---
next_cursor: eyJzY29yZSI6MCwic2VxIjoxOTgzLCJzaW5jZSI6bnVsbCwidG9vbCI6ImJ1aWxkeCIsInYiOjF9
has_more: false
next: https://sincecutoff.com/v1/changes.md?tool=buildx&score=0&cursor=eyJzY29yZSI6MCwic2VxIjoxOTgzLCJzaW5jZSI6bnVsbCwidG9vbCI6ImJ1aWxkeCIsInYiOjF9
items: 10
---
# sincecutoff.com changes: buildx

## Bake --var sets variables from the command line (buildx, 2026-01-22)
Published 2026-10-16
- slug: bake-var-sets-variables-from-the-command-line-b5b4b0587d6c
- score: 0.98

How to use it:

When a repository build needs Bake variable values supplied on the command line, run `docker buildx bake` with `--var name=value` and the target to build. This sets the variable without setting an environment variable.

Examples:

```
docker buildx bake --var <name>=<value> <target>
```

- why_it_matters: Set Bake variable values for a repository build without setting environment variables.
- before: Set variable values using environment variables.
- sources: <https://github.com/docker/buildx/releases/tag/v0.31.0>, <https://docs.docker.com/reference/cli/docker/buildx/bake/>, <https://docs.docker.com/build/bake/introduction/>, <https://docs.docker.com/build/bake/reference/>
- gotchas: "Version: v0.31.0"; "--var <name>=<value>: Sets a Bake variable value; the documented value format is `name=value`."; "<target>: Names a Bake target to build; the CLI also accepts no target argument."; "Prerequisite: Buildx must be installed to use `docker buildx bake`. The `--var` flag is available in Buildx v0.31.0."; "Prerequisite: The repository needs a Bake definition; Bake searches the current working directory for one when `--file` is omitted."

## buildx build and bake support experimental Rego source policies (buildx, 2026-01-22)
Published 2026-10-16
- slug: buildx-build-and-bake-support-experimental-rego-source-policies-3d7caa46bcfe
- score: 0.96

How to use it:

For local-context builds, Buildx loads a matching `.rego` policy automatically; use `--policy` to add or control policies, and use `buildx policy eval` or `buildx policy test` to inspect sources or test policy logic. [Build policy usage](https://docs.docker.com/build/policies/usage/)

Examples:

```
docker buildx build --policy filename=<path-to-policy.rego> .
```

```
docker buildx policy eval --filename <Dockerfile-name> .
```

```
docker buildx policy test <path-to-policy-tests>
```

- why_it_matters: Enforce source policies when building a repository with Buildx.
- sources: <https://github.com/docker/buildx/releases/tag/v0.31.0>, <https://docs.docker.com/build/policies/usage/>, <https://docs.docker.com/reference/cli/docker/buildx/policy/eval/>, <https://docs.docker.com/reference/cli/docker/buildx/policy/test/>
- gotchas: "Version: v0.31.0"; "Availability: experimental"; "--policy filename=<path>: Load the specified policy file; it is added to automatic policy loading unless reset is enabled."; "--policy reset=true|false: When true, ignore automatically loaded policies and use only specified policies."; "--policy disabled=true|false: When true, disable policy evaluation."; "--policy strict=true|false: When true, fail if policies are not loaded or the BuildKit daemon does not support them."; "--policy log-level=<level>: Set policy logging to `error`, `warn`, `info`, `debug`, or `none`."; "policy: Bake target attribute listing policy files; automatic loading alongside the target Dockerfile is also supported."; "--filename <name>: For `policy eval`, select the Dockerfile name whose policy to load; defaults to `Dockerfile`."; "source (required): For `policy eval`, the source to evaluate."; "<path> (required): For `policy test`, path to the policy tests."; "Prerequisite: Build policies are experimental in the v0.31.0 release."; "Prerequisite: In v0.31.0, only builds from the local build context load policies."; "Only builds from the local build context currently load policies."; "Docs conflict: The current Bake usage page documents `policy` as a list of policy-file strings; the current Bake reference says entries use the `--policy` keys (`filename`, `reset`, `disabled`, `strict`, `log-level`). The v0.31.0 release note only establishes that a target `policy` key was added, so its exact value shape is not established here."; "Docs conflict: The current Bake usage page says Bake does not support `reset`, `strict`, or `disabled` in the HCL file; use command-line flags for those options. This may describe behavior newer than v0.31.0."

## buildx imagetools supports --metadata-file (buildx, 2026-03-04)
Published 2026-10-16
- slug: buildx-imagetools-supports-metadata-file-ce726e9fccfc
- score: 0.94

How to use it:

When creating a new image from registry sources, pass `--metadata-file` to write create-result metadata, including descriptor and digest values, as JSON. The output directory must already exist and be writable.

Examples:

```
docker buildx imagetools create -t <image:tag> <source1> <source2> --metadata-file <metadata.json>
```

- why_it_matters: Capture descriptor or digest metadata while working with an image through imagetools.
- sources: <https://github.com/docker/buildx/releases/tag/v0.32.0>, <https://github.com/docker/buildx/blob/v0.32.0/docs/reference/buildx_imagetools_create.md>
- gotchas: "Version: v0.32.0"; "--metadata-file <string>: Write create-result metadata as JSON to the specified file."; "-t, --tag <image>: Set the reference for the new image."; "SOURCE...: Source manifests or images; they must already exist in the registry where the new manifest is created."; "Prerequisite: The metadata file's directory must already exist and be writable."; "Prerequisite: Source manifests must already exist in the registry where the new manifest is created."

## buildx policy eval accepts --platform (buildx, 2026-03-31)
Published 2026-10-16
- slug: buildx-policy-eval-accepts-platform-84d16d7abdac
- score: 0.93

How to use it:

When evaluating an image source for a specific target platform, run `docker buildx policy eval --platform <os/arch> docker-image://<image>`.

Examples:

```
docker buildx policy eval --platform <os/arch> docker-image://<image>
```

- why_it_matters: Evaluate a policy for image sources targeting a specific platform.
- sources: <https://github.com/docker/buildx/releases/tag/v0.33.0>, <https://docs.docker.com/reference/cli/docker/buildx/policy/eval/>, <https://docs.docker.com/build/policies/usage/>
- gotchas: "Version: v0.33.0"; "source (required): Source to evaluate; the policy usage docs identify `docker-image://` as the image-source prefix."; "--platform: Target platform for policy evaluation."

## buildx policy eval reads policy from stdin with -f - (buildx, 2026-03-31)
Published 2026-10-16
- slug: buildx-policy-eval-reads-policy-from-stdin-with-f-fd4d0e441929
- score: 0.93

How to use it:

When evaluating a policy supplied on standard input, run `docker buildx policy eval -f - <source>`; `-f -` reads the policy from stdin.

Examples:

```
docker buildx policy eval -f - <source>
```

- why_it_matters: Evaluate a policy supplied through standard input.
- sources: <https://github.com/docker/buildx/releases/tag/v0.33.0>, <https://docs.docker.com/reference/cli/docker/buildx/policy/eval/>
- gotchas: "Version: v0.33.0"; "-f, --file: Policy filename to evaluate; `-` reads policy from stdin. Defaults to `Dockerfile`."; "Prerequisite: Buildx v0.33.0 or later for reading policy from stdin with `-f -`."

## buildx policy evaluation verifies HTTP sources with PGP signatures (buildx, 2026-03-31)
Published 2026-10-16
- slug: buildx-policy-evaluation-verifies-http-sources-with-pgp-signatures-f360a649d4eb
- score: 0.97

How to use it:

When evaluating an HTTP source against a build policy, use `docker buildx policy eval` with the source URL. Buildx v0.33.0 adds the `verify_http_pgp_signature` policy builtin; its documented arguments and invocation were not found.

Examples:

```
docker buildx policy eval <HTTP-source-URL>
```

- why_it_matters: Evaluate a build policy that verifies an HTTP source using a PGP signature.
- sources: <https://github.com/docker/buildx/releases/tag/v0.33.0>, <https://docs.docker.com/build/policies/usage/>, <https://docs.docker.com/reference/cli/docker/buildx/policy/eval/>
- gotchas: "Version: v0.33.0"; "source (required): Source to evaluate; the docs show an HTTP URL as an example."; "verify_http_pgp_signature: Release note names this policy builtin for verifying HTTP sources with PGP signatures; its arguments and parameters were not found in the official documentation searched."; "-f, --file: Policy filename to evaluate; defaults to `Dockerfile`."; "Prerequisite: Buildx 0.31.0 or later and BuildKit 0.26.0 or later."

## buildx local output supports mode=delete (buildx, 2026-06-17)
Published 2026-10-16
- slug: buildx-local-output-supports-mode-delete-a75ffebe67a5
- score: 0.98

How to use it:

When a build or bake local export should replace its destination, set `mode=delete`. For multi-platform exports, use BuildKit v0.31.0 or later; exporting outside a subdirectory of the working directory requires `--allow=buildx.local.delete` or TUI confirmation.

Examples:

```
docker buildx build --output type=local,dest=<output-dir>,mode=delete .
```

```
docker buildx bake --allow=buildx.local.delete <target>
```

- why_it_matters: When exporting a build or bake result to replace a destination directory, configure the local output to use delete mode.
- before: The local output merged the build result into the destination directory.
- sources: <https://github.com/docker/buildx/releases/tag/v0.35.0>, <https://docs.docker.com/reference/cli/docker/buildx/build/>, <https://github.com/docker/buildx/blob/master/docs/bake-reference.md>
- gotchas: "Version: v0.35.0"; "--output / -o (required): Sets the export action; use `type=local` for a local directory export."; "dest (required): Destination directory for local export files."; "mode (required): Local output write mode: `copy` or `delete`; `delete` removes stale destination files after export. Values are alternatives, not combinable."; "--allow=buildx.local.delete: Allows delete mode when destination is the working directory or resolves outside it; Buildx docs say it is unnecessary for a destination subdirectory."; "Prerequisite: For multi-platform exports, BuildKit v0.31.0 or later is required."; "The destination directory must be a subdirectory of the working directory unless `--allow=buildx.local.delete` is provided or the action is confirmed in the TUI."; "Multi-platform exports require BuildKit v0.31.0+."

## Bake resolves files relative to the bake file (buildx, 2026-07-29)
Published 2026-10-16
- slug: bake-resolves-files-relative-to-the-bake-file-ba5618640ace
- score: 0.94

How to use it:

When Bake file paths should resolve from the file that defines them, set `BUILDX_BAKE_FILE_RELATIVE_PATHS=true` and run Bake. The setting applies to local directory paths in `target.context` and `target.contexts`; use `cwd://` for paths that should stay relative to the working directory.

Examples:

```
BUILDX_BAKE_FILE_RELATIVE_PATHS=true docker buildx bake -f <bake-file> [<target>...]
```

- why_it_matters: Run Bake when file paths should resolve from the bake file's location instead of the current working directory.
- before: By default, local directory build contexts in Bake files resolve from the current working directory.
- sources: <https://github.com/docker/buildx/releases/tag/v0.36.0>, <https://github.com/docker/buildx/blob/v0.36.0/docs/bake-reference.md>, <https://docs.docker.com/reference/cli/docker/buildx/bake/>
- gotchas: "Version: v0.36.0"; "BUILDX_BAKE_FILE_RELATIVE_PATHS (required): Set to `true` to enable file-relative path resolution. The v0.36.0 release note uses `true`; the tagged reference documents the equivalent setting as `1`."; "-f, --file <file>: Select the Bake definition file; Bake searches the current working directory if omitted."; "Prerequisite: Use Buildx v0.36.0 or later for this change."

## buildx bake overrides declared secret sources (buildx, 2026-07-29)
Published 2026-10-16
- slug: buildx-bake-overrides-declared-secret-sources-47196575d315
- score: 0.96

How to use it:

When a Bake target already declares a secret, override that secret’s source for this invocation with `--set target.secret.<id>=...`, using an existing secret source attribute such as `env=` or `src=`. The secret ID must already be declared by the target.

Examples:

```
docker buildx bake --set <target>.secret.<id>=env=<ENV_VAR>
```

```
docker buildx bake --set <target>.secret.<id>=src=<FILE_PATH>
```

- why_it_matters: Build a Bake target that already declares a secret, supplying its source for this invocation.
- sources: <https://github.com/docker/buildx/releases/tag/v0.36.0>, <https://github.com/docker/buildx/pull/3962>, <https://docs.docker.com/build/bake/reference/>, <https://docs.docker.com/reference/cli/docker/buildx/bake/>, <https://docs.docker.com/build/bake/introduction/>
- gotchas: "Version: v0.36.0"; "--set (required): Override a target configuration using `targetpattern.key[.subkey]=value`; repeatable."; "<target> (required): Bake target whose declared secret source is being overridden; target patterns are supported."; "secret.<id> (required): Selects the source override for a secret already declared by the target. The secret ID must already exist; any inline `id=` must match. The `secrets.<id>` plural alias is invalid for this form."; "env=<ENV_VAR> (required): Names the environment variable used as the secret source."; "src=<FILE_PATH> (required): Names the file used as the secret source."; "Prerequisite: Buildx must be installed to use `docker buildx bake`."; "Prerequisite: The secret must already be declared by the target."; "The secret must already be declared by the target."; "The override fails if the secret ID is not already declared or if an inline `id=` does not match."

## Bake `--jobs/-j` configures execution modes and parallelism (buildx, 2026-10-07)
Published 2026-10-16
- slug: bake-jobs-j-configures-execution-modes-and-parallelism-d67ed9a539d4
- score: 0.96

How to use it:

When coordinating Bake targets, use `--jobs` to set a concurrency limit and choose how failures or output are handled. Combine the mode and limit in one flag value, such as `--jobs=defer-error,parallel=2`.

Examples:

```
docker buildx bake --jobs=defer-output
```

```
docker buildx bake --jobs=defer-error,parallel=2
```

- why_it_matters: When coordinating Bake jobs for a build, configure the execution mode and parallelism limit.
- sources: <https://github.com/docker/buildx/releases/tag/v0.38.0>, <https://docs.docker.com/reference/cli/docker/buildx/bake/>, <https://docs.docker.com/build/bake/introduction/>
- gotchas: "Version: v0.38.0"; "--jobs, -j: Sets target execution behavior; accepts `N`, `mode[,parallel=N]`, or `mode`. Default mode is `fail-fast`."; "mode: Use `defer-error` to let independent targets continue after a target fails, or `defer-output` to wait until participating targets reach the output boundary before exporting. Modes are alternatives; choose one per flag value."; "parallel: Non-negative integer target concurrency limit. Omitted or `0` means no target concurrency limit; an integer `N` is shorthand for `parallel=N`. With `defer-output`, a nonzero limit must be at least the number of participating targets, including implicit targets referenced through `target:` contexts."; "Prerequisite: Bake is available through `docker buildx bake` when Buildx is installed."

Next: https://sincecutoff.com/v1/changes.md?tool=buildx&score=0&cursor=eyJzY29yZSI6MCwic2VxIjoxOTgzLCJzaW5jZSI6bnVsbCwidG9vbCI6ImJ1aWxkeCIsInYiOjF9
Save `next_cursor`; next visit, pass it to get only what was published since.
<!-- end of page -->