From 09f288c71e8b3f0fb748e1a5bc055fae7221d62b Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Thu, 9 Apr 2026 15:53:24 +0200
Subject: [PATCH] bake: sort extra-hosts before generating build options

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
---
 bake/bake.go      |  3 ++-
 bake/bake_test.go | 22 ++++++++++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/bake/bake.go b/bake/bake.go
index 1e8e54f414c0..a319c59ee62e 100644
--- a/bake/bake.go
+++ b/bake/bake.go
@@ -1513,7 +1513,8 @@ func toBuildOpt(t *Target, inp *Input) (*build.Options, error) {
 	}
 
 	var extraHosts []string
-	for k, v := range t.ExtraHosts {
+	for _, k := range slices.Sorted(maps.Keys(t.ExtraHosts)) {
+		v := t.ExtraHosts[k]
 		if v == nil {
 			continue
 		}
diff --git a/bake/bake_test.go b/bake/bake_test.go
index b138b5c21e83..466c411d8a04 100644
--- a/bake/bake_test.go
+++ b/bake/bake_test.go
@@ -1812,6 +1812,28 @@ func TestAttestDuplicates(t *testing.T) {
 	}, opts["default"].Attests)
 }
 
+func TestExtraHostsDeterministicOrder(t *testing.T) {
+	expected := []string{
+		"alpha.example.com=1.1.1.1",
+		"beta.example.com=2.2.2.2",
+		"delta.example.com=4.4.4.4",
+		"gamma.example.com=3.3.3.3",
+	}
+	for range 64 {
+		bo, err := toBuildOpt(&Target{
+			DockerfileInline: ptrstr("FROM scratch"),
+			ExtraHosts: map[string]*string{
+				"gamma.example.com": ptrstr("3.3.3.3"),
+				"alpha.example.com": ptrstr("1.1.1.1"),
+				"delta.example.com": ptrstr("4.4.4.4"),
+				"beta.example.com":  ptrstr("2.2.2.2"),
+			},
+		}, &Input{})
+		require.NoError(t, err)
+		require.Equal(t, expected, bo.ExtraHosts)
+	}
+}
+
 func TestAnnotations(t *testing.T) {
 	fp := File{
 		Name: "docker-bake.hcl",