Bake: Cannot `--set` target ssh paths option

[rster2002]

Contributing guidelines

• I've read the contributing guidelines and wholeheartedly agree

I've found a bug and checked that ...

• ... the documentation does not mention anything about my problem
• ... there are no open or closed issues that are related to my problem

Description

The --set option does not seem to allow setting the (target).ssh.paths option.

Expected behaviour

Given the following Bake file:

target "default" {
  # ...
  ssh = [
    {
      id = "default"
    }
  ]
}

I'd expect to be able to use:

docker buildx bake default --set="*.ssh.paths=$HOME/.ssh/id_ed25519" --print
# or
docker buildx bake default --set="*.ssh.paths+=$HOME/.ssh/id_ed25519" --print
# (Not sure which one would be the correct syntax in this case)

To get a final config that looks something like this:

{
    "target": {
        "default": {
            "ssh": [
                {
                    "id": "default",
                    "paths": [
                        "/Users/username/.ssh/id_ed25519"
                    ]
                }
            ]
        }
    }
}

Actual behaviour

The actual output looks like this:

{
    "target": {
        "default": {
            "ssh": [
                {
                    "id": "/Users/username/.ssh/id_ed25519"
                }
            ]
        }
    }
}

Buildx version

github.com/docker/buildx v0.30.1-desktop.1 792b8327a475a5d8c9d5f4ea6ce866e7da39ae8b

Docker info

Client:
 Version:    29.1.2
 Context:    desktop-linux
 Debug Mode: false
 Plugins:
  ai: Docker AI Agent - Ask Gordon (Docker Inc.)
    Version:  v1.17.0
    Path:     /Users/bjorn/.docker/cli-plugins/docker-ai
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.30.1-desktop.1
    Path:     /Users/bjorn/.docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.40.3-desktop.1
    Path:     /Users/bjorn/.docker/cli-plugins/docker-compose
  debug: Get a shell into any image or container (Docker Inc.)
    Version:  0.0.45
    Path:     /Users/bjorn/.docker/cli-plugins/docker-debug
  desktop: Docker Desktop commands (Docker Inc.)
    Version:  v0.2.0
    Path:     /Users/bjorn/.docker/cli-plugins/docker-desktop
  extension: Manages Docker extensions (Docker Inc.)
    Version:  v0.2.31
    Path:     /Users/bjorn/.docker/cli-plugins/docker-extension
  init: Creates Docker-related starter files for your project (Docker Inc.)
    Version:  v1.4.0
    Path:     /Users/bjorn/.docker/cli-plugins/docker-init
  mcp: Docker MCP Plugin (Docker Inc.)
    Version:  v0.28.0
    Path:     /Users/bjorn/.docker/cli-plugins/docker-mcp
  model: Docker Model Runner (Docker Inc.)
    Version:  v1.0.2
    Path:     /Users/bjorn/.docker/cli-plugins/docker-model
  offload: Docker Offload (Docker Inc.)
    Version:  v0.5.29
    Path:     /Users/bjorn/.docker/cli-plugins/docker-offload
  pass: Docker Pass Secrets Manager Plugin (beta) (Docker Inc.)
    Version:  v0.0.15
    Path:     /Users/bjorn/.docker/cli-plugins/docker-pass
  sandbox: Docker Sandbox (Docker Inc.)
    Version:  v0.6.0
    Path:     /Users/bjorn/.docker/cli-plugins/docker-sandbox
  sbom: View the packaged-based Software Bill Of Materials (SBOM) for an image (Anchore Inc.)
    Version:  0.6.0
    Path:     /Users/bjorn/.docker/cli-plugins/docker-sbom
  scout: Docker Scout (Docker Inc.)
    Version:  v1.18.3
    Path:     /Users/bjorn/.docker/cli-plugins/docker-scout

Server:
 Containers: 42
  Running: 0
  Paused: 0
  Stopped: 42
 Images: 47
 Server Version: 29.1.2
 Storage Driver: overlayfs
  driver-type: io.containerd.snapshotter.v1
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Discovered Devices:
  cdi: docker.com/gpu=webgpu
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 1c4457e00facac03ce1d75f7b6777a7a851e5c41
 runc version: v1.3.4-0-gd6d73eb8
 init version: de40ad0
 Security Options:
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.12.54-linuxkit
 Operating System: Docker Desktop
 OSType: linux
 Architecture: aarch64
 CPUs: 10
 Total Memory: 15.6GiB
 Name: docker-desktop
 ID: 2b58ae97-c765-4313-8ca7-95f463801be8
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 HTTP Proxy: http.docker.internal:3128
 HTTPS Proxy: http.docker.internal:3128
 No Proxy: hubproxy.docker.internal
 Labels:
  com.docker.desktop.address=unix:///Users/bjorn/Library/Containers/com.docker.docker/Data/docker-cli.sock
 Experimental: false
 Insecure Registries:
  hubproxy.docker.internal:5555
  ::1/128
  127.0.0.0/8
 Live Restore Enabled: false
 Firewall Backend: iptables

Builders list

NAME/NODE           DRIVER/ENDPOINT     STATUS    BUILDKIT   PLATFORMS
silly_euclid        docker-container
 \_ silly_euclid0    \_ desktop-linux   stopped
default             docker
 \_ default          \_ default         running   v0.26.2    linux/amd64 (+2), linux/arm64, linux/ppc64le, linux/s390x, (2 more)
desktop-linux*      docker
 \_ desktop-linux    \_ desktop-linux   running   v0.26.2    linux/amd64 (+2), linux/arm64, linux/ppc64le, linux/s390x, (2 more)
luna-1              docker
 \_ luna-1           \_ luna-1          running   v0.24.0    linux/amd64 (+4), linux/386
orbstack                                error

Cannot load builder orbstack: Cannot connect to the Docker daemon at unix:///Users/bjorn/.orbstack/run/docker.sock. Is the docker daemon running?

Configuration

target "default" {
  # ...
  ssh = [
    {
      id = "default"
    }
  ]
}

docker buildx bake default --set="*.ssh.paths=$HOME/.ssh/id_ed25519" --print
# or
docker buildx bake default --set="*.ssh.paths+=$HOME/.ssh/id_ed25519" --print
# (Not sure which one would be the correct syntax in this case)

Build logs

Additional info

No response

[jsternberg]

Other patterns I tried:

$ --set '*.ssh.0.paths=/home/xxx/.ssh/id_rsa'
"ssh": [
    {
        "id": "/home/xxx/.ssh/id_rsa"
    }
]
$ --set '*.ssh.0.id=/home/xxx/.ssh/id_rsa'
"ssh": [
    {
        "id": "/home/xxx/.ssh/id_rsa"
    }
]
$ --set '*.ssh.0=/home/xxx/.ssh/id_rsa'
"ssh": [
    {
        "id": "/home/xxx/.ssh/id_rsa"
    }
]

I suspect that the 0 is likely needed and missing from the original issue but it still doesn't seem to work even if you include that. It instead opts to replace the id attribute.

[tonistiigi]

I think only args and contexts support --set with sub-selectors. Others just replace or add to the array. It is weird though that there is no error or warning for the unsupported keys. https://github.com/docker/buildx/blob/v0.30.1/bake/bake.go#L598-L601