Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[BUG] docker compose build cannot grant network.host entitlement when using buildx bake

Cerrado
  • ¿Algo no está bien?
#14,345 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
35/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
docker, docker-compose, go
Área
build-system

Línea de trabajo

Start by reproducing with the compose.yaml in the issue (a build with entitlements: [network.host]) and docker compose build, then find where Compose assembles the Buildx Bake invocation and whether it can pass --allow. The issue says the Bake config already includes the entitlement, so the gap is in the command arguments. Done means the build succeeds with the entitlement granted, and the maintainers have settled whether to add a flag or grant it automatically.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

kind/bug status/0-triage
Description

When a Compose service declares the network.host build entitlement, docker compose build fails because Compose invokes Buildx Bake without passing --allow=network.host

This appears to be a compatibility issue with Buildx's entitlement validation when using --progress rawjson (https://github.com/docker/buildx/security/advisories/GHSA-gwr2-q96m-6682).

The Compose-generated Bake configuration correctly includes the requested entitlement, but the actual Bake invocation does not grant it. The docker compose build CLI does not expose an --allow option to resolve this.

Steps To Reproduce
  1. Create compose.yaml: 
    services:
  test:
    build:
      dockerfile_inline: "FROM alpine\nRUN --network=host true"
      entitlements: [network.host]
  2. Run: 
    docker compose build
Compose Version
Docker Compose version v5.6.0
Docker Environment
Client: Docker Engine - Community
 Version:    29.9.0
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.38.0
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v5.6.0
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 1
  Running: 0
  Paused: 0
  Stopped: 1
 Images: 29
 Server Version: 29.9.0
 Storage Driver: overlayfs
  driver-type: io.containerd.snapshotter.v1
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: b7a25261e029d68978bbf290df0a62fc819b3c51
 runc version: v1.5.2-0-g29dd3dc2
 init version: de40ad0
 Security Options:
  apparmor
   Profile: default
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.11.0-29-generic
 Operating System: Ubuntu 24.04.5 LTS
 OSType: linux
 Architecture: x86_64
 CPUs: 12
 Total Memory: 30.97GiB
 Name: ubuntu
 ID: d4182ace-77a6-4a65-98f3-2e4c558c561f
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
  ::1/128
 Live Restore Enabled: false
 Firewall Backend: iptables
  EnableUserlandProxy: true
  UserlandProxyPath: /usr/bin/docker-proxy
Anything else?
Actual behavior

The build fails with:

$ docker compose build
[+] Building 0.0s (1/1) FINISHED                                                                                                                  
 => [internal] load local bake definitions                                                                                                   0.0s
 => => reading from stdin 559B                                                                                                               0.0s
additional privileges requested: pass "--allow=network.host" to grant requested privileges
Expected behavior

docker compose build should provide a way to grant the requested build entitlement, or otherwise handle the required permission, so that the build can succeed.

Direct Buildx Bake works

The same build succeeds when invoking Buildx Bake directly and explicitly granting the requested entitlement.

  1. Create docker-bake.hcl 
    target "default" {
  dockerfile-inline = "FROM alpine\nRUN --network=host true"
  entitlements = ["network.host"]
}
  2. Run 
    docker buildx bake \
  --file docker-bake.hcl \
  --allow=network.host
Lenguaje dominante
Go
Estrellas
38.4k
Forks
5.9k
Merge medio
2 d 2 h
PR fusionados (30 d)
66

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de docker/compose

Todos los issues de docker/compose

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.