vendor: update buildkit to master@b49a8873179b

Signed-off-by: Justin Chadwell <me@jedevc.com>

vendor/github.com/moby/buildkit/util/testutil/workers/backend.go

@@ -0,0 +1,59 @@
+package workers
+
+import (
+	"os"
+	"strings"
+)
+
+type backend struct {
+	address             string
+	dockerAddress       string
+	containerdAddress   string
+	rootless            bool
+	snapshotter         string
+	unsupportedFeatures []string
+	isDockerd           bool
+}
+
+func (b backend) Address() string {
+	return b.address
+}
+
+func (b backend) DockerAddress() string {
+	return b.dockerAddress
+}
+
+func (b backend) ContainerdAddress() string {
+	return b.containerdAddress
+}
+
+func (b backend) Rootless() bool {
+	return b.rootless
+}
+
+func (b backend) Snapshotter() string {
+	return b.snapshotter
+}
+
+func (b backend) Supports(feature string) bool {
+	if enabledFeatures := os.Getenv("BUILDKIT_TEST_ENABLE_FEATURES"); enabledFeatures != "" {
+		for _, enabledFeature := range strings.Split(enabledFeatures, ",") {
+			if feature == enabledFeature {
+				return true
+			}
+		}
+	}
+	if disabledFeatures := os.Getenv("BUILDKIT_TEST_DISABLE_FEATURES"); disabledFeatures != "" {
+		for _, disabledFeature := range strings.Split(disabledFeatures, ",") {
+			if feature == disabledFeature {
+				return false
+			}
+		}
+	}
+	for _, unsupportedFeature := range b.unsupportedFeatures {
+		if feature == unsupportedFeature {
+			return false
+		}
+	}
+	return true
+}

vendor/github.com/moby/buildkit/util/testutil/workers/containerd.go

@@ -0,0 +1,276 @@
+package workers
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/moby/buildkit/util/bklog"
+	"github.com/moby/buildkit/util/testutil/integration"
+	"github.com/pkg/errors"
+)
+
+func InitContainerdWorker() {
+	integration.Register(&Containerd{
+		ID:         "containerd",
+		Containerd: "containerd",
+	})
+	// defined in Dockerfile
+	// e.g. `containerd-1.1=/opt/containerd-1.1/bin,containerd-42.0=/opt/containerd-42.0/bin`
+	if s := os.Getenv("BUILDKIT_INTEGRATION_CONTAINERD_EXTRA"); s != "" {
+		entries := strings.Split(s, ",")
+		for _, entry := range entries {
+			pair := strings.Split(strings.TrimSpace(entry), "=")
+			if len(pair) != 2 {
+				panic(errors.Errorf("unexpected BUILDKIT_INTEGRATION_CONTAINERD_EXTRA: %q", s))
+			}
+			name, bin := pair[0], pair[1]
+			integration.Register(&Containerd{
+				ID:         name,
+				Containerd: filepath.Join(bin, "containerd"),
+				// override PATH to make sure that the expected version of the shim binary is used
+				ExtraEnv: []string{fmt.Sprintf("PATH=%s:%s", bin, os.Getenv("PATH"))},
+			})
+		}
+	}
+
+	// the rootless uid is defined in Dockerfile
+	if s := os.Getenv("BUILDKIT_INTEGRATION_ROOTLESS_IDPAIR"); s != "" {
+		var uid, gid int
+		if _, err := fmt.Sscanf(s, "%d:%d", &uid, &gid); err != nil {
+			bklog.L.Fatalf("unexpected BUILDKIT_INTEGRATION_ROOTLESS_IDPAIR: %q", s)
+		}
+		if integration.RootlessSupported(uid) {
+			integration.Register(&Containerd{
+				ID:          "containerd-rootless",
+				Containerd:  "containerd",
+				UID:         uid,
+				GID:         gid,
+				Snapshotter: "native", // TODO: test with fuse-overlayfs as well, or automatically determine snapshotter
+			})
+		}
+	}
+
+	if s := os.Getenv("BUILDKIT_INTEGRATION_SNAPSHOTTER"); s != "" {
+		integration.Register(&Containerd{
+			ID:          fmt.Sprintf("containerd-snapshotter-%s", s),
+			Containerd:  "containerd",
+			Snapshotter: s,
+		})
+	}
+}
+
+type Containerd struct {
+	ID          string
+	Containerd  string
+	Snapshotter string
+	UID         int
+	GID         int
+	ExtraEnv    []string // e.g. "PATH=/opt/containerd-1.4/bin:/usr/bin:..."
+}
+
+func (c *Containerd) Name() string {
+	return c.ID
+}
+
+func (c *Containerd) Rootless() bool {
+	return c.UID != 0
+}
+
+func (c *Containerd) New(ctx context.Context, cfg *integration.BackendConfig) (b integration.Backend, cl func() error, err error) {
+	if err := integration.LookupBinary(c.Containerd); err != nil {
+		return nil, nil, err
+	}
+	if err := integration.LookupBinary("buildkitd"); err != nil {
+		return nil, nil, err
+	}
+	if err := requireRoot(); err != nil {
+		return nil, nil, err
+	}
+
+	deferF := &integration.MultiCloser{}
+	cl = deferF.F()
+
+	defer func() {
+		if err != nil {
+			deferF.F()()
+			cl = nil
+		}
+	}()
+
+	rootless := false
+	if c.UID != 0 {
+		if c.GID == 0 {
+			return nil, nil, errors.Errorf("unsupported id pair: uid=%d, gid=%d", c.UID, c.GID)
+		}
+		rootless = true
+	}
+
+	tmpdir, err := os.MkdirTemp("", "bktest_containerd")
+	if err != nil {
+		return nil, nil, err
+	}
+	if rootless {
+		if err := os.Chown(tmpdir, c.UID, c.GID); err != nil {
+			return nil, nil, err
+		}
+	}
+
+	deferF.Append(func() error { return os.RemoveAll(tmpdir) })
+
+	address := filepath.Join(tmpdir, "containerd.sock")
+	config := fmt.Sprintf(`root = %q
+state = %q
+# CRI plugins listens on 10010/tcp for stream server.
+# We disable CRI plugin so that multiple instance can run simultaneously.
+disabled_plugins = ["cri"]
+
+[grpc]
+  address = %q
+
+[debug]
+  level = "debug"
+  address = %q
+`, filepath.Join(tmpdir, "root"), filepath.Join(tmpdir, "state"), address, filepath.Join(tmpdir, "debug.sock"))
+
+	var snBuildkitdArgs []string
+	if c.Snapshotter != "" {
+		snBuildkitdArgs = append(snBuildkitdArgs,
+			fmt.Sprintf("--containerd-worker-snapshotter=%s", c.Snapshotter))
+		if c.Snapshotter == "stargz" {
+			snPath, snCl, err := runStargzSnapshotter(cfg)
+			if err != nil {
+				return nil, nil, err
+			}
+			deferF.Append(snCl)
+			config = fmt.Sprintf(`%s
+
+[proxy_plugins]
+  [proxy_plugins.stargz]
+    type = "snapshot"
+    address = %q
+`, config, snPath)
+		}
+	}
+
+	configFile := filepath.Join(tmpdir, "config.toml")
+	if err := os.WriteFile(configFile, []byte(config), 0644); err != nil {
+		return nil, nil, err
+	}
+
+	containerdArgs := []string{c.Containerd, "--config", configFile}
+	rootlessKitState := filepath.Join(tmpdir, "rootlesskit-containerd")
+	if rootless {
+		containerdArgs = append(append([]string{"sudo", "-E", "-u", fmt.Sprintf("#%d", c.UID), "-i",
+			fmt.Sprintf("CONTAINERD_ROOTLESS_ROOTLESSKIT_STATE_DIR=%s", rootlessKitState),
+			// Integration test requires the access to localhost of the host network namespace.
+			// TODO: remove these configurations
+			"CONTAINERD_ROOTLESS_ROOTLESSKIT_NET=host",
+			"CONTAINERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=none",
+			"CONTAINERD_ROOTLESS_ROOTLESSKIT_FLAGS=--mtu=0",
+		}, c.ExtraEnv...), "containerd-rootless.sh", "-c", configFile)
+	}
+
+	cmd := exec.Command(containerdArgs[0], containerdArgs[1:]...) //nolint:gosec // test utility
+	cmd.Env = append(os.Environ(), c.ExtraEnv...)
+
+	ctdStop, err := integration.StartCmd(cmd, cfg.Logs)
+	if err != nil {
+		return nil, nil, err
+	}
+	if err := integration.WaitUnix(address, 10*time.Second, cmd); err != nil {
+		ctdStop()
+		return nil, nil, errors.Wrapf(err, "containerd did not start up: %s", integration.FormatLogs(cfg.Logs))
+	}
+	deferF.Append(ctdStop)
+
+	buildkitdArgs := append([]string{"buildkitd",
+		"--oci-worker=false",
+		"--containerd-worker-gc=false",
+		"--containerd-worker=true",
+		"--containerd-worker-addr", address,
+		"--containerd-worker-labels=org.mobyproject.buildkit.worker.sandbox=true", // Include use of --containerd-worker-labels to trigger https://github.com/moby/buildkit/pull/603
+	}, snBuildkitdArgs...)
+
+	if runtime.GOOS != "windows" && c.Snapshotter != "native" {
+		c.ExtraEnv = append(c.ExtraEnv, "BUILDKIT_DEBUG_FORCE_OVERLAY_DIFF=true")
+	}
+	if rootless {
+		pidStr, err := os.ReadFile(filepath.Join(rootlessKitState, "child_pid"))
+		if err != nil {
+			return nil, nil, err
+		}
+		pid, err := strconv.ParseInt(string(pidStr), 10, 64)
+		if err != nil {
+			return nil, nil, err
+		}
+		buildkitdArgs = append([]string{"sudo", "-E", "-u", fmt.Sprintf("#%d", c.UID), "-i", "--", "exec",
+			"nsenter", "-U", "--preserve-credentials", "-m", "-t", fmt.Sprintf("%d", pid)},
+			append(buildkitdArgs, "--containerd-worker-snapshotter=native")...)
+	}
+	buildkitdSock, stop, err := runBuildkitd(ctx, cfg, buildkitdArgs, cfg.Logs, c.UID, c.GID, c.ExtraEnv)
+	if err != nil {
+		integration.PrintLogs(cfg.Logs, log.Println)
+		return nil, nil, err
+	}
+	deferF.Append(stop)
+
+	return backend{
+		address:           buildkitdSock,
+		containerdAddress: address,
+		rootless:          rootless,
+		snapshotter:       c.Snapshotter,
+	}, cl, nil
+}
+
+func (c *Containerd) Close() error {
+	return nil
+}
+
+func runStargzSnapshotter(cfg *integration.BackendConfig) (address string, cl func() error, err error) {
+	binary := "containerd-stargz-grpc"
+	if err := integration.LookupBinary(binary); err != nil {
+		return "", nil, err
+	}
+
+	deferF := &integration.MultiCloser{}
+	cl = deferF.F()
+
+	defer func() {
+		if err != nil {
+			deferF.F()()
+			cl = nil
+		}
+	}()
+
+	tmpStargzDir, err := os.MkdirTemp("", "bktest_containerd_stargz_grpc")
+	if err != nil {
+		return "", nil, err
+	}
+	deferF.Append(func() error { return os.RemoveAll(tmpStargzDir) })
+
+	address = filepath.Join(tmpStargzDir, "containerd-stargz-grpc.sock")
+	stargzRootDir := filepath.Join(tmpStargzDir, "root")
+	cmd := exec.Command(binary,
+		"--log-level", "debug",
+		"--address", address,
+		"--root", stargzRootDir)
+	snStop, err := integration.StartCmd(cmd, cfg.Logs)
+	if err != nil {
+		return "", nil, err
+	}
+	if err = integration.WaitUnix(address, 10*time.Second, cmd); err != nil {
+		snStop()
+		return "", nil, errors.Wrapf(err, "containerd-stargz-grpc did not start up: %s", integration.FormatLogs(cfg.Logs))
+	}
+	deferF.Append(snStop)
+
+	return
+}

vendor/github.com/moby/buildkit/util/testutil/workers/dockerd.go

@@ -0,0 +1,250 @@
+package workers
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/docker/docker/client"
+	"github.com/moby/buildkit/cmd/buildkitd/config"
+	"github.com/moby/buildkit/util/testutil/dockerd"
+	"github.com/moby/buildkit/util/testutil/integration"
+	"github.com/pkg/errors"
+	"golang.org/x/sync/errgroup"
+)
+
+// InitDockerdWorker registers a dockerd worker with the global registry.
+func InitDockerdWorker() {
+	integration.Register(&Moby{
+		ID:         "dockerd",
+		IsRootless: false,
+		Unsupported: []string{
+			FeatureCacheExport,
+			FeatureCacheImport,
+			FeatureCacheBackendAzblob,
+			FeatureCacheBackendGha,
+			FeatureCacheBackendLocal,
+			FeatureCacheBackendRegistry,
+			FeatureCacheBackendS3,
+			FeatureDirectPush,
+			FeatureImageExporter,
+			FeatureMultiCacheExport,
+			FeatureMultiPlatform,
+			FeatureOCIExporter,
+			FeatureOCILayout,
+			FeatureProvenance,
+			FeatureSBOM,
+			FeatureSecurityMode,
+			FeatureCNINetwork,
+		},
+	})
+	integration.Register(&Moby{
+		ID:                    "dockerd-containerd",
+		IsRootless:            false,
+		ContainerdSnapshotter: true,
+		Unsupported: []string{
+			FeatureSecurityMode,
+			FeatureCNINetwork,
+		},
+	})
+}
+
+type Moby struct {
+	ID         string
+	IsRootless bool
+
+	ContainerdSnapshotter bool
+
+	Unsupported []string
+}
+
+func (c Moby) Name() string {
+	return c.ID
+}
+
+func (c Moby) Rootless() bool {
+	return c.IsRootless
+}
+
+func (c Moby) New(ctx context.Context, cfg *integration.BackendConfig) (b integration.Backend, cl func() error, err error) {
+	if err := requireRoot(); err != nil {
+		return nil, nil, err
+	}
+
+	bkcfg, err := config.LoadFile(cfg.ConfigFile)
+	if err != nil {
+		return nil, nil, errors.Wrapf(err, "failed to load buildkit config file %s", cfg.ConfigFile)
+	}
+
+	dcfg := dockerd.Config{
+		Features: map[string]bool{
+			"containerd-snapshotter": c.ContainerdSnapshotter,
+		},
+	}
+	if reg, ok := bkcfg.Registries["docker.io"]; ok && len(reg.Mirrors) > 0 {
+		for _, m := range reg.Mirrors {
+			dcfg.Mirrors = append(dcfg.Mirrors, "http://"+m)
+		}
+	}
+	if bkcfg.Entitlements != nil {
+		for _, e := range bkcfg.Entitlements {
+			switch e {
+			case "network.host":
+				dcfg.Builder.Entitlements.NetworkHost = true
+			case "security.insecure":
+				dcfg.Builder.Entitlements.SecurityInsecure = true
+			}
+		}
+	}
+
+	dcfgdt, err := json.Marshal(dcfg)
+	if err != nil {
+		return nil, nil, errors.Wrapf(err, "failed to marshal dockerd config")
+	}
+
+	deferF := &integration.MultiCloser{}
+	cl = deferF.F()
+
+	defer func() {
+		if err != nil {
+			deferF.F()()
+			cl = nil
+		}
+	}()
+
+	var proxyGroup errgroup.Group
+	deferF.Append(proxyGroup.Wait)
+
+	workDir, err := os.MkdirTemp("", "integration")
+	if err != nil {
+		return nil, nil, err
+	}
+
+	d, err := dockerd.NewDaemon(workDir)
+	if err != nil {
+		return nil, nil, errors.Errorf("new daemon error: %q, %s", err, integration.FormatLogs(cfg.Logs))
+	}
+
+	dockerdConfigFile := filepath.Join(workDir, "daemon.json")
+	if err := os.WriteFile(dockerdConfigFile, dcfgdt, 0644); err != nil {
+		return nil, nil, err
+	}
+
+	dockerdFlags := []string{
+		"--config-file", dockerdConfigFile,
+		"--userland-proxy=false",
+		"--tls=false",
+		"--debug",
+	}
+	if s := os.Getenv("BUILDKIT_INTEGRATION_DOCKERD_FLAGS"); s != "" {
+		dockerdFlags = append(dockerdFlags, strings.Split(strings.TrimSpace(s), "\n")...)
+	}
+
+	err = d.StartWithError(cfg.Logs, dockerdFlags...)
+	if err != nil {
+		return nil, nil, err
+	}
+	deferF.Append(d.StopWithError)
+
+	if err := integration.WaitUnix(d.Sock(), 5*time.Second, nil); err != nil {
+		return nil, nil, errors.Errorf("dockerd did not start up: %q, %s", err, integration.FormatLogs(cfg.Logs))
+	}
+
+	dockerAPI, err := client.NewClientWithOpts(client.WithHost(d.Sock()))
+	if err != nil {
+		return nil, nil, err
+	}
+	deferF.Append(dockerAPI.Close)
+
+	err = waitForAPI(ctx, dockerAPI, 5*time.Second)
+	if err != nil {
+		return nil, nil, errors.Wrapf(err, "dockerd client api timed out: %s", integration.FormatLogs(cfg.Logs))
+	}
+
+	// Create a file descriptor to be used as a Unix domain socket.
+	// Remove it immediately (the name will still be valid for the socket) so that
+	// we don't leave files all over the users tmp tree.
+	f, err := os.CreateTemp("", "buildkit-integration")
+	if err != nil {
+		return
+	}
+	localPath := f.Name()
+	f.Close()
+	os.Remove(localPath)
+
+	listener, err := net.Listen("unix", localPath)
+	if err != nil {
+		return nil, nil, errors.Wrapf(err, "dockerd listener error: %s", integration.FormatLogs(cfg.Logs))
+	}
+	deferF.Append(listener.Close)
+
+	proxyGroup.Go(func() error {
+		for {
+			tmpConn, err := listener.Accept()
+			if err != nil {
+				// Ignore the error from accept which is always a system error.
+				return nil
+			}
+			conn, err := dockerAPI.DialHijack(ctx, "/grpc", "h2c", nil)
+			if err != nil {
+				return err
+			}
+
+			proxyGroup.Go(func() error {
+				_, err := io.Copy(conn, tmpConn)
+				if err != nil {
+					return err
+				}
+				return tmpConn.Close()
+			})
+			proxyGroup.Go(func() error {
+				_, err := io.Copy(tmpConn, conn)
+				if err != nil {
+					return err
+				}
+				return conn.Close()
+			})
+		}
+	})
+
+	return backend{
+		address:             "unix://" + listener.Addr().String(),
+		dockerAddress:       d.Sock(),
+		rootless:            c.IsRootless,
+		isDockerd:           true,
+		unsupportedFeatures: c.Unsupported,
+	}, cl, nil
+}
+
+func (c Moby) Close() error {
+	return nil
+}
+
+func waitForAPI(ctx context.Context, apiClient *client.Client, d time.Duration) error {
+	step := 50 * time.Millisecond
+	i := 0
+	for {
+		if _, err := apiClient.Ping(ctx); err == nil {
+			break
+		}
+		i++
+		if time.Duration(i)*step > d {
+			return errors.New("failed to connect to /_ping endpoint")
+		}
+		time.Sleep(step)
+	}
+	return nil
+}
+
+func IsTestDockerd() bool {
+	return os.Getenv("TEST_DOCKERD") == "1"
+}
+
+func IsTestDockerdMoby(sb integration.Sandbox) bool {
+	return sb.DockerAddress() != "" && sb.Name() == "dockerd"
+}

vendor/github.com/moby/buildkit/util/testutil/workers/features.go

@@ -0,0 +1,63 @@
+package workers
+
+import (
+	"testing"
+
+	"github.com/moby/buildkit/util/testutil/integration"
+)
+
+const (
+	FeatureCacheExport          = "cache_export"
+	FeatureCacheImport          = "cache_import"
+	FeatureCacheBackendAzblob   = "cache_backend_azblob"
+	FeatureCacheBackendGha      = "cache_backend_gha"
+	FeatureCacheBackendInline   = "cache_backend_inline"
+	FeatureCacheBackendLocal    = "cache_backend_local"
+	FeatureCacheBackendRegistry = "cache_backend_registry"
+	FeatureCacheBackendS3       = "cache_backend_s3"
+	FeatureDirectPush           = "direct_push"
+	FeatureFrontendOutline      = "frontend_outline"
+	FeatureFrontendTargets      = "frontend_targets"
+	FeatureImageExporter        = "image_exporter"
+	FeatureInfo                 = "info"
+	FeatureMergeDiff            = "merge_diff"
+	FeatureMultiCacheExport     = "multi_cache_export"
+	FeatureMultiPlatform        = "multi_platform"
+	FeatureOCIExporter          = "oci_exporter"
+	FeatureOCILayout            = "oci_layout"
+	FeatureProvenance           = "provenance"
+	FeatureSBOM                 = "sbom"
+	FeatureSecurityMode         = "security_mode"
+	FeatureSourceDateEpoch      = "source_date_epoch"
+	FeatureCNINetwork           = "cni_network"
+)
+
+var features = map[string]struct{}{
+	FeatureCacheExport:          {},
+	FeatureCacheImport:          {},
+	FeatureCacheBackendAzblob:   {},
+	FeatureCacheBackendGha:      {},
+	FeatureCacheBackendInline:   {},
+	FeatureCacheBackendLocal:    {},
+	FeatureCacheBackendRegistry: {},
+	FeatureCacheBackendS3:       {},
+	FeatureDirectPush:           {},
+	FeatureFrontendOutline:      {},
+	FeatureFrontendTargets:      {},
+	FeatureImageExporter:        {},
+	FeatureInfo:                 {},
+	FeatureMergeDiff:            {},
+	FeatureMultiCacheExport:     {},
+	FeatureMultiPlatform:        {},
+	FeatureOCIExporter:          {},
+	FeatureOCILayout:            {},
+	FeatureProvenance:           {},
+	FeatureSBOM:                 {},
+	FeatureSecurityMode:         {},
+	FeatureSourceDateEpoch:      {},
+	FeatureCNINetwork:           {},
+}
+
+func CheckFeatureCompat(t *testing.T, sb integration.Sandbox, reason ...string) {
+	integration.CheckFeatureCompat(t, sb, features, reason...)
+}

vendor/github.com/moby/buildkit/util/testutil/workers/oci.go

@@ -0,0 +1,91 @@
+package workers
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"os"
+	"runtime"
+
+	"github.com/moby/buildkit/util/bklog"
+	"github.com/moby/buildkit/util/testutil/integration"
+	"github.com/pkg/errors"
+)
+
+func InitOCIWorker() {
+	integration.Register(&OCI{ID: "oci"})
+
+	// the rootless uid is defined in Dockerfile
+	if s := os.Getenv("BUILDKIT_INTEGRATION_ROOTLESS_IDPAIR"); s != "" {
+		var uid, gid int
+		if _, err := fmt.Sscanf(s, "%d:%d", &uid, &gid); err != nil {
+			bklog.L.Fatalf("unexpected BUILDKIT_INTEGRATION_ROOTLESS_IDPAIR: %q", s)
+		}
+		if integration.RootlessSupported(uid) {
+			integration.Register(&OCI{ID: "oci-rootless", UID: uid, GID: gid})
+		}
+	}
+
+	if s := os.Getenv("BUILDKIT_INTEGRATION_SNAPSHOTTER"); s != "" {
+		integration.Register(&OCI{ID: "oci-snapshotter-" + s, Snapshotter: s})
+	}
+}
+
+type OCI struct {
+	ID          string
+	UID         int
+	GID         int
+	Snapshotter string
+}
+
+func (s *OCI) Name() string {
+	return s.ID
+}
+
+func (s *OCI) Rootless() bool {
+	return s.UID != 0
+}
+
+func (s *OCI) New(ctx context.Context, cfg *integration.BackendConfig) (integration.Backend, func() error, error) {
+	if err := integration.LookupBinary("buildkitd"); err != nil {
+		return nil, nil, err
+	}
+	if err := requireRoot(); err != nil {
+		return nil, nil, err
+	}
+	// Include use of --oci-worker-labels to trigger https://github.com/moby/buildkit/pull/603
+	buildkitdArgs := []string{"buildkitd", "--oci-worker=true", "--containerd-worker=false", "--oci-worker-gc=false", "--oci-worker-labels=org.mobyproject.buildkit.worker.sandbox=true"}
+
+	if s.Snapshotter != "" {
+		buildkitdArgs = append(buildkitdArgs,
+			fmt.Sprintf("--oci-worker-snapshotter=%s", s.Snapshotter))
+	}
+
+	if s.UID != 0 {
+		if s.GID == 0 {
+			return nil, nil, errors.Errorf("unsupported id pair: uid=%d, gid=%d", s.UID, s.GID)
+		}
+		// TODO: make sure the user exists and subuid/subgid are configured.
+		buildkitdArgs = append([]string{"sudo", "-E", "-u", fmt.Sprintf("#%d", s.UID), "-i", "--", "exec", "rootlesskit"}, buildkitdArgs...)
+	}
+
+	var extraEnv []string
+	if runtime.GOOS != "windows" && s.Snapshotter != "native" {
+		extraEnv = append(extraEnv, "BUILDKIT_DEBUG_FORCE_OVERLAY_DIFF=true")
+	}
+	buildkitdSock, stop, err := runBuildkitd(ctx, cfg, buildkitdArgs, cfg.Logs, s.UID, s.GID, extraEnv)
+	if err != nil {
+		integration.PrintLogs(cfg.Logs, log.Println)
+		return nil, nil, err
+	}
+
+	return backend{
+		address:     buildkitdSock,
+		rootless:    s.UID != 0,
+		snapshotter: s.Snapshotter,
+	}, stop, nil
+}
+
+func (s *OCI) Close() error {
+	return nil
+}

vendor/github.com/moby/buildkit/util/testutil/workers/sysprocattr_unix.go

@@ -0,0 +1,23 @@
+//go:build !windows
+// +build !windows
+
+package workers
+
+import (
+	"path/filepath"
+	"syscall"
+)
+
+func getSysProcAttr() *syscall.SysProcAttr {
+	return &syscall.SysProcAttr{
+		Setsid: true, // stretch sudo needs this for sigterm
+	}
+}
+
+func getBuildkitdAddr(tmpdir string) string {
+	return "unix://" + filepath.Join(tmpdir, "buildkitd.sock")
+}
+
+func getTraceSocketPath(tmpdir string) string {
+	return filepath.Join(tmpdir, "otel-grpc.sock")
+}

vendor/github.com/moby/buildkit/util/testutil/workers/sysprocattr_windows.go

@@ -0,0 +1,21 @@
+//go:build windows
+// +build windows
+
+package workers
+
+import (
+	"path/filepath"
+	"syscall"
+)
+
+func getSysProcAttr() *syscall.SysProcAttr {
+	return &syscall.SysProcAttr{}
+}
+
+func getBuildkitdAddr(tmpdir string) string {
+	return "//./pipe/buildkitd-" + filepath.Base(tmpdir)
+}
+
+func getTraceSocketPath(tmpdir string) string {
+	return `\\.\pipe\buildkit-otel-grpc-` + filepath.Base(tmpdir)
+}

vendor/github.com/moby/buildkit/util/testutil/workers/util.go

@@ -0,0 +1,89 @@
+package workers
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/moby/buildkit/util/testutil/integration"
+	"github.com/pkg/errors"
+)
+
+func requireRoot() error {
+	if os.Getuid() != 0 {
+		return errors.Wrap(integration.ErrRequirements, "requires root")
+	}
+	return nil
+}
+
+func runBuildkitd(ctx context.Context, conf *integration.BackendConfig, args []string, logs map[string]*bytes.Buffer, uid, gid int, extraEnv []string) (address string, cl func() error, err error) {
+	deferF := &integration.MultiCloser{}
+	cl = deferF.F()
+
+	defer func() {
+		if err != nil {
+			deferF.F()()
+			cl = nil
+		}
+	}()
+
+	if conf.ConfigFile != "" {
+		args = append(args, "--config="+conf.ConfigFile)
+	}
+
+	tmpdir, err := os.MkdirTemp("", "bktest_buildkitd")
+	if err != nil {
+		return "", nil, err
+	}
+	if err := os.Chown(tmpdir, uid, gid); err != nil {
+		return "", nil, err
+	}
+	if err := os.MkdirAll(filepath.Join(tmpdir, "tmp"), 0711); err != nil {
+		return "", nil, err
+	}
+	if err := os.Chown(filepath.Join(tmpdir, "tmp"), uid, gid); err != nil {
+		return "", nil, err
+	}
+
+	deferF.Append(func() error { return os.RemoveAll(tmpdir) })
+
+	address = getBuildkitdAddr(tmpdir)
+
+	args = append(args, "--root", tmpdir, "--addr", address, "--debug")
+	cmd := exec.Command(args[0], args[1:]...) //nolint:gosec // test utility
+	cmd.Env = append(os.Environ(), "BUILDKIT_DEBUG_EXEC_OUTPUT=1", "BUILDKIT_DEBUG_PANIC_ON_ERROR=1", "BUILDKIT_TRACE_SOCKET="+getTraceSocketPath(tmpdir), "TMPDIR="+filepath.Join(tmpdir, "tmp"))
+	cmd.Env = append(cmd.Env, extraEnv...)
+	cmd.SysProcAttr = getSysProcAttr()
+
+	stop, err := integration.StartCmd(cmd, logs)
+	if err != nil {
+		return "", nil, err
+	}
+	deferF.Append(stop)
+
+	if err := integration.WaitUnix(address, 15*time.Second, cmd); err != nil {
+		return "", nil, err
+	}
+
+	deferF.Append(func() error {
+		f, err := os.Open("/proc/self/mountinfo")
+		if err != nil {
+			return errors.Wrap(err, "failed to open mountinfo")
+		}
+		defer f.Close()
+		s := bufio.NewScanner(f)
+		for s.Scan() {
+			if strings.Contains(s.Text(), tmpdir) {
+				return errors.Errorf("leaked mountpoint for %s", tmpdir)
+			}
+		}
+		return s.Err()
+	})
+
+	return address, cl, err
+}