dockerfile: add run --mount support #442

tonistiigi · 2018-06-07T23:02:23Z

Update: this feature was added to the experimental Dockerfile syntax

Read more about experimental Dockerfile features in the experimental.md file

This implements moby/moby#32507 (missing tmpfs support atm) as an experimental feature of Dockerfile frontend. The main dockerfile.v0 frontend is unaffected.

It can be used by building the frontend with a dfrunmount build tag and then loading it with either the gateway frontend or syntax directive (or gateway-devel to run from source on development).

The keys from the --mount options are taken from the ones supported by docker run. I'm not sure if we want to keep the ambiguous ones.

I also ran into a case where a scratch mount would error if binded. This was explicitly validated with a test but I don't think that is required. Even though there is no use case for this we can just create an empty temporary readonly directory instead of failing the build. @ijc

example:1

# syntax=docker/dockerfile:1.0-experimental
FROM busybox
RUN --mount=target=/foo cat /foo/Dockerfile

example2:
https://gist.github.com/tonistiigi/0e0ab30ebf0eb6e4b82e1786d8b4dda1#file-test-dockerfile-L28
repeated builds reuse go cache

Note: The examples do not require updating to this PR. They run in master buildkit or moby integration PR.

Follow-up: need to figure out how to run tests with these features. Currently only checks that it builds.

@AkihiroSuda @tiborvass @thaJeztah @vdemeester

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

Supports binds from images and context and cache mounts. Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

vdemeester · 2018-06-08T07:26:18Z

frontend/dockerfile/dockerfile2llb/convert_runmount.go

+	mounts := instructions.GetMounts(c)
+
+	for i, mount := range mounts {
+		if mount.From == "" && mount.Type == "cache" {


Is cache a mount type support by moby ? I guess it's for directory like .m2, … so 👍

AkihiroSuda · 2018-06-08T12:10:01Z

How Go is configured to use /root/.cache?

AkihiroSuda · 2018-06-08T12:13:17Z

frontend/dockerfile/instructions/commands_runmount.go

+		case "type":
+			allowedTypes := map[string]struct{}{
+				"cache": {},
+				"bind":  {},


Enabling bind-mount by default may cause security issue?
Maybe better to require daemon-side configuration?

tonistiigi · 2018-06-08T17:15:47Z

Is cache a mount type support by moby ? I guess it's for directory like

Enabling bind-mount by default may cause security issue?

As described in moby/moby#32507 these are custom mount types with builder specific meaning. Cache is builder specific but of course, it works with moby as well (with no updates required for the current integration branch). The bind (default) is bind between stages or build context not a directory on the host.

How Go is configured to use /root/.cache?

Default go env GOCACHE is /root/.cache/go-build

ghost · 2018-06-13T10:59:37Z

OMG - does this finally mean I'll be able to mount a SSH socket file during docker build ?

tonistiigi · 2018-06-18T17:02:11Z

moby/moby#32507 defines mounts from context, stages and images, tmpfs mounts and persistent cache mounts that can be used for application specific cache. ssh sharing is covered in #262

voltechs · 2018-09-19T00:54:59Z

So... this was merged 4 months ago. I followed about 16 (closed) pull requests and 23 issues all referencing each other like a game of "whodunnit" in 2nd grade, finally arriving here.

I switched to edge (Docker version 18.09.0-ce-beta1, build 78a6bdb) but was confronted with Error response from daemon: Dockerfile parse error line 111: Unknown flag: mount. Also, I see no reference of this mysterious version that I seem to be on... I'm sure I did something wrong.

Generally specking though... Is this out yet?

Edit: Fun fact. When I check for updates in Docker for Mac, I get Docker 2.0.0.0-beta1-mac75 is currently the newest version available. even though docker --version returns 18.09.0 etc 🤔
Edit2: Ok, that's the version of Docker for Mac, which is different from the docker engine. 🙄

thaJeztah · 2018-09-19T16:22:33Z

@voltechs you need to enable buildkit as a builder, and use the syntax directive (as --mount is still a preview/custom feature, and hasn't been included in the official Dockerfile syntax yet);

mkdir foo && cd foo

cat <<EOF > Dockerfile
# syntax=docker/dockerfile:1.0-experimental
FROM busybox
RUN --mount=target=/foo cat /foo/Dockerfile
EOF

DOCKER_BUILDKIT=1 docker build -t foo .

[+] Building 3.2s (11/11) FINISHED                                                                                                                                                                               
 => [internal] load Dockerfile                                                                                                                                                                              0.0s
 => => transferring dockerfile: 144B                                                                                                                                                                        0.0s
 => [internal] load .dockerignore                                                                                                                                                                           0.0s
 => => transferring context: 2B                                                                                                                                                                             0.0s
 => resolve image config for docker.io/docker/dockerfile:1.0-experimental                                                                                                                              0.6s
 => CACHED docker-image://docker.io/docker/dockerfile:1.0-experimental@sha256:85308b90e426508ed13b338b091a4f159b45c2efdbfdabe419477f92d256f744                                                          0.0s
 => local://dockerfile (Dockerfile)                                                                                                                                                                         0.0s
 => local://context (.dockerignore)                                                                                                                                                                         0.0s
 => resolve image config for docker.io/library/busybox:latest                                                                                                                                               0.0s
 => local://context                                                                                                                                                                                         0.0s
 => => transferring context: 144B                                                                                                                                                                           0.0s
 => CACHED docker-image://docker.io/library/busybox:latest                                                                                                                                                  0.0s
 => /bin/sh -c cat /foo/Dockerfile                                                                                                                                                                          1.3s
 => exporting to image                                                                                                                                                                                      0.0s
 => => exporting layers                                                                                                                                                                                     0.0s
 => => writing image sha256:a2f52971817e7f39fa45e54f35235d48f95d2263a63dc8327ff614d8419d504b                                                                                                                0.0s
 => => naming to docker.io/library/foo                                                                                                                                                                      0.0s

bufdev · 2018-10-01T20:40:33Z

I've read through #262 and I've read through this, and I still can't figure out how to do ssh sharing, I'm on 18.09 edge as well - since volume isn't a supported mount type, you can't do e.g. https://github.com/avsm/docker-ssh-agent-forward. Is there an example somewhere?

simonvanderveldt · 2019-01-14T16:07:32Z

@tonistiigi just to check is it still possible to use this to mount a location on the host's filesystem with the current code on master? So something like this:

# syntax=docker/dockerfile:1.0-experimental
FROM busybox
RUN --mount=target=/home/me/somefiles cat /foo/Dockerfile
EOF

DOCKER_BUILDKIT=1 docker build -t foo .

Looking at https://github.com/moby/buildkit/blob/master/frontend/dockerfile/docs/experimental.md#experimental-syntaxes it seems to suggest it doesn't work with host volume mounts which was something that this PR did seem to implement.

Also it seems like it's not possible to choose where to mount it to, is that correct?

AkihiroSuda · 2019-01-14T16:56:16Z

Host-mount is unlikely to be implemented.

Why do you need to mount the host filesystem?

rcjsuen · 2019-01-14T18:03:51Z

When will --mount be available for use in regular Docker?

thaJeztah · 2019-01-15T01:16:41Z

@rcjsuen you mean without the # syntax in the Dockerfile, or you mean with docker build?

You can use it already with docker build if you have DOCKER_BUILDKIT=1 set as environment variable, and use a Dockerfile with the # syntax header to use the experimental Dockerfile syntax

rcjsuen · 2019-01-15T02:13:32Z

Hi, @thaJeztah. Thanks for getting back to me.

I meant as an official feature of Docker without the need of the special # syntax header.

andig · 2019-02-28T09:43:08Z

@thaJeztah I'm still unable to get this to work beyond your example (which is working). I have

# syntax = tonistiigi/dockerfile:runmount20180607
FROM golang:alpine as builder
RUN --mount=target=/root/.cache,type=cache go build -ldflags="-w -s" -a -installsuffix cgo -o /go/bin/ingress github.com/andig/ingress/cmd/ingress

and it still errors with Unknown flag: mount:

❯ DOCKER_BUILDKIT=1 docker build -t ingress:lastest .
[+] Building 0.1s (2/2) FINISHED
=> [internal] load build definition from Dockerfile                                                                                                    0.1s
=> => transferring dockerfile: 1.50kB                                                                                                                  0.0s
=> [internal] load .dockerignore                                                                                                                       0.1s
=> => transferring context: 2B                                                                                                                         0.0s
failed to create LLB definition: Dockerfile parse error line 6: Unknown flag: mount

thaJeztah · 2019-02-28T09:58:08Z

@andig that's odd; what version of docker are you running? I just tried your exact example, and it works (obviously it fails building because the source isn't there, but it doesn't fail on the --mount option);

DOCKER_BUILDKIT=1 docker build -<<'EOF'
# syntax=docker/dockerfile:1.0-experimental
FROM golang:alpine as builder
RUN --mount=target=/root/.cache,type=cache go build -ldflags="-w -s" -a -installsuffix cgo -o /go/bin/ingress github.com/andig/ingress/cmd/ingress
EOF

 => ERROR /bin/sh -c go build -ldflags="-w -s" -a -installsuffix cgo -o /go/bin/ingress github.com/andig/ingress/cmd/ingress                                                                             1.4s
------
 > /bin/sh -c go build -ldflags="-w -s" -a -installsuffix cgo -o /go/bin/ingress github.com/andig/ingress/cmd/ingress:
#8 1.174 can't load package: package github.com/andig/ingress/cmd/ingress: cannot find package "github.com/andig/ingress/cmd/ingress" in any of:
#8 1.174 	/usr/local/go/src/github.com/andig/ingress/cmd/ingress (from $GOROOT)
#8 1.174 	/go/src/github.com/andig/ingress/cmd/ingress (from $GOPATH)
------
exit code: 2

thaJeztah · 2019-02-28T09:58:17Z

Also note that the tonistiigi/dockerfile:runmount20180607 frontend is quite outdated by now, and there's now official "experimental" frontends (https://hub.docker.com/r/docker/dockerfile/tags);

#syntax=<see below>:

docker/dockerfile:1-experimental (latest 1.x.x experimental syntax; currently 1.0.2)
docker/dockerfile:1.0-experimental (latest 1.0.x experimental syntax; currently 1.0.2)
docker/dockerfile:1.0.2-experimental (1.0.2 experimental syntax)
docker/dockerfile:experimental (latest experimental; currently 1.0.2)

I'll update the examples in this thread

andig · 2019-02-28T12:41:43Z

Thanks for the fast reply and the updates. For sake of other readers here's why it failed for me- additional comments above the # syntax don't work:

❯ DOCKER_BUILDKIT=1 docker build -<<'EOF'
############################
# STEP 1 build executable binary
############################
# syntax=docker/dockerfile:1.0-experimental
FROM golang:alpine as builder
RUN --mount=target=/root/.cache,type=cache go build -ldflags="-w -s" -a -installsuffix cgo -o /go/bin/ingress github.com/andig/ingress/cmd/ingress
EOF
[+] Building 0.1s (2/2) FINISHED
=> [internal] load build definition from Dockerfile                                                                                                    0.0s
=> => transferring dockerfile: 356B                                                                                                                    0.0s
=> [internal] load .dockerignore                                                                                                                       0.0s
=> => transferring context: 2B                                                                                                                         0.0s
failed to create LLB definition: Dockerfile parse error line 6: Unknown flag: mount

Without those other comments its fine...

AkihiroSuda · 2019-02-28T12:44:02Z

The # syntax = .. needs to be on the first line

tonistiigi added 3 commits June 7, 2018 14:55

dockerfile: add run mount parsing

aeea615

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

dockerfile: run -—mount initial support

af03a52

Supports binds from images and context and cache mounts. Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

llbsolver: don’t error on readonly scratch mount

479419a

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

tonistiigi force-pushed the runmount branch from a5c0d32 to 479419a Compare June 7, 2018 23:24

tonistiigi added the area/dockerfile label Jun 7, 2018

vdemeester reviewed Jun 8, 2018

View reviewed changes

AkihiroSuda reviewed Jun 8, 2018

View reviewed changes

AkihiroSuda approved these changes Jun 8, 2018

View reviewed changes

AkihiroSuda merged commit 60344aa into moby:master Jun 8, 2018

glensc mentioned this pull request Jun 17, 2018

build time only -v / --volume option moby/moby#14080

Open

shin- mentioned this pull request Jun 18, 2018

Add support for build time volumes docker/docker-py#1937

Closed

AkihiroSuda mentioned this pull request Jul 11, 2018

Add INCLUDE to Dockerfile parsing in bud containers/buildah#851

Closed

marius311 mentioned this pull request Aug 1, 2018

Upgrades, secrets, and ONBUILD images (version 3.0.0) marius311/boinc-server-docker#43

Merged

ijc mentioned this pull request May 20, 2019

[WIP] Add support for build time volumes docker/compose#5736

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

dockerfile: add run --mount support #442

dockerfile: add run --mount support #442

tonistiigi commented Jun 7, 2018 •

edited by thaJeztah

Loading

vdemeester Jun 8, 2018

AkihiroSuda commented Jun 8, 2018

AkihiroSuda Jun 8, 2018

tonistiigi commented Jun 8, 2018

ghost commented Jun 13, 2018

tonistiigi commented Jun 18, 2018

voltechs commented Sep 19, 2018 •

edited

Loading

thaJeztah commented Sep 19, 2018 •

edited

Loading

bufdev commented Oct 1, 2018

simonvanderveldt commented Jan 14, 2019 •

edited by thaJeztah

Loading

AkihiroSuda commented Jan 14, 2019

rcjsuen commented Jan 14, 2019

thaJeztah commented Jan 15, 2019

rcjsuen commented Jan 15, 2019

andig commented Feb 28, 2019

thaJeztah commented Feb 28, 2019 •

edited

Loading

thaJeztah commented Feb 28, 2019 •

edited

Loading

andig commented Feb 28, 2019

AkihiroSuda commented Feb 28, 2019

dockerfile: add run --mount support #442

dockerfile: add run --mount support #442

Conversation

tonistiigi commented Jun 7, 2018 • edited by thaJeztah Loading

Update: this feature was added to the experimental Dockerfile syntax

vdemeester Jun 8, 2018

Choose a reason for hiding this comment

AkihiroSuda commented Jun 8, 2018

AkihiroSuda Jun 8, 2018

Choose a reason for hiding this comment

tonistiigi commented Jun 8, 2018

ghost commented Jun 13, 2018

tonistiigi commented Jun 18, 2018

voltechs commented Sep 19, 2018 • edited Loading

thaJeztah commented Sep 19, 2018 • edited Loading

bufdev commented Oct 1, 2018

simonvanderveldt commented Jan 14, 2019 • edited by thaJeztah Loading

AkihiroSuda commented Jan 14, 2019

rcjsuen commented Jan 14, 2019

thaJeztah commented Jan 15, 2019

rcjsuen commented Jan 15, 2019

andig commented Feb 28, 2019

thaJeztah commented Feb 28, 2019 • edited Loading

thaJeztah commented Feb 28, 2019 • edited Loading

andig commented Feb 28, 2019

AkihiroSuda commented Feb 28, 2019

tonistiigi commented Jun 7, 2018 •

edited by thaJeztah

Loading

voltechs commented Sep 19, 2018 •

edited

Loading

thaJeztah commented Sep 19, 2018 •

edited

Loading

simonvanderveldt commented Jan 14, 2019 •

edited by thaJeztah

Loading

thaJeztah commented Feb 28, 2019 •

edited

Loading

thaJeztah commented Feb 28, 2019 •

edited

Loading