Skip to content

fix: drop docker/docker and bump buildkit to v0.31.2 via the kaniko fork #535

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
stirby wants to merge 3 commits into
base: main
Choose a base branch
from
+137 −239
Open

fix: drop docker/docker and bump buildkit to v0.31.2 via the kaniko fork #535

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7089f45
fix: drop docker/docker and update buildkit via the kaniko fork
stirby Oct 8, 2026
9e64f32
fix: pin kaniko with layer reader close fix and go-containerregistry …
stirby Oct 8, 2026
77452e6
chore: bump toolchain to go1.26.9 and golang.org/x/net to v0.60.0
stirby Oct 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion devcontainer/devcontainer.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ import (
"github.com/google/go-containerregistry/pkg/name"
"github.com/google/go-containerregistry/pkg/v1/remote"
"github.com/moby/buildkit/frontend/dockerfile/instructions"
"github.com/moby/buildkit/frontend/dockerfile/linter"
"github.com/moby/buildkit/frontend/dockerfile/parser"
"github.com/moby/buildkit/frontend/dockerfile/shell"
"github.com/tailscale/hujson"
Expand Down Expand Up @@ -355,7 +356,9 @@ func UserFromDockerfile(dockerfileContent string, buildArgs map[string]string) (
currentStage *instructions.Stage
)
for _, child := range res.AST.Children {
inst, err := instructions.ParseInstruction(child)
// ParseInstruction uses a nil linter, which panics when buildkit applies
// a "# check=" comment to it.
inst, err := instructions.ParseInstructionWithLinter(child, linter.New(&linter.Config{}))
if err != nil {
return "", fmt.Errorf("parse instruction: %w", err)
}
Expand Down
23 changes: 23 additions & 0 deletions devcontainer/devcontainer_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -266,6 +266,29 @@ func TestUserFromDockerfile_BuildArgs(t *testing.T) {
require.NoError(t, err)
require.Equal(t, "testuser", user)
})

t.Run("LintCheckComment", func(t *testing.T) {
t.Parallel()
registry := registrytest.New(t)
image, err := partial.UncompressedToImage(emptyImage{configFile: &v1.ConfigFile{
Config: v1.Config{
User: "testuser",
},
}})
require.NoError(t, err)
ref := strings.TrimPrefix(registry, "http://") + "/coder/test:latest"
parsed, err := name.ParseReference(ref)
require.NoError(t, err)
err = remote.Write(parsed, image)
require.NoError(t, err)

// buildkit applies "# check=" comments to the linter of the next
// instruction, which panics without an initialized linter.
content := fmt.Sprintf("# syntax note\n# check=skip=JSONArgsRecommended\nFROM %s\n# check=error=true\nRUN echo hi\n", ref)
user, err := devcontainer.UserFromDockerfile(content, nil)
require.NoError(t, err)
require.Equal(t, "testuser", user)
})
}

func TestUserFrom(t *testing.T) {
Expand Down
4 changes: 3 additions & 1 deletion devcontainer/features/features.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@ func extractFromImage(fs billy.Filesystem, directory, reference string) error {
}

var tarLayer *tar.Reader
var layerReader io.ReadCloser
for _, manifestLayer := range manifest.Layers {
if manifestLayer.MediaType != TarLayerMediaType {
continue
Expand All @@ -44,7 +45,7 @@ func extractFromImage(fs billy.Filesystem, directory, reference string) error {
if err != nil {
return fmt.Errorf("fetch feature layer %s: %w", reference, err)
}
layerReader, err := layer.Uncompressed()
layerReader, err = layer.Uncompressed()
if err != nil {
return fmt.Errorf("uncompress feature layer %s: %w", reference, err)
}
Expand All @@ -54,6 +55,7 @@ func extractFromImage(fs billy.Filesystem, directory, reference string) error {
if tarLayer == nil {
return fmt.Errorf("no tar layer found with media type %q: are you sure this is a devcontainer feature?", TarLayerMediaType)
}
defer layerReader.Close()

for {
header, err := tarLayer.Next()
Expand Down
73 changes: 26 additions & 47 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,11 @@ module github.com/coder/envbuilder

go 1.26.5

toolchain go1.26.6
toolchain go1.26.9

// There are a few options we need added to Kaniko!

@Lisa-Fiander Lisa-Fiander Oct 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not caused by this PR, but advisories published yesterday now flag toolchain go1.26.6 (12 reachable stdlib advisories, fixed in 1.26.9) and golang.org/x/net v0.58.0 (fixed in v0.60.0). Worth bumping both here or in a quick follow-up.

@stirby stirby Oct 12, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bumped in 77452e6: toolchain go1.26.9 and golang.org/x/net v0.60.0. x/net v0.60.0 also requires newer x/crypto (v0.57.0), x/sys, x/term, x/text, x/sync and x/mod, so go mod tidy moved those too.

Checks: govulncheck ./... reports 0 reachable advisories. make test (integration included), make lint/go, make fmt and make gen all pass with no diff.

Generated by Coder Agents on behalf of @stirby.

// See: https://github.com/GoogleContainerTools/kaniko/compare/main...coder:kaniko:main
replace github.com/GoogleContainerTools/kaniko => github.com/coder/kaniko v0.0.0-20251107135632-b20ff58093d8
replace github.com/GoogleContainerTools/kaniko => github.com/coder/kaniko v0.0.0-20261008191411-61a5b7da7ea3

@Lisa-Fiander Lisa-Fiander Oct 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The pin points at an unmerged commit(v0.0.0-20261008191411-61a5b7da7ea3) - needs re-pined after merged and make sure coder/kaniko#38 is merged first 

@stirby stirby Oct 12, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed. coder/kaniko#38 is still open, so I've left the pin as is for now. Once #38 merges, I'll re-pin the replace to the merge commit on kaniko main and rerun the checks before this PR merges. This thread can stay open until then as a merge blocker.

Generated by Coder Agents on behalf of @stirby.

@coder-agents-review coder-agents-review Bot Oct 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 [CRF-2] coder/kaniko#38 merged as a51d65b5 on 2026-10-14, and the commits after the pinned 61a5b7da change Go code, so the re-pin is not a no-op. (Ryosuke, Mafu-san, Pariston, Mafuuu, Gon, Leorio)

cd77cdb9 and 8cd8fc68 change pkg/creds/acr/token.go to request the service principal token for https://containerregistry.azure.net instead of settings.Environment.ResourceManagerEndpoint, and b7fcaf3d raises kaniko's go directive from 1.25.9 to 1.26.9, which forces envbuilder's go 1.26.5 up. The description's statement that later commits "only change CI and integration fixtures, not Go code" is incorrect, and none of the listed validation covered the ACR change. Re-pin to a51d65b5 in this PR, run go mod tidy, and update the description and the coder/terraform-provider-envbuilder#138 pin to match.

🤖


// Required to import codersdk due to gvisor dependency.
replace tailscale.com => github.com/coder/tailscale v1.1.1-0.20260529105257-b7c5fc6e6399
Expand All @@ -18,31 +18,31 @@ require (
github.com/coder/coder/v2 v2.37.3
github.com/coder/retry v1.5.1
github.com/coder/serpent v0.15.0
github.com/containerd/platforms v1.0.0-rc.2
github.com/containerd/platforms v1.0.0-rc.4
github.com/distribution/distribution/v3 v3.1.1
github.com/docker/cli v29.2.0+incompatible
github.com/docker/cli v29.5.3+incompatible
github.com/docker/docker v28.5.2+incompatible
github.com/fatih/color v1.19.0
github.com/gliderlabs/ssh v0.3.8
github.com/go-git/go-billy/v5 v5.9.0
github.com/go-git/go-git/v5 v5.19.2
github.com/google/go-cmp v0.7.0
github.com/google/go-containerregistry v0.20.7
github.com/google/go-containerregistry v0.21.7

@coder-agents-review coder-agents-review Bot Oct 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 [CRF-1] go-containerregistry v0.21.7 no longer falls back to plain HTTP for *.local registries, and ENVBUILDER_INSECURE=true does not restore it for envbuilder's own image and feature fetches. (Netero, Mafuuu, Razor)

reLocal in pkg/name/registry.go:28 changed from .*\.local(?:host)? to .*\.localhost. UserFromImage (devcontainer/devcontainer.go:487), extractFromImage (devcontainer/features/features.go:29) and the SkipRebuild path (envbuilder.go:500) call remote.Image on references parsed without name.Insecure, so a devcontainer whose base image or features are on registry.ns.svc.cluster.local:5000 now fails in Compile or on restart, with or without the flag (read from both module versions, not run against a live registry). Parse these three references with name.Insecure when opts.Insecure is set, so the workaround in the description covers them.

🤖

github.com/google/uuid v1.6.0
github.com/hashicorp/go-multierror v1.1.1
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
github.com/mattn/go-isatty v0.0.22
github.com/moby/buildkit v0.16.0
github.com/moby/buildkit v0.31.2
github.com/otiai10/copy v1.14.0
github.com/prometheus/procfs v0.21.1
github.com/sirupsen/logrus v1.9.4
github.com/skeema/knownhosts v1.3.1
github.com/stretchr/testify v1.12.0
github.com/tailscale/hujson v0.0.0-20221223112325-20486734a56a
go.uber.org/mock v0.6.0
golang.org/x/crypto v0.56.0
golang.org/x/mod v0.40.0
golang.org/x/sync v0.22.0
golang.org/x/crypto v0.57.0
golang.org/x/mod v0.41.0
golang.org/x/sync v0.23.0
golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da
)

Expand All @@ -56,7 +56,6 @@ require (
dario.cat/mergo v1.0.2 // indirect
filippo.io/edwards25519 v1.1.1 // indirect
github.com/Azure/azure-sdk-for-go v68.0.0+incompatible // indirect
github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
github.com/Azure/go-autorest v14.2.0+incompatible // indirect
github.com/Azure/go-autorest/autorest v0.11.29 // indirect
github.com/Azure/go-autorest/autorest/adal v0.9.23 // indirect
Expand Down Expand Up @@ -89,7 +88,6 @@ require (
github.com/DataDog/sketches-go v1.4.8 // indirect
github.com/Masterminds/semver/v3 v3.4.0 // indirect
github.com/Microsoft/go-winio v0.6.2 // indirect
github.com/Microsoft/hcsshim v0.14.1 // indirect
github.com/ProtonMail/go-crypto v1.4.1 // indirect
github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d // indirect
github.com/agext/levenshtein v1.2.3 // indirect
Expand Down Expand Up @@ -134,35 +132,28 @@ require (
github.com/charmbracelet/x/cellbuf v0.0.15 // indirect
github.com/charmbracelet/x/json v0.2.0 // indirect
github.com/charmbracelet/x/term v0.2.2 // indirect
github.com/chrismellard/docker-credential-acr-env v0.0.0-20230304212654-82a0ddb27589 // indirect
github.com/cihub/seelog v0.0.0-20170130134532-f561c5e57575 // indirect
github.com/cilium/ebpf v0.16.0 // indirect
github.com/clipperhouse/displaywidth v0.10.0 // indirect
github.com/clipperhouse/uax29/v2 v2.6.0 // indirect
github.com/cloudflare/circl v1.6.3 // indirect
github.com/coder/pretty v0.0.0-20230908205945-e89ba86370e0 // indirect
github.com/coder/quartz v0.3.0 // indirect
github.com/coder/terraform-provider-coder/v2 v2.19.0 // indirect
github.com/coder/websocket v1.8.14 // indirect
github.com/containerd/cgroups/v3 v3.1.2 // indirect
github.com/containerd/containerd/api v1.10.0 // indirect
github.com/containerd/containerd/v2 v2.2.9 // indirect
github.com/containerd/continuity v0.4.5 // indirect
github.com/containerd/errdefs v1.0.0 // indirect
github.com/containerd/errdefs/pkg v0.3.0 // indirect
github.com/containerd/log v0.1.0 // indirect
github.com/containerd/stargz-snapshotter/estargz v0.18.1 // indirect
github.com/containerd/ttrpc v1.2.7 // indirect
github.com/containerd/typeurl/v2 v2.2.3 // indirect
github.com/containerd/typeurl/v2 v2.3.0 // indirect
github.com/coreos/go-iptables v0.6.0 // indirect
github.com/coreos/go-oidc/v3 v3.20.0 // indirect
github.com/cyphar/filepath-securejoin v0.6.1 // indirect
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 // indirect
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
github.com/dimchansky/utfbom v1.1.1 // indirect
github.com/distribution/reference v0.6.0 // indirect
github.com/docker/distribution v2.8.3+incompatible // indirect
github.com/docker/docker-credential-helpers v0.9.5 // indirect
github.com/docker/go-connections v0.6.0 // indirect
github.com/docker/docker-credential-helpers v0.9.8 // indirect
github.com/docker/go-connections v0.7.0 // indirect
github.com/docker/go-events v0.0.0-20250808211157-605354379745 // indirect
github.com/docker/go-metrics v0.0.1 // indirect
github.com/docker/go-units v0.5.0 // indirect
Expand All @@ -186,13 +177,12 @@ require (
github.com/gobwas/glob v0.2.3 // indirect
github.com/goccy/go-json v0.10.6 // indirect
github.com/godbus/dbus/v5 v5.2.2 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
github.com/golang/protobuf v1.5.4 // indirect
github.com/google/btree v1.1.3 // indirect
github.com/google/nftables v0.2.0 // indirect
github.com/google/pprof v0.0.0-20250607225305-033d6d78b36a // indirect
github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 // indirect
github.com/gorilla/css v1.0.1 // indirect
github.com/gorilla/handlers v1.5.2 // indirect
github.com/gorilla/mux v1.8.1 // indirect
Expand Down Expand Up @@ -252,30 +242,21 @@ require (
github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c // indirect
github.com/mitchellh/reflectwalk v1.0.2 // indirect
github.com/moby/docker-image-spec v1.3.1 // indirect
github.com/moby/go-archive v0.1.0 // indirect
github.com/moby/locker v1.0.1 // indirect
github.com/moby/patternmatcher v0.6.0 // indirect
github.com/moby/profiles/seccomp v0.2.4 // indirect
github.com/moby/go-archive v0.3.3 // indirect
github.com/moby/patternmatcher v0.6.1 // indirect
github.com/moby/sys/atomicwriter v0.1.0 // indirect
github.com/moby/sys/mount v0.3.4 // indirect
github.com/moby/sys/mountinfo v0.7.2 // indirect
github.com/moby/sys/reexec v0.1.0 // indirect
github.com/moby/sys/sequential v0.6.0 // indirect
github.com/moby/sys/sequential v0.7.0 // indirect
github.com/moby/sys/signal v0.7.1 // indirect
github.com/moby/sys/symlink v0.3.0 // indirect
github.com/moby/sys/user v0.4.0 // indirect
github.com/moby/sys/user v0.4.1 // indirect
github.com/moby/sys/userns v0.1.0 // indirect
github.com/moby/term v0.5.2 // indirect
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
github.com/morikuni/aec v1.0.0 // indirect
github.com/muesli/termenv v0.16.0 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/open-policy-agent/opa v1.19.0 // indirect
github.com/openai/openai-go/v2 v2.7.1 // indirect
github.com/opencontainers/go-digest v1.0.0 // indirect
github.com/opencontainers/image-spec v1.1.1 // indirect
github.com/opencontainers/runtime-spec v1.3.0 // indirect
github.com/outcaste-io/ristretto v0.2.3 // indirect
github.com/pb33f/ordered-map/v2 v2.3.1 // indirect
github.com/petermattis/goid v0.0.0-20260226131333-17d1149c6ac6 // indirect
Expand All @@ -299,7 +280,7 @@ require (
github.com/richardartoul/molecule v1.0.1-0.20240531184615-7ca0df43c0b3 // indirect
github.com/rivo/uniseg v0.4.7 // indirect
github.com/robfig/cron/v3 v3.0.1 // indirect
github.com/secure-systems-lab/go-securesystemslib v0.10.0 // indirect
github.com/secure-systems-lab/go-securesystemslib v0.11.0 // indirect
github.com/segmentio/asm v1.2.1 // indirect
github.com/sergi/go-diff v1.4.0 // indirect
github.com/shirou/gopsutil/v4 v4.26.2 // indirect
Expand All @@ -316,13 +297,12 @@ require (
github.com/tinylib/msgp v1.6.3 // indirect
github.com/tklauser/go-sysconf v0.3.16 // indirect
github.com/tklauser/numcpus v0.11.0 // indirect
github.com/tonistiigi/go-csvvalue v0.0.0-20240710180619-ddb21b71c0b4 // indirect
github.com/tonistiigi/go-csvvalue v0.0.0-20240814133006-030d3b2625d0 // indirect
github.com/trailofbits/go-mutexasserts v0.0.0-20250514102930-c1f3d2e37561 // indirect
github.com/twpayne/go-vfs/v5 v5.0.4 // indirect
github.com/u-root/uio v0.0.0-20240209044354-b3d14b93376a // indirect
github.com/valyala/fasthttp v1.73.0 // indirect
github.com/valyala/fastjson v1.6.10 // indirect
github.com/vbatts/tar-split v0.12.2 // indirect
github.com/vektah/gqlparser/v2 v2.5.36 // indirect
github.com/vishvananda/netlink v1.3.1 // indirect
github.com/vishvananda/netns v0.0.5 // indirect
Expand All @@ -340,7 +320,6 @@ require (
github.com/zclconf/go-cty v1.19.0 // indirect
github.com/zeebo/errs v1.4.0 // indirect
go.nhat.io/otelsql v0.16.0 // indirect
go.opencensus.io v0.24.0 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/collector/component v1.51.1-0.20260205185216-81bc641f26c0 // indirect
go.opentelemetry.io/collector/featuregate v1.51.1-0.20260205185216-81bc641f26c0 // indirect
Expand All @@ -357,7 +336,7 @@ require (
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.45.0 // indirect
go.opentelemetry.io/otel/exporters/prometheus v0.64.0 // indirect
go.opentelemetry.io/otel/exporters/prometheus v0.65.0 // indirect
go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.21.0 // indirect
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.45.0 // indirect
go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.45.0 // indirect
Expand All @@ -376,12 +355,12 @@ require (
go.yaml.in/yaml/v4 v4.0.0-rc.3 // indirect
go4.org/mem v0.0.0-20220726221520-4f986261bf13 // indirect
go4.org/netipx v0.0.0-20230728180743-ad4cb58a6516 // indirect
golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
golang.org/x/net v0.58.0 // indirect
golang.org/x/exp v0.0.0-20260603202125-055de637280b // indirect
golang.org/x/net v0.60.0 // indirect
golang.org/x/oauth2 v0.36.0 // indirect
golang.org/x/sys v0.47.0 // indirect
golang.org/x/term v0.45.0 // indirect
golang.org/x/text v0.41.0 // indirect
golang.org/x/sys v0.48.0 // indirect
golang.org/x/term v0.46.0 // indirect
golang.org/x/text v0.42.0 // indirect
golang.org/x/time v0.15.0 // indirect
golang.org/x/tools v0.49.0 // indirect
golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
Expand Down
Loading
Loading