GeezerVison is showing github.com — Put cache mounts into GitHub Actions cache and reuse it between builds · Issue #328 · docker/github-builder
Put cache mounts into GitHub Actions cache and reuse it between builds #328
Description
Description
According to the Docker’s official documentation:
BuildKit doesn't preserve cache mounts in the GitHub Actions cache by default. To put your cache mounts into GitHub Actions cache and reuse it between builds, you can use a workaround provided by reproducible-containers/buildkit-cache-dance.
This GitHub Action creates temporary containers to extract and inject cache mount data during Docker build steps.
However, once we use docker/github-builder/.github/workflows/build.yml, we can no longer use reproducible-containers/buildkit-cache-dance as a workaround, because we no longer have control over the runner that actually executes the build.
I would like to propose integrating reproducible-containers/buildkit-cache-dance into docker/github-builder/.github/workflows/build.yml so that we can put cache mounts into the GitHub Actions cache and reuse them between builds.
Activity
crazy-max commented on Nov 5, 2026
Yes but I don't think we want to integrate this kind of workaround into github-builder.
We sign and verify BuildKit's GitHub Actions cache to preserve the trust boundary between the caller's repository and the Docker-maintained build workflow (see #56). Restoring files through actions/cache and injecting them into cache mounts would bypass that verification and reintroduce a path for untrusted cache contents to influence the build.
I'd prefer to address this through native BuildKit support, along the lines of moby/buildkit#1512, rather than maintaining an extraction/injection workaround here. That proposal doesn't itself solve cache authentication, so any integration would still need to preserve the same trust guarantees as our existing signed cache.
Metadata
Metadata
Development
No branches or pull requestsIssue actions