driver: docs to set buildkitd network mode and add tests

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>

docs/reference/buildx_create.md

@@ -90,6 +90,22 @@ configuration file specified by [`--buildkitd-config`](#buildkitd-config). See
 --buildkitd-flags '--debug --debugaddr 0.0.0.0:6666'
 ```
 
+#### BuildKit daemon network mode
+
+You can specify the network mode for the BuildKit daemon with either the
+configuration file specified by [`--buildkitd-config`](#buildkitd-config) using the
+`worker.oci.networkMode` option or `--oci-worker-net` flag here. The default
+value is `auto` and can be one of `bridge`, `cni`, `host`:
+
+```text
+--buildkitd-flags '--oci-worker-net bridge'
+```
+
+> **Note**
+>
+> Network mode "bridge" is supported since BuildKit v0.13 and will become the
+> default in next v0.14.
+
 ### <a name="driver"></a> Set the builder driver to use (--driver)
 
 ```text

tests/build.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"net"
 	"os"
 	"path"
 	"path/filepath"
@@ -48,6 +49,7 @@ var buildTests = []func(t *testing.T, sb integration.Sandbox){
 	testBuildOCIExportNotSupported,
 	testBuildMultiPlatformNotSupported,
 	testDockerHostGateway,
+	testBuildNetworkModeBridge,
 }
 
 func testBuild(t *testing.T, sb integration.Sandbox) {
@@ -432,3 +434,66 @@ RUN ping -c 1 buildx.host-gateway-ip.local
 		require.NoError(t, err, string(out))
 	}
 }
+
+func testBuildNetworkModeBridge(t *testing.T, sb integration.Sandbox) {
+	if sb.Name() != "docker" {
+		t.Skip("skipping test for non-docker workers")
+	}
+
+	var builders []string
+	t.Cleanup(func() {
+		for _, builder := range builders {
+			out, err := rmCmd(sb, withArgs(builder))
+			require.NoError(t, err, out)
+		}
+	})
+
+	dockerfile := []byte(`
+FROM busybox AS build
+RUN ip a show eth0 | awk '/inet / {split($2, a, "/"); print a[1]}' > /ip.txt
+FROM scratch
+COPY --from=build /ip.txt /`)
+	dir := tmpdir(t, fstest.CreateFile("Dockerfile", dockerfile, 0600))
+
+	cases := []struct {
+		name string
+		args []string
+	}{
+		{
+			name: "bridge",
+			// TODO: use stable buildkit image when v0.13.0 released
+			args: []string{"--driver", "docker-container", "--buildkitd-flags=--oci-worker-net=bridge", "--driver-opt", "image=moby/buildkit:master"},
+		},
+		{
+			name: "host",
+			args: []string{"--driver", "docker-container", "--buildkitd-flags=--oci-worker-net=host"},
+		},
+	}
+
+	for _, tt := range cases {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			out, err := createCmd(sb, withArgs(tt.args...))
+			require.NoError(t, err, out)
+			builderName := strings.TrimSpace(out)
+			builders = append(builders, builderName)
+
+			cmd := buildxCmd(sb, withArgs("build", fmt.Sprintf("--output=type=local,dest=%s", dir), dir))
+			cmd.Env = append(cmd.Env, "BUILDX_BUILDER="+builderName)
+			outb, err := cmd.CombinedOutput()
+			require.NoError(t, err, string(outb))
+
+			dt, err := os.ReadFile(filepath.Join(dir, "ip.txt"))
+			require.NoError(t, err)
+
+			ip := net.ParseIP(strings.TrimSpace(string(dt)))
+			require.NotNil(t, ip)
+
+			if tt.name == "bridge" {
+				_, subnet, err := net.ParseCIDR("10.10.0.0/16") // default subnet for bridge network in buildkit: https://github.com/moby/buildkit/blob/489f5fc6a331530daa8a31fb6ed7ba223df8ecb9/cmd/buildkitd/main.go#L474
+				require.NoError(t, err)
+				require.True(t, subnet.Contains(ip))
+			}
+		})
+	}
+}

tests/inspect.go

@@ -17,6 +17,7 @@ func inspectCmd(sb integration.Sandbox, opts ...cmdOpt) (string, error) {
 
 var inspectTests = []func(t *testing.T, sb integration.Sandbox){
 	testInspect,
+	testInspectBuildkitdFlags,
 }
 
 func testInspect(t *testing.T, sb integration.Sandbox) {
@@ -47,3 +48,33 @@ func testInspect(t *testing.T, sb integration.Sandbox) {
 		require.Empty(t, hostGatewayIP, "host-gateway-ip worker label should not be set with non-docker driver")
 	}
 }
+
+func testInspectBuildkitdFlags(t *testing.T, sb integration.Sandbox) {
+	if sb.Name() != "docker-container" {
+		t.Skip("only testing for docker-container driver")
+	}
+
+	var builderName string
+	t.Cleanup(func() {
+		if builderName == "" {
+			return
+		}
+		out, err := rmCmd(sb, withArgs(builderName))
+		require.NoError(t, err, out)
+	})
+
+	out, err := createCmd(sb, withArgs("--driver", "docker-container", "--buildkitd-flags=--oci-worker-net=bridge"))
+	require.NoError(t, err, out)
+	builderName = strings.TrimSpace(out)
+
+	out, err = inspectCmd(sb, withArgs(builderName))
+	require.NoError(t, err, out)
+
+	for _, line := range strings.Split(out, "\n") {
+		if v, ok := strings.CutPrefix(line, "BuildKit daemon flags:"); ok {
+			require.Contains(t, v, "--oci-worker-net=bridge")
+			return
+		}
+	}
+	require.Fail(t, "--oci-worker-net=bridge not found in inspect output")
+}

tests/integration.go

@@ -47,8 +47,10 @@ func buildxCmd(sb integration.Sandbox, opts ...cmdOpt) *exec.Cmd {
 	}
 
 	if builder := sb.Address(); builder != "" {
-		cmd.Args = append(cmd.Args, "--builder="+builder)
-		cmd.Env = append(cmd.Env, "BUILDX_CONFIG=/tmp/buildx-"+builder)
+		cmd.Env = append(cmd.Env,
+			"BUILDX_CONFIG=/tmp/buildx-"+builder,
+			"BUILDX_BUILDER="+builder,
+		)
 	}
 	if context := sb.DockerAddress(); context != "" {
 		cmd.Env = append(cmd.Env, "DOCKER_CONTEXT="+context)