #965

Merged
merged 2 commits into from
Feb 25, 2022
Merged

bake: additional support for named context on remote inputs #965

merged 2 commits into from
Feb 25, 2022

Conversation

tonistiigi
Copy link
Member

  • Update named context paths to be relative of remote inputs
  • Add basic validation that named paths don't escape the current working directory when loaded from remote sources.

tonistiigi
tonistiigi commented Feb 24, 2022
View reviewed changes
bake/bake.go
if inp == nil || inp.State == nil {
return nil
}
if v, ok := os.LookupEnv("BAKE_ALLOW_REMOTE_FS_ACCESS"); ok {
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@crazy-max I think in our github actions we can define this by default as the whole system is in a vm anyway.

Copy link
Member

@crazy-max crazy-max Feb 25, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On GHA they could include /home/runner/.docker which contains auth token in config.json if login step has been done in a previous step.

@tonistiigi
bake: make named contexts relative to remote bake input
280c008 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
@tonistiigi
bake: add path validation for remote bake invocations
91e550b 
This is a stopgap before proper entitlements support
is implemented.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
crazy-max
crazy-max reviewed Feb 25, 2022
View reviewed changes
Copy link
Member

@crazy-max crazy-max left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you add BAKE_ALLOW_REMOTE_FS_ACCESS to the list of built-in variables: https://github.com/docker/buildx/blob/master/docs/reference/buildx_bake.md#built-in-variables

@tonistiigi
Copy link
Member Author

Can you add BAKE_ALLOW_REMOTE_FS_ACCESS to the list of built-in variables:

I don't really want to make this very official. Hopefully, it would be removed in the next release if we have proper entitlements support.

@tonistiigi tonistiigi merged commit 6ac01ec into docker:master Feb 25, 2022
@thaJeztah thaJeztah mentioned this pull request Apr 21, 2022
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@crazy-max crazy-max crazy-max approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@tonistiigi @crazy-max