Build fails with fs.read entitlement error when dockerfile is outside the build context (buildx >= 0.37.2)
维护者通常 1 天内回复
评估
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 新手友好度
- 35/100
- Issue 类型
- 缺陷
- 描述清晰度
- 描述清楚
- 活跃度
- 停滞
- 技术栈
- docker, docker-compose, go
- 领域
- build-system
调研方向
Start in pkg/compose/build_bake.go and inspect localBuildPaths, which currently grants fs.read access for build contexts but not the Dockerfile path. Reproduce with a Compose service whose Dockerfile is outside its build context, then check existing build-bake tests for coverage. Done means a local external Dockerfile is included in the fs.read allowlist while dockerfile_inline remains unaffected; an open linked pull request is already addressing this issue.
由索引模型根据 Issue 内容生成。
描述
Description
Since buildx v0.37.2 (GHSA-gwr2-q96m-6682), buildx bake --progress rawjson enforces filesystem entitlements instead of skipping the consent check. Compose always invokes bake that way, but localBuildPaths in pkg/compose/build_bake.go only grants --allow fs.read= for build.context and build.additional_contexts — not for build.dockerfile. A service whose Dockerfile lives outside its build context therefore no longer builds. Before buildx v0.37.2 the missing grant went unnoticed because the check was skipped under rawjson.
This breaks every Dev Container that uses a Compose service with build:: the devcontainer CLI writes Dockerfile-with-features into a temp directory and points dockerfile: at it through an override file (dockerCompose.ts), which fails with:
additional privileges requested: pass "--allow=fs.read=/private/var/folders/…/T/devcontainercli/container-features/0.76.0-…/Dockerfile-with-features" to grant requested privileges
The code is unchanged in v5.6.0 and on main.
Steps To Reproduce
mkdir -p /tmp/outside && echo 'FROM alpine' > /tmp/outside/Dockerfile
mkdir -p /tmp/repro && cd /tmp/repro
cat > compose.yaml <<'EOF'
services:
app:
build:
context: .
dockerfile: /tmp/outside/Dockerfile
EOF
docker compose build
[+] Building 0.0s (1/1) FINISHED
=> [internal] load local bake definitions 0.0s
=> => reading from stdin 466B 0.0s
[+] build 0/1
⠋ Image repro-app Building 0.1s
additional privileges requested: pass "--allow=fs.read=../outside/Dockerfile" to grant requested privileges
Compose Version
Docker Compose version v5.5.1
Docker Environment
macOS (Apple Silicon), Docker Desktop 4.94.0 (241994), buildx v0.37.2
Anything else?
Workaround: BUILDX_BAKE_ENTITLEMENTS_FS=0, which disables the check for all paths.
Suggested fix: add the resolved Dockerfile path to the fs.read allowlist when it is a local path outside the context (dockerfile_inline is unaffected).
- 主要语言
- Go
- 星标
- 38.4k
- 派生
- 5.9k
- 平均合并
- 2 天 5 小时
- 30 天内合并 PR
- 62
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
docker/compose 的其他 Issue
-
Watch: exec mode可能已有人在做 @glours 于 2 天前认领。 未关闭kind/feature
docker/compose#14326 · 1 条评论 · 已指派 1 人 ·
维护者通常 1 天内回复
-
kind/feature
难度 3/5 1-2 天 新手友好度 35/100
维护者通常 1 天内回复
-
[BUG] `start -p <name>` treats an optional (`required: false`) dependency as required可能重新可做 关联的 PR 已关闭且未合并。 未关闭
难度 3/5 1-2 天 新手友好度 22/100
维护者通常 1 天内回复
-
[BUG] `mode` attribute in `configs` works but raises an unsupported warning可能已有人在做 @ndeloof 于 6 天前认领。 未关闭kind/bug
难度 3/5 1-2 天 新手友好度 58/100
docker/compose#14288 · 4 条评论 ·
维护者通常 1 天内回复
-
[BUG] Warns about uid/gid, but with inline configs they do work可能已有人在做 @ndeloof 于 6 天前认领。 未关闭kind/bug
难度 3/5 1-2 天 新手友好度 68/100
docker/compose#14283 · 2 条评论 ·
维护者通常 1 天内回复
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 70/100
limitlessprojects/Go-Hybrid#50 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
-
难度 2/5 1-3 小时 新手友好度 75/100
vinyldns/go-vinyldns#106 ·
-
难度 2/5 1-3 小时 新手友好度 82/100
praetorian-inc/augustus#334 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
ClickHouse/clickhouse-go#2066 ·
维护者通常 1 天内回复