Contributing guidelines and issue reporting guide
Well-formed report checklist
Description of bug
ADD with Azure DevOps HTTPS git URL silently downloads HTML instead of cloning — .git suffix requirement undocumented and incompatible with Azure DevOps
Environment
- Docker version: 29.1.2
- BuildKit version: github.com/docker/buildx v0.30.1
- OS: Ubuntu
Description
The documentation at https://docs.docker.com/build/building/secrets/ explicitly
shows GIT_AUTH_TOKEN working with ADD for private git repositories, with no
mention of any .git suffix requirement:
FROM alpine
ADD https://gitlab.com/example/todo-app.git /src
Following this pattern with Azure DevOps results in two distinct failures depending
on whether .git is appended to the URL or not.
Reproduction
Case 1 — Without .git suffix: silent failure (build succeeds, wrong content)
Dockerfile:
FROM alpine:latest
WORKDIR /app
RUN apk add --no-cache git
ADD https://dev.azure.com/org/project/_git/private-azure-repo .
Build output: exits 0, no errors.
Inside container:
/app # ls
private-azure-repo
/app # head private-azure-repo
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" ...>
<html lang="en-US">
<head><title>Azure DevOps Services | Sign In</title>
BuildKit silently fell back to a plain HTTP download and fetched the Azure
sign-in page. No warning. No error. Exit 0.
Case 2 — With .git suffix: explicit failure (Azure rejects literal name)
Dockerfile:
FROM alpine:latest
WORKDIR /app
RUN apk add --no-cache git
ADD https://dev.azure.com/org/project/_git/private-azure-repo.git .
Build output:
=> ERROR [4/4] ADD https://dev.azure.com/org/project/_git/private-azure-repo.git .
remote: TF401019: The Git repository with name or identifier
private-azure-repo.git does not exist or you do not have permissions
for the operation you are attempting.
fatal: repository 'https://dev.azure.com/.../private-azure-repo.git/' not found
Azure DevOps treats .git as a literal part of the repository name.
There is no repository named private-azure-repo.git.
Case 3 — Workaround: rename the Azure DevOps repo to private-azure-repo.git
Dockerfile:
FROM alpine:latest
WORKDIR /app
RUN apk add --no-cache git
ADD https://dev.azure.com/org/project/_git/private-azure-repo.git .
Build and container:
[+] Building 1.1s (9/9) FINISHED
/app # ls
README.md ex.txt
Works — but only because the repository was literally renamed to include
.git in its name on Azure DevOps.
Reference: GitHub works as documented (no workaround needed)
ADD https://github.com/user/private-repo-test.git .
[+] Building 1.7s (9/9) FINISHED
GitHub silently accepts .git appended to any URL, so BuildKit's
heuristic happens to work. Azure DevOps does not.
Root cause
BuildKit detects whether an HTTPS URL is a git repository by checking
for a .git suffix via regex. This was addressed in #454 (dot escaping)
but the core requirement — that .git must be present — was never removed.
GitHub masks this bug by accepting .git as an alias. Azure DevOps does not.
Expected behavior
Either:
- BuildKit probes the URL using git smart-HTTP
(GET /info/refs?service=git-upload-pack) to detect git repositories
regardless of URL suffix, or
ADD explicitly errors when a URL cannot be identified as a git
repository, rather than silently falling back to a plain HTTP download
The silent success with wrong content (Case 1) is the most severe aspect —
it is nearly impossible to debug without already knowing the root cause.
Contributing guidelines and issue reporting guide
Well-formed report checklist
Description of bug
ADD with Azure DevOps HTTPS git URL silently downloads HTML instead of cloning — .git suffix requirement undocumented and incompatible with Azure DevOps
Environment
Description
The documentation at https://docs.docker.com/build/building/secrets/ explicitly
shows
GIT_AUTH_TOKENworking withADDfor private git repositories, with nomention of any
.gitsuffix requirement:Following this pattern with Azure DevOps results in two distinct failures depending
on whether
.gitis appended to the URL or not.Reproduction
Case 1 — Without
.gitsuffix: silent failure (build succeeds, wrong content)Dockerfile:
Build output: exits 0, no errors.
Inside container:
BuildKit silently fell back to a plain HTTP download and fetched the Azure
sign-in page. No warning. No error. Exit 0.
Case 2 — With
.gitsuffix: explicit failure (Azure rejects literal name)Dockerfile:
Build output:
Azure DevOps treats
.gitas a literal part of the repository name.There is no repository named
private-azure-repo.git.Case 3 — Workaround: rename the Azure DevOps repo to
private-azure-repo.gitDockerfile:
Build and container:
Works — but only because the repository was literally renamed to include
.gitin its name on Azure DevOps.Reference: GitHub works as documented (no workaround needed)
ADD https://github.com/user/private-repo-test.git .GitHub silently accepts
.gitappended to any URL, so BuildKit'sheuristic happens to work. Azure DevOps does not.
Root cause
BuildKit detects whether an HTTPS URL is a git repository by checking
for a
.gitsuffix via regex. This was addressed in #454 (dot escaping)but the core requirement — that
.gitmust be present — was never removed.GitHub masks this bug by accepting
.gitas an alias. Azure DevOps does not.Expected behavior
Either:
(
GET /info/refs?service=git-upload-pack) to detect git repositoriesregardless of URL suffix, or
ADDexplicitly errors when a URL cannot be identified as a gitrepository, rather than silently falling back to a plain HTTP download
The silent success with wrong content (Case 1) is the most severe aspect —
it is nearly impossible to debug without already knowing the root cause.