BuildKit exec steps can route network traffic through an HTTP proxy
Introduced 2026-06-17 · score 0.98
HOW TO USE IT
When you need to inspect exec-step network requests or apply source policies to them, enable BuildKit proxy networking for the daemon or build, then review the build output. Use a source policy to allow, deny, or convert matching proxy-visible HTTP(S) GET URLs.
buildctl build --proxy-network --frontend dockerfile.v0 --local context=<context-dir> --local dockerfile=<dockerfile-dir>buildkitd --proxy-networkbuildctl build --proxy-network --source-policy-file <policy.json> --frontend dockerfile.v0 --local context=<context-dir> --local dockerfile=<dockerfile-dir>WHY THIS HELPS
Inspect or constrain network requests made by containers during a build.
REQUIREMENTS AND LIMITATIONS
- Version: v0.31.0
- --proxy-network: Enables proxy networking for the build; daemon-level `buildkitd --proxy-network` or `proxyNetwork = true` in `buildkitd.toml` also enables it.
- --source-policy-file <policy.json>: Loads source-policy rules from the named file; the policy can allow, deny, or convert matching proxy-visible HTTP(S) GET URLs.
- proxyNetwork: Daemon config boolean; set `true` to enable proxy networking by default.
- rules[].action (required): Documented policy example uses `CONVERT`; proxy policy can also allow or deny matching requests.
- rules[].selector.identifier (required): Selects a source by identifier; policy examples match identifiers such as HTTP URLs and docker-image references.
- rules[].updates.identifier: Replacement identifier for a `CONVERT` policy rule; the example pins an image reference to a digest.
- rules[].updates.attrs: Attributes to update for a `CONVERT` policy rule; the example sets `http.checksum`.
- Prerequisite: Proxy networking applies to exec traffic with network access; non-exec fetch paths are outside its scope.
- Prerequisite: For `RUN --network=host`, enable `network.host` on both daemon (`--allow-insecure-entitlement network.host`) and build request (`--allow network.host`).
- Prerequisite: This implementation is Linux-focused.
- The proxy applies to exec steps; the release does not provide enablement syntax or configuration details.
FIRST-PARTY EVIDENCE
- https://github.com/moby/buildkit/releases/tag/v0.31.0
- https://github.com/moby/buildkit/blob/v0.31.0/docs/proxy.md
- https://github.com/moby/buildkit/blob/v0.31.0/docs/build-repro.md
Check the installed version and the source before using it. Entry JSON