| add-hosts | List of a customs host-to-IP mapping (e.g., docker:10.180.0.1) | no | — |
| allow | List of extra privileged entitlement (e.g., network.host,security.insecure) | no | — |
| annotations | List of annotation to set to the image | no | — |
| attests | List of attestation parameters (e.g., type=sbom,generator=image) | no | — |
| build-args | List of build-time variables | no | — |
| build-contexts | List of additional build contexts (e.g., name=path) | no | — |
| builder | Builder instance | no | — |
| cache-from | List of external cache sources for buildx (e.g., user/app:cache, type=local,src=path/to/dir) | no | — |
| cache-to | List of cache export destinations for buildx (e.g., user/app:cache, type=local,dest=path/to/dir) | no | — |
| cgroup-parent | Optional parent cgroup for the container used in the build | no | — |
| context | Build's context is the set of files located in the specified PATH or URL | no | — |
| file | Path to the Dockerfile | no | — |
| labels | List of metadata for an image | no | — |
| load | Load is a shorthand for --output=type=docker | no | false |
| network | Set the networking mode for the RUN instructions during build | no | — |
| no-cache | Do not use cache when building the image | no | false |
| no-cache-filters | Do not cache specified stages | no | — |
| outputs | List of output destinations (format: type=local,dest=path) | no | — |
| platforms | List of target platforms for build | no | — |
| provenance | Generate provenance attestation for the build (shorthand for --attest=type=provenance) | no | — |
| pull | Always attempt to pull all referenced images | no | false |
| push | Push is a shorthand for --output=type=registry | no | false |
| sbom | Generate SBOM attestation for the build (shorthand for --attest=type=sbom) | no | — |
| secrets | List of secrets to expose to the build (e.g., key=string, GIT_AUTH_TOKEN=mytoken) | no | — |
| secret-envs | List of secret env vars to expose to the build (e.g., key=envname, MY_SECRET=MY_ENV_VAR) | no | — |
| secret-files | List of secret files to expose to the build (e.g., key=filename, MY_SECRET=./secret.txt) | no | — |
| shm-size | Size of /dev/shm (e.g., 2g) | no | — |
| ssh | List of SSH agent socket or keys to expose to the build | no | — |
| tags | List of tags | yes | — |
| target | Sets the target stage to build | no | — |
| ulimit | Ulimit options (e.g., nofile=1024:1024) | no | — |
| github-token | GitHub Token used to authenticate against a repository for Git context | no | ${{ github.token }} |
| extra-inputs | Additional files to include in the content hash | no | — |