Skip to content

buildkit

v0.30.0 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

Published 21d Build & Package
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

builder buildkit cloud-native containers docker go
+1 more
oci-image

ReleasePort's take

Light signal
editorial:auto 13d

BuildKit v0.30.0 introduces a "compatibility version" feature enabling reproducible builds across different BuildKit versions.

Why it matters: Plan migrations to leverage the compatibility version for stable CI/CD pipelines; no immediate patch required.

Summary

AI summary

BuildKit adds a “compatibility version” feature for reproducible builds across versions.

Changes in this release

Feature Medium

Builtin Dockerfile frontend updated to v1.24.0

Builtin Dockerfile frontend updated to v1.24.0

Source: llm_adapter@2026-05-21

Confidence: high

 —
Feature Medium

BuildKit supports compatibility version for reproducible builds across versions

BuildKit supports compatibility version for reproducible builds across versions

Source: llm_adapter@2026-05-21

Confidence: high

 —
Feature Medium

Git sources now support fetch-by-commit option using SHA

Git sources now support fetch-by-commit option using SHA

Source: llm_adapter@2026-05-21

Confidence: high

 —
Feature Medium

LLB API supports Git bundle format loading from registry or OCI layout blobs

LLB API supports Git bundle format loading from registry or OCI layout blobs

Source: llm_adapter@2026-05-21

Confidence: high

 —
Feature Medium

Provenance attestations for multi-pass builds include request details

Provenance attestations for multi-pass builds include request details

Source: llm_adapter@2026-05-21

Confidence: high

 —
Feature Medium

Version of built-in Dockerfile frontend included in provenance metadata and worker info APIs

Version of built-in Dockerfile frontend included in provenance metadata and worker info APIs

Source: llm_adapter@2026-05-21

Confidence: high

 —
Feature Medium

Gateway frontend requests can now forward to built-in Dockerfile frontend like external frontends

Gateway frontend requests can now forward to built-in Dockerfile frontend like external frontends

Source: llm_adapter@2026-05-21

Confidence: high

 —
Feature Medium

Improved error reporting for registry errors on cache export

Improved error reporting for registry errors on cache export

Source: llm_adapter@2026-05-21

Confidence: low

 —
Feature Medium

S3 cache now supports retry_mode and retry_max_attempts options

S3 cache now supports retry_mode and retry_max_attempts options

Source: llm_adapter@2026-05-21

Confidence: low

 —
Feature Medium

S3 cache now supports disable_accept_encoding option for GCS interoperability

S3 cache now supports disable_accept_encoding option for GCS interoperability

Source: llm_adapter@2026-05-21

Confidence: low

 —
Performance Medium

Reduced potential lock contention in gateway forwarder for parallel builds

Reduced potential lock contention in gateway forwarder for parallel builds

Source: llm_adapter@2026-05-21

Confidence: high

 —
Performance Medium

Improved session connection health checks to detect connectivity loss better

Improved session connection health checks to detect connectivity loss better

Source: llm_adapter@2026-05-21

Confidence: low

 —
Bugfix Medium

Fixed issue with Git subdirectory not included in SLSA provenance for Git sources

Fixed issue with Git subdirectory not included in SLSA provenance for Git sources

Source: llm_adapter@2026-05-21

Confidence: high

 —
Bugfix Medium

Resolved possible data race in provenance computation on parallel builds

Resolved possible data race in provenance computation on parallel builds

Source: llm_adapter@2026-05-21

Confidence: high

 —
Bugfix Medium

Corrected build cancellation when blocked on credential callback

Corrected build cancellation when blocked on credential callback

Source: llm_adapter@2026-05-21

Confidence: high

 —
Bugfix Medium

Avoided potential deadlock if credential helper misbehaves and never returns credentials

Avoided potential deadlock if credential helper misbehaves and never returns credentials

Source: llm_adapter@2026-05-21

Confidence: low

 —
Bugfix Medium

Fixed provenance capture race in concurrent no-cache builds that left source pins empty

Fixed provenance capture race in concurrent no-cache builds that left source pins empty

Source: llm_adapter@2026-05-21

Confidence: low

 —
Bugfix Medium

Addressed possible data race in progress writer

Addressed possible data race in progress writer

Source: llm_adapter@2026-05-21

Confidence: low

 —
Bugfix Medium

Resolved data race in S3 cache reader

Resolved data race in S3 cache reader

Source: llm_adapter@2026-05-21

Confidence: low

 —
Bugfix Medium

Fixed Git config lookup errors on Windows

Fixed Git config lookup errors on Windows

Source: llm_adapter@2026-05-21

Confidence: low

 —
Refactor Medium

Deprecated previous debug and trace options in buildkitd TOML configuration, adding new log level option

Deprecated previous debug and trace options in buildkitd TOML configuration, adding new log level option

Source: llm_adapter@2026-05-21

Confidence: low

 —
Full changelog

Welcome to the v0.30.0 release of buildkit!

Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.

Contributors

  • Tõnis Tiigi
  • CrazyMax
  • Sebastiaan van Stijn
  • Jonathan A. Sternberg
  • Natnael Gebremariam
  • Akihiro Suda
  • Dawei Wei
  • Dmitrii Kostyrev
  • Jiří Moravčík
  • Vladimir Kuznichenkov

Notable Changes

  • Builtin Dockerfile frontend has been updated to v1.24.0 changelog
  • BuildKit now supports the concept of "compatibility version" for improved reproducible builds support across different BuildKit versions. This allows users to specify a version for which the build should be compatible with, and BuildKit will attempt to maintain compatibility with that version when possible. Compatibility version will be stored in the provenance attestation of the build and can be used to independently verify the artifacts of the build on other BuildKit versions. The current compatibility version and backward compatibility with old versions are defined in Build reproducibility docs #6681
  • Git sources now support fetch-by-commit option where commit is fetched by the SHA and then associated with the reference. This is useful when checking out mutable references refs/NR/merge where the commit SHA may change during invocation and cause checksum mismatch error #6708
  • The LLB API now supports Git bundle format. Git bundles can be loaded from registry or OCI layout blobs and Git sources can be checked out into bundle format for snapshotting #6711
  • Provenance attestations for multi-pass or chained builds now include request details for root requests and individual input requests, allowing full reconstruction of such complex builds #6739
  • The version of the built-in Dockerfile frontend that was used is now included in the provenance metadata and reported via worker info APIs. #6705
  • Improve error reporting for registry errors on cache export #6762
  • S3 cache now supports additional options retry_mode and retry_max_attempts to configure retry behavior of S3 client #6657
  • S3 cache now supports disable_accept_encoding option for GCS interoperability #6642
  • Reduce potential lock contention in gateway forwarder for improved performance on parallel builds #6741
  • A new log level option has been added to the buildkitd TOML configuration; previous "debug" and "trace" options have been deprecated #6732
  • Allow gateway frontend requests to forward to the built-in Dockerfile frontend the same way as to external frontends #6643
  • Session connection health checks have been improved to better detect loss of connectivity and avoid stuck builds #6649
  • Fix issue with Git subdirectory value not being included in ConfigSource section of SLSA provenance for builds from Git sources #6724
  • Avoid potential deadlock if the credential helper in the client is misbehaving and never returns credentials #6709
  • Fix possible data race in provenance computation on parallel builds #6758
  • Fix possible provenance capture race in concurrent no-cache builds that could leave source pins empty and fail with an invalid checksum digest error #6764
  • Fix possible data race in progress writer #6679
  • Fix data race in S3 cache reader #6675
  • Fix possible Git config lookup errors on Windows #6639
  • Fix build cancellation not working properly when blocked on credential callback #6641

Dependency Changes

  • github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 -> v1.21.0
  • github.com/Microsoft/hcsshim v0.14.0-rc.1 -> v0.14.1
  • github.com/aws/aws-sdk-go-v2 v1.41.4 -> v1.41.7
  • github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.5 -> v1.7.8
  • github.com/aws/aws-sdk-go-v2/config v1.32.12 -> v1.32.17
  • github.com/aws/aws-sdk-go-v2/credentials v1.19.12 -> v1.19.16
  • github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 -> v1.18.23
  • github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20 -> v1.4.23
  • github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20 -> v2.7.23
  • github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.12 -> v1.4.24
  • github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 -> v1.13.9
  • github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.3 -> v1.9.12
  • github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.20 -> v1.13.23
  • github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.12 -> v1.19.20
  • github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 -> v1.0.11
  • github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 -> v1.30.17
  • github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 -> v1.35.21
  • github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 -> v1.42.1
  • github.com/aws/smithy-go v1.24.2 -> v1.25.1
  • github.com/containerd/containerd/v2 v2.2.2 -> v2.2.3
  • github.com/docker/cli v29.3.1 -> v29.4.3
  • github.com/go-openapi/runtime v0.29.2 -> v0.29.3
  • github.com/go-openapi/swag v0.25.4 -> v0.25.5
  • github.com/go-openapi/swag/cmdutils v0.25.4 -> v0.25.5
  • github.com/go-openapi/swag/netutils v0.25.4 -> v0.25.5
  • github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 -> v2.28.0
  • github.com/in-toto/in-toto-golang v0.10.0 -> v0.11.0
  • github.com/klauspost/compress v1.18.5 -> v1.18.6
  • github.com/moby/policy-helpers b7c0b994300b -> a39d60132186
  • github.com/moby/profiles/seccomp v0.1.0 -> v0.2.3
  • github.com/sigstore/sigstore v1.10.4 -> v1.10.5
  • github.com/sigstore/timestamp-authority/v2 v2.0.3 -> v2.0.6
  • go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 -> v0.68.0
  • go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.63.0 -> v0.68.0
  • go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 -> v0.68.0
  • go.opentelemetry.io/otel v1.40.0 -> v1.43.0
  • go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.40.0 -> v1.43.0
  • go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.40.0 -> v1.43.0
  • go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0 -> v1.43.0
  • go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0 -> v1.43.0
  • go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.40.0 -> v1.43.0
  • go.opentelemetry.io/otel/metric v1.40.0 -> v1.43.0
  • go.opentelemetry.io/otel/sdk v1.40.0 -> v1.43.0
  • go.opentelemetry.io/otel/sdk/metric v1.40.0 -> v1.43.0
  • go.opentelemetry.io/otel/trace v1.40.0 -> v1.43.0
  • go.opentelemetry.io/proto/otlp v1.9.0 -> v1.10.0
  • golang.org/x/crypto v0.48.0 -> v0.50.0
  • golang.org/x/mod v0.33.0 -> v0.34.0
  • golang.org/x/net v0.51.0 -> v0.53.0
  • golang.org/x/sync v0.19.0 -> v0.20.0
  • golang.org/x/sys v0.42.0 -> v0.43.0
  • golang.org/x/term v0.41.0 -> v0.42.0
  • golang.org/x/text v0.34.0 -> v0.36.0
  • golang.org/x/time v0.14.0 -> v0.15.0
  • google.golang.org/genproto/googleapis/api 8636f8732409 -> 6f92a3bedf2d
  • google.golang.org/genproto/googleapis/rpc 8636f8732409 -> 6f92a3bedf2d
  • google.golang.org/grpc v1.79.3 -> v1.80.0
  • kernel.org/pub/linux/libs/security/libcap/cap v1.2.77 -> v1.2.78
  • kernel.org/pub/linux/libs/security/libcap/psx v1.2.77 -> v1.2.78

Previous release can be found at v0.29.0

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track buildkit

Get notified when new releases ship.

Sign up free

About buildkit

concurrent, cache-efficient, and Dockerfile-agnostic builder toolkit

All releases →

Related context

Beta — feedback welcome: [email protected]