chore: enable SBOM attestation for image builds (#16852)

mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00

- Added SBOM (Software Bill of Materials) generation during Docker build
to enhance traceability. Refer to Docker documentation on SBOM:
https://docs.docker.com/build/metadata/attestations/sbom/
- Updated Docker build scripts to use BuildKit for provenance and SBOM
support: https://docs.docker.com/build/metadata/attestations/
- Configured Docker daemon in dogfood image to support the Containerd
snapshotter feature to improve performance:
https://docs.docker.com/engine/storage/containerd/

> [!Important]
> We also need to enable `containerd` on depot runners.
> <img width="587" alt="image"
src="https://github.com/user-attachments/assets/1d7f87c7-fdcc-462a-babe-87ac6486ad09"
/>



## Testing

- Tested locally with ` docker buildx build --sbom=true --output
type=local,dest=out -f Dockerfile .` to verify that an SBOM file is
generated.
- Tested in
[CI](https://github.com/coder/coder/actions/runs/13731162662/job/38408790980?pr=16852#step:17:1)
to ensure the image builds without any errors.


Also closes coder/internal#88

This commit is contained in:

M Atif Ali

2025-03-11 00:24:14 +05:00

committed by

GitHub

parent 8c0350e20c

commit 05ebece03a

3 changed files with 8 additions and 2 deletions

									
										.github/workflows/release.yaml
									
		+1
		
												View File
												
				@@ -361,6 +361,7 @@ jobs:

				          file: scripts/Dockerfile.base

				          platforms: linux/amd64,linux/arm64,linux/arm/v7

				          provenance: true

				          sbom: true

				          pull: true

				          no-cache: true

				          push: true