{
  "slug": "buildkit-exec-steps-can-route-network-traffic-through-an-http-proxy-07cc6cf32dd2",
  "title": "BuildKit exec steps can route network traffic through an HTTP proxy",
  "tools": [
    "buildkit"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-06-17T23:13:34.000Z",
  "announced_at": "2026-06-17T23:13:34.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When you need to inspect exec-step network requests or apply source policies to them, enable BuildKit proxy networking for the daemon or build, then review the build output. Use a source policy to allow, deny, or convert matching proxy-visible HTTP(S) GET URLs.",
    "examples": [
      "buildctl build --proxy-network --frontend dockerfile.v0 --local context=<context-dir> --local dockerfile=<dockerfile-dir>",
      "buildkitd --proxy-network",
      "buildctl build --proxy-network --source-policy-file <policy.json> --frontend dockerfile.v0 --local context=<context-dir> --local dockerfile=<dockerfile-dir>"
    ],
    "gotchas": [
      "Version: v0.31.0",
      "--proxy-network: Enables proxy networking for the build; daemon-level `buildkitd --proxy-network` or `proxyNetwork = true` in `buildkitd.toml` also enables it.",
      "--source-policy-file <policy.json>: Loads source-policy rules from the named file; the policy can allow, deny, or convert matching proxy-visible HTTP(S) GET URLs.",
      "proxyNetwork: Daemon config boolean; set `true` to enable proxy networking by default.",
      "rules[].action (required): Documented policy example uses `CONVERT`; proxy policy can also allow or deny matching requests.",
      "rules[].selector.identifier (required): Selects a source by identifier; policy examples match identifiers such as HTTP URLs and docker-image references.",
      "rules[].updates.identifier: Replacement identifier for a `CONVERT` policy rule; the example pins an image reference to a digest.",
      "rules[].updates.attrs: Attributes to update for a `CONVERT` policy rule; the example sets `http.checksum`.",
      "Prerequisite: Proxy networking applies to exec traffic with network access; non-exec fetch paths are outside its scope.",
      "Prerequisite: For `RUN --network=host`, enable `network.host` on both daemon (`--allow-insecure-entitlement network.host`) and build request (`--allow network.host`).",
      "Prerequisite: This implementation is Linux-focused.",
      "The proxy applies to exec steps; the release does not provide enablement syntax or configuration details."
    ]
  },
  "why_it_matters": "Inspect or constrain network requests made by containers during a build.",
  "sources": [
    "https://github.com/moby/buildkit/releases/tag/v0.31.0",
    "https://github.com/moby/buildkit/blob/v0.31.0/docs/proxy.md",
    "https://github.com/moby/buildkit/blob/v0.31.0/docs/build-repro.md"
  ],
  "rank": 0.98043,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3-rejudge+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave1b-20261016",
    "verdict_id": "wave1b-20261016:wave1b-20261016-74f4da6d581433aa-1:rescue",
    "evidence_hash": "229d2ae5bfdc1550624d3fc7998a48005eaab9d4d2a8408a309f41ebd1c6be7f"
  },
  "review": {
    "draft_hash": "461a11aa922b3dc1c8acb084f80e7d26629fef96785f146233bd4d016acf4ce1",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave1b-20261016:rescue",
    "reason": "Rescue path: first rejected only because the extracted card lacked usage; judged again on the enriched card, 3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.98 >= 0.9; 2 needed) and Jev gave 0.63 (>= 0.6 needed)."
  }
}