OPA policies should normalize input.http.host for well-known ports

[apollo13]

Description

As requested by @tonistiigi I am opening this as a feature request here.

I am currently playing with the buildkit exec proxy and depending on the tools I am using (for instance curl), the requested URLs include the default HTTP(S) ports.

As an example the following Dockerfile and policy fails:

FROM ubuntu:26.04
RUN apt-get update -y && apt-get install -y curl
ARG CACHE_BUSTER
RUN curl -qf "https://example.com"

policy:

package docker

default allow := false

allowed_hosts := [
    "security.ubuntu.com",
    "archive.ubuntu.com",
    "example.com"
]

allow if input.local
allow if input.image

allow if {
  input.http.host in allowed_hosts
}

decision := {
	"allow": allow,
	"caps": {"exec.proxy": true},
}

build via a buildkit builder with network proxy enabled:

docker buildx build --builder=buildkitd "--build-arg=CACHE_BUSTER=$(date)" --progress=plain .

and observe the following failure:

#7 [3/3] RUN curl -qf "https://example.com"
#7 0.086   % Total    % Received % Xferd  Average Speed  Time    Time    Time   Current
#7 0.086                                  Dload  Upload  Total   Spent   Left   Speed
  0      0   0      0   0      0      0      0                              0
#7 0.103 curl: (22) The requested URL returned error: 403
#7 ERROR: process "/bin/sh -c curl -qf \"https://example.com\"" did not complete successfully: exit code: 22

#1 loading policies Dockerfile.rego
#1 0.196 checking policy for source local://context
#1 0.200 policy decision for source local://context: ALLOW
#1 0.209 checking policy for source docker-image://docker.io/library/ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b (linux/amd64)
#1 0.216 policy decision for source docker-image://docker.io/library/ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b (linux/amd64): ALLOW
#1 0.323 checking policy for source https://example.com:443/
#1 0.328 policy decision for source https://example.com:443/: DENY
#1 DONE 0.3s

If I change the policy to include example.com:443 as allowed_host then it works. I think it would be great if the default ports of 80 and 443 are stripped. If a non-default port is used it could stay included or the port could move into a different variable completely?

[locker95]

opened #4065 — strip :80/:443 off input.http.host so an allow-list of example.com still matches curl-style URLs.