go.mod,build_docker.sh: support setting --output for mkctr (#21692)

Enable setting the new --output flag from tailscale/mkctr#38 so we can
save the built images to disk instead of immediately pushing them to a
registry.

Updates tailscale/corp#48996

Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>

build_docker.sh

@@ -40,6 +40,7 @@ BASE="${BASE:-${DEFAULT_BASE}}"
 PLATFORM="${PLATFORM:-}" # default to all platforms
 GOARCH="${GOARCH:-arm,arm64,amd64,386,riscv64}"
 FILES="${FILES:-}" # default to no extra files
+OUTPUT="${OUTPUT:-}" # optional OCI image archive path
 # OCI annotations that will be added to the image.
 # https://github.com/opencontainers/image-spec/blob/main/annotations.md
 ANNOTATIONS="${ANNOTATIONS:-${DEFAULT_ANNOTATIONS}}"
@@ -49,6 +50,7 @@ case "$TARGET" in
     DEFAULT_REPOS="tailscale/tailscale"
     REPOS="${REPOS:-${DEFAULT_REPOS}}"
     go run github.com/tailscale/mkctr \
+      --output="${OUTPUT}" \
       --gopaths="\
         tailscale.com/cmd/tailscale:/usr/local/bin/tailscale, \
         tailscale.com/cmd/tailscaled:/usr/local/bin/tailscaled, \
@@ -72,6 +74,7 @@ case "$TARGET" in
     DEFAULT_REPOS="tailscale/k8s-operator"
     REPOS="${REPOS:-${DEFAULT_REPOS}}"
     go run github.com/tailscale/mkctr \
+      --output="${OUTPUT}" \
       --gopaths="tailscale.com/cmd/k8s-operator:/usr/local/bin/operator" \
       --ldflags="\
         -X tailscale.com/version.longStamp=${VERSION_LONG} \
@@ -92,6 +95,7 @@ case "$TARGET" in
     DEFAULT_REPOS="tailscale/k8s-nameserver"
     REPOS="${REPOS:-${DEFAULT_REPOS}}"
     go run github.com/tailscale/mkctr \
+      --output="${OUTPUT}" \
       --gopaths="tailscale.com/cmd/k8s-nameserver:/usr/local/bin/k8s-nameserver" \
       --ldflags=" \
         -X tailscale.com/version.longStamp=${VERSION_LONG} \
@@ -112,6 +116,7 @@ case "$TARGET" in
     DEFAULT_REPOS="tailscale/tsidp"
     REPOS="${REPOS:-${DEFAULT_REPOS}}"
     go run github.com/tailscale/mkctr \
+      --output="${OUTPUT}" \
       --gopaths="tailscale.com/cmd/tsidp:/usr/local/bin/tsidp" \
       --ldflags=" \
         -X tailscale.com/version.longStamp=${VERSION_LONG} \
@@ -132,6 +137,7 @@ case "$TARGET" in
     DEFAULT_REPOS="tailscale/k8s-proxy"
     REPOS="${REPOS:-${DEFAULT_REPOS}}"
     go run github.com/tailscale/mkctr \
+      --output="${OUTPUT}" \
       --gopaths="tailscale.com/cmd/k8s-proxy:/usr/local/bin/k8s-proxy" \
       --ldflags=" \
         -X tailscale.com/version.longStamp=${VERSION_LONG} \

flake.nix

@@ -173,4 +173,4 @@
     });
   };
 }
-# nix-direnv cache busting line: sha256-VmRpM3dgdfYrBRDHlOzcPgCvvoPkuPug08FFWEDrjh4=
+# nix-direnv cache busting line: sha256-BsinkxzRqYf9FcEsXafjw+seErASQYBPLqzUyC8pLng=

flakehashes.json

@@ -4,7 +4,7 @@
     "sri": "sha256-qxNiwlI/KJpwx7VZQU9C5puJGMUtN5vBXm3ApNYIolI="
   },
   "vendor": {
-    "goModSum": "sha256-3ZSPStrydtR4zde8G+JCc2YinFB7k2wvPRGMl5Mq2yk=",
-    "sri": "sha256-VmRpM3dgdfYrBRDHlOzcPgCvvoPkuPug08FFWEDrjh4="
+    "goModSum": "sha256-yU2kEJCgPxryWA5leU//uCcYLKHkCwaFp4u8KPsKBNk=",
+    "sri": "sha256-BsinkxzRqYf9FcEsXafjw+seErASQYBPLqzUyC8pLng="
   }
 }

go.mod

@@ -116,7 +116,7 @@ require (
 	github.com/tailscale/goexpect v0.0.0-20210902213824-6e8c725cea41
 	github.com/tailscale/golang-x-crypto v0.0.0-20260720160339-c86ca1284b96
 	github.com/tailscale/hujson v0.0.0-20260727124030-b80ff77dac4f
-	github.com/tailscale/mkctr v0.0.0-20260902181255-cbad597122da
+	github.com/tailscale/mkctr v0.0.0-20261007195620-6c992949fa64
 	github.com/tailscale/netlink v1.1.1-0.20240822203006-4d49adab4de7
 	github.com/tailscale/peercred v0.0.0-20250107143737-35a0c7bd7edc
 	github.com/tailscale/policybottest v0.0.0-20260626205140-6863b672b210

go.sum

@@ -1134,8 +1134,8 @@ github.com/tailscale/golang-x-crypto v0.0.0-20260720160339-c86ca1284b96 h1:m9EAs
 github.com/tailscale/golang-x-crypto v0.0.0-20260720160339-c86ca1284b96/go.mod h1:NC3xRCu4UR+m4n6ix8b6oLLbHa820Y0StbOQEdWTDo0=
 github.com/tailscale/hujson v0.0.0-20260727124030-b80ff77dac4f h1:9hiVElpCmKzsBKQHkBqZ8LGzt82iLfM8egxr4sew+Ys=
 github.com/tailscale/hujson v0.0.0-20260727124030-b80ff77dac4f/go.mod h1:8/zr1Tv0+cKpVtGCEB/7YfRXr2TszsMxMXLaT8YuBgU=
-github.com/tailscale/mkctr v0.0.0-20260902181255-cbad597122da h1:xE1TaygKZy8774JrEv1il4jOwGFcFjbnAsTmkxi73rc=
-github.com/tailscale/mkctr v0.0.0-20260902181255-cbad597122da/go.mod h1:4st7fy3NTWcWsQdOC69JcHK4UXnncgcxSOvSR8aD8a0=
+github.com/tailscale/mkctr v0.0.0-20261007195620-6c992949fa64 h1:fINF8B1T0K7137rE60MitDMcZSSRFb+vY6y4EcNBaZI=
+github.com/tailscale/mkctr v0.0.0-20261007195620-6c992949fa64/go.mod h1:4st7fy3NTWcWsQdOC69JcHK4UXnncgcxSOvSR8aD8a0=
 github.com/tailscale/netlink v1.1.1-0.20240822203006-4d49adab4de7 h1:uFsXVBE9Qr4ZoF094vE6iYTLDl0qCiKzYXlL6UeWObU=
 github.com/tailscale/netlink v1.1.1-0.20240822203006-4d49adab4de7/go.mod h1:NzVQi3Mleb+qzq8VmcWpSkcSYxXIg0DkI6XDzpVkhJ0=
 github.com/tailscale/peercred v0.0.0-20250107143737-35a0c7bd7edc h1:24heQPtnFR+yfntqhI3oAu9i27nEojcQ4NuBQOo5ZFA=

shell.nix

@@ -16,4 +16,4 @@
 ) {
   src =  ./.;
 }).shellNix
-# nix-direnv cache busting line: sha256-VmRpM3dgdfYrBRDHlOzcPgCvvoPkuPug08FFWEDrjh4=
+# nix-direnv cache busting line: sha256-BsinkxzRqYf9FcEsXafjw+seErASQYBPLqzUyC8pLng=