Skip to content

Suse v29.4.0 patches#1

Open
rcmadhankumar wants to merge 2 commits intoSUSE:suse-v29.4.0from
rcmadhankumar:suse-v29.4.0-patches
Open

Suse v29.4.0 patches#1
rcmadhankumar wants to merge 2 commits intoSUSE:suse-v29.4.0from
rcmadhankumar:suse-v29.4.0-patches

Conversation

@rcmadhankumar
Copy link
Copy Markdown

- What I did

- How I did it

- How to verify it

- Description for the changelog

- A picture of a cute animal (not mandatory but encouraged)

cyphar added 2 commits April 16, 2026 14:27
For systems with SUSEConnect auto-injection enabled, docker-buildx does
not include our injected secrets. For SLE15 and earlier, enabling
"docker build" to auto-switch to "docker buildx build" would thus break
existing users of the feature.

So, make DOCKER_BUILDKIT=0 the default. Users can still opt-in to using
BuildKit with DOCKER_BUILDKIT=1 or using subcommands like "docker bake"
or "docker buildx $foo", but existing users won't be broken by the
change.

Users that do switch BuildKit can inject SCC credentials in a far more
deliberate (and thus more secure) manner by using

  RUN --mount=type=secret,id=SCCcredentials zypper -n ...

in their Dockerfiles, and then using

  docker buildx build --secret id=SCCcredentials,src=/etc/zypp/credentials.d/SCCcredentials,type=file .

for their builds.

SUSE-Bug: https://jira.suse.com/browse/PED-12534
SUSE-Bug: https://jira.suse.com/browse/PED-8905
SUSE-Bug: https://bugzilla.suse.com/show_bug.cgi?id=1247594
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
The reference to a "buildx component" is a little confusing in the
context of (open)SUSE packaging and might confuse users, as they just
need to install the "docker-buildx" package.

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants