Bake: Inconsistent behavior with SSH mounts and remote contexts

Contributing guidelines

• I've read the contributing guidelines and wholeheartedly agree

I've found a bug and checked that ...

• ... the documentation does not mention anything about my problem
• ... there are no open or closed issues that are related to my problem

Description

When building a Bake target that specifies the ssh = [{ id = "default" }] with a remote context (over SSH in my case), passing the --allow=ssh argument in the command breaks the SSH agent mounts inside the build.

Without the argument, and replying y to the prompt, the build works as expected.

Expected behaviour

Adding the --allow=ssh has the same effect as authorizing SSH from the prompt.

Actual behaviour

If --allow=ssh is passed, the SSH mounts break (authentication to whatever SSH resource fails)

Buildx version

github.com/docker/buildx v0.34.1 e0b0e77d18d3379bc1e0d55f3b37de288d36fe47

Docker info

Client: Docker Engine - Community
 Version:    29.5.3
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.34.1
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v5.1.4
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 2
  Running: 2
  Paused: 0
  Stopped: 0
 Images: 49
 Server Version: 29.5.3
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /run/cdi
 Discovered Devices:
  cdi: nvidia.com/gpu=0
  cdi: nvidia.com/gpu=GPU-087894cc-eb36-b96a-56b0-ee464e9803ca
  cdi: nvidia.com/gpu=all
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 nvidia runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 193637f7ee8ae5f5aa5248f49e7baa3e6164966e
 runc version: v1.3.5-0-g488fc13e
 init version: de40ad0
 Security Options:
  apparmor
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.17.0-35-generic
 Operating System: Ubuntu 24.04.4 LTS
 OSType: linux
 Architecture: x86_64
 CPUs: 20
 Total Memory: 38.86GiB
 Name: LC-Vostro-7620
 ID: 5ac15a31-14ea-467c-ba45-ce2bfb9896ba
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  10.37.42.100:5000
  ::1/128
  127.0.0.0/8
 Live Restore Enabled: false
 Firewall Backend: iptables
  EnableUserlandProxy: true
  UserlandProxyPath: /usr/bin/docker-proxy

Builders list

NAME/NODE               DRIVER/ENDPOINT                   STATUS    BUILDKIT   PLATFORMS
default*                docker                                                 
 \_ default              \_ default                       running   v0.30.0    linux/amd64 (+3), linux/arm64, linux/arm (+2), linux/ppc64le, (7 more)
remote-arm64            docker                                                 
 \_ remote-arm64         \_ remote-arm64                      running   v0.26.3    linux/arm64

Configuration

# syntax=docker/dockerfile:1.10

FROM ubuntu:jammy AS build

RUN apt-get update && \
    apt-get install -y openssh-client git

WORKDIR /ws
RUN --mount=type=ssh \
    git clone git@github.com:<private-repo>

target "build-target" {
  dockerfile = "docker/build.Dockerfile"
  target     = "build"
  ssh = [{ id = "default" }]
}

# Working (yes to SSH prompt)
docker --context remote-arm64 bake build-target

# Failing
docker --context remote-arm64 bake --allow=ssh build-target

Build logs

Additional info

No response

Start by reproducing the two commands in the issue with docker/build.Dockerfile, the Bake target, and the remote-arm64 context, comparing prompt authorization with --allow=ssh. Trace the Bake and remote-context entry points involved in SSH mount authorization; done means --allow=ssh preserves SSH authentication just like answering yes to the prompt.