{"id":13400378,"url":"https://github.com/moby/buildkit","last_synced_at":"2026-02-25T03:02:09.800Z","repository":{"id":37385225,"uuid":"92969352","full_name":"moby/buildkit","owner":"moby","description":"concurrent, cache-efficient, and Dockerfile-agnostic builder toolkit","archived":false,"fork":false,"pushed_at":"2026-02-20T18:34:30.000Z","size":57203,"stargazers_count":9776,"open_issues_count":929,"forks_count":1366,"subscribers_count":122,"default_branch":"master","last_synced_at":"2026-02-20T21:23:47.198Z","etag":null,"topics":["builder","buildkit","cloud-native","containers","docker","dockerfile","go","golang","oci","oci-image"],"latest_commit_sha":null,"homepage":"https://github.com/moby/moby/issues/34227","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/moby.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":".github/CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":".github/CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":".github/SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":"AUTHORS","dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":"MAINTAINERS","copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2017-05-31T17:04:10.000Z","updated_at":"2026-02-20T21:04:08.000Z","dependencies_parsed_at":"2022-07-13T18:21:08.800Z","dependency_job_id":"8140bc41-b043-4118-9c2d-9e2bdc7429d6","html_url":"https://github.com/moby/buildkit","commit_stats":{"total_commits":3909,"total_committers":310,"mean_commits":"12.609677419354838","dds":0.632898439498593,"last_synced_commit":"4438f4f75c1546a125ece011106eb2b18289f938"},"previous_names":["tonistiigi/buildkit_poc"],"tags_count":287,"template":false,"template_full_name":null,"purl":"pkg:github/moby/buildkit","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moby%2Fbuildkit","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moby%2Fbuildkit/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moby%2Fbuildkit/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moby%2Fbuildkit/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/moby","download_url":"https://codeload.github.com/moby/buildkit/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moby%2Fbuildkit/sbom","scorecard":{"id":637546,"data":{"date":"2025-08-11","repo":{"name":"github.com/moby/buildkit","commit":"f9b9b363d6a6777259e435987a1df0d6a314ec8a"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":7.3,"checks":[{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Maintained","score":10,"reason":"30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Security-Policy","score":9,"reason":"security policy file detected","details":["Info: security policy file detected: .github/SECURITY.md:1","Info: Found linked content: .github/SECURITY.md:1","Warn: One or no descriptive hints of disclosure, vulnerability, and/or timelines in security policy","Info: Found text in security policy: .github/SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Token-Permissions","score":9,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'contents' permission set to 'read': .github/workflows/buildkit.yml:158","Info: jobLevel 'contents' permission set to 'read': .github/workflows/buildkit.yml:234","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/buildkit.yml:277","Info: jobLevel 'contents' permission set to 'read': .github/workflows/frontend.yml:138","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/frontend.yml:182","Info: jobLevel 'contents' permission set to 'read': .github/workflows/labeler.yml:13","Info: jobLevel 'contents' permission set to 'read': .github/workflows/pr-assign-author.yml:16","Info: topLevel 'contents' permission set to 'read': .github/workflows/.test.yml:6","Info: topLevel 'contents' permission set to 'read': .github/workflows/buildkit.yml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/buildx-image.yml:18","Info: topLevel 'contents' permission set to 'read': .github/workflows/dockerd.yml:5","Info: topLevel 'contents' permission set to 'read': .github/workflows/docs-upstream.yml:12","Info: topLevel 'contents' permission set to 'read': .github/workflows/frontend.yml:9","Warn: no topLevel permission defined: .github/workflows/labeler.yml:1","Info: topLevel 'contents' permission set to 'read': .github/workflows/pr-assign-author.yml:4","Info: topLevel 'contents' permission set to 'read': .github/workflows/test-os.yml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/validate.yml:9"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Pinned-Dependencies","score":-1,"reason":"internal error: internal error: invalid Dockerfile: ENV must have two arguments","details":null,"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Signed-Releases","score":0,"reason":"Project has not signed or included provenance with any releases.","details":["Warn: release artifact v0.23.2 not signed: https://api.github.com/repos/moby/buildkit/releases/229187737","Warn: release artifact v0.23.1 not signed: https://api.github.com/repos/moby/buildkit/releases/226623999","Warn: release artifact v0.23.0 not signed: https://api.github.com/repos/moby/buildkit/releases/225856747","Warn: release artifact v0.23.2 does not have provenance: https://api.github.com/repos/moby/buildkit/releases/229187737","Warn: release artifact v0.23.1 does not have provenance: https://api.github.com/repos/moby/buildkit/releases/226623999","Warn: release artifact v0.23.0 does not have provenance: https://api.github.com/repos/moby/buildkit/releases/225856747"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/frontend.yml:82"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 30 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-21T09:38:29.806Z","repository_id":37385225,"created_at":"2025-08-21T09:38:29.807Z","updated_at":"2025-08-21T09:38:29.807Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29809138,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-24T22:43:48.403Z","status":"online","status_checked_at":"2026-02-25T02:00:07.329Z","response_time":61,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["builder","buildkit","cloud-native","containers","docker","dockerfile","go","golang","oci","oci-image"],"created_at":"2024-07-30T19:00:51.363Z","updated_at":"2026-02-25T03:02:09.765Z","avatar_url":"https://github.com/moby.png","language":"Go","readme":"[![asciicinema example](https://asciinema.org/a/gPEIEo1NzmDTUu2bEPsUboqmU.png)](https://asciinema.org/a/gPEIEo1NzmDTUu2bEPsUboqmU)\n\n# BuildKit \u003c!-- omit in toc --\u003e\n\n[![GitHub Release](https://img.shields.io/github/release/moby/buildkit.svg?style=flat-square)](https://github.com/moby/buildkit/releases/latest)\n[![PkgGoDev](https://img.shields.io/badge/go.dev-docs-007d9c?style=flat-square\u0026logo=go\u0026logoColor=white)](https://pkg.go.dev/github.com/moby/buildkit/client/llb)\n[![CI BuildKit Status](https://img.shields.io/github/actions/workflow/status/moby/buildkit/buildkit.yml?label=buildkit\u0026logo=github\u0026style=flat-square)](https://github.com/moby/buildkit/actions?query=workflow%3Abuildkit)\n[![CI Frontend Status](https://img.shields.io/github/actions/workflow/status/moby/buildkit/frontend.yml?label=frontend\u0026logo=github\u0026style=flat-square)](https://github.com/moby/buildkit/actions?query=workflow%3Afrontend)\n[![Go Report Card](https://goreportcard.com/badge/github.com/moby/buildkit?style=flat-square)](https://goreportcard.com/report/github.com/moby/buildkit)\n[![Codecov](https://img.shields.io/codecov/c/github/moby/buildkit?logo=codecov\u0026style=flat-square)](https://codecov.io/gh/moby/buildkit)\n\nBuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.\n\nKey features:\n\n-   Automatic garbage collection\n-   Extendable frontend formats\n-   Concurrent dependency resolution\n-   Efficient instruction caching\n-   Build cache import/export\n-   Nested build job invocations\n-   Distributable workers\n-   Multiple output formats\n-   Pluggable architecture\n-   Execution without root privileges\n\nRead the proposal from https://github.com/moby/moby/issues/32925\n\nIntroductory blog post https://blog.mobyproject.org/introducing-buildkit-17e056cc5317\n\nJoin `#buildkit` channel on [Docker Community Slack](https://dockr.ly/comm-slack)\n\n\u003e [!NOTE]\n\u003e If you are visiting this repo for the usage of BuildKit-only Dockerfile features\n\u003e like `RUN --mount=type=(bind|cache|tmpfs|secret|ssh)`, please refer to the\n\u003e [Dockerfile reference](https://docs.docker.com/engine/reference/builder/).\n\n\u003e [!NOTE]\n\u003e `docker build` [uses Buildx and BuildKit by default](https://docs.docker.com/build/architecture/) since Docker Engine 23.0.\n\u003e You don't need to read this document unless you want to use the full-featured\n\u003e standalone version of BuildKit.\n\n\u003c!-- START doctoc generated TOC please keep comment here to allow auto update --\u003e\n\u003c!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE --\u003e\n\n- [Used by](#used-by)\n- [Quick start](#quick-start)\n  - [Linux Setup](#linux-setup)\n  - [Windows Setup](#windows-setup)\n  - [macOS Setup](#macos-setup)\n  - [Build from source](#build-from-source)\n  - [Exploring LLB](#exploring-llb)\n  - [Exploring Dockerfiles](#exploring-dockerfiles)\n    - [Building a Dockerfile with `buildctl`](#building-a-dockerfile-with-buildctl)\n    - [Building a Dockerfile using external frontend](#building-a-dockerfile-using-external-frontend)\n  - [Output](#output)\n    - [Image/Registry](#imageregistry)\n    - [Local directory](#local-directory)\n    - [Docker tarball](#docker-tarball)\n    - [OCI tarball](#oci-tarball)\n    - [containerd image store](#containerd-image-store)\n- [Cache](#cache)\n  - [Garbage collection](#garbage-collection)\n  - [Export cache](#export-cache)\n    - [Inline (push image and cache together)](#inline-push-image-and-cache-together)\n    - [Registry (push image and cache separately)](#registry-push-image-and-cache-separately)\n    - [Local directory](#local-directory-1)\n    - [GitHub Actions cache (experimental)](#github-actions-cache-experimental)\n    - [S3 cache (experimental)](#s3-cache-experimental)\n    - [Azure Blob Storage cache (experimental)](#azure-blob-storage-cache-experimental)\n  - [Consistent hashing](#consistent-hashing)\n- [Metadata](#metadata)\n- [Systemd socket activation](#systemd-socket-activation)\n- [Expose BuildKit as a TCP service](#expose-buildkit-as-a-tcp-service)\n  - [Load balancing](#load-balancing)\n- [Containerizing BuildKit](#containerizing-buildkit)\n  - [Podman](#podman)\n  - [Nerdctl](#nerdctl)\n  - [Kubernetes](#kubernetes)\n  - [Daemonless](#daemonless)\n- [OpenTelemetry support](#opentelemetry-support)\n- [Running BuildKit without root privileges](#running-buildkit-without-root-privileges)\n- [Building multi-platform images](#building-multi-platform-images)\n  - [Configuring `buildctl`](#configuring-buildctl)\n    - [Color Output Controls](#color-output-controls)\n    - [Number of log lines (for active steps in tty mode)](#number-of-log-lines-for-active-steps-in-tty-mode)\n- [Contributing](#contributing)\n\n\u003c!-- END doctoc generated TOC please keep comment here to allow auto update --\u003e\n\n## Used by\n\nBuildKit is used by the following projects:\n\n-   [Moby \u0026 Docker](https://github.com/moby/moby/pull/37151) (`DOCKER_BUILDKIT=1 docker build`)\n-   [img](https://github.com/genuinetools/img)\n-   [OpenFaaS Cloud](https://github.com/openfaas/openfaas-cloud)\n-   [container build interface](https://github.com/containerbuilding/cbi)\n-   [Tekton Pipelines](https://github.com/tektoncd/catalog) (formerly [Knative Build Templates](https://github.com/knative/build-templates))\n-   [the Sanic build tool](https://github.com/distributed-containers-inc/sanic)\n-   [vab](https://github.com/stellarproject/vab)\n-   [Rio](https://github.com/rancher/rio)\n-   [kim](https://github.com/rancher/kim)\n-   [PouchContainer](https://github.com/alibaba/pouch)\n-   [Docker buildx](https://github.com/docker/buildx)\n-   [Okteto Cloud](https://okteto.com/)\n-   [Earthly earthfiles](https://github.com/vladaionescu/earthly)\n-   [Gitpod](https://github.com/gitpod-io/gitpod)\n-   [Dagger](https://dagger.io)\n-   [envd](https://github.com/tensorchord/envd/)\n-   [Depot](https://depot.dev)\n-   [Namespace](https://namespace.so)\n-   [Unikraft](https://unikraft.org)\n-   [DevZero](https://devzero.io)\n-   [dacc](https://github.com/r2d4/dacc)\n\n## Quick start\n\n:information_source: For Kubernetes deployments, see [`examples/kubernetes`](./examples/kubernetes).\n\nBuildKit is composed of the `buildkitd` daemon and the `buildctl` client.\nWhile the `buildctl` client is available for Linux, macOS, and Windows, the `buildkitd` daemon is only available for Linux and *Windows currently.\n\nThe latest binaries of BuildKit are available [here](https://github.com/moby/buildkit/releases) for Linux, macOS, and Windows.\n\n\n### Linux Setup\n\nThe `buildkitd` daemon requires the following components to be installed:\n-   [runc](https://github.com/opencontainers/runc) or [crun](https://github.com/containers/crun)\n-   [containerd](https://github.com/containerd/containerd) (if you want to use containerd worker)\n\n**Starting the `buildkitd` daemon:**\nYou need to run `buildkitd` as the root user on the host.\n\n```bash\n$ sudo buildkitd\n```\n\nTo run `buildkitd` as a non-root user, see [`docs/rootless.md`](docs/rootless.md).\n\nThe buildkitd daemon supports two worker backends: OCI (runc) and containerd.\n\nBy default, the OCI (runc) worker is used. You can set `--oci-worker=false --containerd-worker=true` to use the containerd worker.\n\nWe are open to adding more backends.\n\nTo start the buildkitd daemon using systemd socket activation, you can install the buildkit systemd unit files.\nSee [Systemd socket activation](#systemd-socket-activation)\n\nThe buildkitd daemon listens gRPC API on `/run/buildkit/buildkitd.sock` by default, but you can also use TCP sockets.\nSee [Expose BuildKit as a TCP service](#expose-buildkit-as-a-tcp-service).\n\n### Windows Setup\n\nSee instructions and notes at [`docs/windows.md`](./docs/windows.md).\n\n### macOS Setup\n\n[Homebrew formula](https://formulae.brew.sh/formula/buildkit) (unofficial) is available for macOS.\n```console\n$ brew install buildkit\n```\n\nThe Homebrew formula does not contain the daemon (`buildkitd`).\n\nFor example, [Lima](https://lima-vm.io) can be used for launching the daemon inside a Linux VM.\n```console\nbrew install lima\nlimactl start template://buildkit\nexport BUILDKIT_HOST=\"unix://$HOME/.lima/buildkit/sock/buildkitd.sock\"\n```\n\n### Build from source\n\nTo build BuildKit from source, see [`.github/CONTRIBUTING.md`](./.github/CONTRIBUTING.md).\n\nFor a `buildctl` reference, see [this document](./docs/reference/buildctl.md).\n\n### Exploring LLB\n\nBuildKit builds are based on a binary intermediate format called LLB that is used for defining the dependency graph for processes running part of your build. tl;dr: LLB is to Dockerfile what LLVM IR is to C.\n\n-   Marshaled as Protobuf messages\n-   Concurrently executable\n-   Efficiently cacheable\n-   Vendor-neutral (i.e. non-Dockerfile languages can be easily implemented)\n\nSee [`solver/pb/ops.proto`](./solver/pb/ops.proto) for the format definition, and see [`./examples/README.md`](./examples/README.md) for example LLB applications.\n\nCurrently, the following high-level languages have been implemented for LLB:\n\n-   Dockerfile (See [Exploring Dockerfiles](#exploring-dockerfiles))\n-   [Buildpacks](https://github.com/tonistiigi/buildkit-pack)\n-   [Mockerfile](https://matt-rickard.com/building-a-new-dockerfile-frontend/)\n-   [Gockerfile](https://github.com/po3rin/gockerfile)\n-   [bldr (Pkgfile)](https://github.com/talos-systems/bldr/)\n-   [HLB](https://github.com/openllb/hlb)\n-   [Earthfile (Earthly)](https://github.com/earthly/earthly)\n-   [Cargo Wharf (Rust)](https://github.com/denzp/cargo-wharf)\n-   [Nix](https://github.com/reproducible-containers/buildkit-nix)\n-   [mopy (Python)](https://github.com/cmdjulian/mopy)\n-   [envd (starlark)](https://github.com/tensorchord/envd/)\n-   [Blubber](https://gitlab.wikimedia.org/repos/releng/blubber)\n-   [Bass](https://github.com/vito/bass)\n-   [kraft.yaml (Unikraft)](https://github.com/unikraft/kraftkit/tree/staging/tools/dockerfile-llb-frontend)\n-   [r2d4/llb (JSON Gateway)](https://github.com/r2d4/llb)\n-   [Massé](https://github.com/marxarelli/masse)\n-   [DALEC](https://github.com/project-dalec/dalec)\n-   (open a PR to add your own language)\n\n### Exploring Dockerfiles\n\nFrontends are components that run inside BuildKit and convert any build definition to LLB. There is a special frontend called gateway (`gateway.v0`) that allows using any image as a frontend.\n\nDuring development, Dockerfile frontend (`dockerfile.v0`) is also part of the BuildKit repo. In the future, this will be moved out, and Dockerfiles can be built using an external image.\n\n#### Building a Dockerfile with `buildctl`\n\n```bash\nbuildctl build \\\n    --frontend=dockerfile.v0 \\\n    --local context=. \\\n    --local dockerfile=.\n# or\nbuildctl build \\\n    --frontend=dockerfile.v0 \\\n    --local context=. \\\n    --local dockerfile=. \\\n    --opt target=foo \\\n    --opt build-arg:foo=bar\n```\n\n`--local` exposes local source files from client to the builder. `context` and `dockerfile` are the names Dockerfile frontend looks for build context and Dockerfile location.\n\nIf the Dockerfile has a different filename it can be specified with `--opt filename=./Dockerfile-alternative`.\n\n#### Building a Dockerfile using external frontend\n\nExternal versions of the Dockerfile frontend are pushed to https://hub.docker.com/r/docker/dockerfile-upstream and https://hub.docker.com/r/docker/dockerfile and can be used with the gateway frontend. The source for the external frontend is currently located in `./frontend/dockerfile/cmd/dockerfile-frontend` but will move out of this repository in the future ([#163](https://github.com/moby/buildkit/issues/163)). For automatic build from master branch of this repository `docker/dockerfile-upstream:master` or `docker/dockerfile-upstream:master-labs` image can be used.\n\n```bash\nbuildctl build \\\n    --frontend gateway.v0 \\\n    --opt source=docker/dockerfile \\\n    --local context=. \\\n    --local dockerfile=.\nbuildctl build \\\n    --frontend gateway.v0 \\\n    --opt source=docker/dockerfile \\\n    --opt context=https://github.com/moby/moby.git \\\n    --opt build-arg:APT_MIRROR=cdn-fastly.deb.debian.org\n```\n\n### Output\n\nBy default, the build result and intermediate cache will only remain internally in BuildKit. An output needs to be specified to retrieve the result.\n\n#### Image/Registry\n\n```bash\nbuildctl build ... --output type=image,name=docker.io/username/image,push=true\n```\n\nTo export the image to multiple registries:\n\n```bash\nbuildctl build ... --output type=image,\\\"name=docker.io/username/image,docker.io/username2/image2\\\",push=true\n```\n\nTo export the cache embed with the image and pushing them to registry together, type `registry` is required to import the cache, you should specify `--export-cache type=inline` and `--import-cache type=registry,ref=...`. To export the cache to a local directly, you should specify `--export-cache type=local`.\nDetails in [Export cache](#export-cache).\n\n```bash\nbuildctl build ...\\\n  --output type=image,name=docker.io/username/image,push=true \\\n  --export-cache type=inline \\\n  --import-cache type=registry,ref=docker.io/username/image\n```\n\nKeys supported by image output:\n* `name=\u003cvalue\u003e`: specify image name(s)\n* `push=true`: push after creating the image\n* `push-by-digest=true`: push unnamed image\n* `registry.insecure=true`: push to insecure HTTP registry\n* `oci-mediatypes=true`: use OCI mediatypes in configuration JSON instead of Docker's\n* `oci-artifact=false`: use OCI artifact format for attestations\n* `unpack=true`: unpack image after creation (for use with containerd)\n* `dangling-name-prefix=\u003cvalue\u003e`: name image with `prefix@\u003cdigest\u003e`, used for anonymous images\n* `name-canonical=true`: add additional canonical name `name@\u003cdigest\u003e`\n* `compression=\u003cuncompressed|gzip|estargz|zstd\u003e`: choose compression type for layers newly created and cached, gzip is default value. estargz should be used with `oci-mediatypes=true`.\n* `compression-level=\u003cvalue\u003e`: compression level for gzip, estargz (0-9) and zstd (0-22)\n* `rewrite-timestamp=true`: rewrite the file timestamps to the `SOURCE_DATE_EPOCH` value.\n   See [`docs/build-repro.md`](docs/build-repro.md) for how to specify the `SOURCE_DATE_EPOCH` value.\n* `force-compression=true`: forcefully apply `compression` option to all layers (including already existing layers)\n* `store=true`: store the result images to the worker's (e.g. containerd) image store as well as ensures that the image has all blobs in the content store (default `true`). Ignored if the worker doesn't have image store (e.g. OCI worker).\n* `annotation.\u003ckey\u003e=\u003cvalue\u003e`: attach an annotation with the respective `key` and `value` to the built image\n  * Using the extended syntaxes, `annotation-\u003ctype\u003e.\u003ckey\u003e=\u003cvalue\u003e`, `annotation[\u003cplatform\u003e].\u003ckey\u003e=\u003cvalue\u003e` and both combined with `annotation-\u003ctype\u003e[\u003cplatform\u003e].\u003ckey\u003e=\u003cvalue\u003e`, allows configuring exactly where to attach the annotation.\n  * `\u003ctype\u003e` specifies what object to attach to, and can be any of `manifest` (the default), `manifest-descriptor`, `index` and `index-descriptor`\n  * `\u003cplatform\u003e` specifies which objects to attach to (by default, all), and is the same key passed into the `platform` opt, see [`docs/multi-platform.md`](docs/multi-platform.md).\n  * See [`docs/annotations.md`](docs/annotations.md) for more details.\n\nIf credentials are required, `buildctl` will attempt to read Docker configuration file `$DOCKER_CONFIG/config.json`.\n`$DOCKER_CONFIG` defaults to `~/.docker`.\n\n#### Local directory\n\nThe local client will copy the files directly to the client. This is useful if BuildKit is being used for building something else than container images.\n\n```bash\nbuildctl build ... --output type=local,dest=path/to/output-dir\n```\n\nTo export specific files use multi-stage builds with a scratch stage and copy the needed files into that stage with `COPY --from`.\n\n```dockerfile\n...\nFROM scratch as testresult\n\nCOPY --from=builder /usr/src/app/testresult.xml .\n...\n```\n\n```bash\nbuildctl build ... --opt target=testresult --output type=local,dest=path/to/output-dir\n```\n\nWith a [multi-platform build](docs/multi-platform.md), a subfolder matching\neach target platform will be created in the destination directory:\n\n```dockerfile\nFROM busybox AS build\nARG TARGETOS\nARG TARGETARCH\nRUN mkdir /out \u0026\u0026 echo foo \u003e /out/hello-$TARGETOS-$TARGETARCH\n\nFROM scratch\nCOPY --from=build /out /\n```\n\n```bash\n$ buildctl build \\\n  --frontend dockerfile.v0 \\\n  --opt platform=linux/amd64,linux/arm64 \\\n  --output type=local,dest=./bin/release\n\n$ tree ./bin\n./bin/\n└── release\n    ├── linux_amd64\n    │   └── hello-linux-amd64\n    └── linux_arm64\n        └── hello-linux-arm64\n```\n\nYou can set `platform-split=false` to merge files from all platforms together\ninto same directory:\n\n```bash\n$ buildctl build \\\n  --frontend dockerfile.v0 \\\n  --opt platform=linux/amd64,linux/arm64 \\\n  --output type=local,dest=./bin/release,platform-split=false\n\n$ tree ./bin\n./bin/\n└── release\n    ├── hello-linux-amd64\n    └── hello-linux-arm64\n```\n\nTar exporter is similar to local exporter but transfers the files through a tarball.\n\n```bash\nbuildctl build ... --output type=tar,dest=out.tar\nbuildctl build ... --output type=tar \u003e out.tar\n```\n\n#### Docker tarball\n\n```bash\n# exported tarball is also compatible with OCI spec\nbuildctl build ... --output type=docker,name=myimage | docker load\n```\n\n#### OCI tarball\n\n```bash\nbuildctl build ... --output type=oci,dest=path/to/output.tar\nbuildctl build ... --output type=oci \u003e output.tar\n```\n\n#### containerd image store\n\nThe containerd worker needs to be used\n\n```bash\nbuildctl build ... --output type=image,name=docker.io/username/image\nctr --namespace=buildkit images ls\n```\n\nTo change the containerd namespace, you need to change `worker.containerd.namespace` in [`/etc/buildkit/buildkitd.toml`](./docs/buildkitd.toml.md).\n\n## Cache\n\nTo show local build cache (`/var/lib/buildkit`):\n\n```bash\nbuildctl du -v\n```\n\nTo prune local build cache:\n```bash\nbuildctl prune\n```\n\n### Garbage collection\n\nSee [`./docs/buildkitd.toml.md`](./docs/buildkitd.toml.md).\n\n### Export cache\n\nBuildKit supports the following cache exporters:\n* `inline`: embed the cache into the image, and push them to the registry together\n* `registry`: push the image and the cache separately\n* `local`: export to a local directory\n* `gha`: export to GitHub Actions cache\n\nIn most case you want to use the `inline` cache exporter.\nHowever, note that the `inline` cache exporter only supports `min` cache mode. \nTo enable `max` cache mode, push the image and the cache separately by using `registry` cache exporter.\n\n`inline` and `registry` exporters both store the cache in the registry. For importing the cache, `type=registry` is sufficient for both, as specifying the cache format is not necessary.\n\n#### Inline (push image and cache together)\n\n```bash\nbuildctl build ... \\\n  --output type=image,name=docker.io/username/image,push=true \\\n  --export-cache type=inline \\\n  --import-cache type=registry,ref=docker.io/username/image\n```\n\nNote that the inline cache is not imported unless [`--import-cache type=registry,ref=...`](#registry-push-image-and-cache-separately) is provided.\n\nInline cache embeds cache metadata into the image config. The layers in the image will be left untouched compared to the image with no cache information.\n\n:information_source: Docker-integrated BuildKit (`DOCKER_BUILDKIT=1 docker build`) and `docker buildx`requires \n`--build-arg BUILDKIT_INLINE_CACHE=1` to be specified to enable the `inline` cache exporter.\nHowever, the standalone `buildctl` does NOT require `--opt build-arg:BUILDKIT_INLINE_CACHE=1` and the build-arg is simply ignored.\n\n#### Registry (push image and cache separately)\n\n```bash\nbuildctl build ... \\\n  --output type=image,name=localhost:5000/myrepo:image,push=true \\\n  --export-cache type=registry,ref=localhost:5000/myrepo:buildcache \\\n  --import-cache type=registry,ref=localhost:5000/myrepo:buildcache\n```\n\n`--export-cache` options:\n* `type=registry`\n* `mode=\u003cmin|max\u003e`: specify cache layers to export (default: `min`)\n  * `min`: only export layers for the resulting image\n  * `max`: export all the layers of all intermediate steps\n* `ref=\u003cref\u003e`: specify repository reference to store cache, e.g. `docker.io/user/image:tag`\n* `image-manifest=\u003ctrue|false\u003e`: whether to export cache manifest as an OCI-compatible image manifest rather than a manifest list/index (default: `true` since BuildKit `v0.21`, must be used with `oci-mediatypes=true`)\n* `oci-mediatypes=\u003ctrue|false\u003e`: whether to use OCI mediatypes in exported manifests (default: `true`, since BuildKit `v0.8`)\n* `compression=\u003cuncompressed|gzip|estargz|zstd\u003e`: choose compression type for layers newly created and cached, gzip is default value. estargz and zstd should be used with `oci-mediatypes=true`\n* `compression-level=\u003cvalue\u003e`: choose compression level for gzip, estargz (0-9) and zstd (0-22)\n* `force-compression=true`: forcibly apply `compression` option to all layers\n* `ignore-error=\u003cfalse|true\u003e`: specify if error is ignored in case cache export fails (default: `false`)\n\n`--import-cache` options:\n* `type=registry`\n* `ref=\u003cref\u003e`: specify repository reference to retrieve cache from, e.g. `docker.io/user/image:tag`\n\n#### Local directory\n\n```bash\nbuildctl build ... --export-cache type=local,dest=path/to/output-dir\nbuildctl build ... --import-cache type=local,src=path/to/input-dir\n```\n\nThe directory layout conforms to OCI Image Spec v1.0.\n\n`--export-cache` options:\n* `type=local`\n* `mode=\u003cmin|max\u003e`: specify cache layers to export (default: `min`)\n  * `min`: only export layers for the resulting image\n  * `max`: export all the layers of all intermediate steps\n* `dest=\u003cpath\u003e`: destination directory for cache exporter\n* `tag=\u003ctag\u003e`: specify custom tag of image to write to local index (default: `latest`)\n* `image-manifest=\u003ctrue|false\u003e`: whether to export cache manifest as an OCI-compatible image manifest rather than a manifest list/index (default: `true` since BuildKit `v0.21`, must be used with `oci-mediatypes=true`)\n* `oci-mediatypes=\u003ctrue|false\u003e`: whether to use OCI mediatypes in exported manifests (default `true`, since BuildKit `v0.8`)\n* `compression=\u003cuncompressed|gzip|estargz|zstd\u003e`: choose compression type for layers newly created and cached, gzip is default value. estargz and zstd should be used with `oci-mediatypes=true`.\n* `compression-level=\u003cvalue\u003e`: compression level for gzip, estargz (0-9) and zstd (0-22)\n* `force-compression=true`: forcibly apply `compression` option to all layers\n* `ignore-error=\u003cfalse|true\u003e`: specify if error is ignored in case cache export fails (default: `false`)\n\n`--import-cache` options:\n* `type=local`\n* `src=\u003cpath\u003e`: source directory for cache importer\n* `tag=\u003ctag\u003e`: specify custom tag of image to read from local index (default: `latest`)\n* `digest=sha256:\u003csha256digest\u003e`: specify explicit digest of the manifest list to import\n\n#### GitHub Actions cache (experimental)\n\n```bash\nbuildctl build ... \\\n  --output type=image,name=docker.io/username/image,push=true \\\n  --export-cache type=gha \\\n  --import-cache type=gha\n```\n\nGitHub Actions cache saves both cache metadata and layers to GitHub's Cache service. This cache currently has a [size limit of 10GB](https://docs.github.com/en/actions/advanced-guides/caching-dependencies-to-speed-up-workflows#usage-limits-and-eviction-policy) that is shared across different caches in the repo. If you exceed this limit, GitHub will save your cache but will begin evicting caches until the total size is less than 10 GB. Recycling caches too often can result in slower runtimes overall.\n\nSimilarly to using [actions/cache](https://github.com/actions/cache), caches are [scoped by branch](https://docs.github.com/en/actions/advanced-guides/caching-dependencies-to-speed-up-workflows#restrictions-for-accessing-a-cache), with the default and target branches being available to every branch.\n\nFollowing attributes are required to authenticate against the [GitHub Actions Cache service API](https://github.com/tonistiigi/go-actions-cache/blob/master/api.md#authentication):\n* `url`: Cache server URL (default `$ACTIONS_CACHE_URL` or fallback to `$ACTIONS_RESULTS_URL`)\n* `url_v2`: Cache v2 server URL if `$ACTIONS_CACHE_SERVICE_V2` set on the runner (default `$ACTIONS_RESULTS_URL`)\n* `token`: Access token (default `$ACTIONS_RUNTIME_TOKEN`)\n\n:information_source: This type of cache can be used with [Docker Build Push Action](https://github.com/docker/build-push-action)\nwhere `url` and `token` will be automatically set. To use this backend in an inline `run` step, you have to include [crazy-max/ghaction-github-runtime](https://github.com/crazy-max/ghaction-github-runtime)\nin your workflow to expose the runtime.\n\n`--export-cache` options:\n* `type=gha`\n* `mode=\u003cmin|max\u003e`: specify cache layers to export (default: `min`)\n  * `min`: only export layers for the resulting image\n  * `max`: export all the layers of all intermediate steps\n* `scope=\u003cscope\u003e`: which scope cache object belongs to (default `buildkit`)\n* `ignore-error=\u003cfalse|true\u003e`: specify if error is ignored in case cache export fails (default: `false`)\n* `timeout=\u003cduration\u003e`: sets the timeout duration for cache export (default: `10m`)\n\n`--import-cache` options:\n* `type=gha`\n* `scope=\u003cscope\u003e`: which scope cache object belongs to (default `buildkit`)\n* `timeout=\u003cduration\u003e`: sets the timeout duration for cache import (default: `10m`)\n\n#### S3 cache (experimental)\n\n```bash\nbuildctl build ... \\\n  --output type=image,name=docker.io/username/image,push=true \\\n  --export-cache type=s3,region=eu-west-1,bucket=my_bucket,name=my_image \\\n  --import-cache type=s3,region=eu-west-1,bucket=my_bucket,name=my_image\n```\n\nThe following attributes are required:\n* `bucket`: AWS S3 bucket (default: `$AWS_BUCKET`)\n* `region`: AWS region (default: `$AWS_REGION`)\n\nStorage locations:\n* blobs: `s3://\u003cbucket\u003e/\u003cprefix\u003e\u003cblobs_prefix\u003e/\u003csha256\u003e`, default: `s3://\u003cbucket\u003e/blobs/\u003csha256\u003e`\n* manifests: `s3://\u003cbucket\u003e/\u003cprefix\u003e\u003cmanifests_prefix\u003e/\u003cname\u003e`, default: `s3://\u003cbucket\u003e/manifests/\u003cname\u003e`\n\nS3 configuration:\n* `blobs_prefix`: global prefix to store / read blobs on s3 (default: `blobs/`)\n* `manifests_prefix`: global prefix to store / read manifests on s3 (default: `manifests/`)\n* `endpoint_url`: specify a specific S3 endpoint (default: empty)\n* `use_path_style`: if set to `true`, put the bucket name in the URL instead of in the hostname (default: `false`)\n\nAWS Authentication:\n\nBuildKit relies on the [AWS Go SDK](https://docs.aws.amazon.com/sdk-for-go/v2/developer-guide/configure-gosdk.html). This means that all standard authentication methods through [environment variables](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/config#EnvConfig) or config files are supported. This is especially true for AWS EC2 IAM Profile and AWS Web Identity Token (IAM roles in Kubernetes).\n\nBeware, these configurations must be available at buildkit daemon level, not at client level.\n\n* The following attributes can be used to forward static credentials from a buildkit client to the daemon (buildx for example).\n  * `access_key_id`: Access Key ID\n  * `secret_access_key`: Secret Access Key\n  * `session_token`: Session Token\n\n`--export-cache` options:\n* `type=s3`\n* `mode=\u003cmin|max\u003e`: specify cache layers to export (default: `min`)\n  * `min`: only export layers for the resulting image\n  * `max`: export all the layers of all intermediate steps\n* `prefix=\u003cprefix\u003e`: set global prefix to store / read files on s3 (default: empty)\n* `name=\u003cmanifest\u003e`: specify name of the manifest to use (default `buildkit`)\n  * Multiple manifest names can be specified at the same time, separated by `;`. The standard use case is to use the git sha1 as name, and the branch name as duplicate, and load both with 2 `import-cache` commands.\n* `ignore-error=\u003cfalse|true\u003e`: specify if error is ignored in case cache export fails (default: `false`)\n* `touch_refresh=24h`: Instead of being uploaded again when not changed, blobs files will be \"touched\" on s3 every `touch_refresh`, default is 24h. Due to this, an expiration policy can be set on the S3 bucket to cleanup useless files automatically. Manifests files are systematically rewritten, there is no need to touch them.\n* `upload_parallelism=4`: This parameter changes the number of layers uploaded to s3 in parallel. Each individual layer is uploaded with 5 threads, using the Upload manager provided by the AWS SDK.\n\n`--import-cache` options:\n* `type=s3`\n* `prefix=\u003cprefix\u003e`: set global prefix to store / read files on s3 (default: empty)\n* `blobs_prefix=\u003cprefix\u003e`: set global prefix to store / read blobs on s3 (default: `blobs/`)\n* `manifests_prefix=\u003cprefix\u003e`: set global prefix to store / read manifests on s3 (default: `manifests/`)\n* `name=\u003cmanifest\u003e`: name of the manifest to use (default `buildkit`)\n\n#### Azure Blob Storage cache (experimental)\n\n```bash\nbuildctl build ... \\\n  --output type=image,name=docker.io/username/image,push=true \\\n  --export-cache type=azblob,account_url=https://myaccount.blob.core.windows.net,name=my_image \\\n  --import-cache type=azblob,account_url=https://myaccount.blob.core.windows.net,name=my_image\n```\n\nThe following attributes are required:\n* `account_url`: The Azure Blob Storage account URL (default: `$BUILDKIT_AZURE_STORAGE_ACCOUNT_URL`)\n\nStorage locations:\n* blobs: `\u003caccount_url\u003e/\u003ccontainer\u003e/\u003cprefix\u003e\u003cblobs_prefix\u003e/\u003csha256\u003e`, default: `\u003caccount_url\u003e/\u003ccontainer\u003e/blobs/\u003csha256\u003e`\n* manifests: `\u003caccount_url\u003e/\u003ccontainer\u003e/\u003cprefix\u003e\u003cmanifests_prefix\u003e/\u003cname\u003e`, default: `\u003caccount_url\u003e/\u003ccontainer\u003e/manifests/\u003cname\u003e`\n\nAzure Blob Storage configuration:\n* `container`: The Azure Blob Storage container name (default: `buildkit-cache` or `$BUILDKIT_AZURE_STORAGE_CONTAINER` if set)\n* `blobs_prefix`: Global prefix to store / read blobs on the Azure Blob Storage container (`\u003ccontainer\u003e`) (default: `blobs/`)\n* `manifests_prefix`: Global prefix to store / read blobs on the Azure Blob Storage container (`\u003ccontainer\u003e`) (default: `manifests/`)\n\nAzure Blob Storage authentication:\n\nThere are 2 options supported for Azure Blob Storage authentication:\n\n* Any system using environment variables supported by the [Azure SDK for Go](https://docs.microsoft.com/en-us/azure/developer/go/azure-sdk-authentication). The configuration must be available for the buildkit daemon, not for the client.\n* Secret Access Key, using the `secret_access_key` attribute to specify the primary or secondary account key for your Azure Blob Storage account. [Azure Blob Storage account keys](https://docs.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage)\n\n\u003e [!NOTE]\n\u003e Account name can also be specified with `account_name` attribute (or `$BUILDKIT_AZURE_STORAGE_ACCOUNT_NAME`)\n\u003e if it is not part of the account URL host.\n\n`--export-cache` options:\n* `type=azblob`\n* `mode=\u003cmin|max\u003e`: specify cache layers to export (default: `min`)\n  * `min`: only export layers for the resulting image\n  * `max`: export all the layers of all intermediate steps\n* `prefix=\u003cprefix\u003e`: set global prefix to store / read files on the Azure Blob Storage container (`\u003ccontainer\u003e`) (default: empty)\n* `name=\u003cmanifest\u003e`: specify name of the manifest to use (default: `buildkit`)\n  * Multiple manifest names can be specified at the same time, separated by `;`. The standard use case is to use the git sha1 as name, and the branch name as duplicate, and load both with 2 `import-cache` commands.\n* `ignore-error=\u003cfalse|true\u003e`: specify if error is ignored in case cache export fails (default: `false`)\n\n`--import-cache` options:\n* `type=azblob`\n* `prefix=\u003cprefix\u003e`: set global prefix to store / read files on the Azure Blob Storage container (`\u003ccontainer\u003e`) (default: empty)\n* `blobs_prefix=\u003cprefix\u003e`: set global prefix to store / read blobs on the Azure Blob Storage container (`\u003ccontainer\u003e`) (default: `blobs/`)\n* `manifests_prefix=\u003cprefix\u003e`: set global prefix to store / read manifests on the Azure Blob Storage container (`\u003ccontainer\u003e`) (default: `manifests/`)\n* `name=\u003cmanifest\u003e`: name of the manifest to use (default: `buildkit`)\n\n### Consistent hashing\n\nIf you have multiple BuildKit daemon instances, but you don't want to use registry for sharing cache across the cluster,\nconsider client-side load balancing using consistent hashing.\n\nSee [`./examples/kubernetes/consistenthash`](./examples/kubernetes/consistenthash).\n\n## Metadata\n\nTo output build metadata such as the image digest, pass the `--metadata-file` flag.\nThe metadata will be written as a JSON object to the specified file.\nThe directory of the specified file must already exist and be writable.\n\n```bash\nbuildctl build ... --metadata-file metadata.json\n```\n\n```shell\njq '.' metadata.json\n```\n```json\n{\n  \"containerimage.config.digest\": \"sha256:2937f66a9722f7f4a2df583de2f8cb97fc9196059a410e7f00072fc918930e66\",\n  \"containerimage.descriptor\": {\n    \"annotations\": {\n      \"config.digest\": \"sha256:2937f66a9722f7f4a2df583de2f8cb97fc9196059a410e7f00072fc918930e66\",\n      \"org.opencontainers.image.created\": \"2022-02-08T21:28:03Z\"\n    },\n    \"digest\": \"sha256:19ffeab6f8bc9293ac2c3fdf94ebe28396254c993aea0b5a542cfb02e0883fa3\",\n    \"mediaType\": \"application/vnd.oci.image.manifest.v1+json\",\n    \"size\": 506\n  },\n  \"containerimage.digest\": \"sha256:19ffeab6f8bc9293ac2c3fdf94ebe28396254c993aea0b5a542cfb02e0883fa3\"\n}\n```\n\n## Systemd socket activation\n\nOn Systemd based systems, you can communicate with the daemon via [Systemd socket activation](http://0pointer.de/blog/projects/socket-activation.html), use `buildkitd --addr fd://`.\nYou can find examples of using Systemd socket activation with BuildKit and Systemd in [`./examples/systemd`](./examples/systemd).\n## Expose BuildKit as a TCP service\n\nThe `buildkitd` daemon can listen the gRPC API on a TCP socket.\n\nIt is highly recommended to create TLS certificates for both the daemon and the client (mTLS).\nEnabling TCP without mTLS is dangerous because the executor containers (aka Dockerfile `RUN` containers) can call BuildKit API as well.\n\n```bash\nbuildkitd \\\n  --addr tcp://0.0.0.0:1234 \\\n  --tlscacert /path/to/ca.pem \\\n  --tlscert /path/to/cert.pem \\\n  --tlskey /path/to/key.pem\n```\n\n```bash\nbuildctl \\\n  --addr tcp://example.com:1234 \\\n  --tlscacert /path/to/ca.pem \\\n  --tlscert /path/to/clientcert.pem \\\n  --tlskey /path/to/clientkey.pem \\\n  build ...\n```\n\n### Load balancing\n\n`buildctl build` can be called against randomly load balanced `buildkitd` daemons.\n\nSee also [Consistent hashing](#consistent-hashing) for client-side load balancing.\n\n## Containerizing BuildKit\n\nBuildKit can also be used by running the `buildkitd` daemon inside a Docker container and accessing it remotely.\n\nWe provide the container images as [`moby/buildkit`](https://hub.docker.com/r/moby/buildkit/tags/):\n\n-   `moby/buildkit:latest`: built from the latest regular [release](https://github.com/moby/buildkit/releases)\n-   `moby/buildkit:rootless`: same as `latest` but runs as an unprivileged user, see [`docs/rootless.md`](docs/rootless.md)\n-   `moby/buildkit:master`: built from the master branch\n-   `moby/buildkit:master-rootless`: same as master but runs as an unprivileged user, see [`docs/rootless.md`](docs/rootless.md)\n\nTo run daemon in a container:\n\n```bash\ndocker run -d --name buildkitd --privileged moby/buildkit:latest\nexport BUILDKIT_HOST=docker-container://buildkitd\nbuildctl build --help\n```\n\n### Podman\nTo connect to a BuildKit daemon running in a Podman container, use `podman-container://` instead of `docker-container://` .\n\n```bash\npodman run -d --name buildkitd --privileged moby/buildkit:latest\nbuildctl --addr=podman-container://buildkitd build --frontend dockerfile.v0 --local context=. --local dockerfile=. --output type=oci | podman load foo\n```\n\n`sudo` is not required.\n\n### Nerdctl\nTo connect to a BuildKit daemon running in a Nerdctl container, use `nerdctl-container://` instead of `docker-container://`.\n\n```bash\nnerdctl run -d --name buildkitd --privileged moby/buildkit:latest\nbuildctl --addr=nerdctl-container://buildkitd build --frontend dockerfile.v0 --local context=. --local dockerfile=. --output type=oci | nerdctl load\n```\n\n`sudo` is not required.\n\n### Kubernetes\n\nFor Kubernetes deployments, see [`examples/kubernetes`](./examples/kubernetes).\n\n### Daemonless\n\nTo run the client and an ephemeral daemon in a single container (\"daemonless mode\"):\n\n```bash\ndocker run \\\n    -it \\\n    --rm \\\n    --privileged \\\n    -v /path/to/dir:/tmp/work \\\n    --entrypoint buildctl-daemonless.sh \\\n    moby/buildkit:master \\\n        build \\\n        --frontend dockerfile.v0 \\\n        --local context=/tmp/work \\\n        --local dockerfile=/tmp/work\n```\n\nor\n\n```bash\ndocker run \\\n    -it \\\n    --rm \\\n    --security-opt seccomp=unconfined \\\n    --security-opt apparmor=unconfined \\\n    --security-opt systempaths=unconfined \\\n    -v /path/to/dir:/tmp/work \\\n    --entrypoint buildctl-daemonless.sh \\\n    moby/buildkit:master-rootless \\\n        build \\\n        --frontend \\\n        dockerfile.v0 \\\n        --local context=/tmp/work \\\n        --local dockerfile=/tmp/work\n```\n\n## OpenTelemetry support\n\nBuildKit supports [OpenTelemetry](https://opentelemetry.io/) for buildkitd gRPC\nAPI and buildctl commands. To capture the trace to\n[Jaeger](https://github.com/jaegertracing/jaeger), set `JAEGER_TRACE`\nenvironment variable to the collection address.\n\n```bash\ndocker run -d -p6831:6831/udp -p16686:16686 jaegertracing/all-in-one:latest\nexport JAEGER_TRACE=0.0.0.0:6831\n# restart buildkitd and buildctl so they know JAEGER_TRACE\n# any buildctl command should be traced to http://127.0.0.1:16686/\n```\n\n\u003e On Windows, if you are running Jaeger outside of a container, [`jaeger-all-in-one.exe`](https://www.jaegertracing.io/docs/1.57/getting-started/#all-in-one),\n\u003e set the environment variable `setx -m JAEGER_TRACE \"0.0.0.0:6831\"`,\n\u003e restart `buildkitd` in a new terminal and the traces will be collected automatically.\n\n## Running BuildKit without root privileges\n\nPlease refer to [`docs/rootless.md`](docs/rootless.md).\n\n## Building multi-platform images\n\nPlease refer to [`docs/multi-platform.md`](docs/multi-platform.md).\n\n### Configuring `buildctl`\n\n#### Color Output Controls\n\n`buildctl` has support for modifying the colors that are used to output information to the terminal. You can set the environment variable `BUILDKIT_COLORS` to something like `run=green:warning=yellow:error=red:cancel=255,165,0` to set the colors that you would like to use. Setting `NO_COLOR` to anything will disable any colorized output as recommended by [no-color.org](https://no-color.org/).\n\nParsing errors will be reported but ignored. This will result in default color values being used where needed.\n\n- [The list of pre-defined colors](https://github.com/moby/buildkit/blob/master/util/progress/progressui/colors.go).\n\n#### Number of log lines (for active steps in tty mode)\nYou can change how many log lines are visible for active steps in tty mode by setting `BUILDKIT_TTY_LOG_LINES` to a number (default: 6).\n\n## Contributing\n\nWant to contribute to BuildKit? Awesome! You can find information about contributing to this project in the [CONTRIBUTING.md](/.github/CONTRIBUTING.md)\n","funding_links":[],"categories":["Go","Docker Images","Popular","HarmonyOS","Image builder:","CI/CD","golang","oci-image","Image building","Docker-Tools","镜像与构建 (Images \u0026 Building)","Repositories"],"sub_categories":["Builder","Windows Manager","构建工具 (Builders)"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmoby%2Fbuildkit","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmoby%2Fbuildkit","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmoby%2Fbuildkit/lists"}