| build-args | List of build-time variables | no | — |
| cache-from | List of external cache sources for buildx (e.g., user/app:cache, type=local,src=path/to/dir) | no | — |
| cache-to | List of cache export destinations for buildx (e.g., user/app:cache, type=local,dest=path/to/dir) | no | — |
| context | Build's context is the set of files located in the specified PATH or URL | no | — |
| file | Path to the Dockerfile | no | — |
| labels | List of metadata for an image | no | — |
| load | Load is a shorthand for --output=type=docker | no | false |
| platforms | List of target platforms for build | no | — |
| provenance | Generate provenance attestation for the build (shorthand for --attest=type=provenance) | no | false |
| push | Push is a shorthand for --output=type=registry | no | false |
| sbom | Generate SBOM attestation for the build (shorthand for --attest=type=sbom) | no | — |
| secret-envs | List of secret env vars to expose to the build (e.g., key=envname, MY_SECRET=MY_ENV_VAR) | no | — |
| secrets | List of secrets to expose to the build (e.g., key=string, GIT_AUTH_TOKEN=mytoken) | no | — |
| tags | List of tags | no | — |
| target | Set the target build stage to build | no | — |
| trivy-enabled | Enable scanning with Trivy vulnerability scanner | no | true |
| trivy-severity | Comma-separated list of vulnerability severities to scan for (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) | no | HIGH,CRITICAL |
| trivy-exit-code | Exit code when vulnerabilities were found | no | 1 |