Welcome to the v0.35.0-rc1 release of buildkit!
This is a pre-release of buildkit

Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.

Contributors

• Tõnis Tiigi
• CrazyMax
• Sebastiaan van Stijn
• Zhizhen He
• Adam Stokes
• Christian Muertz
• Geoff Johnson
• Jan Mohr
• Joao Otavio Manieri
• Jonathan A. Sternberg
• Kamil Monicz
• Luca Landi
• MarioJames
• Paweł Gronowski
• Tamir Duberstein
• Tianon Gravi
• ggjulio
• okhowang(王沛文)
• ump45nose

Notable changes

• Built-in Dockerfile frontend has been updated to v1.29.0-rc1 changelog
• Git command tracing can now be enabled with the BUILDKIT_GIT_DEBUG_COMMANDS=1 build arg. #6588
• HTTP sources now retry transient failures and honor Retry-After headers. #7258 #7367
• Registry authentication now refreshes rejected credentials before retrying token requests. #7339
• Fix image cache invalidation when only attestations change. #7334
• Fix remote cache exports containing incomplete layer chains. #7351
• Fix cache matching with missing blobs or alternative input keys. #7364 #7312
• Fix concurrent local cache imports contending for ingest locks. #7187
• Fix local cache exports ignoring ignore-error when publishing the index. #7309
• Fix partial reads and resumed download failures in the S3 cache backend. #7363 #7361
• Fix GitHub Actions cache signature verification ignoring configured transparency log thresholds. #7304
• Fix cache record leaks and cleanup after canceled builds. #7264 #7157 #7355 #7354 #7325
• Fix cache finalization being lost when a build is canceled. #7332
• Fix on-demand CDI device resolution and permission checks. #7293
• Fix failed NVIDIA signing key imports preventing retries. #7298
• Fix frontend startup failures by waiting before the HTTP/2 handshake and allowing more time for containers to start. #7336
• Fix gateway exec hangs and lost process errors when streams close. #7300
• Fix frontend file descriptor leaks and double release of failed exec references. #7337 #7348
• Fix oversized build status messages by batching according to encoded size. #7340
• Fix races in build progress, cache access, provenance, and exporters. #7256 #7277 #7322 #7325 #7338 #7294
• Fix authorization failures leaving request bodies open. #7284
• Fix rootless builds with process sandboxing disabled creating a new keyring. #7311

Dependency Changes

• github.com/Microsoft/go-winio ad3df93bed29 -> v0.6.4
• github.com/Microsoft/hcsshim v0.15.0-rc.4 -> v0.15.0
• github.com/aws/aws-sdk-go-v2 v1.47.0 -> v1.47.5
• github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.20 -> v1.7.25
• github.com/aws/aws-sdk-go-v2/config v1.33.4 -> v1.33.13
• github.com/aws/aws-sdk-go-v2/credentials v1.20.4 -> v1.20.13
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.0 -> v1.20.5
• github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.3 -> v1.5.8
• github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.3 -> v2.8.8
• github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.3 -> v1.5.8
• github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 -> v1.13.23
• github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.3 -> v1.14.8
• github.com/aws/aws-sdk-go-v2/service/signin v1.10.0 -> v1.12.1
• github.com/aws/aws-sdk-go-v2/service/sso v1.38.0 -> v1.39.1
• github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.0 -> v1.44.1
• github.com/aws/aws-sdk-go-v2/service/sts v1.50.0 -> v1.51.6
• github.com/aws/smithy-go v1.28.2 -> v1.28.8
• github.com/containerd/stargz-snapshotter v0.18.2 -> v0.19.1
• github.com/containerd/stargz-snapshotter/estargz v0.18.2 -> v0.19.1
• github.com/docker/cli v29.8.2 -> v29.9.3
• github.com/go-openapi/analysis v0.25.5 -> v1.0.0
• github.com/go-openapi/errors v0.22.8 -> v0.22.9
• github.com/go-openapi/jsonpointer v1.0.0 -> v1.0.1
• github.com/go-openapi/jsonreference v1.0.0 -> v1.0.1
• github.com/go-openapi/loads v0.25.0 -> v0.25.2
• github.com/go-openapi/runtime v0.33.0 -> v0.33.2
• github.com/go-openapi/runtime/server-middleware v0.30.0 -> v0.33.2
• github.com/go-openapi/spec v0.22.9 -> v1.0.0
• github.com/go-openapi/strfmt v0.27.0 -> v0.27.2
• github.com/go-openapi/swag v0.28.0 -> v0.29.2
• github.com/go-openapi/swag/cmdutils v0.28.0 -> v0.29.2
• github.com/go-openapi/swag/conv v0.28.0 -> v0.29.2
• github.com/go-openapi/swag/fileutils v0.28.0 -> v0.29.2
• github.com/go-openapi/swag/jsonutils v0.28.0 -> v0.29.2
• github.com/go-openapi/swag/loading v0.28.0 -> v0.29.2
• github.com/go-openapi/swag/mangling v0.28.0 -> v0.29.2
• github.com/go-openapi/swag/netutils v0.28.0 -> v0.29.2
• github.com/go-openapi/swag/pools v0.28.0 -> v0.29.2
• github.com/go-openapi/swag/stringutils v0.28.0 -> v0.29.2
• github.com/go-openapi/swag/typeutils v0.28.0 -> v0.29.2
• github.com/go-openapi/swag/yamlutils v0.28.0 -> v0.29.2
• github.com/go-openapi/validate v0.26.1 -> v1.0.0
• github.com/google/go-containerregistry v0.21.7 -> v0.22.0
• github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 -> v2.31.0
• github.com/hanwen/go-fuse/v2 v2.9.0 -> v2.11.0
• github.com/moby/policy-helpers bd98f4747414 -> 485a1bec29f6
• github.com/moby/profiles/seccomp v0.2.4 -> v0.3.0
• github.com/moby/sys/mountinfo v0.7.2 -> v0.7.3
• github.com/moby/sys/user v0.4.1 -> v0.5.0
• github.com/oklog/ulid/v2 v2.1.1 -> v2.1.2
• github.com/prometheus/client_golang v1.24.1 -> v1.25.0
• github.com/prometheus/common v0.71.0 -> v0.72.0
• github.com/prometheus/procfs v0.21.1 -> v0.22.0
• github.com/tonistiigi/fsutil a72de9dcf763 -> e075fd9305eb
• go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.71.0 -> v0.72.0
• go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.71.0 -> v0.72.0
• go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 -> v0.72.0
• go.opentelemetry.io/otel v1.46.0 -> v1.47.0
• go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.46.0 -> v1.47.0
• go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.46.0 -> v1.47.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0 -> v1.47.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0 -> v1.47.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.46.0 -> v1.47.0
• go.opentelemetry.io/otel/exporters/prometheus v0.68.0 -> v0.69.0
• go.opentelemetry.io/otel/log v1.47.0 new
• go.opentelemetry.io/otel/metric v1.46.0 -> v1.47.0
• go.opentelemetry.io/otel/sdk v1.46.0 -> v1.47.0
• go.opentelemetry.io/otel/sdk/metric v1.46.0 -> v1.47.0
• go.opentelemetry.io/otel/trace v1.46.0 -> v1.47.0
• go.opentelemetry.io/proto/otlp v1.11.0 -> v1.11.1
• go.yaml.in/yaml/v3 v3.0.5 -> v3.0.6
• golang.org/x/crypto ...

Usage

# syntax=docker.io/docker/dockerfile-upstream:1.29.0-rc1-labs

Notable changes

• New --unset flag for ENV, LABEL, and VOLUME allows removing values, including those inherited from a base image. #7344
• New FROM --reset flag allows clearing selected inherited image configuration fields, or all fields with --reset=all. #7344

Usage

# syntax=docker.io/docker/dockerfile-upstream:1.29.0-rc1

Notable changes

• Git command tracing can now be enabled for Git contexts and ADD sources with the BUILDKIT_GIT_DEBUG_COMMANDS=1 build arg. Requires BuildKit v0.35+. #6588
• The BUILDKIT_DISABLE_ONBUILD build arg now allows skipping inherited ONBUILD triggers in all stages. #7344
• Secret checks now recognize PSW tokens in ARG and ENV names. #7286
• Fix COPY --chown handling of numeric user and group IDs above 2147483647. #7346
• Fix EXPOSE image history entries using invalid syntax. #7318
• Fix unknown flags on ARG and STOPSIGNAL being silently ignored. #7344

Welcome to the v0.34.2 release of buildkit!

Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.

Contributors

• CrazyMax
• Sebastiaan van Stijn
• Tõnis Tiigi

Notable Changes

• Fix a daemon panic caused by resolver cache poisoning when a build resolves metadata for the same Git source reference twice. GHSA-2fqp-xg6f-v7gj
• Prevent malicious clients with access to the BuildKit control APIs from setting extended attributes on files outside the BuildKit state directory, potentially granting elevated privileges to programs on the host. GHSA-w26x-xg27-7qjc

Dependency Changes

• github.com/containerd/containerd/v2 v2.4.1 -> v2.4.2
• github.com/klauspost/compress v1.20.1 -> v1.20.2
• github.com/tonistiigi/fsutil 83cac42c1c52 -> a72de9dcf763

Previous release can be found at v0.34.1

buildkit 0.34.1

Welcome to the v0.34.1 release of buildkit!

Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.

Security

This release has been built with updated Go runtime 1.26.10 to address CVE-2026-111943 by rejecting certificate chains that include eight revoked eMudhra intermediate certificates.
Image pulls and pushes fail TLS certificate verification if a registry's certificate chain relies on one of the affected TLS intermediates.
Affected registries need a replacement certificate chain that does not use these intermediates.

The blocked intermediates are:

• Domain-validated TLS: EM DV TLS CA - G3B and EM DV TLS CA - G3C
• Organization-validated TLS: EM OV TLS CA - G3B and EM OV TLS CA - G3C
• Extended-validation TLS: EM EV TLS CA - G3B and EM EV TLS CA - G3C
• Code signing: EM OV CS CA - G3B and EM OV CS CA - G3C

The G3B intermediates belong to eMudhra BV, and the G3C intermediates belong to eMudhra Inc.
The keys for these intermediates were compromised.

Read more about the eMudhra Intermediate CA Compromise

There are no functional changes in BuildKit itself compared to the previous release.

Previous release can be found at v0.34.0

buildkit 0.34.0

Welcome to the v0.34.0 release of buildkit!

Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.

Contributors

• Tõnis Tiigi
• CrazyMax
• Sebastiaan van Stijn
• Akihiro Suda
• Ernestas Lukoševičius
• Alexandre Rodrigues
• Kamil Monicz
• okhowang(王沛文)
• Alex G. Wolff
• Ben Harris
• Guthrie McAfee Armstrong
• Jonathan A. Sternberg
• KR Ravindra
• MohammadHasan Akbari
• MsfPablo
• Paul Schroeder
• Ruzan Sasuri
• Sterling Greene
• Suhail Hany
• ZRHann

Notable changes

• Built-in Dockerfile frontend has been updated to v1.28.0 changelog
• BoltDB databases now support compaction to periodically reduce database size and compress them on disk. This feature is currently opt-in and can be enabled with TOML configuration. The intention is to enable it by default in future releases. #7138 #7248
• Local and tar exporters now support the src option for specifying the subdirectory to export. #7226
• Provenance attestation now contains information about the target platform of the build. #7227
• Unpack exporter option is not supported in rewrite-timestamp mode. #6939
• Reduce BoltDB database size and performance overhead #6882
• Transient registry token failures are now retried. #7155
• Add protection to using concurrent local cache exports with reset option. #7153
• NewContainer API in Gateway now preserves the platform information of the created container. #7083
• Enable configuring Hyper-V isolation mode for Windows containers. #7067
• S3 remote cache backend now supports compression options. #7121
• Session authentication timeout is now configurable from TOML configuration. #7225
• Startup performance of internal databases has been improved by creating a BoltDB freelist on graceful shutdown #7249
• Improve recovery from database open failures in more internal databases. #7137
• Buildkitd now supports defining the configuration path with an environment variable. #7144
• Original messages from GitHub cache backend are now preserved. #7232
• Avoid panic from misconfigured GC policy. #7209
• Fix issue where some cache records could remain in use after build completion with an error. #7223
• Fix possible cache export failure with parallel requests. #7145
• Fix incorrect backslash escaping in RUN step progress output. #7188
• Fix encoding of some material URLs with custom ports in the provenance attestation. #5641
• Fix possible "ref locked: unavailable" errors on parallel builds export step. #7182
• Fix possible build errors when using SOURCE_DATE_EPOCH together with subdir Git sources. #7183
• Fix possible EBUSY errors from overlay filesystem on some systems. #7167
• Fix bug that could cause some internal database indexes to never get released. #7135
• Fix handling of IPv6 hosts without an explicit port. #7164
• Fix possible build error when canceling QEMU emulated build step. #7092
• Fix using normalized variant of platform identifier in annotation key #7244
• Fix possible storage reference leak when canceling build in the middle of exec step #7247
• Fix possible deadlock on large bidirectional stdio streams #7240
• Fix possible hang on container output writer error #7243

Dependency Changes

• github.com/aws/aws-sdk-go-v2 v1.43.8 -> v1.47.0
• github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.18 -> v1.7.20
• github.com/aws/aws-sdk-go-v2/config v1.32.39 -> v1.33.4
• github.com/aws/aws-sdk-go-v2/credentials v1.19.38 -> v1.20.4
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.39 -> v1.20.0
• github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.39 -> v1.5.3
• github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.39 -> v2.8.3
• github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.40 -> v1.5.3
• github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.18 -> v1.13.19
• github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.39 -> v1.14.3
• github.com/aws/aws-sdk-go-v2/service/signin v1.5.8 -> v1.10.0
• github.com/aws/aws-sdk-go-v2/service/sso v1.33.8 -> v1.38.0
• github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.8 -> v1.43.0
• github.com/aws/aws-sdk-go-v2/service/sts v1.45.8 -> v1.50.0
• github.com/aws/smithy-go v1.27.10 -> v1.28.2
• github.com/containerd/containerd/api v1.11.1 -> v1.12.0
• github.com/containerd/containerd/v2 v2.3.6 -> v2.4.1
• github.com/containerd/go-cni v1.1.13 -> v1.1.14
• github.com/containerd/log/otel v0.1.0 new
• github.com/containerd/ttrpc v1.2.9 -> v1.2.10
• github.com/containernetworking/cni v1.3.0 -> v1.3.1
• github.com/cyphar/filepath-securejoin v0.6.1 -> v0.7.0
• github.com/docker/cli v29.7.2 -> v29.8.2
• github.com/docker/docker-credential-helpers v0.9.8 -> v0.9.9
• github.com/docker/go-metrics v0.0.1 -> v0.1.0
• github.com/fsnotify/fsnotify v1.9.0 -> v1.10.1
• github.com/go-openapi/analysis v0.25.2 -> v0.25.5
• github.com/go-openapi/jsonpointer v0.23.1 -> v1.0.0
• github.com/go-openapi/jsonreference v0.21.6 -> v1.0.0
• github.com/go-openapi/loads v0.24.0 -> v0.25.0
• github.com/go-openapi/runtime v0.32.4 -> v0.33.0
• github.com/go-openapi/spec v0.22.6 -> v0.22.9
• github.com/go-openapi/strfmt v0.26.4 -> v0.27.0
• github.com/go-openapi/swag v0.26.1 -> v0.28.0
• github.com/go-openapi/swag/cmdutils v0.26.1 -> v0.28.0
• github.com/go-openapi/swag/conv v0.27.0 -> v0.28.0
• github.com/go-openapi/swag/fileutils v0.26.1 -> v0.28.0
• github.com/go-openapi/swag/jsonutils v0.26.1 -> v0.28.0
• github.com/go-openapi/swag/loading v0.26.1 -> v0.28.0
• github.com/go-openapi/swag/mangling v0.26.1 -> v0.28.0
• github.com/go-openapi/swag/netutils v0.26.1 -> v0.28.0
• github.com/go-openapi/swag/pools v0.28.0 new
• github.com/go-openapi/swag/stringutils v0.26.1 -> v0.28.0
• github.com/go-openapi/swag/typeutils v0.27.0 -> v0.28.0
• github.com/go-openapi/swag/yamlutils v0.26.1 -> v0.28.0
• github.com/go-openapi/validate v0.26.0 -> v0.26.1
• github.com/gofrs/flock v0.13.0 -> v0.13.1
• github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 -> v2.30.0
• github.com/klauspost/compress v1.19.2 -> v1.20.1
• github.com/moby/policy-helpers dd6c5499c491 -> bd98f4747414
• github.com/moby/profiles/seccomp v0.2.3 -> v0.2.4
• github.com/moby/sys/userns v0.2.0 -> v0.2.1
• github.com/package-url/packageurl-go v0.1.1 -> v0.1.7
• github.com/prometheus/client_model v0.6.2 -> v0.6.3
• github.com/prometheus/common v0.70.1 -> v0.71.0
• github.com/sirupsen/logrus v1.10.1 -> v1.10.2
• github.com/tonistiigi/go-actions-cache 54bc28c26fd2 -> afe8013b5ac4
• github.com/urfave/cli/v3 v3.9.0 -> v3.11.0
• go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.70.0 -> v0.71.0
• go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.70.0 -> v0.71.0
• go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 -> v0.71.0
• go.opentelemetry.io/otel v1.45.0 -> v1.46.0
• go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.45.0 -> v1.46.0
• go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp ...

Usage

# syntax=docker.io/docker/dockerfile-upstream:1.28.0-labs

Usage

# syntax=docker.io/docker/dockerfile-upstream:1.28.0

Notable changes

• Allow "default group" syntax in COPY --chown instruction. #3555
• Add better detection for invalid combinations between --chown and --link in the COPY instruction. #7134

buildkit 0.34.0-rc2

Welcome to the v0.34.0-rc2 release of buildkit!
This is a pre-release of buildkit

Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.

Contributors

• Tõnis Tiigi
• CrazyMax
• Sebastiaan van Stijn
• Kamil Monicz
• Ruzan Sasuri

Notable Changes

• Startup performance of internal databases has been improved by creating a BoltDB freelist on graceful shutdown #7249
• Database compaction now supports configuring minimum reclaimable percentage to avoid unnecessary compaction on very big databases #7248
• Fix using normalized variant of platform identifier in annotation key #7244
• Fix possible storage reference leak when canceling build in the middle of exec step #7247
• Fix possible deadlock on large bidirectional stdio streams #7240
• Fix possible hang on container output writer error #7243

Dependency Changes

• github.com/docker/cli v29.8.1 -> v29.8.2
• github.com/moby/policy-helpers 72f704e6cdb6 -> bd98f4747414

Previous release can be found at v0.34.0-rc1

Usage

# syntax=docker.io/docker/dockerfile-upstream:1.28.0-rc2