v0.31.0-rc1

Welcome to the v0.31.0-rc1 release of buildx!
This is a pre-release of buildx

Please try out the release binaries and report any issues at https://github.com/docker/buildx/issues.

Contributors

• Tõnis Tiigi
• CrazyMax
• Sebastiaan van Stijn
• Jonathan A. Sternberg
• Justin Chadwell
• Akihiro Suda
• Brian Goff
• David Karlsson
• Paweł Gronowski
• Sergei Khomenkov
• guimove

Notable changes

• This is a first version of Buildx with signed artifacts built using Docker Github Builder
• This release comes with new experimental support for source policy enforcement during builds using policies written in Rego language. There are some limitations in this release, for example, only builds from the local build context currently load policies. #3593 #3539
  • Matching policy for Dockerfile is loaded automatically if one exists, e.g., Dockerfile.rego or app.Dockerfile.rego.
  • Additional policy configuration can be provided using new build --policy flag.
  • Bake also supports automatic policy loading and a new policy key in the target configuration.
  • New buildx policy command includes subcommands eval and test to help you write and test your policies.
• When creating images in Docker image store, they no longer unpack if export was initialized with --push or -o type=registry #3519
• Add semvercmp helper function to Bake stdlib for easier version comparisons #3577
• Retry transient TLS errors when talking to Kubernetes nodes #3493
• Allow disabling Bake env lookups so bake can ignore host environment variables #3595
• Add possibility to load Docker configs scoped to specific repos/scopes for finer credential control #3562
• Fix the --debug flag issues in standalone mode #3554
• Fix handling @ characters inside OCI layout paths passed to build #3583
• Surface policy controls --policy, policy eval, custom builtins/Regos/gitsign checks so builds can enforce policies #3593 #3549
• Prevent DAP breakpoint overlaps from triggering false positives #3534
• Fix mount input names in DAP run mounts #3579
• Fix DAP breakpoint reason reporting #3581

Dependency Changes

• github.com/ProtonMail/go-crypto v1.3.0 new
• github.com/agnivade/levenshtein v1.2.1 new
• github.com/asaskevich/govalidator a9d515a09cc2 new
• github.com/aws/aws-sdk-go-v2 v1.38.1 -> v1.39.6
• github.com/aws/aws-sdk-go-v2/config v1.31.3 -> v1.31.20
• github.com/aws/aws-sdk-go-v2/credentials v1.18.7 -> v1.18.24
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.4 -> v1.18.13
• github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.4 -> v1.4.13
• github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.4 -> v2.7.13
• github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 -> v1.8.4
• github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 -> v1.13.3
• github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.4 -> v1.13.13
• github.com/aws/aws-sdk-go-v2/service/sso v1.28.2 -> v1.30.3
• github.com/aws/aws-sdk-go-v2/service/ssooidc v1.34.0 -> v1.35.7
• github.com/aws/aws-sdk-go-v2/service/sts v1.38.0 -> v1.40.2
• github.com/aws/smithy-go v1.22.5 -> v1.23.2
• github.com/beorn7/perks v1.0.1 new
• github.com/blang/semver v3.5.1 new
• github.com/cespare/xxhash/v2 v2.3.0 new
• github.com/cloudflare/circl v1.6.1 new
• github.com/containerd/containerd/v2 v2.2.0 -> v2.2.1
• github.com/cyberphone/json-canonicalization 19d51d7fe467 new
• github.com/davecgh/go-spew v1.1.1 -> d8f796af33cc
• github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 new
• github.com/digitorus/pkcs7 3a137a874352 new
• github.com/digitorus/timestamp 220c5c2851b7 new
• github.com/docker/cli v28.5.1 -> v29.1.4
• github.com/docker/cli-docs-tool v0.10.0 -> v0.11.0
• github.com/docker/docker v28.5.1 -> v28.5.2
• github.com/docker/docker-credential-helpers v0.9.3 -> v0.9.5
• github.com/docker/go-connections v0.5.0 -> v0.6.0
• github.com/fvbommel/sortorder v1.0.1 -> v1.1.0
• github.com/go-ini/ini v1.67.0 new
• github.com/go-openapi/analysis v0.24.1 new
• github.com/go-openapi/errors v0.22.4 new
• github.com/go-openapi/jsonpointer v0.21.0 -> v0.22.1
• github.com/go-openapi/jsonreference v0.20.2 -> v0.21.3
• github.com/go-openapi/loads v0.23.2 new
• github.com/go-openapi/runtime v0.29.2 new
• github.com/go-openapi/spec v0.22.1 new
• github.com/go-openapi/strfmt v0.25.0 new
• github.com/go-openapi/swag v0.23.0 -> v0.25.3
• github.com/go-openapi/swag/cmdutils v0.25.3 new
• github.com/go-openapi/swag/conv v0.25.3 new
• github.com/go-openapi/swag/fileutils v0.25.3 new
• github.com/go-openapi/swag/jsonname v0.25.3 new
• github.com/go-openapi/swag/jsonutils v0.25.3 new
• github.com/go-openapi/swag/loading v0.25.3 new
• github.com/go-openapi/swag/mangling v0.25.3 new
• github.com/go-openapi/swag/netutils v0.25.3 new
• github.com/go-openapi/swag/stringutils v0.25.3 new
• github.com/go-openapi/swag/typeutils v0.25.3 new
• github.com/go-openapi/swag/yamlutils v0.25.3 new
• github.com/go-openapi/validate v0.25.1 new
• github.com/gobwas/glob v0.2.3 new
• github.com/goccy/go-json v0.10.5 new
• github.com/google/certificate-transparency-go v1.3.2 new
• github.com/google/go-containerregistry v0.20.6 new
• github.com/google/go-dap v0.12.0 -> d7a2259b058b
• github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 -> v2.27.3
• github.com/hiddeco/sshsig v0.2.0 new
• github.com/in-toto/attestation v1.1.2 new
• github.com/klauspost/compress v1.18.1 -> v1.18.2
• github.com/lestrrat-go/blackmagic v1.0.4 new
• github.com/lestrrat-go/dsig v1.0.0 new
• github.com/lestrrat-go/dsig-secp256k1 v1.0.0 new
• github.com/lestrrat-go/httpcc v1.0.1 new
• github.com/lestrrat-go/httprc/v3 v3.0.1 new
• github.com/lestrrat-go/jwx/v3 v3.0.11 new
• github.com/lestrrat-go/option v1.0.1 new
• github.com/lestrrat-go/option/v2 v2.0.0 new
• github.com/moby/buildkit v0.26.0 -> v0.27.0-rc1
• github.com/moby/go-archive v0.1.0 -> v0.2.0
• github.com/moby/moby/api v1.52.0 new
• github.com/moby/moby/client v0.2.1 new
• github.com/moby/policy-helpers 9fcc1a9ec5c9 new
• github.com/morikuni/aec v1.0.0 -> v1.1.0
• github.com/oklog/ulid v1.3.1 new
• github.com/open-policy-agent/opa v1.10.1 new
• github.com/pmezard/go-difflib v1.0.0 -> 5d4384ee4fb2
• github.com/prometheus/client_golang v1.23.2 new
• github.com/prometheus/client_model v0.6.2 new
• github.com/prometheus/common v0.66.1 new
• github.com/prometheus/procfs v0.17.0 new
• github.com/rcrowley/go-metrics 65e299d6c5c9 new
• github.com/rivo/uniseg v0.2.0 -> v0.4.7
• github.com/segmentio/asm v1.2.0 new
• github.com/sigstore/protobuf-specs v0.5.0 new
• github.com/sigstore/rekor v1.4.3 new
• github.com/sigstore/rekor-tiles/v2 v2.0.1 new
• github.com/sigstore/sigstore v1.10.0 new
• github.com/sigstore/sigstore-go b5fe07a5a7d7 new
• github.com/sigstore/timestamp-authority/v2 v2.0.2 new
• github.com/sirupsen/logrus v1.9.3 -> dd1b4c2e81af
• github.com/spf13/cobra v1.10.1 -> v1.10.2
• github.com/tchap/go-patricia/v2 v2.3.3 new
• github.com/theupdateframework/go-tuf/v2 v2.3.0 new
• github.com/tonistiigi/fsutil 586307ad452f -> a2aa163d723f
• github.com/transparency-dev/formats 404c0d5b696c new
• github.com/transparency-dev/merkle v0.0.2 new
• github.com/valyala/fastjson v1.6.4 new
• github.com/vektah/gqlparser/v2 v2.5.30 new
• github.com/xeipuuv/gojsonpointer 02993c407bfb new
• github.com/xeipuuv/gojsonreference bd5ef7bd5415 new
• github.com/yashtewari/glob-intersection v0.2.0 new
• go.mongodb.org/mongo-driver v1.17.6 new
• go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 -> v0.63.0
• go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.61.0 -> v0.63.0
• go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 -> v0.63.0
• go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.31.0 -> v1.38.0
• go.yaml.in/yaml/v2 v2.4.2 -> v2.4.3
• google.golang.org/genproto/googleapis/api c5933d9347a5 -> 57b25ae835d4
• google.golang.org/genproto/googleapis/rpc c5933d9347a5 -> f26f9409b101

Previous release can be found at v0.30.0