
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
docker build syntaxYou have three types of container image builds:
In the latter case, buildkit's client CLI buildctl is great because it doesn't depend on any docker-ish platform.
While BuildKit is a generic DAG runner we only ever care about it's ability to process Dockerfiles.
This repo publishes the NPM package buildctl that redistributes the client binary from BuildKit releases.
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. buildctl is its command-line interface.
npm install buildctl
Or globally:
npm install -g buildctl
After installation, the buildctl command will be available:
buildctl --help
This package also provides a buildctl-dockerfile command (aliased as buildctl-d) that offers a simplified interface similar to docker build for common Dockerfile-based builds:
buildctl-dockerfile [OPTIONS] CONTEXT
Options:
-f, --file DOCKERFILE - Path to the Dockerfile (default: Dockerfile in context)--build-arg KEY=VALUE - Set build arguments-t, --tag IMAGE - Name and optionally tag for the built image--push - Push the image to registry (requires -t/--tag or --output in passthrough)--dry-run - Print the buildctl command that would be executed-- - Pass remaining arguments directly to buildctlExamples:
# Build with default Dockerfile in current directory
buildctl-dockerfile .
# Build with custom Dockerfile
buildctl-dockerfile -f custom.Dockerfile .
# Build with build arguments
buildctl-dockerfile --build-arg NODE_VERSION=18 --build-arg ENV=production .
# Build and tag the image
buildctl-dockerfile -t myapp:latest .
# Build, tag and push the image
buildctl-dockerfile -t myregistry.com/myapp:latest --push .
# See what buildctl command would be executed (dry run)
buildctl-dockerfile --dry-run .
# Combine options
buildctl-dockerfile -f docker/Dockerfile -t myapp:v1.0 --build-arg VERSION=1.0 ./src
# Pass additional buildctl options
buildctl-dockerfile . -- --progress=plain --no-cache --export-cache type=local,dest=/tmp/cache
# Override output destination (ignores -t flag if specified)
buildctl-dockerfile -t ignored:tag . -- --output type=registry,name=myregistry.com/image:latest,push=true
Note: If --output is provided in passthrough arguments (after --), it will override any output configuration from the -t/--tag option. The command validates for conflicting options:
-t/--tag and name= in passthrough --output--push and push= in passthrough --output--push requires either -t/--tag or --output in passthrough argumentsThe command translates these familiar options into the appropriate buildctl build syntax with the dockerfile frontend.
This package automatically installs the correct binary for your platform:
This package uses optional dependencies to install platform-specific packages containing the buildctl binary for your system. The main package serves as a wrapper that selects the appropriate binary.
Platform-specific packages follow the naming pattern: buildctl-{os}-{arch}
Package versions correspond to BuildKit releases. For example, version 0.22.0 contains buildctl from BuildKit v0.22.0.
This package is licensed under Apache-2.0, same as BuildKit.
The buildctl binary is built and distributed by the BuildKit project: https://github.com/moby/buildkit
To run the regression test suite for the buildctl-dockerfile command:
./test-dockerfile.sh
See TESTS.md for detailed test documentation and manual test cases.
FAQs
CLI for BuildKit, a toolkit for converting source code to build artifacts
The npm package buildctl receives a total of 9 weekly downloads. As such, buildctl popularity was classified as not popular.
We found that buildctl demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.