build: implement build secrets with buildkit

This patch implements `docker build --secret id=mysecret,src=/secret/file`
for buildkit frontends that request the mysecret secret.

It is currently implemented in the tonistiigi/dockerfile:secrets20180808
frontend via RUN --mount=type=secret,id=mysecret

Signed-off-by: Tibor Vass <tibor@docker.com>

cli/command/image/build.go

@@ -72,6 +72,7 @@ type buildOptions struct {
 	stream         bool
 	platform       string
 	untrusted      bool
+	secrets        []string
 }
 
 // dockerfileFromStdin returns true when the user specified that the Dockerfile
@@ -156,6 +157,10 @@ func NewBuildCommand(dockerCli command.Cli) *cobra.Command {
 	flags.StringVar(&options.progress, "progress", "auto", "Set type of progress output (only if BuildKit enabled) (auto, plain, tty). Use plain to show container output")
 	flags.SetAnnotation("progress", "experimental", nil)
 	flags.SetAnnotation("progress", "version", []string{"1.38"})
+
+	flags.StringArrayVar(&options.secrets, "secret", []string{}, "Secret file to expose to the build (only if BuildKit enabled): id=mysecret,src=/local/secret")
+	flags.SetAnnotation("secret", "experimental", nil)
+	flags.SetAnnotation("secret", "version", []string{"1.39"})
 	return cmd
 }
 

cli/command/image/build_buildkit.go

@@ -3,6 +3,7 @@ package image
 import (
 	"bytes"
 	"context"
+	"encoding/csv"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -22,8 +23,10 @@ import (
 	"github.com/docker/docker/pkg/urlutil"
 	controlapi "github.com/moby/buildkit/api/services/control"
 	"github.com/moby/buildkit/client"
+	"github.com/moby/buildkit/session"
 	"github.com/moby/buildkit/session/auth/authprovider"
 	"github.com/moby/buildkit/session/filesync"
+	"github.com/moby/buildkit/session/secrets/secretsprovider"
 	"github.com/moby/buildkit/util/appcontext"
 	"github.com/moby/buildkit/util/progress/progressui"
 	"github.com/pkg/errors"
@@ -128,6 +131,13 @@ func runBuildBuildKit(dockerCli command.Cli, options buildOptions) error {
 	}
 
 	s.Allow(authprovider.NewDockerAuthProvider())
+	if len(options.secrets) > 0 {
+		sp, err := parseSecretSpecs(options.secrets)
+		if err != nil {
+			return errors.Wrapf(err, "could not parse secrets: %v", options.secrets)
+		}
+		s.Allow(sp)
+	}
 
 	eg, ctx := errgroup.WithContext(ctx)
 
@@ -204,7 +214,7 @@ func doBuild(ctx context.Context, eg *errgroup.Group, dockerCli command.Cli, opt
 		}
 		// not using shared context to not disrupt display but let is finish reporting errors
 		eg.Go(func() error {
-			return progressui.DisplaySolveStatus(context.TODO(), c, out, displayCh)
+			return progressui.DisplaySolveStatus(context.TODO(), "", c, out, displayCh)
 		})
 	}
 
@@ -348,3 +358,53 @@ func (t *tracer) write(msg jsonmessage.JSONMessage) {
 
 	t.displayCh <- &s
 }
+
+func parseSecretSpecs(sl []string) (session.Attachable, error) {
+	fs := make([]secretsprovider.FileSource, 0, len(sl))
+	for _, v := range sl {
+		s, err := parseSecret(v)
+		if err != nil {
+			return nil, err
+		}
+		fs = append(fs, *s)
+	}
+	store, err := secretsprovider.NewFileStore(fs)
+	if err != nil {
+		return nil, err
+	}
+	return secretsprovider.NewSecretProvider(store), nil
+}
+
+func parseSecret(value string) (*secretsprovider.FileSource, error) {
+	csvReader := csv.NewReader(strings.NewReader(value))
+	fields, err := csvReader.Read()
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to parse csv secret")
+	}
+
+	fs := secretsprovider.FileSource{}
+
+	for _, field := range fields {
+		parts := strings.SplitN(field, "=", 2)
+		key := strings.ToLower(parts[0])
+
+		if len(parts) != 2 {
+			return nil, errors.Errorf("invalid field '%s' must be a key=value pair", field)
+		}
+
+		value := parts[1]
+		switch key {
+		case "type":
+			if value != "file" {
+				return nil, errors.Errorf("unsupported secret type %q", value)
+			}
+		case "id":
+			fs.ID = value
+		case "source", "src":
+			fs.FilePath = value
+		default:
+			return nil, errors.Errorf("unexpected key '%s' in '%s'", key, field)
+		}
+	}
+	return &fs, nil
+}

cli/command/image/build_test.go

@@ -5,6 +5,7 @@ import (
 	"bytes"
 	"compress/gzip"
 	"context"
+	"fmt"
 	"io"
 	"io/ioutil"
 	"os"
@@ -17,6 +18,7 @@ import (
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/pkg/archive"
 	"github.com/google/go-cmp/cmp"
+	"github.com/moby/buildkit/session/secrets/secretsprovider"
 	"gotest.tools/assert"
 	"gotest.tools/fs"
 	"gotest.tools/skip"
@@ -173,6 +175,66 @@ RUN echo hello world
 	assert.DeepEqual(t, fakeBuild.filenames(t), []string{"Dockerfile"})
 }
 
+func TestParseSecret(t *testing.T) {
+	type testcase struct {
+		value       string
+		errExpected bool
+		errMatch    string
+		filesource  *secretsprovider.FileSource
+	}
+	var testcases = []testcase{
+		{
+			value:       "",
+			errExpected: true,
+		}, {
+			value:       "foobar",
+			errExpected: true,
+			errMatch:    "must be a key=value pair",
+		}, {
+			value:       "foo,bar",
+			errExpected: true,
+			errMatch:    "must be a key=value pair",
+		}, {
+			value:       "foo=bar",
+			errExpected: true,
+			errMatch:    "unexpected key",
+		}, {
+			value:      "src=somefile",
+			filesource: &secretsprovider.FileSource{FilePath: "somefile"},
+		}, {
+			value:      "source=somefile",
+			filesource: &secretsprovider.FileSource{FilePath: "somefile"},
+		}, {
+			value:      "id=mysecret",
+			filesource: &secretsprovider.FileSource{ID: "mysecret"},
+		}, {
+			value:      "id=mysecret,src=somefile",
+			filesource: &secretsprovider.FileSource{ID: "mysecret", FilePath: "somefile"},
+		}, {
+			value:      "id=mysecret,source=somefile,type=file",
+			filesource: &secretsprovider.FileSource{ID: "mysecret", FilePath: "somefile"},
+		}, {
+			value:      "id=mysecret,src=somefile,src=othersecretfile",
+			filesource: &secretsprovider.FileSource{ID: "mysecret", FilePath: "othersecretfile"},
+		}, {
+			value:       "type=invalid",
+			errExpected: true,
+			errMatch:    "unsupported secret type",
+		},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.value, func(t *testing.T) {
+			secret, err := parseSecret(tc.value)
+			assert.Equal(t, err != nil, tc.errExpected, fmt.Sprintf("err=%v errExpected=%t", err, tc.errExpected))
+			if tc.errMatch != "" {
+				assert.ErrorContains(t, err, tc.errMatch)
+			}
+			assert.DeepEqual(t, secret, tc.filesource)
+		})
+	}
+}
+
 type fakeBuild struct {
 	context *tar.Reader
 	options types.ImageBuildOptions

vendor.conf

@@ -1,8 +1,8 @@
 github.com/agl/ed25519 5312a61534124124185d41f09206b9fef1d88403
 github.com/Azure/go-ansiterm d6e3b3328b783f23731bc4d058875b0371ff8109
 github.com/beorn7/perks 3a771d992973f24aa725d07868b467d1ddfceafb
-github.com/containerd/console cb7008ab3d8359b78c5f464cb7cf160107ad5925
+github.com/containerd/console 5d1b48d6114b8c9666f0c8b916f871af97b0a761
-github.com/containerd/containerd 08f7ee9828af1783dc98cc5cc1739e915697c667
+github.com/containerd/containerd a88b6319614de846458750ff882723479ca7b1a1
 github.com/containerd/continuity d8fb8589b0e8e85b8c8bbaa8840226d0dfeb7371
 github.com/coreos/etcd v3.3.9
 github.com/cpuguy83/go-md2man v1.0.8
@@ -42,7 +42,7 @@ github.com/matttproud/golang_protobuf_extensions v1.0.1
 github.com/Microsoft/go-winio v0.4.9
 github.com/miekg/pkcs11 287d9350987cc9334667882061e202e96cdfb4d0
 github.com/mitchellh/mapstructure f15292f7a699fcc1a38a80977f80a046874ba8ac
-github.com/moby/buildkit 9acf51e49185b348608e0096b2903dd72907adcb
+github.com/moby/buildkit 785436a312230fcc79b41aa044c1643528c91913
 github.com/modern-go/concurrent bacd9c7ef1dd9b15be4a9909b8ac7a4e313eec94 # 1.0.3
 github.com/modern-go/reflect2 4b7aa43c6742a2c18fdef89dd197aaae7dac7ccd # 1.0.1
 github.com/morikuni/aec 39771216ff4c63d11f5e604076f9c45e8be1067b
@@ -63,15 +63,15 @@ github.com/sirupsen/logrus v1.0.6
 github.com/spf13/cobra v0.0.3
 github.com/spf13/pflag v1.0.1
 github.com/theupdateframework/notary v0.6.1
-github.com/tonistiigi/fsutil 8abad97ee3969cdf5e9c367f46adba2c212b3ddb
+github.com/tonistiigi/fsutil b19464cd1b6a00773b4f2eb7acf9c30426f9df42
-github.com/tonistiigi/units 29de085e9400559bd68aea2e7bc21566e7b8281d
+github.com/tonistiigi/units 6950e57a87eaf136bbe44ef2ec8e75b9e3569de2
 github.com/xeipuuv/gojsonpointer 4e3ac2762d5f479393488629ee9370b50873b3a6
 github.com/xeipuuv/gojsonreference bd5ef7bd5415a7ac448318e64f11a24cd21e594b
 github.com/xeipuuv/gojsonschema 93e72a773fade158921402d6a24c819b48aba29d
 golang.org/x/crypto a2144134853fc9a27a7b1e3eb4f19f1a76df13c9
 golang.org/x/net a680a1efc54dd51c040b3b5ce4939ea3cf2ea0d1
 golang.org/x/sync 1d60e4601c6fd243af51cc01ddf169918a5407ca
-golang.org/x/sys ac767d655b305d4e9612f5f6e33120b9176c4ad4
+golang.org/x/sys 1b2967e3c290b7c545b3db0deeda16e9be4f98a2
 golang.org/x/text f21a4dfb5e38f5895301dc265a8def02365cc3d0 # v0.3.0
 golang.org/x/time fbb02b2291d28baffd63558aa44b4b56f178d650
 google.golang.org/genproto 02b4e95473316948020af0b7a4f0f22c73929b0e

vendor/github.com/containerd/console/console_linux.go

@@ -72,7 +72,7 @@ func NewEpoller() (*Epoller, error) {
 	}, nil
 }
 
-// Add creates a epoll console based on the provided console. The console will
+// Add creates an epoll console based on the provided console. The console will
 // be registered with EPOLLET (i.e. using edge-triggered notification) and its
 // file descriptor will be set to non-blocking mode. After this, user should use
 // the return console to perform I/O.
@@ -134,7 +134,7 @@ func (e *Epoller) Wait() error {
 	}
 }
 
-// Close unregister the console's file descriptor from epoll interface
+// CloseConsole unregisters the console's file descriptor from epoll interface
 func (e *Epoller) CloseConsole(fd int) error {
 	e.mu.Lock()
 	defer e.mu.Unlock()
@@ -149,12 +149,12 @@ func (e *Epoller) getConsole(sysfd int) *EpollConsole {
 	return f
 }
 
-// Close the epoll fd
+// Close closes the epoll fd
 func (e *Epoller) Close() error {
 	return unix.Close(e.efd)
 }
 
-// EpollConsole acts like a console but register its file descriptor with a
+// EpollConsole acts like a console but registers its file descriptor with an
 // epoll fd and uses epoll API to perform I/O.
 type EpollConsole struct {
 	Console
@@ -167,7 +167,7 @@ type EpollConsole struct {
 // Read reads up to len(p) bytes into p. It returns the number of bytes read
 // (0 <= n <= len(p)) and any error encountered.
 //
-// If the console's read returns EAGAIN or EIO, we assumes that its a
+// If the console's read returns EAGAIN or EIO, we assume that it's a
 // temporary error because the other side went away and wait for the signal
 // generated by epoll event to continue.
 func (ec *EpollConsole) Read(p []byte) (n int, err error) {
@@ -207,7 +207,7 @@ func (ec *EpollConsole) Read(p []byte) (n int, err error) {
 // written from p (0 <= n <= len(p)) and any error encountered that caused
 // the write to stop early.
 //
-// If writes to the console returns EAGAIN or EIO, we assumes that its a
+// If writes to the console returns EAGAIN or EIO, we assume that it's a
 // temporary error because the other side went away and wait for the signal
 // generated by epoll event to continue.
 func (ec *EpollConsole) Write(p []byte) (n int, err error) {
@@ -224,7 +224,7 @@ func (ec *EpollConsole) Write(p []byte) (n int, err error) {
 			} else {
 				hangup = (err == unix.EAGAIN || err == unix.EIO)
 			}
-			// if the other end disappear, assume this is temporary and wait for the
+			// if the other end disappears, assume this is temporary and wait for the
 			// signal to continue again.
 			if hangup {
 				ec.writec.Wait()
@@ -242,7 +242,7 @@ func (ec *EpollConsole) Write(p []byte) (n int, err error) {
 	return n, err
 }
 
-// Close closed the file descriptor and signal call waiters for this fd.
+// Shutdown closes the file descriptor and signals call waiters for this fd.
 // It accepts a callback which will be called with the console's fd. The
 // callback typically will be used to do further cleanup such as unregister the
 // console's fd from the epoll interface.
@@ -262,10 +262,14 @@ func (ec *EpollConsole) Shutdown(close func(int) error) error {
 
 // signalRead signals that the console is readable.
 func (ec *EpollConsole) signalRead() {
+	ec.readc.L.Lock()
 	ec.readc.Signal()
+	ec.readc.L.Unlock()
 }
 
 // signalWrite signals that the console is writable.
 func (ec *EpollConsole) signalWrite() {
+	ec.writec.L.Lock()
 	ec.writec.Signal()
+	ec.writec.L.Unlock()
 }

vendor/github.com/containerd/console/console_windows.go

@@ -17,7 +17,6 @@
 package console
 
 import (
-	"fmt"
 	"os"
 
 	"github.com/pkg/errors"
@@ -29,90 +28,55 @@ var (
 	ErrNotImplemented = errors.New("not implemented")
 )
 
-func (m *master) initStdios() {
+func (m *master) init() {
-	m.in = windows.Handle(os.Stdin.Fd())
+	m.h = windows.Handle(m.f.Fd())
-	if err := windows.GetConsoleMode(m.in, &m.inMode); err == nil {
+	if err := windows.GetConsoleMode(m.h, &m.mode); err == nil {
+		if m.f == os.Stdin {
 			// Validate that windows.ENABLE_VIRTUAL_TERMINAL_INPUT is supported, but do not set it.
-		if err = windows.SetConsoleMode(m.in, m.inMode|windows.ENABLE_VIRTUAL_TERMINAL_INPUT); err == nil {
+			if err = windows.SetConsoleMode(m.h, m.mode|windows.ENABLE_VIRTUAL_TERMINAL_INPUT); err == nil {
 				vtInputSupported = true
 			}
 			// Unconditionally set the console mode back even on failure because SetConsoleMode
 			// remembers invalid bits on input handles.
-		windows.SetConsoleMode(m.in, m.inMode)
+			windows.SetConsoleMode(m.h, m.mode)
+		} else if err := windows.SetConsoleMode(m.h, m.mode|windows.ENABLE_VIRTUAL_TERMINAL_PROCESSING); err == nil {
+			m.mode |= windows.ENABLE_VIRTUAL_TERMINAL_PROCESSING
 		} else {
-		fmt.Printf("failed to get console mode for stdin: %v\n", err)
+			windows.SetConsoleMode(m.h, m.mode)
 		}
-
-	m.out = windows.Handle(os.Stdout.Fd())
-	if err := windows.GetConsoleMode(m.out, &m.outMode); err == nil {
-		if err := windows.SetConsoleMode(m.out, m.outMode|windows.ENABLE_VIRTUAL_TERMINAL_PROCESSING); err == nil {
-			m.outMode |= windows.ENABLE_VIRTUAL_TERMINAL_PROCESSING
-		} else {
-			windows.SetConsoleMode(m.out, m.outMode)
-		}
-	} else {
-		fmt.Printf("failed to get console mode for stdout: %v\n", err)
-	}
-
-	m.err = windows.Handle(os.Stderr.Fd())
-	if err := windows.GetConsoleMode(m.err, &m.errMode); err == nil {
-		if err := windows.SetConsoleMode(m.err, m.errMode|windows.ENABLE_VIRTUAL_TERMINAL_PROCESSING); err == nil {
-			m.errMode |= windows.ENABLE_VIRTUAL_TERMINAL_PROCESSING
-		} else {
-			windows.SetConsoleMode(m.err, m.errMode)
-		}
-	} else {
-		fmt.Printf("failed to get console mode for stderr: %v\n", err)
 	}
 }
 
 type master struct {
-	in     windows.Handle
+	h    windows.Handle
-	inMode uint32
+	mode uint32
-
+	f    *os.File
-	out     windows.Handle
-	outMode uint32
-
-	err     windows.Handle
-	errMode uint32
 }
 
 func (m *master) SetRaw() error {
-	if err := makeInputRaw(m.in, m.inMode); err != nil {
+	if m.f == os.Stdin {
+		if err := makeInputRaw(m.h, m.mode); err != nil {
 			return err
 		}
-
+	} else {
 		// Set StdOut and StdErr to raw mode, we ignore failures since
 		// windows.DISABLE_NEWLINE_AUTO_RETURN might not be supported on this version of
 		// Windows.
-
+		windows.SetConsoleMode(m.h, m.mode|windows.DISABLE_NEWLINE_AUTO_RETURN)
-	windows.SetConsoleMode(m.out, m.outMode|windows.DISABLE_NEWLINE_AUTO_RETURN)
+	}
-
-	windows.SetConsoleMode(m.err, m.errMode|windows.DISABLE_NEWLINE_AUTO_RETURN)
-
 	return nil
 }
 
 func (m *master) Reset() error {
-	for _, s := range []struct {
+	if err := windows.SetConsoleMode(m.h, m.mode); err != nil {
-		fd   windows.Handle
-		mode uint32
-	}{
-		{m.in, m.inMode},
-		{m.out, m.outMode},
-		{m.err, m.errMode},
-	} {
-		if err := windows.SetConsoleMode(s.fd, s.mode); err != nil {
 		return errors.Wrap(err, "unable to restore console mode")
 	}
-	}
-
 	return nil
 }
 
 func (m *master) Size() (WinSize, error) {
 	var info windows.ConsoleScreenBufferInfo
-	err := windows.GetConsoleScreenBufferInfo(m.out, &info)
+	err := windows.GetConsoleScreenBufferInfo(m.h, &info)
 	if err != nil {
 		return WinSize{}, errors.Wrap(err, "unable to get console info")
 	}
@@ -134,11 +98,11 @@ func (m *master) ResizeFrom(c Console) error {
 }
 
 func (m *master) DisableEcho() error {
-	mode := m.inMode &^ windows.ENABLE_ECHO_INPUT
+	mode := m.mode &^ windows.ENABLE_ECHO_INPUT
 	mode |= windows.ENABLE_PROCESSED_INPUT
 	mode |= windows.ENABLE_LINE_INPUT
 
-	if err := windows.SetConsoleMode(m.in, mode); err != nil {
+	if err := windows.SetConsoleMode(m.h, mode); err != nil {
 		return errors.Wrap(err, "unable to set console to disable echo")
 	}
 
@@ -150,15 +114,15 @@ func (m *master) Close() error {
 }
 
 func (m *master) Read(b []byte) (int, error) {
-	panic("not implemented on windows")
+	return m.f.Read(b)
 }
 
 func (m *master) Write(b []byte) (int, error) {
-	panic("not implemented on windows")
+	return m.f.Write(b)
 }
 
 func (m *master) Fd() uintptr {
-	return uintptr(m.in)
+	return uintptr(m.h)
 }
 
 // on windows, console can only be made from os.Std{in,out,err}, hence there
@@ -210,7 +174,7 @@ func newMaster(f *os.File) (Console, error) {
 	if f != os.Stdin && f != os.Stdout && f != os.Stderr {
 		return nil, errors.New("creating a console from a file is not supported on windows")
 	}
-	m := &master{}
+	m := &master{f: f}
-	m.initStdios()
+	m.init()
 	return m, nil
 }

vendor/github.com/containerd/containerd/vendor.conf

@@ -1,7 +1,7 @@
 github.com/containerd/go-runc f271fa2021de855d4d918dbef83c5fe19db1bdd5
-github.com/containerd/console 9290d21dc56074581f619579c43d970b4514bc08
+github.com/containerd/console 5d1b48d6114b8c9666f0c8b916f871af97b0a761
 github.com/containerd/cgroups fe281dd265766145e943a034aa41086474ea6130
-github.com/containerd/typeurl f6943554a7e7e88b3c14aad190bf05932da84788
+github.com/containerd/typeurl a93fcdb778cd272c6e9b3028b2f42d813e785d40
 github.com/containerd/fifo 3d5202aec260678c48179c56f40e6f38a095738c
 github.com/containerd/btrfs 2e1aa0ddf94f91fa282b6ed87c23bf0d64911244
 github.com/containerd/continuity d3c23511c1bf5851696cba83143d9cbcd666869b
@@ -27,7 +27,7 @@ golang.org/x/net b3756b4b77d7b13260a0a2ec658753cf48922eac
 google.golang.org/grpc v1.12.0
 github.com/pkg/errors v0.8.0
 github.com/opencontainers/go-digest c9281466c8b2f606084ac71339773efd177436e7
-golang.org/x/sys 314a259e304ff91bd6985da2a7149bbf91237993 https://github.com/golang/sys
+golang.org/x/sys 1b2967e3c290b7c545b3db0deeda16e9be4f98a2 https://github.com/golang/sys
 github.com/opencontainers/image-spec v1.0.1
 golang.org/x/sync 450f422ab23cf9881c94e2db30cac0eb1b7cf80c
 github.com/BurntSushi/toml a368813c5e648fee92e5f6c30e3944ff9d5e8895
@@ -37,13 +37,14 @@ github.com/Microsoft/hcsshim v0.6.11
 github.com/boltdb/bolt e9cf4fae01b5a8ff89d0ec6b32f0d9c9f79aefdd
 google.golang.org/genproto d80a6e20e776b0b17a324d0ba1ab50a39c8e8944
 golang.org/x/text 19e51611da83d6be54ddafce4a4af510cb3e9ea4
-github.com/stevvooe/ttrpc d4528379866b0ce7e9d71f3eb96f0582fc374577
+github.com/containerd/ttrpc 94dde388801693c54f88a6596f713b51a8b30b2d
 github.com/syndtr/gocapability db04d3cc01c8b54962a58ec7e491717d06cfcc16
 gotest.tools v2.1.0
 github.com/google/go-cmp v0.1.0
 
-github.com/containerd/cri 8bcb9a95394e8d7845da1d6a994d3ac2a86d22f0
+# cri dependencies
-github.com/containerd/go-cni f2d7272f12d045b16ed924f50e91f9f9cecc55a7
+github.com/containerd/cri 661f3b0377db409fe0e5677115f02ce7b89fd17d https://github.com/dmcgowan/cri-containerd
+github.com/containerd/go-cni 5882530828ecf62032409b298a3e8b19e08b6534
 github.com/blang/semver v3.1.0
 github.com/containernetworking/cni v0.6.0
 github.com/containernetworking/plugins v0.7.0
@@ -57,22 +58,26 @@ github.com/golang/glog 44145f04b68cf362d9c4df2182967c2275eaefed
 github.com/google/gofuzz 44d81051d367757e1c7c6a5a86423ece9afcf63c
 github.com/hashicorp/errwrap 7554cd9344cec97297fa6649b055a8c98c2a1e55
 github.com/hashicorp/go-multierror ed905158d87462226a13fe39ddf685ea65f1c11f
-github.com/json-iterator/go 1.0.4
+github.com/json-iterator/go f2b4162afba35581b6d4a50d3b8f34e33c144682
-github.com/opencontainers/runtime-tools 6073aff4ac61897f75895123f7e24135204a404d
+github.com/modern-go/reflect2 05fbef0ca5da472bbf96c9322b84a53edc03c9fd
+github.com/modern-go/concurrent 1.0.3
+github.com/opencontainers/runtime-tools v0.6.0
 github.com/opencontainers/selinux 4a2974bf1ee960774ffd517717f1f45325af0206
 github.com/seccomp/libseccomp-golang 32f571b70023028bd57d9288c20efbcb237f3ce0
-github.com/spf13/pflag v1.0.0
 github.com/tchap/go-patricia 5ad6cdb7538b0097d5598c7e57f0a24072adf7dc
+github.com/xeipuuv/gojsonpointer 4e3ac2762d5f479393488629ee9370b50873b3a6
+github.com/xeipuuv/gojsonreference bd5ef7bd5415a7ac448318e64f11a24cd21e594b
+github.com/xeipuuv/gojsonschema 1d523034197ff1f222f6429836dd36a2457a1874
 golang.org/x/crypto 49796115aa4b964c318aad4f3084fdb41e9aa067
 golang.org/x/time f51c12702a4d776e4c1fa9b0fabab841babae631
 gopkg.in/inf.v0 3887ee99ecf07df5b447e9b00d9c0b2adaa9f3e4
 gopkg.in/yaml.v2 53feefa2559fb8dfa8d81baad31be332c97d6c77
-k8s.io/api 7e796de92438aede7cb5d6bcf6c10f4fa65db560
+k8s.io/api 9e5ffd1f1320950b238cfce291b926411f0af722
-k8s.io/apimachinery fcb9a12f7875d01f8390b28faedc37dcf2e713b9
+k8s.io/apimachinery ed135c5b96450fd24e5e981c708114fbbd950697
-k8s.io/apiserver 4a8377c547bbff4576a35b5b5bf4026d9b5aa763
+k8s.io/apiserver a90e3a95c2e91b944bfca8225c4e0d12e42a9eb5
-k8s.io/client-go b9a0cf870f239c4a4ecfd3feb075a50e7cbe1473
+k8s.io/client-go 03bfb9bdcfe5482795b999f39ca3ed9ad42ce5bb
-k8s.io/kubernetes v1.10.0
+k8s.io/kubernetes v1.11.0
-k8s.io/utils 258e2a2fa64568210fbd6267cf1d8fd87c3cb86e
+k8s.io/utils 733eca437aa39379e4bcc25e726439dfca40fcff
 
 # zfs dependencies
 github.com/containerd/zfs 9a0b8b8b5982014b729cd34eb7cd7a11062aa6ec

vendor/github.com/moby/buildkit/README.md

@@ -256,7 +256,7 @@ make test TESTPKGS=./client
 make test TESTPKGS=./client TESTFLAGS="--run /TestCallDiskUsage -v" 
 
 # run all integration tests with a specific worker
-# supported workers are oci and containerd
+# supported workers: oci, oci-rootless, containerd, containerd-1.0
 make test TESTPKGS=./client TESTFLAGS="--run //worker=containerd -v" 
 ```
 

vendor/github.com/moby/buildkit/api/services/control/control.pb.go

@@ -23,7 +23,6 @@
 		BytesMessage
 		ListWorkersRequest
 		ListWorkersResponse
-		WorkerRecord
 */
 package moby_buildkit_v1
 
@@ -33,6 +32,7 @@ import math "math"
 import _ "github.com/gogo/protobuf/gogoproto"
 import _ "github.com/golang/protobuf/ptypes/timestamp"
 import pb "github.com/moby/buildkit/solver/pb"
+import moby_buildkit_v1_types "github.com/moby/buildkit/api/types"
 
 import time "time"
 import github_com_opencontainers_go_digest "github.com/opencontainers/go-digest"
@@ -57,6 +57,10 @@ var _ = time.Kitchen
 const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
 
 type PruneRequest struct {
+	Filter       []string `protobuf:"bytes,1,rep,name=filter" json:"filter,omitempty"`
+	All          bool     `protobuf:"varint,2,opt,name=all,proto3" json:"all,omitempty"`
+	KeepDuration int64    `protobuf:"varint,3,opt,name=keepDuration,proto3" json:"keepDuration,omitempty"`
+	KeepBytes    int64    `protobuf:"varint,4,opt,name=keepBytes,proto3" json:"keepBytes,omitempty"`
 }
 
 func (m *PruneRequest) Reset()                    { *m = PruneRequest{} }
@@ -64,8 +68,36 @@ func (m *PruneRequest) String() string            { return proto.CompactTextStri
 func (*PruneRequest) ProtoMessage()               {}
 func (*PruneRequest) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{0} }
 
+func (m *PruneRequest) GetFilter() []string {
+	if m != nil {
+		return m.Filter
+	}
+	return nil
+}
+
+func (m *PruneRequest) GetAll() bool {
+	if m != nil {
+		return m.All
+	}
+	return false
+}
+
+func (m *PruneRequest) GetKeepDuration() int64 {
+	if m != nil {
+		return m.KeepDuration
+	}
+	return 0
+}
+
+func (m *PruneRequest) GetKeepBytes() int64 {
+	if m != nil {
+		return m.KeepBytes
+	}
+	return 0
+}
+
 type DiskUsageRequest struct {
-	Filter string `protobuf:"bytes,1,opt,name=filter,proto3" json:"filter,omitempty"`
+	Filter []string `protobuf:"bytes,1,rep,name=filter" json:"filter,omitempty"`
 }
 
 func (m *DiskUsageRequest) Reset()                    { *m = DiskUsageRequest{} }
@@ -73,11 +105,11 @@ func (m *DiskUsageRequest) String() string            { return proto.CompactText
 func (*DiskUsageRequest) ProtoMessage()               {}
 func (*DiskUsageRequest) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{1} }
 
-func (m *DiskUsageRequest) GetFilter() string {
+func (m *DiskUsageRequest) GetFilter() []string {
 	if m != nil {
 		return m.Filter
 	}
-	return ""
+	return nil
 }
 
 type DiskUsageResponse struct {
@@ -106,6 +138,8 @@ type UsageRecord struct {
 	LastUsedAt  *time.Time `protobuf:"bytes,7,opt,name=LastUsedAt,stdtime" json:"LastUsedAt,omitempty"`
 	UsageCount  int64      `protobuf:"varint,8,opt,name=UsageCount,proto3" json:"UsageCount,omitempty"`
 	Description string     `protobuf:"bytes,9,opt,name=Description,proto3" json:"Description,omitempty"`
+	RecordType  string     `protobuf:"bytes,10,opt,name=RecordType,proto3" json:"RecordType,omitempty"`
+	Shared      bool       `protobuf:"varint,11,opt,name=Shared,proto3" json:"Shared,omitempty"`
 }
 
 func (m *UsageRecord) Reset()                    { *m = UsageRecord{} }
@@ -176,6 +210,20 @@ func (m *UsageRecord) GetDescription() string {
 	return ""
 }
 
+func (m *UsageRecord) GetRecordType() string {
+	if m != nil {
+		return m.RecordType
+	}
+	return ""
+}
+
+func (m *UsageRecord) GetShared() bool {
+	if m != nil {
+		return m.Shared
+	}
+	return false
+}
+
 type SolveRequest struct {
 	Ref           string            `protobuf:"bytes,1,opt,name=Ref,proto3" json:"Ref,omitempty"`
 	Definition    *pb.Definition    `protobuf:"bytes,2,opt,name=Definition" json:"Definition,omitempty"`
@@ -526,7 +574,7 @@ func (m *ListWorkersRequest) GetFilter() []string {
 }
 
 type ListWorkersResponse struct {
-	Record []*WorkerRecord `protobuf:"bytes,1,rep,name=record" json:"record,omitempty"`
+	Record []*moby_buildkit_v1_types.WorkerRecord `protobuf:"bytes,1,rep,name=record" json:"record,omitempty"`
 }
 
 func (m *ListWorkersResponse) Reset()                    { *m = ListWorkersResponse{} }
@@ -534,45 +582,13 @@ func (m *ListWorkersResponse) String() string            { return proto.CompactT
 func (*ListWorkersResponse) ProtoMessage()               {}
 func (*ListWorkersResponse) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{14} }
 
-func (m *ListWorkersResponse) GetRecord() []*WorkerRecord {
+func (m *ListWorkersResponse) GetRecord() []*moby_buildkit_v1_types.WorkerRecord {
 	if m != nil {
 		return m.Record
 	}
 	return nil
 }
 
-type WorkerRecord struct {
-	ID        string            `protobuf:"bytes,1,opt,name=ID,proto3" json:"ID,omitempty"`
-	Labels    map[string]string `protobuf:"bytes,2,rep,name=Labels" json:"Labels,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
-	Platforms []pb.Platform     `protobuf:"bytes,3,rep,name=platforms" json:"platforms"`
-}
-
-func (m *WorkerRecord) Reset()                    { *m = WorkerRecord{} }
-func (m *WorkerRecord) String() string            { return proto.CompactTextString(m) }
-func (*WorkerRecord) ProtoMessage()               {}
-func (*WorkerRecord) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{15} }
-
-func (m *WorkerRecord) GetID() string {
-	if m != nil {
-		return m.ID
-	}
-	return ""
-}
-
-func (m *WorkerRecord) GetLabels() map[string]string {
-	if m != nil {
-		return m.Labels
-	}
-	return nil
-}
-
-func (m *WorkerRecord) GetPlatforms() []pb.Platform {
-	if m != nil {
-		return m.Platforms
-	}
-	return nil
-}
-
 func init() {
 	proto.RegisterType((*PruneRequest)(nil), "moby.buildkit.v1.PruneRequest")
 	proto.RegisterType((*DiskUsageRequest)(nil), "moby.buildkit.v1.DiskUsageRequest")
@@ -589,7 +605,6 @@ func init() {
 	proto.RegisterType((*BytesMessage)(nil), "moby.buildkit.v1.BytesMessage")
 	proto.RegisterType((*ListWorkersRequest)(nil), "moby.buildkit.v1.ListWorkersRequest")
 	proto.RegisterType((*ListWorkersResponse)(nil), "moby.buildkit.v1.ListWorkersResponse")
-	proto.RegisterType((*WorkerRecord)(nil), "moby.buildkit.v1.WorkerRecord")
 }
 
 // Reference imports to suppress errors if they are not otherwise used.
@@ -931,6 +946,41 @@ func (m *PruneRequest) MarshalTo(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if len(m.Filter) > 0 {
+		for _, s := range m.Filter {
+			dAtA[i] = 0xa
+			i++
+			l = len(s)
+			for l >= 1<<7 {
+				dAtA[i] = uint8(uint64(l)&0x7f | 0x80)
+				l >>= 7
+				i++
+			}
+			dAtA[i] = uint8(l)
+			i++
+			i += copy(dAtA[i:], s)
+		}
+	}
+	if m.All {
+		dAtA[i] = 0x10
+		i++
+		if m.All {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i++
+	}
+	if m.KeepDuration != 0 {
+		dAtA[i] = 0x18
+		i++
+		i = encodeVarintControl(dAtA, i, uint64(m.KeepDuration))
+	}
+	if m.KeepBytes != 0 {
+		dAtA[i] = 0x20
+		i++
+		i = encodeVarintControl(dAtA, i, uint64(m.KeepBytes))
+	}
 	return i, nil
 }
 
@@ -950,10 +1000,19 @@ func (m *DiskUsageRequest) MarshalTo(dAtA []byte) (int, error) {
 	var l int
 	_ = l
 	if len(m.Filter) > 0 {
+		for _, s := range m.Filter {
 			dAtA[i] = 0xa
 			i++
-		i = encodeVarintControl(dAtA, i, uint64(len(m.Filter)))
+			l = len(s)
-		i += copy(dAtA[i:], m.Filter)
+			for l >= 1<<7 {
+				dAtA[i] = uint8(uint64(l)&0x7f | 0x80)
+				l >>= 7
+				i++
+			}
+			dAtA[i] = uint8(l)
+			i++
+			i += copy(dAtA[i:], s)
+		}
 	}
 	return i, nil
 }
@@ -1069,6 +1128,22 @@ func (m *UsageRecord) MarshalTo(dAtA []byte) (int, error) {
 		i = encodeVarintControl(dAtA, i, uint64(len(m.Description)))
 		i += copy(dAtA[i:], m.Description)
 	}
+	if len(m.RecordType) > 0 {
+		dAtA[i] = 0x52
+		i++
+		i = encodeVarintControl(dAtA, i, uint64(len(m.RecordType)))
+		i += copy(dAtA[i:], m.RecordType)
+	}
+	if m.Shared {
+		dAtA[i] = 0x58
+		i++
+		if m.Shared {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i++
+	}
 	return i, nil
 }
 
@@ -1620,59 +1695,6 @@ func (m *ListWorkersResponse) MarshalTo(dAtA []byte) (int, error) {
 	return i, nil
 }
 
-func (m *WorkerRecord) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalTo(dAtA)
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *WorkerRecord) MarshalTo(dAtA []byte) (int, error) {
-	var i int
-	_ = i
-	var l int
-	_ = l
-	if len(m.ID) > 0 {
-		dAtA[i] = 0xa
-		i++
-		i = encodeVarintControl(dAtA, i, uint64(len(m.ID)))
-		i += copy(dAtA[i:], m.ID)
-	}
-	if len(m.Labels) > 0 {
-		for k, _ := range m.Labels {
-			dAtA[i] = 0x12
-			i++
-			v := m.Labels[k]
-			mapSize := 1 + len(k) + sovControl(uint64(len(k))) + 1 + len(v) + sovControl(uint64(len(v)))
-			i = encodeVarintControl(dAtA, i, uint64(mapSize))
-			dAtA[i] = 0xa
-			i++
-			i = encodeVarintControl(dAtA, i, uint64(len(k)))
-			i += copy(dAtA[i:], k)
-			dAtA[i] = 0x12
-			i++
-			i = encodeVarintControl(dAtA, i, uint64(len(v)))
-			i += copy(dAtA[i:], v)
-		}
-	}
-	if len(m.Platforms) > 0 {
-		for _, msg := range m.Platforms {
-			dAtA[i] = 0x1a
-			i++
-			i = encodeVarintControl(dAtA, i, uint64(msg.Size()))
-			n, err := msg.MarshalTo(dAtA[i:])
-			if err != nil {
-				return 0, err
-			}
-			i += n
-		}
-	}
-	return i, nil
-}
-
 func encodeVarintControl(dAtA []byte, offset int, v uint64) int {
 	for v >= 1<<7 {
 		dAtA[offset] = uint8(v&0x7f | 0x80)
@@ -1685,16 +1707,33 @@ func encodeVarintControl(dAtA []byte, offset int, v uint64) int {
 func (m *PruneRequest) Size() (n int) {
 	var l int
 	_ = l
+	if len(m.Filter) > 0 {
+		for _, s := range m.Filter {
+			l = len(s)
+			n += 1 + l + sovControl(uint64(l))
+		}
+	}
+	if m.All {
+		n += 2
+	}
+	if m.KeepDuration != 0 {
+		n += 1 + sovControl(uint64(m.KeepDuration))
+	}
+	if m.KeepBytes != 0 {
+		n += 1 + sovControl(uint64(m.KeepBytes))
+	}
 	return n
 }
 
 func (m *DiskUsageRequest) Size() (n int) {
 	var l int
 	_ = l
-	l = len(m.Filter)
+	if len(m.Filter) > 0 {
-	if l > 0 {
+		for _, s := range m.Filter {
+			l = len(s)
 			n += 1 + l + sovControl(uint64(l))
 		}
+	}
 	return n
 }
 
@@ -1743,6 +1782,13 @@ func (m *UsageRecord) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovControl(uint64(l))
 	}
+	l = len(m.RecordType)
+	if l > 0 {
+		n += 1 + l + sovControl(uint64(l))
+	}
+	if m.Shared {
+		n += 2
+	}
 	return n
 }
 
@@ -1984,30 +2030,6 @@ func (m *ListWorkersResponse) Size() (n int) {
 	return n
 }
 
-func (m *WorkerRecord) Size() (n int) {
-	var l int
-	_ = l
-	l = len(m.ID)
-	if l > 0 {
-		n += 1 + l + sovControl(uint64(l))
-	}
-	if len(m.Labels) > 0 {
-		for k, v := range m.Labels {
-			_ = k
-			_ = v
-			mapEntrySize := 1 + len(k) + sovControl(uint64(len(k))) + 1 + len(v) + sovControl(uint64(len(v)))
-			n += mapEntrySize + 1 + sovControl(uint64(mapEntrySize))
-		}
-	}
-	if len(m.Platforms) > 0 {
-		for _, e := range m.Platforms {
-			l = e.Size()
-			n += 1 + l + sovControl(uint64(l))
-		}
-	}
-	return n
-}
-
 func sovControl(x uint64) (n int) {
 	for {
 		n++
@@ -2050,6 +2072,93 @@ func (m *PruneRequest) Unmarshal(dAtA []byte) error {
 			return fmt.Errorf("proto: PruneRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Filter", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowControl
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthControl
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Filter = append(m.Filter, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field All", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowControl
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.All = bool(v != 0)
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KeepDuration", wireType)
+			}
+			m.KeepDuration = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowControl
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.KeepDuration |= (int64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KeepBytes", wireType)
+			}
+			m.KeepBytes = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowControl
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.KeepBytes |= (int64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipControl(dAtA[iNdEx:])
@@ -2127,7 +2236,7 @@ func (m *DiskUsageRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Filter = string(dAtA[iNdEx:postIndex])
+			m.Filter = append(m.Filter, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -2488,6 +2597,55 @@ func (m *UsageRecord) Unmarshal(dAtA []byte) error {
 			}
 			m.Description = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RecordType", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowControl
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthControl
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RecordType = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 11:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Shared", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowControl
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Shared = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipControl(dAtA[iNdEx:])
@@ -4487,7 +4645,7 @@ func (m *ListWorkersResponse) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Record = append(m.Record, &WorkerRecord{})
+			m.Record = append(m.Record, &moby_buildkit_v1_types.WorkerRecord{})
 			if err := m.Record[len(m.Record)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
@@ -4513,234 +4671,6 @@ func (m *ListWorkersResponse) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *WorkerRecord) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowControl
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= (uint64(b) & 0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: WorkerRecord: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: WorkerRecord: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ID", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowControl
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= (uint64(b) & 0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthControl
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.ID = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Labels", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowControl
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= (int(b) & 0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthControl
-			}
-			postIndex := iNdEx + msglen
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if m.Labels == nil {
-				m.Labels = make(map[string]string)
-			}
-			var mapkey string
-			var mapvalue string
-			for iNdEx < postIndex {
-				entryPreIndex := iNdEx
-				var wire uint64
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return ErrIntOverflowControl
-					}
-					if iNdEx >= l {
-						return io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					wire |= (uint64(b) & 0x7F) << shift
-					if b < 0x80 {
-						break
-					}
-				}
-				fieldNum := int32(wire >> 3)
-				if fieldNum == 1 {
-					var stringLenmapkey uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowControl
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapkey |= (uint64(b) & 0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapkey := int(stringLenmapkey)
-					if intStringLenmapkey < 0 {
-						return ErrInvalidLengthControl
-					}
-					postStringIndexmapkey := iNdEx + intStringLenmapkey
-					if postStringIndexmapkey > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
-					iNdEx = postStringIndexmapkey
-				} else if fieldNum == 2 {
-					var stringLenmapvalue uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowControl
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapvalue |= (uint64(b) & 0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapvalue := int(stringLenmapvalue)
-					if intStringLenmapvalue < 0 {
-						return ErrInvalidLengthControl
-					}
-					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
-					if postStringIndexmapvalue > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
-					iNdEx = postStringIndexmapvalue
-				} else {
-					iNdEx = entryPreIndex
-					skippy, err := skipControl(dAtA[iNdEx:])
-					if err != nil {
-						return err
-					}
-					if skippy < 0 {
-						return ErrInvalidLengthControl
-					}
-					if (iNdEx + skippy) > postIndex {
-						return io.ErrUnexpectedEOF
-					}
-					iNdEx += skippy
-				}
-			}
-			m.Labels[mapkey] = mapvalue
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Platforms", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowControl
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= (int(b) & 0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthControl
-			}
-			postIndex := iNdEx + msglen
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Platforms = append(m.Platforms, pb.Platform{})
-			if err := m.Platforms[len(m.Platforms)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipControl(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if skippy < 0 {
-				return ErrInvalidLengthControl
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
 func skipControl(dAtA []byte) (n int, err error) {
 	l := len(dAtA)
 	iNdEx := 0
@@ -4849,81 +4779,83 @@ var (
 func init() { proto.RegisterFile("control.proto", fileDescriptorControl) }
 
 var fileDescriptorControl = []byte{
-	// 1214 bytes of a gzipped FileDescriptorProto
+	// 1241 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xa4, 0x57, 0x4f, 0x6f, 0x1b, 0x55,
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xa4, 0x57, 0xcf, 0x6f, 0x1b, 0xc5,
-	0x10, 0x67, 0x6d, 0xc7, 0xf6, 0x8e, 0x9d, 0x28, 0x3c, 0xa0, 0x5a, 0x2d, 0x90, 0x98, 0x05, 0x24,
+	0x17, 0xef, 0xda, 0x8e, 0xed, 0x7d, 0x76, 0xaa, 0x7c, 0xe7, 0x0b, 0xd5, 0x6a, 0x81, 0xc4, 0x2c,
-	0xab, 0x6a, 0xd7, 0x69, 0xa0, 0x08, 0x72, 0xa8, 0x5a, 0xc7, 0x45, 0x24, 0x4a, 0x44, 0xd8, 0x34,
+	0x20, 0x59, 0x55, 0xbb, 0xdb, 0x06, 0x2a, 0xa1, 0x08, 0x55, 0xad, 0xe3, 0x22, 0x12, 0x25, 0xa2,
-	0x54, 0xe2, 0xb6, 0xb6, 0x5f, 0xdc, 0x55, 0xd6, 0xfb, 0x96, 0xf7, 0x9e, 0xa3, 0x86, 0x4f, 0xc1,
+	0xac, 0x13, 0x2a, 0x71, 0x5b, 0xdb, 0x13, 0x67, 0xe5, 0xf5, 0xce, 0x32, 0x33, 0x1b, 0x6a, 0xfe,
-	0x81, 0x6f, 0xc2, 0x81, 0x33, 0x07, 0xa4, 0xde, 0xe0, 0xcc, 0x21, 0x45, 0xb9, 0xc3, 0x67, 0x40,
+	0x00, 0xce, 0x1c, 0xf8, 0x4f, 0x38, 0xf0, 0x17, 0x20, 0xe5, 0xc8, 0x99, 0x43, 0x8a, 0x72, 0x87,
-	0xef, 0xcf, 0xda, 0xcf, 0x5e, 0xe7, 0x8f, 0xd3, 0x93, 0xdf, 0xcc, 0xfe, 0xe6, 0xb7, 0xf3, 0x66,
+	0x3b, 0x37, 0x34, 0x3f, 0xd6, 0x5e, 0xc7, 0x4e, 0x9c, 0xa4, 0xa7, 0xcc, 0x7b, 0xfe, 0xbc, 0xcf,
-	0x66, 0x67, 0xc6, 0xb0, 0xdc, 0x23, 0x09, 0xa7, 0x24, 0xf6, 0x53, 0x4a, 0x38, 0x41, 0xab, 0x43,
+	0xbe, 0x5f, 0x33, 0xef, 0x05, 0x56, 0x7b, 0x24, 0xe6, 0x94, 0x44, 0x6e, 0x42, 0x09, 0x27, 0x68,
-	0xd2, 0x3d, 0xf3, 0xbb, 0xa3, 0x28, 0xee, 0x9f, 0x44, 0xdc, 0x3f, 0x7d, 0xe0, 0xde, 0x1f, 0x44,
+	0x6d, 0x44, 0xba, 0x63, 0xb7, 0x9b, 0x86, 0x51, 0x7f, 0x18, 0x72, 0xf7, 0xe4, 0xb1, 0xfd, 0x70,
-	0xfc, 0xc5, 0xa8, 0xeb, 0xf7, 0xc8, 0xb0, 0x35, 0x20, 0x03, 0xd2, 0x92, 0xc0, 0xee, 0xe8, 0x58,
+	0x10, 0xf2, 0xe3, 0xb4, 0xeb, 0xf6, 0xc8, 0xc8, 0x1b, 0x90, 0x01, 0xf1, 0x24, 0xb0, 0x9b, 0x1e,
-	0x4a, 0x52, 0x90, 0x27, 0x45, 0xe0, 0xae, 0x0f, 0x08, 0x19, 0xc4, 0x78, 0x82, 0xe2, 0xd1, 0x10,
+	0x49, 0x49, 0x0a, 0xf2, 0xa4, 0x08, 0xec, 0x8d, 0x01, 0x21, 0x83, 0x08, 0x4f, 0x51, 0x3c, 0x1c,
-	0x33, 0x1e, 0x0e, 0x53, 0x0d, 0xb8, 0x67, 0xf0, 0x89, 0x97, 0xb5, 0xb2, 0x97, 0xb5, 0x18, 0x89,
+	0x61, 0xc6, 0x83, 0x51, 0xa2, 0x01, 0x0f, 0x72, 0x7c, 0xe2, 0x63, 0x5e, 0xf6, 0x31, 0x8f, 0x91,
-	0x4f, 0x31, 0x6d, 0xa5, 0xdd, 0x16, 0x49, 0x99, 0x42, 0x7b, 0x2b, 0x50, 0x3f, 0xa0, 0xa3, 0x04,
+	0xe8, 0x04, 0x53, 0x2f, 0xe9, 0x7a, 0x24, 0x61, 0x1a, 0xed, 0x5d, 0x8a, 0x0e, 0x92, 0xd0, 0xe3,
-	0x07, 0xf8, 0xc7, 0x11, 0x66, 0xdc, 0xbb, 0x0b, 0xab, 0x9d, 0x88, 0x9d, 0x1c, 0xb1, 0x70, 0x90,
+	0xe3, 0x04, 0x33, 0xef, 0x07, 0x42, 0x87, 0x98, 0x2a, 0x03, 0xe7, 0x27, 0x03, 0xea, 0x2f, 0x69,
-	0xe9, 0xd0, 0x1d, 0x28, 0x1f, 0x47, 0x31, 0xc7, 0xd4, 0xb1, 0x1a, 0x56, 0xd3, 0x0e, 0xb4, 0xe4,
+	0x1a, 0x63, 0x1f, 0x7f, 0x9f, 0x62, 0xc6, 0xd1, 0x3d, 0x28, 0x1f, 0x85, 0x11, 0xc7, 0xd4, 0x32,
-	0xed, 0xc2, 0xdb, 0x06, 0x96, 0xa5, 0x24, 0x61, 0x18, 0x3d, 0x84, 0x32, 0xc5, 0x3d, 0x42, 0xfb,
+	0x1a, 0xc5, 0xa6, 0xe9, 0x6b, 0x09, 0xad, 0x41, 0x31, 0x88, 0x22, 0xab, 0xd0, 0x30, 0x9a, 0x55,
-	0x8e, 0xd5, 0x28, 0x36, 0x6b, 0x9b, 0x1f, 0xfa, 0xb3, 0x37, 0xf6, 0xb5, 0x81, 0x00, 0x05, 0x1a,
+	0x5f, 0x1c, 0x51, 0x13, 0xea, 0x43, 0x8c, 0x93, 0x76, 0x4a, 0x03, 0x1e, 0x92, 0xd8, 0x2a, 0x36,
-	0xec, 0xfd, 0x5e, 0x80, 0x9a, 0xa1, 0x47, 0x2b, 0x50, 0xd8, 0xe9, 0xe8, 0xf7, 0x15, 0x76, 0x3a,
+	0x8c, 0x66, 0xb1, 0x55, 0x3a, 0x3d, 0xdb, 0x30, 0xfc, 0x99, 0x5f, 0x90, 0x03, 0xa6, 0x90, 0x5b,
-	0xc8, 0x81, 0xca, 0xfe, 0x88, 0x87, 0xdd, 0x18, 0x3b, 0x85, 0x86, 0xd5, 0xac, 0x06, 0x99, 0x88,
+	0x63, 0x8e, 0x99, 0x55, 0xca, 0xc1, 0xa6, 0x6a, 0xe7, 0x3e, 0xac, 0xb5, 0x43, 0x36, 0x3c, 0x64,
-	0xde, 0x85, 0xa5, 0x9d, 0xe4, 0x88, 0x61, 0xa7, 0x28, 0xf5, 0x4a, 0x40, 0x08, 0x4a, 0x87, 0xd1,
+	0xc1, 0x60, 0x99, 0x2f, 0xce, 0x2e, 0xfc, 0x2f, 0x87, 0x65, 0x09, 0x89, 0x19, 0x46, 0x4f, 0xa0,
-	0x4f, 0xd8, 0x29, 0x35, 0xac, 0x66, 0x31, 0x90, 0x67, 0x71, 0x8f, 0x83, 0x90, 0xe2, 0x84, 0x3b,
+	0x4c, 0x71, 0x8f, 0xd0, 0xbe, 0x04, 0xd7, 0x36, 0x3f, 0x70, 0x2f, 0xd6, 0xc6, 0xd5, 0x06, 0x02,
-	0x4b, 0xea, 0x1e, 0x4a, 0x42, 0x6d, 0xb0, 0xb7, 0x29, 0x0e, 0x39, 0xee, 0x3f, 0xe1, 0x4e, 0xb9,
+	0xe4, 0x6b, 0xb0, 0xf3, 0x6f, 0x01, 0x6a, 0x39, 0x3d, 0xba, 0x0b, 0x85, 0x9d, 0xb6, 0x65, 0x34,
-	0x61, 0x35, 0x6b, 0x9b, 0xae, 0xaf, 0xc2, 0xec, 0x67, 0x61, 0xf6, 0x9f, 0x65, 0x61, 0x6e, 0x57,
+	0x8c, 0xa6, 0xe9, 0x17, 0x76, 0xda, 0xc8, 0x82, 0xca, 0x7e, 0xca, 0x83, 0x6e, 0x84, 0x75, 0xec,
-	0x5f, 0x9d, 0xaf, 0xbf, 0xf5, 0xf3, 0xeb, 0x75, 0x2b, 0x98, 0x98, 0xa1, 0xc7, 0x00, 0x7b, 0x21,
+	0x99, 0x88, 0xde, 0x81, 0x95, 0x9d, 0xf8, 0x90, 0x61, 0x19, 0x78, 0xd5, 0x57, 0x02, 0x42, 0x50,
-	0xe3, 0x47, 0x4c, 0x92, 0x54, 0xae, 0x25, 0x29, 0x49, 0x02, 0xc3, 0x06, 0xad, 0x01, 0xc8, 0x00,
+	0xea, 0x84, 0x3f, 0x62, 0x15, 0xa6, 0x2f, 0xcf, 0x22, 0x8e, 0x97, 0x01, 0xc5, 0x31, 0xb7, 0x56,
-	0x6c, 0x93, 0x51, 0xc2, 0x9d, 0xaa, 0xf4, 0xdb, 0xd0, 0xa0, 0x06, 0xd4, 0x3a, 0x98, 0xf5, 0x68,
+	0x24, 0xaf, 0x96, 0x50, 0x0b, 0xcc, 0x6d, 0x8a, 0x03, 0x8e, 0xfb, 0xcf, 0xb9, 0x55, 0x6e, 0x18,
-	0x94, 0xf2, 0x88, 0x24, 0x8e, 0x2d, 0xaf, 0x60, 0xaa, 0xbc, 0x5f, 0x4a, 0x50, 0x3f, 0x14, 0x39,
+	0xcd, 0xda, 0xa6, 0xed, 0xaa, 0x86, 0x70, 0xb3, 0x86, 0x70, 0x0f, 0xb2, 0x86, 0x68, 0x55, 0x4f,
-	0xce, 0x12, 0xb7, 0x0a, 0xc5, 0x00, 0x1f, 0xeb, 0x28, 0x8a, 0x23, 0xf2, 0x01, 0x3a, 0xf8, 0x38,
+	0xcf, 0x36, 0xee, 0xfc, 0xfc, 0x46, 0xe4, 0x6d, 0x62, 0x86, 0x9e, 0x01, 0xec, 0x05, 0x8c, 0x1f,
-	0x4a, 0x22, 0xc9, 0x51, 0x90, 0x6e, 0xae, 0xf8, 0x69, 0xd7, 0x9f, 0x68, 0x03, 0x03, 0x81, 0x5c,
+	0x32, 0x49, 0x52, 0x59, 0x4a, 0x52, 0x92, 0x04, 0x39, 0x1b, 0xb4, 0x0e, 0x20, 0x13, 0xb0, 0x4d,
-	0xa8, 0x3e, 0x7d, 0x99, 0x12, 0x2a, 0x92, 0x5f, 0x94, 0x34, 0x63, 0x19, 0x3d, 0x87, 0xe5, 0xec,
+	0xd2, 0x98, 0x5b, 0x55, 0xe9, 0x77, 0x4e, 0x83, 0x1a, 0x50, 0x6b, 0x63, 0xd6, 0xa3, 0x61, 0x22,
-	0xfc, 0x84, 0x73, 0xca, 0x9c, 0x92, 0x4c, 0xf8, 0x83, 0x7c, 0xc2, 0x4d, 0xa7, 0xfc, 0x29, 0x9b,
+	0xcb, 0x6c, 0xca, 0x10, 0xf2, 0x2a, 0xc1, 0xa0, 0xb2, 0x77, 0x30, 0x4e, 0xb0, 0x05, 0x12, 0x90,
-	0xa7, 0x09, 0xa7, 0x67, 0xc1, 0x34, 0x8f, 0xc8, 0xf5, 0x21, 0x66, 0x4c, 0x78, 0xa8, 0x12, 0x95,
+	0xd3, 0x88, 0xf8, 0x3b, 0xc7, 0x01, 0xc5, 0x7d, 0xab, 0x26, 0x53, 0xa5, 0x25, 0xe7, 0x97, 0x12,
-	0x89, 0xc2, 0x9d, 0xaf, 0x29, 0x49, 0x38, 0x4e, 0xfa, 0x32, 0x51, 0x76, 0x30, 0x96, 0x85, 0x3b,
+	0xd4, 0x3b, 0xa2, 0x8b, 0xb3, 0x82, 0xaf, 0x41, 0xd1, 0xc7, 0x47, 0x3a, 0xfb, 0xe2, 0x88, 0x5c,
-	0xd9, 0x59, 0xb9, 0x53, 0xb9, 0x91, 0x3b, 0x53, 0x36, 0xda, 0x9d, 0x29, 0x1d, 0xda, 0x82, 0xa5,
+	0x80, 0x36, 0x3e, 0x0a, 0xe3, 0x50, 0x7e, 0xbb, 0x20, 0xc3, 0xbb, 0xeb, 0x26, 0x5d, 0x77, 0xaa,
-	0xed, 0xb0, 0xf7, 0x02, 0xcb, 0x9c, 0xd4, 0x36, 0xd7, 0xf2, 0x84, 0xf2, 0xf1, 0xb7, 0x32, 0x09,
+	0xf5, 0x73, 0x08, 0x64, 0x43, 0xf5, 0xc5, 0xeb, 0x84, 0x50, 0xd1, 0x34, 0x45, 0x49, 0x33, 0x91,
-	0xac, 0x5d, 0x12, 0xe5, 0x11, 0x28, 0x13, 0xf7, 0x31, 0xa0, 0xfc, 0x7d, 0x45, 0x5e, 0x4e, 0xf0,
+	0xd1, 0x2b, 0x58, 0xcd, 0xce, 0xcf, 0x39, 0xa7, 0xa2, 0x15, 0x45, 0xa3, 0x3c, 0x9e, 0x6f, 0x94,
-	0x59, 0x96, 0x97, 0x13, 0x7c, 0x26, 0x8a, 0xf8, 0x34, 0x8c, 0x47, 0xaa, 0xb8, 0xed, 0x40, 0x09,
+	0xbc, 0x53, 0xee, 0x8c, 0xcd, 0x8b, 0x98, 0xd3, 0xb1, 0x3f, 0xcb, 0x23, 0x7a, 0xa4, 0x83, 0x19,
-	0x5b, 0x85, 0x2f, 0x2d, 0xc1, 0x90, 0x77, 0x71, 0x11, 0x06, 0xef, 0xb5, 0x05, 0x75, 0xd3, 0x43,
+	0x13, 0x1e, 0xaa, 0x02, 0x67, 0xa2, 0x70, 0xe7, 0x4b, 0x4a, 0x62, 0x8e, 0xe3, 0xbe, 0x2c, 0xb0,
-	0xf4, 0x01, 0xd8, 0xca, 0xa9, 0x49, 0x71, 0x4c, 0x14, 0xa2, 0x0e, 0x77, 0x86, 0x5a, 0x60, 0x4e,
+	0xe9, 0x4f, 0x64, 0xe1, 0x4e, 0x76, 0x56, 0xee, 0x54, 0xae, 0xe5, 0xce, 0x8c, 0x8d, 0x76, 0x67,
-	0xa1, 0x51, 0x6c, 0xda, 0x81, 0xa1, 0x41, 0xdf, 0x41, 0x4d, 0x81, 0x55, 0x94, 0x8b, 0x32, 0xca,
+	0x46, 0x87, 0xb6, 0x60, 0x65, 0x3b, 0xe8, 0x1d, 0x63, 0x59, 0xcb, 0xda, 0xe6, 0xfa, 0x3c, 0xa1,
-	0xad, 0xab, 0x83, 0xe2, 0x1b, 0x16, 0x2a, 0xc6, 0x26, 0x87, 0xfb, 0x08, 0x56, 0x67, 0x01, 0x0b,
+	0xfc, 0xf9, 0x6b, 0x59, 0x3c, 0x26, 0xaf, 0xe2, 0x1d, 0x5f, 0x99, 0xd8, 0xcf, 0x00, 0xcd, 0xc7,
-	0xdd, 0xf0, 0x37, 0x0b, 0x96, 0x75, 0x52, 0x75, 0x17, 0x0a, 0x33, 0x46, 0x4c, 0x33, 0x9d, 0xee,
+	0x2b, 0xea, 0x32, 0xc4, 0xe3, 0xac, 0x2e, 0x43, 0x3c, 0x16, 0xcd, 0x7f, 0x12, 0x44, 0xa9, 0xba,
-	0x47, 0x0f, 0x2f, 0xad, 0x07, 0x05, 0xf3, 0x67, 0xed, 0x94, 0xbf, 0x39, 0x3a, 0x77, 0x1b, 0xde,
+	0x14, 0xa6, 0xaf, 0x84, 0xad, 0xc2, 0xe7, 0x86, 0x60, 0x98, 0x77, 0xf1, 0x26, 0x0c, 0xce, 0x1b,
-	0x9b, 0x0b, 0x5d, 0xc8, 0xf3, 0x8f, 0x60, 0xf9, 0x90, 0x87, 0x7c, 0xc4, 0x2e, 0xfd, 0x64, 0xbd,
+	0x03, 0xea, 0x79, 0x0f, 0xd1, 0xfb, 0x60, 0x2a, 0xa7, 0xa6, 0xcd, 0x31, 0x55, 0x88, 0xee, 0xdb,
-	0x5f, 0x2d, 0x58, 0xc9, 0x30, 0xfa, 0x76, 0x9f, 0x43, 0xf5, 0x14, 0x53, 0x8e, 0x5f, 0x62, 0xa6,
+	0x19, 0x69, 0x81, 0x59, 0x05, 0xf9, 0x52, 0xe4, 0x34, 0xe8, 0x1b, 0xa8, 0x29, 0xb0, 0xca, 0x72,
-	0x6f, 0xe5, 0xe4, 0x6f, 0xf5, 0xbd, 0x44, 0x04, 0x63, 0x24, 0xda, 0x82, 0x2a, 0x93, 0x3c, 0x58,
+	0x51, 0x66, 0xd9, 0xbb, 0x3a, 0x29, 0x6e, 0xce, 0x42, 0xe5, 0x38, 0xcf, 0x61, 0x3f, 0x85, 0xb5,
-	0xa5, 0x75, 0x6e, 0x29, 0x2b, 0x2b, 0xfd, 0xbe, 0x31, 0x1e, 0xb5, 0xa0, 0x14, 0x93, 0x41, 0x96,
+	0x8b, 0x80, 0x1b, 0x45, 0xf8, 0x9b, 0x01, 0xab, 0xba, 0xa8, 0xfa, 0xf5, 0x0a, 0x32, 0x46, 0x4c,
-	0xed, 0xf7, 0x2f, 0xb3, 0xdb, 0x23, 0x83, 0x40, 0x02, 0xbd, 0xf3, 0x02, 0x94, 0x95, 0x0e, 0xed,
+	0x33, 0x9d, 0x7e, 0xc7, 0x9e, 0x5c, 0xda, 0x0f, 0x0a, 0xe6, 0x5e, 0xb4, 0x53, 0xfe, 0xce, 0xd1,
-	0x42, 0xb9, 0x1f, 0x0d, 0x30, 0xe3, 0xea, 0x56, 0xed, 0x4d, 0xf1, 0x81, 0xfc, 0x7d, 0xbe, 0x7e,
+	0xd9, 0xdb, 0xf0, 0xee, 0x42, 0xe8, 0x8d, 0x3c, 0xff, 0x10, 0x56, 0x3b, 0x3c, 0xe0, 0x29, 0xbb,
-	0xd7, 0x18, 0x54, 0x24, 0xc5, 0x89, 0x18, 0x94, 0x61, 0x94, 0x60, 0xca, 0x5a, 0x03, 0x72, 0x5f,
+	0xf4, 0xca, 0x3a, 0xbf, 0x1a, 0x70, 0x37, 0xc3, 0xe8, 0xe8, 0x3e, 0x83, 0xea, 0x09, 0xa6, 0x1c,
-	0x99, 0xf8, 0x1d, 0xf9, 0x13, 0x68, 0x06, 0xc1, 0x15, 0x25, 0xe9, 0x88, 0xeb, 0xc2, 0xbc, 0x1d,
+	0xbf, 0xc6, 0x4c, 0x47, 0x65, 0xcd, 0x47, 0xf5, 0xad, 0x44, 0xf8, 0x13, 0x24, 0xda, 0x82, 0x2a,
-	0x97, 0x62, 0x10, 0x23, 0x22, 0x09, 0x87, 0x58, 0xf7, 0x35, 0x79, 0x16, 0x23, 0xa2, 0x27, 0xea,
+	0x93, 0x3c, 0x58, 0x95, 0x75, 0x61, 0x2b, 0x2b, 0x2b, 0xfd, 0xbd, 0x09, 0x1e, 0x79, 0x50, 0x8a,
-	0xb6, 0x2f, 0x07, 0x47, 0x35, 0xd0, 0x12, 0xda, 0x82, 0x0a, 0xe3, 0x21, 0xe5, 0xb8, 0x2f, 0x5b,
+	0xc8, 0x20, 0xab, 0xf6, 0x7b, 0x97, 0xd9, 0xed, 0x91, 0x81, 0x2f, 0x81, 0xce, 0x59, 0x01, 0xca,
-	0xd2, 0x4d, 0x7a, 0x7b, 0x66, 0x80, 0x1e, 0x81, 0xdd, 0x23, 0xc3, 0x34, 0xc6, 0xc2, 0xba, 0x7c,
+	0x4a, 0x87, 0x76, 0xa1, 0xdc, 0x0f, 0x07, 0x98, 0x71, 0x15, 0x55, 0x6b, 0x53, 0x5c, 0x90, 0x3f,
-	0x43, 0xeb, 0x89, 0x89, 0xa8, 0x1e, 0x4c, 0x29, 0xa1, 0x72, 0xaa, 0xd8, 0x81, 0x12, 0xbc, 0xff,
+	0xcf, 0x36, 0xee, 0xe7, 0x86, 0x2b, 0x49, 0x70, 0x2c, 0x56, 0x81, 0x20, 0x8c, 0x31, 0x65, 0xde,
-	0x0a, 0x50, 0x37, 0x93, 0x95, 0x9b, 0x98, 0xbb, 0x50, 0x56, 0xa9, 0x57, 0x55, 0x77, 0xbb, 0x50,
+	0x80, 0x3c, 0x54, 0x26, 0x6e, 0x5b, 0xfe, 0xf1, 0x35, 0x83, 0xe0, 0x0a, 0xe3, 0x24, 0xe5, 0xba,
-	0x29, 0x86, 0xb9, 0xa1, 0x72, 0xa0, 0xd2, 0x1b, 0x51, 0x39, 0x4e, 0xd5, 0x90, 0xcd, 0x44, 0xe1,
+	0x31, 0x6f, 0xc7, 0xa5, 0x18, 0xc4, 0x68, 0x89, 0x83, 0x11, 0xd6, 0xef, 0x9a, 0x3c, 0x8b, 0xa7,
-	0x30, 0x27, 0x3c, 0x8c, 0x65, 0xa8, 0x8a, 0x81, 0x12, 0xc4, 0x94, 0x1d, 0xaf, 0x2a, 0x8b, 0x4d,
+	0xb5, 0x27, 0xfa, 0xb6, 0x2f, 0x07, 0x4e, 0xd5, 0xd7, 0x12, 0xda, 0x82, 0x0a, 0xe3, 0x01, 0xe5,
-	0xd9, 0xb1, 0x99, 0x99, 0x86, 0xca, 0x1b, 0xa5, 0xa1, 0xba, 0x70, 0x1a, 0xbc, 0x3f, 0x2c, 0xb0,
+	0xb8, 0x2f, 0x9f, 0xa4, 0xeb, 0xcc, 0x84, 0xcc, 0x00, 0x3d, 0x05, 0xb3, 0x47, 0x46, 0x49, 0x84,
-	0xc7, 0x55, 0x6e, 0x44, 0xd7, 0x7a, 0xe3, 0xe8, 0x4e, 0x45, 0xa6, 0x70, 0xbb, 0xc8, 0xdc, 0x81,
+	0x85, 0x75, 0xf9, 0x9a, 0xd6, 0x53, 0x13, 0xd1, 0x3d, 0x98, 0x52, 0x42, 0xe5, 0x34, 0x32, 0x7d,
-	0x32, 0xe3, 0x14, 0x87, 0x43, 0x99, 0xa3, 0x62, 0xa0, 0x25, 0xd1, 0x4f, 0x86, 0x6c, 0x20, 0x33,
+	0x25, 0x38, 0xff, 0x14, 0xa0, 0x9e, 0x2f, 0xd6, 0xdc, 0xa4, 0xdd, 0x85, 0xb2, 0x2a, 0xbd, 0xea,
-	0x54, 0x0f, 0xc4, 0xd1, 0xf3, 0xa0, 0xde, 0x3e, 0xe3, 0x98, 0xed, 0x63, 0x26, 0x96, 0x0b, 0x91,
+	0xba, 0xdb, 0xa5, 0x4a, 0x31, 0x2c, 0x4c, 0x95, 0x05, 0x95, 0x5e, 0x4a, 0xe5, 0x18, 0x56, 0xc3,
-	0xdb, 0x7e, 0xc8, 0x43, 0x79, 0x8f, 0x7a, 0x20, 0xcf, 0xde, 0x3d, 0x40, 0x7b, 0x11, 0xe3, 0xcf,
+	0x39, 0x13, 0x85, 0xc3, 0x9c, 0xf0, 0x20, 0x92, 0xa9, 0x2a, 0xfa, 0x4a, 0x10, 0xd3, 0x79, 0xb2,
-	0x09, 0x3d, 0xc1, 0x94, 0xcd, 0xdb, 0x03, 0x8b, 0xc6, 0x1e, 0xb8, 0x0f, 0xef, 0x4c, 0xa1, 0x75,
+	0x8c, 0xdd, 0x6c, 0x3a, 0x4f, 0xcc, 0xf2, 0x65, 0xa8, 0xbc, 0x55, 0x19, 0xaa, 0x37, 0x2e, 0x83,
-	0x97, 0xfa, 0x62, 0x66, 0x13, 0x9c, 0xd3, 0x6d, 0x94, 0xc9, 0xcc, 0x2a, 0xf8, 0xa7, 0x05, 0x75,
+	0xf3, 0xbb, 0x01, 0xe6, 0xa4, 0xcb, 0x73, 0xd9, 0x35, 0xde, 0x3a, 0xbb, 0x33, 0x99, 0x29, 0xdc,
-	0xf3, 0x41, 0xae, 0xb2, 0xdb, 0x50, 0xde, 0x0b, 0xbb, 0x38, 0xce, 0xda, 0xd8, 0xdd, 0xab, 0x89,
+	0x2e, 0x33, 0xf7, 0xa0, 0xcc, 0x38, 0xc5, 0xc1, 0x48, 0xed, 0x8d, 0xbe, 0x96, 0xc4, 0x7b, 0x32,
-	0x7d, 0x05, 0x56, 0x7d, 0x5c, 0x5b, 0xa2, 0x0d, 0xb0, 0xd3, 0x38, 0xe4, 0xc7, 0x84, 0x0e, 0xb3,
+	0x62, 0x03, 0x59, 0xa1, 0xba, 0x2f, 0x8e, 0x8e, 0x03, 0x75, 0xb9, 0x22, 0xee, 0x63, 0x26, 0x96,
-	0xae, 0x56, 0x17, 0x7b, 0xd0, 0x81, 0x56, 0xea, 0x31, 0x3e, 0x01, 0xb9, 0x5f, 0x41, 0xcd, 0x20,
+	0x12, 0x51, 0xdb, 0x7e, 0xc0, 0x03, 0x19, 0x47, 0xdd, 0x97, 0x67, 0xe7, 0x01, 0xa0, 0xbd, 0x90,
-	0x5a, 0xa4, 0xcb, 0x6f, 0xfe, 0x5b, 0x84, 0xca, 0xb6, 0xfa, 0x1b, 0x80, 0x9e, 0x81, 0x3d, 0x5e,
+	0xf1, 0x57, 0x72, 0xb5, 0x65, 0xcb, 0xf6, 0xc7, 0x0e, 0xfc, 0x7f, 0x06, 0xad, 0x5f, 0xa9, 0x2f,
-	0x9a, 0x91, 0x97, 0xf7, 0x7c, 0x76, 0xfb, 0x76, 0x3f, 0xbe, 0x12, 0xa3, 0x63, 0xfd, 0x0d, 0x2c,
+	0x2e, 0x6c, 0x90, 0x1f, 0xcf, 0xbf, 0x1a, 0x72, 0x83, 0x76, 0x95, 0xe1, 0xec, 0x22, 0xb9, 0xf9,
-	0xc9, 0x35, 0x1e, 0xcd, 0x09, 0xb2, 0xb9, 0xdf, 0xbb, 0x57, 0xaf, 0xe3, 0x1b, 0x96, 0x60, 0x92,
+	0x77, 0x11, 0x2a, 0xdb, 0xea, 0x9f, 0x03, 0x74, 0x00, 0xe6, 0x64, 0x41, 0x45, 0xce, 0x3c, 0xcd,
-	0xf3, 0x70, 0x1e, 0x93, 0xb9, 0x38, 0xb9, 0xeb, 0xd7, 0x0c, 0x52, 0xb4, 0x0f, 0x65, 0xdd, 0x9a,
+	0xc5, 0x4d, 0xd7, 0xfe, 0xe8, 0x4a, 0x8c, 0xf6, 0xef, 0x2b, 0x58, 0x91, 0xab, 0x3a, 0x5a, 0xf0,
-	0xe6, 0x41, 0xcd, 0xa9, 0xe7, 0x36, 0x2e, 0x07, 0x28, 0xb2, 0x0d, 0x0b, 0xed, 0x8f, 0xb7, 0xc2,
+	0x0c, 0xe6, 0x77, 0x78, 0xfb, 0xea, 0xd5, 0xf7, 0x91, 0x21, 0x98, 0xe4, 0x0c, 0x59, 0xc4, 0x94,
-	0x79, 0xae, 0x99, 0x25, 0xed, 0x5e, 0xf3, 0xbc, 0x69, 0x6d, 0x58, 0xe8, 0x07, 0xa8, 0x19, 0x45,
+	0x5f, 0x36, 0xec, 0x8d, 0x25, 0xc3, 0x07, 0xed, 0x43, 0x59, 0x5f, 0xe7, 0x45, 0xd0, 0xfc, 0xa4,
-	0x8b, 0x3e, 0xc9, 0x9b, 0xe4, 0xbf, 0x00, 0xf7, 0xd3, 0x6b, 0x50, 0xca, 0xd9, 0x76, 0xfd, 0xd5,
+	0xb0, 0x1b, 0x97, 0x03, 0x14, 0xd9, 0x23, 0x03, 0xed, 0x4f, 0x36, 0xa9, 0x45, 0xae, 0xe5, 0xdb,
-	0xc5, 0x9a, 0xf5, 0xd7, 0xc5, 0x9a, 0xf5, 0xcf, 0xc5, 0x9a, 0xd5, 0x2d, 0xcb, 0x6f, 0xf8, 0xb3,
+	0xc0, 0x5e, 0xf2, 0x7b, 0xd3, 0x78, 0x64, 0xa0, 0xef, 0xa0, 0x96, 0x2b, 0x34, 0x5a, 0x50, 0xd0,
-	0xff, 0x03, 0x00, 0x00, 0xff, 0xff, 0x86, 0xd4, 0x0f, 0xa1, 0x0a, 0x0e, 0x00, 0x00,
+	0xf9, 0xae, 0xb1, 0x3f, 0x59, 0x82, 0x52, 0xce, 0xb6, 0xea, 0xa7, 0xe7, 0xeb, 0xc6, 0x1f, 0xe7,
+	0xeb, 0xc6, 0x5f, 0xe7, 0xeb, 0x46, 0xb7, 0x2c, 0xfb, 0xfe, 0xd3, 0xff, 0x02, 0x00, 0x00, 0xff,
+	0xff, 0x61, 0x35, 0x4d, 0x35, 0x20, 0x0e, 0x00, 0x00,
 }

vendor/github.com/moby/buildkit/api/services/control/control.proto

@@ -2,9 +2,13 @@ syntax = "proto3";
 
 package moby.buildkit.v1;
 
+// The control API is currently considered experimental and may break in a backwards
+// incompatible way.
+
 import "github.com/gogo/protobuf/gogoproto/gogo.proto";
 import "google/protobuf/timestamp.proto";
 import "github.com/moby/buildkit/solver/pb/ops.proto";
+import "github.com/moby/buildkit/api/types/worker.proto";
 
 option (gogoproto.sizer_all) = true;
 option (gogoproto.marshaler_all) = true;
@@ -17,14 +21,18 @@ service Control {
 	rpc Status(StatusRequest) returns (stream StatusResponse);
 	rpc Session(stream BytesMessage) returns (stream BytesMessage);
 	rpc ListWorkers(ListWorkersRequest) returns (ListWorkersResponse);
+	// rpc Info(InfoRequest) returns (InfoResponse);
 }
 
 message PruneRequest {
-	// TODO: filter
+	repeated string filter = 1;
+	bool all = 2;
+	int64 keepDuration = 3 [(gogoproto.nullable) = true];
+	int64 keepBytes = 4 [(gogoproto.nullable) = true];
 }
 
 message DiskUsageRequest {
-	string filter = 1; // FIXME: this should be containerd-compatible repeated string?
+	repeated string filter = 1; 
 }
 
 message DiskUsageResponse {
@@ -41,6 +49,8 @@ message UsageRecord {
 	google.protobuf.Timestamp LastUsedAt = 7 [(gogoproto.stdtime) = true];
 	int64 UsageCount = 8;
 	string Description = 9;
+	string RecordType = 10;
+	bool Shared = 11;
 }
 
 message SolveRequest {
@@ -112,11 +122,5 @@ message ListWorkersRequest {
 }
 
 message ListWorkersResponse {
-	repeated WorkerRecord record = 1;
+	repeated moby.buildkit.v1.types.WorkerRecord record = 1;
-}
-
-message WorkerRecord {
-	string ID = 1;
-	map<string, string> Labels = 2;
-	repeated pb.Platform platforms = 3 [(gogoproto.nullable) = false];
 }

vendor/github.com/moby/buildkit/api/types/generate.go

@@ -0,0 +1,3 @@
+package moby_buildkit_v1_types
+
+//go:generate protoc -I=. -I=../../vendor/ -I=../../../../../ --gogo_out=plugins=grpc:. worker.proto

vendor/github.com/moby/buildkit/api/types/worker.pb.go

@@ -0,0 +1,523 @@
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: worker.proto
+
+/*
+	Package moby_buildkit_v1_types is a generated protocol buffer package.
+
+	It is generated from these files:
+		worker.proto
+
+	It has these top-level messages:
+		WorkerRecord
+*/
+package moby_buildkit_v1_types
+
+import proto "github.com/gogo/protobuf/proto"
+import fmt "fmt"
+import math "math"
+import _ "github.com/gogo/protobuf/gogoproto"
+import pb "github.com/moby/buildkit/solver/pb"
+
+import io "io"
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the proto package it is being compiled against.
+// A compilation error at this line likely means your copy of the
+// proto package needs to be updated.
+const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
+
+type WorkerRecord struct {
+	ID        string            `protobuf:"bytes,1,opt,name=ID,proto3" json:"ID,omitempty"`
+	Labels    map[string]string `protobuf:"bytes,2,rep,name=Labels" json:"Labels,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	Platforms []pb.Platform     `protobuf:"bytes,3,rep,name=platforms" json:"platforms"`
+}
+
+func (m *WorkerRecord) Reset()                    { *m = WorkerRecord{} }
+func (m *WorkerRecord) String() string            { return proto.CompactTextString(m) }
+func (*WorkerRecord) ProtoMessage()               {}
+func (*WorkerRecord) Descriptor() ([]byte, []int) { return fileDescriptorWorker, []int{0} }
+
+func (m *WorkerRecord) GetID() string {
+	if m != nil {
+		return m.ID
+	}
+	return ""
+}
+
+func (m *WorkerRecord) GetLabels() map[string]string {
+	if m != nil {
+		return m.Labels
+	}
+	return nil
+}
+
+func (m *WorkerRecord) GetPlatforms() []pb.Platform {
+	if m != nil {
+		return m.Platforms
+	}
+	return nil
+}
+
+func init() {
+	proto.RegisterType((*WorkerRecord)(nil), "moby.buildkit.v1.types.WorkerRecord")
+}
+func (m *WorkerRecord) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WorkerRecord) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if len(m.ID) > 0 {
+		dAtA[i] = 0xa
+		i++
+		i = encodeVarintWorker(dAtA, i, uint64(len(m.ID)))
+		i += copy(dAtA[i:], m.ID)
+	}
+	if len(m.Labels) > 0 {
+		for k, _ := range m.Labels {
+			dAtA[i] = 0x12
+			i++
+			v := m.Labels[k]
+			mapSize := 1 + len(k) + sovWorker(uint64(len(k))) + 1 + len(v) + sovWorker(uint64(len(v)))
+			i = encodeVarintWorker(dAtA, i, uint64(mapSize))
+			dAtA[i] = 0xa
+			i++
+			i = encodeVarintWorker(dAtA, i, uint64(len(k)))
+			i += copy(dAtA[i:], k)
+			dAtA[i] = 0x12
+			i++
+			i = encodeVarintWorker(dAtA, i, uint64(len(v)))
+			i += copy(dAtA[i:], v)
+		}
+	}
+	if len(m.Platforms) > 0 {
+		for _, msg := range m.Platforms {
+			dAtA[i] = 0x1a
+			i++
+			i = encodeVarintWorker(dAtA, i, uint64(msg.Size()))
+			n, err := msg.MarshalTo(dAtA[i:])
+			if err != nil {
+				return 0, err
+			}
+			i += n
+		}
+	}
+	return i, nil
+}
+
+func encodeVarintWorker(dAtA []byte, offset int, v uint64) int {
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return offset + 1
+}
+func (m *WorkerRecord) Size() (n int) {
+	var l int
+	_ = l
+	l = len(m.ID)
+	if l > 0 {
+		n += 1 + l + sovWorker(uint64(l))
+	}
+	if len(m.Labels) > 0 {
+		for k, v := range m.Labels {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + sovWorker(uint64(len(k))) + 1 + len(v) + sovWorker(uint64(len(v)))
+			n += mapEntrySize + 1 + sovWorker(uint64(mapEntrySize))
+		}
+	}
+	if len(m.Platforms) > 0 {
+		for _, e := range m.Platforms {
+			l = e.Size()
+			n += 1 + l + sovWorker(uint64(l))
+		}
+	}
+	return n
+}
+
+func sovWorker(x uint64) (n int) {
+	for {
+		n++
+		x >>= 7
+		if x == 0 {
+			break
+		}
+	}
+	return n
+}
+func sozWorker(x uint64) (n int) {
+	return sovWorker(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (m *WorkerRecord) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowWorker
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WorkerRecord: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WorkerRecord: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowWorker
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthWorker
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Labels", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowWorker
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthWorker
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Labels == nil {
+				m.Labels = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowWorker
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= (uint64(b) & 0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowWorker
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= (uint64(b) & 0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthWorker
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowWorker
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= (uint64(b) & 0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return ErrInvalidLengthWorker
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipWorker(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if skippy < 0 {
+						return ErrInvalidLengthWorker
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.Labels[mapkey] = mapvalue
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Platforms", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowWorker
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthWorker
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Platforms = append(m.Platforms, pb.Platform{})
+			if err := m.Platforms[len(m.Platforms)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipWorker(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthWorker
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func skipWorker(dAtA []byte) (n int, err error) {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowWorker
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowWorker
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if dAtA[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+			return iNdEx, nil
+		case 1:
+			iNdEx += 8
+			return iNdEx, nil
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowWorker
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			iNdEx += length
+			if length < 0 {
+				return 0, ErrInvalidLengthWorker
+			}
+			return iNdEx, nil
+		case 3:
+			for {
+				var innerWire uint64
+				var start int = iNdEx
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return 0, ErrIntOverflowWorker
+					}
+					if iNdEx >= l {
+						return 0, io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					innerWire |= (uint64(b) & 0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				innerWireType := int(innerWire & 0x7)
+				if innerWireType == 4 {
+					break
+				}
+				next, err := skipWorker(dAtA[start:])
+				if err != nil {
+					return 0, err
+				}
+				iNdEx = start + next
+			}
+			return iNdEx, nil
+		case 4:
+			return iNdEx, nil
+		case 5:
+			iNdEx += 4
+			return iNdEx, nil
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+	}
+	panic("unreachable")
+}
+
+var (
+	ErrInvalidLengthWorker = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowWorker   = fmt.Errorf("proto: integer overflow")
+)
+
+func init() { proto.RegisterFile("worker.proto", fileDescriptorWorker) }
+
+var fileDescriptorWorker = []byte{
+	// 273 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x6c, 0x8f, 0x41, 0x4b, 0xf3, 0x40,
+	0x10, 0x86, 0xbf, 0x4d, 0x3e, 0x0b, 0xdd, 0x06, 0x91, 0x45, 0x24, 0xe4, 0x10, 0x8b, 0xa7, 0x1e,
+	0x74, 0xb6, 0xea, 0x45, 0x3d, 0x96, 0x0a, 0x16, 0x3c, 0x48, 0x2e, 0x9e, 0xb3, 0xed, 0x36, 0x86,
+	0x24, 0xce, 0xb2, 0xd9, 0x44, 0xf2, 0x0f, 0x7b, 0xf4, 0xe2, 0x55, 0x24, 0xbf, 0x44, 0xba, 0x89,
+	0x98, 0x83, 0xb7, 0x79, 0x87, 0x67, 0x1e, 0xde, 0xa1, 0xde, 0x1b, 0xea, 0x4c, 0x6a, 0x50, 0x1a,
+	0x0d, 0xb2, 0x93, 0x02, 0x45, 0x03, 0xa2, 0x4a, 0xf3, 0x4d, 0x96, 0x1a, 0xa8, 0x2f, 0xc1, 0x34,
+	0x4a, 0x96, 0xc1, 0x45, 0x92, 0x9a, 0x97, 0x4a, 0xc0, 0x1a, 0x0b, 0x9e, 0x60, 0x82, 0xdc, 0xe2,
+	0xa2, 0xda, 0xda, 0x64, 0x83, 0x9d, 0x3a, 0x4d, 0x70, 0x3e, 0xc0, 0xf7, 0x46, 0xfe, 0x63, 0xe4,
+	0x25, 0xe6, 0xb5, 0xd4, 0x5c, 0x09, 0x8e, 0xaa, 0xec, 0xe8, 0xb3, 0x0f, 0x42, 0xbd, 0x67, 0xdb,
+	0x22, 0x92, 0x6b, 0xd4, 0x1b, 0x76, 0x48, 0x9d, 0xd5, 0xd2, 0x27, 0x53, 0x32, 0x1b, 0x47, 0xce,
+	0x6a, 0xc9, 0x1e, 0xe8, 0xe8, 0x31, 0x16, 0x32, 0x2f, 0x7d, 0x67, 0xea, 0xce, 0x26, 0x57, 0x73,
+	0xf8, 0xbb, 0x26, 0x0c, 0x2d, 0xd0, 0x9d, 0xdc, 0xbf, 0x1a, 0xdd, 0x44, 0xfd, 0x3d, 0x9b, 0xd3,
+	0xb1, 0xca, 0x63, 0xb3, 0x45, 0x5d, 0x94, 0xbe, 0x6b, 0x65, 0x1e, 0x28, 0x01, 0x4f, 0xfd, 0x72,
+	0xf1, 0x7f, 0xf7, 0x79, 0xfa, 0x2f, 0xfa, 0x85, 0x82, 0x5b, 0x3a, 0x19, 0x88, 0xd8, 0x11, 0x75,
+	0x33, 0xd9, 0xf4, 0xdd, 0xf6, 0x23, 0x3b, 0xa6, 0x07, 0x75, 0x9c, 0x57, 0xd2, 0x77, 0xec, 0xae,
+	0x0b, 0x77, 0xce, 0x0d, 0x59, 0x78, 0xbb, 0x36, 0x24, 0xef, 0x6d, 0x48, 0xbe, 0xda, 0x90, 0x88,
+	0x91, 0x7d, 0xf6, 0xfa, 0x3b, 0x00, 0x00, 0xff, 0xff, 0xa9, 0x5c, 0x8f, 0x26, 0x71, 0x01, 0x00,
+	0x00,
+}

vendor/github.com/moby/buildkit/api/types/worker.proto

@@ -0,0 +1,16 @@
+syntax = "proto3";
+
+package moby.buildkit.v1.types;
+
+import "github.com/gogo/protobuf/gogoproto/gogo.proto";
+import "github.com/moby/buildkit/solver/pb/ops.proto";
+
+option (gogoproto.sizer_all) = true;
+option (gogoproto.marshaler_all) = true;
+option (gogoproto.unmarshaler_all) = true;
+
+message WorkerRecord {
+	string ID = 1;
+	map<string, string> Labels = 2;
+	repeated pb.Platform platforms = 3 [(gogoproto.nullable) = false];
+}

vendor/github.com/moby/buildkit/client/diskusage.go

@@ -20,12 +20,14 @@ type UsageInfo struct {
 	UsageCount  int
 	Parent      string
 	Description string
+	RecordType  UsageRecordType
+	Shared      bool
 }
 
 func (c *Client) DiskUsage(ctx context.Context, opts ...DiskUsageOption) ([]*UsageInfo, error) {
 	info := &DiskUsageInfo{}
 	for _, o := range opts {
-		o(info)
+		o.SetDiskUsageOption(info)
 	}
 
 	req := &controlapi.DiskUsageRequest{Filter: info.Filter}
@@ -47,6 +49,8 @@ func (c *Client) DiskUsage(ctx context.Context, opts ...DiskUsageOption) ([]*Usa
 			Description: d.Description,
 			UsageCount:  int(d.UsageCount),
 			LastUsedAt:  d.LastUsedAt,
+			RecordType:  UsageRecordType(d.RecordType),
+			Shared:      d.Shared,
 		})
 	}
 
@@ -60,14 +64,21 @@ func (c *Client) DiskUsage(ctx context.Context, opts ...DiskUsageOption) ([]*Usa
 	return du, nil
 }
 
-type DiskUsageOption func(*DiskUsageInfo)
+type DiskUsageOption interface {
+	SetDiskUsageOption(*DiskUsageInfo)
+}
 
 type DiskUsageInfo struct {
-	Filter string
+	Filter []string
 }
 
-func WithFilter(f string) DiskUsageOption {
+type UsageRecordType string
-	return func(di *DiskUsageInfo) {
+
-		di.Filter = f
+const (
-	}
+	UsageRecordTypeInternal    UsageRecordType = "internal"
-}
+	UsageRecordTypeFrontend    UsageRecordType = "frontend"
+	UsageRecordTypeLocalSource UsageRecordType = "source.local"
+	UsageRecordTypeGitCheckout UsageRecordType = "source.git.checkout"
+	UsageRecordTypeCacheMount  UsageRecordType = "exec.cachemount"
+	UsageRecordTypeRegular     UsageRecordType = "regular"
+)

vendor/github.com/moby/buildkit/client/filter.go

@@ -0,0 +1,19 @@
+package client
+
+func WithFilter(f []string) Filter {
+	return Filter(f)
+}
+
+type Filter []string
+
+func (f Filter) SetDiskUsageOption(di *DiskUsageInfo) {
+	di.Filter = f
+}
+
+func (f Filter) SetPruneOption(pi *PruneInfo) {
+	pi.Filter = f
+}
+
+func (f Filter) SetListWorkersOption(lwi *ListWorkersInfo) {
+	lwi.Filter = f
+}

vendor/github.com/moby/buildkit/client/llb/exec.go

@@ -2,6 +2,7 @@ package llb
 
 import (
 	_ "crypto/sha256"
+	"net"
 	"sort"
 
 	"github.com/moby/buildkit/solver/pb"
@@ -15,6 +16,7 @@ type Meta struct {
 	Cwd        string
 	User       string
 	ProxyEnv   *ProxyEnv
+	ExtraHosts []HostIP
 }
 
 func NewExecOp(root Output, meta Meta, readOnly bool, c Constraints) *ExecOp {
@@ -57,6 +59,7 @@ type ExecOp struct {
 	meta        Meta
 	constraints Constraints
 	isValidated bool
+	secrets     []SecretInfo
 }
 
 func (e *ExecOp) AddMount(target string, source Output, opt ...MountOption) Output {
@@ -126,13 +129,22 @@ func (e *ExecOp) Marshal(c *Constraints) (digest.Digest, []byte, *pb.OpMetadata,
 		return e.mounts[i].target < e.mounts[j].target
 	})
 
-	peo := &pb.ExecOp{
+	meta := &pb.Meta{
-		Meta: &pb.Meta{
 		Args: e.meta.Args,
 		Env:  e.meta.Env.ToArray(),
 		Cwd:  e.meta.Cwd,
 		User: e.meta.User,
-		},
+	}
+	if len(e.meta.ExtraHosts) > 0 {
+		hosts := make([]*pb.HostIP, len(e.meta.ExtraHosts))
+		for i, h := range e.meta.ExtraHosts {
+			hosts[i] = &pb.HostIP{Host: h.Host, IP: h.IP.String()}
+		}
+		meta.ExtraHosts = hosts
+	}
+
+	peo := &pb.ExecOp{
+		Meta: meta,
 	}
 
 	if p := e.meta.ProxyEnv; p != nil {
@@ -142,6 +154,23 @@ func (e *ExecOp) Marshal(c *Constraints) (digest.Digest, []byte, *pb.OpMetadata,
 			FtpProxy:   p.FtpProxy,
 			NoProxy:    p.NoProxy,
 		}
+		addCap(&e.constraints, pb.CapExecMetaProxy)
+	}
+
+	addCap(&e.constraints, pb.CapExecMetaBase)
+
+	for _, m := range e.mounts {
+		if m.selector != "" {
+			addCap(&e.constraints, pb.CapExecMountSelector)
+		}
+		if m.cacheID != "" {
+			addCap(&e.constraints, pb.CapExecMountCache)
+			addCap(&e.constraints, pb.CapExecMountCacheSharing)
+		} else if m.tmpfs {
+			addCap(&e.constraints, pb.CapExecMountTmpfs)
+		} else if m.source != nil {
+			addCap(&e.constraints, pb.CapExecMountBind)
+		}
 	}
 
 	pop, md := MarshalConstraints(c, &e.constraints)
@@ -211,6 +240,25 @@ func (e *ExecOp) Marshal(c *Constraints) (digest.Digest, []byte, *pb.OpMetadata,
 		peo.Mounts = append(peo.Mounts, pm)
 	}
 
+	if len(e.secrets) > 0 {
+		addCap(&e.constraints, pb.CapMountSecret)
+	}
+
+	for _, s := range e.secrets {
+		pm := &pb.Mount{
+			Dest:      s.Target,
+			MountType: pb.MountType_SECRET,
+			SecretOpt: &pb.SecretOpt{
+				ID:       s.ID,
+				Uid:      uint32(s.UID),
+				Gid:      uint32(s.GID),
+				Optional: s.Optional,
+				Mode:     uint32(s.Mode),
+			},
+		}
+		peo.Mounts = append(peo.Mounts, pm)
+	}
+
 	dt, err := pop.Marshal()
 	if err != nil {
 		return "", nil, nil, err
@@ -349,6 +397,12 @@ func Dirf(str string, v ...interface{}) RunOption {
 	})
 }
 
+func AddExtraHost(host string, ip net.IP) RunOption {
+	return runOptionFunc(func(ei *ExecInfo) {
+		ei.State = ei.State.AddExtraHost(host, ip)
+	})
+}
+
 func Reset(s State) RunOption {
 	return runOptionFunc(func(ei *ExecInfo) {
 		ei.State = ei.State.Reset(s)
@@ -367,6 +421,53 @@ func AddMount(dest string, mountState State, opts ...MountOption) RunOption {
 	})
 }
 
+func AddSecret(dest string, opts ...SecretOption) RunOption {
+	return runOptionFunc(func(ei *ExecInfo) {
+		s := &SecretInfo{ID: dest, Target: dest, Mode: 0400}
+		for _, opt := range opts {
+			opt.SetSecretOption(s)
+		}
+		ei.Secrets = append(ei.Secrets, *s)
+	})
+}
+
+type SecretOption interface {
+	SetSecretOption(*SecretInfo)
+}
+
+type secretOptionFunc func(*SecretInfo)
+
+func (fn secretOptionFunc) SetSecretOption(si *SecretInfo) {
+	fn(si)
+}
+
+type SecretInfo struct {
+	ID       string
+	Target   string
+	Mode     int
+	UID      int
+	GID      int
+	Optional bool
+}
+
+var SecretOptional = secretOptionFunc(func(si *SecretInfo) {
+	si.Optional = true
+})
+
+func SecretID(id string) SecretOption {
+	return secretOptionFunc(func(si *SecretInfo) {
+		si.ID = id
+	})
+}
+
+func SecretFileOpt(uid, gid, mode int) SecretOption {
+	return secretOptionFunc(func(si *SecretInfo) {
+		si.UID = uid
+		si.GID = gid
+		si.Mode = mode
+	})
+}
+
 func ReadonlyRootFS() RunOption {
 	return runOptionFunc(func(ei *ExecInfo) {
 		ei.ReadonlyRootFS = true
@@ -385,6 +486,7 @@ type ExecInfo struct {
 	Mounts         []MountInfo
 	ReadonlyRootFS bool
 	ProxyEnv       *ProxyEnv
+	Secrets        []SecretInfo
 }
 
 type MountInfo struct {

vendor/github.com/moby/buildkit/client/llb/meta.go

@@ -2,6 +2,7 @@ package llb
 
 import (
 	"fmt"
+	"net"
 	"path"
 
 	"github.com/containerd/containerd/platforms"
@@ -16,6 +17,7 @@ var (
 	keyDir       = contextKeyT("llb.exec.dir")
 	keyEnv       = contextKeyT("llb.exec.env")
 	keyUser      = contextKeyT("llb.exec.user")
+	keyExtraHost = contextKeyT("llb.exec.extrahost")
 	keyPlatform  = contextKeyT("llb.platform")
 )
 
@@ -124,6 +126,25 @@ func getPlatform(s State) *specs.Platform {
 	return nil
 }
 
+func extraHost(host string, ip net.IP) StateOption {
+	return func(s State) State {
+		return s.WithValue(keyExtraHost, append(getExtraHosts(s), HostIP{Host: host, IP: ip}))
+	}
+}
+
+func getExtraHosts(s State) []HostIP {
+	v := s.Value(keyExtraHost)
+	if v != nil {
+		return v.([]HostIP)
+	}
+	return nil
+}
+
+type HostIP struct {
+	Host string
+	IP   net.IP
+}
+
 type EnvList []KeyValue
 
 type KeyValue struct {

vendor/github.com/moby/buildkit/client/llb/resolver.go

@@ -3,16 +3,16 @@ package llb
 import (
 	"context"
 
+	gw "github.com/moby/buildkit/frontend/gateway/client"
 	digest "github.com/opencontainers/go-digest"
-	specs "github.com/opencontainers/image-spec/specs-go/v1"
 )
 
 func WithMetaResolver(mr ImageMetaResolver) ImageOption {
-	return ImageOptionFunc(func(ii *ImageInfo) {
+	return imageOptionFunc(func(ii *ImageInfo) {
 		ii.metaResolver = mr
 	})
 }
 
 type ImageMetaResolver interface {
-	ResolveImageConfig(ctx context.Context, ref string, platform *specs.Platform) (digest.Digest, []byte, error)
+	ResolveImageConfig(ctx context.Context, ref string, opt gw.ResolveImageConfigOpt) (digest.Digest, []byte, error)
 }

vendor/github.com/moby/buildkit/client/llb/source.go

@@ -9,7 +9,9 @@ import (
 	"strings"
 
 	"github.com/docker/distribution/reference"
+	gw "github.com/moby/buildkit/frontend/gateway/client"
 	"github.com/moby/buildkit/solver/pb"
+	"github.com/moby/buildkit/util/apicaps"
 	digest "github.com/opencontainers/go-digest"
 	"github.com/pkg/errors"
 )
@@ -51,11 +53,26 @@ func (s *SourceOp) Marshal(constraints *Constraints) (digest.Digest, []byte, *pb
 		return "", nil, nil, err
 	}
 
+	if strings.HasPrefix(s.id, "local://") {
+		if _, hasSession := s.attrs[pb.AttrLocalSessionID]; !hasSession {
+			uid := s.constraints.LocalUniqueID
+			if uid == "" {
+				uid = constraints.LocalUniqueID
+			}
+			s.attrs[pb.AttrLocalUniqueID] = uid
+			addCap(&s.constraints, pb.CapSourceLocalUnique)
+		}
+	}
 	proto, md := MarshalConstraints(constraints, &s.constraints)
 
 	proto.Op = &pb.Op_Source{
 		Source: &pb.SourceOp{Identifier: s.id, Attrs: s.attrs},
 	}
+
+	if !platformSpecificSource(s.id) {
+		proto.Platform = nil
+	}
+
 	dt, err := proto.Marshal()
 	if err != nil {
 		return "", nil, nil, err
@@ -82,12 +99,30 @@ func Image(ref string, opts ...ImageOption) State {
 	for _, opt := range opts {
 		opt.SetImageOption(&info)
 	}
-	src := NewSource("docker-image://"+ref, nil, info.Constraints) // controversial
+
+	addCap(&info.Constraints, pb.CapSourceImage)
+
+	attrs := map[string]string{}
+	if info.resolveMode != 0 {
+		attrs[pb.AttrImageResolveMode] = info.resolveMode.String()
+		if info.resolveMode == ResolveModeForcePull {
+			addCap(&info.Constraints, pb.CapSourceImageResolveMode) // only require cap for security enforced mode
+		}
+	}
+
+	if info.RecordType != "" {
+		attrs[pb.AttrImageRecordType] = info.RecordType
+	}
+
+	src := NewSource("docker-image://"+ref, attrs, info.Constraints) // controversial
 	if err != nil {
 		src.err = err
 	}
 	if info.metaResolver != nil {
-		_, dt, err := info.metaResolver.ResolveImageConfig(context.TODO(), ref, info.Constraints.Platform)
+		_, dt, err := info.metaResolver.ResolveImageConfig(context.TODO(), ref, gw.ResolveImageConfigOpt{
+			Platform:    info.Constraints.Platform,
+			ResolveMode: info.resolveMode.String(),
+		})
 		if err != nil {
 			src.err = err
 		} else {
@@ -124,15 +159,46 @@ type ImageOption interface {
 	SetImageOption(*ImageInfo)
 }
 
-type ImageOptionFunc func(*ImageInfo)
+type imageOptionFunc func(*ImageInfo)
 
-func (fn ImageOptionFunc) SetImageOption(ii *ImageInfo) {
+func (fn imageOptionFunc) SetImageOption(ii *ImageInfo) {
 	fn(ii)
 }
 
+var MarkImageInternal = imageOptionFunc(func(ii *ImageInfo) {
+	ii.RecordType = "internal"
+})
+
+type ResolveMode int
+
+const (
+	ResolveModeDefault ResolveMode = iota
+	ResolveModeForcePull
+	ResolveModePreferLocal
+)
+
+func (r ResolveMode) SetImageOption(ii *ImageInfo) {
+	ii.resolveMode = r
+}
+
+func (r ResolveMode) String() string {
+	switch r {
+	case ResolveModeDefault:
+		return pb.AttrImageResolveModeDefault
+	case ResolveModeForcePull:
+		return pb.AttrImageResolveModeForcePull
+	case ResolveModePreferLocal:
+		return pb.AttrImageResolveModePreferLocal
+	default:
+		return ""
+	}
+}
+
 type ImageInfo struct {
 	constraintsWrapper
 	metaResolver ImageMetaResolver
+	resolveMode  ResolveMode
+	RecordType   string
 }
 
 func Git(remote, ref string, opts ...GitOption) State {
@@ -160,10 +226,15 @@ func Git(remote, ref string, opts ...GitOption) State {
 	attrs := map[string]string{}
 	if gi.KeepGitDir {
 		attrs[pb.AttrKeepGitDir] = "true"
+		addCap(&gi.Constraints, pb.CapSourceGitKeepDir)
 	}
 	if url != "" {
 		attrs[pb.AttrFullRemoteURL] = url
+		addCap(&gi.Constraints, pb.CapSourceGitFullURL)
 	}
+
+	addCap(&gi.Constraints, pb.CapSourceGit)
+
 	source := NewSource("git://"+id, attrs, gi.Constraints)
 	return NewState(source.Output())
 }
@@ -201,20 +272,27 @@ func Local(name string, opts ...LocalOption) State {
 	attrs := map[string]string{}
 	if gi.SessionID != "" {
 		attrs[pb.AttrLocalSessionID] = gi.SessionID
+		addCap(&gi.Constraints, pb.CapSourceLocalSessionID)
 	}
 	if gi.IncludePatterns != "" {
 		attrs[pb.AttrIncludePatterns] = gi.IncludePatterns
+		addCap(&gi.Constraints, pb.CapSourceLocalIncludePatterns)
 	}
 	if gi.FollowPaths != "" {
 		attrs[pb.AttrFollowPaths] = gi.FollowPaths
+		addCap(&gi.Constraints, pb.CapSourceLocalFollowPaths)
 	}
 	if gi.ExcludePatterns != "" {
 		attrs[pb.AttrExcludePatterns] = gi.ExcludePatterns
+		addCap(&gi.Constraints, pb.CapSourceLocalExcludePatterns)
 	}
 	if gi.SharedKeyHint != "" {
 		attrs[pb.AttrSharedKeyHint] = gi.SharedKeyHint
+		addCap(&gi.Constraints, pb.CapSourceLocalSharedKeyHint)
 	}
 
+	addCap(&gi.Constraints, pb.CapSourceLocal)
+
 	source := NewSource("local://"+name, attrs, gi.Constraints)
 	return NewState(source.Output())
 }
@@ -291,20 +369,25 @@ func HTTP(url string, opts ...HTTPOption) State {
 	attrs := map[string]string{}
 	if hi.Checksum != "" {
 		attrs[pb.AttrHTTPChecksum] = hi.Checksum.String()
+		addCap(&hi.Constraints, pb.CapSourceHTTPChecksum)
 	}
 	if hi.Filename != "" {
 		attrs[pb.AttrHTTPFilename] = hi.Filename
 	}
 	if hi.Perm != 0 {
 		attrs[pb.AttrHTTPPerm] = "0" + strconv.FormatInt(int64(hi.Perm), 8)
+		addCap(&hi.Constraints, pb.CapSourceHTTPPerm)
 	}
 	if hi.UID != 0 {
 		attrs[pb.AttrHTTPUID] = strconv.Itoa(hi.UID)
+		addCap(&hi.Constraints, pb.CapSourceHTTPUIDGID)
 	}
-	if hi.UID != 0 {
+	if hi.GID != 0 {
 		attrs[pb.AttrHTTPGID] = strconv.Itoa(hi.GID)
+		addCap(&hi.Constraints, pb.CapSourceHTTPUIDGID)
 	}
 
+	addCap(&hi.Constraints, pb.CapSourceHTTP)
 	source := NewSource(url, attrs, hi.Constraints)
 	return NewState(source.Output())
 }
@@ -352,3 +435,14 @@ func Chown(uid, gid int) HTTPOption {
 		hi.GID = gid
 	})
 }
+
+func platformSpecificSource(id string) bool {
+	return strings.HasPrefix(id, "docker-image://")
+}
+
+func addCap(c *Constraints, id apicaps.CapID) {
+	if c.Metadata.Caps == nil {
+		c.Metadata.Caps = make(map[apicaps.CapID]bool)
+	}
+	c.Metadata.Caps[id] = true
+}

vendor/github.com/moby/buildkit/client/llb/state.go

@@ -2,9 +2,13 @@ package llb
 
 import (
 	"context"
+	"fmt"
+	"net"
 
 	"github.com/containerd/containerd/platforms"
+	"github.com/moby/buildkit/identity"
 	"github.com/moby/buildkit/solver/pb"
+	"github.com/moby/buildkit/util/apicaps"
 	"github.com/moby/buildkit/util/system"
 	digest "github.com/opencontainers/go-digest"
 	specs "github.com/opencontainers/image-spec/specs-go/v1"
@@ -79,6 +83,7 @@ func (s State) Marshal(co ...ConstraintsOpt) (*Definition, error) {
 	defaultPlatform := platforms.Normalize(platforms.DefaultSpec())
 	c := &Constraints{
 		Platform:      &defaultPlatform,
+		LocalUniqueID: identity.NewID(),
 	}
 	for _, o := range append(s.opts, co...) {
 		o.SetConstraintsOption(c)
@@ -98,6 +103,28 @@ func (s State) Marshal(co ...ConstraintsOpt) (*Definition, error) {
 		return def, err
 	}
 	def.Def = append(def.Def, dt)
+
+	dgst := digest.FromBytes(dt)
+	md := def.Metadata[dgst]
+	md.Caps = map[apicaps.CapID]bool{
+		pb.CapConstraints: true,
+		pb.CapPlatform:    true,
+	}
+
+	for _, m := range def.Metadata {
+		if m.IgnoreCache {
+			md.Caps[pb.CapMetaIgnoreCache] = true
+		}
+		if m.Description != nil {
+			md.Caps[pb.CapMetaDescription] = true
+		}
+		if m.ExportCache != nil {
+			md.Caps[pb.CapMetaExportCache] = true
+		}
+	}
+
+	def.Metadata[dgst] = md
+
 	return def, nil
 }
 
@@ -160,12 +187,14 @@ func (s State) Run(ro ...RunOption) ExecState {
 		Env:        getEnv(ei.State),
 		User:       getUser(ei.State),
 		ProxyEnv:   ei.ProxyEnv,
+		ExtraHosts: getExtraHosts(ei.State),
 	}
 
 	exec := NewExecOp(s.Output(), meta, ei.ReadonlyRootFS, ei.Constraints)
 	for _, m := range ei.Mounts {
 		exec.AddMount(m.Target, m.Source, m.Opts...)
 	}
+	exec.secrets = ei.Secrets
 
 	return ExecState{
 		State: s.WithOutput(exec.Output()),
@@ -192,6 +221,10 @@ func (s State) GetEnv(key string) (string, bool) {
 	return getEnv(s).Get(key)
 }
 
+func (s State) Env() []string {
+	return getEnv(s).ToArray()
+}
+
 func (s State) GetDir() string {
 	return getDir(s)
 }
@@ -223,6 +256,10 @@ func (s State) With(so ...StateOption) State {
 	return s
 }
 
+func (s State) AddExtraHost(host string, ip net.IP) State {
+	return extraHost(host, ip)(s)
+}
+
 type output struct {
 	vertex   Vertex
 	getIndex func() (pb.OutputIndex, error)
@@ -308,6 +345,13 @@ func mergeMetadata(m1, m2 pb.OpMetadata) pb.OpMetadata {
 		m1.ExportCache = m2.ExportCache
 	}
 
+	for k := range m2.Caps {
+		if m1.Caps == nil {
+			m1.Caps = make(map[apicaps.CapID]bool, len(m2.Caps))
+		}
+		m1.Caps[k] = true
+	}
+
 	return m1
 }
 
@@ -317,7 +361,18 @@ var IgnoreCache = constraintsOptFunc(func(c *Constraints) {
 
 func WithDescription(m map[string]string) ConstraintsOpt {
 	return constraintsOptFunc(func(c *Constraints) {
-		c.Metadata.Description = m
+		if c.Metadata.Description == nil {
+			c.Metadata.Description = map[string]string{}
+		}
+		for k, v := range m {
+			c.Metadata.Description[k] = v
+		}
+	})
+}
+
+func WithCustomName(name string, a ...interface{}) ConstraintsOpt {
+	return WithDescription(map[string]string{
+		"llb.customname": fmt.Sprintf(name, a...),
 	})
 }
 
@@ -358,6 +413,7 @@ type Constraints struct {
 	Platform          *specs.Platform
 	WorkerConstraints []string
 	Metadata          pb.OpMetadata
+	LocalUniqueID     string
 }
 
 func Platform(p specs.Platform) ConstraintsOpt {
@@ -366,6 +422,12 @@ func Platform(p specs.Platform) ConstraintsOpt {
 	})
 }
 
+func LocalUniqueID(v string) ConstraintsOpt {
+	return constraintsOptFunc(func(c *Constraints) {
+		c.LocalUniqueID = v
+	})
+}
+
 var (
 	LinuxAmd64   = Platform(specs.Platform{OS: "linux", Architecture: "amd64"})
 	LinuxArmhf   = Platform(specs.Platform{OS: "linux", Architecture: "arm", Variant: "v7"})

vendor/github.com/moby/buildkit/client/prune.go

@@ -3,6 +3,7 @@ package client
 import (
 	"context"
 	"io"
+	"time"
 
 	controlapi "github.com/moby/buildkit/api/services/control"
 	"github.com/pkg/errors"
@@ -11,10 +12,17 @@ import (
 func (c *Client) Prune(ctx context.Context, ch chan UsageInfo, opts ...PruneOption) error {
 	info := &PruneInfo{}
 	for _, o := range opts {
-		o(info)
+		o.SetPruneOption(info)
 	}
 
-	req := &controlapi.PruneRequest{}
+	req := &controlapi.PruneRequest{
+		Filter:       info.Filter,
+		KeepDuration: int64(info.KeepDuration),
+		KeepBytes:    int64(info.KeepBytes),
+	}
+	if info.All {
+		req.All = true
+	}
 	cl, err := c.controlClient().Prune(ctx, req)
 	if err != nil {
 		return errors.Wrap(err, "failed to call prune")
@@ -39,12 +47,37 @@ func (c *Client) Prune(ctx context.Context, ch chan UsageInfo, opts ...PruneOpti
 				Description: d.Description,
 				UsageCount:  int(d.UsageCount),
 				LastUsedAt:  d.LastUsedAt,
+				RecordType:  UsageRecordType(d.RecordType),
+				Shared:      d.Shared,
 			}
 		}
 	}
 }
 
-type PruneOption func(*PruneInfo)
+type PruneOption interface {
+	SetPruneOption(*PruneInfo)
+}
 
 type PruneInfo struct {
+	Filter       []string
+	All          bool
+	KeepDuration time.Duration
+	KeepBytes    int64
+}
+
+type pruneOptionFunc func(*PruneInfo)
+
+func (f pruneOptionFunc) SetPruneOption(pi *PruneInfo) {
+	f(pi)
+}
+
+var PruneAll = pruneOptionFunc(func(pi *PruneInfo) {
+	pi.All = true
+})
+
+func WithKeepOpt(duration time.Duration, bytes int64) PruneOption {
+	return pruneOptionFunc(func(pi *PruneInfo) {
+		pi.KeepDuration = duration
+		pi.KeepBytes = bytes
+	})
 }

vendor/github.com/moby/buildkit/client/workers.go

@@ -18,7 +18,7 @@ type WorkerInfo struct {
 func (c *Client) ListWorkers(ctx context.Context, opts ...ListWorkersOption) ([]*WorkerInfo, error) {
 	info := &ListWorkersInfo{}
 	for _, o := range opts {
-		o(info)
+		o.SetListWorkersOption(info)
 	}
 
 	req := &controlapi.ListWorkersRequest{Filter: info.Filter}
@@ -33,35 +33,17 @@ func (c *Client) ListWorkers(ctx context.Context, opts ...ListWorkersOption) ([]
 		wi = append(wi, &WorkerInfo{
 			ID:        w.ID,
 			Labels:    w.Labels,
-			Platforms: toClientPlatforms(w.Platforms),
+			Platforms: pb.ToSpecPlatforms(w.Platforms),
 		})
 	}
 
 	return wi, nil
 }
 
-type ListWorkersOption func(*ListWorkersInfo)
+type ListWorkersOption interface {
+	SetListWorkersOption(*ListWorkersInfo)
+}
 
 type ListWorkersInfo struct {
 	Filter []string
 }
-
-func WithWorkerFilter(f []string) ListWorkersOption {
-	return func(wi *ListWorkersInfo) {
-		wi.Filter = f
-	}
-}
-
-func toClientPlatforms(p []pb.Platform) []specs.Platform {
-	out := make([]specs.Platform, 0, len(p))
-	for _, pp := range p {
-		out = append(out, specs.Platform{
-			OS:           pp.OS,
-			Architecture: pp.Architecture,
-			Variant:      pp.Variant,
-			OSVersion:    pp.OSVersion,
-			OSFeatures:   pp.OSFeatures,
-		})
-	}
-	return out
-}

vendor/github.com/moby/buildkit/frontend/gateway/client/client.go

@@ -0,0 +1,58 @@
+package client
+
+import (
+	"context"
+
+	"github.com/moby/buildkit/solver/pb"
+	digest "github.com/opencontainers/go-digest"
+	specs "github.com/opencontainers/image-spec/specs-go/v1"
+)
+
+type Client interface {
+	Solve(ctx context.Context, req SolveRequest) (*Result, error)
+	ResolveImageConfig(ctx context.Context, ref string, opt ResolveImageConfigOpt) (digest.Digest, []byte, error)
+	BuildOpts() BuildOpts
+}
+
+type Reference interface {
+	ReadFile(ctx context.Context, req ReadRequest) ([]byte, error)
+	// StatFile(ctx context.Context, req StatRequest) (*StatResponse, error)
+	// ReadDir(ctx context.Context, req ReadDirRequest) ([]*StatResponse, error)
+}
+
+type ReadRequest struct {
+	Filename string
+	Range    *FileRange
+}
+
+type FileRange struct {
+	Offset int
+	Length int
+}
+
+// SolveRequest is same as frontend.SolveRequest but avoiding dependency
+type SolveRequest struct {
+	Definition      *pb.Definition
+	Frontend        string
+	FrontendOpt     map[string]string
+	ImportCacheRefs []string
+}
+
+type WorkerInfo struct {
+	ID        string
+	Labels    map[string]string
+	Platforms []specs.Platform
+}
+
+type BuildOpts struct {
+	Opts      map[string]string
+	SessionID string
+	Workers   []WorkerInfo
+	Product   string
+}
+
+type ResolveImageConfigOpt struct {
+	Platform    *specs.Platform
+	ResolveMode string
+	LogName     string
+}

vendor/github.com/moby/buildkit/frontend/gateway/client/result.go

@@ -0,0 +1,54 @@
+package client
+
+import (
+	"context"
+	"sync"
+
+	"github.com/pkg/errors"
+)
+
+type BuildFunc func(context.Context, Client) (*Result, error)
+
+type Result struct {
+	mu       sync.Mutex
+	Ref      Reference
+	Refs     map[string]Reference
+	Metadata map[string][]byte
+}
+
+func NewResult() *Result {
+	return &Result{}
+}
+
+func (r *Result) AddMeta(k string, v []byte) {
+	r.mu.Lock()
+	if r.Metadata == nil {
+		r.Metadata = map[string][]byte{}
+	}
+	r.Metadata[k] = v
+	r.mu.Unlock()
+}
+
+func (r *Result) AddRef(k string, ref Reference) {
+	r.mu.Lock()
+	if r.Refs == nil {
+		r.Refs = map[string]Reference{}
+	}
+	r.Refs[k] = ref
+	r.mu.Unlock()
+}
+
+func (r *Result) SetRef(ref Reference) {
+	r.Ref = ref
+}
+
+func (r *Result) SingleRef() (Reference, error) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	if r.Refs != nil && r.Ref == nil {
+		return nil, errors.Errorf("invalid map result")
+	}
+
+	return r.Ref, nil
+}

vendor/github.com/moby/buildkit/session/filesync/diffcopy.go

@@ -12,13 +12,8 @@ import (
 	"google.golang.org/grpc"
 )
 
-func sendDiffCopy(stream grpc.Stream, dir string, includes, excludes, followPaths []string, progress progressCb, _map func(*fsutil.Stat) bool) error {
+func sendDiffCopy(stream grpc.Stream, fs fsutil.FS, progress progressCb) error {
-	return fsutil.Send(stream.Context(), stream, dir, &fsutil.WalkOpt{
+	return fsutil.Send(stream.Context(), stream, fs, progress)
-		ExcludePatterns: excludes,
-		IncludePatterns: includes,
-		FollowPaths:     followPaths,
-		Map:             _map,
-	}, progress)
 }
 
 func newStreamWriter(stream grpc.ClientStream) io.WriteCloser {

vendor/github.com/moby/buildkit/session/filesync/filesync.go

@@ -11,7 +11,9 @@ import (
 	"github.com/pkg/errors"
 	"github.com/tonistiigi/fsutil"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
 )
 
 const (
@@ -79,7 +81,7 @@ func (sp *fsSyncProvider) handle(method string, stream grpc.ServerStream) (retEr
 
 	dir, ok := sp.dirs[dirName]
 	if !ok {
-		return errors.Errorf("no access allowed to dir %q", dirName)
+		return status.Errorf(codes.NotFound, "no access allowed to dir %q", dirName)
 	}
 
 	excludes := opts[keyExcludePatterns]
@@ -101,7 +103,12 @@ func (sp *fsSyncProvider) handle(method string, stream grpc.ServerStream) (retEr
 		doneCh = sp.doneCh
 		sp.doneCh = nil
 	}
-	err := pr.sendFn(stream, dir.Dir, includes, excludes, followPaths, progress, dir.Map)
+	err := pr.sendFn(stream, fsutil.NewFS(dir.Dir, &fsutil.WalkOpt{
+		ExcludePatterns: excludes,
+		IncludePatterns: includes,
+		FollowPaths:     followPaths,
+		Map:             dir.Map,
+	}), progress)
 	if doneCh != nil {
 		if err != nil {
 			doneCh <- err
@@ -120,7 +127,7 @@ type progressCb func(int, bool)
 
 type protocol struct {
 	name   string
-	sendFn func(stream grpc.Stream, srcDir string, includes, excludes, followPaths []string, progress progressCb, _map func(*fsutil.Stat) bool) error
+	sendFn func(stream grpc.Stream, fs fsutil.FS, progress progressCb) error
 	recvFn func(stream grpc.Stream, destDir string, cu CacheUpdater, progress progressCb) error
 }
 
@@ -169,7 +176,7 @@ func FSSync(ctx context.Context, c session.Caller, opt FSSendRequestOpt) error {
 		}
 	}
 	if pr == nil {
-		return errors.New("no fssync handlers")
+		return errors.New("no local sources enabled")
 	}
 
 	opts := make(map[string][]string)
@@ -256,7 +263,7 @@ func (sp *fsSyncTarget) DiffCopy(stream FileSend_DiffCopyServer) error {
 	return writeTargetFile(stream, sp.outfile)
 }
 
-func CopyToCaller(ctx context.Context, srcPath string, c session.Caller, progress func(int, bool)) error {
+func CopyToCaller(ctx context.Context, fs fsutil.FS, c session.Caller, progress func(int, bool)) error {
 	method := session.MethodURL(_FileSend_serviceDesc.ServiceName, "diffcopy")
 	if !c.Supports(method) {
 		return errors.Errorf("method %s not supported by the client", method)
@@ -269,7 +276,7 @@ func CopyToCaller(ctx context.Context, srcPath string, c session.Caller, progres
 		return err
 	}
 
-	return sendDiffCopy(cc, srcPath, nil, nil, nil, progress, nil)
+	return sendDiffCopy(cc, fs, progress)
 }
 
 func CopyFileWriter(ctx context.Context, c session.Caller) (io.WriteCloser, error) {

vendor/github.com/moby/buildkit/session/secrets/generate.go

@@ -0,0 +1,3 @@
+package secrets
+
+//go:generate protoc --gogoslick_out=plugins=grpc:. secrets.proto

vendor/github.com/moby/buildkit/session/secrets/secrets.go

@@ -0,0 +1,30 @@
+package secrets
+
+import (
+	"context"
+
+	"github.com/moby/buildkit/session"
+	"github.com/pkg/errors"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+type SecretStore interface {
+	GetSecret(context.Context, string) ([]byte, error)
+}
+
+var ErrNotFound = errors.Errorf("not found")
+
+func GetSecret(ctx context.Context, c session.Caller, id string) ([]byte, error) {
+	client := NewSecretsClient(c.Conn())
+	resp, err := client.GetSecret(ctx, &GetSecretRequest{
+		ID: id,
+	})
+	if err != nil {
+		if st, ok := status.FromError(err); ok && (st.Code() == codes.Unimplemented || st.Code() == codes.NotFound) {
+			return nil, errors.Wrapf(ErrNotFound, "secret %s not found", id)
+		}
+		return nil, err
+	}
+	return resp.Data, nil
+}

vendor/github.com/moby/buildkit/session/secrets/secrets.pb.go

@@ -0,0 +1,813 @@
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: secrets.proto
+
+/*
+	Package secrets is a generated protocol buffer package.
+
+	It is generated from these files:
+		secrets.proto
+
+	It has these top-level messages:
+		GetSecretRequest
+		GetSecretResponse
+*/
+package secrets
+
+import proto "github.com/gogo/protobuf/proto"
+import fmt "fmt"
+import math "math"
+
+import bytes "bytes"
+
+import strings "strings"
+import reflect "reflect"
+import sortkeys "github.com/gogo/protobuf/sortkeys"
+
+import context "golang.org/x/net/context"
+import grpc "google.golang.org/grpc"
+
+import io "io"
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the proto package it is being compiled against.
+// A compilation error at this line likely means your copy of the
+// proto package needs to be updated.
+const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
+
+type GetSecretRequest struct {
+	ID          string            `protobuf:"bytes,1,opt,name=ID,proto3" json:"ID,omitempty"`
+	Annotations map[string]string `protobuf:"bytes,2,rep,name=annotations" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+}
+
+func (m *GetSecretRequest) Reset()                    { *m = GetSecretRequest{} }
+func (*GetSecretRequest) ProtoMessage()               {}
+func (*GetSecretRequest) Descriptor() ([]byte, []int) { return fileDescriptorSecrets, []int{0} }
+
+func (m *GetSecretRequest) GetID() string {
+	if m != nil {
+		return m.ID
+	}
+	return ""
+}
+
+func (m *GetSecretRequest) GetAnnotations() map[string]string {
+	if m != nil {
+		return m.Annotations
+	}
+	return nil
+}
+
+type GetSecretResponse struct {
+	Data []byte `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
+}
+
+func (m *GetSecretResponse) Reset()                    { *m = GetSecretResponse{} }
+func (*GetSecretResponse) ProtoMessage()               {}
+func (*GetSecretResponse) Descriptor() ([]byte, []int) { return fileDescriptorSecrets, []int{1} }
+
+func (m *GetSecretResponse) GetData() []byte {
+	if m != nil {
+		return m.Data
+	}
+	return nil
+}
+
+func init() {
+	proto.RegisterType((*GetSecretRequest)(nil), "moby.buildkit.secrets.v1.GetSecretRequest")
+	proto.RegisterType((*GetSecretResponse)(nil), "moby.buildkit.secrets.v1.GetSecretResponse")
+}
+func (this *GetSecretRequest) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*GetSecretRequest)
+	if !ok {
+		that2, ok := that.(GetSecretRequest)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if this.ID != that1.ID {
+		return false
+	}
+	if len(this.Annotations) != len(that1.Annotations) {
+		return false
+	}
+	for i := range this.Annotations {
+		if this.Annotations[i] != that1.Annotations[i] {
+			return false
+		}
+	}
+	return true
+}
+func (this *GetSecretResponse) Equal(that interface{}) bool {
+	if that == nil {
+		return this == nil
+	}
+
+	that1, ok := that.(*GetSecretResponse)
+	if !ok {
+		that2, ok := that.(GetSecretResponse)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		return this == nil
+	} else if this == nil {
+		return false
+	}
+	if !bytes.Equal(this.Data, that1.Data) {
+		return false
+	}
+	return true
+}
+func (this *GetSecretRequest) GoString() string {
+	if this == nil {
+		return "nil"
+	}
+	s := make([]string, 0, 6)
+	s = append(s, "&secrets.GetSecretRequest{")
+	s = append(s, "ID: "+fmt.Sprintf("%#v", this.ID)+",\n")
+	keysForAnnotations := make([]string, 0, len(this.Annotations))
+	for k, _ := range this.Annotations {
+		keysForAnnotations = append(keysForAnnotations, k)
+	}
+	sortkeys.Strings(keysForAnnotations)
+	mapStringForAnnotations := "map[string]string{"
+	for _, k := range keysForAnnotations {
+		mapStringForAnnotations += fmt.Sprintf("%#v: %#v,", k, this.Annotations[k])
+	}
+	mapStringForAnnotations += "}"
+	if this.Annotations != nil {
+		s = append(s, "Annotations: "+mapStringForAnnotations+",\n")
+	}
+	s = append(s, "}")
+	return strings.Join(s, "")
+}
+func (this *GetSecretResponse) GoString() string {
+	if this == nil {
+		return "nil"
+	}
+	s := make([]string, 0, 5)
+	s = append(s, "&secrets.GetSecretResponse{")
+	s = append(s, "Data: "+fmt.Sprintf("%#v", this.Data)+",\n")
+	s = append(s, "}")
+	return strings.Join(s, "")
+}
+func valueToGoStringSecrets(v interface{}, typ string) string {
+	rv := reflect.ValueOf(v)
+	if rv.IsNil() {
+		return "nil"
+	}
+	pv := reflect.Indirect(rv).Interface()
+	return fmt.Sprintf("func(v %v) *%v { return &v } ( %#v )", typ, typ, pv)
+}
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ context.Context
+var _ grpc.ClientConn
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+const _ = grpc.SupportPackageIsVersion4
+
+// Client API for Secrets service
+
+type SecretsClient interface {
+	GetSecret(ctx context.Context, in *GetSecretRequest, opts ...grpc.CallOption) (*GetSecretResponse, error)
+}
+
+type secretsClient struct {
+	cc *grpc.ClientConn
+}
+
+func NewSecretsClient(cc *grpc.ClientConn) SecretsClient {
+	return &secretsClient{cc}
+}
+
+func (c *secretsClient) GetSecret(ctx context.Context, in *GetSecretRequest, opts ...grpc.CallOption) (*GetSecretResponse, error) {
+	out := new(GetSecretResponse)
+	err := grpc.Invoke(ctx, "/moby.buildkit.secrets.v1.Secrets/GetSecret", in, out, c.cc, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// Server API for Secrets service
+
+type SecretsServer interface {
+	GetSecret(context.Context, *GetSecretRequest) (*GetSecretResponse, error)
+}
+
+func RegisterSecretsServer(s *grpc.Server, srv SecretsServer) {
+	s.RegisterService(&_Secrets_serviceDesc, srv)
+}
+
+func _Secrets_GetSecret_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetSecretRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SecretsServer).GetSecret(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/moby.buildkit.secrets.v1.Secrets/GetSecret",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SecretsServer).GetSecret(ctx, req.(*GetSecretRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+var _Secrets_serviceDesc = grpc.ServiceDesc{
+	ServiceName: "moby.buildkit.secrets.v1.Secrets",
+	HandlerType: (*SecretsServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "GetSecret",
+			Handler:    _Secrets_GetSecret_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "secrets.proto",
+}
+
+func (m *GetSecretRequest) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GetSecretRequest) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if len(m.ID) > 0 {
+		dAtA[i] = 0xa
+		i++
+		i = encodeVarintSecrets(dAtA, i, uint64(len(m.ID)))
+		i += copy(dAtA[i:], m.ID)
+	}
+	if len(m.Annotations) > 0 {
+		for k, _ := range m.Annotations {
+			dAtA[i] = 0x12
+			i++
+			v := m.Annotations[k]
+			mapSize := 1 + len(k) + sovSecrets(uint64(len(k))) + 1 + len(v) + sovSecrets(uint64(len(v)))
+			i = encodeVarintSecrets(dAtA, i, uint64(mapSize))
+			dAtA[i] = 0xa
+			i++
+			i = encodeVarintSecrets(dAtA, i, uint64(len(k)))
+			i += copy(dAtA[i:], k)
+			dAtA[i] = 0x12
+			i++
+			i = encodeVarintSecrets(dAtA, i, uint64(len(v)))
+			i += copy(dAtA[i:], v)
+		}
+	}
+	return i, nil
+}
+
+func (m *GetSecretResponse) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GetSecretResponse) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if len(m.Data) > 0 {
+		dAtA[i] = 0xa
+		i++
+		i = encodeVarintSecrets(dAtA, i, uint64(len(m.Data)))
+		i += copy(dAtA[i:], m.Data)
+	}
+	return i, nil
+}
+
+func encodeVarintSecrets(dAtA []byte, offset int, v uint64) int {
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return offset + 1
+}
+func (m *GetSecretRequest) Size() (n int) {
+	var l int
+	_ = l
+	l = len(m.ID)
+	if l > 0 {
+		n += 1 + l + sovSecrets(uint64(l))
+	}
+	if len(m.Annotations) > 0 {
+		for k, v := range m.Annotations {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + sovSecrets(uint64(len(k))) + 1 + len(v) + sovSecrets(uint64(len(v)))
+			n += mapEntrySize + 1 + sovSecrets(uint64(mapEntrySize))
+		}
+	}
+	return n
+}
+
+func (m *GetSecretResponse) Size() (n int) {
+	var l int
+	_ = l
+	l = len(m.Data)
+	if l > 0 {
+		n += 1 + l + sovSecrets(uint64(l))
+	}
+	return n
+}
+
+func sovSecrets(x uint64) (n int) {
+	for {
+		n++
+		x >>= 7
+		if x == 0 {
+			break
+		}
+	}
+	return n
+}
+func sozSecrets(x uint64) (n int) {
+	return sovSecrets(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (this *GetSecretRequest) String() string {
+	if this == nil {
+		return "nil"
+	}
+	keysForAnnotations := make([]string, 0, len(this.Annotations))
+	for k, _ := range this.Annotations {
+		keysForAnnotations = append(keysForAnnotations, k)
+	}
+	sortkeys.Strings(keysForAnnotations)
+	mapStringForAnnotations := "map[string]string{"
+	for _, k := range keysForAnnotations {
+		mapStringForAnnotations += fmt.Sprintf("%v: %v,", k, this.Annotations[k])
+	}
+	mapStringForAnnotations += "}"
+	s := strings.Join([]string{`&GetSecretRequest{`,
+		`ID:` + fmt.Sprintf("%v", this.ID) + `,`,
+		`Annotations:` + mapStringForAnnotations + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *GetSecretResponse) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&GetSecretResponse{`,
+		`Data:` + fmt.Sprintf("%v", this.Data) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func valueToStringSecrets(v interface{}) string {
+	rv := reflect.ValueOf(v)
+	if rv.IsNil() {
+		return "nil"
+	}
+	pv := reflect.Indirect(rv).Interface()
+	return fmt.Sprintf("*%v", pv)
+}
+func (m *GetSecretRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowSecrets
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GetSecretRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GetSecretRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowSecrets
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthSecrets
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Annotations", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowSecrets
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthSecrets
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Annotations == nil {
+				m.Annotations = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowSecrets
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= (uint64(b) & 0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowSecrets
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= (uint64(b) & 0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthSecrets
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowSecrets
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= (uint64(b) & 0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return ErrInvalidLengthSecrets
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipSecrets(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if skippy < 0 {
+						return ErrInvalidLengthSecrets
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.Annotations[mapkey] = mapvalue
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipSecrets(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthSecrets
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GetSecretResponse) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowSecrets
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GetSecretResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GetSecretResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Data", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowSecrets
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return ErrInvalidLengthSecrets
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Data = append(m.Data[:0], dAtA[iNdEx:postIndex]...)
+			if m.Data == nil {
+				m.Data = []byte{}
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipSecrets(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthSecrets
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func skipSecrets(dAtA []byte) (n int, err error) {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowSecrets
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowSecrets
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if dAtA[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+			return iNdEx, nil
+		case 1:
+			iNdEx += 8
+			return iNdEx, nil
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowSecrets
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			iNdEx += length
+			if length < 0 {
+				return 0, ErrInvalidLengthSecrets
+			}
+			return iNdEx, nil
+		case 3:
+			for {
+				var innerWire uint64
+				var start int = iNdEx
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return 0, ErrIntOverflowSecrets
+					}
+					if iNdEx >= l {
+						return 0, io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					innerWire |= (uint64(b) & 0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				innerWireType := int(innerWire & 0x7)
+				if innerWireType == 4 {
+					break
+				}
+				next, err := skipSecrets(dAtA[start:])
+				if err != nil {
+					return 0, err
+				}
+				iNdEx = start + next
+			}
+			return iNdEx, nil
+		case 4:
+			return iNdEx, nil
+		case 5:
+			iNdEx += 4
+			return iNdEx, nil
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+	}
+	panic("unreachable")
+}
+
+var (
+	ErrInvalidLengthSecrets = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowSecrets   = fmt.Errorf("proto: integer overflow")
+)
+
+func init() { proto.RegisterFile("secrets.proto", fileDescriptorSecrets) }
+
+var fileDescriptorSecrets = []byte{
+	// 279 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0xe2, 0x2d, 0x4e, 0x4d, 0x2e,
+	0x4a, 0x2d, 0x29, 0xd6, 0x2b, 0x28, 0xca, 0x2f, 0xc9, 0x17, 0x92, 0xc8, 0xcd, 0x4f, 0xaa, 0xd4,
+	0x4b, 0x2a, 0xcd, 0xcc, 0x49, 0xc9, 0xce, 0x2c, 0xd1, 0x83, 0x49, 0x96, 0x19, 0x2a, 0x1d, 0x64,
+	0xe4, 0x12, 0x70, 0x4f, 0x2d, 0x09, 0x06, 0x8b, 0x04, 0xa5, 0x16, 0x96, 0xa6, 0x16, 0x97, 0x08,
+	0xf1, 0x71, 0x31, 0x79, 0xba, 0x48, 0x30, 0x2a, 0x30, 0x6a, 0x70, 0x06, 0x31, 0x79, 0xba, 0x08,
+	0xc5, 0x72, 0x71, 0x27, 0xe6, 0xe5, 0xe5, 0x97, 0x24, 0x96, 0x64, 0xe6, 0xe7, 0x15, 0x4b, 0x30,
+	0x29, 0x30, 0x6b, 0x70, 0x1b, 0x59, 0xeb, 0xe1, 0x32, 0x54, 0x0f, 0xdd, 0x40, 0x3d, 0x47, 0x84,
+	0x6e, 0xd7, 0xbc, 0x92, 0xa2, 0xca, 0x20, 0x64, 0xf3, 0xa4, 0xec, 0xb8, 0x04, 0xd0, 0x15, 0x08,
+	0x09, 0x70, 0x31, 0x67, 0xa7, 0x56, 0x42, 0xdd, 0x00, 0x62, 0x0a, 0x89, 0x70, 0xb1, 0x96, 0x25,
+	0xe6, 0x94, 0xa6, 0x4a, 0x30, 0x81, 0xc5, 0x20, 0x1c, 0x2b, 0x26, 0x0b, 0x46, 0x25, 0x75, 0x2e,
+	0x41, 0x24, 0x1b, 0x8b, 0x0b, 0xf2, 0xf3, 0x8a, 0x53, 0x85, 0x84, 0xb8, 0x58, 0x52, 0x12, 0x4b,
+	0x12, 0xc1, 0x26, 0xf0, 0x04, 0x81, 0xd9, 0x46, 0xf9, 0x5c, 0xec, 0x10, 0x55, 0xc5, 0x42, 0x29,
+	0x5c, 0x9c, 0x70, 0x3d, 0x42, 0x5a, 0xc4, 0x7b, 0x45, 0x4a, 0x9b, 0x28, 0xb5, 0x10, 0x47, 0x38,
+	0x99, 0x5e, 0x78, 0x28, 0xc7, 0x70, 0xe3, 0xa1, 0x1c, 0xc3, 0x87, 0x87, 0x72, 0x8c, 0x0d, 0x8f,
+	0xe4, 0x18, 0x57, 0x3c, 0x92, 0x63, 0x3c, 0xf1, 0x48, 0x8e, 0xf1, 0xc2, 0x23, 0x39, 0xc6, 0x07,
+	0x8f, 0xe4, 0x18, 0x5f, 0x3c, 0x92, 0x63, 0xf8, 0xf0, 0x48, 0x8e, 0x71, 0xc2, 0x63, 0x39, 0x86,
+	0x28, 0x76, 0xa8, 0x59, 0x49, 0x6c, 0xe0, 0x58, 0x33, 0x06, 0x04, 0x00, 0x00, 0xff, 0xff, 0x05,
+	0x4e, 0x56, 0xde, 0xc6, 0x01, 0x00, 0x00,
+}

vendor/github.com/moby/buildkit/session/secrets/secrets.proto

@@ -0,0 +1,19 @@
+syntax = "proto3";
+
+package moby.buildkit.secrets.v1;
+
+option go_package = "secrets";
+
+service Secrets{
+  rpc GetSecret(GetSecretRequest) returns (GetSecretResponse);
+}
+
+
+message GetSecretRequest {
+	string ID = 1;
+	map<string, string> annotations = 2;
+}
+
+message GetSecretResponse {
+	bytes data = 1;
+}

vendor/github.com/moby/buildkit/session/secrets/secretsprovider/file.go

@@ -0,0 +1,54 @@
+package secretsprovider
+
+import (
+	"context"
+	"io/ioutil"
+	"os"
+
+	"github.com/moby/buildkit/session/secrets"
+	"github.com/pkg/errors"
+)
+
+type FileSource struct {
+	ID       string
+	FilePath string
+}
+
+func NewFileStore(files []FileSource) (secrets.SecretStore, error) {
+	m := map[string]FileSource{}
+	for _, f := range files {
+		if f.ID == "" {
+			return nil, errors.Errorf("secret missing ID")
+		}
+		if f.FilePath == "" {
+			f.FilePath = f.ID
+		}
+		fi, err := os.Stat(f.FilePath)
+		if err != nil {
+			return nil, errors.Wrapf(err, "failed to stat %s", f.FilePath)
+		}
+		if fi.Size() > MaxSecretSize {
+			return nil, errors.Errorf("secret %s too big. max size 500KB", f.ID)
+		}
+		m[f.ID] = f
+	}
+	return &fileStore{
+		m: m,
+	}, nil
+}
+
+type fileStore struct {
+	m map[string]FileSource
+}
+
+func (fs *fileStore) GetSecret(ctx context.Context, id string) ([]byte, error) {
+	v, ok := fs.m[id]
+	if !ok {
+		return nil, errors.WithStack(secrets.ErrNotFound)
+	}
+	dt, err := ioutil.ReadFile(v.FilePath)
+	if err != nil {
+		return nil, err
+	}
+	return dt, nil
+}

vendor/github.com/moby/buildkit/session/secrets/secretsprovider/secretsprovider.go

@@ -0,0 +1,60 @@
+package secretsprovider
+
+import (
+	"context"
+
+	"github.com/moby/buildkit/session"
+	"github.com/moby/buildkit/session/secrets"
+	"github.com/pkg/errors"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// MaxSecretSize is the maximum byte length allowed for a secret
+const MaxSecretSize = 500 * 1024 // 500KB
+
+func NewSecretProvider(store secrets.SecretStore) session.Attachable {
+	return &secretProvider{
+		store: store,
+	}
+}
+
+type secretProvider struct {
+	store secrets.SecretStore
+}
+
+func (sp *secretProvider) Register(server *grpc.Server) {
+	secrets.RegisterSecretsServer(server, sp)
+}
+
+func (sp *secretProvider) GetSecret(ctx context.Context, req *secrets.GetSecretRequest) (*secrets.GetSecretResponse, error) {
+	dt, err := sp.store.GetSecret(ctx, req.ID)
+	if err != nil {
+		if errors.Cause(err) == secrets.ErrNotFound {
+			return nil, status.Errorf(codes.NotFound, err.Error())
+		}
+		return nil, err
+	}
+	if l := len(dt); l > MaxSecretSize {
+		return nil, errors.Errorf("invalid secret size %d", l)
+	}
+
+	return &secrets.GetSecretResponse{
+		Data: dt,
+	}, nil
+}
+
+func FromMap(m map[string][]byte) session.Attachable {
+	return NewSecretProvider(mapStore(m))
+}
+
+type mapStore map[string][]byte
+
+func (m mapStore) GetSecret(ctx context.Context, id string) ([]byte, error) {
+	v, ok := m[id]
+	if !ok {
+		return nil, errors.WithStack(secrets.ErrNotFound)
+	}
+	return v, nil
+}

vendor/github.com/moby/buildkit/solver/pb/attr.go

@@ -3,6 +3,7 @@ package pb
 const AttrKeepGitDir = "git.keepgitdir"
 const AttrFullRemoteURL = "git.fullurl"
 const AttrLocalSessionID = "local.session"
+const AttrLocalUniqueID = "local.unique"
 const AttrIncludePatterns = "local.includepattern"
 const AttrFollowPaths = "local.followpaths"
 const AttrExcludePatterns = "local.excludepatterns"
@@ -14,3 +15,9 @@ const AttrHTTPFilename = "http.filename"
 const AttrHTTPPerm = "http.perm"
 const AttrHTTPUID = "http.uid"
 const AttrHTTPGID = "http.gid"
+
+const AttrImageResolveMode = "image.resolvemode"
+const AttrImageResolveModeDefault = "default"
+const AttrImageResolveModeForcePull = "pull"
+const AttrImageResolveModePreferLocal = "local"
+const AttrImageRecordType = "image.recordtype"

vendor/github.com/moby/buildkit/solver/pb/caps.go

@@ -0,0 +1,231 @@
+package pb
+
+import "github.com/moby/buildkit/util/apicaps"
+
+var Caps apicaps.CapList
+
+// Every backwards or forwards non-compatible change needs to add a new capability row.
+// By default new capabilities should be experimental. After merge a capability is
+// considered immutable. After a capability is marked stable it should not be disabled.
+
+const (
+	CapSourceImage                apicaps.CapID = "source.image"
+	CapSourceImageResolveMode     apicaps.CapID = "source.image.resolvemode"
+	CapSourceLocal                apicaps.CapID = "source.local"
+	CapSourceLocalUnique          apicaps.CapID = "source.local.unique"
+	CapSourceLocalSessionID       apicaps.CapID = "source.local.sessionid"
+	CapSourceLocalIncludePatterns apicaps.CapID = "source.local.includepatterns"
+	CapSourceLocalFollowPaths     apicaps.CapID = "source.local.followpaths"
+	CapSourceLocalExcludePatterns apicaps.CapID = "source.local.excludepatterns"
+	CapSourceLocalSharedKeyHint   apicaps.CapID = "source.local.sharedkeyhint"
+
+	CapSourceGit        apicaps.CapID = "source.git"
+	CapSourceGitKeepDir apicaps.CapID = "source.git.keepgitdir"
+	CapSourceGitFullURL apicaps.CapID = "source.git.fullurl"
+
+	CapSourceHTTP         apicaps.CapID = "source.http"
+	CapSourceHTTPChecksum apicaps.CapID = "source.http.checksum"
+	CapSourceHTTPPerm     apicaps.CapID = "source.http.perm"
+	CapSourceHTTPUIDGID   apicaps.CapID = "soruce.http.uidgid"
+
+	CapBuildOpLLBFileName apicaps.CapID = "source.buildop.llbfilename"
+
+	CapExecMetaBase          apicaps.CapID = "exec.meta.base"
+	CapExecMetaProxy         apicaps.CapID = "exec.meta.proxyenv"
+	CapExecMountBind         apicaps.CapID = "exec.mount.bind"
+	CapExecMountCache        apicaps.CapID = "exec.mount.cache"
+	CapExecMountCacheSharing apicaps.CapID = "exec.mount.cache.sharing"
+	CapExecMountSelector     apicaps.CapID = "exec.mount.selector"
+	CapExecMountTmpfs        apicaps.CapID = "exec.mount.tmpfs"
+	CapMountSecret           apicaps.CapID = "exec.mount.secret"
+
+	CapConstraints apicaps.CapID = "constraints"
+	CapPlatform    apicaps.CapID = "platform"
+
+	CapMetaIgnoreCache apicaps.CapID = "meta.ignorecache"
+	CapMetaDescription apicaps.CapID = "meta.description"
+	CapMetaExportCache apicaps.CapID = "meta.exportcache"
+)
+
+func init() {
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapSourceImage,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapSourceImageResolveMode,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapSourceLocal,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapSourceLocalUnique,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapSourceLocalSessionID,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapSourceLocalIncludePatterns,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapSourceLocalFollowPaths,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapSourceLocalExcludePatterns,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapSourceLocalSharedKeyHint,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+	Caps.Init(apicaps.Cap{
+		ID:      CapSourceGit,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapSourceGitKeepDir,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapSourceGitFullURL,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapSourceHTTP,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapSourceHTTPChecksum,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapSourceHTTPPerm,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapSourceHTTPUIDGID,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapBuildOpLLBFileName,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapExecMetaBase,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapExecMetaProxy,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapExecMountBind,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapExecMountCache,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapExecMountCacheSharing,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapExecMountSelector,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapExecMountTmpfs,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapMountSecret,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapConstraints,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapPlatform,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapMetaIgnoreCache,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapMetaDescription,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+	Caps.Init(apicaps.Cap{
+		ID:      CapMetaExportCache,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
+}

vendor/github.com/moby/buildkit/solver/pb/ops.proto

@@ -52,6 +52,7 @@ message Meta {
 	string cwd = 3;
 	string user = 4;
 	ProxyEnv proxy_env = 5;
+	repeated HostIP extraHosts = 6;
 }
 
 // Mount specifies how to mount an input Op as a filesystem.
@@ -63,6 +64,7 @@ message Mount {
 	bool readonly = 5;
 	MountType mountType = 6;
 	CacheOpt cacheOpt = 20;
+	SecretOpt secretOpt = 21;
 }
 
 // MountType defines a type of a mount from a supported set
@@ -92,6 +94,21 @@ enum CacheSharingOpt {
 	LOCKED = 2;
 }
 
+// SecretOpt defines options describing secret mounts
+message SecretOpt {
+	// ID of secret. Used for quering the value.
+	string ID = 1;
+	// UID of secret file
+	uint32 uid = 2;
+	// GID of secret file
+	uint32 gid = 3;
+	// Mode is the filesystem mode of secret file
+	uint32 mode = 4;
+	// Optional defines if secret value is required. Error is produced
+	// if value is not found and optional is false.
+	bool optional = 5;
+}
+
 // CopyOp copies files across Ops.
 message CopyOp {
 	repeated CopySource src = 1;
@@ -114,6 +131,7 @@ message SourceOp {
 }
 
 // BuildOp is used for nested build invocation.
+// BuildOp is experimental and can break without backwards compatibility
 message BuildOp {
 	int64 builder = 1 [(gogoproto.customtype) = "InputIndex", (gogoproto.nullable) = false];
 	map<string, BuildInput> inputs = 2;
@@ -136,6 +154,8 @@ message OpMetadata {
 	// index 3 reserved for WorkerConstraint in previous versions
 	// WorkerConstraint worker_constraint = 3;
 	ExportCache export_cache = 4;
+	
+	map<string, bool> caps = 5 [(gogoproto.castkey) = "github.com/moby/buildkit/util/apicaps.CapID", (gogoproto.nullable) = false];
 }
 
 message ExportCache {
@@ -162,3 +182,8 @@ message Definition {
 	// A key must be an LLB op digest string. Currently, empty string is not expected as a key, but it may change in the future.
 	map<string, OpMetadata> metadata = 2 [(gogoproto.castkey) = "github.com/opencontainers/go-digest.Digest", (gogoproto.nullable) = false];
 }
+
+message HostIP {
+	string Host = 1;
+	string IP = 2;
+}

vendor/github.com/moby/buildkit/solver/pb/platform.go

@@ -0,0 +1,41 @@
+package pb
+
+import (
+	specs "github.com/opencontainers/image-spec/specs-go/v1"
+)
+
+func (p *Platform) Spec() specs.Platform {
+	return specs.Platform{
+		OS:           p.OS,
+		Architecture: p.Architecture,
+		Variant:      p.Variant,
+		OSVersion:    p.OSVersion,
+		OSFeatures:   p.OSFeatures,
+	}
+}
+
+func PlatformFromSpec(p specs.Platform) Platform {
+	return Platform{
+		OS:           p.OS,
+		Architecture: p.Architecture,
+		Variant:      p.Variant,
+		OSVersion:    p.OSVersion,
+		OSFeatures:   p.OSFeatures,
+	}
+}
+
+func ToSpecPlatforms(p []Platform) []specs.Platform {
+	out := make([]specs.Platform, 0, len(p))
+	for _, pp := range p {
+		out = append(out, pp.Spec())
+	}
+	return out
+}
+
+func PlatformsFromSpec(p []specs.Platform) []Platform {
+	out := make([]Platform, 0, len(p))
+	for _, pp := range p {
+		out = append(out, PlatformFromSpec(pp))
+	}
+	return out
+}

vendor/github.com/moby/buildkit/util/apicaps/caps.go

@@ -0,0 +1,162 @@
+package apicaps
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	pb "github.com/moby/buildkit/util/apicaps/pb"
+	"github.com/pkg/errors"
+)
+
+type PBCap = pb.APICap
+
+// ExportedProduct is the name of the product using this package.
+// Users vendoring this library may override it to provide better versioning hints
+// for their users (or set it with a flag to buildkitd).
+var ExportedProduct string
+
+// CapStatus defines the stability properties of a capability
+type CapStatus int
+
+const (
+	// CapStatusStable refers to a capability that should never be changed in
+	// backwards incompatible manner unless there is a serious security issue.
+	CapStatusStable CapStatus = iota
+	// CapStatusExperimental refers to a capability that may be removed in the future.
+	// If incompatible changes are made the previous ID is disabled and new is added.
+	CapStatusExperimental
+	// CapStatusPrerelease is same as CapStatusExperimental that can be used for new
+	// features before they move to stable.
+	CapStatusPrerelease
+)
+
+// CapID is type for capability identifier
+type CapID string
+
+// Cap describes an API feature
+type Cap struct {
+	ID                  CapID
+	Name                string // readable name, may contain spaces but keep in one sentence
+	Status              CapStatus
+	Enabled             bool
+	Deprecated          bool
+	SupportedHint       map[string]string
+	DisabledReason      string
+	DisabledReasonMsg   string
+	DisabledAlternative string
+}
+
+// CapList is a collection of capability definitions
+type CapList struct {
+	m map[CapID]Cap
+}
+
+// Init initializes definition for a new capability.
+// Not safe to be called concurrently with other methods.
+func (l *CapList) Init(cc ...Cap) {
+	if l.m == nil {
+		l.m = make(map[CapID]Cap, len(cc))
+	}
+	for _, c := range cc {
+		l.m[c.ID] = c
+	}
+}
+
+// All reports the configuration of all known capabilities
+func (l *CapList) All() []pb.APICap {
+	out := make([]pb.APICap, 0, len(l.m))
+	for _, c := range l.m {
+		out = append(out, pb.APICap{
+			ID:                  string(c.ID),
+			Enabled:             c.Enabled,
+			Deprecated:          c.Deprecated,
+			DisabledReason:      c.DisabledReason,
+			DisabledReasonMsg:   c.DisabledReasonMsg,
+			DisabledAlternative: c.DisabledAlternative,
+		})
+	}
+	sort.Slice(out, func(i, j int) bool {
+		return out[i].ID < out[j].ID
+	})
+	return out
+}
+
+// CapSet returns a CapSet for an capability configuration
+func (l *CapList) CapSet(caps []pb.APICap) CapSet {
+	m := make(map[string]*pb.APICap, len(caps))
+	for _, c := range caps {
+		if c.ID != "" {
+			c := c // capture loop iterator
+			m[c.ID] = &c
+		}
+	}
+	return CapSet{
+		list: l,
+		set:  m,
+	}
+}
+
+// CapSet is a configuration for detecting supported capabilities
+type CapSet struct {
+	list *CapList
+	set  map[string]*pb.APICap
+}
+
+// Supports returns an error if capability is not supported
+func (s *CapSet) Supports(id CapID) error {
+	err := &CapError{ID: id}
+	c, ok := s.list.m[id]
+	if !ok {
+		return errors.WithStack(err)
+	}
+	err.Definition = &c
+	state, ok := s.set[string(id)]
+	if !ok {
+		return errors.WithStack(err)
+	}
+	err.State = state
+	if !state.Enabled {
+		return errors.WithStack(err)
+	}
+	return nil
+}
+
+// CapError is an error for unsupported capability
+type CapError struct {
+	ID         CapID
+	Definition *Cap
+	State      *pb.APICap
+}
+
+func (e CapError) Error() string {
+	if e.Definition == nil {
+		return fmt.Sprintf("unknown API capability %s", e.ID)
+	}
+	typ := ""
+	if e.Definition.Status == CapStatusExperimental {
+		typ = "experimental "
+	}
+	if e.Definition.Status == CapStatusPrerelease {
+		typ = "prerelease "
+	}
+	name := ""
+	if e.Definition.Name != "" {
+		name = "(" + e.Definition.Name + ")"
+	}
+	b := &strings.Builder{}
+	fmt.Fprintf(b, "requested %sfeature %s %s", typ, e.ID, name)
+	if e.State == nil {
+		fmt.Fprint(b, " is not supported by build server")
+		if hint, ok := e.Definition.SupportedHint[ExportedProduct]; ok {
+			fmt.Fprintf(b, " (added in %s)", hint)
+		}
+		fmt.Fprintf(b, ", please update %s", ExportedProduct)
+	} else {
+		fmt.Fprint(b, " has been disabled on the build server")
+		if e.State.DisabledReasonMsg != "" {
+			fmt.Fprintf(b, ": %s", e.State.DisabledReasonMsg)
+		}
+	}
+	return b.String()
+}

vendor/github.com/moby/buildkit/util/apicaps/pb/caps.pb.go

@@ -0,0 +1,535 @@
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: caps.proto
+
+/*
+	Package moby_buildkit_v1_apicaps is a generated protocol buffer package.
+
+	It is generated from these files:
+		caps.proto
+
+	It has these top-level messages:
+		APICap
+*/
+package moby_buildkit_v1_apicaps
+
+import proto "github.com/gogo/protobuf/proto"
+import fmt "fmt"
+import math "math"
+import _ "github.com/gogo/protobuf/gogoproto"
+
+import io "io"
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the proto package it is being compiled against.
+// A compilation error at this line likely means your copy of the
+// proto package needs to be updated.
+const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
+
+// APICap defines a capability supported by the service
+type APICap struct {
+	ID                  string `protobuf:"bytes,1,opt,name=ID,proto3" json:"ID,omitempty"`
+	Enabled             bool   `protobuf:"varint,2,opt,name=Enabled,proto3" json:"Enabled,omitempty"`
+	Deprecated          bool   `protobuf:"varint,3,opt,name=Deprecated,proto3" json:"Deprecated,omitempty"`
+	DisabledReason      string `protobuf:"bytes,4,opt,name=DisabledReason,proto3" json:"DisabledReason,omitempty"`
+	DisabledReasonMsg   string `protobuf:"bytes,5,opt,name=DisabledReasonMsg,proto3" json:"DisabledReasonMsg,omitempty"`
+	DisabledAlternative string `protobuf:"bytes,6,opt,name=DisabledAlternative,proto3" json:"DisabledAlternative,omitempty"`
+}
+
+func (m *APICap) Reset()                    { *m = APICap{} }
+func (m *APICap) String() string            { return proto.CompactTextString(m) }
+func (*APICap) ProtoMessage()               {}
+func (*APICap) Descriptor() ([]byte, []int) { return fileDescriptorCaps, []int{0} }
+
+func (m *APICap) GetID() string {
+	if m != nil {
+		return m.ID
+	}
+	return ""
+}
+
+func (m *APICap) GetEnabled() bool {
+	if m != nil {
+		return m.Enabled
+	}
+	return false
+}
+
+func (m *APICap) GetDeprecated() bool {
+	if m != nil {
+		return m.Deprecated
+	}
+	return false
+}
+
+func (m *APICap) GetDisabledReason() string {
+	if m != nil {
+		return m.DisabledReason
+	}
+	return ""
+}
+
+func (m *APICap) GetDisabledReasonMsg() string {
+	if m != nil {
+		return m.DisabledReasonMsg
+	}
+	return ""
+}
+
+func (m *APICap) GetDisabledAlternative() string {
+	if m != nil {
+		return m.DisabledAlternative
+	}
+	return ""
+}
+
+func init() {
+	proto.RegisterType((*APICap)(nil), "moby.buildkit.v1.apicaps.APICap")
+}
+func (m *APICap) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *APICap) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if len(m.ID) > 0 {
+		dAtA[i] = 0xa
+		i++
+		i = encodeVarintCaps(dAtA, i, uint64(len(m.ID)))
+		i += copy(dAtA[i:], m.ID)
+	}
+	if m.Enabled {
+		dAtA[i] = 0x10
+		i++
+		if m.Enabled {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i++
+	}
+	if m.Deprecated {
+		dAtA[i] = 0x18
+		i++
+		if m.Deprecated {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i++
+	}
+	if len(m.DisabledReason) > 0 {
+		dAtA[i] = 0x22
+		i++
+		i = encodeVarintCaps(dAtA, i, uint64(len(m.DisabledReason)))
+		i += copy(dAtA[i:], m.DisabledReason)
+	}
+	if len(m.DisabledReasonMsg) > 0 {
+		dAtA[i] = 0x2a
+		i++
+		i = encodeVarintCaps(dAtA, i, uint64(len(m.DisabledReasonMsg)))
+		i += copy(dAtA[i:], m.DisabledReasonMsg)
+	}
+	if len(m.DisabledAlternative) > 0 {
+		dAtA[i] = 0x32
+		i++
+		i = encodeVarintCaps(dAtA, i, uint64(len(m.DisabledAlternative)))
+		i += copy(dAtA[i:], m.DisabledAlternative)
+	}
+	return i, nil
+}
+
+func encodeVarintCaps(dAtA []byte, offset int, v uint64) int {
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return offset + 1
+}
+func (m *APICap) Size() (n int) {
+	var l int
+	_ = l
+	l = len(m.ID)
+	if l > 0 {
+		n += 1 + l + sovCaps(uint64(l))
+	}
+	if m.Enabled {
+		n += 2
+	}
+	if m.Deprecated {
+		n += 2
+	}
+	l = len(m.DisabledReason)
+	if l > 0 {
+		n += 1 + l + sovCaps(uint64(l))
+	}
+	l = len(m.DisabledReasonMsg)
+	if l > 0 {
+		n += 1 + l + sovCaps(uint64(l))
+	}
+	l = len(m.DisabledAlternative)
+	if l > 0 {
+		n += 1 + l + sovCaps(uint64(l))
+	}
+	return n
+}
+
+func sovCaps(x uint64) (n int) {
+	for {
+		n++
+		x >>= 7
+		if x == 0 {
+			break
+		}
+	}
+	return n
+}
+func sozCaps(x uint64) (n int) {
+	return sovCaps(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (m *APICap) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowCaps
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: APICap: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: APICap: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowCaps
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthCaps
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Enabled", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowCaps
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Enabled = bool(v != 0)
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Deprecated", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowCaps
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Deprecated = bool(v != 0)
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DisabledReason", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowCaps
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthCaps
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DisabledReason = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DisabledReasonMsg", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowCaps
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthCaps
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DisabledReasonMsg = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DisabledAlternative", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowCaps
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthCaps
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DisabledAlternative = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipCaps(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthCaps
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func skipCaps(dAtA []byte) (n int, err error) {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowCaps
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowCaps
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if dAtA[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+			return iNdEx, nil
+		case 1:
+			iNdEx += 8
+			return iNdEx, nil
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowCaps
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			iNdEx += length
+			if length < 0 {
+				return 0, ErrInvalidLengthCaps
+			}
+			return iNdEx, nil
+		case 3:
+			for {
+				var innerWire uint64
+				var start int = iNdEx
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return 0, ErrIntOverflowCaps
+					}
+					if iNdEx >= l {
+						return 0, io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					innerWire |= (uint64(b) & 0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				innerWireType := int(innerWire & 0x7)
+				if innerWireType == 4 {
+					break
+				}
+				next, err := skipCaps(dAtA[start:])
+				if err != nil {
+					return 0, err
+				}
+				iNdEx = start + next
+			}
+			return iNdEx, nil
+		case 4:
+			return iNdEx, nil
+		case 5:
+			iNdEx += 4
+			return iNdEx, nil
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+	}
+	panic("unreachable")
+}
+
+var (
+	ErrInvalidLengthCaps = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowCaps   = fmt.Errorf("proto: integer overflow")
+)
+
+func init() { proto.RegisterFile("caps.proto", fileDescriptorCaps) }
+
+var fileDescriptorCaps = []byte{
+	// 236 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0xe2, 0x4a, 0x4e, 0x2c, 0x28,
+	0xd6, 0x2b, 0x28, 0xca, 0x2f, 0xc9, 0x17, 0x92, 0xc8, 0xcd, 0x4f, 0xaa, 0xd4, 0x4b, 0x2a, 0xcd,
+	0xcc, 0x49, 0xc9, 0xce, 0x2c, 0xd1, 0x2b, 0x33, 0xd4, 0x4b, 0x2c, 0xc8, 0x04, 0xc9, 0x4b, 0xe9,
+	0xa6, 0x67, 0x96, 0x64, 0x94, 0x26, 0xe9, 0x25, 0xe7, 0xe7, 0xea, 0xa7, 0xe7, 0xa7, 0xe7, 0xeb,
+	0x83, 0x35, 0x24, 0x95, 0xa6, 0x81, 0x79, 0x60, 0x0e, 0x98, 0x05, 0x31, 0x48, 0xe9, 0x16, 0x23,
+	0x17, 0x9b, 0x63, 0x80, 0xa7, 0x73, 0x62, 0x81, 0x10, 0x1f, 0x17, 0x93, 0xa7, 0x8b, 0x04, 0xa3,
+	0x02, 0xa3, 0x06, 0x67, 0x10, 0x93, 0xa7, 0x8b, 0x90, 0x04, 0x17, 0xbb, 0x6b, 0x5e, 0x62, 0x52,
+	0x4e, 0x6a, 0x8a, 0x04, 0x93, 0x02, 0xa3, 0x06, 0x47, 0x10, 0x8c, 0x2b, 0x24, 0xc7, 0xc5, 0xe5,
+	0x92, 0x5a, 0x50, 0x94, 0x9a, 0x9c, 0x58, 0x92, 0x9a, 0x22, 0xc1, 0x0c, 0x96, 0x44, 0x12, 0x11,
+	0x52, 0xe3, 0xe2, 0x73, 0xc9, 0x2c, 0x06, 0xab, 0x0d, 0x4a, 0x4d, 0x2c, 0xce, 0xcf, 0x93, 0x60,
+	0x01, 0x9b, 0x8a, 0x26, 0x2a, 0xa4, 0xc3, 0x25, 0x88, 0x2a, 0xe2, 0x5b, 0x9c, 0x2e, 0xc1, 0x0a,
+	0x56, 0x8a, 0x29, 0x21, 0x64, 0xc0, 0x25, 0x0c, 0x13, 0x74, 0xcc, 0x29, 0x49, 0x2d, 0xca, 0x4b,
+	0x2c, 0xc9, 0x2c, 0x4b, 0x95, 0x60, 0x03, 0xab, 0xc7, 0x26, 0xe5, 0xc4, 0x73, 0xe2, 0x91, 0x1c,
+	0xe3, 0x85, 0x47, 0x72, 0x8c, 0x0f, 0x1e, 0xc9, 0x31, 0x26, 0xb1, 0x81, 0x7d, 0x6c, 0x0c, 0x08,
+	0x00, 0x00, 0xff, 0xff, 0x02, 0x2d, 0x9e, 0x91, 0x48, 0x01, 0x00, 0x00,
+}

vendor/github.com/moby/buildkit/util/apicaps/pb/caps.proto

@@ -0,0 +1,19 @@
+syntax = "proto3";
+
+package moby.buildkit.v1.apicaps;
+
+import "github.com/gogo/protobuf/gogoproto/gogo.proto";
+
+option (gogoproto.sizer_all) = true;
+option (gogoproto.marshaler_all) = true;
+option (gogoproto.unmarshaler_all) = true;
+
+// APICap defines a capability supported by the service
+message APICap {
+	string ID = 1;
+	bool Enabled = 2;
+	bool Deprecated = 3; // Unused. May be used for warnings in the future
+	string DisabledReason = 4; // Reason key for detection code
+	string DisabledReasonMsg = 5; // Message to the user
+	string DisabledAlternative = 6; // Identifier that updated client could catch.
+}

vendor/github.com/moby/buildkit/util/apicaps/pb/generate.go

@@ -0,0 +1,3 @@
+package moby_buildkit_v1_apicaps
+
+//go:generate protoc -I=. -I=../../../vendor/ -I=../../../../../../ --gogo_out=plugins=grpc:. caps.proto

vendor/github.com/moby/buildkit/util/progress/progressui/display.go

@@ -16,13 +16,17 @@ import (
 	"golang.org/x/time/rate"
 )
 
-func DisplaySolveStatus(ctx context.Context, c console.Console, w io.Writer, ch chan *client.SolveStatus) error {
+func DisplaySolveStatus(ctx context.Context, phase string, c console.Console, w io.Writer, ch chan *client.SolveStatus) error {
 
 	modeConsole := c != nil
 
-	disp := &display{c: c}
+	disp := &display{c: c, phase: phase}
 	printer := &textMux{w: w}
 
+	if disp.phase == "" {
+		disp.phase = "Building"
+	}
+
 	t := newTrace(w)
 
 	var done bool
@@ -323,6 +327,7 @@ func addTime(tm *time.Time, d time.Duration) *time.Time {
 
 type display struct {
 	c         console.Console
+	phase     string
 	lineCount int
 	repeated  bool
 }
@@ -359,7 +364,7 @@ func (disp *display) print(d displayInfo, all bool) {
 	fmt.Fprint(disp.c, aec.Hide)
 	defer fmt.Fprint(disp.c, aec.Show)
 
-	out := fmt.Sprintf("[+] Building %.1fs (%d/%d) %s", time.Since(d.startTime).Seconds(), d.countCompleted, d.countTotal, statusStr)
+	out := fmt.Sprintf("[+] %s %.1fs (%d/%d) %s", disp.phase, time.Since(d.startTime).Seconds(), d.countCompleted, d.countTotal, statusStr)
 	out = align(out, "", width)
 	fmt.Fprintln(disp.c, out)
 	lineCount := 0

vendor/github.com/moby/buildkit/util/progress/progressui/printer.go

@@ -11,13 +11,25 @@ import (
 
 const antiFlicker = 5 * time.Second
 const maxDelay = 10 * time.Second
+const minTimeDelta = 5 * time.Second
+const minProgressDelta = 0.05 // %
+
+type lastStatus struct {
+	Current   int64
+	Timestamp time.Time
+}
 
 type textMux struct {
 	w       io.Writer
 	current digest.Digest
+	last    map[string]lastStatus
 }
 
 func (p *textMux) printVtx(t *trace, dgst digest.Digest) {
+	if p.last == nil {
+		p.last = make(map[string]lastStatus)
+	}
+
 	v, ok := t.byDigest[dgst]
 	if !ok {
 		return
@@ -47,6 +59,28 @@ func (p *textMux) printVtx(t *trace, dgst digest.Digest) {
 
 	for _, s := range v.statuses {
 		if _, ok := v.statusUpdates[s.ID]; ok {
+			doPrint := true
+
+			if last, ok := p.last[s.ID]; ok && s.Completed == nil {
+				var progressDelta float64
+				if s.Total > 0 {
+					progressDelta = float64(s.Current-last.Current) / float64(s.Total)
+				}
+				timeDelta := s.Timestamp.Sub(last.Timestamp)
+				if progressDelta < minProgressDelta && timeDelta < minTimeDelta {
+					doPrint = false
+				}
+			}
+
+			if !doPrint {
+				continue
+			}
+
+			p.last[s.ID] = lastStatus{
+				Timestamp: s.Timestamp,
+				Current:   s.Current,
+			}
+
 			var bytes string
 			if s.Total != 0 {
 				bytes = fmt.Sprintf(" %.2f / %.2f", units.Bytes(s.Current), units.Bytes(s.Total))

vendor/github.com/moby/buildkit/vendor.conf

@@ -4,10 +4,10 @@ github.com/pkg/errors v0.8.0
 github.com/stretchr/testify v1.1.4
 github.com/davecgh/go-spew v1.1.0
 github.com/pmezard/go-difflib v1.0.0
-golang.org/x/sys 314a259e304ff91bd6985da2a7149bbf91237993
+golang.org/x/sys 1b2967e3c290b7c545b3db0deeda16e9be4f98a2
 
-github.com/containerd/containerd 08f7ee9828af1783dc98cc5cc1739e915697c667
+github.com/containerd/containerd a88b6319614de846458750ff882723479ca7b1a1
-github.com/containerd/typeurl f6943554a7e7e88b3c14aad190bf05932da84788
+github.com/containerd/typeurl a93fcdb778cd272c6e9b3028b2f42d813e785d40
 golang.org/x/sync 450f422ab23cf9881c94e2db30cac0eb1b7cf80c
 github.com/sirupsen/logrus v1.0.0
 google.golang.org/grpc v1.12.0
@@ -23,7 +23,7 @@ github.com/Microsoft/go-winio v0.4.7
 github.com/containerd/fifo 3d5202aec260678c48179c56f40e6f38a095738c
 github.com/opencontainers/runtime-spec v1.0.1
 github.com/containerd/go-runc f271fa2021de855d4d918dbef83c5fe19db1bdd5
-github.com/containerd/console 9290d21dc56074581f619579c43d970b4514bc08
+github.com/containerd/console 5d1b48d6114b8c9666f0c8b916f871af97b0a761
 google.golang.org/genproto d80a6e20e776b0b17a324d0ba1ab50a39c8e8944
 golang.org/x/text 19e51611da83d6be54ddafce4a4af510cb3e9ea4
 github.com/docker/go-events 9461782956ad83b30282bf90e31fa6a70c255ba9
@@ -39,14 +39,14 @@ golang.org/x/time f51c12702a4d776e4c1fa9b0fabab841babae631
 github.com/docker/docker 71cd53e4a197b303c6ba086bd584ffd67a884281
 github.com/pkg/profile 5b67d428864e92711fcbd2f8629456121a56d91f
 
-github.com/tonistiigi/fsutil 8abad97ee3969cdf5e9c367f46adba2c212b3ddb
+github.com/tonistiigi/fsutil b19464cd1b6a00773b4f2eb7acf9c30426f9df42
 github.com/hashicorp/go-immutable-radix 826af9ccf0feeee615d546d69b11f8e98da8c8f1 git://github.com/tonistiigi/go-immutable-radix.git
 github.com/hashicorp/golang-lru a0d98a5f288019575c6d1f4bb1573fef2d1fcdc4
 github.com/mitchellh/hashstructure 2bca23e0e452137f789efbc8610126fd8b94f73b
 github.com/docker/go-connections 3ede32e2033de7505e6500d6c868c2b9ed9f169d
 github.com/docker/distribution 30578ca32960a4d368bf6db67b0a33c2a1f3dc6f
 
-github.com/tonistiigi/units 29de085e9400559bd68aea2e7bc21566e7b8281d
+github.com/tonistiigi/units 6950e57a87eaf136bbe44ef2ec8e75b9e3569de2
 github.com/docker/cli 99576756eb3303b7af8102c502f21a912e3c1af6 https://github.com/tonistiigi/docker-cli.git
 github.com/docker/docker-credential-helpers d68f9aeca33f5fd3f08eeae5e9d175edf4e731d1
 github.com/docker/libnetwork 822e5b59d346b7ad0735df2c8e445e9787320e67
@@ -60,8 +60,10 @@ github.com/uber/jaeger-lib c48167d9cae5887393dd5e61efd06a4a48b7fbb3
 github.com/codahale/hdrhistogram f8ad88b59a584afeee9d334eff879b104439117b
 
 github.com/opentracing-contrib/go-stdlib b1a47cfbdd7543e70e9ef3e73d0802ad306cc1cc
-github.com/opencontainers/selinux 74a747aeaf2d66097b6908f572794f49f07dda2c
 
 # used by dockerfile tests
 gotest.tools v2.1.0
 github.com/google/go-cmp v0.2.0
+
+# used by rootless spec conv test
+github.com/seccomp/libseccomp-golang 32f571b70023028bd57d9288c20efbcb237f3ce0

vendor/github.com/tonistiigi/fsutil/diff_containerd.go

@@ -174,7 +174,7 @@ func sameFile(f1, f2 *currentPath) (same bool, retErr error) {
 	if !ok {
 		return false, nil
 	}
-	ls2, ok := f1.f.Sys().(*Stat)
+	ls2, ok := f2.f.Sys().(*Stat)
 	if !ok {
 		return false, nil
 	}

vendor/github.com/tonistiigi/fsutil/diskwriter.go

@@ -175,6 +175,11 @@ func (dw *DiskWriter) HandleChange(kind ChangeKind, p string, fi os.FileInfo, er
 	}
 
 	if rename {
+		if oldFi.IsDir() != fi.IsDir() {
+			if err := os.RemoveAll(destPath); err != nil {
+				return errors.Wrapf(err, "failed to remove %s", destPath)
+			}
+		}
 		if err := os.Rename(newPath, destPath); err != nil {
 			return errors.Wrapf(err, "failed to rename %s to %s", newPath, destPath)
 		}

vendor/github.com/tonistiigi/fsutil/fs.go

@@ -0,0 +1,71 @@
+package fsutil
+
+import (
+	"context"
+	"io"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+
+	"github.com/pkg/errors"
+)
+
+type FS interface {
+	Walk(context.Context, filepath.WalkFunc) error
+	Open(string) (io.ReadCloser, error)
+}
+
+func NewFS(root string, opt *WalkOpt) FS {
+	return &fs{
+		root: root,
+		opt:  opt,
+	}
+}
+
+type fs struct {
+	root string
+	opt  *WalkOpt
+}
+
+func (fs *fs) Walk(ctx context.Context, fn filepath.WalkFunc) error {
+	return Walk(ctx, fs.root, fs.opt, fn)
+}
+
+func (fs *fs) Open(p string) (io.ReadCloser, error) {
+	return os.Open(filepath.Join(fs.root, p))
+}
+
+func SubDirFS(fs FS, stat Stat) FS {
+	return &subDirFS{fs: fs, stat: stat}
+}
+
+type subDirFS struct {
+	fs   FS
+	stat Stat
+}
+
+func (fs *subDirFS) Walk(ctx context.Context, fn filepath.WalkFunc) error {
+	main := &StatInfo{Stat: &fs.stat}
+	if !main.IsDir() {
+		return errors.Errorf("fs subdir not mode directory")
+	}
+	if main.Name() != fs.stat.Path {
+		return errors.Errorf("subdir path must be single file")
+	}
+	if err := fn(fs.stat.Path, main, nil); err != nil {
+		return err
+	}
+	return fs.fs.Walk(ctx, func(p string, fi os.FileInfo, err error) error {
+		stat, ok := fi.Sys().(*Stat)
+		if !ok {
+			return errors.Wrapf(err, "invalid fileinfo without stat info: %s", p)
+		}
+		stat.Path = path.Join(fs.stat.Path, stat.Path)
+		return fn(filepath.Join(fs.stat.Path, p), &StatInfo{stat}, nil)
+	})
+}
+
+func (fs *subDirFS) Open(p string) (io.ReadCloser, error) {
+	return fs.fs.Open(strings.TrimPrefix(p, fs.stat.Path+"/"))
+}

vendor/github.com/tonistiigi/fsutil/send.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"io"
 	"os"
-	"path/filepath"
 	"sync"
 
 	"github.com/pkg/errors"
@@ -23,11 +22,10 @@ type Stream interface {
 	Context() context.Context
 }
 
-func Send(ctx context.Context, conn Stream, root string, opt *WalkOpt, progressCb func(int, bool)) error {
+func Send(ctx context.Context, conn Stream, fs FS, progressCb func(int, bool)) error {
 	s := &sender{
 		conn:         &syncStream{Stream: conn},
-		root:         root,
+		fs:           fs,
-		opt:          opt,
 		files:        make(map[uint32]string),
 		progressCb:   progressCb,
 		sendpipeline: make(chan *sendHandle, 128),
@@ -42,8 +40,7 @@ type sendHandle struct {
 
 type sender struct {
 	conn            Stream
-	opt             *WalkOpt
+	fs              FS
-	root            string
 	files           map[uint32]string
 	mu              sync.RWMutex
 	progressCb      func(int, bool)
@@ -130,7 +127,7 @@ func (s *sender) queue(id uint32) error {
 }
 
 func (s *sender) sendFile(h *sendHandle) error {
-	f, err := os.Open(filepath.Join(s.root, h.path))
+	f, err := s.fs.Open(h.path)
 	if err == nil {
 		defer f.Close()
 		buf := bufPool.Get().([]byte)
@@ -144,7 +141,7 @@ func (s *sender) sendFile(h *sendHandle) error {
 
 func (s *sender) walk(ctx context.Context) error {
 	var i uint32 = 0
-	err := Walk(ctx, s.root, s.opt, func(path string, fi os.FileInfo, err error) error {
+	err := s.fs.Walk(ctx, func(path string, fi os.FileInfo, err error) error {
 		if err != nil {
 			return err
 		}

vendor/github.com/tonistiigi/units/bytes.go

@@ -67,7 +67,7 @@ func (b Bytes) Format(f fmt.State, c rune) {
 	case 'f', 'g':
 		fv, unit, ok := b.floatValue(f.Flag('#'))
 		if !ok {
-			b.formatInt(f, 'd', true)
+			b.formatInt(&noPrecision{f}, 'd', true)
 			return
 		}
 		big.NewFloat(fv).Format(f, c)
@@ -115,3 +115,11 @@ func (b Bytes) floatValue(binary bool) (float64, string, bool) {
 		return float64(b) / math.Abs(float64(baseUnit)), units[binary][i], true
 	}
 }
+
+type noPrecision struct {
+	fmt.State
+}
+
+func (*noPrecision) Precision() (prec int, ok bool) {
+	return 0, false
+}