buildx build and bake support experimental Rego source policies
Introduced 2026-01-22 · score 0.96
HOW TO USE IT
For local-context builds, Buildx loads a matching `.rego` policy automatically; use `--policy` to add or control policies, and use `buildx policy eval` or `buildx policy test` to inspect sources or test policy logic. [Build policy usage](https://docs.docker.com/build/policies/usage/)
docker buildx build --policy filename=<path-to-policy.rego> .docker buildx policy eval --filename <Dockerfile-name> .docker buildx policy test <path-to-policy-tests>WHY THIS HELPS
Enforce source policies when building a repository with Buildx.
REQUIREMENTS AND LIMITATIONS
- Version: v0.31.0
- Availability: experimental
- --policy filename=<path>: Load the specified policy file; it is added to automatic policy loading unless reset is enabled.
- --policy reset=true|false: When true, ignore automatically loaded policies and use only specified policies.
- --policy disabled=true|false: When true, disable policy evaluation.
- --policy strict=true|false: When true, fail if policies are not loaded or the BuildKit daemon does not support them.
- --policy log-level=<level>: Set policy logging to `error`, `warn`, `info`, `debug`, or `none`.
- policy: Bake target attribute listing policy files; automatic loading alongside the target Dockerfile is also supported.
- --filename <name>: For `policy eval`, select the Dockerfile name whose policy to load; defaults to `Dockerfile`.
- source (required): For `policy eval`, the source to evaluate.
- <path> (required): For `policy test`, path to the policy tests.
- Prerequisite: Build policies are experimental in the v0.31.0 release.
- Prerequisite: In v0.31.0, only builds from the local build context load policies.
- Only builds from the local build context currently load policies.
- Docs conflict: The current Bake usage page documents `policy` as a list of policy-file strings; the current Bake reference says entries use the `--policy` keys (`filename`, `reset`, `disabled`, `strict`, `log-level`). The v0.31.0 release note only establishes that a target `policy` key was added, so its exact value shape is not established here.
- Docs conflict: The current Bake usage page says Bake does not support `reset`, `strict`, or `disabled` in the HCL file; use command-line flags for those options. This may describe behavior newer than v0.31.0.
FIRST-PARTY EVIDENCE
- https://github.com/docker/buildx/releases/tag/v0.31.0
- https://docs.docker.com/build/policies/usage/
- https://docs.docker.com/reference/cli/docker/buildx/policy/eval/
- https://docs.docker.com/reference/cli/docker/buildx/policy/test/
Check the installed version and the source before using it. Entry JSON