Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Build fails with fs.read entitlement error when dockerfile is outside the build context (buildx >= 0.37.2)

Cerrado
  • ¿Algo no está bien?
#14,285 7 comentarios 13 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Ya se ha fusionado un pull request relacionado.

  • #14286 de @locker95 — cerrado sin fusionar
  • #14325 de @crazy-max — fusionado

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
35/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Estancado
Stack tecnológico
docker, docker-compose, go
Área
build-system

Línea de trabajo

Start in pkg/compose/build_bake.go and inspect localBuildPaths, which currently grants fs.read access for build contexts but not the Dockerfile path. Reproduce with a Compose service whose Dockerfile is outside its build context, then check existing build-bake tests for coverage. Done means a local external Dockerfile is included in the fs.read allowlist while dockerfile_inline remains unaffected; an open linked pull request is already addressing this issue.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Description

Since buildx v0.37.2 (GHSA-gwr2-q96m-6682), buildx bake --progress rawjson enforces filesystem entitlements instead of skipping the consent check. Compose always invokes bake that way, but localBuildPaths in pkg/compose/build_bake.go only grants --allow fs.read= for build.context and build.additional_contexts — not for build.dockerfile. A service whose Dockerfile lives outside its build context therefore no longer builds. Before buildx v0.37.2 the missing grant went unnoticed because the check was skipped under rawjson.

This breaks every Dev Container that uses a Compose service with build:: the devcontainer CLI writes Dockerfile-with-features into a temp directory and points dockerfile: at it through an override file (dockerCompose.ts), which fails with:

additional privileges requested: pass "--allow=fs.read=/private/var/folders/…/T/devcontainercli/container-features/0.76.0-…/Dockerfile-with-features" to grant requested privileges

The code is unchanged in v5.6.0 and on main.

Steps To Reproduce
mkdir -p /tmp/outside && echo 'FROM alpine' > /tmp/outside/Dockerfile
mkdir -p /tmp/repro && cd /tmp/repro
cat > compose.yaml <<'EOF'
services:
  app:
    build:
      context: .
      dockerfile: /tmp/outside/Dockerfile
EOF
docker compose build

[+] Building 0.0s (1/1) FINISHED
 => [internal] load local bake definitions                         0.0s
 => => reading from stdin 466B                                     0.0s
[+] build 0/1
 ⠋ Image repro-app Building                                        0.1s
additional privileges requested: pass "--allow=fs.read=../outside/Dockerfile" to grant requested privileges
Compose Version
Docker Compose version v5.5.1
Docker Environment

macOS (Apple Silicon), Docker Desktop 4.94.0 (241994), buildx v0.37.2

Anything else?

Workaround: BUILDX_BAKE_ENTITLEMENTS_FS=0, which disables the check for all paths.
Suggested fix: add the resolved Dockerfile path to the fs.read allowlist when it is a local path outside the context (dockerfile_inline is unaffected).

Lenguaje dominante
Go
Estrellas
38.4k
Forks
5.9k
Merge medio
2 d 7 h
PR fusionados (30 d)
60

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de docker/compose

Todos los issues de docker/compose

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.