Skip to content

build: parallelize forced reference evaluation#3696

Open
tonistiigi wants to merge 1 commit intodocker:masterfrom
tonistiigi:bake-linked-target-fix
Open

build: parallelize forced reference evaluation#3696
tonistiigi wants to merge 1 commit intodocker:masterfrom
tonistiigi:bake-linked-target-fix

Conversation

@tonistiigi
Copy link
Member

fix #3543

@nicocrm

Use an errgroup helper to evaluate result refs concurrently during forced evaluation, and fail fast on the first evaluation error.

This mitigates the current case in Bake where chained targets with a multi-platform build could miss secrets and other session properties.

The outline for the issue case:

  • Base target is solved, but only lazily and not really loaded/tracked in the build graph yet.
  • Child targets are loaded, base target waits.
  • Evaluate is called for the base stage (because it might be missing the result condition), the child stage is processed as the build result. This happens in parallel.
  • Because Evaluate() was called synchronously, it may not have been called yet for the second platform while the child target already needs to run RUN --mount=type=secret.

This isn't a completely proper fix, but in practice, it should make the request timings so that the wrong order of steps does not occur. There is still misalignment that buildx seems to assume that after non-evaluated solve result is returned, the associated LLB is reference counted for the duration of the build request. While in reality, the lazy solve just returns the handle to the LLB definition in the request without attempting to load it into the build graph at all. Possible fixes for this would be to make BuildKit load the LLB but not trigger graph evaluation even on lazy solve, or add something new in the gateway API like ref.Prepare() that does the same thing explicitly.

Use an errgroup helper to evaluate result refs concurrently during forced
evaluation, and fail fast on the first evaluation error.

This mitigates current case in bake where chained targets with
a multi-platform build could miss secrets and other session properties.

The outline for the issue case:
- Base target is solved but only lazily and not really loaded/tracked
in build graph yet.
- Child targets are loaded, base target waits.
- Evaluate is called for base stage (because it might be missing result
condition), child stage is processed as build result. This happens in
parallel.
- Because `Evaluate()` was called synchronously, it may have not been
 called yet for the second platform while the child target already
 needs to run `RUN --mount=type=secret`.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
@crazy-max crazy-max added this to the v0.33.0 milestone Mar 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Docker Buildx Bake Secret Mounting Fails During Multi-Platform Context Build

2 participants