docs(buildkit): 上游 PR #6996(env 变量式上游代理)端到端验证报告与部署资产

[TommyLike]

背景

上游社区(gmarmstrong)在 moby/buildkit#6996 用环境变量实现了"内置 exec 代理链到上游代理"——与本仓库 fork 方案([proxy] 段 + upstreamCACert)路线不同:无 cert 配置,CA 信任下沉系统信任库。本 PR 记录我们用上游实现重新编译镜像、跑通端到端验证的结果与可复现资产。

改动

• reports/buildkit-pr6996-validation-20260813.md(新增):完整测试报告——两条路线对比、测试配置、三场景实测矩阵、关键结论、遗留建议、复现方法
• buildkit/buildkitd-6996.toml(新增):无 [proxy] 段,仅 proxyNetwork = true
• buildkit/docker-compose.6996.yml(新增):env 变量式部署(HTTP(S)_PROXY + SSL_CERT_FILE),与 fork 版并列、互不影响
• buildkit/README.md:新增「上游 PR #6996 变体」小节 + 目录树补两行

实测结果(镜像 tommylike/buildkit-6996:test,从 gmarmstrong/buildkit@proxy-chaining 编译)

场景	结果
正对照(SSL_CERT_FILE = Squid CA)	✅ RUN 内 HTTPS 下载 200,RPM 14.9MB
缓存(二次构建)	✅ Squid TCP_HIT 75 → 76
负对照(无 CA,隔离 RUN 路径)	✅ exec 代理对 bump 证书校验失败 → 502

关键结论

1. 功能正确:env 生效、大小写优先级、NO_PROXY 语义、fail-closed 均符合设计
2. 无 cert 配置 → SSL_CERT_FILE 走系统信任库,实测成立(newProxyTransport 的 TLSClientConfig == nil → 系统池回退,代码+实测双重确认)
3. PULL 也走代理是 BuildKit 既有标准行为(非本 PR 引入),一次 env 配置同时覆盖 PULL+RUN,与 deploy/ 的 splice + registry-proxy 架构互补
4. 结论:上游 #6996 可替代我们的 fork

不涉及

• 未改主测试套件、fork 版 buildkit 资产原样保留(两套并列)。

🤖 Generated with Claude Code

[opensourceways-bot]

Welcome To opensourceways Community

Hey @TommyLike , thanks for your contribution to the community.

Bot Usage Manual

I'm the Bot here serving you. You can find the instructions on how to interact with me at Here . That means you can comment below every pull request or issue to trigger Bot Commands.

[opensourceways-bot]

CLA Signature Pass

TommyLike, thanks for your pull request. All authors of the commits have signed the CLA. 👍

[opensourceways-bot]

Linking Issue Notice

@TommyLike , the pull request must be linked to at least one issue.
If an issue has already been linked, but the needs-issue label remains, you can remove the label by commenting /check-issue .