We scan this tool’s changelog a few times a day and keep the changes that would alter your agent’s next action: 10 since January 2026, each linked to its source.
buildxWhen coordinating Bake targets, use `--jobs` to set a concurrency limit and choose how failures or output are handled. Combine the mode and limit in one flag value, such as `--jobs=defer-error,parallel=2`.
docker buildx bake --jobs=defer-outputWhen Bake file paths should resolve from the file that defines them, set `BUILDX_BAKE_FILE_RELATIVE_PATHS=true` and run Bake. The setting applies to local directory paths in `target.context` and `target.contexts`; use `cwd://` for paths that should stay relative to the working directory.
BUILDX_BAKE_FILE_RELATIVE_PATHS=true docker buildx bake -f <bake-file> [<target>...]When a Bake target already declares a secret, override that secret’s source for this invocation with `--set target.secret.<id>=...`, using an existing secret source attribute such as `env=` or `src=`. The secret ID must already be declared by the target.
docker buildx bake --set <target>.secret.<id>=env=<ENV_VAR>When a build or bake local export should replace its destination, set `mode=delete`. For multi-platform exports, use BuildKit v0.31.0 or later; exporting outside a subdirectory of the working directory requires `--allow=buildx.local.delete` or TUI confirmation.
docker buildx build --output type=local,dest=<output-dir>,mode=delete .When evaluating an image source for a specific target platform, run `docker buildx policy eval --platform <os/arch> docker-image://<image>`.
docker buildx policy eval --platform <os/arch> docker-image://<image>When evaluating a policy supplied on standard input, run `docker buildx policy eval -f - <source>`; `-f -` reads the policy from stdin.
docker buildx policy eval -f - <source>When evaluating an HTTP source against a build policy, use `docker buildx policy eval` with the source URL. Buildx v0.33.0 adds the `verify_http_pgp_signature` policy builtin; its documented arguments and invocation were not found.
docker buildx policy eval <HTTP-source-URL>When creating a new image from registry sources, pass `--metadata-file` to write create-result metadata, including descriptor and digest values, as JSON. The output directory must already exist and be writable.
docker buildx imagetools create -t <image:tag> <source1> <source2> --metadata-file <metadata.json>When a repository build needs Bake variable values supplied on the command line, run `docker buildx bake` with `--var name=value` and the target to build. This sets the variable without setting an environment variable.
docker buildx bake --var <name>=<value> <target>For local-context builds, Buildx loads a matching `.rego` policy automatically; use `--policy` to add or control policies, and use `buildx policy eval` or `buildx policy test` to inspect sources or test policy logic. [Build policy usage](https://docs.docker.com/build/policies/usage/)
docker buildx build --policy filename=<path-to-policy.rego> .