Docker Cheatsheet 07 — Buildx and Multi-Arch

docker buildx ls                              # builders
docker buildx create --name mybuilder --use
docker buildx inspect --bootstrap
docker buildx build .                         # uses BuildKit

docker buildx build --platform linux/amd64,linux/arm64 -t myapp:v1 --push .

docker buildx build --load -t myapp .        # load into local docker (single platform)
docker buildx build --push -t myapp .        # push to registry
docker buildx build --output type=tar,dest=out.tar .

docker buildx build \
  --cache-to type=registry,ref=myreg/cache:latest,mode=max \
  --cache-from type=registry,ref=myreg/cache:latest \
  -t myapp .

docker buildx build \
  --cache-to type=local,dest=./cache \
  --cache-from type=local,src=./cache \
  -t myapp .

docker buildx build \
  --cache-to type=inline \
  -t myreg/myapp:latest --push .

# Next build uses image as cache source
docker buildx build \
  --cache-from type=registry,ref=myreg/myapp:latest \
  -t myreg/myapp:next --push .

- uses: docker/setup-buildx-action@v3

- uses: docker/build-push-action@v6
  with:
    context: .
    push: true
    tags: myreg/myapp:${{ github.sha }}
    cache-from: type=gha
    cache-to: type=gha,mode=max
    platforms: linux/amd64,linux/arm64

# docker-bake.hcl
group "default" {
  targets = ["web", "worker"]
}

target "web" {
  context    = "."
  dockerfile = "Dockerfile.web"
  platforms  = ["linux/amd64", "linux/arm64"]
  tags       = ["myreg/web:v1"]
}

target "worker" {
  context    = "."
  dockerfile = "Dockerfile.worker"
  tags       = ["myreg/worker:v1"]
}

docker buildx bake
docker buildx bake --push
docker buildx bake web              # one target

FROM --platform=$BUILDPLATFORM golang:1.22 AS build
ARG TARGETOS TARGETARCH
WORKDIR /src
COPY . .
RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -o /out/app .

FROM scratch
COPY --from=build /out/app /app
ENTRYPOINT ["/app"]

docker run --rm --privileged tonistiigi/binfmt --install all

docker buildx imagetools inspect myreg/myapp:v1

docker buildx build \
  --provenance=true \
  --sbom=true \
  -t myreg/myapp:v1 --push .

docker buildx imagetools inspect --format '{{json .Provenance}}' myreg/myapp:v1
docker scout sbom myreg/myapp:v1

docker buildx create \
  --name remote-builder \
  --driver docker-container \
  --driver-opt image=moby/buildkit:latest \
  --buildkitd-flags '--allow-insecure-entitlement security.insecure' \
  ssh://user@buildhost

docker buildx create \
  --driver kubernetes \
  --name k8s-builder \
  --node mybuilder

- uses: docker/login-action@v3
  with: { registry: ghcr.io, username: ..., password: ... }

- uses: docker/build-push-action@v6
  with:
    context: .
    platforms: linux/amd64,linux/arm64
    push: ${{ github.ref == 'refs/heads/main' }}
    tags: |
      ghcr.io/me/myapp:latest
      ghcr.io/me/myapp:${{ github.sha }}
    cache-from: type=gha
    cache-to: type=gha,mode=max