@@ -43,39 +43,27 @@ to see if images you are already using are exposed to vulnerabilities.
4343
4444## Creating attestations
4545
46- When you build an image with ` docker buildx build ` , you can add attestation
47- records to the resulting image using the ` --provenance ` and ` --sbom ` options.
48- You can opt in to add either the SBOM or provenance attestation type, or both.
49-
50- ``` console
51- $ docker buildx build --sbom=true --provenance=true .
46+ BuildKit generates the attestations when building the image. Provenance
47+ attestations with the ` mode=min ` level are added to images by default. The
48+ attestation records are wrapped in the in-toto JSON format and attached to the
49+ image index in a manifest for the final image.
50+
51+ You can customize attestation behavior using the ` --provenance ` and ` --sbom `
52+ flags:
53+
54+ ``` bash
55+ # Opt in to SBOM attestations:
56+ docker buildx build --sbom=true .
57+ # Opt in to max-level provenance attestations:
58+ docker buildx build --provenance=mode=max .
59+ # Opt out of provenance attestations:
60+ docker buildx build --provenance=false .
5261```
5362
54- > [ !NOTE]
55- >
56- > The default image store doesn't support attestations. If you're using the
57- > default image store and you build an image using the default ` docker ` driver,
58- > or using a different driver with the ` --load ` flag, the attestations are
59- > lost.
60- >
61- > To make sure the attestations are preserved, you can:
62- >
63- > - Use a ` docker-container ` driver with the ` --push ` flag to push the image to
64- > a registry directly.
65- > - Enable the [ containerd image store] ( /manuals/desktop/features/containerd.md ) .
66-
67- > [ !NOTE]
68- >
69- > Provenance attestations are enabled by default, with the ` mode=min ` option.
70- > You can disable provenance attestations using the ` --provenance=false ` flag,
71- > or by setting the [ ` BUILDX_NO_DEFAULT_ATTESTATIONS ` ] ( /manuals/build/building/variables.md#buildx_no_default_attestations ) environment variable.
72- >
73- > Using the ` --provenance=true ` flag attaches provenance attestations with ` mode=min `
74- > by default. See [ Provenance attestation] ( ./slsa-provenance.md ) for more details.
75-
76- BuildKit generates the attestations when building the image. The attestation
77- records are wrapped in the in-toto JSON format and attached to the image
78- index in a manifest for the final image.
63+ You can also disable default provenance attestations by setting the
64+ [ ` BUILDX_NO_DEFAULT_ATTESTATIONS ` ] ( /manuals/build/building/variables.md#buildx_no_default_attestations )
65+ environment variable. See [ Provenance attestation] ( ./slsa-provenance.md ) for
66+ more details about provenance modes and options.
7967
8068## Storage
8169
0 commit comments