From 6e0eae54614b2fb54269a4092ab5acc027078c0c Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Thu, 17 Sep 2026 14:57:32 +0200
Subject: [PATCH] bake: fix override value parsing

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
---
 bake/bake.go                  |  2 +-
 bake/bake_test.go             | 18 ++++++++++++++++++
 docs/reference/buildx_bake.md |  6 ++++++
 3 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/bake/bake.go b/bake/bake.go
index 290e8670d590..d166f3b384ef 100644
--- a/bake/bake.go
+++ b/bake/bake.go
@@ -680,7 +680,7 @@ func (c Config) newOverrides(v []string) (map[string]map[string]Override, error)
 			// IMPORTANT: if you add more fields here, do not forget to update
 			// docs/reference/buildx_bake.md (--set) and https://docs.docker.com/build/bake/overrides/
 			switch keys[1] {
-			case "output", "cache-to", "cache-from", "tags", "platform", "secrets", "ssh", "attest", "entitlements", "network", "annotations", "policy":
+			case "output", "cache-to", "cache-from", "tags", "platform", "secrets", "ssh", "attest", "entitlements", "annotations", "policy", "ulimits", "no-cache-filter":
 				if len(parts) == 2 {
 					override.Append = appendTo
 					override.ArrValue = append(override.ArrValue, parts[1])
diff --git a/bake/bake_test.go b/bake/bake_test.go
index 10a29f1db334..97c2c0b2b8af 100644
--- a/bake/bake_test.go
+++ b/bake/bake_test.go
@@ -194,6 +194,12 @@ target "webapp" {
 		require.Equal(t, []string{"webapp"}, g["default"].Targets)
 	})
 
+	t.Run("NoCacheFilterOverride", func(t *testing.T) {
+		m, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.no-cache-filter=stage"}, nil, nil, &EntitlementConf{})
+		require.NoError(t, err)
+		require.Equal(t, []string{"stage"}, m["webapp"].NoCacheFilter)
+	})
+
 	t.Run("PlatformOverride", func(t *testing.T) {
 		m, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.platform=linux/arm64"}, nil, nil, &EntitlementConf{})
 		require.NoError(t, err)
@@ -286,6 +292,18 @@ target "webapp" {
 		require.Equal(t, "256m", *m["webapp"].ShmSize)
 	})
 
+	t.Run("NetworkOverride", func(t *testing.T) {
+		m, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.network=host"}, nil, nil, &EntitlementConf{})
+		require.NoError(t, err)
+		require.Equal(t, "host", *m["webapp"].NetworkMode)
+	})
+
+	t.Run("UlimitsOverride", func(t *testing.T) {
+		m, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.ulimits=nofile=2048:2048"}, nil, nil, &EntitlementConf{})
+		require.NoError(t, err)
+		require.Equal(t, []string{"nofile=2048:2048"}, m["webapp"].Ulimits)
+	})
+
 	t.Run("ResourceLimitsOverride", func(t *testing.T) {
 		m, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{
 			"webapp.resources.memory=512m",
diff --git a/docs/reference/buildx_bake.md b/docs/reference/buildx_bake.md
index 42e3a78cd144..c272ed3c05fd 100644
--- a/docs/reference/buildx_bake.md
+++ b/docs/reference/buildx_bake.md
@@ -463,16 +463,20 @@ You can override the following fields:
 * `load`
 * `no-cache`
 * `no-cache-filter`
+* `network`
 * `output`
 * `platform`
+* `policy`
 * `pull`
 * `push`
 * `resources`
 * `secret.<id>`
 * `secrets`
+* `shm-size`
 * `ssh`
 * `tags`
 * `target`
+* `ulimits`
 
 You can append using `+=` operator for the following fields:
 
@@ -484,9 +488,11 @@ You can append using `+=` operator for the following fields:
 * `no-cache-filter`
 * `output`
 * `platform`
+* `policy`
 * `secrets`
 * `ssh`
 * `tags`
+* `ulimits`
 
 > [!NOTE]
 > ¹ These fields already append by default.