Docker 29.9.2 build recipe

github.com/moby/moby (docker-v29.9.2) at 0367cbeb49b9d98cb0b4f51e95f7b54b4803e76c

Also built from source:

• cli: github.com/docker/cli (v29.9.2) at a82e528901260c8df6073311379eac65f92db204
• containerd: github.com/containerd/containerd (v2.4.2) at b7a25261e029d68978bbf290df0a62fc819b3c51
• runc: github.com/opencontainers/runc (v1.5.2) at 29dd3dc2b13b4123162e5fe132504bb4b15569f1
• rootlesskit: github.com/rootless-containers/rootlesskit (v3.3.0) at 888c3189e9cdf34dcdb19011e1c7c34eb94b5393

Fetched once, with the network on, by the vendor step (Dockerfile.vendor) when the kit was made; the offline build uses the kit's vendored copies:

• git https://github.com/moby/moby.git docker-v29.9.2

• Base imagegolang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af
• Base imageubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c
• BuildKitmoby/buildkit:v0.31.2
  sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0
• Build methodsource-rebuild-go
• SOURCE_DATE_EPOCH1792515187 (2026-10-20T16:53:07Z)
• Target digest (linux/amd64)sha256:f97b1b29d0c0da6df421b790650defe2e2f890540092bc44def0d166398d429b
• Target config digestsha256:2f3f6efccec99247420b7bdd4509ef0ae4a9bc9c8142cfefade5e7e97818a743
• Checksummed kit files40,511 (CHECKSUMS.sha256)

# =====================================================================
# Docker Engine 29.9.2 (rootless Docker-in-Docker) L-009 HERMETIC OFFLINE BUILD — the canonical, attestation-producing
# build. build_kit runs
#   docker buildx build --builder readystack-builder-max --network=none
#     --attest type=provenance,mode=max --attest type=sbom --push <git-context>
# Pinned-public-base + vendored model: golang 1.26.10 + ubuntu 24.04 pinned BY DIGEST (BASE_IMAGE_DIGESTS.lock);
# vendored/*-src are fully vendored Go trees (GOPROXY=off, -mod=vendor), every Go program in the image compiled here on
# the one pinned Go (the toolchain upstream's 29.9.2 bundle reports: go1.26.10); vendored/debs is the apt closure.
# Dockerfile and Dockerfile.offline are byte copies of this file (the repo-wide convention).
#
# SHAPE: docker-library's docker:29-dind-rootless on Ubuntu 24.04: dockerd, containerd and runc run as the non-root user
# rootless (uid 1000) inside a rootlesskit user namespace with slirp4netns networking; the container needs --privileged
# (as docker:dind-rootless does). The Docker API is the unix socket $XDG_RUNTIME_DIR/docker.sock and, with TLS
# (DOCKER_TLS_CERTDIR=/certs, the default), tcp://0.0.0.0:2376 with client certificates.
# =====================================================================
FROM golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af AS gobuild
# libseccomp-dev for runc (built with seccomp support, as upstream builds it), dpkg'd offline.
RUN --mount=type=bind,source=vendored/builddebs,target=/tmp/builddebs dpkg -i /tmp/builddebs/*.deb
ENV GOTOOLCHAIN=local GOWORK=off GOFLAGS="-mod=vendor -buildvcs=false" GOPROXY=off CGO_ENABLED=0
# Fail closed on a stale toolchain: `go version <binary>` reads the toolchain recorded in the binary. gocheck ends every
# compile RUN and empties the Go build cache, so no stage's layer keeps it.
RUN printf '%s\n' '#!/bin/sh' 'set -eu' 'for b in "$@"; do v=$(go version "$b" | awk "{print \$2}"); echo "$b: $v";' \
      '[ "$(printf "%s\n%s\n" go1.26.10 "$v" | sort -V | head -n1)" = go1.26.10 ] || { echo "$b built with $v < go1.26.10" >&2; exit 1; }; done' \
      'go clean -cache' > /usr/local/bin/gocheck && chmod 0755 /usr/local/bin/gocheck

Continues: 128 more lines. Create a free account to read the rest, or sign in.

Published with one line redacted (internal host).

#!/usr/bin/env bash
# =============================================================================
# ReadyStack — offline reproducible rebuild.
#
# Rebuilds this product's image from THIS ARCHIVE ALONE, with no network access
# of any kind, and prints the resulting linux/amd64 image-manifest digest.
# Run ./VERIFY_OFFLINE.sh afterwards to assert it equals the published digest.
#
# Requirements: linux/amd64 Docker host, docker buildx >= 0.30, jq, tar.
# No git, no registry access, no additional tooling.
#
#   ./BUILD_OFFLINE.sh                the rebuild (OCI image + a docker-loadable copy)
#   ./BUILD_OFFLINE.sh --provenance   the same rebuild with SLSA v1 build provenance (mode=max) attached to the OCI
#                                     image, generated by BuildKit, not by any build step. Run on your own hardened,
#                                     isolated build platform and sign that provenance with a key the build cannot
#                                     reach, and the result meets SLSA Build Level 3 (see REBUILD.md). The image
#                                     digest is the same either way.
# =============================================================================
set -euo pipefail
PROVENANCE=0
for arg in "$@"; do
  case "$arg" in
    --provenance) PROVENANCE=1 ;;
    -h|--help) sed -n '2,20p' "$0"; exit 0 ;;

Continues: 101 more lines. Create a free account to read the rest, or sign in.