title
SLSA provenance

BuildKit supports automatic creation of provenance attestations for the build process. Provenance attestations record information describing how a build was created, and is important for tracking the security of your software artifacts.

Provenance attestations created by BuildKit include details such as:

• Build parameters and environment.
• Build timestamps.
• Version control metadata for your build sources.
• Build dependencies with their immutable checksums. For example, base images or external URLs used by the build.
• Descriptions of all build steps, with their source and layer mappings.

Provenance generated by BuildKit is wrapped inside in-toto attestations in the SLSA Provenance format.

For more information about how the attestation fields get generated, see SLSA definitions.

Build with provenance attestations

To build an image with provenance attestations using buildctl, use the attest:provenance option:

buildctl build \
    --frontend=dockerfile.v0 \
    --local context=. \
    --local dockerfile=. \
    --opt attest:provenance=

You can also customize the attestations using parameters:

buildctl build \
    --frontend=dockerfile.v0 \
    --local context=. \
    --local dockerfile=. \
    --opt attest:provenance=mode=min,inline-only=true

All BuildKit exporters support attaching attestations to build results. When the final output format is a container image (image or oci exporter), provenance is attached to the image using the format described in the attestation storage specification. When creating a multi-platform image, each platform version of the image gets its own provenance.

If you use the local or tar exporter, the provenance will be written to a file named provenance.json and exported with your build result, in the root directory.

Parameters

Parameter	Type	Default	Description
mode	min,max	max	Configures the amount of provenance to be generated. See mode
builder-id	String		Explicitly set SLSA builder.id field
filename	String	provenance.json	Set filename for provenance attestation when exported with local or tar exporter
reproducible	true,false	false	Explicitly set SLSA metadata.reproducible field
inline-only	true,false	false	Only embed provenance into exporters that support inline content. See inline-only

mode

Provenance can be generated in one of two modes: min or max. By default, when provenance is enabled, the mode parameter will be set to max.

In min mode, BuildKit generates only the bare minimum amount of provenance, including:

• Build timestamps
• The frontend used
• The build materials

However, the values of build arguments, the identities of secrets, and rich layer metadata will not be included. mode=min should be safe to set on all builds, as it does not leak information from any part of the build environment.

In max mode, BuildKit generates all of the above, as well as:

• The source Dockerfile, and rich layer metadata with sourcemaps to connect the source with the build result
• The values of passed build arguments
• Metadata about secrets and ssh mounts

Wherever possible, you should prefer mode=max as it contains significantly more detailed information for analysis. However, on some builds it may not be appropriate, as it includes the values of various build arguments and metadata about secrets - these builds should be refactored to prefer passing hidden values through secrets wherever possible to prevent unnecessary information leakage.

inline-only

By default, provenance is by included in all exporters that support attestations. The inline-only parameter allows configuring this behavior, to only include the provenance results in exporters that support inline content, specifically only exporters that produce container images.

Since other exporters produce attestations into separate files, in their filesystems, you may not want to include the provenance in these cases.