Skip to content

Commit d9f8c73

Browse files
crazy-maxcrazy-max
authored
Merge pull request #3004 from crazy-max/0.21_picks_0.21.0-rc3
[v0.21] cherry-picks 0.21.0-rc3
2 parents 5e5568f + af5d0d4 commit d9f8c73

File tree

18 files changed

+217
-65
lines changed

18 files changed

+217
-65
lines changed

‎bake/bake.go‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@ import (
2727
"github.com/moby/buildkit/client"
2828
"github.com/moby/buildkit/client/llb"
2929
"github.com/moby/buildkit/session/auth/authprovider"
30-
"github.com/moby/buildkit/util/entitlements"
3130
"github.com/pkg/errors"
3231
"github.com/zclconf/go-cty/cty"
3332
"github.com/zclconf/go-cty/cty/convert"
@@ -1434,9 +1433,7 @@ func toBuildOpt(t *Target, inp *Input) (*build.Options, error) {
14341433
}
14351434
bo.Ulimits = ulimits
14361435

1437-
for _, ent := range t.Entitlements {
1438-
bo.Allow = append(bo.Allow, entitlements.Entitlement(ent))
1439-
}
1436+
bo.Allow = append(bo.Allow, t.Entitlements...)
14401437

14411438
return bo, nil
14421439
}

‎bake/bake_test.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1806,8 +1806,8 @@ func TestHCLEntitlements(t *testing.T) {
18061806
require.Equal(t, "network.host", m["app"].Entitlements[1])
18071807

18081808
require.Len(t, bo["app"].Allow, 2)
1809-
require.Equal(t, entitlements.EntitlementSecurityInsecure, bo["app"].Allow[0])
1810-
require.Equal(t, entitlements.EntitlementNetworkHost, bo["app"].Allow[1])
1809+
require.Equal(t, entitlements.EntitlementSecurityInsecure.String(), bo["app"].Allow[0])
1810+
require.Equal(t, entitlements.EntitlementNetworkHost.String(), bo["app"].Allow[1])
18111811
}
18121812

18131813
func TestEntitlementsForNetHostCompose(t *testing.T) {
@@ -1846,7 +1846,7 @@ func TestEntitlementsForNetHostCompose(t *testing.T) {
18461846
require.Equal(t, "host", *m["app"].NetworkMode)
18471847

18481848
require.Len(t, bo["app"].Allow, 1)
1849-
require.Equal(t, entitlements.EntitlementNetworkHost, bo["app"].Allow[0])
1849+
require.Equal(t, entitlements.EntitlementNetworkHost.String(), bo["app"].Allow[0])
18501850
require.Equal(t, "host", bo["app"].NetworkMode)
18511851
}
18521852

@@ -1877,7 +1877,7 @@ func TestEntitlementsForNetHost(t *testing.T) {
18771877
require.Equal(t, "host", *m["app"].NetworkMode)
18781878

18791879
require.Len(t, bo["app"].Allow, 1)
1880-
require.Equal(t, entitlements.EntitlementNetworkHost, bo["app"].Allow[0])
1880+
require.Equal(t, entitlements.EntitlementNetworkHost.String(), bo["app"].Allow[0])
18811881
require.Equal(t, "host", bo["app"].NetworkMode)
18821882
}
18831883

‎bake/entitlements.go‎

Lines changed: 60 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,15 @@ import (
2020
"github.com/moby/buildkit/util/entitlements"
2121
"github.com/pkg/errors"
2222
"github.com/sirupsen/logrus"
23+
"github.com/tonistiigi/go-csvvalue"
2324
)
2425

2526
type EntitlementKey string
2627

2728
const (
2829
EntitlementKeyNetworkHost EntitlementKey = "network.host"
2930
EntitlementKeySecurityInsecure EntitlementKey = "security.insecure"
31+
EntitlementKeyDevice EntitlementKey = "device"
3032
EntitlementKeyFSRead EntitlementKey = "fs.read"
3133
EntitlementKeyFSWrite EntitlementKey = "fs.write"
3234
EntitlementKeyFS EntitlementKey = "fs"
@@ -39,13 +41,19 @@ const (
3941
type EntitlementConf struct {
4042
NetworkHost bool
4143
SecurityInsecure bool
44+
Devices *EntitlementsDevicesConf
4245
FSRead []string
4346
FSWrite []string
4447
ImagePush []string
4548
ImageLoad []string
4649
SSH bool
4750
}
4851

52+
type EntitlementsDevicesConf struct {
53+
All bool
54+
Devices map[string]struct{}
55+
}
56+
4957
func ParseEntitlements(in []string) (EntitlementConf, error) {
5058
var conf EntitlementConf
5159
for _, e := range in {
@@ -59,6 +67,22 @@ func ParseEntitlements(in []string) (EntitlementConf, error) {
5967
default:
6068
k, v, _ := strings.Cut(e, "=")
6169
switch k {
70+
case string(EntitlementKeyDevice):
71+
if v == "" {
72+
conf.Devices = &EntitlementsDevicesConf{All: true}
73+
continue
74+
}
75+
fields, err := csvvalue.Fields(v, nil)
76+
if err != nil {
77+
return EntitlementConf{}, errors.Wrapf(err, "failed to parse device entitlement %q", v)
78+
}
79+
if conf.Devices == nil {
80+
conf.Devices = &EntitlementsDevicesConf{}
81+
}
82+
if conf.Devices.Devices == nil {
83+
conf.Devices.Devices = make(map[string]struct{}, 0)
84+
}
85+
conf.Devices.Devices[fields[0]] = struct{}{}
6286
case string(EntitlementKeyFSRead):
6387
conf.FSRead = append(conf.FSRead, v)
6488
case string(EntitlementKeyFSWrite):
@@ -95,12 +119,34 @@ func (c EntitlementConf) Validate(m map[string]build.Options) (EntitlementConf,
95119

96120
func (c EntitlementConf) check(bo build.Options, expected *EntitlementConf) error {
97121
for _, e := range bo.Allow {
122+
k, rest, _ := strings.Cut(e, "=")
123+
switch k {
124+
case entitlements.EntitlementDevice.String():
125+
if rest == "" {
126+
if c.Devices == nil || !c.Devices.All {
127+
expected.Devices = &EntitlementsDevicesConf{All: true}
128+
}
129+
continue
130+
}
131+
fields, err := csvvalue.Fields(rest, nil)
132+
if err != nil {
133+
return errors.Wrapf(err, "failed to parse device entitlement %q", rest)
134+
}
135+
if expected.Devices == nil {
136+
expected.Devices = &EntitlementsDevicesConf{}
137+
}
138+
if expected.Devices.Devices == nil {
139+
expected.Devices.Devices = make(map[string]struct{}, 0)
140+
}
141+
expected.Devices.Devices[fields[0]] = struct{}{}
142+
}
143+
98144
switch e {
99-
case entitlements.EntitlementNetworkHost:
145+
case entitlements.EntitlementNetworkHost.String():
100146
if !c.NetworkHost {
101147
expected.NetworkHost = true
102148
}
103-
case entitlements.EntitlementSecurityInsecure:
149+
case entitlements.EntitlementSecurityInsecure.String():
104150
if !c.SecurityInsecure {
105151
expected.SecurityInsecure = true
106152
}
@@ -187,6 +233,18 @@ func (c EntitlementConf) Prompt(ctx context.Context, isRemote bool, out io.Write
187233
flags = append(flags, string(EntitlementKeySecurityInsecure))
188234
}
189235

236+
if c.Devices != nil {
237+
if c.Devices.All {
238+
msgs = append(msgs, " - Access to CDI devices")
239+
flags = append(flags, string(EntitlementKeyDevice))
240+
} else {
241+
for d := range c.Devices.Devices {
242+
msgs = append(msgs, fmt.Sprintf(" - Access to device %s", d))
243+
flags = append(flags, string(EntitlementKeyDevice)+"="+d)
244+
}
245+
}
246+
}
247+
190248
if c.SSH {
191249
msgsFS = append(msgsFS, " - Forwarding default SSH agent socket")
192250
flagsFS = append(flagsFS, string(EntitlementKeySSH))

‎bake/entitlements_test.go‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -208,8 +208,8 @@ func TestValidateEntitlements(t *testing.T) {
208208
{
209209
name: "NetworkHostMissing",
210210
opt: build.Options{
211-
Allow: []entitlements.Entitlement{
212-
entitlements.EntitlementNetworkHost,
211+
Allow: []string{
212+
entitlements.EntitlementNetworkHost.String(),
213213
},
214214
},
215215
expected: EntitlementConf{
@@ -223,8 +223,8 @@ func TestValidateEntitlements(t *testing.T) {
223223
NetworkHost: true,
224224
},
225225
opt: build.Options{
226-
Allow: []entitlements.Entitlement{
227-
entitlements.EntitlementNetworkHost,
226+
Allow: []string{
227+
entitlements.EntitlementNetworkHost.String(),
228228
},
229229
},
230230
expected: EntitlementConf{
@@ -234,9 +234,9 @@ func TestValidateEntitlements(t *testing.T) {
234234
{
235235
name: "SecurityAndNetworkHostMissing",
236236
opt: build.Options{
237-
Allow: []entitlements.Entitlement{
238-
entitlements.EntitlementNetworkHost,
239-
entitlements.EntitlementSecurityInsecure,
237+
Allow: []string{
238+
entitlements.EntitlementNetworkHost.String(),
239+
entitlements.EntitlementSecurityInsecure.String(),
240240
},
241241
},
242242
expected: EntitlementConf{
@@ -251,9 +251,9 @@ func TestValidateEntitlements(t *testing.T) {
251251
NetworkHost: true,
252252
},
253253
opt: build.Options{
254-
Allow: []entitlements.Entitlement{
255-
entitlements.EntitlementNetworkHost,
256-
entitlements.EntitlementSecurityInsecure,
254+
Allow: []string{
255+
entitlements.EntitlementNetworkHost.String(),
256+
entitlements.EntitlementSecurityInsecure.String(),
257257
},
258258
},
259259
expected: EntitlementConf{

‎build/build.go‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,6 @@ import (
4040
"github.com/moby/buildkit/solver/errdefs"
4141
"github.com/moby/buildkit/solver/pb"
4242
spb "github.com/moby/buildkit/sourcepolicy/pb"
43-
"github.com/moby/buildkit/util/entitlements"
4443
"github.com/moby/buildkit/util/progress/progresswriter"
4544
"github.com/moby/buildkit/util/tracing"
4645
"github.com/opencontainers/go-digest"
@@ -63,7 +62,7 @@ type Options struct {
6362
Inputs Inputs
6463

6564
Ref string
66-
Allow []entitlements.Entitlement
65+
Allow []string
6766
Attests map[string]*string
6867
BuildArgs map[string]string
6968
CacheFrom []client.CacheOptionsEntry

‎build/opt.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -318,7 +318,7 @@ func toSolveOpt(ctx context.Context, node builder.Node, multiDriver bool, opt *O
318318
switch opt.NetworkMode {
319319
case "host":
320320
so.FrontendAttrs["force-network-mode"] = opt.NetworkMode
321-
so.AllowedEntitlements = append(so.AllowedEntitlements, entitlements.EntitlementNetworkHost)
321+
so.AllowedEntitlements = append(so.AllowedEntitlements, entitlements.EntitlementNetworkHost.String())
322322
case "none":
323323
so.FrontendAttrs["force-network-mode"] = opt.NetworkMode
324324
case "", "default":

‎commands/build.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -593,7 +593,7 @@ func buildCmd(dockerCli command.Cli, rootOpts *rootOptions, debugConfig *debug.D
593593

594594
flags.StringSliceVar(&options.extraHosts, "add-host", []string{}, `Add a custom host-to-IP mapping (format: "host:ip")`)
595595

596-
flags.StringSliceVar(&options.allow, "allow", []string{}, `Allow extra privileged entitlement (e.g., "network.host", "security.insecure")`)
596+
flags.StringArrayVar(&options.allow, "allow", []string{}, `Allow extra privileged entitlement (e.g., "network.host", "security.insecure")`)
597597

598598
flags.StringArrayVarP(&options.annotations, "annotation", "", []string{}, "Add annotation to the image")
599599

‎docs/reference/buildx_build.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ Start a build
1616
| Name | Type | Default | Description |
1717
|:----------------------------------------|:--------------|:----------|:-------------------------------------------------------------------------------------------------------------|
1818
| [`--add-host`](#add-host) | `stringSlice` | | Add a custom host-to-IP mapping (format: `host:ip`) |
19-
| [`--allow`](#allow) | `stringSlice` | | Allow extra privileged entitlement (e.g., `network.host`, `security.insecure`) |
19+
| [`--allow`](#allow) | `stringArray` | | Allow extra privileged entitlement (e.g., `network.host`, `security.insecure`) |
2020
| [`--annotation`](#annotation) | `stringArray` | | Add annotation to the image |
2121
| [`--attest`](#attest) | `stringArray` | | Attestation parameters (format: `type=sbom,generator=image`) |
2222
| [`--build-arg`](#build-arg) | `stringArray` | | Set build-time variables |

‎docs/reference/buildx_debug_build.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ Start a build
1212
| Name | Type | Default | Description |
1313
|:--------------------|:--------------|:----------|:-------------------------------------------------------------------------------------------------------------|
1414
| `--add-host` | `stringSlice` | | Add a custom host-to-IP mapping (format: `host:ip`) |
15-
| `--allow` | `stringSlice` | | Allow extra privileged entitlement (e.g., `network.host`, `security.insecure`) |
15+
| `--allow` | `stringArray` | | Allow extra privileged entitlement (e.g., `network.host`, `security.insecure`) |
1616
| `--annotation` | `stringArray` | | Add annotation to the image |
1717
| `--attest` | `stringArray` | | Attestation parameters (format: `type=sbom,generator=image`) |
1818
| `--build-arg` | `stringArray` | | Set build-time variables |

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ require (
2929
github.com/hashicorp/hcl/v2 v2.23.0
3030
github.com/in-toto/in-toto-golang v0.5.0
3131
github.com/mitchellh/hashstructure/v2 v2.0.2
32-
github.com/moby/buildkit v0.20.0-rc2
32+
github.com/moby/buildkit v0.20.0-rc3
3333
github.com/moby/sys/mountinfo v0.7.2
3434
github.com/moby/sys/signal v0.7.1
3535
github.com/morikuni/aec v1.0.0

0 commit comments

Comments
 (0)