support for device entitlement in build and bake#2994
support for device entitlement in build and bake#2994crazy-max merged 2 commits intodocker:masterfrom
Conversation
github-actions
Bot
added
area/bake
area/build
area/cli
area/dependencies
area/tests
labels
| flags.StringSliceVar(&options.extraHosts, "add-host", []string{}, `Add a custom host-to-IP mapping (format: "host:ip")`) | ||
|
|
||
| flags.StringSliceVar(&options.allow, "allow", []string{}, `Allow extra privileged entitlement (e.g., "network.host", "security.insecure")`) | ||
| flags.StringArrayVar(&options.allow, "allow", []string{}, `Allow extra privileged entitlement (e.g., "network.host", "security.insecure")`) |
There was a problem hiding this comment.
This is technically a breaking change but I think StringSlice was accidental. Alias syntax can not be supported with the slice.
There was a problem hiding this comment.
Yes I think it should have been StringArray type in the first place for build. With bake it looks good:
Line 470 in ef73c64
Would need to adapt build push action to ignore comma:
- https://github.com/docker/build-push-action/blob/ca877d9245402d1537745e0e356eab47c3520991/README.md?plain=1#L215
- https://github.com/docker/build-push-action/blob/ca877d9245402d1537745e0e356eab47c3520991/src/context.ts#L49
Looking at https://grep.app/search?regexp=true&q=build.*--allow.*%28security%5C.insecure%7Cnetwork%5C.host%29 it seems people don't use csv values.
There are some in GHA workflows https://grep.app/search?f.path=.github%2Fworkflows%2F®exp=true&q=allow%3A+.*%28security%5C.insecure%7Cnetwork%5C.host%29 but we can manage this in our action.
crazy-max
force-pushed
the
device-entitlements
branch
from
0dda89d to
c5e65d7
Compare
Allow access to CDI Devices in Buildkit v0.20.0+ for devices that are not automatically allowed to be used by everyone in BuildKit configuration. Signed-off-by: Tonis Tiigi <[email protected]> Signed-off-by: CrazyMax <[email protected]>
crazy-max
force-pushed
the
device-entitlements
branch
from
c5e65d7 to
0c296fe
Compare
Signed-off-by: CrazyMax <[email protected]>
4 participants
Buildx side of moby/buildkit#5742
Allow access to CDI Devices in Buildkit v0.20.0+ for devices that are not automatically allowed to be used by everyone in BuildKit configuration.