docker/compose
1
0
Fork 0
mirror of https://github.com/docker/compose.git synced 2026-10-12 02:13:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(build): skip remote URL contexts from bake fs.read allowlist

Browse Source 
When a service's build context is a remote git/HTTP URL, the path was
unconditionally added to bake's --allow fs.read= entitlements. On Windows,
bake then tries to evaluate the URL as a local filesystem path and fails
because `https:` is invalid path syntax (colon is reserved for drive
letters).

Apply the same gitutil.ParseGitRef + "://" check already used for
additional_contexts so that remote contexts are skipped from the fs.read
allowlist.

Fixes #13815

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Signed-off-by: Nicolas De loof <[email protected]>
This commit is contained in:
Nicolas De loof
2026-06-05 15:13:36 +02:00
committed by Guillaume Lours
co-authored by Claude Opus 4.7
parent d9d9e87882
commit 9834762bd7
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/compose/build_bake.go
+3 -1
View File
@@ -197,7 +197,9 @@ func (s *composeService) doBuildBake(ctx context.Context, project *types.Project
}
}
read = append(read, buildConfig.Context)
if _, _, err := gitutil.ParseGitRef(buildConfig.Context); !strings.Contains(buildConfig.Context, "://") && err != nil {
read = append(read, buildConfig.Context)
}
for _, path := range buildConfig.AdditionalContexts {
_, _, err := gitutil.ParseGitRef(path)
if !strings.Contains(path, "://") && err != nil {