Buildkit 0.32.2 adds undocumented max attestation size

[thespad]

Contributing guidelines and issue reporting guide

• I've read the contributing guidelines and wholeheartedly agree. I've also read the issue reporting guide.

Well-formed report checklist

• I have found a bug that the documentation does not mention anything about my problem
• I have found a bug that there are no open or closed issues that are related to my problem
• I have provided version/information about my environment and done my best to provide a reproducer

Description of bug

Bug description

Buildkit 0.32.2 added an undocumented 40Mb limit for attestations during image export in this commit, breaking any image that produces an SBOM over 40Mb in size.

Reproduction

Build an image that results in an SBOM of over 40Mb, e.g. https://github.com/linuxserver/docker-webtop/tree/ubuntu-kde (Approx 80Mb)

git clone https://github.com/linuxserver/docker-webtop -b ubuntu-kde
cd docker-webtop
docker buildx create --driver docker-container --name container --bootstrap
docker buildx build --load --builder=container --sbom=true -t webtop:ubuntu-kde .

Image build fails during export with error

#21 exporting to image
#21 exporting layers
#21 exporting layers 211.1s done
#21 exporting manifest sha256:2c483ecc19109580ea454f6858702b13544a33e45abf110abbd80c4503e62384 0.0s done
#21 exporting config sha256:40d96f440c2ac578ebf7ca4f8aa3d3e7938e4d582cf97242b4eee3b72f7a39c3 0.0s done
#21 ERROR: /tmp/buildkit-mount1305374765/sbom.spdx.json exceeds 41943040 bytes

Version information

github.com/docker/buildx v0.36.1 1d8dde89b8aba914e05e45366770736fea1fd690
Name:          default
Driver:        docker
Last Activity: 2026-08-17 08:09:40 +0000 UTC

Nodes:
Name:             default
Endpoint:         default
Status:           running
BuildKit version: v0.32.2
Platforms:        linux/amd64, linux/amd64/v2, linux/amd64/v3
Labels:
 org.mobyproject.buildkit.worker.containerd.namespace: moby
 org.mobyproject.buildkit.worker.containerd.uuid:      b945eea4-6ec6-4297-abb4-d196619cba26
 org.mobyproject.buildkit.worker.executor:             containerd
 org.mobyproject.buildkit.worker.hostname:             kasm
 org.mobyproject.buildkit.worker.moby.host-gateway-ip: 172.17.0.1
 org.mobyproject.buildkit.worker.network:              host
 org.mobyproject.buildkit.worker.selinux.enabled:      false
 org.mobyproject.buildkit.worker.snapshotter:          overlayfs
GC Policy rule#0:
 All:            false
 Filters:        type==source.local type==exec.cachemount type==source.git.checkout
 Keep Duration:  48h0m0s
 Max Used Space: 2.831GiB
GC Policy rule#1:
 All:            false
 Keep Duration:  1440h0m0s
 Reserved Space: 20.49GiB
 Max Used Space: 160.2GiB
 Min Free Space: 40.05GiB
GC Policy rule#2:
 All:            false
 Reserved Space: 20.49GiB
 Max Used Space: 160.2GiB
 Min Free Space: 40.05GiB
GC Policy rule#3:
 All:            true
 Reserved Space: 20.49GiB
 Max Used Space: 160.2GiB
 Min Free Space: 40.05GiB

Docker engine

Client: Docker Engine - Community
 Version:           29.7.2
 API version:       1.55
 Go version:        go1.26.5
 Git commit:        a7dcaa6
 Built:             Wed Aug  5 18:28:53 2026
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          29.7.2
  API version:      1.55 (minimum version 1.40)
  Go version:       go1.26.5
  Git commit:       6a43e3d
  Built:            Wed Aug  5 18:28:53 2026
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          v2.3.3
  GitCommit:        aad11006b869517fcd3009450b6f82da282e1a9b
 runc:
  Version:          1.4.3
  GitCommit:        v1.4.3-0-gbb14dabe
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

[tonistiigi]

#7046 (comment)

If you are interested in compression, open new issue for that.