Docker Buildx is a Docker CLI plugin that extends the native `docker build` command with advanced BuildKit capabilities. It provides a rich command surface for multi-platform builds, declarative bake files (HCL/JSON/Compose), cache management, image attestations and provenance, policy-based source verification (OPA/Rego), and interactive debugging via a Debug Adapter Protocol (DAP) server. The architecture is driver-based, supporting local Docker, Docker containers, Kubernetes, remote TCP/Unix sockets, and a cloud driver. The codebase is written in Go and follows a modular structure with clear separation between CLI commands, build orchestration, driver implementations, policy evaluation, and utility packages. It includes an extensive integration test suite and CI pipelines that test across multiple BuildKit and Docker versions.
envbuilder is a CLI tool written in Go that builds and runs Dev Containers (as defined by devcontainer.json) inside Docker containers, using a forked version of Kaniko for image building. In production, it clones a Git repository, locates a devcontainer.json or Dockerfile, compiles a Dockerfile with requested features, builds the image via Kaniko (with layer caching), and then executes lifecycle scripts (onCreate, postCreate, etc.) before running an init command as a specified user. It is designed to integrate with Coder workspaces for log forwarding but can operate standalone. The architecture is a single binary with modular components: options parsing (options/), Git operations (git/), devcontainer spec handling (devcontainer/), Kaniko build orchestration (envbuilder.go), and logging (log/). It relies on system calls for user switching (setuid), execution (exec), and filesystem mounts. External dependencies include Git, Docker daemon, and the Kaniko fork. The tool supports extensive configuration via CLI flags and environment variables, with legacy variable support. Key entry points are cmd/envbuilder/main.go (CLI) and envbuilder.go (Run function). The primary data flow is: input options -> clone repo -> parse devcontainer -> compile Dockerfile -> Kaniko build -> execute lifecycle scripts -> setuid -> exec init. The tool also includes a cache probe mode for checking layer availability without full build.