remove buildx as a Go dependency - #14123
Merged
Merged
Conversation
thaJeztah
reviewed
Aug 25, 2026
| // EncodedAuth returns the credentials for the registry hosting the given | ||
| // image reference, base64-encoded as expected by the Docker API's | ||
| // X-Registry-Auth header. | ||
| func EncodedAuth(ref reference.Named, cfg AuthProvider) (string, error) { |
Member
There was a problem hiding this comment.
thaJeztah
reviewed
Aug 25, 2026
ndeloof
force-pushed
the
remove-buildx-dependency
branch
from
August 25, 2026 13:37
c1c6c87 to
5a6bace
Compare
ndeloof
marked this pull request as ready for review
August 25, 2026 13:39
buildx was imported for two narrow purposes, both replaced by docker/cli machinery compose already uses elsewhere: - storeutil.GetProxyConfig -> configfile.ParseProxyConfig, the same lookup docker build uses (also picks up ALL_PROXY and lowercase variants) - the dry-run image resolver (buildx builder + imagetools) -> a DistributionInspect through the daemon with credentials from the CLI config file, i.e. the same path a real pull/push would take; the encoded-auth helper moves to internal/registry, shared with pull.go bake is unaffected: it already execs the buildx CLI plugin. Dropping the module also drops the transitive aws-sdk-go-v2 footprint (-328 lines of go.sum). Signed-off-by: Nicolas De Loof <nicolas.deloof@gmail.com>
EncodedAuth now delegates the X-Registry-Auth wire encoding to moby/api/pkg/authconfig (same module, already required) instead of hand-rolling the JSON+base64url pair, and push.go reuses it instead of its own copy. The CLI and moby AuthConfig structs are field-for-field identical, so a direct type conversion bridges them. The explicit GetAuthConfigKey normalization drops out of EncodedAuth: docker/cli's configfile.GetAuthConfig normalizes the Docker Hub domain itself. It remains for the OCI resolver, whose credential callback receives the network host actually contacted (registry-1.docker.io), which the configfile does not map. Signed-off-by: Nicolas De Loof <nicolas.deloof@gmail.com>
ndeloof
force-pushed
the
remove-buildx-dependency
branch
from
August 25, 2026 13:44
5a6bace to
df6b473
Compare
thaJeztah
reviewed
Aug 25, 2026
Comment on lines
+252
to
+253
| m := make(map[string]*string, len(s.proxyConfig)) | ||
| for k, v := range s.proxyConfig { |
Member
There was a problem hiding this comment.
Ugh; no idea TBH why we picked a map with pointers for this in the CLI (otherwise this could've been a maps.Clone 😞
Member
There was a problem hiding this comment.
Oh, or was this perhaps for the "nil means "take from current environment"?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
buildx was imported for two narrow purposes, both now covered by docker/cli machinery compose already uses elsewhere:
storeutil.GetProxyConfig→configfile.ParseProxyConfig, the same lookupdocker builduses. Behavioral note: build args now also pick upALL_PROXYand the lowercase proxy variants, matchingdocker build.buildx/builder+imagetools) → aDistributionInspectthrough the daemon with credentials from the CLI config file — the same path the real pull/push would take. The encoded-auth helper moves tointernal/registry, shared withpull.go.bake is unaffected: it already execs the buildx CLI plugin rather than importing it. Dropping the module removes 23 buildx packages from the binary and the whole transitive
aws-sdk-go-v2footprint (−328 lines of go.sum).Follows up on the intent recorded in
build_bake.go: "long term plan is to remove buildx as a dependency".🤖 Generated with Claude Code