Add ability to do OS and language package installs when running --network=none

Summary: provide a way to install arbitrary packages - both OS and language - without using RUN.

The ability to disable network via --network=none is important when building. This is especially powerful for compliance, source tracking, and reproducible builds.

If I can RUN anything, then the number of ways that I can install something is infinite. This makes it impossible to parse a Dockerfile to learn all source code, which can lead to license compliance and security scanning issues.

Did I do RUN apk add? RUN apt install? RUN git clone? RUN curl -O https://example.com/foo.tgz? RUN go build (which may or may not have downloaded)? RUN my-command.sh which calls other-cmd.sh which calls some binary which downloads software?

The curl issue is resolved by ADD features; the upcoming git features of ADD bring it a step forward.

What happens when I need to install OS packages? Language-specific packages?

The key here is not "no network access", but rather "no arbitrary network access", which --network=none provides, by eliminating access for RUN, not for ADD.

As a first blush, I would propose that we either extend ADD or use a new command like INSTALL (see this moby issue) that can install arbitrary package types. The same way I can ADD a file from a URL or a git repo, I can ADD an apk package, an apt package, go mod download, npm install, etc.

In terms of syntax, I could see something like:

ADD --type=apk bash=1.2.3

Or just as easily bash@1.2.3 or bash#1.2.3.

For languages, each language usually has a standard format for "install all my dependencies", so:

ADD --type=go /workdir
# OR
WORKDIR /workdir
ADD --type=go .

The above would run go mod download. We could extend it to:

ADD --type=npm /workdir

which would run npm install.

We could just as easily use INSTALL instead of ADD, if that fits better.

Either way, the goal would be to get the benefits of --network=none while working with the various needs - OS and language - to install dependencies.

I am aware that, at least for languages, we could download all of those things and add them to git commit (vendoring of various kinds), but that isn't always a realistic option, e.g.

ADD https://github.com/some/project.git#v1.2.3
RUN go build

The above will fail if it is a 3rd-party project that does not have everything vendored.

As discussed in community Slack with @jedevc and @AkihiroSuda

The issue identifies no files, tests, or entry points. Start by reviewing BuildKit's handling of --network=none and the existing ADD behavior, then read the linked Moby issue 39467. Done would require an agreed design and implementation for controlled OS and language package installation without arbitrary RUN network access.