The Wayback Machine - https://web.archive.org/web/20251014183012/https://github.com/docker/buildx/pull/2796
Skip to content

bake: add filesystem entitlements support #2796

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 6 commits into from
Nov 21, 2024
Merged

bake: add filesystem entitlements support #2796

merged 6 commits into from
Nov 21, 2024

Conversation

tonistiigi
Copy link
Member

Adds support for entitlements when bake definition accesses local files. Accessing files within the current working directory is allowed by default.

part of #179
closes #2697

In this version, privileged path accesses for local bake definitions only warns, unless BUILDX_BAKE_ENTITLEMENTS_FS is set. In next version, the intention is to make this case fail as with other entitlements.
@tonistiigi tonistiigi requested a review from crazy-max November 19, 2024 06:25
@tonistiigi tonistiigi force-pushed the fs-entitlements branch 2 times, most recently from b7a9691 to f0ec2c4 Compare November 19, 2024 07:27
@tonistiigi tonistiigi modified the milestones: v0.18.1, v0.19.0 Nov 19, 2024
@crazy-max crazy-max force-pushed the fs-entitlements branch 5 times, most recently from 11e9bd2 to 0152f76 Compare November 21, 2024 12:35
tonistiigi and others added 6 commits November 21, 2024 14:05
@tonistiigi @crazy-max
bake: add filesystem entitlements support
1af4f05 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
@tonistiigi @crazy-max
bake: add fs entitlements for context paths
9a7b028 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
@tonistiigi @crazy-max
bake: windows entitlement path fixes
615f4f6 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
@crazy-max
fix lint issues
f392944 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
@crazy-max
bake: windows entitlement path fixes take 2
9f42996 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
@crazy-max
bake: handle root evaluation with available drives for windows entitl…
f10be07 
…ement

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
@crazy-max crazy-max marked this pull request as ready for review November 21, 2024 17:34
@crazy-max
Copy link
Member

Needs follow-up for GA:

  • Remove volumes handling for root path on Windows and instead use volume of current working dir
  • Check long path name handling in stdlib instead of using conversion from osutil
@tonistiigi
Copy link
Member Author

@profnandaa FYI, if you would like to double-check any of the Windows path stuff. We can also ping you on follow-up PR>
@tonistiigi
Copy link
Member Author

Discussing with @crazy-max the difference seems to be that in windows EvalSymlinks has extra toNorm call https://github.com/golang/go/blob/c37d9a0f9313ff2936b1b0b82476416e6cb03c62/src/path/filepath/symlink_windows.go#L113 that is missing in our custom evaluateToExistingPath implementation.
@tonistiigi tonistiigi merged commit a34c641 into docker:master Nov 21, 2024
122 checks passed
@tonistiigi tonistiigi mentioned this pull request Nov 21, 2024
Closed
@crazy-max crazy-max mentioned this pull request Nov 22, 2024
Merged
@crazy-max crazy-max removed their assignment Jun 18, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/bake area/build area/cli area/tests status/needs-docs-follow-up

2 participants

@tonistiigi @crazy-max