Docker Buildx 0.36.0 Adds Source Policy Validation for Build Images
The release verifies the authenticity of BuildKit release images and fixes a Kubernetes-driver hang.
Docker released Buildx v0.36.0 on July 29, 2026. Buildx is the extended build client Docker ships for BuildKit-powered builds, and this release focuses mainly on tightening supply-chain controls around the images Buildx itself pulls and runs.
The headline change lets the default source policy validate the authenticity of BuildKit release images when a developer creates a docker-container builder with `docker buildx create`. In practice, this closes a gap where Buildx would pull and run a BuildKit image without verifying where it actually came from.
The release also expands what source policies can express: a new `array.flatten` builtin and support for OPA template strings give teams more flexibility when writing policy rules. On the Bake side, `docker buildx bake` now supports overriding declared secret sources, and setting `BUILDX_BAKE_FILE_RELATIVE_PATHS=true` makes Bake resolve file paths relative to the bake file itself rather than the current working directory — useful for bake files that are meant to be run from anywhere in a repository.
On the bug-fix side, 0.36.0 resolves a hang in the Kubernetes driver along with an associated file-descriptor leak that could occur when using source policies with that driver, and fixes handling of broken builder instances when they're removed.
Buildx matters beyond Docker's own command line: most CI systems that build container images, including GitHub Actions' own build-push-action, use Buildx under the hood. A security-relevant change like image-authenticity validation reaches a large share of automated build pipelines automatically once the underlying Buildx version updates, without any action required from the pipeline's author. Teams that pin an exact Buildx version in their CI configuration are the one group that has to update that pin manually to pick up the fix.
Full release notes, including every fix and the complete list of contributors, are published on the docker/buildx GitHub repository alongside each tagged release.
Source: docker/buildx — Release v0.36.0