Merge pull request #890 from AkihiroSuda/cherrypick-887

[v0.7 backport] docker-container: set UsernsMode only when needed

bake/bake.go

@@ -89,7 +89,20 @@ func ReadTargets(ctx context.Context, files []File, targets, overrides []string,
 			}
 		}
 	}
-	return m, c.Groups, nil
+
+	var g []*Group
+	if len(targets) == 0 || (len(targets) == 1 && targets[0] == "default") {
+		for _, group := range c.Groups {
+			if group.Name != "default" {
+				continue
+			}
+			g = []*Group{{Targets: group.Targets}}
+		}
+	} else {
+		g = []*Group{{Targets: targets}}
+	}
+
+	return m, g, nil
 }
 
 func ParseFiles(files []File, defaults map[string]string) (_ *Config, err error) {

bake/bake_test.go

@@ -3,6 +3,7 @@ package bake
 import (
 	"context"
 	"os"
+	"sort"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -34,7 +35,7 @@ target "webapp" {
 	ctx := context.TODO()
 
 	t.Run("NoOverrides", func(t *testing.T) {
-		m, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, nil, nil)
+		m, g, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, nil, nil)
 		require.NoError(t, err)
 		require.Equal(t, 1, len(m))
 
@@ -43,6 +44,9 @@ target "webapp" {
 		require.Equal(t, "webDEP", m["webapp"].Args["VAR_INHERITED"])
 		require.Equal(t, true, *m["webapp"].NoCache)
 		require.Nil(t, m["webapp"].Pull)
+
+		require.Equal(t, 1, len(g))
+		require.Equal(t, []string{"webapp"}, g[0].Targets)
 	})
 
 	t.Run("InvalidTargetOverrides", func(t *testing.T) {
@@ -56,7 +60,7 @@ target "webapp" {
 			os.Setenv("VAR_FROMENV"+t.Name(), "fromEnv")
 			defer os.Unsetenv("VAR_FROM_ENV" + t.Name())
 
-			m, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{
+			m, g, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{
 				"webapp.args.VAR_UNSET",
 				"webapp.args.VAR_EMPTY=",
 				"webapp.args.VAR_SET=bananas",
@@ -81,17 +85,23 @@ target "webapp" {
 
 			require.Equal(t, m["webapp"].Args["VAR_BOTH"], "webapp")
 			require.Equal(t, m["webapp"].Args["VAR_INHERITED"], "override")
+
+			require.Equal(t, 1, len(g))
+			require.Equal(t, []string{"webapp"}, g[0].Targets)
 		})
 
 		// building leaf but overriding parent fields
 		t.Run("parent", func(t *testing.T) {
-			m, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{
+			m, g, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{
 				"webDEP.args.VAR_INHERITED=override",
 				"webDEP.args.VAR_BOTH=override",
 			}, nil)
+
 			require.NoError(t, err)
 			require.Equal(t, m["webapp"].Args["VAR_INHERITED"], "override")
 			require.Equal(t, m["webapp"].Args["VAR_BOTH"], "webapp")
+			require.Equal(t, 1, len(g))
+			require.Equal(t, []string{"webapp"}, g[0].Targets)
 		})
 	})
 
@@ -99,40 +109,48 @@ target "webapp" {
 		_, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.context"}, nil)
 		require.NotNil(t, err)
 
-		m, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.context=foo"}, nil)
+		m, g, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.context=foo"}, nil)
 		require.NoError(t, err)
-
 		require.Equal(t, "foo", *m["webapp"].Context)
+		require.Equal(t, 1, len(g))
+		require.Equal(t, []string{"webapp"}, g[0].Targets)
 	})
 
 	t.Run("NoCacheOverride", func(t *testing.T) {
-		m, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.no-cache=false"}, nil)
+		m, g, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.no-cache=false"}, nil)
 		require.NoError(t, err)
 		require.Equal(t, false, *m["webapp"].NoCache)
+		require.Equal(t, 1, len(g))
+		require.Equal(t, []string{"webapp"}, g[0].Targets)
 	})
 
 	t.Run("PullOverride", func(t *testing.T) {
-		m, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.pull=false"}, nil)
+		m, g, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.pull=false"}, nil)
 		require.NoError(t, err)
 		require.Equal(t, false, *m["webapp"].Pull)
+		require.Equal(t, 1, len(g))
+		require.Equal(t, []string{"webapp"}, g[0].Targets)
 	})
 
 	t.Run("PatternOverride", func(t *testing.T) {
 		// same check for two cases
-		multiTargetCheck := func(t *testing.T, m map[string]*Target, err error) {
+		multiTargetCheck := func(t *testing.T, m map[string]*Target, g []*Group, err error) {
 			require.NoError(t, err)
 			require.Equal(t, 2, len(m))
 			require.Equal(t, "foo", *m["webapp"].Dockerfile)
 			require.Equal(t, "webDEP", m["webapp"].Args["VAR_INHERITED"])
 			require.Equal(t, "foo", *m["webDEP"].Dockerfile)
 			require.Equal(t, "webDEP", m["webDEP"].Args["VAR_INHERITED"])
+			require.Equal(t, 1, len(g))
+			sort.Strings(g[0].Targets)
+			require.Equal(t, []string{"webDEP", "webapp"}, g[0].Targets)
 		}
 
 		cases := []struct {
 			name      string
 			targets   []string
 			overrides []string
-			check     func(*testing.T, map[string]*Target, error)
+			check     func(*testing.T, map[string]*Target, []*Group, error)
 		}{
 			{
 				name:      "multi target single pattern",
@@ -150,18 +168,20 @@ target "webapp" {
 				name:      "single target",
 				targets:   []string{"webapp"},
 				overrides: []string{"web*.dockerfile=foo"},
-				check: func(t *testing.T, m map[string]*Target, err error) {
+				check: func(t *testing.T, m map[string]*Target, g []*Group, err error) {
 					require.NoError(t, err)
 					require.Equal(t, 1, len(m))
 					require.Equal(t, "foo", *m["webapp"].Dockerfile)
 					require.Equal(t, "webDEP", m["webapp"].Args["VAR_INHERITED"])
+					require.Equal(t, 1, len(g))
+					require.Equal(t, []string{"webapp"}, g[0].Targets)
 				},
 			},
 			{
 				name:      "nomatch",
 				targets:   []string{"webapp"},
 				overrides: []string{"nomatch*.dockerfile=foo"},
-				check: func(t *testing.T, m map[string]*Target, err error) {
+				check: func(t *testing.T, m map[string]*Target, g []*Group, err error) {
 					// NOTE: I am unsure whether failing to match should always error out
 					// instead of simply skipping that override.
 					// Let's enforce the error and we can relax it later if users complain.
@@ -172,8 +192,8 @@ target "webapp" {
 		}
 		for _, test := range cases {
 			t.Run(test.name, func(t *testing.T) {
-				m, _, err := ReadTargets(ctx, []File{fp}, test.targets, test.overrides, nil)
-				test.check(t, m, err)
+				m, g, err := ReadTargets(ctx, []File{fp}, test.targets, test.overrides, nil)
+				test.check(t, m, g, err)
 			})
 		}
 	})
@@ -260,16 +280,21 @@ services:
 
 	ctx := context.TODO()
 
-	m, _, err := ReadTargets(ctx, []File{fp, fp2}, []string{"default"}, nil, nil)
+	m, g, err := ReadTargets(ctx, []File{fp, fp2}, []string{"default"}, nil, nil)
 	require.NoError(t, err)
 
 	require.Equal(t, 3, len(m))
 	_, ok := m["newservice"]
+
 	require.True(t, ok)
 	require.Equal(t, "Dockerfile.webapp", *m["webapp"].Dockerfile)
 	require.Equal(t, ".", *m["webapp"].Context)
 	require.Equal(t, "1", m["webapp"].Args["buildno"])
 	require.Equal(t, "12", m["webapp"].Args["buildno2"])
+
+	require.Equal(t, 1, len(g))
+	sort.Strings(g[0].Targets)
+	require.Equal(t, []string{"db", "newservice", "webapp"}, g[0].Targets)
 }
 
 func TestHCLCwdPrefix(t *testing.T) {
@@ -282,7 +307,7 @@ func TestHCLCwdPrefix(t *testing.T) {
 			}`),
 	}
 	ctx := context.TODO()
-	m, _, err := ReadTargets(ctx, []File{fp}, []string{"app"}, nil, nil)
+	m, g, err := ReadTargets(ctx, []File{fp}, []string{"app"}, nil, nil)
 	require.NoError(t, err)
 
 	require.Equal(t, 1, len(m))
@@ -294,6 +319,9 @@ func TestHCLCwdPrefix(t *testing.T) {
 
 	require.Equal(t, "test", *m["app"].Dockerfile)
 	require.Equal(t, "foo", *m["app"].Context)
+
+	require.Equal(t, 1, len(g))
+	require.Equal(t, []string{"app"}, g[0].Targets)
 }
 
 func TestOverrideMerge(t *testing.T) {
@@ -324,3 +352,177 @@ func TestOverrideMerge(t *testing.T) {
 	require.Equal(t, 1, len(m["app"].Outputs))
 	require.Equal(t, "type=registry", m["app"].Outputs[0])
 }
+
+func TestReadTargetsMixed(t *testing.T) {
+	t.Parallel()
+
+	fTargetDefault := File{
+		Name: "docker-bake2.hcl",
+		Data: []byte(`
+target "default" {
+  dockerfile = "test"
+}`)}
+
+	fTargetImage := File{
+		Name: "docker-bake3.hcl",
+		Data: []byte(`
+target "image" {
+  dockerfile = "test"
+}`)}
+
+	fpHCL := File{
+		Name: "docker-bake.hcl",
+		Data: []byte(`
+group "default" {
+  targets = ["image"]
+}
+
+target "nocache" {
+  no-cache = true
+}
+
+group "release" {
+  targets = ["image-release"]
+}
+
+target "image" {
+  inherits = ["nocache"]
+  output = ["type=docker"]
+}
+
+target "image-release" {
+  inherits = ["image"]
+  output = ["type=image,push=true"]
+  tags = ["user/app:latest"]
+}`)}
+
+	fpYML := File{
+		Name: "docker-compose.yml",
+		Data: []byte(`
+services:
+  addon:
+    build:
+      context: .
+      dockerfile: ./Dockerfile
+      args:
+        CT_ECR: foo
+        CT_TAG: bar
+    image: ct-addon:bar
+    environment:
+      - NODE_ENV=test
+      - AWS_ACCESS_KEY_ID=dummy
+      - AWS_SECRET_ACCESS_KEY=dummy
+
+  aws:
+    build:
+      dockerfile: ./aws.Dockerfile
+      args:
+        CT_ECR: foo
+        CT_TAG: bar
+    image: ct-fake-aws:bar`)}
+
+	fpJSON := File{
+		Name: "docker-bake.json",
+		Data: []byte(`{
+	 "group": {
+	   "default": {
+	     "targets": [
+	       "image"
+	     ]
+	   }
+	 },
+	 "target": {
+	   "image": {
+	     "context": ".",
+	     "dockerfile": "Dockerfile",
+	     "output": [
+	       "type=docker"
+	     ]
+	   }
+	 }
+	}`)}
+
+	ctx := context.TODO()
+
+	m, g, err := ReadTargets(ctx, []File{fTargetDefault}, []string{"default"}, nil, nil)
+	require.NoError(t, err)
+	require.Equal(t, 0, len(g))
+	require.Equal(t, 1, len(m))
+	require.Equal(t, "test", *m["default"].Dockerfile)
+
+	_, _, err = ReadTargets(ctx, []File{fTargetImage}, []string{"default"}, nil, nil)
+	require.Error(t, err)
+
+	m, g, err = ReadTargets(ctx, []File{fTargetImage}, []string{"image"}, nil, nil)
+	require.NoError(t, err)
+	require.Equal(t, 1, len(g))
+	require.Equal(t, []string{"image"}, g[0].Targets)
+	require.Equal(t, 1, len(m))
+	require.Equal(t, "test", *m["image"].Dockerfile)
+
+	m, g, err = ReadTargets(ctx, []File{fTargetImage}, []string{"image"}, nil, nil)
+	require.NoError(t, err)
+	require.Equal(t, 1, len(g))
+	require.Equal(t, []string{"image"}, g[0].Targets)
+	require.Equal(t, 1, len(m))
+	require.Equal(t, "test", *m["image"].Dockerfile)
+
+	m, g, err = ReadTargets(ctx, []File{fpHCL}, []string{"image-release"}, nil, nil)
+	require.NoError(t, err)
+	require.Equal(t, 1, len(g))
+	require.Equal(t, []string{"image-release"}, g[0].Targets)
+	require.Equal(t, 1, len(m))
+	require.Equal(t, 1, len(m["image-release"].Outputs))
+	require.Equal(t, "type=image,push=true", m["image-release"].Outputs[0])
+
+	m, g, err = ReadTargets(ctx, []File{fpHCL}, []string{"image", "image-release"}, nil, nil)
+	require.NoError(t, err)
+	require.Equal(t, 1, len(g))
+	require.Equal(t, []string{"image", "image-release"}, g[0].Targets)
+	require.Equal(t, 2, len(m))
+	require.Equal(t, ".", *m["image"].Context)
+	require.Equal(t, 1, len(m["image-release"].Outputs))
+	require.Equal(t, "type=image,push=true", m["image-release"].Outputs[0])
+
+	m, g, err = ReadTargets(ctx, []File{fpYML, fpHCL}, []string{"default"}, nil, nil)
+	require.NoError(t, err)
+	require.Equal(t, 1, len(g))
+	require.Equal(t, []string{"image"}, g[0].Targets)
+	require.Equal(t, 1, len(m))
+	require.Equal(t, ".", *m["image"].Context)
+
+	m, g, err = ReadTargets(ctx, []File{fpJSON}, []string{"default"}, nil, nil)
+	require.NoError(t, err)
+	require.Equal(t, 1, len(g))
+	require.Equal(t, []string{"image"}, g[0].Targets)
+	require.Equal(t, 1, len(m))
+	require.Equal(t, ".", *m["image"].Context)
+
+	m, g, err = ReadTargets(ctx, []File{fpYML}, []string{"default"}, nil, nil)
+	require.NoError(t, err)
+	require.Equal(t, 1, len(g))
+	sort.Strings(g[0].Targets)
+	require.Equal(t, []string{"addon", "aws"}, g[0].Targets)
+	require.Equal(t, 2, len(m))
+	require.Equal(t, "./Dockerfile", *m["addon"].Dockerfile)
+	require.Equal(t, "./aws.Dockerfile", *m["aws"].Dockerfile)
+
+	m, g, err = ReadTargets(ctx, []File{fpYML, fpHCL}, []string{"addon", "aws"}, nil, nil)
+	require.NoError(t, err)
+	require.Equal(t, 1, len(g))
+	sort.Strings(g[0].Targets)
+	require.Equal(t, []string{"addon", "aws"}, g[0].Targets)
+	require.Equal(t, 2, len(m))
+	require.Equal(t, "./Dockerfile", *m["addon"].Dockerfile)
+	require.Equal(t, "./aws.Dockerfile", *m["aws"].Dockerfile)
+
+	m, g, err = ReadTargets(ctx, []File{fpYML, fpHCL}, []string{"addon", "aws", "image"}, nil, nil)
+	require.NoError(t, err)
+	require.Equal(t, 1, len(g))
+	sort.Strings(g[0].Targets)
+	require.Equal(t, []string{"addon", "aws", "image"}, g[0].Targets)
+	require.Equal(t, 3, len(m))
+	require.Equal(t, ".", *m["image"].Context)
+	require.Equal(t, "./Dockerfile", *m["addon"].Dockerfile)
+	require.Equal(t, "./aws.Dockerfile", *m["aws"].Dockerfile)
+}

commands/bake.go

@@ -38,7 +38,6 @@ func runBake(dockerCli command.Cli, targets []string, in bakeOptions) (err error
 	}()
 
 	var url string
-	var noTarget bool
 	cmdContext := "cwd://"
 
 	if len(targets) > 0 {
@@ -49,7 +48,6 @@ func runBake(dockerCli command.Cli, targets []string, in bakeOptions) (err error
 				if bake.IsRemoteURL(targets[0]) {
 					cmdContext = targets[0]
 					targets = targets[1:]
-
 				}
 			}
 		}
@@ -57,7 +55,6 @@ func runBake(dockerCli command.Cli, targets []string, in bakeOptions) (err error
 
 	if len(targets) == 0 {
 		targets = []string{"default"}
-		noTarget = true
 	}
 
 	overrides := in.overrides
@@ -107,7 +104,7 @@ func runBake(dockerCli command.Cli, targets []string, in bakeOptions) (err error
 		return err
 	}
 
-	t, g, err := bake.ReadTargets(ctx, files, targets, overrides, map[string]string{
+	tgts, grps, err := bake.ReadTargets(ctx, files, targets, overrides, map[string]string{
 		// Don't forget to update documentation if you add a new
 		// built-in variable: docs/reference/buildx_bake.md#built-in-variables
 		"BAKE_CMD_CONTEXT":    cmdContext,
@@ -118,31 +115,24 @@ func runBake(dockerCli command.Cli, targets []string, in bakeOptions) (err error
 	}
 
 	// this function can update target context string from the input so call before printOnly check
-	bo, err := bake.TargetsToBuildOpt(t, inp)
+	bo, err := bake.TargetsToBuildOpt(tgts, inp)
 	if err != nil {
 		return err
 	}
 
 	if in.printOnly {
-		defGroup := map[string][]string{
-			"default": targets,
-		}
-		if noTarget {
-			for _, group := range g {
-				if group.Name != "default" {
-					continue
-				}
-				defGroup = map[string][]string{
-					"default": group.Targets,
-				}
+		var defg map[string]*bake.Group
+		if len(grps) == 1 {
+			defg = map[string]*bake.Group{
+				"default": grps[0],
 			}
 		}
 		dt, err := json.MarshalIndent(struct {
-			Group  map[string][]string     `json:"group,omitempty"`
+			Group  map[string]*bake.Group  `json:"group,omitempty"`
 			Target map[string]*bake.Target `json:"target"`
 		}{
-			defGroup,
-			t,
+			defg,
+			tgts,
 		}, "", "  ")
 		if err != nil {
 			return err

docs/reference/buildx_bake.md

@@ -99,19 +99,23 @@ $ docker buildx bake -f docker-compose.dev.yaml backend database
 You can also use a remote `git` bake definition:
 
 ```console
-$ docker buildx bake "git://github.com/docker/cli#master" --print
-#1 [internal] load git source git://github.com/docker/cli#master
-#1 0.686 2776a6d694f988c0c1df61cad4bfac0f54e481c8       refs/heads/master
-#1 CACHED
+$ docker buildx bake "git://github.com/docker/cli#v20.10.11" --print
+#1 [internal] load git source git://github.com/docker/cli#v20.10.11
+#1 0.745 e8f1871b077b64bcb4a13334b7146492773769f7       refs/tags/v20.10.11
+#1 2.022 From git://github.com/docker/cli
+#1 2.022  * [new tag]         v20.10.11  -> v20.10.11
+#1 DONE 2.9s
 {
   "group": {
-    "default": [
-      "binary"
-    ]
+    "default": {
+      "targets": [
+        "binary"
+      ]
+    }
   },
   "target": {
     "binary": {
-      "context": "git://github.com/docker/cli#master",
+      "context": "git://github.com/docker/cli#v20.10.11",
       "dockerfile": "Dockerfile",
       "args": {
         "BASE_VARIANT": "alpine",
@@ -153,11 +157,6 @@ EOT
 ```console
 $ docker buildx bake "git://github.com/tonistiigi/buildx#remote-test" --print
 {
-  "group": {
-    "default": [
-      "default"
-    ]
-  },
   "target": {
     "default": {
       "context": ".",
@@ -180,19 +179,14 @@ $ docker buildx bake "git://github.com/tonistiigi/buildx#remote-test"
 ```
 
 ```console
-$ docker buildx bake "git://github.com/tonistiigi/buildx#remote-test" "git://github.com/docker/cli#master" --print
+$ docker buildx bake "git://github.com/tonistiigi/buildx#remote-test" "git://github.com/docker/cli#v20.10.11" --print
 #1 [internal] load git source git://github.com/tonistiigi/buildx#remote-test
-#1 0.401 577303add004dd7efeb13434d69ea030d35f7888       refs/heads/remote-test
+#1 0.429 577303add004dd7efeb13434d69ea030d35f7888       refs/heads/remote-test
 #1 CACHED
 {
-  "group": {
-    "default": [
-      "default"
-    ]
-  },
   "target": {
     "default": {
-      "context": "git://github.com/docker/cli#master",
+      "context": "git://github.com/docker/cli#v20.10.11",
       "dockerfile": "Dockerfile",
       "dockerfile-inline": "FROM alpine\nWORKDIR /src\nCOPY . .\nRUN ls -l \u0026\u0026 stop\n"
     }
@@ -201,7 +195,7 @@ $ docker buildx bake "git://github.com/tonistiigi/buildx#remote-test" "git://git
 ```
 
 ```console
-$ docker buildx bake "git://github.com/tonistiigi/buildx#remote-test" "git://github.com/docker/cli#master"
+$ docker buildx bake "git://github.com/tonistiigi/buildx#remote-test" "git://github.com/docker/cli#v20.10.11"
 ...
  > [4/4] RUN ls -l && stop:
 #8 0.136 drwxrwxrwx    5 root     root          4096 Jul 27 18:31 kubernetes
@@ -229,9 +223,11 @@ format, without starting a build.
 $ docker buildx bake -f docker-bake.hcl --print db
 {
   "group": {
-    "default": [
-      "db"
-    ]
+    "default": {
+      "targets": [
+        "db"
+      ]
+    }
   },
   "target": {
     "db": {
@@ -372,9 +368,11 @@ You can use this file directly:
 $ docker buildx bake --print app
 {
   "group": {
-    "default": [
-      "app"
-    ]
+    "default": {
+      "targets": [
+        "app"
+      ]
+    }
   },
   "target": {
     "app": {
@@ -402,9 +400,11 @@ And invoke bake together with both of the files:
 $ docker buildx bake -f docker-bake.hcl -f env.hcl --print app
 {
   "group": {
-    "default": [
-      "app"
-    ]
+    "default": {
+      "targets": [
+        "app"
+      ]
+    }
   },
   "target": {
     "app": {
@@ -454,9 +454,11 @@ target "webapp" {
 $ docker buildx bake --print webapp
 {
   "group": {
-    "default": [
-      "webapp"
-    ]
+    "default": {
+      "targets": [
+        "webapp"
+      ]
+    }
   },
   "target": {
     "webapp": {
@@ -474,9 +476,11 @@ $ docker buildx bake --print webapp
 $ TAG=$(git rev-parse --short HEAD) docker buildx bake --print webapp
 {
   "group": {
-    "default": [
-      "webapp"
-    ]
+    "default": {
+      "targets": [
+        "webapp"
+      ]
+    }
   },
   "target": {
     "webapp": {
@@ -516,9 +520,11 @@ target "webapp" {
 $ docker buildx bake --print webapp
 {
   "group": {
-    "default": [
-      "webapp"
-    ]
+    "default": {
+      "targets": [
+        "webapp"
+      ]
+    }
   },
   "target": {
     "webapp": {
@@ -559,9 +565,11 @@ target "webapp" {
 $ docker buildx bake --print webapp
 {
   "group": {
-    "default": [
-      "webapp"
-    ]
+    "default": {
+      "targets": [
+        "webapp"
+      ]
+    }
   },
   "target": {
     "webapp": {
@@ -604,9 +612,11 @@ target "webapp" {
 $ docker buildx bake --print webapp
 {
   "group": {
-    "default": [
-      "webapp"
-    ]
+    "default": {
+      "targets": [
+        "webapp"
+      ]
+    }
   },
   "target": {
     "webapp": {
@@ -645,9 +655,11 @@ target "webapp" {
 $ docker buildx bake --print webapp
 {
   "group": {
-    "default": [
-      "webapp"
-    ]
+    "default": {
+      "targets": [
+        "webapp"
+      ]
+    }
   },
   "target": {
     "webapp": {
@@ -700,9 +712,11 @@ target "app" {
 $ docker buildx bake -f docker-bake1.hcl -f docker-bake2.hcl --print app
 {
   "group": {
-    "default": [
-      "app"
-    ]
+    "default": {
+      "targets": [
+        "app"
+      ]
+    }
   },
   "target": {
     "app": {
@@ -744,9 +758,11 @@ target "app" {
 $ docker buildx bake --print app
 {
   "group": {
-    "default": [
-      "app"
-    ]
+    "default": {
+      "targets": [
+        "app"
+      ]
+    }
   },
   "target": {
     "app": {
@@ -810,6 +826,14 @@ services:
 ```console
 $ docker buildx bake --print
 {
+  "group": {
+    "default": {
+      "targets": [
+        "aws",
+        "addon"
+      ]
+    }
+  },
   "target": {
     "addon": {
       "context": ".",

driver/docker-container/driver.go

@@ -37,6 +37,7 @@ const (
 type Driver struct {
 	driver.InitConfig
 	factory      driver.Factory
+	userNSRemap  bool // true if dockerd is running with userns-remap mode
 	netMode      string
 	image        string
 	cgroupParent string
@@ -112,7 +113,6 @@ func (d *Driver) create(ctx context.Context, l progress.SubLogger) error {
 	if err := l.Wrap("creating container "+d.Name, func() error {
 		hc := &container.HostConfig{
 			Privileged: true,
-			UsernsMode: "host",
 			Mounts: []mount.Mount{
 				{
 					Type:   mount.TypeVolume,
@@ -121,6 +121,9 @@ func (d *Driver) create(ctx context.Context, l progress.SubLogger) error {
 				},
 			},
 		}
+		if d.userNSRemap {
+			hc.UsernsMode = "host"
+		}
 		if d.netMode != "" {
 			hc.NetworkMode = container.NetworkMode(d.netMode)
 		}

driver/docker-container/factory.go

@@ -6,6 +6,7 @@ import (
 	"strings"
 
 	"github.com/docker/buildx/driver"
+	dockertypes "github.com/docker/docker/api/types"
 	dockerclient "github.com/docker/docker/client"
 	"github.com/pkg/errors"
 )
@@ -40,6 +41,20 @@ func (f *factory) New(ctx context.Context, cfg driver.InitConfig) (driver.Driver
 		return nil, errors.Errorf("%s driver requires docker API access", f.Name())
 	}
 	d := &Driver{factory: f, InitConfig: cfg}
+	dockerInfo, err := cfg.DockerAPI.Info(ctx)
+	if err != nil {
+		return nil, err
+	}
+	secOpts, err := dockertypes.DecodeSecurityOptions(dockerInfo.SecurityOptions)
+	if err != nil {
+		return nil, err
+	}
+	for _, f := range secOpts {
+		if f.Name == "userns" {
+			d.userNSRemap = true
+			break
+		}
+	}
 	for k, v := range cfg.DriverOpts {
 		switch {
 		case k == "network":

go.mod

@@ -57,7 +57,8 @@ require (
 
 replace (
 	github.com/docker/cli => github.com/docker/cli v20.10.3-0.20210702143511-f782d1355eff+incompatible
-	github.com/docker/docker => github.com/docker/docker v20.10.3-0.20210817025855-ba2adeebdb8d+incompatible
+	github.com/docker/docker => github.com/tonistiigi/docker v0.10.1-0.20211122204227-65a6f25dbca2
+	github.com/tonistiigi/fsutil => github.com/tonistiigi/fsutil v0.0.0-20211122210416-da5201e0b3af
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc => github.com/tonistiigi/opentelemetry-go-contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.0.0-20210714055410-d010b05b4939
 	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace => github.com/tonistiigi/opentelemetry-go-contrib/instrumentation/net/http/httptrace/otelhttptrace v0.0.0-20210714055410-d010b05b4939
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp => github.com/tonistiigi/opentelemetry-go-contrib/instrumentation/net/http/otelhttp v0.0.0-20210714055410-d010b05b4939

go.sum

@@ -421,8 +421,6 @@ github.com/docker/distribution v2.6.0-rc.1.0.20180327202408-83389a148052+incompa
 github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.7.1+incompatible h1:a5mlkVzth6W5A4fOsS3D2EO5BUmsJpcB+cRlLU7cSug=
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v20.10.3-0.20210817025855-ba2adeebdb8d+incompatible h1:tSd7TeZCH0j9m4P14bfe/eO1KYawrt3DztHI8gZAmLM=
-github.com/docker/docker v20.10.3-0.20210817025855-ba2adeebdb8d+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.6.3/go.mod h1:WRaJzqw3CTB9bk10avuGsjVBZsD05qeibJ1/TYlvc0Y=
 github.com/docker/docker-credential-helpers v0.6.4 h1:axCks+yV+2MR3/kZhAmy07yC56WZ2Pwu/fKWtKuZB0o=
 github.com/docker/docker-credential-helpers v0.6.4/go.mod h1:ofX3UI0Gz1TteYBjtgs07O36Pyasyp66D2uKT7H8W1c=
@@ -915,7 +913,6 @@ github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
 github.com/moby/spdystream v0.2.0 h1:cjW1zVyyoiM0T7b6UoySUFqzXMoqRckQtXwGPiBhOM8=
 github.com/moby/spdystream v0.2.0/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c=
-github.com/moby/sys/mount v0.1.0/go.mod h1:FVQFLDRWwyBjDTBNQXDlWnSFREqOo3OKX9aqhmeoo74=
 github.com/moby/sys/mount v0.1.1/go.mod h1:FVQFLDRWwyBjDTBNQXDlWnSFREqOo3OKX9aqhmeoo74=
 github.com/moby/sys/mount v0.2.0 h1:WhCW5B355jtxndN5ovugJlMFJawbUODuW8fSnEH6SSM=
 github.com/moby/sys/mount v0.2.0/go.mod h1:aAivFE2LB3W4bACsUXChRHQ0qKWsetY4Y9V7sxOougM=
@@ -990,7 +987,6 @@ github.com/opencontainers/image-spec v1.0.2-0.20210819154149-5ad6f50d6283 h1:TVz
 github.com/opencontainers/image-spec v1.0.2-0.20210819154149-5ad6f50d6283/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
 github.com/opencontainers/runc v0.0.0-20190115041553-12f6a991201f/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
 github.com/opencontainers/runc v0.1.1/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
-github.com/opencontainers/runc v1.0.0-rc10/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
 github.com/opencontainers/runc v1.0.0-rc8.0.20190926000215-3e425f80a8c9/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
 github.com/opencontainers/runc v1.0.0-rc9/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
 github.com/opencontainers/runc v1.0.0-rc92/go.mod h1:X1zlU4p7wOlX4+WRCz+hvlRv8phdL7UqbYD+vQwNMmE=
@@ -1203,9 +1199,10 @@ github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
 github.com/tommy-muehle/go-mnd v1.1.1/go.mod h1:dSUh0FtTP8VhvkL1S+gUR1OKd9ZnSaozuI6r3m6wOig=
 github.com/tommy-muehle/go-mnd v1.3.1-0.20200224220436-e6f9a994e8fa/go.mod h1:dSUh0FtTP8VhvkL1S+gUR1OKd9ZnSaozuI6r3m6wOig=
-github.com/tonistiigi/fsutil v0.0.0-20201103201449-0834f99b7b85/go.mod h1:a7cilN64dG941IOXfhJhlH0qB92hxJ9A1ewrdUmJ6xo=
-github.com/tonistiigi/fsutil v0.0.0-20210818161904-4442383b5028 h1:uEkkUFMCPtzz1HVOa42u15OHems1ugiRt172tSRTWSk=
-github.com/tonistiigi/fsutil v0.0.0-20210818161904-4442383b5028/go.mod h1:E6osHKls9ix67jofYQ61RQKwlJhqJOZM2hintp+49iI=
+github.com/tonistiigi/docker v0.10.1-0.20211122204227-65a6f25dbca2 h1:e6PyP4Gi3HZ9hSH9gGGGSaBh3EI+HZj5E4fgEV43ZCI=
+github.com/tonistiigi/docker v0.10.1-0.20211122204227-65a6f25dbca2/go.mod h1:v9W/4hjeg+54O4ffkt1Dnh7nOIE9uHi9F0W9clN3nTQ=
+github.com/tonistiigi/fsutil v0.0.0-20211122210416-da5201e0b3af h1:G5OoRy5gm3D9uLT0JIlgjB0aJPyTM48GFDqS9ESQPW4=
+github.com/tonistiigi/fsutil v0.0.0-20211122210416-da5201e0b3af/go.mod h1:WnebnONB1EcTV5BdGlPLPlCX+FVMKhTnGZP2BvmyhgE=
 github.com/tonistiigi/go-actions-cache v0.0.0-20211002214948-4d48f2ff622a/go.mod h1:YiIBjH5gP7mao3t0dBrNNBGuKYdeJmcAJjYLXr43k6A=
 github.com/tonistiigi/opentelemetry-go-contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.0.0-20210714055410-d010b05b4939 h1:s6wDMZYNyWt8KvkjhrMpOthFPgI3JB8ipJS+eCV/psg=
 github.com/tonistiigi/opentelemetry-go-contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.0.0-20210714055410-d010b05b4939/go.mod h1:Vm5u/mtkj1OMhtao0v+BGo2LUoLCgHYXvRmj0jWITlE=
@@ -1563,7 +1560,6 @@ golang.org/x/sys v0.0.0-20200831180312-196b9ba8737a/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200909081042-eff7692f9009/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200916030750-2334cc1a136f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200917073148-efd3b9a0ff20/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200922070232-aee5d888a860/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201013081832-0aaa2718063a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=

vendor/github.com/docker/docker/pkg/archive/archive.go

@@ -809,8 +809,8 @@ func TarWithOptions(srcPath string, options *TarOptions) (io.ReadCloser, error)
 			rebaseName := options.RebaseNames[include]
 
 			var (
-				parentMatched []bool
-				parentDirs    []string
+				parentMatchInfo []fileutils.MatchInfo
+				parentDirs      []string
 			)
 
 			walkRoot := getWalkRoot(srcPath, include)
@@ -845,13 +845,14 @@ func TarWithOptions(srcPath string, options *TarOptions) (io.ReadCloser, error)
 							break
 						}
 						parentDirs = parentDirs[:len(parentDirs)-1]
-						parentMatched = parentMatched[:len(parentMatched)-1]
+						parentMatchInfo = parentMatchInfo[:len(parentMatchInfo)-1]
 					}
 
-					if len(parentMatched) != 0 {
-						skip, err = pm.MatchesUsingParentResult(relFilePath, parentMatched[len(parentMatched)-1])
+					var matchInfo fileutils.MatchInfo
+					if len(parentMatchInfo) != 0 {
+						skip, matchInfo, err = pm.MatchesUsingParentResults(relFilePath, parentMatchInfo[len(parentMatchInfo)-1])
 					} else {
-						skip, err = pm.MatchesOrParentMatches(relFilePath)
+						skip, matchInfo, err = pm.MatchesUsingParentResults(relFilePath, fileutils.MatchInfo{})
 					}
 					if err != nil {
 						logrus.Errorf("Error matching %s: %v", relFilePath, err)
@@ -860,7 +861,7 @@ func TarWithOptions(srcPath string, options *TarOptions) (io.ReadCloser, error)
 
 					if f.IsDir() {
 						parentDirs = append(parentDirs, relFilePath)
-						parentMatched = append(parentMatched, skip)
+						parentMatchInfo = append(parentMatchInfo, matchInfo)
 					}
 				}
 

vendor/github.com/docker/docker/pkg/fileutils/fileutils.go

@@ -62,9 +62,9 @@ func NewPatternMatcher(patterns []string) (*PatternMatcher, error) {
 //
 // Matches is not safe to call concurrently.
 //
-// This implementation is buggy (it only checks a single parent dir against the
-// pattern) and will be removed soon. Use either MatchesOrParentMatches or
-// MatchesUsingParentResult instead.
+// Depercated: This implementation is buggy (it only checks a single parent dir
+// against the pattern) and will be removed soon. Use either
+// MatchesOrParentMatches or MatchesUsingParentResults instead.
 func (pm *PatternMatcher) Matches(file string) (bool, error) {
 	matched := false
 	file = filepath.FromSlash(file)
@@ -150,6 +150,11 @@ func (pm *PatternMatcher) MatchesOrParentMatches(file string) (bool, error) {
 // The "file" argument should be a slash-delimited path.
 //
 // MatchesUsingParentResult is not safe to call concurrently.
+//
+// Deprecated: this function does behave correctly in some cases (see
+// https://github.com/docker/buildx/issues/850).
+//
+// Use MatchesUsingParentResults instead.
 func (pm *PatternMatcher) MatchesUsingParentResult(file string, parentMatched bool) (bool, error) {
 	matched := parentMatched
 	file = filepath.FromSlash(file)
@@ -174,6 +179,78 @@ func (pm *PatternMatcher) MatchesUsingParentResult(file string, parentMatched bo
 	return matched, nil
 }
 
+// MatchInfo tracks information about parent dir matches while traversing a
+// filesystem.
+type MatchInfo struct {
+	parentMatched []bool
+}
+
+// MatchesUsingParentResults returns true if "file" matches any of the patterns
+// and isn't excluded by any of the subsequent patterns. The functionality is
+// the same as Matches, but as an optimization, the caller passes in
+// intermediate results from matching the parent directory.
+//
+// The "file" argument should be a slash-delimited path.
+//
+// MatchesUsingParentResults is not safe to call concurrently.
+func (pm *PatternMatcher) MatchesUsingParentResults(file string, parentMatchInfo MatchInfo) (bool, MatchInfo, error) {
+	parentMatched := parentMatchInfo.parentMatched
+	if len(parentMatched) != 0 && len(parentMatched) != len(pm.patterns) {
+		return false, MatchInfo{}, errors.New("wrong number of values in parentMatched")
+	}
+
+	file = filepath.FromSlash(file)
+	matched := false
+
+	matchInfo := MatchInfo{
+		parentMatched: make([]bool, len(pm.patterns)),
+	}
+	for i, pattern := range pm.patterns {
+		match := false
+		// If the parent matched this pattern, we don't need to recheck.
+		if len(parentMatched) != 0 {
+			match = parentMatched[i]
+		}
+
+		if !match {
+			// Skip evaluation if this is an inclusion and the filename
+			// already matched the pattern, or it's an exclusion and it has
+			// not matched the pattern yet.
+			if pattern.exclusion != matched {
+				continue
+			}
+
+			var err error
+			match, err = pattern.match(file)
+			if err != nil {
+				return false, matchInfo, err
+			}
+
+			// If the zero value of MatchInfo was passed in, we don't have
+			// any information about the parent dir's match results, and we
+			// apply the same logic as MatchesOrParentMatches.
+			if len(parentMatched) == 0 {
+				if parentPath := filepath.Dir(file); parentPath != "." {
+					parentPathDirs := strings.Split(parentPath, string(os.PathSeparator))
+					// Check to see if the pattern matches one of our parent dirs.
+					for i := range parentPathDirs {
+						match, _ = pattern.match(strings.Join(parentPathDirs[:i+1], string(os.PathSeparator)))
+						if match {
+							break
+						}
+					}
+				}
+			}
+		}
+		matchInfo.parentMatched[i] = match
+
+		if match {
+			matched = !pattern.exclusion
+		}
+	}
+	return matched, matchInfo, nil
+}
+
 // Exclusions returns true if any of the patterns define exclusions
 func (pm *PatternMatcher) Exclusions() bool {
 	return pm.exclusions

vendor/github.com/tonistiigi/fsutil/diff_containerd.go

@@ -33,6 +33,19 @@ const (
 	ChangeKindDelete
 )
 
+func (k ChangeKind) String() string {
+	switch k {
+	case ChangeKindAdd:
+		return "add"
+	case ChangeKindModify:
+		return "modify"
+	case ChangeKindDelete:
+		return "delete"
+	default:
+		return "unknown"
+	}
+}
+
 // ChangeFunc is the type of function called for each change
 // computed during a directory changes calculation.
 type ChangeFunc func(ChangeKind, string, os.FileInfo, error) error

vendor/github.com/tonistiigi/fsutil/diskwriter_freebsd.go

@@ -0,0 +1,14 @@
+// +build freebsd
+
+package fsutil
+
+import (
+	"github.com/tonistiigi/fsutil/types"
+	"golang.org/x/sys/unix"
+)
+
+func createSpecialFile(path string, mode uint32, stat *types.Stat) error {
+	dev := unix.Mkdev(uint32(stat.Devmajor), uint32(stat.Devminor))
+
+	return unix.Mknod(path, mode, dev)
+}

vendor/github.com/tonistiigi/fsutil/diskwriter_unix.go

@@ -45,7 +45,7 @@ func handleTarTypeBlockCharFifo(path string, stat *types.Stat) error {
 		mode |= syscall.S_IFBLK
 	}
 
-	if err := syscall.Mknod(path, mode, int(mkdev(stat.Devmajor, stat.Devminor))); err != nil {
+	if err := createSpecialFile(path, mode, stat); err != nil {
 		return errors.WithStack(err)
 	}
 	return nil

vendor/github.com/tonistiigi/fsutil/diskwriter_unixnobsd.go

@@ -0,0 +1,13 @@
+// +build !windows,!freebsd
+
+package fsutil
+
+import (
+	"syscall"
+
+	"github.com/tonistiigi/fsutil/types"
+)
+
+func createSpecialFile(path string, mode uint32, stat *types.Stat) error {
+	return syscall.Mknod(path, mode, int(mkdev(stat.Devmajor, stat.Devminor)))
+}

vendor/github.com/tonistiigi/fsutil/docker-bake.hcl

@@ -63,5 +63,5 @@ target "shfmt" {
 
 target "cross" {
   inherits = ["build"]
-  platforms = ["linux/amd64", "linux/386", "linux/arm64", "linux/arm", "linux/ppc64le", "linux/s390x"]
+  platforms = ["linux/amd64", "linux/386", "linux/arm64", "linux/arm", "linux/ppc64le", "linux/s390x", "darwin/amd64", "darwin/arm64", "windows/amd64", "freebsd/amd64", "freebsd/arm64"]
 }

vendor/github.com/tonistiigi/fsutil/go.mod

@@ -18,3 +18,5 @@ require (
 	gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
 	gotest.tools/v3 v3.0.3 // indirect
 )
+
+replace github.com/docker/docker => github.com/aaronlehmann/docker v1.4.2-0.20211119215941-554d44fa45a2

vendor/github.com/tonistiigi/fsutil/go.sum

@@ -2,6 +2,8 @@ bazil.org/fuse v0.0.0-20160811212531-371fbbdaa898/go.mod h1:Xbm+BRKSBEpa4q4hTSxo
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
+github.com/aaronlehmann/docker v1.4.2-0.20211119215941-554d44fa45a2 h1:W1DM5Z2Yym6DVr1Qcx+HCECYYjoAGWfYfgS1prcqoc4=
+github.com/aaronlehmann/docker v1.4.2-0.20211119215941-554d44fa45a2/go.mod h1:fLQH6hJxU6jTc+JFQWNyw/nl0i9+jjwDmugekrLew18=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
@@ -23,8 +25,6 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
-github.com/docker/docker v20.10.3-0.20210817025855-ba2adeebdb8d+incompatible h1:tSd7TeZCH0j9m4P14bfe/eO1KYawrt3DztHI8gZAmLM=
-github.com/docker/docker v20.10.3-0.20210817025855-ba2adeebdb8d+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=

vendor/github.com/tonistiigi/fsutil/prefix/match.go

@@ -1,45 +0,0 @@
-package prefix
-
-import (
-	"path"
-	"path/filepath"
-	"strings"
-)
-
-// Match matches a path against a pattern. It returns m = true if the path
-// matches the pattern, and partial = true if the pattern has more separators
-// than the path and the common components match (for example, name = foo and
-// pattern = foo/bar/*). slashSeparator determines whether the path and pattern
-// are '/' delimited (true) or use the native path separator (false).
-func Match(pattern, name string, slashSeparator bool) (m bool, partial bool) {
-	separator := filepath.Separator
-	if slashSeparator {
-		separator = '/'
-	}
-	count := strings.Count(name, string(separator))
-	if strings.Count(pattern, string(separator)) > count {
-		pattern = trimUntilIndex(pattern, string(separator), count)
-		partial = true
-	}
-	if slashSeparator {
-		m, _ = path.Match(pattern, name)
-	} else {
-		m, _ = filepath.Match(pattern, name)
-	}
-	return m, partial
-}
-
-func trimUntilIndex(str, sep string, count int) string {
-	s := str
-	i := 0
-	c := 0
-	for {
-		idx := strings.Index(s, sep)
-		s = s[idx+len(sep):]
-		i += idx + len(sep)
-		c++
-		if c > count {
-			return str[:i-len(sep)]
-		}
-	}
-}

vendor/github.com/tonistiigi/fsutil/walker.go

@@ -10,7 +10,6 @@ import (
 
 	"github.com/docker/docker/pkg/fileutils"
 	"github.com/pkg/errors"
-	"github.com/tonistiigi/fsutil/prefix"
 	"github.com/tonistiigi/fsutil/types"
 )
 
@@ -36,20 +35,15 @@ func Walk(ctx context.Context, p string, opt *WalkOpt, fn filepath.WalkFunc) err
 		return errors.WithStack(&os.PathError{Op: "walk", Path: root, Err: syscall.ENOTDIR})
 	}
 
-	var pm *fileutils.PatternMatcher
-	if opt != nil && opt.ExcludePatterns != nil {
-		pm, err = fileutils.NewPatternMatcher(opt.ExcludePatterns)
-		if err != nil {
-			return errors.Wrapf(err, "invalid excludepatterns: %s", opt.ExcludePatterns)
-		}
-	}
+	var (
+		includePatterns []string
+		includeMatcher  *fileutils.PatternMatcher
+		excludeMatcher  *fileutils.PatternMatcher
+	)
 
-	var includePatterns []string
 	if opt != nil && opt.IncludePatterns != nil {
 		includePatterns = make([]string, len(opt.IncludePatterns))
-		for k := range opt.IncludePatterns {
-			includePatterns[k] = filepath.Clean(opt.IncludePatterns[k])
-		}
+		copy(includePatterns, opt.IncludePatterns)
 	}
 	if opt != nil && opt.FollowPaths != nil {
 		targets, err := FollowLinks(p, opt.FollowPaths)
@@ -61,13 +55,32 @@ func Walk(ctx context.Context, p string, opt *WalkOpt, fn filepath.WalkFunc) err
 			includePatterns = dedupePaths(includePatterns)
 		}
 	}
+	if len(includePatterns) != 0 {
+		includeMatcher, err = fileutils.NewPatternMatcher(includePatterns)
+		if err != nil {
+			return errors.Wrapf(err, "invalid includepatterns: %s", opt.IncludePatterns)
+		}
+	}
 
-	var (
-		lastIncludedDir string
+	if opt != nil && opt.ExcludePatterns != nil {
+		excludeMatcher, err = fileutils.NewPatternMatcher(opt.ExcludePatterns)
+		if err != nil {
+			return errors.Wrapf(err, "invalid excludepatterns: %s", opt.ExcludePatterns)
+		}
+	}
 
-		parentDirs           []string // used only for exclude handling
-		parentMatchedExclude []bool
-	)
+	type visitedDir struct {
+		fi               os.FileInfo
+		path             string
+		origpath         string
+		pathWithSep      string
+		includeMatchInfo fileutils.MatchInfo
+		excludeMatchInfo fileutils.MatchInfo
+		calledFn         bool
+	}
+
+	// used only for include/exclude handling
+	var parentDirs []visitedDir
 
 	seenFiles := make(map[uint64]string)
 	return filepath.Walk(root, func(path string, fi os.FileInfo, err error) (retErr error) {
@@ -90,87 +103,84 @@ func Walk(ctx context.Context, p string, opt *WalkOpt, fn filepath.WalkFunc) err
 			return nil
 		}
 
-		if opt != nil {
-			if includePatterns != nil {
-				skip := false
-				if lastIncludedDir != "" {
-					if strings.HasPrefix(path, lastIncludedDir+string(filepath.Separator)) {
-						skip = true
-					}
-				}
+		var dir visitedDir
 
-				if !skip {
-					matched := false
-					partial := true
-					for _, pattern := range includePatterns {
-						if ok, p := prefix.Match(pattern, path, false); ok {
-							matched = true
-							if !p {
-								partial = false
-								break
-							}
-						}
-					}
-					if !matched {
-						if fi.IsDir() {
-							return filepath.SkipDir
-						}
-						return nil
-					}
-					if !partial && fi.IsDir() {
-						lastIncludedDir = path
-					}
+		if includeMatcher != nil || excludeMatcher != nil {
+			for len(parentDirs) != 0 {
+				lastParentDir := parentDirs[len(parentDirs)-1].pathWithSep
+				if strings.HasPrefix(path, lastParentDir) {
+					break
 				}
+				parentDirs = parentDirs[:len(parentDirs)-1]
 			}
-			if pm != nil {
-				for len(parentMatchedExclude) != 0 {
-					lastParentDir := parentDirs[len(parentDirs)-1]
-					if strings.HasPrefix(path, lastParentDir) {
-						break
-					}
-					parentDirs = parentDirs[:len(parentDirs)-1]
-					parentMatchedExclude = parentMatchedExclude[:len(parentMatchedExclude)-1]
-				}
 
-				var m bool
-				if len(parentMatchedExclude) != 0 {
-					m, err = pm.MatchesUsingParentResult(path, parentMatchedExclude[len(parentMatchedExclude)-1])
-				} else {
-					m, err = pm.MatchesOrParentMatches(path)
-				}
-				if err != nil {
-					return errors.Wrap(err, "failed to match excludepatterns")
-				}
-
-				var dirSlash string
-				if fi.IsDir() {
-					dirSlash = path + string(filepath.Separator)
-					parentDirs = append(parentDirs, dirSlash)
-					parentMatchedExclude = append(parentMatchedExclude, m)
-				}
-
-				if m {
-					if fi.IsDir() {
-						if !pm.Exclusions() {
-							return filepath.SkipDir
-						}
-						for _, pat := range pm.Patterns() {
-							if !pat.Exclusion() {
-								continue
-							}
-							patStr := pat.String() + string(filepath.Separator)
-							if strings.HasPrefix(patStr, dirSlash) {
-								goto passedFilter
-							}
-						}
-						return filepath.SkipDir
-					}
-					return nil
+			if fi.IsDir() {
+				dir = visitedDir{
+					fi:          fi,
+					path:        path,
+					origpath:    origpath,
+					pathWithSep: path + string(filepath.Separator),
 				}
 			}
 		}
 
-	passedFilter:
+		skip := false
+
+		if includeMatcher != nil {
+			var parentIncludeMatchInfo fileutils.MatchInfo
+			if len(parentDirs) != 0 {
+				parentIncludeMatchInfo = parentDirs[len(parentDirs)-1].includeMatchInfo
+			}
+			m, matchInfo, err := includeMatcher.MatchesUsingParentResults(path, parentIncludeMatchInfo)
+			if err != nil {
+				return errors.Wrap(err, "failed to match includepatterns")
+			}
+
+			if fi.IsDir() {
+				dir.includeMatchInfo = matchInfo
+			}
+
+			if !m {
+				skip = true
+			}
+		}
+
+		if excludeMatcher != nil {
+			var parentExcludeMatchInfo fileutils.MatchInfo
+			if len(parentDirs) != 0 {
+				parentExcludeMatchInfo = parentDirs[len(parentDirs)-1].excludeMatchInfo
+			}
+			m, matchInfo, err := excludeMatcher.MatchesUsingParentResults(path, parentExcludeMatchInfo)
+			if err != nil {
+				return errors.Wrap(err, "failed to match excludepatterns")
+			}
+
+			if fi.IsDir() {
+				dir.excludeMatchInfo = matchInfo
+			}
+
+			if m {
+				if fi.IsDir() && !excludeMatcher.Exclusions() {
+					return filepath.SkipDir
+				}
+				skip = true
+			}
+		}
+
+		if includeMatcher != nil || excludeMatcher != nil {
+			defer func() {
+				if fi.IsDir() {
+					parentDirs = append(parentDirs, dir)
+				}
+			}()
+		}
+
+		if skip {
+			return nil
+		}
+
+		dir.calledFn = true
+
 		stat, err := mkstat(origpath, path, fi, seenFiles)
 		if err != nil {
 			return err
@@ -185,6 +195,31 @@ func Walk(ctx context.Context, p string, opt *WalkOpt, fn filepath.WalkFunc) err
 					return nil
 				}
 			}
+			for i, parentDir := range parentDirs {
+				if parentDir.calledFn {
+					continue
+				}
+				parentStat, err := mkstat(parentDir.origpath, parentDir.path, parentDir.fi, seenFiles)
+				if err != nil {
+					return err
+				}
+
+				select {
+				case <-ctx.Done():
+					return ctx.Err()
+				default:
+				}
+				if opt != nil && opt.Map != nil {
+					if allowed := opt.Map(parentStat.Path, parentStat); !allowed {
+						continue
+					}
+				}
+
+				if err := fn(parentStat.Path, &StatInfo{parentStat}, nil); err != nil {
+					return err
+				}
+				parentDirs[i].calledFn = true
+			}
 			if err := fn(stat.Path, &StatInfo{stat}, nil); err != nil {
 				return err
 			}

vendor/modules.txt

@@ -126,7 +126,7 @@ github.com/docker/distribution/registry/client/transport
 github.com/docker/distribution/registry/storage/cache
 github.com/docker/distribution/registry/storage/cache/memory
 github.com/docker/distribution/uuid
-# github.com/docker/docker v20.10.7+incompatible => github.com/docker/docker v20.10.3-0.20210817025855-ba2adeebdb8d+incompatible
+# github.com/docker/docker v20.10.7+incompatible => github.com/tonistiigi/docker v0.10.1-0.20211122204227-65a6f25dbca2
 ## explicit
 github.com/docker/docker/api
 github.com/docker/docker/api/types
@@ -416,9 +416,8 @@ github.com/theupdateframework/notary/tuf/data
 github.com/theupdateframework/notary/tuf/signed
 github.com/theupdateframework/notary/tuf/utils
 github.com/theupdateframework/notary/tuf/validation
-# github.com/tonistiigi/fsutil v0.0.0-20210818161904-4442383b5028
+# github.com/tonistiigi/fsutil v0.0.0-20210818161904-4442383b5028 => github.com/tonistiigi/fsutil v0.0.0-20211122210416-da5201e0b3af
 github.com/tonistiigi/fsutil
-github.com/tonistiigi/fsutil/prefix
 github.com/tonistiigi/fsutil/types
 # github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea
 ## explicit
@@ -872,7 +871,8 @@ sigs.k8s.io/structured-merge-diff/v4/value
 # sigs.k8s.io/yaml v1.2.0
 sigs.k8s.io/yaml
 # github.com/docker/cli => github.com/docker/cli v20.10.3-0.20210702143511-f782d1355eff+incompatible
-# github.com/docker/docker => github.com/docker/docker v20.10.3-0.20210817025855-ba2adeebdb8d+incompatible
+# github.com/docker/docker => github.com/tonistiigi/docker v0.10.1-0.20211122204227-65a6f25dbca2
+# github.com/tonistiigi/fsutil => github.com/tonistiigi/fsutil v0.0.0-20211122210416-da5201e0b3af
 # go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc => github.com/tonistiigi/opentelemetry-go-contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.0.0-20210714055410-d010b05b4939
 # go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace => github.com/tonistiigi/opentelemetry-go-contrib/instrumentation/net/http/httptrace/otelhttptrace v0.0.0-20210714055410-d010b05b4939
 # go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp => github.com/tonistiigi/opentelemetry-go-contrib/instrumentation/net/http/otelhttp v0.0.0-20210714055410-d010b05b4939