policy: verify BuildKit builder images#3961
Conversation
Extend the built-in policy to validate signed moby/buildkit release and floating tags before docker-container builders are created. Pull the image first, inspect it through Docker, and bind verification to the descriptor digest. Resolve signature attestations through the BuildKit API embedded in the Docker daemon. If pulling fails, use a local image while applying the same verification when the containerd image store exposes an immutable descriptor. Keep the classic image-store behavior unchanged because no descriptor is available. Allow unmanaged repositories and digest-only references unchanged. Add the allow-untrusted-image driver option as an explicit verification bypass. Document the behavior and add policy, digest-pinning, and local fallback coverage. Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
3b5e22c to
acaf251
Compare
| DefaultImage = "moby/buildkit:buildx-stable-1" // TODO: make this verified | ||
| QemuImage = "tonistiigi/binfmt:latest" // TODO: make this verified | ||
| DefaultImage = "moby/buildkit:buildx-stable-1" | ||
| QemuImage = "tonistiigi/binfmt:latest" // TODO: make this verified |
There was a problem hiding this comment.
This could be a follow-up but looks tricky to verify QEMU image used by the kubernetes driver during deployment at:
buildx/driver/kubernetes/manifest/manifest.go
Lines 196 to 205 in 5c10fb7
We would need to know beforehand the node platform to perform the verification.
cc @AkihiroSuda
There was a problem hiding this comment.
The current policy verifier resolves signatures against a selected platform manifest, so Kubernetes cannot safely use the local default platform here. We'd need either a known pod platform or an all-platform verification story before verifying and pinning this init image.
| // them. Images from other repositories pass through unverified; the | ||
| // allow-untrusted-image driver-opt is only needed when a TrustedRepo tag | ||
| // that the policy covers does not verify correctly. | ||
| TrustedRepo = "docker.io/moby/buildkit" |
There was a problem hiding this comment.
Why not just promote buildkit (and binfmt, xx, ...) to DOI?
3 participants
Extend the built-in policy to validate signed moby/buildkit release and floating tags before docker-container builders are created.
Pull the image first, inspect it through Docker, and bind verification to the descriptor digest. Resolve signature attestations through the BuildKit API embedded in the Docker daemon.
If pulling fails, use a local image while applying the same verification when the containerd image store exposes an immutable descriptor. Keep the classic image-store behavior unchanged because no descriptor is available.
Allow unmanaged repositories and digest-only references unchanged. Add the allow-untrusted-image driver option as an explicit verification bypass.
--
I think in the future this could be optimized to make
policy evalcommand share more code with this. Currently some similar code is in cli package of that command that I didn't want to change yet.