Distinguish remote Bake definitions from local build context

Bottom line: Write the intended definition source and build context separately before running remote Bake. Make any local-file access explicit and inspect the resolved target before starting the build.

Source fact: documented behavior

The Remote Bake file definition documentation is the primary reference.

When a remote Bake definition omits a build context, Bake automatically uses the Git remote as the context. The documented cwd:// prefix selects local files relative to the directory where Bake runs, including local named contexts. A path appended to cwd:// must remain within that working directory; an absolute path or a relative path leading outside it causes an error. The combined-definition example uses -f bake.hcl relative to the Git URL and -f cwd://local.hcl relative to the invocation’s working directory.

What the source does not establish

This article reviews definition and context selection. It does not approve a remote repository, grant access to local data or define every merge and authentication rule. Confirm the actual source revision and reviewed local directory; keep credentials, private repository access and application release acceptance separate.

Applicability questions

• Which repository or URL and revision supply the remote definition?
• Does each selected target use a remote or explicitly local context?
• What is the actual working directory of the managed invocation?
• Which local files are approved for that build to consume?

DSE recommendation: map definition location and input location

DSE recommends a two-column review showing where each Bake definition comes from and where each target obtains its files. Record the actual invocation, source revision and working directory. Ask the build owner to identify the expected Dockerfile and important input files without treating the definition’s location as proof of the intended context.

Make local access deliberate. Review every proposed cwd-prefixed context or local definition against an approved directory boundary. Use a harmless test directory for exploration, leaving unrelated source trees and credentials outside the exercise. Do not broaden the working directory simply to make an unexpected path resolve.

Inspect the resolved target through the documented print workflow before execution. Compare the reported context and definition choices with the map, including any combined local definition. Preserve the actual resolved result and investigate discrepancies before running the remote instructions. Keep configuration inspection distinct from trust in the remote publisher.

Review changes to the managed job’s working directory as build-input changes. Name the owner of that directory and the files supplied by preceding steps. Require a fresh context comparison when the pipeline layout or remote revision changes. Keep the approved build and release tests separate from this input-selection check.

Verification and evidence

Proposed verification, not performed: prepare a reviewed remote test definition and a dedicated local directory containing only benign marker files. Compare a target with the documented remote-context default against a separately approved cwd-prefixed local-context case. Inspect the resolved definitions before permitting either build.

Record the remote revision, invocation directory, target, context and observed marker inputs. Use a separate non-executing or isolated negative case for an out-of-bound local path, following the installed tool’s documented workflow. Retain errors without widening access to silence them. Report which input location was observed; do not claim that context resolution establishes source trust or validates the resulting application.

Official references

• Remote Bake file definition — Docker Docs.

Source review completed October 30, 2026. Recheck the official documentation and deployment-specific applicability before a production change.