Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[BUG] docker compose build cannot grant network.host entitlement when using buildx bake

Chiusa
  • Qualcosa non va?
#14,345 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
docker, docker-compose, go
Ambito
build-system

Direzione di ricerca

Start by reproducing with the compose.yaml in the issue (a build with entitlements: [network.host]) and docker compose build, then find where Compose assembles the Buildx Bake invocation and whether it can pass --allow. The issue says the Bake config already includes the entitlement, so the gap is in the command arguments. Done means the build succeeds with the entitlement granted, and the maintainers have settled whether to add a flag or grant it automatically.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

kind/bug status/0-triage
Description

When a Compose service declares the network.host build entitlement, docker compose build fails because Compose invokes Buildx Bake without passing --allow=network.host

This appears to be a compatibility issue with Buildx's entitlement validation when using --progress rawjson (https://github.com/docker/buildx/security/advisories/GHSA-gwr2-q96m-6682).

The Compose-generated Bake configuration correctly includes the requested entitlement, but the actual Bake invocation does not grant it. The docker compose build CLI does not expose an --allow option to resolve this.

Steps To Reproduce
  1. Create compose.yaml: 
    services:
  test:
    build:
      dockerfile_inline: "FROM alpine\nRUN --network=host true"
      entitlements: [network.host]
  2. Run: 
    docker compose build
Compose Version
Docker Compose version v5.6.0
Docker Environment
Client: Docker Engine - Community
 Version:    29.9.0
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.38.0
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v5.6.0
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 1
  Running: 0
  Paused: 0
  Stopped: 1
 Images: 29
 Server Version: 29.9.0
 Storage Driver: overlayfs
  driver-type: io.containerd.snapshotter.v1
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: b7a25261e029d68978bbf290df0a62fc819b3c51
 runc version: v1.5.2-0-g29dd3dc2
 init version: de40ad0
 Security Options:
  apparmor
   Profile: default
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.11.0-29-generic
 Operating System: Ubuntu 24.04.5 LTS
 OSType: linux
 Architecture: x86_64
 CPUs: 12
 Total Memory: 30.97GiB
 Name: ubuntu
 ID: d4182ace-77a6-4a65-98f3-2e4c558c561f
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
  ::1/128
 Live Restore Enabled: false
 Firewall Backend: iptables
  EnableUserlandProxy: true
  UserlandProxyPath: /usr/bin/docker-proxy
Anything else?
Actual behavior

The build fails with:

$ docker compose build
[+] Building 0.0s (1/1) FINISHED                                                                                                                  
 => [internal] load local bake definitions                                                                                                   0.0s
 => => reading from stdin 559B                                                                                                               0.0s
additional privileges requested: pass "--allow=network.host" to grant requested privileges
Expected behavior

docker compose build should provide a way to grant the requested build entitlement, or otherwise handle the required permission, so that the build can succeed.

Direct Buildx Bake works

The same build succeeds when invoking Buildx Bake directly and explicitly granting the requested entitlement.

  1. Create docker-bake.hcl 
    target "default" {
  dockerfile-inline = "FROM alpine\nRUN --network=host true"
  entitlements = ["network.host"]
}
  2. Run 
    docker buildx bake \
  --file docker-bake.hcl \
  --allow=network.host
Lingua principale
Go
Stelle
38.4k
Fork
5.9k
Merge medio
2g 2h
PR unite (30g)
67

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di docker/compose

Tutte le issue di docker/compose

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.