Repository navigation
Conversation
Ilyes512
changed the title
The plan job reads the commit time with git log -1 --pretty=%ct and freezes it in the definition as the SOURCE_DATE_EPOCH build arg, so every platform builds with the same one. BuildKit uses it for the created timestamps in the image config and its history. The build writes the image with rewrite-timestamp=true, which also sets the time of every file the build created to SOURCE_DATE_EPOCH; without it every RUN leaves the build's own time in the layers. CREATED, and with it the org.opencontainers.image.created label and annotations, is now that commit time instead of the time of the run, so the same commit builds the same image. test-bake.yml gets a Reproducible job that builds a test image twice without cache and fails when the digests differ.
Ilyes512
force-pushed
the
4.0/reproducible
branch
from
November 9, 2026 14:01
8d210df to
ca9dc17
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follows https://docs.docker.com/build/ci/github-actions/reproducible-builds/ and BuildKit's
docs/build-repro.md.SOURCE_DATE_EPOCHwithgit log -1 --pretty=%ct, once. Bake carries it into every target'sargs, so it is frozen in the definition and every platform builds with the same value. BuildKit uses it forcreatedin the image config and its history.rewrite-timestamp=true. Without it, files created byRUNkeep the build's own time and the layer digests change on every build.SOURCE_DATE_EPOCHalone isn't enough.CREATED(and with it theorg.opencontainers.image.createdlabel and annotations) is now the commit time as RFC 3339, not the time of the run. This publishes differently; it's in the migration guide.Verified locally: two clean builds of the test image gave the same digest with
rewrite-timestamp=trueand different digests without it. The newReproduciblejob intest-bake.ymlchecks this on every PR.plan.shgains two cases (20 in total).Not covered, as the docs say: unpinned base images and packages, provenance attestations, and BuildKit's
compatibility-version(not set).Part of the 4.0.0 stack. Merge bottom to top: #82 → #83 → #84 → #85 → #86 → #88.