[BUG] docker compose build cannot grant network.host entitlement when using buildx bake

已关闭

#14,345 创建于 2026年10月14日 1 条评论 0 个 reaction 已指派 0 人在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度: 3/5
预计耗时: 1-2 天
新手友好度: 35/100

Issue 类型: 缺陷
描述清晰度: 基本清楚
活跃度: 活跃
技术栈: docker, docker-compose, go
领域: build-system

调研方向

Start by reproducing with the compose.yaml in the issue (a build with entitlements: [network.host]) and docker compose build, then find where Compose assembles the Buildx Bake invocation and whether it can pass --allow. The issue says the Bake config already includes the entitlement, so the gap is in the command arguments. Done means the build succeeds with the entitlement granted, and the maintainers have settled whether to add a flag or grant it automatically.

由索引模型根据 Issue 内容生成。

描述

kind/bug status/0-triage

Description

When a Compose service declares the network.host build entitlement, docker compose build fails because Compose invokes Buildx Bake without passing --allow=network.host

This appears to be a compatibility issue with Buildx's entitlement validation when using --progress rawjson (https://github.com/docker/buildx/security/advisories/GHSA-gwr2-q96m-6682).

The Compose-generated Bake configuration correctly includes the requested entitlement, but the actual Bake invocation does not grant it. The docker compose build CLI does not expose an --allow option to resolve this.

Steps To Reproduce

Create compose.yaml:

services:
  test:
    build:
      dockerfile_inline: "FROM alpine\nRUN --network=host true"
      entitlements: [network.host]

Run:
```
docker compose build
```

Compose Version

Docker Compose version v5.6.0

Docker Environment

Client: Docker Engine - Community
 Version:    29.9.0
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.38.0
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v5.6.0
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 1
  Running: 0
  Paused: 0
  Stopped: 1
 Images: 29
 Server Version: 29.9.0
 Storage Driver: overlayfs
  driver-type: io.containerd.snapshotter.v1
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: b7a25261e029d68978bbf290df0a62fc819b3c51
 runc version: v1.5.2-0-g29dd3dc2
 init version: de40ad0
 Security Options:
  apparmor
   Profile: default
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.11.0-29-generic
 Operating System: Ubuntu 24.04.5 LTS
 OSType: linux
 Architecture: x86_64
 CPUs: 12
 Total Memory: 30.97GiB
 Name: ubuntu
 ID: d4182ace-77a6-4a65-98f3-2e4c558c561f
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
  ::1/128
 Live Restore Enabled: false
 Firewall Backend: iptables
  EnableUserlandProxy: true
  UserlandProxyPath: /usr/bin/docker-proxy

Anything else?

Actual behavior

The build fails with:

$ docker compose build
[+] Building 0.0s (1/1) FINISHED                                                                                                                  
 => [internal] load local bake definitions                                                                                                   0.0s
 => => reading from stdin 559B                                                                                                               0.0s
additional privileges requested: pass "--allow=network.host" to grant requested privileges

Expected behavior

docker compose build should provide a way to grant the requested build entitlement, or otherwise handle the required permission, so that the build can succeed.

Direct Buildx Bake works

The same build succeeds when invoking Buildx Bake directly and explicitly granting the requested entitlement.

Create docker-bake.hcl

target "default" {
  dockerfile-inline = "FROM alpine\nRUN --network=host true"
  entitlements = ["network.host"]
}

Run

docker buildx bake \
  --file docker-bake.hcl \
  --allow=network.host

主要语言: Go
星标: 38.4k
派生: 5.9k
平均合并: 2 天 4 小时
30 天内合并 PR: 70

环境准备

提供 Dockerfile 或 Docker Compose 文件
有 Pull Request 模板
阅读贡献指南

从这里开始

先读完整个 Issue，再读项目的贡献指南。
在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
Fork 仓库，在一个分支上完成修改。
提交 Pull Request，并在描述里引用这个 Issue 编号。

docker/compose 的其他 Issue

[BUG] <title>
未关闭
- 哪里不对？
kind/bug status/0-triage

难度 5/5 一周以上新手友好度 10/100

docker/compose#14355 · 2026年10月17日创建

维护者通常 1 天内回复
Epic: Move service selection into the backend API instead of pre-filtering the project in the CLI
未关闭
- 哪里不对？
难度 5/5 一周以上新手友好度 15/100

docker/compose#14346 · 2026年10月15日创建

维护者通常 1 天内回复
Watch: exec mode
可能已有人在做 @glours 于 5 天前认领。未关闭
- 哪里不对？
kind/feature

docker/compose#14326 · 1 条评论 · 已指派 1 人 · 2026年10月12日创建

维护者通常 1 天内回复
Restore build concurrency limit now that bake supports it
可能已有人在做 @maxproske 于 1 天前认领。未关闭
- 哪里不对？
kind/feature

难度 3/5 1-2 天新手友好度 35/100

docker/compose#14313 · 2026年10月8日创建

维护者通常 1 天内回复
[BUG] `start -p <name>` treats an optional (`required: false`) dependency as required
可能重新可做关联的 PR 已关闭且未合并。未关闭
- 哪里不对？
难度 3/5 1-2 天新手友好度 22/100

docker/compose#14311 · 2026年10月8日创建

维护者通常 1 天内回复

查看 docker/compose 的全部 Issue

相似的 Issue

macOS: Tab skips buttons and links in a window unless system keyboard navigation is on
未关闭
- 哪里不对？
难度 2/5 1-3 小时新手友好度 82/100

egoist/mygo#473 · 2026年10月17日创建

维护者通常 1 天内回复
encoder produces invalid toml (missing comma)
未关闭
- 哪里不对？
难度 2/5 1-3 小时新手友好度 65/100

BurntSushi/toml#530 · 2026年10月17日创建
test: TestStopLetsARenewalEnd's 300ms call can end before the host starts the renewal under load ("the renewal never started")
未关闭
- 哪里不对？
难度 2/5 1-3 小时新手友好度 77/100

yetone/magpie#2743 · 2026年10月17日创建

维护者通常 1 天内回复
Own sends stored without quote; own-chat reactions stored under the LID chat (0.21.0)
未关闭
- 哪里不对？
clawsweeper:fix-shape-clear clawsweeper:queueable-fix clawsweeper:source-repro impact:session-state issue-rating: 🦞 diamond lobster no-stale P2

难度 2/5 1-3 小时新手友好度 74/100

openclaw/wacli#503 · 1 条评论 · 1 个 reaction · 2026年10月17日创建

维护者通常 1 天内回复
[Bug] rmqctl error diagnostics emit terminal control characters
可能已有人在做关联的 PR 仍在进行中或已合并。未关闭
- 哪里不对？
难度 2/5 1-3 小时新手友好度 81/100

apache/rocketmq-dashboard#6895 · 2026年10月17日创建

维护者通常 3 天内回复

更多 Go Issue

[BUG] docker compose build cannot grant network.host entitlement when using buildx bake

哪里不对？

评估

调研方向

描述

Description

Steps To Reproduce

Compose Version

Docker Environment

Anything else?

Actual behavior

Expected behavior

Direct Buildx Bake works

环境准备

从这里开始

docker/compose 的其他 Issue

哪里不对？

哪里不对？

哪里不对？

哪里不对？

哪里不对？

相似的 Issue

哪里不对？

哪里不对？

哪里不对？

哪里不对？

哪里不对？

把新 issue 发到你的邮箱