Build Number Attestation For Free

Buildx is a drop-in replacement for the legacy build client used in earlier versions of Docker Engine and Docker Desktop. In newer versions of Docker Desktop and Docker Engine, you're using Buildx by default when you invoke the docker build command.

The provenance attestations include facts about the build process, including details such as: Build timestamps. Build parameters and environment. Version control metadata. Source code details.

After a container image is built, an attestation can be created to affirm that a required activity was performed on the image such as a regression test, vulnerability scan, or other test. The attestation is created by signing the image's unique digest.

The default docker driver only supports embedded cache, using the inline cache type. To use external cache, you must select an alternative build driver. If you use secrets or credentials inside your build process, ensure you manipulate them using the dedicated --secret option.

Additionally, --provenance can be used with boolean values to broadly enable or disable provenance attestations. For example, --provenance=false can be used to disable all provenance attestations, while --provenance=true can be used to enable all provenance attestations.

Attestation Manifest Attestation manifests are attached to the root image index object, under a separate OCI image manifest. Each attestation manifest can contain multiple attestation blobs, with all the of the attestations in a manifest applying to a single platform manifest.

$ docker buildx build --sbom=true --provenance=true . Provenance attestations are enabled by default, with the mode=min option. You can disable provenance attestations using the --provenance=false flag, or by setting the BUILDX_NO_DEFAULT_ATTESTATIONS environment variable.