aws / aws/aws-cdk

(aws-ecr-assets): DockerImageAsset cacheTo property causes "unknown flag: --cache-to" error

Open
#24,685 8 comments 9 reactions 0 assignees View on GitHub
@aws-cdk/aws-ecr-assets effort/medium feature-request p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

CDK DockerImageAsset has a recently-added cacheTo property.

This option should allow the Docker build cache to be exported, in order to be used to improve performance of future builds.

But instead using this property in a CDK CodePipeline causes a CodeBuild error.

### Expected Behavior

The cacheTo property should save a Docker build cache to the selected destination, in this case ECR.

### Current Behavior

Instead the build process fails with the following `unknown flag: --cache-to` error:

```
[23:55:56] [20%] debug: docker --config /tmp/cdkDockerConfigH10b build --tag cdkasset-2991adba35b --file Dockerfile --platform linux/arm64 --cache-to 'type=registry,ref=${Token[TOKEN.608]}.dkr.ecr.${Token[TOKEN.607]}.${Token[AWS.URLSuffix.5]}/${Token[TOKEN.602]}:tag,mode=max' .
unknown flag: --cache-to
```

### Reproduction Steps

```
const cache = new ecr.Repository(this, 'Cache');
const image = new DockerImageAsset(this, 'Image', {
directory: join(__dirname, '../'),
file: 'Dockerfile',
platform: Platform.LINUX_ARM64,
cacheTo: {
type: 'registry',
params: {
ref: `${cache.repositoryUri}:tag`,
mode: 'max',
},
}
});
```

### Possible Solution

This seems to be because the CodeBuild Docker build process isn't using BuildKit.

I've tried using the following config but it still runs `docker build` rather than `docker buildx build`. Adding the same environment to `selfMutationCodeBuildDefaults` also doesn't seem to help.

```
codeBuildDefaults: {
buildEnvironment: {
environmentVariables: {
DOCKER_BUILDKIT: {
value: '1',
},
},
},
},
```

### Additional Information/Context

Some properties have a comment referencing BuildKit as a requirement, perhaps this property also needs a similar comment:

```
/**
* Build secrets.
*
* Docker BuildKit must be enabled to use build secrets.
*
* @see https://docs.docker.com/build/buildkit/
*
* @default - no build secrets
*
* @example
*
* {
* 'MY_SECRET': DockerBuildSecret.fromSrc('file.txt')
* }
*/
readonly buildSecrets?: {
[key: string]: string;
};
```

Although I haven't been able to find documentation on enabling BuildKit for DockerImageAsset.

### CDK CLI Version

2.69.0

### Framework Version

_No response_

### Node.js Version

16

### OS

LinuxBuildImage.STANDARD_6_0

### Language

Typescript

### Language Version

_No response_

### Other information

The pull requests adding the cacheTo property: https://github.com/aws/aws-cdk/pull/24024 & https://github.com/aws/aws-cdk/pull/24524

Contributor guide

Open the contributing guide

Research direction

Start at the DockerImageAsset cacheTo implementation and the CodeBuild path that invokes Docker builds; compare the reported docker build command with the BuildKit requirements. Reproduce the issue using the supplied ECR cache configuration, and consider the work done when the build exports its cache to ECR without the unknown flag error.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, docker, typescript
Domain
build-system, cloud, devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.