Merge pull request #2768 from tonistiigi/0.18-buildkit-v0.17.0

[v0.18] vendor: update buildkit to v0.17.0

.github/CONTRIBUTING.md

@@ -188,89 +188,6 @@ To generate new vendored files with go modules run:
 $ make vendor
 ```
 
-### Generate profiling data
-
-You can configure Buildx to generate [`pprof`](https://github.com/google/pprof)
-memory and CPU profiles to analyze and optimize your builds. These profiles are
-useful for identifying performance bottlenecks, detecting memory
-inefficiencies, and ensuring the program (Buildx) runs efficiently.
-
-The following environment variables control whether Buildx generates profiling
-data for builds:
-
-```console
-$ export BUILDX_CPU_PROFILE=buildx_cpu.prof
-$ export BUILDX_MEM_PROFILE=buildx_mem.prof
-```
-
-When set, Buildx emits profiling samples for the builds to the location
-specified by the environment variable.
-
-To analyze and visualize profiling samples, you need `pprof` from the Go
-toolchain, and (optionally) GraphViz for visualization in a graphical format.
-
-To inspect profiling data with `pprof`:
-
-1. Build a local binary of Buildx from source.
-
-   ```console
-   $ docker buildx bake
-   ```
-
-   The binary gets exported to `./bin/build/buildx`.
-
-2. Run a build and with the environment variables set to generate profiling data.
-
-   ```console
-   $ export BUILDX_CPU_PROFILE=buildx_cpu.prof
-   $ export BUILDX_MEM_PROFILE=buildx_mem.prof
-   $ ./bin/build/buildx bake
-   ```
-
-   This creates `buildx_cpu.prof` and `buildx_mem.prof` for the build.
-
-3. Start `pprof` and specify the filename of the profile that you want to
-   analyze.
-
-   ```console
-   $ go tool pprof buildx_cpu.prof
-   ```
-
-   This opens the `pprof` interactive console. From here, you can inspect the
-   profiling sample using various commands. For example, use `top 10` command
-   to view the top 10 most time-consuming entries.
-
-   ```plaintext
-   (pprof) top 10
-   Showing nodes accounting for 3.04s, 91.02% of 3.34s total
-   Dropped 123 nodes (cum <= 0.02s)
-   Showing top 10 nodes out of 159
-         flat  flat%   sum%        cum   cum%
-        1.14s 34.13% 34.13%      1.14s 34.13%  syscall.syscall
-        0.91s 27.25% 61.38%      0.91s 27.25%  runtime.kevent
-        0.35s 10.48% 71.86%      0.35s 10.48%  runtime.pthread_cond_wait
-        0.22s  6.59% 78.44%      0.22s  6.59%  runtime.pthread_cond_signal
-        0.15s  4.49% 82.93%      0.15s  4.49%  runtime.usleep
-        0.10s  2.99% 85.93%      0.10s  2.99%  runtime.memclrNoHeapPointers
-        0.10s  2.99% 88.92%      0.10s  2.99%  runtime.memmove
-        0.03s   0.9% 89.82%      0.03s   0.9%  runtime.madvise
-        0.02s   0.6% 90.42%      0.02s   0.6%  runtime.(*mspan).typePointersOfUnchecked
-        0.02s   0.6% 91.02%      0.02s   0.6%  runtime.pcvalue
-   ```
-
-To view the call graph in a GUI, run `go tool pprof -http=:8081 <sample>`.
-
-> [!NOTE]
-> Requires [GraphViz](https://www.graphviz.org/) to be installed.
-
-```console
-$ go tool pprof -http=:8081 buildx_cpu.prof
-Serving web UI on http://127.0.0.1:8081
-http://127.0.0.1:8081
-```
-
-For more information about using `pprof` and how to interpret the call graph,
-refer to the [`pprof` README](https://github.com/google/pprof/blob/main/doc/README.md).
 
 ### Conventions
 

.github/workflows/build.yml

@@ -36,7 +36,7 @@ env:
   TEST_CACHE_SCOPE: "test"
   TESTFLAGS: "-v --parallel=6 --timeout=30m"
   GOTESTSUM_FORMAT: "standard-verbose"
-  GO_VERSION: "1.23"
+  GO_VERSION: "1.22"
   GOTESTSUM_VERSION: "v1.9.0"  # same as one in Dockerfile
 
 jobs:
@@ -54,9 +54,9 @@ jobs:
           - master
           - latest
           - buildx-stable-1
-          - v0.17.2
-          - v0.16.0
           - v0.15.2
+          - v0.14.1
+          - v0.13.2
         worker:
           - docker-container
           - remote
@@ -76,16 +76,6 @@ jobs:
           - worker: docker+containerd  # same as docker, but with containerd snapshotter
             pkg: ./tests
             mode: experimental
-          - worker: "docker@26.1"
-            pkg: ./tests
-          - worker: "docker+containerd@26.1"  # same as docker, but with containerd snapshotter
-            pkg: ./tests
-          - worker: "docker@26.1"
-            pkg: ./tests
-            mode: experimental
-          - worker: "docker+containerd@26.1"  # same as docker, but with containerd snapshotter
-            pkg: ./tests
-            mode: experimental
     steps:
       -
         name: Prepare
@@ -96,7 +86,7 @@ jobs:
           fi
           testFlags="--run=//worker=$(echo "${{ matrix.worker }}" | sed 's/\+/\\+/g')$"
           case "${{ matrix.worker }}" in
-            docker | docker+containerd | docker@* | docker+containerd@*)
+            docker | docker+containerd)
               echo "TESTFLAGS=${{ env.TESTFLAGS_DOCKER }} $testFlags" >> $GITHUB_ENV
               ;;
             *)
@@ -141,7 +131,7 @@ jobs:
       -
         name: Send to Codecov
         if: always()
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v4
         with:
           directory: ./bin/testreports
           flags: integration
@@ -168,7 +158,7 @@ jobs:
       matrix:
         os:
           - ubuntu-24.04
-          - macos-14
+          - macos-12
           - windows-2022
     env:
       SKIP_INTEGRATION_TESTS: 1
@@ -213,7 +203,7 @@ jobs:
       -
         name: Send to Codecov
         if: always()
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v4
         with:
           directory: ${{ env.TESTREPORTS_DIR }}
           env_vars: RUNNER_OS
@@ -448,7 +438,7 @@ jobs:
       -
         name: GitHub Release
         if: startsWith(github.ref, 'refs/tags/v')
-        uses: softprops/action-gh-release@01570a1f39cb168c169c802c3bceb9e93fb10974  # v2.1.0
+        uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191  # v2.0.8
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/codeql.yml

@@ -17,7 +17,7 @@ on:
   pull_request:
 
 env:
-  GO_VERSION: "1.23"
+  GO_VERSION: "1.22"
 
 jobs:
   codeql:

.golangci.yml

@@ -1,52 +1,26 @@
 run:
   timeout: 30m
+
   modules-download-mode: vendor
-  # default uses Go version from the go.mod file, fallback on the env var
-  # `GOVERSION`, fallback on 1.17: https://golangci-lint.run/usage/configuration/#run-configuration
-  go: "1.23"
 
 linters:
   enable:
-    - bodyclose
-    - depguard
-    - forbidigo
-    - gocritic
     - gofmt
-    - goimports
-    - gosec
-    - gosimple
     - govet
+    - depguard
+    - goimports
     - ineffassign
-    - makezero
     - misspell
-    - noctx
+    - unused
-    - nolintlint
     - revive
     - staticcheck
-    - testifylint
     - typecheck
-    - unused
+    - nolintlint
-    - whitespace
+    - gosec
+    - forbidigo
   disable-all: true
 
 linters-settings:
-  gocritic:
-    disabled-checks:
-      - "ifElseChain"
-      - "assignOp"
-      - "appendAssign"
-      - "singleCaseSwitch"
-      - "exitAfterDefer" # FIXME
-  importas:
-    alias:
-      # Enforce alias to prevent it accidentally being used instead of
-      # buildkit errdefs package (or vice-versa).
-      - pkg: "github.com/containerd/errdefs"
-        alias: "cerrdefs"
-      - pkg: "github.com/opencontainers/image-spec/specs-go/v1"
-        alias: "ocispecs"
-      - pkg: "github.com/opencontainers/go-digest"
-        alias: "digest"
   govet:
     enable:
       - nilness
@@ -69,27 +43,14 @@ linters-settings:
             desc: The io/ioutil package has been deprecated.
   forbidigo:
     forbid:
-      - '^context\.WithCancel(# use context\.WithCancelCause instead)?$'
-      - '^context\.WithDeadline(# use context\.WithDeadline instead)?$'
-      - '^context\.WithTimeout(# use context\.WithTimeoutCause instead)?$'
-      - '^ctx\.Err(# use context\.Cause instead)?$'
       - '^fmt\.Errorf(# use errors\.Errorf instead)?$'
       - '^platforms\.DefaultString(# use platforms\.Format(platforms\.DefaultSpec()) instead\.)?$'
   gosec:
     excludes:
       - G204  # Audit use of command execution
       - G402  # TLS MinVersion too low
-      - G115  # integer overflow conversion (TODO: verify these)
     config:
       G306: "0644"
-  testifylint:
-    disable:
-      # disable rules that reduce the test condition
-      - "empty"
-      - "bool-compare"
-      - "len"
-      - "negative-positive"
-
 
 issues:
   exclude-files:

Dockerfile

@@ -1,23 +1,20 @@
 # syntax=docker/dockerfile:1
 
-ARG GO_VERSION=1.23
+ARG GO_VERSION=1.22
-ARG XX_VERSION=1.6.1
+ARG XX_VERSION=1.5.0
 
 # for testing
-ARG DOCKER_VERSION=27.4.0-rc.2
+ARG DOCKER_VERSION=27.2.1
-ARG DOCKER_VERSION_ALT_26=26.1.3
 ARG DOCKER_CLI_VERSION=${DOCKER_VERSION}
-ARG GOTESTSUM_VERSION=v1.12.0
+ARG GOTESTSUM_VERSION=v1.9.0
-ARG REGISTRY_VERSION=2.8.3
+ARG REGISTRY_VERSION=2.8.0
-ARG BUILDKIT_VERSION=v0.17.2
+ARG BUILDKIT_VERSION=v0.16.0
-ARG UNDOCK_VERSION=0.8.0
+ARG UNDOCK_VERSION=0.7.0
 
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
 FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine AS golatest
 FROM moby/moby-bin:$DOCKER_VERSION AS docker-engine
 FROM dockereng/cli-bin:$DOCKER_CLI_VERSION AS docker-cli
-FROM moby/moby-bin:$DOCKER_VERSION_ALT_26 AS docker-engine-alt
-FROM dockereng/cli-bin:$DOCKER_VERSION_ALT_26 AS docker-cli-alt
 FROM registry:$REGISTRY_VERSION AS registry
 FROM moby/buildkit:$BUILDKIT_VERSION AS buildkit
 FROM crazymax/undock:$UNDOCK_VERSION AS undock
@@ -80,7 +77,6 @@ RUN --mount=type=bind,target=. \
   set -e
   xx-go --wrap
   DESTDIR=/usr/bin VERSION=$(cat /buildx-version/version) REVISION=$(cat /buildx-version/revision) GO_EXTRA_LDFLAGS="-s -w" ./hack/build
-  file /usr/bin/docker-buildx
   xx-verify --static /usr/bin/docker-buildx
 EOT
 
@@ -99,9 +95,7 @@ FROM scratch AS binaries-unix
 COPY --link --from=buildx-build /usr/bin/docker-buildx /buildx
 
 FROM binaries-unix AS binaries-darwin
-FROM binaries-unix AS binaries-freebsd
 FROM binaries-unix AS binaries-linux
-FROM binaries-unix AS binaries-openbsd
 
 FROM scratch AS binaries-windows
 COPY --link --from=buildx-build /usr/bin/docker-buildx /buildx.exe
@@ -126,13 +120,10 @@ COPY --link --from=gotestsum /out /usr/bin/
 COPY --link --from=registry /bin/registry /usr/bin/
 COPY --link --from=docker-engine / /usr/bin/
 COPY --link --from=docker-cli / /usr/bin/
-COPY --link --from=docker-engine-alt / /opt/docker-alt-26/
-COPY --link --from=docker-cli-alt / /opt/docker-alt-26/
 COPY --link --from=buildkit /usr/bin/buildkitd /usr/bin/
 COPY --link --from=buildkit /usr/bin/buildctl /usr/bin/
 COPY --link --from=undock /usr/local/bin/undock /usr/bin/
 COPY --link --from=binaries /buildx /usr/bin/
-ENV TEST_DOCKER_EXTRA="docker@26.1=/opt/docker-alt-26"
 
 FROM integration-test-base AS integration-test
 COPY . .

bake/bake.go

@@ -193,7 +193,7 @@ func ListTargets(files []File) ([]string, error) {
 	return dedupSlice(targets), nil
 }
 
-func ReadTargets(ctx context.Context, files []File, targets, overrides []string, defaults map[string]string, ent *EntitlementConf) (map[string]*Target, map[string]*Group, error) {
+func ReadTargets(ctx context.Context, files []File, targets, overrides []string, defaults map[string]string) (map[string]*Target, map[string]*Group, error) {
 	c, _, err := ParseFiles(files, defaults)
 	if err != nil {
 		return nil, nil, err
@@ -212,7 +212,7 @@ func ReadTargets(ctx context.Context, files []File, targets, overrides []string,
 	for _, target := range targets {
 		ts, gs := c.ResolveGroup(target)
 		for _, tname := range ts {
-			t, err := c.ResolveTarget(tname, o, ent)
+			t, err := c.ResolveTarget(tname, o)
 			if err != nil {
 				return nil, nil, err
 			}
@@ -244,7 +244,7 @@ func ReadTargets(ctx context.Context, files []File, targets, overrides []string,
 	}
 
 	for name, t := range m {
-		if err := c.loadLinks(name, t, m, o, nil, ent); err != nil {
+		if err := c.loadLinks(name, t, m, o, nil); err != nil {
 			return nil, nil, err
 		}
 	}
@@ -476,7 +476,7 @@ func (c Config) expandTargets(pattern string) ([]string, error) {
 	return names, nil
 }
 
-func (c Config) loadLinks(name string, t *Target, m map[string]*Target, o map[string]map[string]Override, visited []string, ent *EntitlementConf) error {
+func (c Config) loadLinks(name string, t *Target, m map[string]*Target, o map[string]map[string]Override, visited []string) error {
 	visited = append(visited, name)
 	for _, v := range t.Contexts {
 		if strings.HasPrefix(v, "target:") {
@@ -492,7 +492,7 @@ func (c Config) loadLinks(name string, t *Target, m map[string]*Target, o map[st
 			t2, ok := m[target]
 			if !ok {
 				var err error
-				t2, err = c.ResolveTarget(target, o, ent)
+				t2, err = c.ResolveTarget(target, o)
 				if err != nil {
 					return err
 				}
@@ -500,7 +500,7 @@ func (c Config) loadLinks(name string, t *Target, m map[string]*Target, o map[st
 				t2.linked = true
 				m[target] = t2
 			}
-			if err := c.loadLinks(target, t2, m, o, visited, ent); err != nil {
+			if err := c.loadLinks(target, t2, m, o, visited); err != nil {
 				return err
 			}
 
@@ -627,8 +627,8 @@ func (c Config) group(name string, visited map[string]visit) ([]string, []string
 	return targets, groups
 }
 
-func (c Config) ResolveTarget(name string, overrides map[string]map[string]Override, ent *EntitlementConf) (*Target, error) {
+func (c Config) ResolveTarget(name string, overrides map[string]map[string]Override) (*Target, error) {
-	t, err := c.target(name, map[string]*Target{}, overrides, ent)
+	t, err := c.target(name, map[string]*Target{}, overrides)
 	if err != nil {
 		return nil, err
 	}
@@ -644,7 +644,7 @@ func (c Config) ResolveTarget(name string, overrides map[string]map[string]Overr
 	return t, nil
 }
 
-func (c Config) target(name string, visited map[string]*Target, overrides map[string]map[string]Override, ent *EntitlementConf) (*Target, error) {
+func (c Config) target(name string, visited map[string]*Target, overrides map[string]map[string]Override) (*Target, error) {
 	if t, ok := visited[name]; ok {
 		return t, nil
 	}
@@ -661,7 +661,7 @@ func (c Config) target(name string, visited map[string]*Target, overrides map[st
 	}
 	tt := &Target{}
 	for _, name := range t.Inherits {
-		t, err := c.target(name, visited, overrides, ent)
+		t, err := c.target(name, visited, overrides)
 		if err != nil {
 			return nil, err
 		}
@@ -673,7 +673,7 @@ func (c Config) target(name string, visited map[string]*Target, overrides map[st
 	m.Merge(tt)
 	m.Merge(t)
 	tt = m
-	if err := tt.AddOverrides(overrides[name], ent); err != nil {
+	if err := tt.AddOverrides(overrides[name]); err != nil {
 		return nil, err
 	}
 	tt.normalize()
@@ -725,12 +725,10 @@ type Target struct {
 	linked bool
 }
 
-var (
+var _ hclparser.WithEvalContexts = &Target{}
-	_ hclparser.WithEvalContexts = &Target{}
+var _ hclparser.WithGetName = &Target{}
-	_ hclparser.WithGetName      = &Target{}
+var _ hclparser.WithEvalContexts = &Group{}
-	_ hclparser.WithEvalContexts = &Group{}
+var _ hclparser.WithGetName = &Group{}
-	_ hclparser.WithGetName      = &Group{}
-)
 
 func (t *Target) normalize() {
 	t.Annotations = removeDupes(t.Annotations)
@@ -856,7 +854,7 @@ func (t *Target) Merge(t2 *Target) {
 	t.Inherits = append(t.Inherits, t2.Inherits...)
 }
 
-func (t *Target) AddOverrides(overrides map[string]Override, ent *EntitlementConf) error {
+func (t *Target) AddOverrides(overrides map[string]Override) error {
 	for key, o := range overrides {
 		value := o.Value
 		keys := strings.SplitN(key, ".", 2)
@@ -867,7 +865,7 @@ func (t *Target) AddOverrides(overrides map[string]Override, ent *EntitlementCon
 			t.Dockerfile = &value
 		case "args":
 			if len(keys) != 2 {
-				return errors.Errorf("invalid format for args, expecting args.<name>=<value>")
+				return errors.Errorf("args require name")
 			}
 			if t.Args == nil {
 				t.Args = map[string]*string{}
@@ -875,7 +873,7 @@ func (t *Target) AddOverrides(overrides map[string]Override, ent *EntitlementCon
 			t.Args[keys[1]] = &value
 		case "contexts":
 			if len(keys) != 2 {
-				return errors.Errorf("invalid format for contexts, expecting contexts.<name>=<value>")
+				return errors.Errorf("contexts require name")
 			}
 			if t.Contexts == nil {
 				t.Contexts = map[string]string{}
@@ -883,7 +881,7 @@ func (t *Target) AddOverrides(overrides map[string]Override, ent *EntitlementCon
 			t.Contexts[keys[1]] = value
 		case "labels":
 			if len(keys) != 2 {
-				return errors.Errorf("invalid format for labels, expecting labels.<name>=<value>")
+				return errors.Errorf("labels require name")
 			}
 			if t.Labels == nil {
 				t.Labels = map[string]*string{}
@@ -893,76 +891,22 @@ func (t *Target) AddOverrides(overrides map[string]Override, ent *EntitlementCon
 			t.Tags = o.ArrValue
 		case "cache-from":
 			t.CacheFrom = o.ArrValue
-			cacheFrom, err := buildflags.ParseCacheEntry(o.ArrValue)
-			if err != nil {
-				return err
-			}
-			for _, c := range cacheFrom {
-				if c.Type == "local" {
-					if v, ok := c.Attrs["src"]; ok {
-						ent.FSRead = append(ent.FSRead, v)
-					}
-				}
-			}
 		case "cache-to":
 			t.CacheTo = o.ArrValue
-			cacheTo, err := buildflags.ParseCacheEntry(o.ArrValue)
-			if err != nil {
-				return err
-			}
-			for _, c := range cacheTo {
-				if c.Type == "local" {
-					if v, ok := c.Attrs["dest"]; ok {
-						ent.FSWrite = append(ent.FSWrite, v)
-					}
-				}
-			}
 		case "target":
 			t.Target = &value
 		case "call":
 			t.Call = &value
 		case "secrets":
 			t.Secrets = o.ArrValue
-			secrets, err := buildflags.ParseSecretSpecs(o.ArrValue)
-			if err != nil {
-				return errors.Wrap(err, "invalid value for outputs")
-			}
-			for _, s := range secrets {
-				if s.FilePath != "" {
-					ent.FSRead = append(ent.FSRead, s.FilePath)
-				}
-			}
 		case "ssh":
 			t.SSH = o.ArrValue
-			ssh, err := buildflags.ParseSSHSpecs(o.ArrValue)
-			if err != nil {
-				return errors.Wrap(err, "invalid value for outputs")
-			}
-			for _, s := range ssh {
-				ent.FSRead = append(ent.FSRead, s.Paths...)
-			}
 		case "platform":
 			t.Platforms = o.ArrValue
 		case "output":
 			t.Outputs = o.ArrValue
-			outputs, err := buildflags.ParseExports(o.ArrValue)
-			if err != nil {
-				return errors.Wrap(err, "invalid value for outputs")
-			}
-			for _, o := range outputs {
-				if o.Destination != "" {
-					ent.FSWrite = append(ent.FSWrite, o.Destination)
-				}
-			}
 		case "entitlements":
 			t.Entitlements = append(t.Entitlements, o.ArrValue...)
-			for _, v := range o.ArrValue {
-				if v == string(EntitlementKeyNetworkHost) {
-					ent.NetworkHost = true
-				} else if v == string(EntitlementKeySecurityInsecure) {
-					ent.SecurityInsecure = true
-				}
-			}
 		case "annotations":
 			t.Annotations = append(t.Annotations, o.ArrValue...)
 		case "attest":
@@ -1171,34 +1115,62 @@ func updateContext(t *build.Inputs, inp *Input) {
 	t.ContextState = &st
 }
 
-func collectLocalPaths(t build.Inputs) []string {
+// validateContextsEntitlements is a basic check to ensure contexts do not
-	var out []string
+// escape local directories when loaded from remote sources. This is to be
+// replaced with proper entitlements support in the future.
+func validateContextsEntitlements(t build.Inputs, inp *Input) error {
+	if inp == nil || inp.State == nil {
+		return nil
+	}
+	if v, ok := os.LookupEnv("BAKE_ALLOW_REMOTE_FS_ACCESS"); ok {
+		if vv, _ := strconv.ParseBool(v); vv {
+			return nil
+		}
+	}
 	if t.ContextState == nil {
-		if v, ok := isLocalPath(t.ContextPath); ok {
+		if err := checkPath(t.ContextPath); err != nil {
-			out = append(out, v)
+			return err
 		}
-		if v, ok := isLocalPath(t.DockerfilePath); ok {
-			out = append(out, v)
-		}
-	} else if strings.HasPrefix(t.ContextPath, "cwd://") {
-		out = append(out, strings.TrimPrefix(t.ContextPath, "cwd://"))
 	}
 	for _, v := range t.NamedContexts {
 		if v.State != nil {
 			continue
 		}
-		if v, ok := isLocalPath(v.Path); ok {
+		if err := checkPath(v.Path); err != nil {
-			out = append(out, v)
+			return err
 		}
 	}
-	return out
+	return nil
 }
 
-func isLocalPath(p string) (string, bool) {
+func checkPath(p string) error {
 	if build.IsRemoteURL(p) || strings.HasPrefix(p, "target:") || strings.HasPrefix(p, "docker-image:") {
-		return "", false
+		return nil
 	}
-	return strings.TrimPrefix(p, "cwd://"), true
+	p, err := filepath.EvalSymlinks(p)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+	p, err = filepath.Abs(p)
+	if err != nil {
+		return err
+	}
+	wd, err := os.Getwd()
+	if err != nil {
+		return err
+	}
+	rel, err := filepath.Rel(wd, p)
+	if err != nil {
+		return err
+	}
+	parts := strings.Split(rel, string(os.PathSeparator))
+	if parts[0] == ".." {
+		return errors.Errorf("path %s is outside of the working directory, please set BAKE_ALLOW_REMOTE_FS_ACCESS=1", p)
+	}
+	return nil
 }
 
 func toBuildOpt(t *Target, inp *Input) (*build.Options, error) {
@@ -1238,6 +1210,9 @@ func toBuildOpt(t *Target, inp *Input) (*build.Options, error) {
 		// it's not outside the working directory and then resolve it to an
 		// absolute path.
 		bi.DockerfilePath = path.Clean(strings.TrimPrefix(bi.DockerfilePath, "cwd://"))
+		if err := checkPath(bi.DockerfilePath); err != nil {
+			return nil, err
+		}
 		var err error
 		bi.DockerfilePath, err = filepath.Abs(bi.DockerfilePath)
 		if err != nil {
@@ -1274,6 +1249,10 @@ func toBuildOpt(t *Target, inp *Input) (*build.Options, error) {
 		}
 	}
 
+	if err := validateContextsEntitlements(bi, inp); err != nil {
+		return nil, err
+	}
+
 	t.Context = &bi.ContextPath
 
 	args := map[string]string{}
@@ -1334,8 +1313,6 @@ func toBuildOpt(t *Target, inp *Input) (*build.Options, error) {
 	if err != nil {
 		return nil, err
 	}
-	bo.SecretSpecs = secrets
-
 	secretAttachment, err := controllerapi.CreateSecrets(secrets)
 	if err != nil {
 		return nil, err
@@ -1349,8 +1326,6 @@ func toBuildOpt(t *Target, inp *Input) (*build.Options, error) {
 	if len(sshSpecs) == 0 && (buildflags.IsGitSSH(bi.ContextPath) || (inp != nil && buildflags.IsGitSSH(inp.URL))) {
 		sshSpecs = append(sshSpecs, &controllerapi.SSH{ID: "default"})
 	}
-	bo.SSHSpecs = sshSpecs
-
 	sshAttachment, err := controllerapi.CreateSSH(sshSpecs)
 	if err != nil {
 		return nil, err
@@ -1383,8 +1358,7 @@ func toBuildOpt(t *Target, inp *Input) (*build.Options, error) {
 	if err != nil {
 		return nil, err
 	}
-
+	bo.Exports, err = controllerapi.CreateExports(outputs)
-	bo.Exports, bo.ExportsLocalPathsTemporary, err = controllerapi.CreateExports(outputs)
 	if err != nil {
 		return nil, err
 	}

bake/bake_test.go

@@ -40,7 +40,7 @@ target "webapp" {
 
 	t.Run("NoOverrides", func(t *testing.T) {
 		t.Parallel()
-		m, g, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, nil, nil, &EntitlementConf{})
+		m, g, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, nil, nil)
 		require.NoError(t, err)
 		require.Equal(t, 1, len(m))
 
@@ -58,9 +58,9 @@ target "webapp" {
 
 	t.Run("InvalidTargetOverrides", func(t *testing.T) {
 		t.Parallel()
-		_, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"nosuchtarget.context=foo"}, nil, &EntitlementConf{})
+		_, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"nosuchtarget.context=foo"}, nil)
-		require.Error(t, err)
+		require.NotNil(t, err)
-		require.Equal(t, "could not find any target matching 'nosuchtarget'", err.Error())
+		require.Equal(t, err.Error(), "could not find any target matching 'nosuchtarget'")
 	})
 
 	t.Run("ArgsOverrides", func(t *testing.T) {
@@ -74,7 +74,7 @@ target "webapp" {
 				"webapp.args.VAR_FROMENV" + t.Name(),
 				"webapp.args.VAR_INHERITED=override",
 				// not overriding VAR_BOTH on purpose
-			}, nil, &EntitlementConf{})
+			}, nil)
 			require.NoError(t, err)
 
 			require.Equal(t, "Dockerfile.webapp", *m["webapp"].Dockerfile)
@@ -103,7 +103,7 @@ target "webapp" {
 			m, g, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{
 				"webDEP.args.VAR_INHERITED=override",
 				"webDEP.args.VAR_BOTH=override",
-			}, nil, &EntitlementConf{})
+			}, nil)
 
 			require.NoError(t, err)
 			require.Equal(t, ptrstr("override"), m["webapp"].Args["VAR_INHERITED"])
@@ -115,10 +115,10 @@ target "webapp" {
 
 	t.Run("ContextOverride", func(t *testing.T) {
 		t.Parallel()
-		_, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.context"}, nil, &EntitlementConf{})
+		_, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.context"}, nil)
-		require.Error(t, err)
+		require.NotNil(t, err)
 
-		m, g, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.context=foo"}, nil, &EntitlementConf{})
+		m, g, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.context=foo"}, nil)
 		require.NoError(t, err)
 		require.Equal(t, "foo", *m["webapp"].Context)
 		require.Equal(t, 1, len(g))
@@ -127,7 +127,7 @@ target "webapp" {
 
 	t.Run("NoCacheOverride", func(t *testing.T) {
 		t.Parallel()
-		m, g, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.no-cache=false"}, nil, &EntitlementConf{})
+		m, g, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.no-cache=false"}, nil)
 		require.NoError(t, err)
 		require.Equal(t, false, *m["webapp"].NoCache)
 		require.Equal(t, 1, len(g))
@@ -135,14 +135,14 @@ target "webapp" {
 	})
 
 	t.Run("ShmSizeOverride", func(t *testing.T) {
-		m, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.shm-size=256m"}, nil, &EntitlementConf{})
+		m, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.shm-size=256m"}, nil)
 		require.NoError(t, err)
 		require.Equal(t, "256m", *m["webapp"].ShmSize)
 	})
 
 	t.Run("PullOverride", func(t *testing.T) {
 		t.Parallel()
-		m, g, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.pull=false"}, nil, &EntitlementConf{})
+		m, g, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.pull=false"}, nil)
 		require.NoError(t, err)
 		require.Equal(t, false, *m["webapp"].Pull)
 		require.Equal(t, 1, len(g))
@@ -203,14 +203,14 @@ target "webapp" {
 					// NOTE: I am unsure whether failing to match should always error out
 					// instead of simply skipping that override.
 					// Let's enforce the error and we can relax it later if users complain.
-					require.Error(t, err)
+					require.NotNil(t, err)
-					require.Equal(t, "could not find any target matching 'nomatch*'", err.Error())
+					require.Equal(t, err.Error(), "could not find any target matching 'nomatch*'")
 				},
 			},
 		}
 		for _, test := range cases {
 			t.Run(test.name, func(t *testing.T) {
-				m, g, err := ReadTargets(ctx, []File{fp}, test.targets, test.overrides, nil, &EntitlementConf{})
+				m, g, err := ReadTargets(ctx, []File{fp}, test.targets, test.overrides, nil)
 				test.check(t, m, g, err)
 			})
 		}
@@ -225,7 +225,7 @@ func TestPushOverride(t *testing.T) {
 				`target "app" {
 			}`),
 		}
-		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.push=true"}, nil, &EntitlementConf{})
+		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.push=true"}, nil)
 		require.NoError(t, err)
 		require.Equal(t, 1, len(m["app"].Outputs))
 		require.Equal(t, "type=image,push=true", m["app"].Outputs[0])
@@ -239,7 +239,7 @@ func TestPushOverride(t *testing.T) {
 				output = ["type=image,compression=zstd"]
 			}`),
 		}
-		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.push=true"}, nil, &EntitlementConf{})
+		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.push=true"}, nil)
 		require.NoError(t, err)
 		require.Equal(t, 1, len(m["app"].Outputs))
 		require.Equal(t, "type=image,compression=zstd,push=true", m["app"].Outputs[0])
@@ -253,7 +253,7 @@ func TestPushOverride(t *testing.T) {
 				output = ["type=image,compression=zstd"]
 			}`),
 		}
-		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.push=false"}, nil, &EntitlementConf{})
+		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.push=false"}, nil)
 		require.NoError(t, err)
 		require.Equal(t, 1, len(m["app"].Outputs))
 		require.Equal(t, "type=image,compression=zstd,push=false", m["app"].Outputs[0])
@@ -267,7 +267,7 @@ func TestPushOverride(t *testing.T) {
 				output = ["type=registry"]
 			}`),
 		}
-		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.push=true"}, nil, &EntitlementConf{})
+		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.push=true"}, nil)
 		require.NoError(t, err)
 		require.Equal(t, 1, len(m["app"].Outputs))
 		require.Equal(t, "type=registry", m["app"].Outputs[0])
@@ -281,7 +281,7 @@ func TestPushOverride(t *testing.T) {
 				output = ["type=registry"]
 			}`),
 		}
-		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.push=false"}, nil, &EntitlementConf{})
+		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.push=false"}, nil)
 		require.NoError(t, err)
 		require.Equal(t, 0, len(m["app"].Outputs))
 	})
@@ -296,7 +296,7 @@ func TestPushOverride(t *testing.T) {
 			target "bar" {
 			}`),
 		}
-		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"foo", "bar"}, []string{"*.push=true"}, nil, &EntitlementConf{})
+		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"foo", "bar"}, []string{"*.push=true"}, nil)
 		require.NoError(t, err)
 		require.Equal(t, 2, len(m))
 		require.Equal(t, 1, len(m["foo"].Outputs))
@@ -314,7 +314,7 @@ func TestLoadOverride(t *testing.T) {
 				`target "app" {
 			}`),
 		}
-		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.load=true"}, nil, &EntitlementConf{})
+		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.load=true"}, nil)
 		require.NoError(t, err)
 		require.Equal(t, 1, len(m["app"].Outputs))
 		require.Equal(t, "type=docker", m["app"].Outputs[0])
@@ -328,7 +328,7 @@ func TestLoadOverride(t *testing.T) {
 				output = ["type=docker"]
 			}`),
 		}
-		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.load=true"}, nil, &EntitlementConf{})
+		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.load=true"}, nil)
 		require.NoError(t, err)
 		require.Equal(t, 1, len(m["app"].Outputs))
 		require.Equal(t, []string{"type=docker"}, m["app"].Outputs)
@@ -342,7 +342,7 @@ func TestLoadOverride(t *testing.T) {
 				output = ["type=image"]
 			}`),
 		}
-		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.load=true"}, nil, &EntitlementConf{})
+		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.load=true"}, nil)
 		require.NoError(t, err)
 		require.Equal(t, 2, len(m["app"].Outputs))
 		require.Equal(t, []string{"type=image", "type=docker"}, m["app"].Outputs)
@@ -356,7 +356,7 @@ func TestLoadOverride(t *testing.T) {
 				output = ["type=image"]
 			}`),
 		}
-		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.load=false"}, nil, &EntitlementConf{})
+		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.load=false"}, nil)
 		require.NoError(t, err)
 		require.Equal(t, 1, len(m["app"].Outputs))
 		require.Equal(t, []string{"type=image"}, m["app"].Outputs)
@@ -370,7 +370,7 @@ func TestLoadOverride(t *testing.T) {
 				output = ["type=registry"]
 			}`),
 		}
-		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.load=true"}, nil, &EntitlementConf{})
+		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.load=true"}, nil)
 		require.NoError(t, err)
 		require.Equal(t, 2, len(m["app"].Outputs))
 		require.Equal(t, []string{"type=registry", "type=docker"}, m["app"].Outputs)
@@ -384,7 +384,7 @@ func TestLoadOverride(t *testing.T) {
 				output = ["type=oci,dest=out"]
 			}`),
 		}
-		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.load=true"}, nil, &EntitlementConf{})
+		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.load=true"}, nil)
 		require.NoError(t, err)
 		require.Equal(t, 2, len(m["app"].Outputs))
 		require.Equal(t, []string{"type=oci,dest=out", "type=docker"}, m["app"].Outputs)
@@ -398,7 +398,7 @@ func TestLoadOverride(t *testing.T) {
 				output = ["type=docker,dest=out"]
 			}`),
 		}
-		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.load=true"}, nil, &EntitlementConf{})
+		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"app"}, []string{"*.load=true"}, nil)
 		require.NoError(t, err)
 		require.Equal(t, 2, len(m["app"].Outputs))
 		require.Equal(t, []string{"type=docker,dest=out", "type=docker"}, m["app"].Outputs)
@@ -414,7 +414,7 @@ func TestLoadOverride(t *testing.T) {
 			target "bar" {
 			}`),
 		}
-		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"foo", "bar"}, []string{"*.load=true"}, nil, &EntitlementConf{})
+		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"foo", "bar"}, []string{"*.load=true"}, nil)
 		require.NoError(t, err)
 		require.Equal(t, 2, len(m))
 		require.Equal(t, 1, len(m["foo"].Outputs))
@@ -435,7 +435,7 @@ func TestLoadAndPushOverride(t *testing.T) {
 			target "bar" {
 			}`),
 		}
-		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"foo", "bar"}, []string{"*.load=true", "*.push=true"}, nil, &EntitlementConf{})
+		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"foo", "bar"}, []string{"*.load=true", "*.push=true"}, nil)
 		require.NoError(t, err)
 		require.Equal(t, 2, len(m))
 
@@ -456,7 +456,7 @@ func TestLoadAndPushOverride(t *testing.T) {
 		  		output = [ "type=registry" ]
 			}`),
 		}
-		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"foo"}, []string{"*.load=true", "*.push=true"}, nil, &EntitlementConf{})
+		m, _, err := ReadTargets(context.TODO(), []File{fp}, []string{"foo"}, []string{"*.load=true", "*.push=true"}, nil)
 		require.NoError(t, err)
 		require.Equal(t, 1, len(m))
 
@@ -512,7 +512,7 @@ services:
 
 	ctx := context.TODO()
 
-	m, g, err := ReadTargets(ctx, []File{fp, fp2, fp3}, []string{"default"}, nil, nil, &EntitlementConf{})
+	m, g, err := ReadTargets(ctx, []File{fp, fp2, fp3}, []string{"default"}, nil, nil)
 	require.NoError(t, err)
 
 	require.Equal(t, 3, len(m))
@@ -559,7 +559,7 @@ services:
 
 	ctx := context.TODO()
 
-	m, _, err := ReadTargets(ctx, []File{fp}, []string{"web.app"}, nil, nil, &EntitlementConf{})
+	m, _, err := ReadTargets(ctx, []File{fp}, []string{"web.app"}, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, 1, len(m))
 	_, ok := m["web_app"]
@@ -567,7 +567,7 @@ services:
 	require.Equal(t, "Dockerfile.webapp", *m["web_app"].Dockerfile)
 	require.Equal(t, ptrstr("1"), m["web_app"].Args["buildno"])
 
-	m, _, err = ReadTargets(ctx, []File{fp2}, []string{"web_app"}, nil, nil, &EntitlementConf{})
+	m, _, err = ReadTargets(ctx, []File{fp2}, []string{"web_app"}, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, 1, len(m))
 	_, ok = m["web_app"]
@@ -575,7 +575,7 @@ services:
 	require.Equal(t, "Dockerfile", *m["web_app"].Dockerfile)
 	require.Equal(t, ptrstr("12"), m["web_app"].Args["buildno2"])
 
-	m, g, err := ReadTargets(ctx, []File{fp, fp2}, []string{"default"}, nil, nil, &EntitlementConf{})
+	m, g, err := ReadTargets(ctx, []File{fp, fp2}, []string{"default"}, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, 1, len(m))
 	_, ok = m["web_app"]
@@ -600,7 +600,7 @@ func TestHCLContextCwdPrefix(t *testing.T) {
 			}`),
 	}
 	ctx := context.TODO()
-	m, g, err := ReadTargets(ctx, []File{fp}, []string{"app"}, nil, nil, &EntitlementConf{})
+	m, g, err := ReadTargets(ctx, []File{fp}, []string{"app"}, nil, nil)
 	require.NoError(t, err)
 
 	bo, err := TargetsToBuildOpt(m, &Input{})
@@ -631,7 +631,7 @@ func TestHCLDockerfileCwdPrefix(t *testing.T) {
 	cwd, err := os.Getwd()
 	require.NoError(t, err)
 
-	m, g, err := ReadTargets(ctx, []File{fp}, []string{"app"}, nil, nil, &EntitlementConf{})
+	m, g, err := ReadTargets(ctx, []File{fp}, []string{"app"}, nil, nil)
 	require.NoError(t, err)
 
 	bo, err := TargetsToBuildOpt(m, &Input{})
@@ -662,7 +662,7 @@ func TestOverrideMerge(t *testing.T) {
 		"app.platform=linux/arm",
 		"app.platform=linux/ppc64le",
 		"app.output=type=registry",
-	}, nil, &EntitlementConf{})
+	}, nil)
 	require.NoError(t, err)
 
 	require.Equal(t, 1, len(m))
@@ -697,7 +697,7 @@ func TestReadContexts(t *testing.T) {
 	}
 
 	ctx := context.TODO()
-	m, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, []string{}, nil, &EntitlementConf{})
+	m, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, []string{}, nil)
 	require.NoError(t, err)
 
 	require.Equal(t, 1, len(m))
@@ -713,7 +713,7 @@ func TestReadContexts(t *testing.T) {
 	require.Equal(t, "baz", ctxs["foo"].Path)
 	require.Equal(t, "def", ctxs["abc"].Path)
 
-	m, _, err = ReadTargets(ctx, []File{fp}, []string{"app"}, []string{"app.contexts.foo=bay", "base.contexts.ghi=jkl"}, nil, &EntitlementConf{})
+	m, _, err = ReadTargets(ctx, []File{fp}, []string{"app"}, []string{"app.contexts.foo=bay", "base.contexts.ghi=jkl"}, nil)
 	require.NoError(t, err)
 
 	require.Equal(t, 1, len(m))
@@ -731,7 +731,7 @@ func TestReadContexts(t *testing.T) {
 	require.Equal(t, "jkl", ctxs["ghi"].Path)
 
 	// test resetting base values
-	m, _, err = ReadTargets(ctx, []File{fp}, []string{"app"}, []string{"app.contexts.foo="}, nil, &EntitlementConf{})
+	m, _, err = ReadTargets(ctx, []File{fp}, []string{"app"}, []string{"app.contexts.foo="}, nil)
 	require.NoError(t, err)
 
 	require.Equal(t, 1, len(m))
@@ -766,7 +766,7 @@ func TestReadContextFromTargetUnknown(t *testing.T) {
 	}
 
 	ctx := context.TODO()
-	_, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, []string{}, nil, &EntitlementConf{})
+	_, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, []string{}, nil)
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "failed to find target bar")
 }
@@ -790,7 +790,7 @@ services:
 
 	ctx := context.TODO()
 
-	m, _, err := ReadTargets(ctx, []File{fp, fp2}, []string{"app1", "app2"}, nil, nil, &EntitlementConf{})
+	m, _, err := ReadTargets(ctx, []File{fp, fp2}, []string{"app1", "app2"}, nil, nil)
 	require.NoError(t, err)
 
 	require.Equal(t, 2, len(m))
@@ -828,7 +828,7 @@ func TestReadContextFromTargetChain(t *testing.T) {
 		`),
 	}
 
-	m, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, []string{}, nil, &EntitlementConf{})
+	m, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, []string{}, nil)
 	require.NoError(t, err)
 
 	require.Equal(t, 3, len(m))
@@ -867,7 +867,7 @@ func TestReadContextFromTargetInfiniteLoop(t *testing.T) {
 		}
 		`),
 	}
-	_, _, err := ReadTargets(ctx, []File{fp}, []string{"app", "mid"}, []string{}, nil, &EntitlementConf{})
+	_, _, err := ReadTargets(ctx, []File{fp}, []string{"app", "mid"}, []string{}, nil)
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "infinite loop from")
 }
@@ -889,7 +889,7 @@ func TestReadContextFromTargetMultiPlatform(t *testing.T) {
 		}
 		`),
 	}
-	_, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, []string{}, nil, &EntitlementConf{})
+	_, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, []string{}, nil)
 	require.NoError(t, err)
 }
 
@@ -910,7 +910,7 @@ func TestReadContextFromTargetInvalidPlatforms(t *testing.T) {
 		}
 		`),
 	}
-	_, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, []string{}, nil, &EntitlementConf{})
+	_, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, []string{}, nil)
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "defined for different platforms")
 }
@@ -926,7 +926,7 @@ target "default" {
   dockerfile = "test"
 }`)}
 
-	m, g, err := ReadTargets(ctx, []File{f}, []string{"default"}, nil, nil, &EntitlementConf{})
+	m, g, err := ReadTargets(ctx, []File{f}, []string{"default"}, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, 0, len(g))
 	require.Equal(t, 1, len(m))
@@ -944,10 +944,10 @@ target "image" {
   dockerfile = "test"
 }`)}
 
-	_, _, err := ReadTargets(ctx, []File{f}, []string{"default"}, nil, nil, &EntitlementConf{})
+	_, _, err := ReadTargets(ctx, []File{f}, []string{"default"}, nil, nil)
 	require.Error(t, err)
 
-	m, g, err := ReadTargets(ctx, []File{f}, []string{"image"}, nil, nil, &EntitlementConf{})
+	m, g, err := ReadTargets(ctx, []File{f}, []string{"image"}, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, 1, len(g))
 	require.Equal(t, []string{"image"}, g["default"].Targets)
@@ -969,7 +969,7 @@ target "image" {
   dockerfile = "test"
 }`)}
 
-	m, g, err := ReadTargets(ctx, []File{f}, []string{"foo"}, nil, nil, &EntitlementConf{})
+	m, g, err := ReadTargets(ctx, []File{f}, []string{"foo"}, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, 2, len(g))
 	require.Equal(t, []string{"foo"}, g["default"].Targets)
@@ -995,7 +995,7 @@ target "image" {
   dockerfile = "test"
 }`)}
 
-	m, g, err := ReadTargets(ctx, []File{f}, []string{"foo"}, nil, nil, &EntitlementConf{})
+	m, g, err := ReadTargets(ctx, []File{f}, []string{"foo"}, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, 2, len(g))
 	require.Equal(t, []string{"foo"}, g["default"].Targets)
@@ -1003,7 +1003,7 @@ target "image" {
 	require.Equal(t, 1, len(m))
 	require.Equal(t, "test", *m["image"].Dockerfile)
 
-	m, g, err = ReadTargets(ctx, []File{f}, []string{"foo", "foo"}, nil, nil, &EntitlementConf{})
+	m, g, err = ReadTargets(ctx, []File{f}, []string{"foo", "foo"}, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, 2, len(g))
 	require.Equal(t, []string{"foo"}, g["default"].Targets)
@@ -1083,7 +1083,7 @@ services:
 	 }
 	}`)}
 
-	m, g, err := ReadTargets(ctx, []File{fhcl}, []string{"default"}, nil, nil, &EntitlementConf{})
+	m, g, err := ReadTargets(ctx, []File{fhcl}, []string{"default"}, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, 1, len(g))
 	require.Equal(t, []string{"image"}, g["default"].Targets)
@@ -1091,7 +1091,7 @@ services:
 	require.Equal(t, 1, len(m["image"].Outputs))
 	require.Equal(t, "type=docker", m["image"].Outputs[0])
 
-	m, g, err = ReadTargets(ctx, []File{fhcl}, []string{"image-release"}, nil, nil, &EntitlementConf{})
+	m, g, err = ReadTargets(ctx, []File{fhcl}, []string{"image-release"}, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, 1, len(g))
 	require.Equal(t, []string{"image-release"}, g["default"].Targets)
@@ -1099,7 +1099,7 @@ services:
 	require.Equal(t, 1, len(m["image-release"].Outputs))
 	require.Equal(t, "type=image,push=true", m["image-release"].Outputs[0])
 
-	m, g, err = ReadTargets(ctx, []File{fhcl}, []string{"image", "image-release"}, nil, nil, &EntitlementConf{})
+	m, g, err = ReadTargets(ctx, []File{fhcl}, []string{"image", "image-release"}, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, 1, len(g))
 	require.Equal(t, []string{"image", "image-release"}, g["default"].Targets)
@@ -1108,21 +1108,21 @@ services:
 	require.Equal(t, 1, len(m["image-release"].Outputs))
 	require.Equal(t, "type=image,push=true", m["image-release"].Outputs[0])
 
-	m, g, err = ReadTargets(ctx, []File{fyml, fhcl}, []string{"default"}, nil, nil, &EntitlementConf{})
+	m, g, err = ReadTargets(ctx, []File{fyml, fhcl}, []string{"default"}, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, 1, len(g))
 	require.Equal(t, []string{"image"}, g["default"].Targets)
 	require.Equal(t, 1, len(m))
 	require.Equal(t, ".", *m["image"].Context)
 
-	m, g, err = ReadTargets(ctx, []File{fjson}, []string{"default"}, nil, nil, &EntitlementConf{})
+	m, g, err = ReadTargets(ctx, []File{fjson}, []string{"default"}, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, 1, len(g))
 	require.Equal(t, []string{"image"}, g["default"].Targets)
 	require.Equal(t, 1, len(m))
 	require.Equal(t, ".", *m["image"].Context)
 
-	m, g, err = ReadTargets(ctx, []File{fyml}, []string{"default"}, nil, nil, &EntitlementConf{})
+	m, g, err = ReadTargets(ctx, []File{fyml}, []string{"default"}, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, 1, len(g))
 	sort.Strings(g["default"].Targets)
@@ -1131,7 +1131,7 @@ services:
 	require.Equal(t, "./Dockerfile", *m["addon"].Dockerfile)
 	require.Equal(t, "./aws.Dockerfile", *m["aws"].Dockerfile)
 
-	m, g, err = ReadTargets(ctx, []File{fyml, fhcl}, []string{"addon", "aws"}, nil, nil, &EntitlementConf{})
+	m, g, err = ReadTargets(ctx, []File{fyml, fhcl}, []string{"addon", "aws"}, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, 1, len(g))
 	sort.Strings(g["default"].Targets)
@@ -1140,7 +1140,7 @@ services:
 	require.Equal(t, "./Dockerfile", *m["addon"].Dockerfile)
 	require.Equal(t, "./aws.Dockerfile", *m["aws"].Dockerfile)
 
-	m, g, err = ReadTargets(ctx, []File{fyml, fhcl}, []string{"addon", "aws", "image"}, nil, nil, &EntitlementConf{})
+	m, g, err = ReadTargets(ctx, []File{fyml, fhcl}, []string{"addon", "aws", "image"}, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, 1, len(g))
 	sort.Strings(g["default"].Targets)
@@ -1168,7 +1168,7 @@ target "image" {
   output = ["type=docker"]
 }`)}
 
-	m, g, err := ReadTargets(ctx, []File{f}, []string{"foo"}, nil, nil, &EntitlementConf{})
+	m, g, err := ReadTargets(ctx, []File{f}, []string{"foo"}, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, 2, len(g))
 	require.Equal(t, []string{"foo"}, g["default"].Targets)
@@ -1176,7 +1176,7 @@ target "image" {
 	require.Equal(t, 1, len(m))
 	require.Equal(t, "bar", *m["foo"].Dockerfile)
 
-	m, g, err = ReadTargets(ctx, []File{f}, []string{"foo", "foo"}, nil, nil, &EntitlementConf{})
+	m, g, err = ReadTargets(ctx, []File{f}, []string{"foo", "foo"}, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, 2, len(g))
 	require.Equal(t, []string{"foo"}, g["default"].Targets)
@@ -1202,7 +1202,7 @@ target "image" {
   output = ["type=docker"]
 }`)}
 
-	m, g, err := ReadTargets(ctx, []File{f}, []string{"foo"}, nil, nil, &EntitlementConf{})
+	m, g, err := ReadTargets(ctx, []File{f}, []string{"foo"}, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, 2, len(g))
 	require.Equal(t, []string{"foo"}, g["default"].Targets)
@@ -1211,7 +1211,7 @@ target "image" {
 	require.Equal(t, "bar", *m["foo"].Dockerfile)
 	require.Equal(t, "type=docker", m["image"].Outputs[0])
 
-	m, g, err = ReadTargets(ctx, []File{f}, []string{"foo", "image"}, nil, nil, &EntitlementConf{})
+	m, g, err = ReadTargets(ctx, []File{f}, []string{"foo", "image"}, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, 2, len(g))
 	require.Equal(t, []string{"foo", "image"}, g["default"].Targets)
@@ -1273,7 +1273,7 @@ target "d" {
 	for _, tt := range cases {
 		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
-			m, g, err := ReadTargets(ctx, []File{f}, []string{"d"}, tt.overrides, nil, &EntitlementConf{})
+			m, g, err := ReadTargets(ctx, []File{f}, []string{"d"}, tt.overrides, nil)
 			require.NoError(t, err)
 			require.Equal(t, 1, len(g))
 			require.Equal(t, []string{"d"}, g["default"].Targets)
@@ -1345,7 +1345,7 @@ group "default" {
 	for _, tt := range cases {
 		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
-			m, g, err := ReadTargets(ctx, []File{f}, []string{"default"}, tt.overrides, nil, &EntitlementConf{})
+			m, g, err := ReadTargets(ctx, []File{f}, []string{"default"}, tt.overrides, nil)
 			require.NoError(t, err)
 			require.Equal(t, 1, len(g))
 			require.Equal(t, []string{"child1", "child2"}, g["default"].Targets)
@@ -1403,7 +1403,7 @@ func TestTargetName(t *testing.T) {
 			_, _, err := ReadTargets(ctx, []File{{
 				Name: "docker-bake.hcl",
 				Data: []byte(`target "` + tt.target + `" {}`),
-			}}, []string{tt.target}, nil, nil, &EntitlementConf{})
+			}}, []string{tt.target}, nil, nil)
 			if tt.wantErr {
 				require.Error(t, err)
 			} else {
@@ -1490,7 +1490,7 @@ target "f" {
 	for _, tt := range cases {
 		tt := tt
 		t.Run(strings.Join(tt.names, "+"), func(t *testing.T) {
-			m, g, err := ReadTargets(ctx, []File{f}, tt.names, nil, nil, &EntitlementConf{})
+			m, g, err := ReadTargets(ctx, []File{f}, tt.names, nil, nil)
 			require.NoError(t, err)
 
 			var gnames []string
@@ -1567,7 +1567,7 @@ func TestHCLNullVars(t *testing.T) {
 	}
 
 	ctx := context.TODO()
-	m, _, err := ReadTargets(ctx, []File{fp}, []string{"default"}, nil, nil, &EntitlementConf{})
+	m, _, err := ReadTargets(ctx, []File{fp}, []string{"default"}, nil, nil)
 	require.NoError(t, err)
 
 	require.Equal(t, 1, len(m))
@@ -1602,7 +1602,7 @@ func TestJSONNullVars(t *testing.T) {
 	}
 
 	ctx := context.TODO()
-	m, _, err := ReadTargets(ctx, []File{fp}, []string{"default"}, nil, nil, &EntitlementConf{})
+	m, _, err := ReadTargets(ctx, []File{fp}, []string{"default"}, nil, nil)
 	require.NoError(t, err)
 
 	require.Equal(t, 1, len(m))
@@ -1677,7 +1677,7 @@ func TestAttestDuplicates(t *testing.T) {
 	}
 	ctx := context.TODO()
 
-	m, _, err := ReadTargets(ctx, []File{fp}, []string{"default"}, nil, nil, &EntitlementConf{})
+	m, _, err := ReadTargets(ctx, []File{fp}, []string{"default"}, nil, nil)
 	require.Equal(t, []string{"type=sbom,foo=bar", "type=provenance,mode=max"}, m["default"].Attest)
 	require.NoError(t, err)
 
@@ -1688,7 +1688,7 @@ func TestAttestDuplicates(t *testing.T) {
 		"provenance": ptrstr("type=provenance,mode=max"),
 	}, opts["default"].Attests)
 
-	m, _, err = ReadTargets(ctx, []File{fp}, []string{"default"}, []string{"*.attest=type=sbom,disabled=true"}, nil, &EntitlementConf{})
+	m, _, err = ReadTargets(ctx, []File{fp}, []string{"default"}, []string{"*.attest=type=sbom,disabled=true"}, nil)
 	require.Equal(t, []string{"type=sbom,disabled=true", "type=provenance,mode=max"}, m["default"].Attest)
 	require.NoError(t, err)
 
@@ -1710,7 +1710,7 @@ func TestAnnotations(t *testing.T) {
 			}`),
 	}
 	ctx := context.TODO()
-	m, g, err := ReadTargets(ctx, []File{fp}, []string{"app"}, nil, nil, &EntitlementConf{})
+	m, g, err := ReadTargets(ctx, []File{fp}, []string{"app"}, nil, nil)
 	require.NoError(t, err)
 
 	bo, err := TargetsToBuildOpt(m, &Input{})
@@ -1737,7 +1737,7 @@ func TestHCLEntitlements(t *testing.T) {
 			}`),
 	}
 	ctx := context.TODO()
-	m, g, err := ReadTargets(ctx, []File{fp}, []string{"app"}, nil, nil, &EntitlementConf{})
+	m, g, err := ReadTargets(ctx, []File{fp}, []string{"app"}, nil, nil)
 	require.NoError(t, err)
 
 	bo, err := TargetsToBuildOpt(m, &Input{})
@@ -1777,7 +1777,7 @@ func TestEntitlementsForNetHostCompose(t *testing.T) {
 	}
 
 	ctx := context.TODO()
-	m, g, err := ReadTargets(ctx, []File{fp, fp2}, []string{"app"}, nil, nil, &EntitlementConf{})
+	m, g, err := ReadTargets(ctx, []File{fp, fp2}, []string{"app"}, nil, nil)
 	require.NoError(t, err)
 
 	bo, err := TargetsToBuildOpt(m, &Input{})
@@ -1808,7 +1808,7 @@ func TestEntitlementsForNetHost(t *testing.T) {
 	}
 
 	ctx := context.TODO()
-	m, g, err := ReadTargets(ctx, []File{fp}, []string{"app"}, nil, nil, &EntitlementConf{})
+	m, g, err := ReadTargets(ctx, []File{fp}, []string{"app"}, nil, nil)
 	require.NoError(t, err)
 
 	bo, err := TargetsToBuildOpt(m, &Input{})
@@ -1839,7 +1839,7 @@ func TestNetNone(t *testing.T) {
 	}
 
 	ctx := context.TODO()
-	m, g, err := ReadTargets(ctx, []File{fp}, []string{"app"}, nil, nil, &EntitlementConf{})
+	m, g, err := ReadTargets(ctx, []File{fp}, []string{"app"}, nil, nil)
 	require.NoError(t, err)
 
 	bo, err := TargetsToBuildOpt(m, &Input{})
@@ -1856,192 +1856,3 @@ func TestNetNone(t *testing.T) {
 	require.Len(t, bo["app"].Allow, 0)
 	require.Equal(t, "none", bo["app"].NetworkMode)
 }
-
-func TestVariableValidation(t *testing.T) {
-	fp := File{
-		Name: "docker-bake.hcl",
-		Data: []byte(`
-variable "FOO" {
-  validation {
-    condition = FOO != ""
-    error_message = "FOO is required."
-  }
-}
-target "app" {
-  args = {
-    FOO = FOO
-  }
-}
-`),
-	}
-
-	ctx := context.TODO()
-
-	t.Run("Valid", func(t *testing.T) {
-		t.Setenv("FOO", "bar")
-		_, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, nil, nil, &EntitlementConf{})
-		require.NoError(t, err)
-	})
-
-	t.Run("Invalid", func(t *testing.T) {
-		_, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, nil, nil, &EntitlementConf{})
-		require.Error(t, err)
-		require.Contains(t, err.Error(), "FOO is required.")
-	})
-}
-
-func TestVariableValidationMulti(t *testing.T) {
-	fp := File{
-		Name: "docker-bake.hcl",
-		Data: []byte(`
-variable "FOO" {
-  validation {
-    condition = FOO != ""
-    error_message = "FOO is required."
-  }
-  validation {
-    condition = strlen(FOO) > 4
-    error_message = "FOO must be longer than 4 characters."
-  }
-}
-target "app" {
-  args = {
-    FOO = FOO
-  }
-}
-`),
-	}
-
-	ctx := context.TODO()
-
-	t.Run("Valid", func(t *testing.T) {
-		t.Setenv("FOO", "barbar")
-		_, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, nil, nil, &EntitlementConf{})
-		require.NoError(t, err)
-	})
-
-	t.Run("InvalidLength", func(t *testing.T) {
-		t.Setenv("FOO", "bar")
-		_, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, nil, nil, &EntitlementConf{})
-		require.Error(t, err)
-		require.Contains(t, err.Error(), "FOO must be longer than 4 characters.")
-	})
-
-	t.Run("InvalidEmpty", func(t *testing.T) {
-		_, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, nil, nil, &EntitlementConf{})
-		require.Error(t, err)
-		require.Contains(t, err.Error(), "FOO is required.")
-	})
-}
-
-func TestVariableValidationWithDeps(t *testing.T) {
-	fp := File{
-		Name: "docker-bake.hcl",
-		Data: []byte(`
-variable "FOO" {}
-variable "BAR" {
-  validation {
-    condition = FOO != ""
-    error_message = "BAR requires FOO to be set."
-  }
-}
-target "app" {
-  args = {
-    BAR = BAR
-  }
-}
-`),
-	}
-
-	ctx := context.TODO()
-
-	t.Run("Valid", func(t *testing.T) {
-		t.Setenv("FOO", "bar")
-		_, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, nil, nil, &EntitlementConf{})
-		require.NoError(t, err)
-	})
-
-	t.Run("SetBar", func(t *testing.T) {
-		t.Setenv("FOO", "bar")
-		t.Setenv("BAR", "baz")
-		_, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, nil, nil, &EntitlementConf{})
-		require.NoError(t, err)
-	})
-
-	t.Run("Invalid", func(t *testing.T) {
-		_, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, nil, nil, &EntitlementConf{})
-		require.Error(t, err)
-		require.Contains(t, err.Error(), "BAR requires FOO to be set.")
-	})
-}
-
-func TestVariableValidationTyped(t *testing.T) {
-	fp := File{
-		Name: "docker-bake.hcl",
-		Data: []byte(`
-variable "FOO" {
-  default = 0
-  validation {
-    condition = FOO > 5
-    error_message = "FOO must be greater than 5."
-  }
-}
-target "app" {
-  args = {
-    FOO = FOO
-  }
-}
-`),
-	}
-
-	ctx := context.TODO()
-
-	t.Run("Valid", func(t *testing.T) {
-		t.Setenv("FOO", "10")
-		_, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, nil, nil, &EntitlementConf{})
-		require.NoError(t, err)
-	})
-
-	t.Run("Invalid", func(t *testing.T) {
-		_, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, nil, nil, &EntitlementConf{})
-		require.Error(t, err)
-		require.Contains(t, err.Error(), "FOO must be greater than 5.")
-	})
-}
-
-// https://github.com/docker/buildx/issues/2822
-func TestVariableEmpty(t *testing.T) {
-	fp := File{
-		Name: "docker-bake.hcl",
-		Data: []byte(`
-variable "FOO" {
-  default = ""
-}
-target "app" {
-  output = [FOO]
-}
-`),
-	}
-
-	ctx := context.TODO()
-
-	_, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, nil, nil, &EntitlementConf{})
-	require.NoError(t, err)
-}
-
-// https://github.com/docker/buildx/issues/2858
-func TestOverrideEmpty(t *testing.T) {
-	fp := File{
-		Name: "docker-bake.hcl",
-		Data: []byte(`
-target "app" {
-  output = ["./bin"]
-}
-`),
-	}
-
-	ctx := context.TODO()
-
-	_, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, []string{"app.output="}, nil, &EntitlementConf{})
-	require.NoError(t, err)
-}

bake/compose.go

@@ -102,12 +102,6 @@ func ParseCompose(cfgs []composetypes.ConfigFile, envs map[string]string) (*Conf
 				shmSize = &shmSizeStr
 			}
 
-			var networkModeP *string
-			if s.Build.Network != "" {
-				networkMode := s.Build.Network
-				networkModeP = &networkMode
-			}
-
 			var ulimits []string
 			if s.Build.Ulimits != nil {
 				for n, u := range s.Build.Ulimits {
@@ -160,7 +154,7 @@ func ParseCompose(cfgs []composetypes.ConfigFile, envs map[string]string) (*Conf
 				})),
 				CacheFrom:   s.Build.CacheFrom,
 				CacheTo:     s.Build.CacheTo,
-				NetworkMode: networkModeP,
+				NetworkMode: &s.Build.Network,
 				SSH:         ssh,
 				Secrets:     secrets,
 				ShmSize:     shmSize,
@@ -179,6 +173,7 @@ func ParseCompose(cfgs []composetypes.ConfigFile, envs map[string]string) (*Conf
 			c.Targets = append(c.Targets, t)
 		}
 		c.Groups = append(c.Groups, g)
+
 	}
 
 	return &c, nil

bake/entitlements.go

@@ -2,24 +2,17 @@ package bake
 
 import (
 	"bufio"
-	"cmp"
 	"context"
 	"fmt"
 	"io"
-	"io/fs"
 	"os"
-	"path/filepath"
 	"slices"
-	"strconv"
 	"strings"
-	"syscall"
 
 	"github.com/containerd/console"
 	"github.com/docker/buildx/build"
-	"github.com/docker/buildx/util/osutil"
 	"github.com/moby/buildkit/util/entitlements"
 	"github.com/pkg/errors"
-	"github.com/sirupsen/logrus"
 )
 
 type EntitlementKey string
@@ -74,8 +67,10 @@ func ParseEntitlements(in []string) (EntitlementConf, error) {
 				conf.ImagePush = append(conf.ImagePush, v)
 				conf.ImageLoad = append(conf.ImageLoad, v)
 			default:
-				return conf, errors.Errorf("unknown entitlement key %q", k)
+				return conf, errors.Errorf("uknown entitlement key %q", k)
 			}
+
+			// TODO: dedupe slices and parent paths
 		}
 	}
 	return conf, nil
@@ -106,64 +101,10 @@ func (c EntitlementConf) check(bo build.Options, expected *EntitlementConf) erro
 			}
 		}
 	}
-
-	rwPaths := map[string]struct{}{}
-	roPaths := map[string]struct{}{}
-
-	for _, p := range collectLocalPaths(bo.Inputs) {
-		roPaths[p] = struct{}{}
-	}
-
-	for _, p := range bo.ExportsLocalPathsTemporary {
-		rwPaths[p] = struct{}{}
-	}
-
-	for _, ce := range bo.CacheTo {
-		if ce.Type == "local" {
-			if dest, ok := ce.Attrs["dest"]; ok {
-				rwPaths[dest] = struct{}{}
-			}
-		}
-	}
-
-	for _, ci := range bo.CacheFrom {
-		if ci.Type == "local" {
-			if src, ok := ci.Attrs["src"]; ok {
-				roPaths[src] = struct{}{}
-			}
-		}
-	}
-
-	for _, secret := range bo.SecretSpecs {
-		if secret.FilePath != "" {
-			roPaths[secret.FilePath] = struct{}{}
-		}
-	}
-
-	for _, ssh := range bo.SSHSpecs {
-		for _, p := range ssh.Paths {
-			roPaths[p] = struct{}{}
-		}
-		if len(ssh.Paths) == 0 {
-			expected.SSH = true
-		}
-	}
-
-	var err error
-	expected.FSRead, err = findMissingPaths(c.FSRead, roPaths)
-	if err != nil {
-		return err
-	}
-
-	expected.FSWrite, err = findMissingPaths(c.FSWrite, rwPaths)
-	if err != nil {
-		return err
-	}
-
 	return nil
 }
 
-func (c EntitlementConf) Prompt(ctx context.Context, isRemote bool, out io.Writer) error {
+func (c EntitlementConf) Prompt(ctx context.Context, out io.Writer) error {
 	var term bool
 	if _, err := console.ConsoleFromFile(os.Stdin); err == nil {
 		term = true
@@ -172,78 +113,32 @@ func (c EntitlementConf) Prompt(ctx context.Context, isRemote bool, out io.Write
 	var msgs []string
 	var flags []string
 
-	// these warnings are currently disabled to give users time to update
-	var msgsFS []string
-	var flagsFS []string
-
 	if c.NetworkHost {
 		msgs = append(msgs, " - Running build containers that can access host network")
-		flags = append(flags, string(EntitlementKeyNetworkHost))
+		flags = append(flags, "network.host")
 	}
 	if c.SecurityInsecure {
 		msgs = append(msgs, " - Running privileged containers that can make system changes")
-		flags = append(flags, string(EntitlementKeySecurityInsecure))
+		flags = append(flags, "security.insecure")
 	}
 
-	if c.SSH {
+	if len(msgs) == 0 {
-		msgsFS = append(msgsFS, " - Forwarding default SSH agent socket")
-		flagsFS = append(flagsFS, string(EntitlementKeySSH))
-	}
-
-	roPaths, rwPaths, commonPaths := groupSamePaths(c.FSRead, c.FSWrite)
-	wd, err := os.Getwd()
-	if err != nil {
-		return errors.Wrap(err, "failed to get current working directory")
-	}
-	wd, err = filepath.EvalSymlinks(wd)
-	if err != nil {
-		return errors.Wrap(err, "failed to evaluate working directory")
-	}
-	roPaths = toRelativePaths(roPaths, wd)
-	rwPaths = toRelativePaths(rwPaths, wd)
-	commonPaths = toRelativePaths(commonPaths, wd)
-
-	if len(commonPaths) > 0 {
-		for _, p := range commonPaths {
-			msgsFS = append(msgsFS, fmt.Sprintf(" - Read and write access to path %s", p))
-			flagsFS = append(flagsFS, string(EntitlementKeyFS)+"="+p)
-		}
-	}
-
-	if len(roPaths) > 0 {
-		for _, p := range roPaths {
-			msgsFS = append(msgsFS, fmt.Sprintf(" - Read access to path %s", p))
-			flagsFS = append(flagsFS, string(EntitlementKeyFSRead)+"="+p)
-		}
-	}
-
-	if len(rwPaths) > 0 {
-		for _, p := range rwPaths {
-			msgsFS = append(msgsFS, fmt.Sprintf(" - Write access to path %s", p))
-			flagsFS = append(flagsFS, string(EntitlementKeyFSWrite)+"="+p)
-		}
-	}
-
-	if len(msgs) == 0 && len(msgsFS) == 0 {
 		return nil
 	}
 
 	fmt.Fprintf(out, "Your build is requesting privileges for following possibly insecure capabilities:\n\n")
-	for _, m := range slices.Concat(msgs, msgsFS) {
+	for _, m := range msgs {
 		fmt.Fprintf(out, "%s\n", m)
 	}
 
 	for i, f := range flags {
 		flags[i] = "--allow=" + f
 	}
-	for i, f := range flagsFS {
-		flagsFS[i] = "--allow=" + f
-	}
 
 	if term {
-		fmt.Fprintf(out, "\nIn order to not see this message in the future pass %q to grant requested privileges.\n", strings.Join(slices.Concat(flags, flagsFS), " "))
+		fmt.Fprintf(out, "\nIn order to not see this message in the future pass %q to grant requested privileges.\n", strings.Join(flags, " "))
 	} else {
-		fmt.Fprintf(out, "\nPass %q to grant requested privileges.\n", strings.Join(slices.Concat(flags, flagsFS), " "))
+		fmt.Fprintf(out, "\nPass %q to grant requested privileges.\n", strings.Join(flags, " "))
 	}
 
 	args := append([]string(nil), os.Args...)
@@ -254,35 +149,7 @@ func (c EntitlementConf) Prompt(ctx context.Context, isRemote bool, out io.Write
 
 	if idx != -1 {
 		fmt.Fprintf(out, "\nYour full command with requested privileges:\n\n")
-		fmt.Fprintf(out, "%s %s %s\n\n", strings.Join(args[:idx+1], " "), strings.Join(slices.Concat(flags, flagsFS), " "), strings.Join(args[idx+1:], " "))
+		fmt.Fprintf(out, "%s %s %s\n\n", strings.Join(args[:idx+1], " "), strings.Join(flags, " "), strings.Join(args[idx+1:], " "))
-	}
-
-	fsEntitlementsEnabled := false
-	if isRemote {
-		if v, ok := os.LookupEnv("BAKE_ALLOW_REMOTE_FS_ACCESS"); ok {
-			vv, err := strconv.ParseBool(v)
-			if err != nil {
-				return errors.Wrapf(err, "failed to parse BAKE_ALLOW_REMOTE_FS_ACCESS value %q", v)
-			}
-			fsEntitlementsEnabled = !vv
-		} else {
-			fsEntitlementsEnabled = true
-		}
-	}
-	v, fsEntitlementsSet := os.LookupEnv("BUILDX_BAKE_ENTITLEMENTS_FS")
-	if fsEntitlementsSet {
-		vv, err := strconv.ParseBool(v)
-		if err != nil {
-			return errors.Wrapf(err, "failed to parse BUILDX_BAKE_ENTITLEMENTS_FS value %q", v)
-		}
-		fsEntitlementsEnabled = vv
-	}
-
-	if !fsEntitlementsEnabled && len(msgs) == 0 {
-		if !fsEntitlementsSet {
-			fmt.Fprintf(out, "This warning will become an error in a future release. To enable filesystem entitlements checks at the moment, set BUILDX_BAKE_ENTITLEMENTS_FS=1 .\n\n")
-		}
-		return nil
 	}
 
 	if term {
@@ -306,296 +173,3 @@ func (c EntitlementConf) Prompt(ctx context.Context, isRemote bool, out io.Write
 
 	return errors.Errorf("additional privileges requested")
 }
-
-func isParentOrEqualPath(p, parent string) bool {
-	if p == parent || parent == "/" {
-		return true
-	}
-	if strings.HasPrefix(p, filepath.Clean(parent+string(filepath.Separator))) {
-		return true
-	}
-	return false
-}
-
-func findMissingPaths(set []string, paths map[string]struct{}) ([]string, error) {
-	set, allowAny, err := evaluatePaths(set)
-	if err != nil {
-		return nil, err
-	} else if allowAny {
-		return nil, nil
-	}
-
-	paths, err = evaluateToExistingPaths(paths)
-	if err != nil {
-		return nil, err
-	}
-	paths, err = dedupPaths(paths)
-	if err != nil {
-		return nil, err
-	}
-
-	out := make([]string, 0, len(paths))
-loop0:
-	for p := range paths {
-		for _, c := range set {
-			if isParentOrEqualPath(p, c) {
-				continue loop0
-			}
-		}
-		out = append(out, p)
-	}
-	if len(out) == 0 {
-		return nil, nil
-	}
-
-	slices.Sort(out)
-
-	return out, nil
-}
-
-func dedupPaths(in map[string]struct{}) (map[string]struct{}, error) {
-	arr := make([]string, 0, len(in))
-	for p := range in {
-		arr = append(arr, filepath.Clean(p))
-	}
-
-	slices.SortFunc(arr, func(a, b string) int {
-		return cmp.Compare(len(a), len(b))
-	})
-
-	m := make(map[string]struct{}, len(arr))
-loop0:
-	for _, p := range arr {
-		for parent := range m {
-			if strings.HasPrefix(p, parent+string(filepath.Separator)) {
-				continue loop0
-			}
-		}
-		m[p] = struct{}{}
-	}
-	return m, nil
-}
-
-func toRelativePaths(in []string, wd string) []string {
-	out := make([]string, 0, len(in))
-	for _, p := range in {
-		rel, err := filepath.Rel(wd, p)
-		if err == nil {
-			// allow up to one level of ".." in the path
-			if !strings.HasPrefix(rel, ".."+string(filepath.Separator)+"..") {
-				out = append(out, rel)
-				continue
-			}
-		}
-		out = append(out, p)
-	}
-	return out
-}
-
-func groupSamePaths(in1, in2 []string) ([]string, []string, []string) {
-	if in1 == nil || in2 == nil {
-		return in1, in2, nil
-	}
-
-	slices.Sort(in1)
-	slices.Sort(in2)
-
-	common := []string{}
-	i, j := 0, 0
-
-	for i < len(in1) && j < len(in2) {
-		switch {
-		case in1[i] == in2[j]:
-			common = append(common, in1[i])
-			i++
-			j++
-		case in1[i] < in2[j]:
-			i++
-		default:
-			j++
-		}
-	}
-
-	in1 = removeCommonPaths(in1, common)
-	in2 = removeCommonPaths(in2, common)
-
-	return in1, in2, common
-}
-
-func removeCommonPaths(in, common []string) []string {
-	filtered := make([]string, 0, len(in))
-	commonIndex := 0
-	for _, path := range in {
-		if commonIndex < len(common) && path == common[commonIndex] {
-			commonIndex++
-			continue
-		}
-		filtered = append(filtered, path)
-	}
-	return filtered
-}
-
-func evaluatePaths(in []string) ([]string, bool, error) {
-	out := make([]string, 0, len(in))
-	allowAny := false
-	for _, p := range in {
-		if p == "*" {
-			allowAny = true
-			continue
-		}
-		v, err := filepath.Abs(p)
-		if err != nil {
-			logrus.Warnf("failed to evaluate entitlement path %q: %v", p, err)
-			continue
-		}
-		v, rest, err := evaluateToExistingPath(v)
-		if err != nil {
-			return nil, false, errors.Wrapf(err, "failed to evaluate path %q", p)
-		}
-		v, err = osutil.GetLongPathName(v)
-		if err != nil {
-			return nil, false, errors.Wrapf(err, "failed to evaluate path %q", p)
-		}
-		if rest != "" {
-			v = filepath.Join(v, rest)
-		}
-		out = append(out, v)
-	}
-	return out, allowAny, nil
-}
-
-func evaluateToExistingPaths(in map[string]struct{}) (map[string]struct{}, error) {
-	m := make(map[string]struct{}, len(in))
-	for p := range in {
-		v, _, err := evaluateToExistingPath(p)
-		if err != nil {
-			return nil, errors.Wrapf(err, "failed to evaluate path %q", p)
-		}
-		v, err = osutil.GetLongPathName(v)
-		if err != nil {
-			return nil, errors.Wrapf(err, "failed to evaluate path %q", p)
-		}
-		m[v] = struct{}{}
-	}
-	return m, nil
-}
-
-func evaluateToExistingPath(in string) (string, string, error) {
-	in, err := filepath.Abs(in)
-	if err != nil {
-		return "", "", err
-	}
-
-	volLen := volumeNameLen(in)
-	pathSeparator := string(os.PathSeparator)
-
-	if volLen < len(in) && os.IsPathSeparator(in[volLen]) {
-		volLen++
-	}
-	vol := in[:volLen]
-	dest := vol
-	linksWalked := 0
-	var end int
-	for start := volLen; start < len(in); start = end {
-		for start < len(in) && os.IsPathSeparator(in[start]) {
-			start++
-		}
-		end = start
-		for end < len(in) && !os.IsPathSeparator(in[end]) {
-			end++
-		}
-
-		if end == start {
-			break
-		} else if in[start:end] == "." {
-			continue
-		} else if in[start:end] == ".." {
-			var r int
-			for r = len(dest) - 1; r >= volLen; r-- {
-				if os.IsPathSeparator(dest[r]) {
-					break
-				}
-			}
-			if r < volLen || dest[r+1:] == ".." {
-				if len(dest) > volLen {
-					dest += pathSeparator
-				}
-				dest += ".."
-			} else {
-				dest = dest[:r]
-			}
-			continue
-		}
-
-		if len(dest) > volumeNameLen(dest) && !os.IsPathSeparator(dest[len(dest)-1]) {
-			dest += pathSeparator
-		}
-		dest += in[start:end]
-
-		fi, err := os.Lstat(dest)
-		if err != nil {
-			// If the component doesn't exist, return the last valid path
-			if os.IsNotExist(err) {
-				for r := len(dest) - 1; r >= volLen; r-- {
-					if os.IsPathSeparator(dest[r]) {
-						return dest[:r], in[start:], nil
-					}
-				}
-				return vol, in[start:], nil
-			}
-			return "", "", err
-		}
-
-		if fi.Mode()&fs.ModeSymlink == 0 {
-			if !fi.Mode().IsDir() && end < len(in) {
-				return "", "", syscall.ENOTDIR
-			}
-			continue
-		}
-
-		linksWalked++
-		if linksWalked > 255 {
-			return "", "", errors.New("too many symlinks")
-		}
-
-		link, err := os.Readlink(dest)
-		if err != nil {
-			return "", "", err
-		}
-
-		in = link + in[end:]
-
-		v := volumeNameLen(link)
-		if v > 0 {
-			if v < len(link) && os.IsPathSeparator(link[v]) {
-				v++
-			}
-			vol = link[:v]
-			dest = vol
-			end = len(vol)
-		} else if len(link) > 0 && os.IsPathSeparator(link[0]) {
-			dest = link[:1]
-			end = 1
-			vol = link[:1]
-			volLen = 1
-		} else {
-			var r int
-			for r = len(dest) - 1; r >= volLen; r-- {
-				if os.IsPathSeparator(dest[r]) {
-					break
-				}
-			}
-			if r < volLen {
-				dest = vol
-			} else {
-				dest = dest[:r]
-			}
-			end = 0
-		}
-	}
-	return filepath.Clean(dest), "", nil
-}
-
-func volumeNameLen(s string) int {
-	return len(filepath.VolumeName(s))
-}

bake/entitlements_test.go

@@ -1,486 +0,0 @@
-package bake
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"slices"
-	"testing"
-
-	"github.com/docker/buildx/build"
-	"github.com/docker/buildx/controller/pb"
-	"github.com/docker/buildx/util/osutil"
-	"github.com/moby/buildkit/client/llb"
-	"github.com/moby/buildkit/util/entitlements"
-	"github.com/stretchr/testify/require"
-)
-
-func TestEvaluateToExistingPath(t *testing.T) {
-	tempDir, err := osutil.GetLongPathName(t.TempDir())
-	require.NoError(t, err)
-
-	// Setup temporary directory structure for testing
-	existingFile := filepath.Join(tempDir, "existing_file")
-	require.NoError(t, os.WriteFile(existingFile, []byte("test"), 0644))
-
-	existingDir := filepath.Join(tempDir, "existing_dir")
-	require.NoError(t, os.Mkdir(existingDir, 0755))
-
-	symlinkToFile := filepath.Join(tempDir, "symlink_to_file")
-	require.NoError(t, os.Symlink(existingFile, symlinkToFile))
-
-	symlinkToDir := filepath.Join(tempDir, "symlink_to_dir")
-	require.NoError(t, os.Symlink(existingDir, symlinkToDir))
-
-	nonexistentPath := filepath.Join(tempDir, "nonexistent", "path", "file.txt")
-
-	tests := []struct {
-		name      string
-		input     string
-		expected  string
-		expectErr bool
-	}{
-		{
-			name:      "Existing file",
-			input:     existingFile,
-			expected:  existingFile,
-			expectErr: false,
-		},
-		{
-			name:      "Existing directory",
-			input:     existingDir,
-			expected:  existingDir,
-			expectErr: false,
-		},
-		{
-			name:      "Symlink to file",
-			input:     symlinkToFile,
-			expected:  existingFile,
-			expectErr: false,
-		},
-		{
-			name:      "Symlink to directory",
-			input:     symlinkToDir,
-			expected:  existingDir,
-			expectErr: false,
-		},
-		{
-			name:      "Non-existent path",
-			input:     nonexistentPath,
-			expected:  tempDir,
-			expectErr: false,
-		},
-		{
-			name:      "Non-existent intermediate path",
-			input:     filepath.Join(tempDir, "nonexistent", "file.txt"),
-			expected:  tempDir,
-			expectErr: false,
-		},
-		{
-			name:  "Root path",
-			input: "/",
-			expected: func() string {
-				root, _ := filepath.Abs("/")
-				return root
-			}(),
-			expectErr: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result, _, err := evaluateToExistingPath(tt.input)
-
-			if tt.expectErr {
-				require.Error(t, err)
-			} else {
-				require.NoError(t, err)
-				require.Equal(t, tt.expected, result)
-			}
-		})
-	}
-}
-
-func TestDedupePaths(t *testing.T) {
-	wd := osutil.GetWd()
-	tcases := []struct {
-		in  map[string]struct{}
-		out map[string]struct{}
-	}{
-		{
-			in: map[string]struct{}{
-				"/a/b/c": {},
-				"/a/b/d": {},
-				"/a/b/e": {},
-			},
-			out: map[string]struct{}{
-				"/a/b/c": {},
-				"/a/b/d": {},
-				"/a/b/e": {},
-			},
-		},
-		{
-			in: map[string]struct{}{
-				"/a/b/c":      {},
-				"/a/b/c/d":    {},
-				"/a/b/c/d/e":  {},
-				"/a/b/../b/c": {},
-			},
-			out: map[string]struct{}{
-				"/a/b/c": {},
-			},
-		},
-		{
-			in: map[string]struct{}{
-				filepath.Join(wd, "a/b/c"):    {},
-				filepath.Join(wd, "../aa"):    {},
-				filepath.Join(wd, "a/b"):      {},
-				filepath.Join(wd, "a/b/d"):    {},
-				filepath.Join(wd, "../aa/b"):  {},
-				filepath.Join(wd, "../../bb"): {},
-			},
-			out: map[string]struct{}{
-				"a/b":                         {},
-				"../aa":                       {},
-				filepath.Join(wd, "../../bb"): {},
-			},
-		},
-	}
-
-	for i, tc := range tcases {
-		t.Run(fmt.Sprintf("case%d", i), func(t *testing.T) {
-			out, err := dedupPaths(tc.in)
-			if err != nil {
-				require.NoError(t, err)
-			}
-			// convert to relative paths as that is shown to user
-			arr := make([]string, 0, len(out))
-			for k := range out {
-				arr = append(arr, k)
-			}
-			require.NoError(t, err)
-			arr = toRelativePaths(arr, wd)
-			m := make(map[string]struct{})
-			for _, v := range arr {
-				m[filepath.ToSlash(v)] = struct{}{}
-			}
-			o := make(map[string]struct{}, len(tc.out))
-			for k := range tc.out {
-				o[filepath.ToSlash(k)] = struct{}{}
-			}
-			require.Equal(t, o, m)
-		})
-	}
-}
-
-func TestValidateEntitlements(t *testing.T) {
-	dir1 := t.TempDir()
-	dir2 := t.TempDir()
-
-	// the paths returned by entitlements validation will have symlinks resolved
-	expDir1, err := filepath.EvalSymlinks(dir1)
-	require.NoError(t, err)
-	expDir2, err := filepath.EvalSymlinks(dir2)
-	require.NoError(t, err)
-
-	escapeLink := filepath.Join(dir1, "escape_link")
-	require.NoError(t, os.Symlink("../../aa", escapeLink))
-
-	wd, err := os.Getwd()
-	require.NoError(t, err)
-	expWd, err := filepath.EvalSymlinks(wd)
-	require.NoError(t, err)
-
-	tcases := []struct {
-		name     string
-		conf     EntitlementConf
-		opt      build.Options
-		expected EntitlementConf
-	}{
-		{
-			name: "No entitlements",
-			opt: build.Options{
-				Inputs: build.Inputs{
-					ContextState: &llb.State{},
-				},
-			},
-		},
-		{
-			name: "NetworkHostMissing",
-			opt: build.Options{
-				Allow: []entitlements.Entitlement{
-					entitlements.EntitlementNetworkHost,
-				},
-			},
-			expected: EntitlementConf{
-				NetworkHost: true,
-				FSRead:      []string{expWd},
-			},
-		},
-		{
-			name: "NetworkHostSet",
-			conf: EntitlementConf{
-				NetworkHost: true,
-			},
-			opt: build.Options{
-				Allow: []entitlements.Entitlement{
-					entitlements.EntitlementNetworkHost,
-				},
-			},
-			expected: EntitlementConf{
-				FSRead: []string{expWd},
-			},
-		},
-		{
-			name: "SecurityAndNetworkHostMissing",
-			opt: build.Options{
-				Allow: []entitlements.Entitlement{
-					entitlements.EntitlementNetworkHost,
-					entitlements.EntitlementSecurityInsecure,
-				},
-			},
-			expected: EntitlementConf{
-				NetworkHost:      true,
-				SecurityInsecure: true,
-				FSRead:           []string{expWd},
-			},
-		},
-		{
-			name: "SecurityMissingAndNetworkHostSet",
-			conf: EntitlementConf{
-				NetworkHost: true,
-			},
-			opt: build.Options{
-				Allow: []entitlements.Entitlement{
-					entitlements.EntitlementNetworkHost,
-					entitlements.EntitlementSecurityInsecure,
-				},
-			},
-			expected: EntitlementConf{
-				SecurityInsecure: true,
-				FSRead:           []string{expWd},
-			},
-		},
-		{
-			name: "SSHMissing",
-			opt: build.Options{
-				SSHSpecs: []*pb.SSH{
-					{
-						ID: "test",
-					},
-				},
-			},
-			expected: EntitlementConf{
-				SSH:    true,
-				FSRead: []string{expWd},
-			},
-		},
-		{
-			name: "ExportLocal",
-			opt: build.Options{
-				ExportsLocalPathsTemporary: []string{
-					dir1,
-					filepath.Join(dir1, "subdir"),
-					dir2,
-				},
-			},
-			expected: EntitlementConf{
-				FSWrite: func() []string {
-					exp := []string{expDir1, expDir2}
-					slices.Sort(exp)
-					return exp
-				}(),
-				FSRead: []string{expWd},
-			},
-		},
-		{
-			name: "SecretFromSubFile",
-			opt: build.Options{
-				SecretSpecs: []*pb.Secret{
-					{
-						FilePath: filepath.Join(dir1, "subfile"),
-					},
-				},
-			},
-			conf: EntitlementConf{
-				FSRead: []string{wd, dir1},
-			},
-		},
-		{
-			name: "SecretFromEscapeLink",
-			opt: build.Options{
-				SecretSpecs: []*pb.Secret{
-					{
-						FilePath: escapeLink,
-					},
-				},
-			},
-			conf: EntitlementConf{
-				FSRead: []string{wd, dir1},
-			},
-			expected: EntitlementConf{
-				FSRead: []string{filepath.Join(expDir1, "../..")},
-			},
-		},
-		{
-			name: "SecretFromEscapeLinkAllowRoot",
-			opt: build.Options{
-				SecretSpecs: []*pb.Secret{
-					{
-						FilePath: escapeLink,
-					},
-				},
-			},
-			conf: EntitlementConf{
-				FSRead: []string{"/"},
-			},
-			expected: EntitlementConf{
-				FSRead: func() []string {
-					// on windows root (/) is only allowed if it is the same volume as wd
-					if filepath.VolumeName(wd) == filepath.VolumeName(escapeLink) {
-						return nil
-					}
-					// if not, then escapeLink is not allowed
-					exp, _, err := evaluateToExistingPath(escapeLink)
-					require.NoError(t, err)
-					exp, err = filepath.EvalSymlinks(exp)
-					require.NoError(t, err)
-					return []string{exp}
-				}(),
-			},
-		},
-		{
-			name: "SecretFromEscapeLinkAllowAny",
-			opt: build.Options{
-				SecretSpecs: []*pb.Secret{
-					{
-						FilePath: escapeLink,
-					},
-				},
-			},
-			conf: EntitlementConf{
-				FSRead: []string{"*"},
-			},
-			expected: EntitlementConf{},
-		},
-		{
-			name: "NonExistingAllowedPathSubpath",
-			opt: build.Options{
-				ExportsLocalPathsTemporary: []string{
-					dir1,
-				},
-			},
-			conf: EntitlementConf{
-				FSRead:  []string{wd},
-				FSWrite: []string{filepath.Join(dir1, "not/exists")},
-			},
-			expected: EntitlementConf{
-				FSWrite: []string{expDir1}, // dir1 is still needed as only subpath was allowed
-			},
-		},
-		{
-			name: "NonExistingAllowedPathMatches",
-			opt: build.Options{
-				ExportsLocalPathsTemporary: []string{
-					filepath.Join(dir1, "not/exists"),
-				},
-			},
-			conf: EntitlementConf{
-				FSRead:  []string{wd},
-				FSWrite: []string{filepath.Join(dir1, "not/exists")},
-			},
-			expected: EntitlementConf{
-				FSWrite: []string{expDir1}, // dir1 is still needed as build also needs to write not/exists directory
-			},
-		},
-		{
-			name: "NonExistingBuildPath",
-			opt: build.Options{
-				ExportsLocalPathsTemporary: []string{
-					filepath.Join(dir1, "not/exists"),
-				},
-			},
-			conf: EntitlementConf{
-				FSRead:  []string{wd},
-				FSWrite: []string{dir1},
-			},
-		},
-	}
-
-	for _, tc := range tcases {
-		t.Run(tc.name, func(t *testing.T) {
-			expected, err := tc.conf.Validate(map[string]build.Options{"test": tc.opt})
-			require.NoError(t, err)
-			require.Equal(t, tc.expected, expected)
-		})
-	}
-}
-
-func TestGroupSamePaths(t *testing.T) {
-	tests := []struct {
-		name      string
-		in1       []string
-		in2       []string
-		expected1 []string
-		expected2 []string
-		expectedC []string
-	}{
-		{
-			name:      "All common paths",
-			in1:       []string{"/path/a", "/path/b", "/path/c"},
-			in2:       []string{"/path/a", "/path/b", "/path/c"},
-			expected1: []string{},
-			expected2: []string{},
-			expectedC: []string{"/path/a", "/path/b", "/path/c"},
-		},
-		{
-			name:      "No common paths",
-			in1:       []string{"/path/a", "/path/b"},
-			in2:       []string{"/path/c", "/path/d"},
-			expected1: []string{"/path/a", "/path/b"},
-			expected2: []string{"/path/c", "/path/d"},
-			expectedC: []string{},
-		},
-		{
-			name:      "Some common paths",
-			in1:       []string{"/path/a", "/path/b", "/path/c"},
-			in2:       []string{"/path/b", "/path/c", "/path/d"},
-			expected1: []string{"/path/a"},
-			expected2: []string{"/path/d"},
-			expectedC: []string{"/path/b", "/path/c"},
-		},
-		{
-			name:      "Empty inputs",
-			in1:       []string{},
-			in2:       []string{},
-			expected1: []string{},
-			expected2: []string{},
-			expectedC: []string{},
-		},
-		{
-			name:      "One empty input",
-			in1:       []string{"/path/a", "/path/b"},
-			in2:       []string{},
-			expected1: []string{"/path/a", "/path/b"},
-			expected2: []string{},
-			expectedC: []string{},
-		},
-		{
-			name:      "Unsorted inputs with common paths",
-			in1:       []string{"/path/c", "/path/a", "/path/b"},
-			in2:       []string{"/path/b", "/path/c", "/path/a"},
-			expected1: []string{},
-			expected2: []string{},
-			expectedC: []string{"/path/a", "/path/b", "/path/c"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			out1, out2, common := groupSamePaths(tt.in1, tt.in2)
-			require.Equal(t, tt.expected1, out1, "in1 should match expected1")
-			require.Equal(t, tt.expected2, out2, "in2 should match expected2")
-			require.Equal(t, tt.expectedC, common, "common should match expectedC")
-		})
-	}
-}

bake/hcl_test.go

@@ -49,18 +49,18 @@ func TestHCLBasic(t *testing.T) {
 	require.Equal(t, []string{"db", "webapp"}, c.Groups[0].Targets)
 
 	require.Equal(t, 4, len(c.Targets))
-	require.Equal(t, "db", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "db")
 	require.Equal(t, "./db", *c.Targets[0].Context)
 
-	require.Equal(t, "webapp", c.Targets[1].Name)
+	require.Equal(t, c.Targets[1].Name, "webapp")
 	require.Equal(t, 1, len(c.Targets[1].Args))
 	require.Equal(t, ptrstr("123"), c.Targets[1].Args["buildno"])
 
-	require.Equal(t, "cross", c.Targets[2].Name)
+	require.Equal(t, c.Targets[2].Name, "cross")
 	require.Equal(t, 2, len(c.Targets[2].Platforms))
 	require.Equal(t, []string{"linux/amd64", "linux/arm64"}, c.Targets[2].Platforms)
 
-	require.Equal(t, "webapp-plus", c.Targets[3].Name)
+	require.Equal(t, c.Targets[3].Name, "webapp-plus")
 	require.Equal(t, 1, len(c.Targets[3].Args))
 	require.Equal(t, map[string]*string{"IAMCROSS": ptrstr("true")}, c.Targets[3].Args)
 }
@@ -109,18 +109,18 @@ func TestHCLBasicInJSON(t *testing.T) {
 	require.Equal(t, []string{"db", "webapp"}, c.Groups[0].Targets)
 
 	require.Equal(t, 4, len(c.Targets))
-	require.Equal(t, "db", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "db")
 	require.Equal(t, "./db", *c.Targets[0].Context)
 
-	require.Equal(t, "webapp", c.Targets[1].Name)
+	require.Equal(t, c.Targets[1].Name, "webapp")
 	require.Equal(t, 1, len(c.Targets[1].Args))
 	require.Equal(t, ptrstr("123"), c.Targets[1].Args["buildno"])
 
-	require.Equal(t, "cross", c.Targets[2].Name)
+	require.Equal(t, c.Targets[2].Name, "cross")
 	require.Equal(t, 2, len(c.Targets[2].Platforms))
 	require.Equal(t, []string{"linux/amd64", "linux/arm64"}, c.Targets[2].Platforms)
 
-	require.Equal(t, "webapp-plus", c.Targets[3].Name)
+	require.Equal(t, c.Targets[3].Name, "webapp-plus")
 	require.Equal(t, 1, len(c.Targets[3].Args))
 	require.Equal(t, map[string]*string{"IAMCROSS": ptrstr("true")}, c.Targets[3].Args)
 }
@@ -146,7 +146,7 @@ func TestHCLWithFunctions(t *testing.T) {
 	require.Equal(t, []string{"webapp"}, c.Groups[0].Targets)
 
 	require.Equal(t, 1, len(c.Targets))
-	require.Equal(t, "webapp", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "webapp")
 	require.Equal(t, ptrstr("124"), c.Targets[0].Args["buildno"])
 }
 
@@ -176,7 +176,7 @@ func TestHCLWithUserDefinedFunctions(t *testing.T) {
 	require.Equal(t, []string{"webapp"}, c.Groups[0].Targets)
 
 	require.Equal(t, 1, len(c.Targets))
-	require.Equal(t, "webapp", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "webapp")
 	require.Equal(t, ptrstr("124"), c.Targets[0].Args["buildno"])
 }
 
@@ -205,7 +205,7 @@ func TestHCLWithVariables(t *testing.T) {
 	require.Equal(t, []string{"webapp"}, c.Groups[0].Targets)
 
 	require.Equal(t, 1, len(c.Targets))
-	require.Equal(t, "webapp", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "webapp")
 	require.Equal(t, ptrstr("123"), c.Targets[0].Args["buildno"])
 
 	t.Setenv("BUILD_NUMBER", "456")
@@ -218,7 +218,7 @@ func TestHCLWithVariables(t *testing.T) {
 	require.Equal(t, []string{"webapp"}, c.Groups[0].Targets)
 
 	require.Equal(t, 1, len(c.Targets))
-	require.Equal(t, "webapp", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "webapp")
 	require.Equal(t, ptrstr("456"), c.Targets[0].Args["buildno"])
 }
 
@@ -241,7 +241,7 @@ func TestHCLWithVariablesInFunctions(t *testing.T) {
 	require.NoError(t, err)
 
 	require.Equal(t, 1, len(c.Targets))
-	require.Equal(t, "webapp", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "webapp")
 	require.Equal(t, []string{"user/repo:v1"}, c.Targets[0].Tags)
 
 	t.Setenv("REPO", "docker/buildx")
@@ -250,7 +250,7 @@ func TestHCLWithVariablesInFunctions(t *testing.T) {
 	require.NoError(t, err)
 
 	require.Equal(t, 1, len(c.Targets))
-	require.Equal(t, "webapp", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "webapp")
 	require.Equal(t, []string{"docker/buildx:v1"}, c.Targets[0].Tags)
 }
 
@@ -279,7 +279,7 @@ func TestHCLMultiFileSharedVariables(t *testing.T) {
 	}, nil)
 	require.NoError(t, err)
 	require.Equal(t, 1, len(c.Targets))
-	require.Equal(t, "app", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "app")
 	require.Equal(t, ptrstr("pre-abc"), c.Targets[0].Args["v1"])
 	require.Equal(t, ptrstr("abc-post"), c.Targets[0].Args["v2"])
 
@@ -292,7 +292,7 @@ func TestHCLMultiFileSharedVariables(t *testing.T) {
 	require.NoError(t, err)
 
 	require.Equal(t, 1, len(c.Targets))
-	require.Equal(t, "app", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "app")
 	require.Equal(t, ptrstr("pre-def"), c.Targets[0].Args["v1"])
 	require.Equal(t, ptrstr("def-post"), c.Targets[0].Args["v2"])
 }
@@ -328,7 +328,7 @@ func TestHCLVarsWithVars(t *testing.T) {
 	}, nil)
 	require.NoError(t, err)
 	require.Equal(t, 1, len(c.Targets))
-	require.Equal(t, "app", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "app")
 	require.Equal(t, ptrstr("pre--ABCDEF-"), c.Targets[0].Args["v1"])
 	require.Equal(t, ptrstr("ABCDEF-post"), c.Targets[0].Args["v2"])
 
@@ -341,7 +341,7 @@ func TestHCLVarsWithVars(t *testing.T) {
 	require.NoError(t, err)
 
 	require.Equal(t, 1, len(c.Targets))
-	require.Equal(t, "app", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "app")
 	require.Equal(t, ptrstr("pre--NEWDEF-"), c.Targets[0].Args["v1"])
 	require.Equal(t, ptrstr("NEWDEF-post"), c.Targets[0].Args["v2"])
 }
@@ -366,7 +366,7 @@ func TestHCLTypedVariables(t *testing.T) {
 	require.NoError(t, err)
 
 	require.Equal(t, 1, len(c.Targets))
-	require.Equal(t, "app", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "app")
 	require.Equal(t, ptrstr("lower"), c.Targets[0].Args["v1"])
 	require.Equal(t, ptrstr("yes"), c.Targets[0].Args["v2"])
 
@@ -377,7 +377,7 @@ func TestHCLTypedVariables(t *testing.T) {
 	require.NoError(t, err)
 
 	require.Equal(t, 1, len(c.Targets))
-	require.Equal(t, "app", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "app")
 	require.Equal(t, ptrstr("higher"), c.Targets[0].Args["v1"])
 	require.Equal(t, ptrstr("no"), c.Targets[0].Args["v2"])
 
@@ -475,7 +475,7 @@ func TestHCLAttrs(t *testing.T) {
 	require.NoError(t, err)
 
 	require.Equal(t, 1, len(c.Targets))
-	require.Equal(t, "app", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "app")
 	require.Equal(t, ptrstr("attr-abcdef"), c.Targets[0].Args["v1"])
 
 	// env does not apply if no variable
@@ -484,7 +484,7 @@ func TestHCLAttrs(t *testing.T) {
 	require.NoError(t, err)
 
 	require.Equal(t, 1, len(c.Targets))
-	require.Equal(t, "app", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "app")
 	require.Equal(t, ptrstr("attr-abcdef"), c.Targets[0].Args["v1"])
 	// attr-multifile
 }
@@ -592,7 +592,7 @@ func TestHCLAttrsCustomType(t *testing.T) {
 	require.NoError(t, err)
 
 	require.Equal(t, 1, len(c.Targets))
-	require.Equal(t, "app", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "app")
 	require.Equal(t, []string{"linux/arm64", "linux/amd64"}, c.Targets[0].Platforms)
 	require.Equal(t, ptrstr("linux/arm64"), c.Targets[0].Args["v1"])
 }
@@ -618,7 +618,7 @@ func TestHCLMultiFileAttrs(t *testing.T) {
 	}, nil)
 	require.NoError(t, err)
 	require.Equal(t, 1, len(c.Targets))
-	require.Equal(t, "app", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "app")
 	require.Equal(t, ptrstr("pre-def"), c.Targets[0].Args["v1"])
 
 	t.Setenv("FOO", "ghi")
@@ -630,7 +630,7 @@ func TestHCLMultiFileAttrs(t *testing.T) {
 	require.NoError(t, err)
 
 	require.Equal(t, 1, len(c.Targets))
-	require.Equal(t, "app", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "app")
 	require.Equal(t, ptrstr("pre-ghi"), c.Targets[0].Args["v1"])
 }
 
@@ -653,7 +653,7 @@ func TestHCLMultiFileGlobalAttrs(t *testing.T) {
 	}, nil)
 	require.NoError(t, err)
 	require.Equal(t, 1, len(c.Targets))
-	require.Equal(t, "app", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "app")
 	require.Equal(t, "pre-def", *c.Targets[0].Args["v1"])
 }
 
@@ -839,12 +839,12 @@ func TestHCLRenameMultiFile(t *testing.T) {
 
 	require.Equal(t, 2, len(c.Targets))
 
-	require.Equal(t, "bar", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "bar")
-	require.Equal(t, "x", *c.Targets[0].Dockerfile)
+	require.Equal(t, *c.Targets[0].Dockerfile, "x")
-	require.Equal(t, "z", *c.Targets[0].Target)
+	require.Equal(t, *c.Targets[0].Target, "z")
 
-	require.Equal(t, "foo", c.Targets[1].Name)
+	require.Equal(t, c.Targets[1].Name, "foo")
-	require.Equal(t, "y", *c.Targets[1].Context)
+	require.Equal(t, *c.Targets[1].Context, "y")
 }
 
 func TestHCLMatrixBasic(t *testing.T) {
@@ -862,10 +862,10 @@ func TestHCLMatrixBasic(t *testing.T) {
 	require.NoError(t, err)
 
 	require.Equal(t, 2, len(c.Targets))
-	require.Equal(t, "x", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "x")
-	require.Equal(t, "y", c.Targets[1].Name)
+	require.Equal(t, c.Targets[1].Name, "y")
-	require.Equal(t, "x.Dockerfile", *c.Targets[0].Dockerfile)
+	require.Equal(t, *c.Targets[0].Dockerfile, "x.Dockerfile")
-	require.Equal(t, "y.Dockerfile", *c.Targets[1].Dockerfile)
+	require.Equal(t, *c.Targets[1].Dockerfile, "y.Dockerfile")
 
 	require.Equal(t, 1, len(c.Groups))
 	require.Equal(t, "default", c.Groups[0].Name)
@@ -948,9 +948,9 @@ func TestHCLMatrixMaps(t *testing.T) {
 	require.NoError(t, err)
 
 	require.Equal(t, 2, len(c.Targets))
-	require.Equal(t, "aa", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "aa")
 	require.Equal(t, c.Targets[0].Args["target"], ptrstr("valbb"))
-	require.Equal(t, "cc", c.Targets[1].Name)
+	require.Equal(t, c.Targets[1].Name, "cc")
 	require.Equal(t, c.Targets[1].Args["target"], ptrstr("valdd"))
 }
 
@@ -1141,7 +1141,7 @@ func TestJSONAttributes(t *testing.T) {
 	require.NoError(t, err)
 
 	require.Equal(t, 1, len(c.Targets))
-	require.Equal(t, "app", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "app")
 	require.Equal(t, ptrstr("pre-abc-def"), c.Targets[0].Args["v1"])
 }
 
@@ -1166,7 +1166,7 @@ func TestJSONFunctions(t *testing.T) {
 	require.NoError(t, err)
 
 	require.Equal(t, 1, len(c.Targets))
-	require.Equal(t, "app", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "app")
 	require.Equal(t, ptrstr("pre-<FOO-abc>"), c.Targets[0].Args["v1"])
 }
 
@@ -1184,7 +1184,7 @@ func TestJSONInvalidFunctions(t *testing.T) {
 	require.NoError(t, err)
 
 	require.Equal(t, 1, len(c.Targets))
-	require.Equal(t, "app", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "app")
 	require.Equal(t, ptrstr(`myfunc("foo")`), c.Targets[0].Args["v1"])
 }
 
@@ -1212,7 +1212,7 @@ func TestHCLFunctionInAttr(t *testing.T) {
 	require.NoError(t, err)
 
 	require.Equal(t, 1, len(c.Targets))
-	require.Equal(t, "app", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "app")
 	require.Equal(t, ptrstr("FOO <> [baz]"), c.Targets[0].Args["v1"])
 }
 
@@ -1243,7 +1243,7 @@ services:
 	require.NoError(t, err)
 
 	require.Equal(t, 1, len(c.Targets))
-	require.Equal(t, "app", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "app")
 	require.Equal(t, ptrstr("foo"), c.Targets[0].Args["v1"])
 	require.Equal(t, ptrstr("bar"), c.Targets[0].Args["v2"])
 	require.Equal(t, "dir", *c.Targets[0].Context)
@@ -1266,7 +1266,7 @@ func TestHCLBuiltinVars(t *testing.T) {
 	require.NoError(t, err)
 
 	require.Equal(t, 1, len(c.Targets))
-	require.Equal(t, "app", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "app")
 	require.Equal(t, "foo", *c.Targets[0].Context)
 	require.Equal(t, "test", *c.Targets[0].Dockerfile)
 }
@@ -1332,17 +1332,17 @@ target "b" {
 
 	require.Equal(t, 4, len(c.Targets))
 
-	require.Equal(t, "metadata-a", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "metadata-a")
 	require.Equal(t, []string{"app/a:1.0.0", "app/a:latest"}, c.Targets[0].Tags)
 
-	require.Equal(t, "metadata-b", c.Targets[1].Name)
+	require.Equal(t, c.Targets[1].Name, "metadata-b")
 	require.Equal(t, []string{"app/b:1.0.0", "app/b:latest"}, c.Targets[1].Tags)
 
-	require.Equal(t, "a", c.Targets[2].Name)
+	require.Equal(t, c.Targets[2].Name, "a")
 	require.Equal(t, ".", *c.Targets[2].Context)
 	require.Equal(t, "a", *c.Targets[2].Target)
 
-	require.Equal(t, "b", c.Targets[3].Name)
+	require.Equal(t, c.Targets[3].Name, "b")
 	require.Equal(t, ".", *c.Targets[3].Context)
 	require.Equal(t, "b", *c.Targets[3].Target)
 }
@@ -1389,10 +1389,10 @@ target "two" {
 
 	require.Equal(t, 2, len(c.Targets))
 
-	require.Equal(t, "one", c.Targets[0].Name)
+	require.Equal(t, c.Targets[0].Name, "one")
 	require.Equal(t, map[string]*string{"a": ptrstr("pre-ghi-jkl")}, c.Targets[0].Args)
 
-	require.Equal(t, "two", c.Targets[1].Name)
+	require.Equal(t, c.Targets[1].Name, "two")
 	require.Equal(t, map[string]*string{"b": ptrstr("pre-jkl")}, c.Targets[1].Args)
 }
 

bake/hclparser/hclparser.go

@@ -28,16 +28,10 @@ type variable struct {
 	Name        string         `json:"-" hcl:"name,label"`
 	Default     *hcl.Attribute `json:"default,omitempty" hcl:"default,optional"`
 	Description string         `json:"description,omitempty" hcl:"description,optional"`
-	Validations []*variableValidation `json:"validation,omitempty" hcl:"validation,block"`
 	Body        hcl.Body       `json:"-" hcl:",body"`
 	Remain      hcl.Body       `json:"-" hcl:",remain"`
 }
 
-type variableValidation struct {
-	Condition    hcl.Expression `json:"condition" hcl:"condition"`
-	ErrorMessage hcl.Expression `json:"error_message" hcl:"error_message"`
-}
-
 type functionDef struct {
 	Name     string         `json:"-" hcl:"name,label"`
 	Params   *hcl.Attribute `json:"params,omitempty" hcl:"params"`
@@ -547,33 +541,6 @@ func (p *parser) resolveBlockNames(block *hcl.Block) ([]string, error) {
 	return names, nil
 }
 
-func (p *parser) validateVariables(vars map[string]*variable, ectx *hcl.EvalContext) hcl.Diagnostics {
-	var diags hcl.Diagnostics
-	for _, v := range vars {
-		for _, validation := range v.Validations {
-			condition, condDiags := validation.Condition.Value(ectx)
-			if condDiags.HasErrors() {
-				diags = append(diags, condDiags...)
-				continue
-			}
-			if !condition.True() {
-				message, msgDiags := validation.ErrorMessage.Value(ectx)
-				if msgDiags.HasErrors() {
-					diags = append(diags, msgDiags...)
-					continue
-				}
-				diags = append(diags, &hcl.Diagnostic{
-					Severity: hcl.DiagError,
-					Summary:  "Validation failed",
-					Detail:   message.AsString(),
-					Subject:  validation.Condition.Range().Ptr(),
-				})
-			}
-		}
-	}
-	return diags
-}
-
 type Variable struct {
 	Name        string
 	Description string
@@ -719,9 +686,6 @@ func Parse(b hcl.Body, opt Opt, val interface{}) (*ParseMeta, hcl.Diagnostics) {
 		}
 		vars = append(vars, v)
 	}
-	if diags := p.validateVariables(p.vars, p.ectx); diags.HasErrors() {
-		return nil, diags
-	}
 
 	for k := range p.funcs {
 		if err := p.resolveFunction(p.ectx, k); err != nil {

bake/hclparser/stdlib.go

@@ -170,6 +170,7 @@ func indexOfFunc() function.Function {
 				}
 			}
 			return cty.NilVal, errors.New("item not found")
+
 		},
 	})
 }

build/build.go

@@ -18,7 +18,6 @@ import (
 	"github.com/containerd/containerd/images"
 	"github.com/distribution/reference"
 	"github.com/docker/buildx/builder"
-	controllerapi "github.com/docker/buildx/controller/pb"
 	"github.com/docker/buildx/driver"
 	"github.com/docker/buildx/util/confutil"
 	"github.com/docker/buildx/util/desktop"
@@ -70,7 +69,6 @@ type Options struct {
 	CacheTo       []client.CacheOptionsEntry
 	CgroupParent  string
 	Exports       []client.ExportEntry
-	ExportsLocalPathsTemporary []string // should be removed after client.ExportEntry update in buildkit v0.19.0
 	ExtraHosts    []string
 	Labels        map[string]string
 	NetworkMode   string
@@ -78,8 +76,6 @@ type Options struct {
 	NoCacheFilter []string
 	Platforms     []specs.Platform
 	Pull          bool
-	SecretSpecs                []*controllerapi.Secret
-	SSHSpecs                   []*controllerapi.SSH
 	ShmSize       opts.MemBytes
 	Tags          []string
 	Target        string

build/git_test.go

@@ -23,7 +23,7 @@ func setupTest(tb testing.TB) {
 	gitutil.GitInit(c, tb)
 
 	df := []byte("FROM alpine:latest\n")
-	require.NoError(tb, os.WriteFile("Dockerfile", df, 0644))
+	assert.NoError(tb, os.WriteFile("Dockerfile", df, 0644))
 
 	gitutil.GitAdd(c, tb, "Dockerfile")
 	gitutil.GitCommit(c, tb, "initial commit")
@@ -32,7 +32,7 @@ func setupTest(tb testing.TB) {
 
 func TestGetGitAttributesNotGitRepo(t *testing.T) {
 	_, err := getGitAttributes(context.Background(), t.TempDir(), "Dockerfile")
-	require.NoError(t, err)
+	assert.NoError(t, err)
 }
 
 func TestGetGitAttributesBadGitRepo(t *testing.T) {
@@ -47,7 +47,7 @@ func TestGetGitAttributesNoContext(t *testing.T) {
 	setupTest(t)
 
 	addGitAttrs, err := getGitAttributes(context.Background(), "", "Dockerfile")
-	require.NoError(t, err)
+	assert.NoError(t, err)
 	var so client.SolveOpt
 	addGitAttrs(&so)
 	assert.Empty(t, so.FrontendAttrs)
@@ -195,8 +195,8 @@ func TestLocalDirsSub(t *testing.T) {
 	gitutil.GitInit(c, t)
 
 	df := []byte("FROM alpine:latest\n")
-	require.NoError(t, os.MkdirAll("app", 0755))
+	assert.NoError(t, os.MkdirAll("app", 0755))
-	require.NoError(t, os.WriteFile("app/Dockerfile", df, 0644))
+	assert.NoError(t, os.WriteFile("app/Dockerfile", df, 0644))
 
 	gitutil.GitAdd(c, t, "app/Dockerfile")
 	gitutil.GitCommit(c, t, "initial commit")

build/invoke.go

@@ -16,7 +16,7 @@ import (
 
 type Container struct {
 	cancelOnce      sync.Once
-	containerCancel func(error)
+	containerCancel func()
 	isUnavailable   atomic.Bool
 	initStarted     atomic.Bool
 	container       gateway.Container
@@ -31,18 +31,18 @@ func NewContainer(ctx context.Context, resultCtx *ResultHandle, cfg *controllera
 	errCh := make(chan error)
 	go func() {
 		err := resultCtx.build(func(ctx context.Context, c gateway.Client) (*gateway.Result, error) {
-			ctx, cancel := context.WithCancelCause(ctx)
+			ctx, cancel := context.WithCancel(ctx)
 			go func() {
 				<-mainCtx.Done()
-				cancel(errors.WithStack(context.Canceled))
+				cancel()
 			}()
 
 			containerCfg, err := resultCtx.getContainerConfig(cfg)
 			if err != nil {
 				return nil, err
 			}
-			containerCtx, containerCancel := context.WithCancelCause(ctx)
+			containerCtx, containerCancel := context.WithCancel(ctx)
-			defer containerCancel(errors.WithStack(context.Canceled))
+			defer containerCancel()
 			bkContainer, err := c.NewContainer(containerCtx, containerCfg)
 			if err != nil {
 				return nil, err
@@ -83,7 +83,7 @@ func (c *Container) Cancel() {
 	c.markUnavailable()
 	c.cancelOnce.Do(func() {
 		if c.containerCancel != nil {
-			c.containerCancel(errors.WithStack(context.Canceled))
+			c.containerCancel()
 		}
 		close(c.releaseCh)
 	})

build/replicatedstream_test.go

@@ -10,6 +10,7 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func generateRandomData(size int) []byte {
@@ -56,7 +57,7 @@ func TestSyncMultiReaderParallel(t *testing.T) {
 					return
 				}
 
-				assert.NoError(t, err, "Reader %d error", readerId)
+				require.NoError(t, err, "Reader %d error", readerId)
 
 				if mathrand.Intn(1000) == 0 { //nolint:gosec
 					t.Logf("Reader %d closing", readerId)

build/result.go

@@ -82,7 +82,7 @@ func NewResultHandle(ctx context.Context, cc *client.Client, opt client.SolveOpt
 	var respHandle *ResultHandle
 
 	go func() {
-		defer func() { cancel(errors.WithStack(context.Canceled)) }() // ensure no dangling processes
+		defer cancel(context.Canceled) // ensure no dangling processes
 
 		var res *gateway.Result
 		var err error
@@ -181,7 +181,7 @@ func NewResultHandle(ctx context.Context, cc *client.Client, opt client.SolveOpt
 			case <-respHandle.done:
 			case <-ctx.Done():
 			}
-			return nil, context.Cause(ctx)
+			return nil, ctx.Err()
 		}, nil)
 		if respHandle != nil {
 			return

build/utils_test.go

@@ -138,7 +138,7 @@ func TestToBuildkitExtraHosts(t *testing.T) {
 			actualOut, actualErr := toBuildkitExtraHosts(context.TODO(), tc.input, nil)
 			if tc.expectedErr == "" {
 				require.Equal(t, tc.expectedOut, actualOut)
-				require.NoError(t, actualErr)
+				require.Nil(t, actualErr)
 			} else {
 				require.Zero(t, actualOut)
 				require.Error(t, actualErr, tc.expectedErr)

builder/builder.go

@@ -288,15 +288,7 @@ func GetBuilders(dockerCli command.Cli, txn *store.Txn) ([]*Builder, error) {
 		return nil, err
 	}
 
-	contexts, err := dockerCli.ContextStore().List()
+	builders := make([]*Builder, len(storeng))
-	if err != nil {
-		return nil, err
-	}
-	sort.Slice(contexts, func(i, j int) bool {
-		return contexts[i].Name < contexts[j].Name
-	})
-
-	builders := make([]*Builder, len(storeng), len(storeng)+len(contexts))
 	seen := make(map[string]struct{})
 	for i, ng := range storeng {
 		b, err := New(dockerCli,
@@ -311,6 +303,14 @@ func GetBuilders(dockerCli command.Cli, txn *store.Txn) ([]*Builder, error) {
 		seen[b.NodeGroup.Name] = struct{}{}
 	}
 
+	contexts, err := dockerCli.ContextStore().List()
+	if err != nil {
+		return nil, err
+	}
+	sort.Slice(contexts, func(i, j int) bool {
+		return contexts[i].Name < contexts[j].Name
+	})
+
 	for _, c := range contexts {
 		// if a context has the same name as an instance from the store, do not
 		// add it to the builders list. An instance from the store takes
@@ -522,9 +522,8 @@ func Create(ctx context.Context, txn *store.Txn, dockerCli command.Cli, opts Cre
 		return nil, err
 	}
 
-	cancelCtx, cancel := context.WithCancelCause(ctx)
+	timeoutCtx, cancel := context.WithTimeout(ctx, 20*time.Second)
-	timeoutCtx, _ := context.WithTimeoutCause(cancelCtx, 20*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet,lostcancel // no need to manually cancel this context as we already rely on parent
+	defer cancel()
-	defer func() { cancel(errors.WithStack(context.Canceled)) }()
 
 	nodes, err := b.LoadNodes(timeoutCtx, WithData())
 	if err != nil {

builder/builder_test.go

@@ -19,13 +19,13 @@ func TestCsvToMap(t *testing.T) {
 	require.NoError(t, err)
 
 	require.Contains(t, r, "tolerations")
-	require.Equal(t, "key=foo,value=bar;key=foo2,value=bar2", r["tolerations"])
+	require.Equal(t, r["tolerations"], "key=foo,value=bar;key=foo2,value=bar2")
 
 	require.Contains(t, r, "replicas")
-	require.Equal(t, "1", r["replicas"])
+	require.Equal(t, r["replicas"], "1")
 
 	require.Contains(t, r, "namespace")
-	require.Equal(t, "default", r["namespace"])
+	require.Equal(t, r["namespace"], "default")
 }
 
 func TestParseBuildkitdFlags(t *testing.T) {

commands/bake.go

@@ -107,16 +107,9 @@ func runBake(ctx context.Context, dockerCli command.Cli, targets []string, in ba
 	if err != nil {
 		return err
 	}
-	wd, err := os.Getwd()
-	if err != nil {
-		return errors.Wrapf(err, "failed to get current working directory")
-	}
-	// filesystem access under the current working directory is allowed by default
-	ent.FSRead = append(ent.FSRead, wd)
-	ent.FSWrite = append(ent.FSWrite, wd)
 
-	ctx2, cancel := context.WithCancelCause(context.TODO())
+	ctx2, cancel := context.WithCancel(context.TODO())
-	defer cancel(errors.WithStack(context.Canceled))
+	defer cancel()
 
 	var nodes []builder.Node
 	var progressConsoleDesc, progressTextDesc string
@@ -199,7 +192,7 @@ func runBake(ctx context.Context, dockerCli command.Cli, targets []string, in ba
 		}
 	}
 
-	tgts, grps, err := bake.ReadTargets(ctx, files, targets, overrides, defaults, &ent)
+	tgts, grps, err := bake.ReadTargets(ctx, files, targets, overrides, defaults)
 	if err != nil {
 		return err
 	}
@@ -257,7 +250,7 @@ func runBake(ctx context.Context, dockerCli command.Cli, targets []string, in ba
 	if err != nil {
 		return err
 	}
-	if err := exp.Prompt(ctx, url != "", &syncWriter{w: dockerCli.Err(), wait: printer.Wait}); err != nil {
+	if err := exp.Prompt(ctx, &syncWriter{w: dockerCli.Err(), wait: printer.Wait}); err != nil {
 		return err
 	}
 	if printer.IsDone() {

commands/build.go

@@ -325,8 +325,8 @@ func runBuild(ctx context.Context, dockerCli command.Cli, options buildOptions)
 	}
 	attributes := buildMetricAttributes(dockerCli, driverType, &options)
 
-	ctx2, cancel := context.WithCancelCause(context.TODO())
+	ctx2, cancel := context.WithCancel(context.TODO())
-	defer func() { cancel(errors.WithStack(context.Canceled)) }()
+	defer cancel()
 	progressMode, err := options.toDisplayMode()
 	if err != nil {
 		return err
@@ -763,12 +763,9 @@ func decodeExporterResponse(exporterResponse map[string]string) map[string]inter
 		}
 		var raw map[string]interface{}
 		if err = json.Unmarshal(dt, &raw); err != nil || len(raw) == 0 {
-			var rawList []map[string]interface{}
-			if err = json.Unmarshal(dt, &rawList); err != nil || len(rawList) == 0 {
 			out[k] = v
 			continue
 		}
-		}
 		out[k] = json.RawMessage(dt)
 	}
 	return out
@@ -885,6 +882,7 @@ func printWarnings(w io.Writer, warnings []client.VertexWarning, mode progressui
 			src.Print(w)
 		}
 		fmt.Fprintf(w, "\n")
+
 	}
 }
 

commands/imagetools/create.go

@@ -42,7 +42,7 @@ func runCreate(ctx context.Context, dockerCli command.Cli, in createOptions, arg
 		return errors.Errorf("can't push with no tags specified, please set --tag or --dry-run")
 	}
 
-	fileArgs := make([]string, len(in.files), len(in.files)+len(args))
+	fileArgs := make([]string, len(in.files))
 	for i, f := range in.files {
 		dt, err := os.ReadFile(f)
 		if err != nil {
@@ -173,8 +173,8 @@ func runCreate(ctx context.Context, dockerCli command.Cli, in createOptions, arg
 	// new resolver cause need new auth
 	r = imagetools.New(imageopt)
 
-	ctx2, cancel := context.WithCancelCause(context.TODO())
+	ctx2, cancel := context.WithCancel(context.TODO())
-	defer func() { cancel(errors.WithStack(context.Canceled)) }()
+	defer cancel()
 	printer, err := progress.NewPrinter(ctx2, os.Stderr, progressui.DisplayMode(in.progress))
 	if err != nil {
 		return err

commands/inspect.go

@@ -17,7 +17,6 @@ import (
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/cli/debug"
 	"github.com/docker/go-units"
-	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 )
 
@@ -35,9 +34,8 @@ func runInspect(ctx context.Context, dockerCli command.Cli, in inspectOptions) e
 		return err
 	}
 
-	timeoutCtx, cancel := context.WithCancelCause(ctx)
+	timeoutCtx, cancel := context.WithTimeout(ctx, 20*time.Second)
-	timeoutCtx, _ = context.WithTimeoutCause(timeoutCtx, 20*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet,lostcancel // no need to manually cancel this context as we already rely on parent
+	defer cancel()
-	defer func() { cancel(errors.WithStack(context.Canceled)) }()
 
 	nodes, err := b.LoadNodes(timeoutCtx, builder.WithData())
 	if in.bootstrap {

commands/ls.go

@@ -18,7 +18,6 @@ import (
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/cli/command/formatter"
-	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 	"golang.org/x/sync/errgroup"
 )
@@ -58,9 +57,8 @@ func runLs(ctx context.Context, dockerCli command.Cli, in lsOptions) error {
 		return err
 	}
 
-	timeoutCtx, cancel := context.WithCancelCause(ctx)
+	timeoutCtx, cancel := context.WithTimeout(ctx, 20*time.Second)
-	timeoutCtx, _ = context.WithTimeoutCause(timeoutCtx, 20*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet,lostcancel // no need to manually cancel this context as we already rely on parent
+	defer cancel()
-	defer func() { cancel(errors.WithStack(context.Canceled)) }()
 
 	eg, _ := errgroup.WithContext(timeoutCtx)
 	for _, b := range builders {
@@ -321,7 +319,7 @@ func (tp truncatedPlatforms) String() string {
 		if tpf, ok := tp.res[mpf]; ok {
 			seen[mpf] = struct{}{}
 			if len(tpf) == 1 {
-				out = append(out, tpf[0])
+				out = append(out, fmt.Sprintf("%s", tpf[0]))
 				count++
 			} else {
 				hasPreferredPlatform := false
@@ -349,7 +347,7 @@ func (tp truncatedPlatforms) String() string {
 			continue
 		}
 		if len(tp.res[mpf]) == 1 {
-			out = append(out, tp.res[mpf][0])
+			out = append(out, fmt.Sprintf("%s", tp.res[mpf][0]))
 			count++
 		} else {
 			hasPreferredPlatform := false

commands/rm.go

@@ -150,9 +150,8 @@ func rmAllInactive(ctx context.Context, txn *store.Txn, dockerCli command.Cli, i
 		return err
 	}
 
-	timeoutCtx, cancel := context.WithCancelCause(ctx)
+	timeoutCtx, cancel := context.WithTimeout(ctx, 20*time.Second)
-	timeoutCtx, _ = context.WithTimeoutCause(timeoutCtx, 20*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet,lostcancel // no need to manually cancel this context as we already rely on parent
+	defer cancel()
-	defer func() { cancel(errors.WithStack(context.Canceled)) }()
 
 	eg, _ := errgroup.WithContext(timeoutCtx)
 	for _, b := range builders {

commands/use.go

@@ -46,6 +46,7 @@ func runUse(dockerCli command.Cli, in useOptions) error {
 					return errors.Errorf("run `docker context use %s` to switch to context %s", in.builder, in.builder)
 				}
 			}
+
 		}
 		return errors.Wrapf(err, "failed to find instance %q", in.builder)
 	}

controller/build/build.go

@@ -93,7 +93,7 @@ func RunBuild(ctx context.Context, dockerCli command.Cli, in *controllerapi.Buil
 	}
 	opts.Session = append(opts.Session, ssh)
 
-	outputs, _, err := controllerapi.CreateExports(in.Exports)
+	outputs, err := controllerapi.CreateExports(in.Exports)
 	if err != nil {
 		return nil, nil, nil, err
 	}

controller/local/controller.go

@@ -109,7 +109,7 @@ func (b *localController) Invoke(ctx context.Context, sessionID string, pid stri
 
 	// Attach containerIn to this process
 	ioCancelledCh := make(chan struct{})
-	proc.ForwardIO(&ioset.In{Stdin: ioIn, Stdout: ioOut, Stderr: ioErr}, func(error) { close(ioCancelledCh) })
+	proc.ForwardIO(&ioset.In{Stdin: ioIn, Stdout: ioOut, Stderr: ioErr}, func() { close(ioCancelledCh) })
 
 	select {
 	case <-ioCancelledCh:
@@ -117,7 +117,7 @@ func (b *localController) Invoke(ctx context.Context, sessionID string, pid stri
 	case err := <-proc.Done():
 		return err
 	case <-ctx.Done():
-		return context.Cause(ctx)
+		return ctx.Err()
 	}
 }
 

controller/pb/export.go

@@ -10,16 +10,15 @@ import (
 	"github.com/pkg/errors"
 )
 
-func CreateExports(entries []*ExportEntry) ([]client.ExportEntry, []string, error) {
+func CreateExports(entries []*ExportEntry) ([]client.ExportEntry, error) {
 	var outs []client.ExportEntry
-	var localPaths []string
 	if len(entries) == 0 {
-		return nil, nil, nil
+		return nil, nil
 	}
 	var stdoutUsed bool
 	for _, entry := range entries {
 		if entry.Type == "" {
-			return nil, nil, errors.Errorf("type is required for output")
+			return nil, errors.Errorf("type is required for output")
 		}
 
 		out := client.ExportEntry{
@@ -50,21 +49,20 @@ func CreateExports(entries []*ExportEntry) ([]client.ExportEntry, []string, erro
 
 		if supportDir {
 			if entry.Destination == "" {
-				return nil, nil, errors.Errorf("dest is required for %s exporter", out.Type)
+				return nil, errors.Errorf("dest is required for %s exporter", out.Type)
 			}
 			if entry.Destination == "-" {
-				return nil, nil, errors.Errorf("dest cannot be stdout for %s exporter", out.Type)
+				return nil, errors.Errorf("dest cannot be stdout for %s exporter", out.Type)
 			}
 
 			fi, err := os.Stat(entry.Destination)
 			if err != nil && !os.IsNotExist(err) {
-				return nil, nil, errors.Wrapf(err, "invalid destination directory: %s", entry.Destination)
+				return nil, errors.Wrapf(err, "invalid destination directory: %s", entry.Destination)
 			}
 			if err == nil && !fi.IsDir() {
-				return nil, nil, errors.Errorf("destination directory %s is a file", entry.Destination)
+				return nil, errors.Errorf("destination directory %s is a file", entry.Destination)
 			}
 			out.OutputDir = entry.Destination
-			localPaths = append(localPaths, entry.Destination)
 		}
 		if supportFile {
 			if entry.Destination == "" && out.Type != client.ExporterDocker {
@@ -72,33 +70,32 @@ func CreateExports(entries []*ExportEntry) ([]client.ExportEntry, []string, erro
 			}
 			if entry.Destination == "-" {
 				if stdoutUsed {
-					return nil, nil, errors.Errorf("multiple outputs configured to write to stdout")
+					return nil, errors.Errorf("multiple outputs configured to write to stdout")
 				}
 				if _, err := console.ConsoleFromFile(os.Stdout); err == nil {
-					return nil, nil, errors.Errorf("dest file is required for %s exporter. refusing to write to console", out.Type)
+					return nil, errors.Errorf("dest file is required for %s exporter. refusing to write to console", out.Type)
 				}
 				out.Output = wrapWriteCloser(os.Stdout)
 				stdoutUsed = true
 			} else if entry.Destination != "" {
 				fi, err := os.Stat(entry.Destination)
 				if err != nil && !os.IsNotExist(err) {
-					return nil, nil, errors.Wrapf(err, "invalid destination file: %s", entry.Destination)
+					return nil, errors.Wrapf(err, "invalid destination file: %s", entry.Destination)
 				}
 				if err == nil && fi.IsDir() {
-					return nil, nil, errors.Errorf("destination file %s is a directory", entry.Destination)
+					return nil, errors.Errorf("destination file %s is a directory", entry.Destination)
 				}
 				f, err := os.Create(entry.Destination)
 				if err != nil {
-					return nil, nil, errors.Errorf("failed to open %s", err)
+					return nil, errors.Errorf("failed to open %s", err)
 				}
 				out.Output = wrapWriteCloser(f)
-				localPaths = append(localPaths, entry.Destination)
 			}
 		}
 
 		outs = append(outs, out)
 	}
-	return outs, localPaths, nil
+	return outs, nil
 }
 
 func wrapWriteCloser(wc io.WriteCloser) func(map[string]string) (io.WriteCloser, error) {

controller/pb/path.go

@@ -153,6 +153,7 @@ func ResolveOptionPaths(options *BuildOptions) (_ *BuildOptions, err error) {
 				}
 			}
 			ps = append(ps, p)
+
 		}
 		s.Paths = ps
 		ssh = append(ssh, s)

controller/pb/progress.go

@@ -22,7 +22,9 @@ func (w *writer) Write(status *client.SolveStatus) {
 	w.ch <- ToControlStatus(status)
 }
 
-func (w *writer) WriteBuildRef(target string, ref string) {}
+func (w *writer) WriteBuildRef(target string, ref string) {
+	return
+}
 
 func (w *writer) ValidateLogSource(digest.Digest, interface{}) bool {
 	return true

controller/processes/processes.go

@@ -18,16 +18,16 @@ type Process struct {
 	invokeConfig  *pb.InvokeConfig
 	errCh         chan error
 	processCancel func()
-	serveIOCancel func(error)
+	serveIOCancel func()
 }
 
 // ForwardIO forwards process's io to the specified reader/writer.
 // Optionally specify ioCancelCallback which will be called when
 // the process closes the specified IO. This will be useful for additional cleanup.
-func (p *Process) ForwardIO(in *ioset.In, ioCancelCallback func(error)) {
+func (p *Process) ForwardIO(in *ioset.In, ioCancelCallback func()) {
 	p.inEnd.SetIn(in)
 	if f := p.serveIOCancel; f != nil {
-		f(errors.WithStack(context.Canceled))
+		f()
 	}
 	p.serveIOCancel = ioCancelCallback
 }
@@ -124,16 +124,9 @@ func (m *Manager) StartProcess(pid string, resultCtx *build.ResultHandle, cfg *p
 	f.SetOut(&out)
 
 	// Register process
-	ctx, cancel := context.WithCancelCause(context.TODO())
+	ctx, cancel := context.WithCancel(context.TODO())
 	var cancelOnce sync.Once
-	processCancelFunc := func() {
+	processCancelFunc := func() { cancelOnce.Do(func() { cancel(); f.Close(); in.Close(); out.Close() }) }
-		cancelOnce.Do(func() {
-			cancel(errors.WithStack(context.Canceled))
-			f.Close()
-			in.Close()
-			out.Close()
-		})
-	}
 	p := &Process{
 		inEnd:         f,
 		invokeConfig:  cfg,

controller/remote/controller.go

@@ -62,10 +62,9 @@ func NewRemoteBuildxController(ctx context.Context, dockerCli command.Cli, opts
 	serverRoot := filepath.Join(rootDir, "shared")
 
 	// connect to buildx server if it is already running
-	ctx2, cancel := context.WithCancelCause(ctx)
+	ctx2, cancel := context.WithTimeout(ctx, 1*time.Second)
-	ctx2, _ = context.WithTimeoutCause(ctx2, 1*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet,lostcancel // no need to manually cancel this context as we already rely on parent
 	c, err := newBuildxClientAndCheck(ctx2, filepath.Join(serverRoot, defaultSocketFilename))
-	cancel(errors.WithStack(context.Canceled))
+	cancel()
 	if err != nil {
 		if !errors.Is(err, context.DeadlineExceeded) {
 			return nil, errors.Wrap(err, "cannot connect to the buildx server")
@@ -91,10 +90,9 @@ func NewRemoteBuildxController(ctx context.Context, dockerCli command.Cli, opts
 		go wait()
 
 		// wait for buildx server to be ready
-		ctx2, cancel = context.WithCancelCause(ctx)
+		ctx2, cancel = context.WithTimeout(ctx, 10*time.Second)
-		ctx2, _ = context.WithTimeoutCause(ctx2, 10*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet,lostcancel // no need to manually cancel this context as we already rely on parent
 		c, err = newBuildxClientAndCheck(ctx2, filepath.Join(serverRoot, defaultSocketFilename))
-		cancel(errors.WithStack(context.Canceled))
+		cancel()
 		if err != nil {
 			return errors.Wrap(err, "cannot connect to the buildx server")
 		}

controller/remote/io.go

@@ -302,6 +302,7 @@ func attachIO(ctx context.Context, stream msgStream, initMessage *pb.InitMessage
 					out = cfg.stderr
 				default:
 					return errors.Errorf("unsupported fd %d", file.Fd)
+
 				}
 				if out == nil {
 					logrus.Warnf("attachIO: no writer for fd %d", file.Fd)
@@ -344,7 +345,7 @@ func receive(ctx context.Context, stream msgStream) (*pb.Message, error) {
 	case err := <-errCh:
 		return nil, err
 	case <-ctx.Done():
-		return nil, context.Cause(ctx)
+		return nil, ctx.Err()
 	}
 }
 

controller/remote/server.go

@@ -37,7 +37,7 @@ type Server struct {
 type session struct {
 	buildOnGoing atomic.Bool
 	statusChan   chan *pb.StatusResponse
-	cancelBuild  func(error)
+	cancelBuild  func()
 	buildOptions *pb.BuildOptions
 	inputPipe    *io.PipeWriter
 
@@ -109,7 +109,7 @@ func (m *Server) Disconnect(ctx context.Context, req *pb.DisconnectRequest) (res
 	m.sessionMu.Lock()
 	if s, ok := m.session[sessionID]; ok {
 		if s.cancelBuild != nil {
-			s.cancelBuild(errors.WithStack(context.Canceled))
+			s.cancelBuild()
 		}
 		s.cancelRunningProcesses()
 		if s.result != nil {
@@ -127,7 +127,7 @@ func (m *Server) Close() error {
 	for k := range m.session {
 		if s, ok := m.session[k]; ok {
 			if s.cancelBuild != nil {
-				s.cancelBuild(errors.WithStack(context.Canceled))
+				s.cancelBuild()
 			}
 			s.cancelRunningProcesses()
 		}
@@ -199,8 +199,8 @@ func (m *Server) Build(ctx context.Context, req *pb.BuildRequest) (*pb.BuildResp
 	pw := pb.NewProgressWriter(statusChan)
 
 	// Build the specified request
-	ctx, cancel := context.WithCancelCause(ctx)
+	ctx, cancel := context.WithCancel(ctx)
-	defer func() { cancel(errors.WithStack(context.Canceled)) }()
+	defer cancel()
 	resp, res, _, buildErr := m.buildFunc(ctx, req.Options, inR, pw)
 	m.sessionMu.Lock()
 	if s, ok := m.session[sessionID]; ok {
@@ -341,7 +341,7 @@ func (m *Server) Input(stream pb.Controller_InputServer) (err error) {
 			select {
 			case msg = <-msgCh:
 			case <-ctx.Done():
-				return context.Cause(ctx)
+				return errors.Wrap(ctx.Err(), "canceled")
 			}
 			if msg == nil {
 				return nil
@@ -370,9 +370,9 @@ func (m *Server) Invoke(srv pb.Controller_InvokeServer) error {
 	initDoneCh := make(chan *processes.Process)
 	initErrCh := make(chan error)
 	eg, egCtx := errgroup.WithContext(context.TODO())
-	srvIOCtx, srvIOCancel := context.WithCancelCause(egCtx)
+	srvIOCtx, srvIOCancel := context.WithCancel(egCtx)
 	eg.Go(func() error {
-		defer srvIOCancel(errors.WithStack(context.Canceled))
+		defer srvIOCancel()
 		return serveIO(srvIOCtx, srv, func(initMessage *pb.InitMessage) (retErr error) {
 			defer func() {
 				if retErr != nil {
@@ -418,7 +418,7 @@ func (m *Server) Invoke(srv pb.Controller_InvokeServer) error {
 		})
 	})
 	eg.Go(func() (rErr error) {
-		defer srvIOCancel(errors.WithStack(context.Canceled))
+		defer srvIOCancel()
 		// Wait for init done
 		var proc *processes.Process
 		select {

docker-bake.hcl

@@ -41,15 +41,11 @@ target "lint" {
   platforms = GOLANGCI_LINT_MULTIPLATFORM != "" ? [
     "darwin/amd64",
     "darwin/arm64",
-    "freebsd/amd64",
-    "freebsd/arm64",
     "linux/amd64",
     "linux/arm64",
     "linux/s390x",
     "linux/ppc64le",
     "linux/riscv64",
-    "openbsd/amd64",
-    "openbsd/arm64",
     "windows/amd64",
     "windows/arm64"
   ] : []
@@ -158,8 +154,6 @@ target "binaries-cross" {
   platforms = [
     "darwin/amd64",
     "darwin/arm64",
-    "freebsd/amd64",
-    "freebsd/arm64",
     "linux/amd64",
     "linux/arm/v6",
     "linux/arm/v7",
@@ -167,8 +161,6 @@ target "binaries-cross" {
     "linux/ppc64le",
     "linux/riscv64",
     "linux/s390x",
-    "openbsd/amd64",
-    "openbsd/arm64",
     "windows/amd64",
     "windows/arm64"
   ]

docs/bake-reference.md

@@ -359,21 +359,6 @@ target "app" {
 }
 ```
 
-### `target.call`
-
-Specifies the frontend method to use. Frontend methods let you, for example,
-execute build checks only, instead of running a build. This is the same as the
-`--call` flag.
-
-```hcl
-target "app" {
-  call = "check"
-}
-```
-
-For more information about frontend methods, refer to the CLI reference for
-[`docker buildx build --call`](https://docs.docker.com/reference/cli/docker/buildx/build/#call).
-
 ### `target.context`
 
 Specifies the location of the build context to use for this target.

driver/docker-container/driver.go

@@ -177,6 +177,7 @@ func (d *Driver) create(ctx context.Context, l progress.SubLogger) error {
 					break
 				}
 			}
+
 		}
 		_, err := d.DockerAPI.ContainerCreate(ctx, cfg, hc, &network.NetworkingConfig{}, nil, d.Name)
 		if err != nil && !errdefs.IsConflict(err) {
@@ -212,7 +213,7 @@ func (d *Driver) wait(ctx context.Context, l progress.SubLogger) error {
 			}
 			select {
 			case <-ctx.Done():
-				return context.Cause(ctx)
+				return ctx.Err()
 			case <-time.After(time.Duration(try*120) * time.Millisecond):
 				try++
 				continue

driver/docker/driver.go

@@ -29,7 +29,7 @@ func (d *Driver) Bootstrap(ctx context.Context, l progress.Logger) error {
 func (d *Driver) Info(ctx context.Context) (*driver.Info, error) {
 	_, err := d.DockerAPI.ServerVersion(ctx)
 	if err != nil {
-		return nil, errors.Wrap(driver.ErrNotConnecting{}, err.Error())
+		return nil, errors.Wrapf(driver.ErrNotConnecting{}, err.Error())
 	}
 	return &driver.Info{
 		Status: driver.Running,
@@ -39,7 +39,7 @@ func (d *Driver) Info(ctx context.Context) (*driver.Info, error) {
 func (d *Driver) Version(ctx context.Context) (string, error) {
 	v, err := d.DockerAPI.ServerVersion(ctx)
 	if err != nil {
-		return "", errors.Wrap(driver.ErrNotConnecting{}, err.Error())
+		return "", errors.Wrapf(driver.ErrNotConnecting{}, err.Error())
 	}
 	if bkversion, _ := resolveBuildKitVersion(v.Version); bkversion != "" {
 		return bkversion, nil

driver/docker/version.go

@@ -176,6 +176,11 @@ func resolveBuildKitVersion(ver string) (string, error) {
 		if err != nil {
 			return "", err
 		}
+		//if _, errs := c.Validate(mobyVersion); len(errs) > 0 {
+		//	for _, err := range errs {
+		//		fmt.Printf("%s: %v\n", m.MobyVersionConstraint, err)
+		//	}
+		//}
 		if !c.Check(mobyVersion) {
 			continue
 		}

driver/kubernetes/context/endpoint_test.go

@@ -191,7 +191,7 @@ func checkClientConfig(t *testing.T, ep Endpoint, server, namespace string, ca,
 		require.NoError(t, err)
 		assert.Equal(t, proxyURLString, proxyURL.String())
 	} else {
-		assert.Nil(t, cfg.Proxy, "expected proxy to be nil, but is not nil instead")
+		assert.True(t, cfg.Proxy == nil, "expected proxy to be nil, but is not nil instead")
 	}
 }
 
@@ -224,7 +224,7 @@ func TestSaveLoadGKEConfig(t *testing.T) {
 	persistedMetadata, err := store.GetMetadata("gke-context")
 	require.NoError(t, err)
 	persistedEPMeta := EndpointFromContext(persistedMetadata)
-	assert.NotNil(t, persistedEPMeta)
+	assert.True(t, persistedEPMeta != nil)
 	persistedEP, err := persistedEPMeta.WithTLSData(store, "gke-context")
 	require.NoError(t, err)
 	persistedCfg := persistedEP.KubernetesConfig()
@@ -249,7 +249,7 @@ func TestSaveLoadEKSConfig(t *testing.T) {
 	persistedMetadata, err := store.GetMetadata("eks-context")
 	require.NoError(t, err)
 	persistedEPMeta := EndpointFromContext(persistedMetadata)
-	assert.NotNil(t, persistedEPMeta)
+	assert.True(t, persistedEPMeta != nil)
 	persistedEP, err := persistedEPMeta.WithTLSData(store, "eks-context")
 	require.NoError(t, err)
 	persistedCfg := persistedEP.KubernetesConfig()
@@ -274,14 +274,14 @@ func TestSaveLoadK3SConfig(t *testing.T) {
 	persistedMetadata, err := store.GetMetadata("k3s-context")
 	require.NoError(t, err)
 	persistedEPMeta := EndpointFromContext(persistedMetadata)
-	assert.NotNil(t, persistedEPMeta)
+	assert.True(t, persistedEPMeta != nil)
 	persistedEP, err := persistedEPMeta.WithTLSData(store, "k3s-context")
 	require.NoError(t, err)
 	persistedCfg := persistedEP.KubernetesConfig()
 	actualCfg, err := persistedCfg.ClientConfig()
 	require.NoError(t, err)
-	assert.Greater(t, len(actualCfg.Username), 0)
+	assert.True(t, len(actualCfg.Username) > 0)
-	assert.Greater(t, len(actualCfg.Password), 0)
+	assert.True(t, len(actualCfg.Password) > 0)
 	assert.Equal(t, expectedCfg.Username, actualCfg.Username)
 	assert.Equal(t, expectedCfg.Password, actualCfg.Password)
 }

driver/kubernetes/driver.go

@@ -112,7 +112,7 @@ func (d *Driver) wait(ctx context.Context) error {
 	for {
 		select {
 		case <-ctx.Done():
-			return context.Cause(ctx)
+			return ctx.Err()
 		case <-timeoutChan:
 			return err
 		case <-ticker.C:

driver/remote/driver.go

@@ -47,9 +47,8 @@ func (d *Driver) Bootstrap(ctx context.Context, l progress.Logger) error {
 		return err
 	}
 	return progress.Wrap("[internal] waiting for connection", l, func(_ progress.SubLogger) error {
-		cancelCtx, cancel := context.WithCancelCause(ctx)
+		ctx, cancel := context.WithTimeout(ctx, 20*time.Second)
-		ctx, _ := context.WithTimeoutCause(cancelCtx, 20*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet,lostcancel // no need to manually cancel this context as we already rely on parent
+		defer cancel()
-		defer func() { cancel(errors.WithStack(context.Canceled)) }()
 		return c.Wait(ctx)
 	})
 }

go.mod

@@ -6,19 +6,19 @@ require (
 	github.com/Masterminds/semver/v3 v3.2.1
 	github.com/Microsoft/go-winio v0.6.2
 	github.com/aws/aws-sdk-go-v2/config v1.26.6
-	github.com/compose-spec/compose-go/v2 v2.4.4
+	github.com/compose-spec/compose-go/v2 v2.4.1
 	github.com/containerd/console v1.0.4
-	github.com/containerd/containerd v1.7.24
+	github.com/containerd/containerd v1.7.22
-	github.com/containerd/continuity v0.4.5
+	github.com/containerd/continuity v0.4.4
-	github.com/containerd/errdefs v0.3.0
+	github.com/containerd/errdefs v0.1.0
 	github.com/containerd/log v0.1.0
 	github.com/containerd/platforms v0.2.1
-	github.com/containerd/typeurl/v2 v2.2.3
+	github.com/containerd/typeurl/v2 v2.2.0
 	github.com/creack/pty v1.1.21
 	github.com/distribution/reference v0.6.0
-	github.com/docker/cli v27.4.0-rc.2+incompatible
+	github.com/docker/cli v27.3.1+incompatible
 	github.com/docker/cli-docs-tool v0.8.0
-	github.com/docker/docker v27.4.0-rc.2+incompatible
+	github.com/docker/docker v27.3.1+incompatible
 	github.com/docker/go-units v0.5.0
 	github.com/gofrs/flock v0.12.1
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
@@ -27,7 +27,7 @@ require (
 	github.com/hashicorp/hcl/v2 v2.20.1
 	github.com/in-toto/in-toto-golang v0.5.0
 	github.com/mitchellh/hashstructure/v2 v2.0.2
-	github.com/moby/buildkit v0.18.0
+	github.com/moby/buildkit v0.17.0
 	github.com/moby/sys/mountinfo v0.7.2
 	github.com/moby/sys/signal v0.7.1
 	github.com/morikuni/aec v1.0.0
@@ -41,19 +41,19 @@ require (
 	github.com/spf13/cobra v1.8.1
 	github.com/spf13/pflag v1.0.5
 	github.com/stretchr/testify v1.9.0
-	github.com/tonistiigi/fsutil v0.0.0-20241121093142-31cf1f437184
+	github.com/tonistiigi/fsutil v0.0.0-20241028165955-397af5306b5c
 	github.com/tonistiigi/go-csvvalue v0.0.0-20240710180619-ddb21b71c0b4
 	github.com/zclconf/go-cty v1.14.4
-	go.opentelemetry.io/otel v1.28.0
+	go.opentelemetry.io/otel v1.21.0
-	go.opentelemetry.io/otel/metric v1.28.0
+	go.opentelemetry.io/otel/metric v1.21.0
-	go.opentelemetry.io/otel/sdk v1.28.0
+	go.opentelemetry.io/otel/sdk v1.21.0
-	go.opentelemetry.io/otel/trace v1.28.0
+	go.opentelemetry.io/otel/trace v1.21.0
 	golang.org/x/mod v0.21.0
 	golang.org/x/sync v0.8.0
 	golang.org/x/sys v0.26.0
 	golang.org/x/term v0.24.0
 	golang.org/x/text v0.18.0
-	google.golang.org/grpc v1.66.3
+	google.golang.org/grpc v1.66.2
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1
 	google.golang.org/protobuf v1.35.1
 	gopkg.in/yaml.v3 v3.0.1
@@ -82,7 +82,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/sts v1.26.7 // indirect
 	github.com/aws/smithy-go v1.19.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/containerd/containerd/api v1.7.19 // indirect
 	github.com/containerd/ttrpc v1.2.5 // indirect
@@ -96,7 +96,7 @@ require (
 	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fvbommel/sortorder v1.0.1 // indirect
-	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-logr/logr v1.4.1 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/jsonpointer v0.19.6 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
@@ -109,7 +109,7 @@ require (
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/gorilla/websocket v1.5.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
@@ -121,6 +121,7 @@ require (
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-runewidth v0.0.15 // indirect
 	github.com/mattn/go-shellwords v1.0.12 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
 	github.com/miekg/pkcs11 v1.1.1 // indirect
 	github.com/mitchellh/go-wordwrap v0.0.0-20150314170334-ad45545899c7 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
@@ -137,9 +138,9 @@ require (
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/prometheus/client_golang v1.20.2 // indirect
+	github.com/prometheus/client_golang v1.17.0 // indirect
-	github.com/prometheus/client_model v0.6.1 // indirect
+	github.com/prometheus/client_model v0.5.0 // indirect
-	github.com/prometheus/common v0.55.0 // indirect
+	github.com/prometheus/common v0.44.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/rivo/uniseg v0.2.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
@@ -154,14 +155,14 @@ require (
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.46.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.46.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v0.44.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v0.44.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.28.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.28.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.21.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.28.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.21.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.3.1 // indirect
+	go.opentelemetry.io/proto/otlp v1.0.0 // indirect
 	golang.org/x/crypto v0.27.0 // indirect
 	golang.org/x/exp v0.0.0-20240909161429-701f63a606c0 // indirect
 	golang.org/x/net v0.29.0 // indirect
@@ -169,8 +170,8 @@ require (
 	golang.org/x/time v0.6.0 // indirect
 	golang.org/x/tools v0.25.0 // indirect
 	google.golang.org/genproto v0.0.0-20240123012728-ef4313101c80 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240701130421-f6361c86f094 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20240604185151-ef581f913117 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240604185151-ef581f913117 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	k8s.io/klog/v2 v2.110.1 // indirect

go.sum

@@ -14,8 +14,8 @@ github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0
 github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/Microsoft/hcsshim v0.12.8 h1:BtDWYlFMcWhorrvSSo2M7z0csPdw6t7no/C3FsSvqiI=
+github.com/Microsoft/hcsshim v0.12.5 h1:bpTInLlDy/nDRWFVcefDZZ1+U8tS+rz3MxjKgu9boo0=
-github.com/Microsoft/hcsshim v0.12.8/go.mod h1:cibQ4BqhJ32FXDwPdQhKhwrwophnh3FuT4nwQZF907w=
+github.com/Microsoft/hcsshim v0.12.5/go.mod h1:tIUGego4G1EN5Hb6KC90aDYiUI2dqLSTTOCjVNpOgZ8=
 github.com/Shopify/logrus-bugsnag v0.0.0-20170309145241-6dbc35f2c30d/go.mod h1:HI8ITrYtUY+O+ZhtlqUnD8+KwNPOyugEhfP9fdUIaEQ=
 github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d h1:UrqY+r/OJnIp5u0s1SbQ8dVfLCZJsnvazdBP5hS4iRs=
 github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d/go.mod h1:HI8ITrYtUY+O+ZhtlqUnD8+KwNPOyugEhfP9fdUIaEQ=
@@ -73,8 +73,8 @@ github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b h1:otBG+dV+YK+Soembj
 github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b/go.mod h1:obH5gd0BsqsP2LwDJ9aOkm/6J86V6lyAXCoQWGw3K50=
 github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0 h1:nvj0OLI3YqYXer/kZD8Ri1aaunCxIEsOst1BVJswV0o=
 github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0/go.mod h1:D/8v3kj0zr8ZAKg1AQ6crr+5VwKN5eIywRkfhyM/+dE=
-github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
-github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cloudflare/cfssl v0.0.0-20180223231731-4e2dcbde5004 h1:lkAMpLVBDaj17e85keuznYcH5rqI438v41pKcBl4ZxQ=
@@ -83,21 +83,21 @@ github.com/cncf/xds/go v0.0.0-20240423153145-555b57ec207b h1:ga8SEFjZ60pxLcmhnTh
 github.com/cncf/xds/go v0.0.0-20240423153145-555b57ec207b/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
 github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb h1:EDmT6Q9Zs+SbUoc7Ik9EfrFqcylYqgPZ9ANSbTAntnE=
 github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb/go.mod h1:ZjrT6AXHbDs86ZSdt/osfBi5qfexBrKUdONk989Wnk4=
-github.com/compose-spec/compose-go/v2 v2.4.4 h1:cvHBl5Jf1iNBmRrZCICmHvaoskYc1etTPEMLKVwokAY=
+github.com/compose-spec/compose-go/v2 v2.4.1 h1:tEg6Qn/9LZnKg42fZlFmxN4lxSqnCvsiG5TXnxzvI4c=
-github.com/compose-spec/compose-go/v2 v2.4.4/go.mod h1:lFN0DrMxIncJGYAXTfWuajfwj5haBJqrBkarHcnjJKc=
+github.com/compose-spec/compose-go/v2 v2.4.1/go.mod h1:lFN0DrMxIncJGYAXTfWuajfwj5haBJqrBkarHcnjJKc=
 github.com/containerd/cgroups v1.1.0 h1:v8rEWFl6EoqHB+swVNjVoCJE8o3jX7e8nqBGPLaDFBM=
-github.com/containerd/cgroups/v3 v3.0.3 h1:S5ByHZ/h9PMe5IOQoN7E+nMc2UcLEM/V48DGDJ9kip0=
+github.com/containerd/cgroups/v3 v3.0.2 h1:f5WFqIVSgo5IZmtTT3qVBo6TzI1ON6sycSBKkymb9L0=
-github.com/containerd/cgroups/v3 v3.0.3/go.mod h1:8HBe7V3aWGLFPd/k03swSIsGjZhHI2WzJmticMgVuz0=
+github.com/containerd/cgroups/v3 v3.0.2/go.mod h1:JUgITrzdFqp42uI2ryGA+ge0ap/nxzYgkGmIcetmErE=
 github.com/containerd/console v1.0.4 h1:F2g4+oChYvBTsASRTz8NP6iIAi97J3TtSAsLbIFn4ro=
 github.com/containerd/console v1.0.4/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
-github.com/containerd/containerd v1.7.24 h1:zxszGrGjrra1yYJW/6rhm9cJ1ZQ8rkKBR48brqsa7nA=
+github.com/containerd/containerd v1.7.22 h1:nZuNnNRA6T6jB975rx2RRNqqH2k6ELYKDZfqTHqwyy0=
-github.com/containerd/containerd v1.7.24/go.mod h1:7QUzfURqZWCZV7RLNEn1XjUCQLEf0bkaK4GjUaZehxw=
+github.com/containerd/containerd v1.7.22/go.mod h1:e3Jz1rYRUZ2Lt51YrH9Rz0zPyJBOlSvB3ghr2jbVD8g=
 github.com/containerd/containerd/api v1.7.19 h1:VWbJL+8Ap4Ju2mx9c9qS1uFSB1OVYr5JJrW2yT5vFoA=
 github.com/containerd/containerd/api v1.7.19/go.mod h1:fwGavl3LNwAV5ilJ0sbrABL44AQxmNjDRcwheXDb6Ig=
-github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4=
+github.com/containerd/continuity v0.4.4 h1:/fNVfTJ7wIl/YPMHjf+5H32uFhl63JucB34PlCpMKII=
-github.com/containerd/continuity v0.4.5/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
+github.com/containerd/continuity v0.4.4/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
-github.com/containerd/errdefs v0.3.0 h1:FSZgGOeK4yuT/+DnF07/Olde/q4KBoMsaamhXxIMDp4=
+github.com/containerd/errdefs v0.1.0 h1:m0wCRBiu1WJT/Fr+iOoQHMQS/eP5myQ8lCv4Dz5ZURM=
-github.com/containerd/errdefs v0.3.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs v0.1.0/go.mod h1:YgWiiHtLmSeBrvpw+UfPijzbLaB77mEG1WwJTDETIV0=
 github.com/containerd/fifo v1.1.0 h1:4I2mbh5stb1u6ycIABlBw9zgtlK8viPI9QkQNRQEEmY=
 github.com/containerd/fifo v1.1.0/go.mod h1:bmC4NWMbXlt2EZ0Hc7Fx7QzTFxgPID13eH0Qu+MAb2o=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
@@ -111,8 +111,8 @@ github.com/containerd/stargz-snapshotter/estargz v0.15.1 h1:eXJjw9RbkLFgioVaTG+G
 github.com/containerd/stargz-snapshotter/estargz v0.15.1/go.mod h1:gr2RNwukQ/S9Nv33Lt6UC7xEx58C+LHRdoqbEKjz1Kk=
 github.com/containerd/ttrpc v1.2.5 h1:IFckT1EFQoFBMG4c3sMdT8EP3/aKfumK1msY+Ze4oLU=
 github.com/containerd/ttrpc v1.2.5/go.mod h1:YCXHsb32f+Sq5/72xHubdiJRQY9inL4a4ZQrAbN1q9o=
-github.com/containerd/typeurl/v2 v2.2.3 h1:yNA/94zxWdvYACdYO8zofhrTVuQY73fFU1y++dYSw40=
+github.com/containerd/typeurl/v2 v2.2.0 h1:6NBDbQzr7I5LHgp34xAXYF5DOTQDn05X58lsPEmzLso=
-github.com/containerd/typeurl/v2 v2.2.3/go.mod h1:95ljDnPfD3bAbDJRugOiShd/DlAAsxGtUBhJxIn7SCk=
+github.com/containerd/typeurl/v2 v2.2.0/go.mod h1:8XOOxnyatxSWuG8OfsZXVnAF4iZfedjS/8UHSPJnX4g=
 github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/cpuguy83/go-md2man/v2 v2.0.5 h1:ZtcqGrnekaHpVLArFSe4HK5DoKx1T0rq2DwVB0alcyc=
 github.com/cpuguy83/go-md2man/v2 v2.0.5/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
@@ -125,15 +125,15 @@ github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/denisenkom/go-mssqldb v0.0.0-20191128021309-1d7a30a10f73/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/cli v27.4.0-rc.2+incompatible h1:A0GZwegDlt2wdt3tpmrUzkVOZmbhvd7i05wPSf7Oo74=
+github.com/docker/cli v27.3.1+incompatible h1:qEGdFBF3Xu6SCvCYhc7CzaQTlBmqDuzxPDpigSyeKQQ=
-github.com/docker/cli v27.4.0-rc.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v27.3.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/cli-docs-tool v0.8.0 h1:YcDWl7rQJC3lJ7WVZRwSs3bc9nka97QLWfyJQli8yJU=
 github.com/docker/cli-docs-tool v0.8.0/go.mod h1:8TQQ3E7mOXoYUs811LiPdUnAhXrcVsBIrW21a5pUbdk=
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v27.4.0-rc.2+incompatible h1:9OJjVGtelk/zGC3TyKweJ29b9Axzh0s/0vtU4mneumE=
+github.com/docker/docker v27.3.1+incompatible h1:KttF0XoteNTicmUtBO0L2tP+J7FGRFTjaEF4k6WdhfI=
-github.com/docker/docker v27.4.0-rc.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v27.3.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
 github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
 github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c h1:lzqkGL9b3znc+ZUgi7FlLnqjQhcXxkNM/quxIjBVMD0=
@@ -166,8 +166,8 @@ github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.3.0/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
-github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
@@ -192,6 +192,8 @@ github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7a
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
+github.com/golang/glog v1.2.1 h1:OptwRhECazUx5ix5TTWC3EZhsZEHWcYWY4FQHTIubm4=
+github.com/golang/glog v1.2.1/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/protobuf v1.1.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
@@ -226,8 +228,8 @@ github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWS
 github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc=
 github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 h1:bkypFPDjIYGfCYD5mRBvpqxfYX1YCS1PXdKYWi8FsN0=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 h1:YBftPWNWd4WwGqtY2yeZL2ef8rHAxPBD8KFhJpmcqms=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0/go.mod h1:P+Lt/0by1T8bfcF3z737NnSbmxQAppXMRziHUxPOC8k=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0/go.mod h1:YN5jB8ie0yfIUg6VvR9Kz84aCaG7AsGZnLjhHbUqwPg=
 github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed h1:5upAirOpQc1Q53c0bnx2ufif5kANL7bfZWcc6VJWJd8=
 github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -277,8 +279,6 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
-github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/lib/pq v0.0.0-20150723085316-0dad96c0b94f/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/magiconair/properties v1.5.3 h1:C8fxWnhYyME3n0klPOhVM7PtYUB3eV1W3DeFmN3j53Y=
 github.com/magiconair/properties v1.5.3/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
@@ -290,6 +290,8 @@ github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebG
 github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
 github.com/mattn/go-sqlite3 v1.6.0/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
+github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
+github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
 github.com/miekg/pkcs11 v1.0.2/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
 github.com/miekg/pkcs11 v1.1.1 h1:Ugu9pdy6vAYku5DEpVWVFPYnzV+bxB+iRdbuFSu7TvU=
 github.com/miekg/pkcs11 v1.1.1/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
@@ -301,8 +303,8 @@ github.com/mitchellh/hashstructure/v2 v2.0.2/go.mod h1:MG3aRVU/N29oo/V/IhBX8GR/z
 github.com/mitchellh/mapstructure v0.0.0-20150613213606-2caf8efc9366/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/moby/buildkit v0.18.0 h1:KSelhNINJcNA3FCWBbGCytvicjP+kjU5kZlZhkTUkVo=
+github.com/moby/buildkit v0.17.0 h1:ZA/4AxwBbve1f3ZaNNJQiCBtTV62R6YweWNwq4A+sTc=
-github.com/moby/buildkit v0.18.0/go.mod h1:vCR5CX8NGsPTthTg681+9kdmfvkvqJBXEv71GZe5msU=
+github.com/moby/buildkit v0.17.0/go.mod h1:ru8NFyDHD8HbuKaLXJIjK9nr3x6FZR+IWjtF07S+wdM=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
@@ -373,18 +375,18 @@ github.com/prometheus/client_golang v0.9.0-pre1.0.20180209125602-c332b6f63c06/go
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQP1xR9D75/vuwEF3g=
-github.com/prometheus/client_golang v1.20.2 h1:5ctymQzZlyOON1666svgwn3s6IKWgfbjsejTMiXIyjg=
+github.com/prometheus/client_golang v1.17.0 h1:rl2sfwZMtSthVU752MqfjQozy7blglC+1SOtjMAMh+Q=
-github.com/prometheus/client_golang v1.20.2/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
+github.com/prometheus/client_golang v1.17.0/go.mod h1:VeL+gMmOAxkS2IqfCq0ZmHSL+LjWfWDUmp1mBz9JgUY=
 github.com/prometheus/client_model v0.0.0-20171117100541-99fa1f4be8e5/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
+github.com/prometheus/client_model v0.5.0 h1:VQw1hfvPvk3Uv6Qf29VrPF32JB6rtbgI6cYPYQjL0Qw=
-github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
+github.com/prometheus/client_model v0.5.0/go.mod h1:dTiFglRmd66nLR9Pv9f0mZi7B7fk5Pm3gvsjB5tr+kI=
 github.com/prometheus/common v0.0.0-20180110214958-89604d197083/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+Zk0j9GMYc=
-github.com/prometheus/common v0.55.0 h1:KEi6DK7lXW/m7Ig5i47x0vRzuBsHuvJdi5ee6Y3G1dc=
+github.com/prometheus/common v0.44.0 h1:+5BrQJwiBB9xsMygAB3TNvpQKOwlkc25LbISbrdOOfY=
-github.com/prometheus/common v0.55.0/go.mod h1:2SECS4xJG1kd8XF9IcM1gMX6510RAEL65zxzNImwdc8=
+github.com/prometheus/common v0.44.0/go.mod h1:ofAIvZbQ1e/nugmZGz4/qCb9Ap1VoSTIO7x0VV9VvuY=
 github.com/prometheus/procfs v0.0.0-20180125133057-cb4147076ac7/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
@@ -393,8 +395,8 @@ github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0leargg
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
 github.com/rivo/uniseg v0.2.0 h1:S1pD9weZBuJdFmowNwbpi7BJ8TNftyUImj/0WQi72jY=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
-github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
+github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
-github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
+github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/secure-systems-lab/go-securesystemslib v0.4.0 h1:b23VGrQhTA8cN2CbBw7/FulN9fTtqYUdS5+Oxzt+DUE=
@@ -441,8 +443,8 @@ github.com/theupdateframework/notary v0.7.0 h1:QyagRZ7wlSpjT5N2qQAh/pN+DVqgekv4D
 github.com/theupdateframework/notary v0.7.0/go.mod h1:c9DRxcmhHmVLDay4/2fUYdISnHqbFDGRSlXPO0AhYWw=
 github.com/tonistiigi/dchapes-mode v0.0.0-20241001053921-ca0759fec205 h1:eUk79E1w8yMtXeHSzjKorxuC8qJOnyXQnLaJehxpJaI=
 github.com/tonistiigi/dchapes-mode v0.0.0-20241001053921-ca0759fec205/go.mod h1:3Iuxbr0P7D3zUzBMAZB+ois3h/et0shEz0qApgHYGpY=
-github.com/tonistiigi/fsutil v0.0.0-20241121093142-31cf1f437184 h1:RgyoSI38Y36zjQaszel/0RAcIehAnjA1B0RiUV9SDO4=
+github.com/tonistiigi/fsutil v0.0.0-20241028165955-397af5306b5c h1:bQLsfX+uEPZUjyR2qmoJs5F8Z57bPVmF3IsUf22Xo9Y=
-github.com/tonistiigi/fsutil v0.0.0-20241121093142-31cf1f437184/go.mod h1:Dl/9oEjK7IqnjAm21Okx/XIxUCFJzvh+XdVHUlBwXTw=
+github.com/tonistiigi/fsutil v0.0.0-20241028165955-397af5306b5c/go.mod h1:Dl/9oEjK7IqnjAm21Okx/XIxUCFJzvh+XdVHUlBwXTw=
 github.com/tonistiigi/go-csvvalue v0.0.0-20240710180619-ddb21b71c0b4 h1:7I5c2Ig/5FgqkYOh/N87NzoyI9U15qUPXhDD8uCupv8=
 github.com/tonistiigi/go-csvvalue v0.0.0-20240710180619-ddb21b71c0b4/go.mod h1:278M4p8WsNh3n4a1eqiFcV2FGk7wE5fwUpUom9mK9lE=
 github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea h1:SXhTLE6pb6eld/v/cCndK0AMpt1wiVFb/YYmqB3/QG0=
@@ -472,30 +474,30 @@ go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.4
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.46.1/go.mod h1:4UoMYEZOC0yN/sPGH76KPkkU7zgiEWYWL9vwmbnTJPE=
 go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.46.1 h1:gbhw/u49SS3gkPWiYweQNJGm/uJN5GkI/FrosxSHT7A=
 go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.46.1/go.mod h1:GnOaBaFQ2we3b9AGWJpsBa7v1S5RlQzlC3O7dRMxZhM=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0 h1:4K4tsIXefpVJtvA/8srF4V4y0akAoPHkIslgAkjixJA=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 h1:aFJWCqJMNjENlcleuuOkGAPH82y0yULBScfXcIEdS24=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0/go.mod h1:jjdQuTGVsXV4vSs+CJ2qYDeDPf9yIJV23qlIzBm73Vg=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1/go.mod h1:sEGXWArGqc3tVa+ekntsN65DmVbVeW+7lTKTjZF3/Fo=
-go.opentelemetry.io/otel v1.28.0 h1:/SqNcYk+idO0CxKEUOtKQClMK/MimZihKYMruSMViUo=
+go.opentelemetry.io/otel v1.21.0 h1:hzLeKBZEL7Okw2mGzZ0cc4k/A7Fta0uoPgaJCr8fsFc=
-go.opentelemetry.io/otel v1.28.0/go.mod h1:q68ijF8Fc8CnMHKyzqL6akLO46ePnjkgfIMIjUIX9z4=
+go.opentelemetry.io/otel v1.21.0/go.mod h1:QZzNPQPm1zLX4gZK4cMi+71eaorMSGT3A4znnUvNNEo=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v0.44.0 h1:jd0+5t/YynESZqsSyPz+7PAFdEop0dlN0+PkyHYo8oI=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v0.44.0/go.mod h1:U707O40ee1FpQGyhvqnzmCJm1Wh6OX6GGBVn0E6Uyyk=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v0.44.0 h1:bflGWrfYyuulcdxf14V6n9+CoQcu5SAAdHmDPAJnlps=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v0.44.0/go.mod h1:qcTO4xHAxZLaLxPd60TdE88rxtItPHgHWqOhOGRr0as=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0 h1:3Q/xZUyC1BBkualc9ROb4G8qkH90LXEIICcs5zv1OYY=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 h1:cl5P5/GIfFh4t6xyruOgJP5QiA1pw4fYYdv6nc6CBWw=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0/go.mod h1:s75jGIWA9OfCMzF0xr+ZgfrB5FEbbV7UuYo32ahUiFI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0/go.mod h1:zgBdWWAu7oEEMC06MMKc5NLbA/1YDXV1sMpSqEeLQLg=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.28.0 h1:R3X6ZXmNPRR8ul6i3WgFURCHzaXjHdm0karRG/+dj3s=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0 h1:tIqheXEFWAZ7O8A7m+J0aPTmpJN3YQ7qetUAdkkkKpk=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.28.0/go.mod h1:QWFXnDavXWwMx2EEcZsf3yxgEKAqsxQ+Syjp+seyInw=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0/go.mod h1:nUeKExfxAQVbiVFn32YXpXZZHZ61Cc3s3Rn1pDBGAb0=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.28.0 h1:j9+03ymgYhPKmeXGk5Zu+cIZOlVzd9Zv7QIiyItjFBU=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.21.0 h1:digkEZCJWobwBqMwC0cwCq8/wkkRy/OowZg5OArWZrM=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.28.0/go.mod h1:Y5+XiUG4Emn1hTfciPzGPJaSI+RpDts6BnCIir0SLqk=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.21.0/go.mod h1:/OpE/y70qVkndM0TrxT4KBoN3RsFZP0QaofcfYrj76I=
-go.opentelemetry.io/otel/metric v1.28.0 h1:f0HGvSl1KRAU1DLgLGFjrwVyismPlnuU6JD6bOeuA5Q=
+go.opentelemetry.io/otel/metric v1.21.0 h1:tlYWfeo+Bocx5kLEloTjbcDwBuELRrIFxwdQ36PlJu4=
-go.opentelemetry.io/otel/metric v1.28.0/go.mod h1:Fb1eVBFZmLVTMb6PPohq3TO9IIhUisDsbJoL/+uQW4s=
+go.opentelemetry.io/otel/metric v1.21.0/go.mod h1:o1p3CA8nNHW8j5yuQLdc1eeqEaPfzug24uvsyIEJRWM=
-go.opentelemetry.io/otel/sdk v1.28.0 h1:b9d7hIry8yZsgtbmM0DKyPWMMUMlK9NEKuIG4aBqWyE=
+go.opentelemetry.io/otel/sdk v1.21.0 h1:FTt8qirL1EysG6sTQRZ5TokkU8d0ugCj8htOgThZXQ8=
-go.opentelemetry.io/otel/sdk v1.28.0/go.mod h1:oYj7ClPUA7Iw3m+r7GeEjz0qckQRJK2B8zjcZEfu7Pg=
+go.opentelemetry.io/otel/sdk v1.21.0/go.mod h1:Nna6Yv7PWTdgJHVRD9hIYywQBRx7pbox6nwBnZIxl/E=
-go.opentelemetry.io/otel/sdk/metric v1.28.0 h1:OkuaKgKrgAbYrrY0t92c+cC+2F6hsFNnCQArXCKlg08=
+go.opentelemetry.io/otel/sdk/metric v1.21.0 h1:smhI5oD714d6jHE6Tie36fPx4WDFIg+Y6RfAY4ICcR0=
-go.opentelemetry.io/otel/sdk/metric v1.28.0/go.mod h1:cWPjykihLAPvXKi4iZc1dpER3Jdq2Z0YLse3moQUCpg=
+go.opentelemetry.io/otel/sdk/metric v1.21.0/go.mod h1:FJ8RAsoPGv/wYMgBdUJXOm+6pzFY3YdljnXtv1SBE8Q=
-go.opentelemetry.io/otel/trace v1.28.0 h1:GhQ9cUuQGmNDd5BTCP2dAvv75RdMxEfTmYejp+lkx9g=
+go.opentelemetry.io/otel/trace v1.21.0 h1:WD9i5gzvoUPuXIXH24ZNBudiarZDKuekPqi/E8fpfLc=
-go.opentelemetry.io/otel/trace v1.28.0/go.mod h1:jPyXzNPg6da9+38HEwElrQiHlVMTnVfM3/yv2OlIHaI=
+go.opentelemetry.io/otel/trace v1.21.0/go.mod h1:LGbsEB0f9LGjN+OZaQQ26sohbOmiMR+BaslueVtS/qQ=
-go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0=
+go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
-go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8=
+go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
@@ -570,13 +572,13 @@ golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8T
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/genproto v0.0.0-20240123012728-ef4313101c80 h1:KAeGQVN3M9nD0/bQXnr/ClcEMJ968gUXJQ9pwfSynuQ=
 google.golang.org/genproto v0.0.0-20240123012728-ef4313101c80/go.mod h1:cc8bqMqtv9gMOr0zHg2Vzff5ULhhL2IXP4sbcn32Dro=
-google.golang.org/genproto/googleapis/api v0.0.0-20240701130421-f6361c86f094 h1:0+ozOGcrp+Y8Aq8TLNN2Aliibms5LEzsq99ZZmAGYm0=
+google.golang.org/genproto/googleapis/api v0.0.0-20240604185151-ef581f913117 h1:+rdxYoE3E5htTEWIe15GlN6IfvbURM//Jt0mmkmm6ZU=
-google.golang.org/genproto/googleapis/api v0.0.0-20240701130421-f6361c86f094/go.mod h1:fJ/e3If/Q67Mj99hin0hMhiNyCRmt6BQ2aWIJshUSJw=
+google.golang.org/genproto/googleapis/api v0.0.0-20240604185151-ef581f913117/go.mod h1:OimBR/bc1wPO9iV4NC2bpyjy3VnAwZh5EBPQdtaE5oo=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 h1:BwIjyKYGsK9dMCBOorzRri8MQwmi7mT9rGHsCEinZkA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240604185151-ef581f913117 h1:1GBuWVLM/KMVUv1t1En5Gs+gFZCNd360GGb4sSxtrhU=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240604185151-ef581f913117/go.mod h1:EfXuqaE1J41VCDicxHzUDm+8rk+7ZdXzHV0IhO/I6s0=
 google.golang.org/grpc v1.0.5/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
-google.golang.org/grpc v1.66.3 h1:TWlsh8Mv0QI/1sIbs1W36lqRclxrmF+eFJ4DbI0fuhA=
+google.golang.org/grpc v1.66.2 h1:3QdXkuq3Bkh7w+ywLdLvM56cmGvQHUMZpiCzt6Rqaoo=
-google.golang.org/grpc v1.66.3/go.mod h1:s3/l6xSSCURdVfAnL+TqCNMyTDAGN6+lZeVxnZR128Y=
+google.golang.org/grpc v1.66.2/go.mod h1:s3/l6xSSCURdVfAnL+TqCNMyTDAGN6+lZeVxnZR128Y=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 h1:F29+wU6Ee6qgu9TddPgooOdaqsxTMunOoj8KA5yuS5A=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1/go.mod h1:5KF+wpkbTSbGcR9zteSqZV6fqFOWBl4Yde8En8MryZA=
 google.golang.org/protobuf v1.35.1 h1:m3LfL6/Ca+fqnjnlqQXNpFPABW1UD7mjh8KO2mKFytA=

hack/dockerfiles/docs.Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-ARG GO_VERSION=1.23
+ARG GO_VERSION=1.22
 ARG FORMATS=md,yaml
 
 FROM golang:${GO_VERSION}-alpine AS docsgen

hack/dockerfiles/generated-files.Dockerfile

@@ -5,8 +5,8 @@
 # Copyright The Buildx Authors.
 # Licensed under the Apache License, Version 2.0
 
-ARG GO_VERSION=1.23
+ARG GO_VERSION="1.22"
-ARG PROTOC_VERSION=3.11.4
+ARG PROTOC_VERSION="3.11.4"
 ARG PROTOC_GOOGLEAPIS_VERSION=2af421884dd468d565137215c946ebe4e245ae26
 
 # protoc is dynamically linked to glibc so can't use alpine base

hack/dockerfiles/govulncheck.Dockerfile

@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1
 
-ARG GO_VERSION=1.23
+ARG GO_VERSION="1.22"
-ARG GOVULNCHECK_VERSION=v1.1.3
+ARG GOVULNCHECK_VERSION="v1.1.3"
 ARG FORMAT="text"
 
 FROM golang:${GO_VERSION}-alpine AS base

hack/dockerfiles/lint.Dockerfile

@@ -1,11 +1,12 @@
 # syntax=docker/dockerfile:1
 
-ARG GO_VERSION=1.23
+ARG GO_VERSION=1.22
-ARG XX_VERSION=1.5.0
+ARG XX_VERSION=1.3.0
-ARG GOLANGCI_LINT_VERSION=1.62.0
+ARG GOLANGCI_LINT_VERSION=1.57.2
-ARG GOPLS_VERSION=v0.26.0
+ARG GOPLS_VERSION=v0.20.0
 # disabled: deprecated unusedvariable simplifyrange
-ARG GOPLS_ANALYZERS="embeddirective fillreturns infertypeargs nonewvars norangeoverfunc noresultvalues simplifycompositelit simplifyslice undeclaredname unusedparams useany"
+ARG GOPLS_ANALYZERS="embeddirective fillreturns infertypeargs nonewvars noresultvalues simplifycompositelit simplifyslice stubmethods undeclaredname unusedparams useany"
+
 
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
 

hack/dockerfiles/vendor.Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-ARG GO_VERSION=1.23
+ARG GO_VERSION=1.22
 ARG MODOUTDATED_VERSION=v0.9.0
 
 FROM golang:${GO_VERSION}-alpine AS base

monitor/monitor.go

@@ -326,7 +326,7 @@ func (m *monitor) invoke(ctx context.Context, pid string, cfg *controllerapi.Inv
 	if m.AttachedSessionID() == "" {
 		return nil
 	}
-	invokeCtx, invokeCancel := context.WithCancelCause(ctx)
+	invokeCtx, invokeCancel := context.WithCancel(ctx)
 
 	containerIn, containerOut := ioset.Pipe()
 	m.invokeIO.SetOut(&containerOut)
@@ -336,7 +336,7 @@ func (m *monitor) invoke(ctx context.Context, pid string, cfg *controllerapi.Inv
 		cancelOnce.Do(func() {
 			containerIn.Close()
 			m.invokeIO.SetOut(nil)
-			invokeCancel(errors.WithStack(context.Canceled))
+			invokeCancel()
 		})
 		<-waitInvokeDoneCh
 	}

store/nodegroup_test.go

@@ -17,13 +17,13 @@ func TestNodeGroupUpdate(t *testing.T) {
 	err = ng.Update("foo1", "foo1", []string{"linux/arm64", "linux/arm/v7"}, true, true, nil, "", nil)
 	require.NoError(t, err)
 
-	require.Equal(t, 2, len(ng.Nodes))
+	require.Equal(t, len(ng.Nodes), 2)
 
 	// update
 	err = ng.Update("foo", "foo2", []string{"linux/amd64", "linux/arm"}, true, false, nil, "", nil)
 	require.NoError(t, err)
 
-	require.Equal(t, 2, len(ng.Nodes))
+	require.Equal(t, len(ng.Nodes), 2)
 	require.Equal(t, []string{"linux/amd64", "linux/arm/v7"}, platformutil.Format(ng.Nodes[0].Platforms))
 	require.Equal(t, []string{"linux/arm64"}, platformutil.Format(ng.Nodes[1].Platforms))
 
@@ -39,6 +39,6 @@ func TestNodeGroupUpdate(t *testing.T) {
 	err = ng.Leave("foo")
 	require.NoError(t, err)
 
-	require.Equal(t, 1, len(ng.Nodes))
+	require.Equal(t, len(ng.Nodes), 1)
 	require.Equal(t, []string{"linux/arm64"}, platformutil.Format(ng.Nodes[0].Platforms))
 }

store/store_test.go

@@ -7,7 +7,6 @@ import (
 
 	"github.com/docker/buildx/util/confutil"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -45,7 +44,7 @@ func TestNodeLocking(t *testing.T) {
 
 	go func() {
 		_, release, err := s.Txn()
-		assert.NoError(t, err)
+		require.NoError(t, err)
 		release()
 		close(ready)
 	}()

tests/bake.go

@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
-	"strconv"
 	"strings"
 	"testing"
 
@@ -47,14 +46,6 @@ var bakeTests = []func(t *testing.T, sb integration.Sandbox){
 	testBakeRemoteDockerfileCwd,
 	testBakeRemoteLocalContextRemoteDockerfile,
 	testBakeEmpty,
-	testBakeSetNonExistingSubdirNoParallel,
-	testBakeSetNonExistingOutsideNoParallel,
-	testBakeSetExistingOutsideNoParallel,
-	testBakeDefinitionNotExistingSubdirNoParallel,
-	testBakeDefinitionNotExistingOutsideNoParallel,
-	testBakeDefinitionExistingOutsideNoParallel,
-	testBakeDefinitionSymlinkOutsideNoParallel,
-	testBakeDefinitionSymlinkOutsideGrantedNoParallel,
 	testBakeShmSize,
 	testBakeUlimits,
 	testBakeMetadataProvenance,
@@ -72,44 +63,22 @@ var bakeTests = []func(t *testing.T, sb integration.Sandbox){
 }
 
 func testBakePrint(t *testing.T, sb integration.Sandbox) {
-	testCases := []struct {
+	dockerfile := []byte(`
-		name string
+FROM busybox
-		f    string
+ARG HELLO
-		dt   []byte
+RUN echo "Hello ${HELLO}"
-	}{
+	`)
-		{
+	bakefile := []byte(`
-			"HCL",
-			"docker-bake.hcl",
-			[]byte(`
 target "build" {
   args = {
     HELLO = "foo"
   }
 }
-`)},
+`)
-		{
-			"Compose",
-			"compose.yml",
-			[]byte(`
-services:
-  build:
-    build:
-      context: .
-      args:
-        HELLO: foo
-`)},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
 	dir := tmpdir(
 		t,
-				fstest.CreateFile(tc.f, tc.dt, 0600),
+		fstest.CreateFile("docker-bake.hcl", bakefile, 0600),
-				fstest.CreateFile("Dockerfile", []byte(`
+		fstest.CreateFile("Dockerfile", dockerfile, 0600),
-FROM busybox
-ARG HELLO
-RUN echo "Hello ${HELLO}"
-	`), 0600),
 	)
 
 	cmd := buildxCmd(sb, withDir(dir), withArgs("bake", "--print", "build"))
@@ -135,7 +104,7 @@ RUN echo "Hello ${HELLO}"
 	require.Equal(t, "Dockerfile", *def.Target["build"].Dockerfile)
 	require.Equal(t, map[string]*string{"HELLO": ptrstr("foo")}, def.Target["build"].Args)
 
-			require.JSONEq(t, `{
+	require.Equal(t, `{
   "group": {
     "default": {
       "targets": [
@@ -154,8 +123,6 @@ RUN echo "Hello ${HELLO}"
   }
 }
 `, stdout.String())
-		})
-	}
 }
 
 func testBakeLocal(t *testing.T, sb integration.Sandbox) {
@@ -517,8 +484,7 @@ EOT
 		withArgs(addr, "--set", "*.output=type=local,dest="+dirDest),
 	)
 	require.Error(t, err, out)
-	require.Contains(t, out, "Your build is requesting privileges for following possibly insecure capabilities")
+	require.Contains(t, out, "outside of the working directory, please set BAKE_ALLOW_REMOTE_FS_ACCESS")
-	require.Contains(t, out, "Read access to path ../")
 
 	out, err = bakeCmd(
 		sb,
@@ -565,8 +531,7 @@ EOT
 		withArgs(addr, "--set", "*.output=type=local,dest="+dirDest),
 	)
 	require.Error(t, err, out)
-	require.Contains(t, out, "Your build is requesting privileges for following possibly insecure capabilities")
+	require.Contains(t, out, "outside of the working directory, please set BAKE_ALLOW_REMOTE_FS_ACCESS")
-	require.Contains(t, out, "Read access to path ..")
 
 	out, err = bakeCmd(
 		sb,
@@ -714,261 +679,6 @@ target "default" {
 	require.Contains(t, string(dt), `size=131072k`)
 }
 
-func testBakeSetNonExistingSubdirNoParallel(t *testing.T, sb integration.Sandbox) {
-	for _, ent := range []bool{true, false} {
-		t.Run(fmt.Sprintf("ent=%v", ent), func(t *testing.T) {
-			t.Setenv("BUILDX_BAKE_ENTITLEMENTS_FS", strconv.FormatBool(ent))
-			dockerfile := []byte(`
-FROM scratch
-COPY foo /foo
-	`)
-			bakefile := []byte(`
-target "default" {
-}
-`)
-			dir := tmpdir(
-				t,
-				fstest.CreateFile("docker-bake.hcl", bakefile, 0600),
-				fstest.CreateFile("Dockerfile", dockerfile, 0600),
-				fstest.CreateFile("foo", []byte("foo"), 0600),
-			)
-
-			cmd := buildxCmd(sb, withDir(dir), withArgs("bake", "--progress=plain", "--set", "*.output=type=local,dest="+filepath.Join(dir, "not/exists")))
-			out, err := cmd.CombinedOutput()
-			require.NoError(t, err, string(out))
-			require.Contains(t, string(out), `#1 [internal] load local bake definitions`)
-			require.Contains(t, string(out), `#1 reading docker-bake.hcl`)
-
-			require.FileExists(t, filepath.Join(dir, "not/exists/foo"))
-		})
-	}
-}
-func testBakeSetNonExistingOutsideNoParallel(t *testing.T, sb integration.Sandbox) {
-	for _, ent := range []bool{true, false} {
-		t.Run(fmt.Sprintf("ent=%v", ent), func(t *testing.T) {
-			t.Setenv("BUILDX_BAKE_ENTITLEMENTS_FS", strconv.FormatBool(ent))
-			dockerfile := []byte(`
-FROM scratch
-COPY foo /foo
-	`)
-			bakefile := []byte(`
-target "default" {
-}
-`)
-			dir := tmpdir(
-				t,
-				fstest.CreateFile("docker-bake.hcl", bakefile, 0600),
-				fstest.CreateFile("Dockerfile", dockerfile, 0600),
-				fstest.CreateFile("foo", []byte("foo"), 0600),
-			)
-
-			destDir := t.TempDir()
-
-			cmd := buildxCmd(sb, withDir(dir), withArgs("bake", "--progress=plain", "--set", "*.output=type=local,dest="+filepath.Join(destDir, "not/exists")))
-			out, err := cmd.CombinedOutput()
-			if ent {
-				require.Error(t, err, string(out))
-				require.Contains(t, string(out), "ERROR: additional privileges requested")
-			} else {
-				require.NoError(t, err, string(out))
-				require.FileExists(t, filepath.Join(destDir, "not/exists/foo"))
-			}
-		})
-	}
-}
-
-func testBakeSetExistingOutsideNoParallel(t *testing.T, sb integration.Sandbox) {
-	for _, ent := range []bool{true, false} {
-		t.Run(fmt.Sprintf("ent=%v", ent), func(t *testing.T) {
-			t.Setenv("BUILDX_BAKE_ENTITLEMENTS_FS", strconv.FormatBool(ent))
-			dockerfile := []byte(`
-FROM scratch
-COPY foo /foo
-	`)
-			bakefile := []byte(`
-target "default" {
-}
-`)
-			dir := tmpdir(
-				t,
-				fstest.CreateFile("docker-bake.hcl", bakefile, 0600),
-				fstest.CreateFile("Dockerfile", dockerfile, 0600),
-				fstest.CreateFile("foo", []byte("foo"), 0600),
-			)
-
-			destDir := t.TempDir()
-
-			cmd := buildxCmd(sb, withDir(dir), withArgs("bake", "--progress=plain", "--set", "*.output=type=local,dest="+destDir))
-			out, err := cmd.CombinedOutput()
-			// existing directory via --set is always allowed
-			require.NoError(t, err, string(out))
-			require.FileExists(t, filepath.Join(destDir, "foo"))
-		})
-	}
-}
-
-func testBakeDefinitionNotExistingSubdirNoParallel(t *testing.T, sb integration.Sandbox) {
-	for _, ent := range []bool{true, false} {
-		t.Run(fmt.Sprintf("ent=%v", ent), func(t *testing.T) {
-			t.Setenv("BUILDX_BAKE_ENTITLEMENTS_FS", strconv.FormatBool(ent))
-			dockerfile := []byte(`
-FROM scratch
-COPY foo /foo
-	`)
-			bakefile := []byte(`
-target "default" {
-	output = ["type=local,dest=not/exists"]
-}
-`)
-			dir := tmpdir(
-				t,
-				fstest.CreateFile("docker-bake.hcl", bakefile, 0600),
-				fstest.CreateFile("Dockerfile", dockerfile, 0600),
-				fstest.CreateFile("foo", []byte("foo"), 0600),
-			)
-
-			cmd := buildxCmd(sb, withDir(dir), withArgs("bake", "--progress=plain"))
-			out, err := cmd.CombinedOutput()
-			// subdirs of working directory are always allowed
-			require.NoError(t, err, string(out))
-			require.FileExists(t, filepath.Join(dir, "not/exists/foo"))
-		})
-	}
-}
-
-func testBakeDefinitionNotExistingOutsideNoParallel(t *testing.T, sb integration.Sandbox) {
-	for _, ent := range []bool{true, false} {
-		t.Run(fmt.Sprintf("ent=%v", ent), func(t *testing.T) {
-			t.Setenv("BUILDX_BAKE_ENTITLEMENTS_FS", strconv.FormatBool(ent))
-			dockerfile := []byte(`
-FROM scratch
-COPY foo /foo
-	`)
-			destDir := t.TempDir()
-			bakefile := []byte(fmt.Sprintf(`
-target "default" {
-	output = ["type=local,dest=%s/not/exists"]
-}
-`, destDir))
-			dir := tmpdir(
-				t,
-				fstest.CreateFile("docker-bake.hcl", bakefile, 0600),
-				fstest.CreateFile("Dockerfile", dockerfile, 0600),
-				fstest.CreateFile("foo", []byte("foo"), 0600),
-			)
-
-			cmd := buildxCmd(sb, withDir(dir), withArgs("bake", "--progress=plain"))
-			out, err := cmd.CombinedOutput()
-			if ent {
-				require.Error(t, err, string(out))
-				require.Contains(t, string(out), "ERROR: additional privileges requested")
-			} else {
-				require.NoError(t, err, string(out))
-				require.FileExists(t, filepath.Join(destDir, "not/exists/foo"))
-			}
-		})
-	}
-}
-
-func testBakeDefinitionExistingOutsideNoParallel(t *testing.T, sb integration.Sandbox) {
-	for _, ent := range []bool{true, false} {
-		t.Run(fmt.Sprintf("ent=%v", ent), func(t *testing.T) {
-			t.Setenv("BUILDX_BAKE_ENTITLEMENTS_FS", strconv.FormatBool(ent))
-			dockerfile := []byte(`
-FROM scratch
-COPY foo /foo
-	`)
-			destDir := t.TempDir()
-			bakefile := []byte(fmt.Sprintf(`
-target "default" {
-	output = ["type=local,dest=%s"]
-}
-`, destDir))
-			dir := tmpdir(
-				t,
-				fstest.CreateFile("docker-bake.hcl", bakefile, 0600),
-				fstest.CreateFile("Dockerfile", dockerfile, 0600),
-				fstest.CreateFile("foo", []byte("foo"), 0600),
-			)
-
-			cmd := buildxCmd(sb, withDir(dir), withArgs("bake", "--progress=plain"))
-			out, err := cmd.CombinedOutput()
-			if ent {
-				require.Error(t, err, string(out))
-				require.Contains(t, string(out), "ERROR: additional privileges requested")
-			} else {
-				require.NoError(t, err, string(out))
-				require.FileExists(t, filepath.Join(destDir, "foo"))
-			}
-		})
-	}
-}
-
-func testBakeDefinitionSymlinkOutsideNoParallel(t *testing.T, sb integration.Sandbox) {
-	for _, ent := range []bool{true, false} {
-		t.Run(fmt.Sprintf("ent=%v", ent), func(t *testing.T) {
-			t.Setenv("BUILDX_BAKE_ENTITLEMENTS_FS", strconv.FormatBool(ent))
-			dockerfile := []byte(`
-FROM scratch
-COPY foo /foo
-	`)
-			destDir := t.TempDir()
-			bakefile := []byte(`
-target "default" {
-	output = ["type=local,dest=out"]
-}
-`)
-			dir := tmpdir(
-				t,
-				fstest.CreateFile("docker-bake.hcl", bakefile, 0600),
-				fstest.CreateFile("Dockerfile", dockerfile, 0600),
-				fstest.CreateFile("foo", []byte("foo"), 0600),
-				fstest.Symlink(destDir, "out"),
-			)
-
-			cmd := buildxCmd(sb, withDir(dir), withArgs("bake", "--progress=plain"))
-			out, err := cmd.CombinedOutput()
-			if ent {
-				require.Error(t, err, string(out))
-				require.Contains(t, string(out), "ERROR: additional privileges requested")
-			} else {
-				require.NoError(t, err, string(out))
-				require.FileExists(t, filepath.Join(destDir, "foo"))
-			}
-		})
-	}
-}
-
-func testBakeDefinitionSymlinkOutsideGrantedNoParallel(t *testing.T, sb integration.Sandbox) {
-	for _, ent := range []bool{true, false} {
-		t.Run(fmt.Sprintf("ent=%v", ent), func(t *testing.T) {
-			t.Setenv("BUILDX_BAKE_ENTITLEMENTS_FS", strconv.FormatBool(ent))
-			dockerfile := []byte(`
-FROM scratch
-COPY foo /foo
-	`)
-			destDir := t.TempDir()
-			bakefile := []byte(`
-target "default" {
-	output = ["type=local,dest=out"]
-}
-`)
-			dir := tmpdir(
-				t,
-				fstest.CreateFile("docker-bake.hcl", bakefile, 0600),
-				fstest.CreateFile("Dockerfile", dockerfile, 0600),
-				fstest.CreateFile("foo", []byte("foo"), 0600),
-				fstest.Symlink(destDir, "out"),
-			)
-
-			cmd := buildxCmd(sb, withDir(dir), withArgs("bake", "--progress=plain", "--allow", "fs.write="+destDir))
-			out, err := cmd.CombinedOutput()
-			require.NoError(t, err, string(out))
-			require.FileExists(t, filepath.Join(destDir, "foo"))
-		})
-	}
-}
-
 func testBakeUlimits(t *testing.T, sb integration.Sandbox) {
 	dockerfile := []byte(`
 FROM busybox AS build
@@ -1244,6 +954,7 @@ func testBakeMultiPlatform(t *testing.T, sb integration.Sandbox) {
 		require.NotNil(t, img)
 		img = imgs.Find("linux/arm64")
 		require.NotNil(t, img)
+
 	} else {
 		require.Error(t, err, string(out))
 		require.Contains(t, string(out), "Multi-platform build is not supported")
@@ -1733,7 +1444,7 @@ target "third" {
 			fstest.CreateFile("docker-bake.hcl", bakefile, 0600),
 		)
 
-		dockerfilePathFirst := "Dockerfile"
+		dockerfilePathFirst := filepath.Join("Dockerfile")
 		dockerfilePathSecond := filepath.Join("subdir", "Dockerfile")
 		dockerfilePathThird := filepath.Join("subdir", "subsubdir", "Dockerfile")
 

tests/build.go

@@ -471,7 +471,7 @@ RUN echo foo > /bar`)
 	cmd := buildxCmd(sb, withArgs("build", "--output=type=cacheonly", dir))
 	out, err := cmd.CombinedOutput()
 	require.NoError(t, err, string(out))
-	require.False(t, buildDetailsPattern.MatchString(string(out)), "build details link not expected in output, got %q", out)
+	require.False(t, buildDetailsPattern.MatchString(string(out)), fmt.Sprintf("build details link not expected in output, got %q", out))
 
 	// create desktop-build .lastaccess file
 	home, err := os.UserHomeDir() // TODO: sandbox should create a temp home dir and expose it through its interface
@@ -491,7 +491,7 @@ RUN echo foo > /bar`)
 	cmd = buildxCmd(sb, withArgs("build", "--output=type=cacheonly", dir))
 	out, err = cmd.CombinedOutput()
 	require.NoError(t, err, string(out))
-	require.True(t, buildDetailsPattern.MatchString(string(out)), "expected build details link in output, got %q", out)
+	require.True(t, buildDetailsPattern.MatchString(string(out)), fmt.Sprintf("expected build details link in output, got %q", out))
 
 	// build erroneous dockerfile
 	dockerfile = []byte(`FROM busybox:latest
@@ -500,12 +500,12 @@ RUN exit 1`)
 	cmd = buildxCmd(sb, withArgs("build", "--output=type=cacheonly", dir))
 	out, err = cmd.CombinedOutput()
 	require.Error(t, err, string(out))
-	require.True(t, buildDetailsPattern.MatchString(string(out)), "expected build details link in output, got %q", out)
+	require.True(t, buildDetailsPattern.MatchString(string(out)), fmt.Sprintf("expected build details link in output, got %q", out))
 }
 
 func testBuildProgress(t *testing.T, sb integration.Sandbox) {
 	dir := createTestProject(t)
-	sbDriver, _, _ := driverName(sb.Name())
+	sbDriver, _ := driverName(sb.Name())
 	name := sb.Address()
 
 	// progress=tty
@@ -578,7 +578,7 @@ func testBuildBuildArgNoKey(t *testing.T, sb integration.Sandbox) {
 	cmd := buildxCmd(sb, withArgs("build", "--build-arg", "=TEST_STRING", dir))
 	out, err := cmd.CombinedOutput()
 	require.Error(t, err, string(out))
-	require.Equal(t, `ERROR: invalid key-value pair "=TEST_STRING": empty key`, strings.TrimSpace(string(out)))
+	require.Equal(t, strings.TrimSpace(string(out)), `ERROR: invalid key-value pair "=TEST_STRING": empty key`)
 }
 
 func testBuildLabelNoKey(t *testing.T, sb integration.Sandbox) {
@@ -586,7 +586,7 @@ func testBuildLabelNoKey(t *testing.T, sb integration.Sandbox) {
 	cmd := buildxCmd(sb, withArgs("build", "--label", "=TEST_STRING", dir))
 	out, err := cmd.CombinedOutput()
 	require.Error(t, err, string(out))
-	require.Equal(t, `ERROR: invalid key-value pair "=TEST_STRING": empty key`, strings.TrimSpace(string(out)))
+	require.Equal(t, strings.TrimSpace(string(out)), `ERROR: invalid key-value pair "=TEST_STRING": empty key`)
 }
 
 func testBuildCacheExportNotSupported(t *testing.T, sb integration.Sandbox) {
@@ -649,6 +649,7 @@ func testBuildMultiPlatform(t *testing.T, sb integration.Sandbox) {
 		require.NotNil(t, img)
 		img = imgs.Find("linux/arm64")
 		require.NotNil(t, img)
+
 	} else {
 		require.Error(t, err, string(out))
 		require.Contains(t, string(out), "Multi-platform build is not supported")

tests/create.go

@@ -102,7 +102,7 @@ func testCreateRemoteContainer(t *testing.T, sb integration.Sandbox) {
 
 	for _, line := range strings.Split(out, "\n") {
 		if v, ok := strings.CutPrefix(line, "Status:"); ok {
-			require.Equal(t, "running", strings.TrimSpace(v))
+			require.Equal(t, strings.TrimSpace(v), "running")
 			return
 		}
 	}

tests/dialstdio.go

@@ -17,6 +17,7 @@ import (
 	"github.com/moby/buildkit/util/progress/progressui"
 	"github.com/moby/buildkit/util/testutil/integration"
 	"github.com/pkg/errors"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -56,7 +57,7 @@ func testDialStdio(t *testing.T, sb integration.Sandbox) {
 			case <-time.After(10 * time.Second):
 				t.Error("timeout waiting for buildx command to exit")
 			case <-chErr:
-				require.NoError(t, err)
+				assert.NoError(t, err)
 			}
 		}()
 

tests/inspect.go

@@ -45,7 +45,7 @@ func testInspect(t *testing.T, sb integration.Sandbox) {
 	}
 
 	require.Equal(t, sb.Address(), name)
-	sbDriver, _, _ := driverName(sb.Name())
+	sbDriver, _ := driverName(sb.Name())
 	require.Equal(t, sbDriver, driver)
 	if isDockerWorker(sb) {
 		require.NotEmpty(t, hostGatewayIP, "host-gateway-ip worker label should be set with docker driver")

tests/integration.go

@@ -95,37 +95,33 @@ func buildxConfig(sb integration.Sandbox) string {
 }
 
 func isMobyWorker(sb integration.Sandbox) bool {
-	name, _, hasFeature := driverName(sb.Name())
+	name, hasFeature := driverName(sb.Name())
 	return name == "docker" && !hasFeature
 }
 
 func isMobyContainerdSnapWorker(sb integration.Sandbox) bool {
-	name, _, hasFeature := driverName(sb.Name())
+	name, hasFeature := driverName(sb.Name())
 	return name == "docker" && hasFeature
 }
 
 func isDockerWorker(sb integration.Sandbox) bool {
-	name, _, _ := driverName(sb.Name())
+	name, _ := driverName(sb.Name())
 	return name == "docker"
 }
 
 func isDockerContainerWorker(sb integration.Sandbox) bool {
-	name, _, _ := driverName(sb.Name())
+	name, _ := driverName(sb.Name())
 	return name == "docker-container"
 }
 
-func driverName(sbName string) (string, bool, bool) {
+func driverName(sbName string) (string, bool) {
 	name := sbName
-	var hasVersion, hasFeature bool
+	var hasFeature bool
-	if b, _, ok := strings.Cut(sbName, "@"); ok {
-		name = b
-		hasVersion = true
-	}
 	if b, _, ok := strings.Cut(name, "+"); ok {
 		name = b
 		hasFeature = true
 	}
-	return name, hasVersion, hasFeature
+	return name, hasFeature
 }
 
 func isExperimental() bool {

tests/ls.go

@@ -34,7 +34,7 @@ func testLs(t *testing.T, sb integration.Sandbox) {
 		},
 	}
 
-	sbDriver, _, _ := driverName(sb.Name())
+	sbDriver, _ := driverName(sb.Name())
 	for _, tt := range tests {
 		tt := tt
 		t.Run(tt.name, func(t *testing.T) {

tests/workers/docker.go

@@ -2,14 +2,10 @@ package workers
 
 import (
 	"context"
-	"fmt"
 	"os"
 	"os/exec"
-	"path/filepath"
-	"strings"
 
 	"github.com/moby/buildkit/identity"
-	"github.com/moby/buildkit/util/testutil/dockerd"
 	"github.com/moby/buildkit/util/testutil/integration"
 	bkworkers "github.com/moby/buildkit/util/testutil/workers"
 	"github.com/pkg/errors"
@@ -18,60 +14,17 @@ import (
 func InitDockerWorker() {
 	integration.Register(&dockerWorker{
 		id: "docker",
-		binary: dockerd.DefaultDockerdBinary,
 	})
 	integration.Register(&dockerWorker{
 		id:                    "docker+containerd",
-		binary:                dockerd.DefaultDockerdBinary,
 		containerdSnapshotter: true,
 	})
-	// e.g. `docker@26.0=/opt/docker-26.0,docker@25.0=/opt/docker-25.0`
-	if s := os.Getenv("TEST_DOCKER_EXTRA"); s != "" {
-		entries := strings.Split(s, ",")
-		for _, entry := range entries {
-			ver, bin, err := func(entry string) (string, string, error) {
-				p1 := strings.Split(strings.TrimSpace(entry), "=")
-				if len(p1) != 2 {
-					return "", "", errors.Errorf("invalid entry: %q", entry)
-				}
-				name, bin := p1[0], p1[1]
-				if _, err := os.Stat(bin); err != nil {
-					return "", "", errors.Wrapf(err, "bin not found: %q", bin)
-				}
-				p2 := strings.Split(strings.TrimSpace(name), "@")
-				if len(p2) != 2 {
-					return "", "", errors.Errorf("invalid name: %q", name)
-				}
-				_, ver := p2[0], p2[1]
-				if ver == "" {
-					return "", "", errors.New("empty version")
-				}
-				return ver, bin, nil
-			}(entry)
-			if err != nil {
-				panic(errors.Wrapf(err, "unexpected TEST_DOCKER_EXTRA: %q", s))
-			}
-			integration.Register(&dockerWorker{
-				id:       fmt.Sprintf("docker@%s", ver),
-				binary:   filepath.Join(bin, "dockerd"),
-				extraEnv: []string{fmt.Sprintf("PATH=%s:%s", bin, os.Getenv("PATH"))},
-			})
-			integration.Register(&dockerWorker{
-				id:                    fmt.Sprintf("docker+containerd@%s", ver),
-				binary:                filepath.Join(bin, "dockerd"),
-				containerdSnapshotter: true,
-				extraEnv:              []string{fmt.Sprintf("PATH=%s:%s", bin, os.Getenv("PATH"))},
-			})
-		}
-	}
 }
 
 type dockerWorker struct {
 	id                    string
-	binary                string
 	containerdSnapshotter bool
 	unsupported           []string
-	extraEnv              []string
 }
 
 func (c dockerWorker) Name() string {
@@ -89,9 +42,7 @@ func (c *dockerWorker) NetNSDetached() bool {
 func (c dockerWorker) New(ctx context.Context, cfg *integration.BackendConfig) (b integration.Backend, cl func() error, err error) {
 	moby := bkworkers.Moby{
 		ID:                    c.id,
-		Binary:                c.binary,
 		ContainerdSnapshotter: c.containerdSnapshotter,
-		ExtraEnv:              c.extraEnv,
 	}
 	bk, bkclose, err := moby.New(ctx, cfg)
 	if err != nil {

util/buildflags/cache.go

@@ -14,9 +14,6 @@ import (
 func ParseCacheEntry(in []string) ([]*controllerapi.CacheOptionsEntry, error) {
 	outs := make([]*controllerapi.CacheOptionsEntry, 0, len(in))
 	for _, in := range in {
-		if in == "" {
-			continue
-		}
 		fields, err := csvvalue.Fields(in, nil)
 		if err != nil {
 			return nil, err

util/buildflags/export.go

@@ -19,9 +19,6 @@ func ParseExports(inp []string) ([]*controllerapi.ExportEntry, error) {
 		return nil, nil
 	}
 	for _, s := range inp {
-		if s == "" {
-			continue
-		}
 		fields, err := csvvalue.Fields(s, nil)
 		if err != nil {
 			return nil, err
@@ -141,6 +138,7 @@ func ParseAnnotations(inp []string) (map[exptypes.AnnotationKey]string, error) {
 			}
 			annotations[ak] = v
 		}
+
 	}
 	return annotations, nil
 }

util/buildflags/secrets.go

@@ -11,9 +11,6 @@ import (
 func ParseSecretSpecs(sl []string) ([]*controllerapi.Secret, error) {
 	fs := make([]*controllerapi.Secret, 0, len(sl))
 	for _, v := range sl {
-		if v == "" {
-			continue
-		}
 		s, err := parseSecret(v)
 		if err != nil {
 			return nil, err

util/buildflags/ssh.go

@@ -14,9 +14,6 @@ func ParseSSHSpecs(sl []string) ([]*controllerapi.SSH, error) {
 	}
 
 	for _, s := range sl {
-		if s == "" {
-			continue
-		}
 		parts := strings.SplitN(s, "=", 2)
 		out := controllerapi.SSH{
 			ID: parts[0],

util/confutil/config_unix_test.go

@@ -7,7 +7,6 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestIsSubPath(t *testing.T) {
@@ -52,7 +51,7 @@ func TestIsSubPath(t *testing.T) {
 		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			ok, err := isSubPath(tt.basePath, tt.subPath)
-			require.NoError(t, err)
+			assert.NoError(t, err)
 			assert.Equal(t, tt.expected, ok)
 		})
 	}

util/dockerutil/client.go

@@ -41,6 +41,7 @@ func (c *Client) LoadImage(ctx context.Context, name string, status progress.Wri
 	pr, pw := io.Pipe()
 	done := make(chan struct{})
 
+	ctx, cancel := context.WithCancel(ctx)
 	var w *waitingWriter
 	w = &waitingWriter{
 		PipeWriter: pw,
@@ -67,6 +68,7 @@ func (c *Client) LoadImage(ctx context.Context, name string, status progress.Wri
 			}
 		},
 		done:   done,
+		cancel: cancel,
 	}
 	return w, func() {
 		pr.Close()
@@ -104,6 +106,7 @@ type waitingWriter struct {
 	mu     sync.Mutex
 	err    error
 	done   chan struct{}
+	cancel func()
 }
 
 func (w *waitingWriter) Write(dt []byte) (int, error) {

util/dockerutil/progress.go

@@ -55,7 +55,7 @@ func fromReader(l progress.SubLogger, rc io.ReadCloser) error {
 				Started: &now,
 			}
 		}
-		timeDelta := time.Since(st.Timestamp)
+		timeDelta := time.Now().Sub(st.Timestamp)
 		if timeDelta < minTimeDelta {
 			continue
 		}

util/gitutil/testutilserve.go

@@ -7,7 +7,6 @@ import (
 	"net/http"
 	"testing"
 
-	"github.com/pkg/errors"
 	"github.com/stretchr/testify/require"
 )
 
@@ -26,7 +25,7 @@ func WithAccessToken(token string) GitServeOpt {
 func GitServeHTTP(c *Git, t testing.TB, opts ...GitServeOpt) (url string) {
 	t.Helper()
 	gitUpdateServerInfo(c, t)
-	ctx, cancel := context.WithCancelCause(context.TODO())
+	ctx, cancel := context.WithCancel(context.TODO())
 
 	gs := &gitServe{}
 	for _, opt := range opts {
@@ -39,7 +38,7 @@ func GitServeHTTP(c *Git, t testing.TB, opts ...GitServeOpt) (url string) {
 	name := "test.git"
 	dir, err := c.GitDir()
 	if err != nil {
-		cancel(err)
+		cancel()
 	}
 
 	var addr string
@@ -85,7 +84,7 @@ func GitServeHTTP(c *Git, t testing.TB, opts ...GitServeOpt) (url string) {
 	<-ready
 
 	t.Cleanup(func() {
-		cancel(errors.Errorf("cleanup"))
+		cancel()
 		<-done
 	})
 	return fmt.Sprintf("http://%s/%s", addr, name)

util/imagetools/imagetools_helpers_test.go

@@ -47,6 +47,7 @@ func (f mockFetcher) Fetch(ctx context.Context, desc ocispec.Descriptor) (io.Rea
 		reader := io.NopCloser(strings.NewReader(desc.Annotations["test_content"]))
 		return reader, nil
 	}
+
 }
 
 func (r mockResolver) Resolve(ctx context.Context, ref string) (name string, desc ocispec.Descriptor, err error) {

util/imagetools/loader_test.go

@@ -10,7 +10,6 @@ import (
 	"github.com/opencontainers/go-digest"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestLoad(t *testing.T) {
@@ -20,7 +19,7 @@ func TestLoad(t *testing.T) {
 	r := getImageNoAttestation()
 	indexDigest := reflect.ValueOf(r.indexes).MapKeys()[0].String()
 	result, err := loader.Load(ctx, fmt.Sprintf("test@%s", indexDigest))
-	require.NoError(t, err)
+	assert.NoError(t, err)
 	if err == nil {
 		assert.Equal(t, 1, len(result.indexes))
 		assert.Equal(t, 2, len(result.images))
@@ -33,7 +32,7 @@ func TestLoad(t *testing.T) {
 	r = getImageWithAttestation(plainSpdx)
 	indexDigest = reflect.ValueOf(r.indexes).MapKeys()[0].String()
 	result, err = loader.Load(ctx, fmt.Sprintf("test@%s", indexDigest))
-	require.NoError(t, err)
+	assert.NoError(t, err)
 	if err == nil {
 		assert.Equal(t, 1, len(result.indexes))
 		assert.Equal(t, 2, len(result.images))
@@ -93,7 +92,7 @@ func TestSBOM(t *testing.T) {
 			r.assets["linux/amd64"] = a
 			actual, err := r.SBOM()
 
-			require.NoError(t, err)
+			assert.NoError(t, err)
 			assert.Equal(t, 1, len(actual))
 		})
 	}
@@ -141,7 +140,7 @@ func TestProvenance(t *testing.T) {
 			r.assets["linux/amd64"] = a
 			actual, err := r.Provenance()
 
-			require.NoError(t, err)
+			assert.NoError(t, err)
 			assert.Equal(t, 1, len(actual))
 		})
 	}
@@ -168,7 +167,7 @@ func Test_isInTotoDSSE(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.mime, func(t *testing.T) {
-			assert.Equal(t, test.expected, isInTotoDSSE(test.mime))
+			assert.Equal(t, isInTotoDSSE(test.mime), test.expected)
 		})
 	}
 }
@@ -176,19 +175,19 @@ func Test_isInTotoDSSE(t *testing.T) {
 func Test_decodeDSSE(t *testing.T) {
 	// Returns input when mime isn't a DSSE type
 	actual, err := decodeDSSE([]byte("foobar"), "application/vnd.in-toto+json")
-	require.NoError(t, err)
+	assert.NoError(t, err)
 	assert.Equal(t, []byte("foobar"), actual)
 
 	// Returns the base64 decoded payload if is a DSSE
 	payload := base64.StdEncoding.EncodeToString([]byte("hello world"))
 	envelope := fmt.Sprintf("{\"payload\":\"%s\"}", payload)
 	actual, err = decodeDSSE([]byte(envelope), "application/vnd.in-toto.spdx+dsse")
-	require.NoError(t, err)
+	assert.NoError(t, err)
 	assert.Equal(t, "hello world", string(actual))
 
 	_, err = decodeDSSE([]byte("not a json"), "application/vnd.in-toto.spdx+dsse")
-	require.Error(t, err)
+	assert.Error(t, err)
 
 	_, err = decodeDSSE([]byte("{\"payload\": \"not base64\"}"), "application/vnd.in-toto.spdx+dsse")
-	require.Error(t, err)
+	assert.Error(t, err)
 }

util/waitmap/waitmap.go

@@ -61,7 +61,7 @@ func (m *Map) Get(ctx context.Context, keys ...string) (map[string]interface{},
 		m.mu.Unlock()
 		select {
 		case <-ctx.Done():
-			return nil, context.Cause(ctx)
+			return nil, ctx.Err()
 		case <-ch:
 			m.mu.Lock()
 		}

util/waitmap/waitmap_test.go

@@ -2,6 +2,7 @@ package waitmap
 
 import (
 	"context"
+	"errors"
 	"testing"
 	"time"
 
@@ -33,12 +34,12 @@ func TestTimeout(t *testing.T) {
 
 	m.Set("foo", "bar")
 
-	ctx, cancel := context.WithTimeoutCause(context.TODO(), 100*time.Millisecond, nil)
+	ctx, cancel := context.WithTimeout(context.TODO(), 100*time.Millisecond)
 	defer cancel()
 
 	_, err := m.Get(ctx, "bar")
 	require.Error(t, err)
-	require.ErrorIs(t, err, context.DeadlineExceeded)
+	require.True(t, errors.Is(err, context.DeadlineExceeded))
 }
 
 func TestBlocking(t *testing.T) {

vendor/github.com/cenkalti/backoff/v4/README.md

@@ -1,4 +1,4 @@
-# Exponential Backoff [![GoDoc][godoc image]][godoc] [![Coverage Status][coveralls image]][coveralls]
+# Exponential Backoff [![GoDoc][godoc image]][godoc] [![Build Status][travis image]][travis] [![Coverage Status][coveralls image]][coveralls]
 
 This is a Go port of the exponential backoff algorithm from [Google's HTTP Client Library for Java][google-http-java-client].
 
@@ -21,6 +21,8 @@ Use https://pkg.go.dev/github.com/cenkalti/backoff/v4 to view the documentation.
 
 [godoc]: https://pkg.go.dev/github.com/cenkalti/backoff/v4
 [godoc image]: https://godoc.org/github.com/cenkalti/backoff?status.png
+[travis]: https://travis-ci.org/cenkalti/backoff
+[travis image]: https://travis-ci.org/cenkalti/backoff.png?branch=master
 [coveralls]: https://coveralls.io/github/cenkalti/backoff?branch=master
 [coveralls image]: https://coveralls.io/repos/github/cenkalti/backoff/badge.svg?branch=master
 

vendor/github.com/cenkalti/backoff/v4/exponential.go

@@ -71,9 +71,6 @@ type Clock interface {
 	Now() time.Time
 }
 
-// ExponentialBackOffOpts is a function type used to configure ExponentialBackOff options.
-type ExponentialBackOffOpts func(*ExponentialBackOff)
-
 // Default values for ExponentialBackOff.
 const (
 	DefaultInitialInterval     = 500 * time.Millisecond
@@ -84,7 +81,7 @@ const (
 )
 
 // NewExponentialBackOff creates an instance of ExponentialBackOff using default values.
-func NewExponentialBackOff(opts ...ExponentialBackOffOpts) *ExponentialBackOff {
+func NewExponentialBackOff() *ExponentialBackOff {
 	b := &ExponentialBackOff{
 		InitialInterval:     DefaultInitialInterval,
 		RandomizationFactor: DefaultRandomizationFactor,
@@ -94,62 +91,10 @@ func NewExponentialBackOff(opts ...ExponentialBackOffOpts) *ExponentialBackOff {
 		Stop:                Stop,
 		Clock:               SystemClock,
 	}
-	for _, fn := range opts {
-		fn(b)
-	}
 	b.Reset()
 	return b
 }
 
-// WithInitialInterval sets the initial interval between retries.
-func WithInitialInterval(duration time.Duration) ExponentialBackOffOpts {
-	return func(ebo *ExponentialBackOff) {
-		ebo.InitialInterval = duration
-	}
-}
-
-// WithRandomizationFactor sets the randomization factor to add jitter to intervals.
-func WithRandomizationFactor(randomizationFactor float64) ExponentialBackOffOpts {
-	return func(ebo *ExponentialBackOff) {
-		ebo.RandomizationFactor = randomizationFactor
-	}
-}
-
-// WithMultiplier sets the multiplier for increasing the interval after each retry.
-func WithMultiplier(multiplier float64) ExponentialBackOffOpts {
-	return func(ebo *ExponentialBackOff) {
-		ebo.Multiplier = multiplier
-	}
-}
-
-// WithMaxInterval sets the maximum interval between retries.
-func WithMaxInterval(duration time.Duration) ExponentialBackOffOpts {
-	return func(ebo *ExponentialBackOff) {
-		ebo.MaxInterval = duration
-	}
-}
-
-// WithMaxElapsedTime sets the maximum total time for retries.
-func WithMaxElapsedTime(duration time.Duration) ExponentialBackOffOpts {
-	return func(ebo *ExponentialBackOff) {
-		ebo.MaxElapsedTime = duration
-	}
-}
-
-// WithRetryStopDuration sets the duration after which retries should stop.
-func WithRetryStopDuration(duration time.Duration) ExponentialBackOffOpts {
-	return func(ebo *ExponentialBackOff) {
-		ebo.Stop = duration
-	}
-}
-
-// WithClockProvider sets the clock used to measure time.
-func WithClockProvider(clock Clock) ExponentialBackOffOpts {
-	return func(ebo *ExponentialBackOff) {
-		ebo.Clock = clock
-	}
-}
-
 type systemClock struct{}
 
 func (t systemClock) Now() time.Time {

vendor/github.com/compose-spec/compose-go/v2/cli/options.go

@@ -414,7 +414,7 @@ func (o *ProjectOptions) ReadConfigFiles(ctx context.Context, workingDir string,
 	for i, c := range config.ConfigFiles {
 		var err error
 		var b []byte
-		if c.IsStdin() {
+		if c.Filename == "-" {
 			b, err = io.ReadAll(os.Stdin)
 			if err != nil {
 				return nil, err

vendor/github.com/compose-spec/compose-go/v2/loader/loader.go

@@ -318,13 +318,6 @@ func LoadConfigFiles(ctx context.Context, configFiles []string, workingDir strin
 	opts.ResourceLoaders = append(opts.ResourceLoaders, localResourceLoader{})
 
 	for i, p := range configFiles {
-		if p == "-" {
-			config.ConfigFiles[i] = types.ConfigFile{
-				Filename: p,
-			}
-			continue
-		}
-
 		for _, loader := range opts.ResourceLoaders {
 			_, isLocalResourceLoader := loader.(localResourceLoader)
 			if !loader.Accept(p) {

vendor/github.com/compose-spec/compose-go/v2/loader/reset.go

@@ -28,12 +28,11 @@ import (
 type ResetProcessor struct {
 	target       interface{}
 	paths        []tree.Path
-	visitedNodes map[*yaml.Node][]string
+	visitedNodes map[*yaml.Node]string
 }
 
 // UnmarshalYAML implement yaml.Unmarshaler
 func (p *ResetProcessor) UnmarshalYAML(value *yaml.Node) error {
-	p.visitedNodes = make(map[*yaml.Node][]string)
 	resolved, err := p.resolveReset(value, tree.NewPath())
 	p.visitedNodes = nil
 	if err != nil {
@@ -50,12 +49,24 @@ func (p *ResetProcessor) resolveReset(node *yaml.Node, path tree.Path) (*yaml.No
 		path = tree.NewPath(strings.Replace(pathStr, ".<<", "", 1))
 	}
 
-	// If the node is an alias, We need to process the alias field in order to consider the !override and !reset tags
+	// Check for cycle
-	if node.Kind == yaml.AliasNode {
+	if p.visitedNodes == nil {
-		if err := p.checkForCycle(node.Alias, path); err != nil {
+		p.visitedNodes = make(map[*yaml.Node]string)
-			return nil, err
 	}
 
+	// Check for cycle by seeing if the node has already been visited at this path
+	if previousPath, found := p.visitedNodes[node]; found {
+		// If the current node has been visited, we have a cycle if the previous path is a prefix
+		if strings.HasPrefix(pathStr, previousPath) {
+			return nil, fmt.Errorf("cycle detected at path: %s", pathStr)
+		}
+	}
+
+	// Mark the current node as visited
+	p.visitedNodes[node] = pathStr
+
+	// If the node is an alias, We need to process the alias field in order to consider the !override and !reset tags
+	if node.Kind == yaml.AliasNode {
 		return p.resolveReset(node.Alias, path)
 	}
 
@@ -143,48 +154,3 @@ func (p *ResetProcessor) applyNullOverrides(target any, path tree.Path) error {
 	}
 	return nil
 }
-
-func (p *ResetProcessor) checkForCycle(node *yaml.Node, path tree.Path) error {
-	paths := p.visitedNodes[node]
-	pathStr := path.String()
-
-	for _, prevPath := range paths {
-		// If we're visiting the exact same path, it's not a cycle
-		if pathStr == prevPath {
-			continue
-		}
-
-		// If either path is using a merge key, it's legitimate YAML merging
-		if strings.Contains(prevPath, "<<") || strings.Contains(pathStr, "<<") {
-			continue
-		}
-
-		// Only consider it a cycle if one path is contained within the other
-		// and they're not in different service definitions
-		if (strings.HasPrefix(pathStr, prevPath+".") ||
-			strings.HasPrefix(prevPath, pathStr+".")) &&
-			!areInDifferentServices(pathStr, prevPath) {
-			return fmt.Errorf("cycle detected: node at path %s references node at path %s", pathStr, prevPath)
-		}
-	}
-
-	p.visitedNodes[node] = append(paths, pathStr)
-	return nil
-}
-
-// areInDifferentServices checks if two paths are in different service definitions
-func areInDifferentServices(path1, path2 string) bool {
-	// Split paths into components
-	parts1 := strings.Split(path1, ".")
-	parts2 := strings.Split(path2, ".")
-
-	// Look for the services component and compare the service names
-	for i := 0; i < len(parts1) && i < len(parts2); i++ {
-		if parts1[i] == "services" && i+1 < len(parts1) &&
-			parts2[i] == "services" && i+1 < len(parts2) {
-			// If they're different services, it's not a cycle
-			return parts1[i+1] != parts2[i+1]
-		}
-	}
-	return false
-}

vendor/github.com/compose-spec/compose-go/v2/types/config.go

@@ -67,10 +67,6 @@ type ConfigFile struct {
 	Config map[string]interface{}
 }
 
-func (cf ConfigFile) IsStdin() bool {
-	return cf.Filename == "-"
-}
-
 func ToConfigFiles(path []string) (f []ConfigFile) {
 	for _, p := range path {
 		f = append(f, ConfigFile{Filename: p})

vendor/github.com/containerd/containerd/content/helpers.go

@@ -24,12 +24,11 @@ import (
 	"sync"
 	"time"
 
+	"github.com/containerd/containerd/pkg/randutil"
+	"github.com/containerd/errdefs"
 	"github.com/containerd/log"
 	"github.com/opencontainers/go-digest"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
-
-	"github.com/containerd/containerd/errdefs"
-	"github.com/containerd/containerd/pkg/randutil"
 )
 
 var ErrReset = errors.New("writer has been reset")

vendor/github.com/containerd/containerd/content/local/locks.go

@@ -21,7 +21,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/containerd/containerd/errdefs"
+	"github.com/containerd/errdefs"
 )
 
 // Handles locking references

vendor/github.com/containerd/containerd/content/local/readerat.go

@@ -22,7 +22,7 @@ import (
 	"os"
 
 	"github.com/containerd/containerd/content"
-	"github.com/containerd/containerd/errdefs"
+	"github.com/containerd/errdefs"
 )
 
 // readerat implements io.ReaderAt in a completely stateless manner by opening

vendor/github.com/containerd/containerd/content/local/store.go

@@ -27,13 +27,12 @@ import (
 	"sync"
 	"time"
 
-	"github.com/containerd/log"
-	"github.com/sirupsen/logrus"
-
 	"github.com/containerd/containerd/content"
-	"github.com/containerd/containerd/errdefs"
 	"github.com/containerd/containerd/filters"
 	"github.com/containerd/containerd/pkg/randutil"
+	"github.com/containerd/errdefs"
+	"github.com/containerd/log"
+	"github.com/sirupsen/logrus"
 
 	"github.com/opencontainers/go-digest"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
@@ -67,8 +66,6 @@ type LabelStore interface {
 type store struct {
 	root string
 	ls   LabelStore
-
-	ensureIngestRootOnce func() error
 }
 
 // NewStore returns a local content store
@@ -82,13 +79,14 @@ func NewStore(root string) (content.Store, error) {
 // require labels and should use `NewStore`. `NewLabeledStore` is primarily
 // useful for tests or standalone implementations.
 func NewLabeledStore(root string, ls LabelStore) (content.Store, error) {
-	s := &store{
+	if err := os.MkdirAll(filepath.Join(root, "ingest"), 0777); err != nil {
-		root: root,
+		return nil, err
-		ls:   ls,
 	}
 
-	s.ensureIngestRootOnce = sync.OnceValue(s.ensureIngestRoot)
+	return &store{
-	return s, nil
+		root: root,
+		ls:   ls,
+	}, nil
 }
 
 func (s *store) Info(ctx context.Context, dgst digest.Digest) (content.Info, error) {
@@ -295,9 +293,6 @@ func (s *store) Status(ctx context.Context, ref string) (content.Status, error)
 func (s *store) ListStatuses(ctx context.Context, fs ...string) ([]content.Status, error) {
 	fp, err := os.Open(filepath.Join(s.root, "ingest"))
 	if err != nil {
-		if os.IsNotExist(err) {
-			return nil, nil
-		}
 		return nil, err
 	}
 
@@ -348,9 +343,6 @@ func (s *store) ListStatuses(ctx context.Context, fs ...string) ([]content.Statu
 func (s *store) WalkStatusRefs(ctx context.Context, fn func(string) error) error {
 	fp, err := os.Open(filepath.Join(s.root, "ingest"))
 	if err != nil {
-		if os.IsNotExist(err) {
-			return nil
-		}
 		return err
 	}
 
@@ -552,11 +544,6 @@ func (s *store) writer(ctx context.Context, ref string, total int64, expected di
 	)
 
 	foundValidIngest := false
-
-	if err := s.ensureIngestRootOnce(); err != nil {
-		return nil, err
-	}
-
 	// ensure that the ingest path has been created.
 	if err := os.Mkdir(path, 0755); err != nil {
 		if !os.IsExist(err) {
@@ -667,10 +654,6 @@ func (s *store) ingestPaths(ref string) (string, string, string) {
 	return fp, rp, dp
 }
 
-func (s *store) ensureIngestRoot() error {
-	return os.MkdirAll(filepath.Join(s.root, "ingest"), 0777)
-}
-
 func readFileString(path string) (string, error) {
 	p, err := os.ReadFile(path)
 	return string(p), err

vendor/github.com/containerd/containerd/content/local/writer.go

@@ -26,11 +26,10 @@ import (
 	"runtime"
 	"time"
 
+	"github.com/containerd/containerd/content"
+	"github.com/containerd/errdefs"
 	"github.com/containerd/log"
 	"github.com/opencontainers/go-digest"
-
-	"github.com/containerd/containerd/content"
-	"github.com/containerd/containerd/errdefs"
 )
 
 // writer represents a write transaction against the blob store.

vendor/github.com/containerd/containerd/content/proxy/content_store.go

@@ -22,9 +22,9 @@ import (
 
 	contentapi "github.com/containerd/containerd/api/services/content/v1"
 	"github.com/containerd/containerd/content"
-	"github.com/containerd/containerd/errdefs"
 	"github.com/containerd/containerd/protobuf"
 	protobuftypes "github.com/containerd/containerd/protobuf/types"
+	"github.com/containerd/errdefs"
 	digest "github.com/opencontainers/go-digest"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 )

vendor/github.com/containerd/containerd/content/proxy/content_writer.go

@@ -23,8 +23,8 @@ import (
 
 	contentapi "github.com/containerd/containerd/api/services/content/v1"
 	"github.com/containerd/containerd/content"
-	"github.com/containerd/containerd/errdefs"
 	"github.com/containerd/containerd/protobuf"
+	"github.com/containerd/errdefs"
 	digest "github.com/opencontainers/go-digest"
 )
 

vendor/github.com/containerd/containerd/errdefs/errors.go

@@ -1,72 +0,0 @@
-/*
-   Copyright The containerd Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-// Package errdefs defines the common errors used throughout containerd
-// packages.
-//
-// Use with fmt.Errorf to add context to an error.
-//
-// To detect an error class, use the IsXXX functions to tell whether an error
-// is of a certain type.
-package errdefs
-
-import (
-	"github.com/containerd/errdefs"
-)
-
-// Definitions of common error types used throughout containerd. All containerd
-// errors returned by most packages will map into one of these errors classes.
-// Packages should return errors of these types when they want to instruct a
-// client to take a particular action.
-//
-// These errors map closely to grpc errors.
-var (
-	ErrUnknown            = errdefs.ErrUnknown
-	ErrInvalidArgument    = errdefs.ErrInvalidArgument
-	ErrNotFound           = errdefs.ErrNotFound
-	ErrAlreadyExists      = errdefs.ErrAlreadyExists
-	ErrPermissionDenied   = errdefs.ErrPermissionDenied
-	ErrResourceExhausted  = errdefs.ErrResourceExhausted
-	ErrFailedPrecondition = errdefs.ErrFailedPrecondition
-	ErrConflict           = errdefs.ErrConflict
-	ErrNotModified        = errdefs.ErrNotModified
-	ErrAborted            = errdefs.ErrAborted
-	ErrOutOfRange         = errdefs.ErrOutOfRange
-	ErrNotImplemented     = errdefs.ErrNotImplemented
-	ErrInternal           = errdefs.ErrInternal
-	ErrUnavailable        = errdefs.ErrUnavailable
-	ErrDataLoss           = errdefs.ErrDataLoss
-	ErrUnauthenticated    = errdefs.ErrUnauthenticated
-
-	IsCanceled           = errdefs.IsCanceled
-	IsUnknown            = errdefs.IsUnknown
-	IsInvalidArgument    = errdefs.IsInvalidArgument
-	IsDeadlineExceeded   = errdefs.IsDeadlineExceeded
-	IsNotFound           = errdefs.IsNotFound
-	IsAlreadyExists      = errdefs.IsAlreadyExists
-	IsPermissionDenied   = errdefs.IsPermissionDenied
-	IsResourceExhausted  = errdefs.IsResourceExhausted
-	IsFailedPrecondition = errdefs.IsFailedPrecondition
-	IsConflict           = errdefs.IsConflict
-	IsNotModified        = errdefs.IsNotModified
-	IsAborted            = errdefs.IsAborted
-	IsOutOfRange         = errdefs.IsOutOfRange
-	IsNotImplemented     = errdefs.IsNotImplemented
-	IsInternal           = errdefs.IsInternal
-	IsUnavailable        = errdefs.IsUnavailable
-	IsDataLoss           = errdefs.IsDataLoss
-	IsUnauthorized       = errdefs.IsUnauthorized
-)

vendor/github.com/containerd/containerd/filters/parser.go

@@ -20,7 +20,7 @@ import (
 	"fmt"
 	"io"
 
-	"github.com/containerd/containerd/errdefs"
+	"github.com/containerd/errdefs"
 )
 
 /*

vendor/github.com/containerd/containerd/identifiers/validate.go

@@ -28,7 +28,7 @@ import (
 	"fmt"
 	"regexp"
 
-	"github.com/containerd/containerd/errdefs"
+	"github.com/containerd/errdefs"
 )
 
 const (

vendor/github.com/containerd/containerd/images/archive/exporter.go

@@ -26,16 +26,15 @@ import (
 	"sort"
 	"strings"
 
+	"github.com/containerd/containerd/content"
+	"github.com/containerd/containerd/images"
+	"github.com/containerd/containerd/labels"
+	"github.com/containerd/errdefs"
 	"github.com/containerd/log"
 	"github.com/containerd/platforms"
 	digest "github.com/opencontainers/go-digest"
 	ocispecs "github.com/opencontainers/image-spec/specs-go"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
-
-	"github.com/containerd/containerd/content"
-	"github.com/containerd/containerd/errdefs"
-	"github.com/containerd/containerd/images"
-	"github.com/containerd/containerd/labels"
 )
 
 type exportOptions struct {

vendor/github.com/containerd/containerd/images/archive/importer.go

@@ -29,9 +29,9 @@ import (
 
 	"github.com/containerd/containerd/archive/compression"
 	"github.com/containerd/containerd/content"
-	"github.com/containerd/containerd/errdefs"
 	"github.com/containerd/containerd/images"
 	"github.com/containerd/containerd/labels"
+	"github.com/containerd/errdefs"
 	"github.com/containerd/log"
 	"github.com/containerd/platforms"
 	digest "github.com/opencontainers/go-digest"

vendor/github.com/containerd/containerd/images/handlers.go

@@ -22,13 +22,12 @@ import (
 	"fmt"
 	"sort"
 
+	"github.com/containerd/containerd/content"
+	"github.com/containerd/errdefs"
 	"github.com/containerd/platforms"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 	"golang.org/x/sync/errgroup"
 	"golang.org/x/sync/semaphore"
-
-	"github.com/containerd/containerd/content"
-	"github.com/containerd/containerd/errdefs"
 )
 
 var (

vendor/github.com/containerd/containerd/images/image.go

@@ -23,13 +23,12 @@ import (
 	"sort"
 	"time"
 
+	"github.com/containerd/containerd/content"
+	"github.com/containerd/errdefs"
 	"github.com/containerd/log"
 	"github.com/containerd/platforms"
 	digest "github.com/opencontainers/go-digest"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
-
-	"github.com/containerd/containerd/content"
-	"github.com/containerd/containerd/errdefs"
 )
 
 // Image provides the model for how containerd views container images.

vendor/github.com/containerd/containerd/images/mediatypes.go

@@ -22,7 +22,7 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/containerd/containerd/errdefs"
+	"github.com/containerd/errdefs"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 )
 

vendor/github.com/containerd/containerd/labels/validate.go

@@ -19,7 +19,7 @@ package labels
 import (
 	"fmt"
 
-	"github.com/containerd/containerd/errdefs"
+	"github.com/containerd/errdefs"
 )
 
 const (

vendor/github.com/containerd/containerd/namespaces/context.go

@@ -21,8 +21,8 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/containerd/containerd/errdefs"
 	"github.com/containerd/containerd/identifiers"
+	"github.com/containerd/errdefs"
 )
 
 const (

vendor/github.com/containerd/containerd/remotes/docker/authorizer.go

@@ -25,11 +25,10 @@ import (
 	"strings"
 	"sync"
 
-	"github.com/containerd/log"
-
-	"github.com/containerd/containerd/errdefs"
 	"github.com/containerd/containerd/remotes/docker/auth"
 	remoteerrors "github.com/containerd/containerd/remotes/errors"
+	"github.com/containerd/errdefs"
+	"github.com/containerd/log"
 )
 
 type dockerAuthorizer struct {

vendor/github.com/containerd/containerd/remotes/docker/fetcher.go

@@ -26,12 +26,11 @@ import (
 	"net/url"
 	"strings"
 
+	"github.com/containerd/containerd/images"
+	"github.com/containerd/errdefs"
 	"github.com/containerd/log"
 	digest "github.com/opencontainers/go-digest"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
-
-	"github.com/containerd/containerd/errdefs"
-	"github.com/containerd/containerd/images"
 )
 
 type dockerFetcher struct {