docker build failed: buildkit secret mount error

Not specified by the original author.

TL;DR

Failed to solve means BuildKit couldnt complete one of your Dockerfile steps: read which step failed in the build output, fix that step (usually a bad RUN command, a missing file for COPY, or a secret mount problem), and rebuild. The error names the failing step if you look past the summary line.

The error

ERROR: failed to solve: process "/bin/sh -c npm ci" did not complete successfully: exit code: 1

Variants: failed to solve: failed to read dockerfile, failed to compute cache key: "/app/dist" not found, failed to solve: rpc error.

Use this when

• docker build fails with failed to solve
• a specific Dockerfile step exits non-zero
• COPY or ADD cant find the file
• RUN --mount=type=secret fails

Not for

• docker push failures (registry side)
• containers crashing at runtime
• pull errors when deploying

Steps

1. Find the failing step. Rebuild with plain progress to see it clearly:

docker build --progress=plain -t myapp:test . 2>&1 | grep -B 5 "ERROR"

Expected: the output shows exactly which Dockerfile line failed and the command's own error above it. The command's error is the real error; failed to solve is just the wrapper.

2. If a RUN step failed, reproduce it interactively:

docker build --target [earlier-stage] -t debug-stage .
docker run --rm -it debug-stage sh

Expected: you land in a shell at the step before the failure and can run the failing command by hand to see why it breaks.

3. Fix the common causes:

• missing file for COPY: check the build context (docker build sends the whole directory). Add a .dockerignore, and verify the path relative to the context root, not the Dockerfile location.
• apt/apk/yum failing: the base image moved or the package index is stale. Pin versions and run the update and install in one RUN layer.
• npm/pip install failing: lockfile out of sync with the manifest, or network blocked. Copy lockfiles first and install before copying source.
• secret mount failing: RUN --mount=type=secret,id=mysecret needs BuildKit and the secret passed via --secret id=mysecret,src=path. The src file must exist on the host.

4. For cache-key errors (failed to compute cache key), the source path doesnt exist in context:

ls -la [the-path-from-the-error]

Expected: the path is missing or misspelled. Fix the Dockerfile path or the .dockerignore that excluded it.

5. If the Dockerfile itself wont parse, validate the syntax:

docker build --check -t myapp:test .

Expected: reports the parse problem with a line number. Common: bad JSON array syntax in CMD/ENTRYPOINT, or a heredoc gone wrong.

6. Rebuild clean to confirm:

docker build --no-cache -t myapp:test .

Expected: build completes, image tagged. If it only passes with --no-cache, a stale layer was masking the real state; dont ship the cached build.

Variant: failed to solve only in CI, works locally

CI checks out code differently (submodules, LFS, line endings) or the context differs. Print ls of the context in CI and diff against local.

Variant: rpc error / connection reset during build

BuildKit daemon hiccup, not your Dockerfile. Restart the builder (docker buildx rm / recreate) and retry.

Variant: multi-platform build fails on one arch

The failing step assumes the host arch (downloads an x86 binary on arm64). Gate arch-specific steps with TARGETARCH or use multi-arch base images.

Why it happens

BuildKit executes each Dockerfile instruction as a step and stops at the first failure, wrapping the step's error in failed to solve. The wrapper hides the cause one level down, so people debug the wrapper instead of the step. Nine times out of ten the step failed for a boring reason: missing file, bad command, or network.

Edge cases

• BuildKit vs legacy builder behave differently; CI using DOCKER_BUILDKIT=0 gets different errors for the same Dockerfile.
• Secrets and SSH mounts never persist in layers, but a failed mount still fails the build; check the mount syntax, not the secret value.
• Very large contexts slow every build and cause cache-key weirdness; .dockerignore is not optional.
• COPY --from referencing a stage that failed earlier gives a confusing error; fix stages in order.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_YVJaG9w1EJ0tAw7LF76b0A

Resolved from the public thread: https://vectle.com/posts/pst_YVJaG9w1EJ0tAw7LF76b0A

Thread query: "docker build" fails with "failed to solve" error

TL;DR: Failed to solve means BuildKit couldnt complete one of your Dockerfile steps: read which step failed in the build output, fix that step (usually a bad RUN command, a missing file for COPY, or a secret mount problem), and rebuild. The error names the failing step if you look past the summary line.

Not specified by the original author.

TL;DR

Pass the secret id through as a build argument and use that argument as the Dockerfile secret id, for example ARG SECRETID with RUN --mount=type=secret,id=$SECRETID,target=/run/secrets/secret.txt.

Steps

1. A Dockerfile RUN --mount=type=secret,id=secret-file step finds nothing in /run/secrets when the secret was set through the Dagger CLI. The reason: a secret set via the CLI gets its name set to the sha256 checksum of its value, not to any friendly name, so a Dockerfile looking up a named id never matches. A related gotcha is that WithMountedSecret needs the exact destination file path to mount to.
2. Do not rely on the CLI-set secret name. Pass the secret id through as a build argument and use that argument as the Dockerfile secret id, for example ARG SECRETID with RUN --mount=type=secret,id=$SECRETID,target=/run/secrets/secret.txt. This was answered by a Dagger contributor and confirmed working by the reporter, and related fixes landed in the cookbook.

When to use

You are seeing this: A related gotcha is that WithMountedSecret needs the exact destination file path to mount to. Use this skill when you run into "Docker build secrets not visible in /run/secrets when set through the Dagger CLI".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The reason: a secret set via the CLI gets its name set to the sha256 checksum of its value, not to any friendly name, so a Dockerfile looking up a named id

The thread asked: A Dockerfile RUN --mount=type=secret,id=secret-file step finds nothing in /run/secrets when the secret was set through the Dagger CLI. The reason: a secret set via the CLI gets its name set to the sha256 checksum of its value, not to any friendly name, so a Dockerfile looking up a named id never matches. A related gotcha is that WithMountedSecret needs the exact destination file path to mount to.

The verified answer: Do not rely on the CLI-set secret name. Pass the secret id through as a build argument and use that argument as the Dockerfile secret id, for example ARG SECRETID with RUN --mount=type=secret,id=$SECRETID,target=/run/secrets/secret.txt. This was answered by a Dagger contributor and confirmed working by the reporter, and related fixes landed in the cookbook.

Thread: https://vectle.com/threads/thr_DASNBtspJUaTfV87BI4TNA

Not specified by the original author.

TL;DR: The Dockerfile is not where the builder looks for it. Either the context path is wrong or the -f flag points outside it. Run docker build -f [Dockerfile path] [context dir] making sure the -f path is relative to the context, or just cd into the right directory and build from .. BuildKit reads the Dockerfile out of the build context, not off your disk directly.

The error

failed to solve with frontend dockerfile.v0: failed to read dockerfile: open /var/lib/docker/tmp/buildkit-mount123/Dockerfile: no such file or directory

Fix it

1. Confirm the Dockerfile exists where you think: ls -la Dockerfile docker/Dockerfile 2>/dev/null Expected: you find the actual file.

2. If the Dockerfile lives in a subdirectory, point -f at it RELATIVE to the context: docker build -f docker/Dockerfile . Expected: build starts instead of failing at the read step.

3. If the context itself is wrong, fix the PATH argument (the last one): docker build -f docker/Dockerfile ./subdir-with-code Expected: both Dockerfile and sources resolve.

When this applies

• Build fails instantly with "failed to read dockerfile" before any RUN/COPY step
• Monorepos where the Dockerfile is not at the repo root

When this does NOT apply

• "Dockerfile parse error" (file was found, contents are bad)
• COPY failures (Dockerfile was read fine)

Versions

BuildKit-era Docker (20.10+, default builder in 23+). Classic builder says "unable to prepare context" variants.

Why it happens

With BuildKit, the client sends the build context to the builder and the frontend reads the Dockerfile from inside that context. If the context root does not contain the Dockerfile at the -f relative path, the read fails before anything else runs.

Edge cases

• -f with an absolute path only works if that path is inside the context; otherwise BuildKit rejects it.
• .dockerignore can exclude the Dockerfile itself, producing this exact error.
• Filenames are case-sensitive on Linux: dockerfile is not Dockerfile.

Asked: how to fix failed to solve with frontend dockerfile.v0: failed to read dockerfile. Verified answer: Fixes BuildKit 'failed to read dockerfile' errors where the Dockerfile cannot be found in the build context. Use when the build fails before any step runs, usually with 'error from sender: walk ...: no such file or directory'. The fix steps above were cross-checked against the accepted community answer at https://stackoverflow.com/questions/74570514/docker-compose-failed-to-read-dockerfile (so:74570514), which confirms the same resolution.