1、docker buildx build 简介

docker buildx build命令使用BuildKit启动构建。这个命令类似于docker build命令的UI，使用相同的标志和参数。

参考文档：https://docs.docker.com/engine/reference/commandline/buildx_build/

2、docker buildx build 语法

docker buildx build [OPTIONS] PATH | URL | -

3、docker buildx build 命令

1）允许额外的特权(--allow)

network.host：允许执行主机网络。

security.insecure：允许执行没有sandbox的命令。

docker buildx create --use --name insecure-builder --buildkitd-flags '--allow-insecure-entitlement security.insecure'
docker buildx build --allow security.insecure .

2）设置构建时变量(--build-arg)

BUILDKIT_CONTEXT_KEEP_GIT_DIR=： 触发git上下文，保留.git目录。

BUILDKIT_INLINE_BUILDINFO_ATTRS=：是否在镜像配置中内联构建信息属性

BUILDKIT_INLINE_CACHE= inline cache： 是否配置元数据

BUILDKIT_MULTI_PLATFORM=： 选择确定性输出，而不管是否支持多平台输出。

docker buildx build --build-arg BUILDKIT_MULTI_PLATFORM=1 .

3）额外的构建上下文 (--build-context)

docker buildx build --build-context alpine=docker-image://alpine@sha256:0123456789 . 

docker buildx build --build-context project=path/to/project/source .

docker buildx build --build-context foo=oci-layout:///path/to/local/layout@sha256:abcd12345 .

4）使用外部缓存源进行构建(--cache-from)

registry ：可以从注册表上的缓存清单或(特殊)镜像配置导入缓存。

local ：可以从之前使用--cache-to导出的本地文件导入缓存。

gha：可以在GitHub仓库中使用--cache-to从之前导出的缓存中导入缓存。

docker buildx build --cache-from=user/app:cache .
docker buildx build --cache-from=user/app .
docker buildx build --cache-from=type=registry,ref=user/app .
docker buildx build --cache-from=type=local,src=path/to/cache .
docker buildx build --cache-from=type=gha .

5）将构建缓存导出到外部缓存目标(--cache-to)

registry： 将构建缓存导出到registry中的缓存清单。

local：Type在客户端将缓存导出到本地目录。

inline： Type将缓存元数据写入映像配置。

gha： Type通过Github Actions cache service API导出缓存。

 docker buildx build --cache-to=user/app:cache .
 docker buildx build --cache-to=type=inline .
 docker buildx build --cache-to=type=registry,ref=user/app .
 docker buildx build --cache-to=type=local,dest=path/to/cache .
 docker buildx build --cache-to=type=gha .

6）将构建结果元数据写入文件 (--metadata-file)

docker buildx build --load --metadata-file metadata.json .
cat metadata.json

{
  "containerimage.buildinfo": {
    "frontend": "dockerfile.v0",
    "attrs": {
      "context": "https://github.com/crazy-max/buildkit-buildsources-test.git#master",
      "filename": "Dockerfile",
      "source": "docker/dockerfile:master"
    },
    "sources": [
      {
        "type": "docker-image",
        "ref": "docker.io/docker/buildx-bin:0.6.1@sha256:a652ced4a4141977c7daaed0a074dcd9844a78d7d2615465b12f433ae6dd29f0",
        "pin": "sha256:a652ced4a4141977c7daaed0a074dcd9844a78d7d2615465b12f433ae6dd29f0"
      },
      {
        "type": "docker-image",
        "ref": "docker.io/library/alpine:3.13",
        "pin": "sha256:026f721af4cf2843e07bba648e158fb35ecc876d822130633cc49f707f0fc88c"
      }
    ]
  },
  "containerimage.config.digest": "sha256:2937f66a9722f7f4a2df583de2f8cb97fc9196059a410e7f00072fc918930e66",
  "containerimage.descriptor": {
    "annotations": {
      "config.digest": "sha256:2937f66a9722f7f4a2df583de2f8cb97fc9196059a410e7f00072fc918930e66",
      "org.opencontainers.image.created": "2022-02-08T21:28:03Z"
    },
    "digest": "sha256:19ffeab6f8bc9293ac2c3fdf94ebe28396254c993aea0b5a542cfb02e0883fa3",
    "mediaType": "application/vnd.oci.image.manifest.v1+json",
    "size": 506
  },
  "containerimage.digest": "sha256:19ffeab6f8bc9293ac2c3fdf94ebe28396254c993aea0b5a542cfb02e0883fa3"
}

7）为构建结果设置导出操作(-o, --output)

docker buildx build -o . .
docker buildx build -o outdir .
docker buildx build -o - - > out.tar
docker buildx build -o type=docker .
docker buildx build -o type=docker,dest=- . > myimage.tar
docker buildx build -t tonistiigi/foo -o type=registry

8）为构建设定目标平台(--platform)

docker buildx build --platform=linux/arm64 .
docker buildx build --platform=linux/amd64,linux/arm64,linux/arm/v7 .
docker buildx build --platform=darwin .

9）设置进度输出类型(--progress)

设置进度输出类型(auto、plain、tty)。使用plain来显示容器输出(默认为“auto”)。

docker buildx build --load --progress=plain .

#1 [internal] load build definition from Dockerfile
#1 transferring dockerfile: 227B 0.0s done
#1 DONE 0.1s

#2 [internal] load .dockerignore
#2 transferring context: 129B 0.0s done
#2 DONE 0.0s
...

10）要暴露给构建的Secret(--secret)

文件：

# syntax=docker/dockerfile:1.4
FROM python:3
RUN pip install awscli
RUN --mount=type=secret,id=aws,target=/root/.aws/credentials \
  aws s3 cp s3://... ...

docker buildx build --secret id=aws,src=$HOME/.aws/credentials .

环境变量：

# syntax=docker/dockerfile:1.4
FROM node:alpine
RUN --mount=type=bind,target=. \
  --mount=type=secret,id=SECRET_TOKEN \
  SECRET_TOKEN=$(cat /run/secrets/SECRET_TOKEN) yarn run test

SECRET_TOKEN=token docker buildx build --secret id=SECRET_TOKEN .

11）SSH代理套接字或密钥暴露给构建(--ssh)

# syntax=docker/dockerfile:1.4
FROM alpine
RUN apk add --no-cache openssh-client
RUN mkdir -p -m 0700 ~/.ssh && ssh-keyscan gitlab.com >> ~/.ssh/known_hosts
RUN --mount=type=ssh ssh -q -T git@gitlab.com 2>&1 | tee /hello
# "Welcome to GitLab, @GITLAB_USERNAME_ASSOCIATED_WITH_SSHKEY" should be printed here
# with the type of build progress is defined as `plain`.

eval $(ssh-agent)
ssh-add ~/.ssh/id_rsa
(Input your passphrase here)
docker buildx build --ssh default=$SSH_AUTH_SOCK .

12）ulimit设置

格式为：=[:]

docker buildx build --ulimit nofile=1024:1024 .

4、选项说明

5、相关命令

6、父命令