{
  "slug": "buildx-build-and-bake-support-experimental-rego-source-policies-3d7caa46bcfe",
  "title": "buildx build and bake support experimental Rego source policies",
  "tools": [
    "buildx"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-01-22T00:18:29.000Z",
  "announced_at": "2026-01-22T00:18:29.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "For local-context builds, Buildx loads a matching `.rego` policy automatically; use `--policy` to add or control policies, and use `buildx policy eval` or `buildx policy test` to inspect sources or test policy logic. [Build policy usage](https://docs.docker.com/build/policies/usage/)",
    "examples": [
      "docker buildx build --policy filename=<path-to-policy.rego> .",
      "docker buildx policy eval --filename <Dockerfile-name> .",
      "docker buildx policy test <path-to-policy-tests>"
    ],
    "gotchas": [
      "Version: v0.31.0",
      "Availability: experimental",
      "--policy filename=<path>: Load the specified policy file; it is added to automatic policy loading unless reset is enabled.",
      "--policy reset=true|false: When true, ignore automatically loaded policies and use only specified policies.",
      "--policy disabled=true|false: When true, disable policy evaluation.",
      "--policy strict=true|false: When true, fail if policies are not loaded or the BuildKit daemon does not support them.",
      "--policy log-level=<level>: Set policy logging to `error`, `warn`, `info`, `debug`, or `none`.",
      "policy: Bake target attribute listing policy files; automatic loading alongside the target Dockerfile is also supported.",
      "--filename <name>: For `policy eval`, select the Dockerfile name whose policy to load; defaults to `Dockerfile`.",
      "source (required): For `policy eval`, the source to evaluate.",
      "<path> (required): For `policy test`, path to the policy tests.",
      "Prerequisite: Build policies are experimental in the v0.31.0 release.",
      "Prerequisite: In v0.31.0, only builds from the local build context load policies.",
      "Only builds from the local build context currently load policies.",
      "Docs conflict: The current Bake usage page documents `policy` as a list of policy-file strings; the current Bake reference says entries use the `--policy` keys (`filename`, `reset`, `disabled`, `strict`, `log-level`). The v0.31.0 release note only establishes that a target `policy` key was added, so its exact value shape is not established here.",
      "Docs conflict: The current Bake usage page says Bake does not support `reset`, `strict`, or `disabled` in the HCL file; use command-line flags for those options. This may describe behavior newer than v0.31.0."
    ]
  },
  "why_it_matters": "Enforce source policies when building a repository with Buildx.",
  "sources": [
    "https://github.com/docker/buildx/releases/tag/v0.31.0",
    "https://docs.docker.com/build/policies/usage/",
    "https://docs.docker.com/reference/cli/docker/buildx/policy/eval/",
    "https://docs.docker.com/reference/cli/docker/buildx/policy/test/"
  ],
  "rank": 0.96025,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave1b-20261016",
    "verdict_id": "wave1b-20261016:wave1b-20261016-f7712a60cc987a7c-1:gate",
    "evidence_hash": "c24a02b05121e6f5ea15a3e91f6081dbc961264a52cbc85ed092b08d62e7ec83"
  },
  "review": {
    "draft_hash": "bc4419e2776a924f904c95d1ee759eeb546bc6d50bef4a0d6f13d3dc9a4686fb",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave1b-20261016:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.96 >= 0.9; 2 needed) and Jev gave 0.63 (>= 0.6 needed)."
  }
}