Fix issues in BuildImage()

container.go

@@ -209,6 +209,7 @@ func (c *ContainerRequest) Validate() error {
 }
 
 // GetContext retrieve the build context for the request
+// Must be closed when no longer needed.
 func (c *ContainerRequest) GetContext() (io.Reader, error) {
 	var includes []string = []string{"."}
 
@@ -356,12 +357,6 @@ func (c *ContainerRequest) BuildOptions() (types.ImageBuildOptions, error) {
 	buildOptions.BuildArgs = c.GetBuildArgs()
 	buildOptions.Dockerfile = c.GetDockerfile()
 
-	buildContext, err := c.GetContext()
-	if err != nil {
-		return buildOptions, err
-	}
-	buildOptions.Context = buildContext
-
 	// Make sure the auth configs from the Dockerfile are set right after the user-defined build options.
 	authsFromDockerfile := getAuthConfigsFromDockerfile(c)
 
@@ -400,6 +395,13 @@ func (c *ContainerRequest) BuildOptions() (types.ImageBuildOptions, error) {
 		buildOptions.Labels = core.DefaultLabels(core.SessionID())
 	}
 
+	// Do this as late as possible to ensure we don't leak the context on error/panic.
+	buildContext, err := c.GetContext()
+	if err != nil {
+		return buildOptions, err
+	}
+	buildOptions.Context = buildContext
+
 	return buildOptions, nil
 }
 

docker.go

@@ -882,35 +882,36 @@ var _ ContainerProvider = (*DockerProvider)(nil)
 
 // BuildImage will build and image from context and Dockerfile, then return the tag
 func (p *DockerProvider) BuildImage(ctx context.Context, img ImageBuildInfo) (string, error) {
-	buildOptions, err := img.BuildOptions()
-	if err != nil {
-		return "", err
-	}
+	var buildOptions types.ImageBuildOptions
+	resp, err := backoff.RetryNotifyWithData(
+		func() (types.ImageBuildResponse, error) {
+			var err error
+			buildOptions, err = img.BuildOptions()
+			if err != nil {
+				return types.ImageBuildResponse{}, backoff.Permanent(err)
+			}
+			defer tryClose(buildOptions.Context) // release resources in any case
 
-	var buildError error
-	var resp types.ImageBuildResponse
-	err = backoff.RetryNotify(
-		func() error {
-			resp, err = p.client.ImageBuild(ctx, buildOptions.Context, buildOptions)
+			resp, err := p.client.ImageBuild(ctx, buildOptions.Context, buildOptions)
 			if err != nil {
-				buildError = errors.Join(buildError, err)
 				if isPermanentClientError(err) {
-					return backoff.Permanent(err)
+					return types.ImageBuildResponse{}, backoff.Permanent(err)
 				}
-				return err
+				return types.ImageBuildResponse{}, err
 			}
 			defer p.Close()
 
-			return nil
+			return resp, nil
 		},
 		backoff.WithContext(backoff.NewExponentialBackOff(), ctx),
 		func(err error, duration time.Duration) {
 			p.Logger.Printf("Failed to build image: %s, will retry", err)
 		},
 	)
 	if err != nil {
-		return "", errors.Join(buildError, err)
+		return "", err
 	}
+	defer resp.Body.Close()
 
 	if img.ShouldPrintBuildLog() {
 		termFd, isTerm := term.GetFdInfo(os.Stderr)
@@ -927,8 +928,6 @@ func (p *DockerProvider) BuildImage(ctx context.Context, img ImageBuildInfo) (st
 		return "", err
 	}
 
-	_ = resp.Body.Close()
-
 	// the first tag is the one we want
 	return buildOptions.Tags[0], nil
 }
@@ -1664,3 +1663,10 @@ func isPermanentClientError(err error) bool {
 	}
 	return false
 }
+
+func tryClose(r io.Reader) {
+	rc, ok := r.(io.Closer)
+	if ok {
+		_ = rc.Close()
+	}
+}