From abbf550b8fbd5952bef3175343e7783af772b85f Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Fri, 27 Jun 2025 09:34:13 +0200
Subject: [PATCH 01/11] tests: kubernetes worker

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
---
 .github/workflows/build.yml |   1 +
 Dockerfile                  |  32 +++++++++++
 go.mod                      |   2 +-
 tests/helpers/k3s.go        | 112 ++++++++++++++++++++++++++++++++++++
 tests/integration_test.go   |   1 +
 tests/workers/kubernetes.go | 100 ++++++++++++++++++++++++++++++++
 6 files changed, 247 insertions(+), 1 deletion(-)
 create mode 100644 tests/helpers/k3s.go
 create mode 100644 tests/workers/kubernetes.go

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a43d82344da7..1075fbaae858 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -60,6 +60,7 @@ jobs:
         worker:
           - docker-container
           - remote
+          - kubernetes
         pkg:
           - ./tests
         mode:
diff --git a/Dockerfile b/Dockerfile
index 0dfa1c908094..2aa8c88f402e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,6 +13,7 @@ ARG GOTESTSUM_VERSION=v1.12.0
 ARG REGISTRY_VERSION=3.0.0
 ARG BUILDKIT_VERSION=v0.23.2
 ARG UNDOCK_VERSION=0.9.0
+ARG K3S_VERSION=v1.32.2-k3s1
 
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
 FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS golatest
@@ -25,6 +26,7 @@ FROM dockereng/cli-bin:$DOCKER_VERSION_ALT_26 AS docker-cli-alt26
 FROM registry:$REGISTRY_VERSION AS registry
 FROM moby/buildkit:$BUILDKIT_VERSION AS buildkit
 FROM crazymax/undock:$UNDOCK_VERSION AS undock
+FROM rancher/k3s:${K3S_VERSION} AS k3s
 
 FROM golatest AS gobase
 COPY --from=xx / /
@@ -127,6 +129,17 @@ RUN apk add --no-cache \
       shadow-uidmap \
       xfsprogs \
       xz
+# k3s deps
+RUN apk add --no-cache \
+      busybox-binsh \
+      cni-plugins \
+      cni-plugin-flannel \
+      conntrack-tools \
+      coreutils \
+      dbus \
+      findutils \
+      ipset
+ENV PATH="/usr/libexec/cni:${PATH}"
 COPY --link --from=gotestsum /out /usr/bin/
 COPY --link --from=registry /bin/registry /usr/bin/
 COPY --link --from=docker-engine / /usr/bin/
@@ -135,11 +148,30 @@ COPY --link --from=docker-engine-alt27 / /opt/docker-alt-27/
 COPY --link --from=docker-engine-alt26 / /opt/docker-alt-26/
 COPY --link --from=docker-cli-alt27 / /opt/docker-alt-27/
 COPY --link --from=docker-cli-alt26 / /opt/docker-alt-26/
+COPY --link --from=k3s /bin/k3s /usr/bin/
+COPY --link --from=k3s /bin/kubectl /usr/bin/
 COPY --link --from=buildkit /usr/bin/buildkitd /usr/bin/
 COPY --link --from=buildkit /usr/bin/buildctl /usr/bin/
 COPY --link --from=undock /usr/local/bin/undock /usr/bin/
 COPY --link --from=binaries /buildx /usr/bin/
+COPY --chmod=755 <<-"EOF" /entrypoint.sh
+#!/bin/sh
+set -e
+# cgroup v2: enable nesting
+# https://github.com/moby/moby/blob/v25.0.0/hack/dind#L59-L69
+if [ -f /sys/fs/cgroup/cgroup.controllers ]; then
+  # move the processes from the root group to the /init group,
+  # otherwise writing subtree_control fails with EBUSY.
+  # An error during moving non-existent process (i.e., "cat") is ignored.
+  mkdir -p /sys/fs/cgroup/init
+  xargs -rn1 < /sys/fs/cgroup/cgroup.procs > /sys/fs/cgroup/init/cgroup.procs || :
+  # enable controllers
+  sed -e 's/ / +/g' -e 's/^/+/' < /sys/fs/cgroup/cgroup.controllers > /sys/fs/cgroup/cgroup.subtree_control
+fi
+exec "$@"
+EOF
 ENV TEST_DOCKER_EXTRA="docker@27.5=/opt/docker-alt-27,docker@26.1=/opt/docker-alt-26"
+ENTRYPOINT ["/entrypoint.sh"]
 
 FROM integration-test-base AS integration-test
 COPY . .
diff --git a/go.mod b/go.mod
index f8b8809082a7..30d47b41f903 100644
--- a/go.mod
+++ b/go.mod
@@ -6,6 +6,7 @@ require (
 	github.com/Masterminds/semver/v3 v3.2.1
 	github.com/Microsoft/go-winio v0.6.2
 	github.com/aws/aws-sdk-go-v2/config v1.27.27
+	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/compose-spec/compose-go/v2 v2.7.1
 	github.com/containerd/console v1.0.5
 	github.com/containerd/containerd/v2 v2.1.1
@@ -87,7 +88,6 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.4 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sts v1.30.3 // indirect
 	github.com/aws/smithy-go v1.20.3 // indirect
-	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/containerd/containerd/api v1.9.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/ttrpc v1.2.7 // indirect
diff --git a/tests/helpers/k3s.go b/tests/helpers/k3s.go
new file mode 100644
index 000000000000..50e418362487
--- /dev/null
+++ b/tests/helpers/k3s.go
@@ -0,0 +1,112 @@
+package helpers
+
+import (
+	"bytes"
+	"net"
+	"os"
+	"os/exec"
+	"strconv"
+	"time"
+
+	"github.com/cenkalti/backoff/v4"
+	"github.com/moby/buildkit/util/testutil/integration"
+	"github.com/pkg/errors"
+)
+
+const (
+	k3sBin     = "k3s"
+	kubeCtlBin = "kubectl"
+)
+
+func NewK3sServer(cfg *integration.BackendConfig) (kubeConfig string, cl func() error, err error) {
+	if _, err := exec.LookPath(k3sBin); err != nil {
+		return "", nil, errors.Wrapf(err, "failed to lookup %s binary", k3sBin)
+	}
+	if _, err := exec.LookPath(kubeCtlBin); err != nil {
+		return "", nil, errors.Wrapf(err, "failed to lookup %s binary", kubeCtlBin)
+	}
+
+	deferF := &integration.MultiCloser{}
+	cl = deferF.F()
+
+	defer func() {
+		if err != nil {
+			deferF.F()()
+			cl = nil
+		}
+	}()
+
+	cfgfile, err := os.CreateTemp("", "kubeconfig*.yml")
+	if err != nil {
+		return "", nil, err
+	}
+	kubeConfig = cfgfile.Name()
+	deferF.Append(func() error {
+		return os.Remove(cfgfile.Name())
+	})
+
+	k3sDataDir, err := os.MkdirTemp("", "kubedata")
+	if err != nil {
+		return "", nil, err
+	}
+	deferF.Append(func() error {
+		return os.RemoveAll(k3sDataDir)
+	})
+
+	l, err := net.Listen("tcp", "localhost:0")
+	if err != nil {
+		return "", nil, err
+	}
+	_ = l.Close()
+
+	lport := strconv.Itoa(l.Addr().(*net.TCPAddr).Port)
+	nodeName := "integrationk3s"
+
+	stop, err := integration.StartCmd(exec.Command(k3sBin, "server",
+		"--bind-address", "127.0.0.1",
+		"--https-listen-port", lport,
+		"--data-dir", k3sDataDir, // write to /tmp for overlayfs support
+		"--write-kubeconfig", cfgfile.Name(),
+		"--write-kubeconfig-mode", "666",
+		"--node-name", nodeName,
+	), cfg.Logs)
+	if err != nil {
+		return "", nil, err
+	}
+
+	if err = waitK3s(cfg, kubeConfig, nodeName); err != nil {
+		stop()
+		return "", nil, errors.Wrapf(err, "k3s did not start up: %s", integration.FormatLogs(cfg.Logs))
+	}
+
+	deferF.Append(stop)
+	return
+}
+
+func waitK3s(cfg *integration.BackendConfig, kubeConfig string, nodeName string) error {
+	logbuf := new(bytes.Buffer)
+	defer func() {
+		if logbuf.Len() > 0 {
+			cfg.Logs["waitK3s: "] = logbuf
+		}
+	}()
+
+	boff := backoff.NewExponentialBackOff()
+	boff.InitialInterval = 3 * time.Second
+	boff.MaxInterval = 5 * time.Second
+	boff.MaxElapsedTime = 2 * time.Minute
+
+	if err := backoff.Retry(func() error {
+		cmd := exec.Command(kubeCtlBin, "--kubeconfig", kubeConfig, "wait", "--for=condition=Ready", "node/"+nodeName)
+		out, err := cmd.CombinedOutput()
+		if err == nil && bytes.Contains(out, []byte("condition met")) {
+			return nil
+		}
+		return errors.Wrapf(err, "node is not ready: %s %s", cmd.String(), string(out))
+	}, boff); err != nil {
+		logbuf.WriteString(errors.Unwrap(err).Error())
+		return err
+	}
+
+	return nil
+}
diff --git a/tests/integration_test.go b/tests/integration_test.go
index 3884ca684430..7d02afef2f0f 100644
--- a/tests/integration_test.go
+++ b/tests/integration_test.go
@@ -16,6 +16,7 @@ func init() {
 		workers.InitDockerContainerWorker()
 	} else {
 		workers.InitRemoteWorker()
+		workers.InitKubernetesWorker()
 	}
 }
 
diff --git a/tests/workers/kubernetes.go b/tests/workers/kubernetes.go
new file mode 100644
index 000000000000..0e2b07a83862
--- /dev/null
+++ b/tests/workers/kubernetes.go
@@ -0,0 +1,100 @@
+package workers
+
+import (
+	"context"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"sync"
+
+	"github.com/docker/buildx/tests/helpers"
+	"github.com/moby/buildkit/identity"
+	"github.com/moby/buildkit/util/testutil/integration"
+	"github.com/pkg/errors"
+)
+
+func InitKubernetesWorker() {
+	integration.Register(&kubernetesWorker{
+		id: "kubernetes",
+	})
+}
+
+type kubernetesWorker struct {
+	id string
+
+	unsupported []string
+
+	k3sConfig string
+	k3sClose  func() error
+	k3sErr    error
+	k3sOnce   sync.Once
+}
+
+func (w *kubernetesWorker) Name() string {
+	return w.id
+}
+
+func (w *kubernetesWorker) Rootless() bool {
+	return false
+}
+
+func (w *kubernetesWorker) NetNSDetached() bool {
+	return false
+}
+
+func (w *kubernetesWorker) New(ctx context.Context, cfg *integration.BackendConfig) (integration.Backend, func() error, error) {
+	var err error
+
+	w.k3sOnce.Do(func() {
+		w.k3sConfig, w.k3sClose, w.k3sErr = helpers.NewK3sServer(cfg)
+	})
+	if w.k3sErr != nil {
+		return nil, w.k3sClose, w.k3sErr
+	}
+
+	cfgfile, err := integration.WriteConfig(cfg.DaemonConfig)
+	if err != nil {
+		return nil, nil, err
+	}
+	defer os.RemoveAll(filepath.Dir(cfgfile))
+
+	name := "integration-kubernetes-" + identity.NewID()
+	cmd := exec.Command("buildx", "create",
+		"--bootstrap",
+		"--name="+name,
+		"--config="+cfgfile,
+		"--driver=kubernetes",
+	)
+	cmd.Env = append(
+		os.Environ(),
+		"BUILDX_CONFIG=/tmp/buildx-"+name,
+		"KUBECONFIG="+w.k3sConfig,
+	)
+	if err := cmd.Run(); err != nil {
+		return nil, nil, errors.Wrapf(err, "failed to create buildx instance %s", name)
+	}
+
+	cl := func() error {
+		cmd := exec.Command("buildx", "rm", "-f", name)
+		return cmd.Run()
+	}
+
+	return &backend{
+		builder:             name,
+		unsupportedFeatures: w.unsupported,
+	}, cl, nil
+}
+
+func (w *kubernetesWorker) Close() error {
+	if c := w.k3sClose; c != nil {
+		return c()
+	}
+
+	// reset the worker to be ready to go again
+	w.k3sConfig = ""
+	w.k3sClose = nil
+	w.k3sErr = nil
+	w.k3sOnce = sync.Once{}
+
+	return nil
+}

From 5a881f78de6242d8addbf080a81cee313b7a5dc4 Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Fri, 27 Jun 2025 10:58:22 +0200
Subject: [PATCH 02/11] test

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
---
 tests/helpers/k3s.go | 25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)

diff --git a/tests/helpers/k3s.go b/tests/helpers/k3s.go
index 50e418362487..26e2e6b51aba 100644
--- a/tests/helpers/k3s.go
+++ b/tests/helpers/k3s.go
@@ -2,10 +2,13 @@ package helpers
 
 import (
 	"bytes"
+	"fmt"
 	"net"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"strconv"
+	"strings"
 	"time"
 
 	"github.com/cenkalti/backoff/v4"
@@ -76,7 +79,11 @@ func NewK3sServer(cfg *integration.BackendConfig) (kubeConfig string, cl func()
 
 	if err = waitK3s(cfg, kubeConfig, nodeName); err != nil {
 		stop()
-		return "", nil, errors.Wrapf(err, "k3s did not start up: %s", integration.FormatLogs(cfg.Logs))
+		containerdLogs, _ := os.ReadFile(filepath.Join(k3sDataDir, "agent", "containerd", "containerd.log"))
+		if len(containerdLogs) > 0 {
+			return "", nil, errors.Wrapf(err, "k3s did not start up: %s\ncontainerd.log: %s", formatLogs(cfg.Logs), containerdLogs)
+		}
+		return "", nil, errors.Wrapf(err, "k3s did not start up: %s", formatLogs(cfg.Logs))
 	}
 
 	deferF.Append(stop)
@@ -92,9 +99,9 @@ func waitK3s(cfg *integration.BackendConfig, kubeConfig string, nodeName string)
 	}()
 
 	boff := backoff.NewExponentialBackOff()
-	boff.InitialInterval = 3 * time.Second
-	boff.MaxInterval = 5 * time.Second
-	boff.MaxElapsedTime = 2 * time.Minute
+	boff.InitialInterval = 5 * time.Second
+	boff.MaxInterval = 10 * time.Second
+	boff.MaxElapsedTime = 3 * time.Minute
 
 	if err := backoff.Retry(func() error {
 		cmd := exec.Command(kubeCtlBin, "--kubeconfig", kubeConfig, "wait", "--for=condition=Ready", "node/"+nodeName)
@@ -110,3 +117,13 @@ func waitK3s(cfg *integration.BackendConfig, kubeConfig string, nodeName string)
 
 	return nil
 }
+
+func formatLogs(m map[string]*bytes.Buffer) string {
+	var ss []string
+	for k, b := range m {
+		if b != nil {
+			ss = append(ss, fmt.Sprintf("%q:%s", k, b.String()))
+		}
+	}
+	return strings.Join(ss, ",")
+}

From 6342da79b848a6b39aa5df076cc43f7a60c4ec8c Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Fri, 27 Jun 2025 11:20:33 +0200
Subject: [PATCH 03/11] test

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
---
 Dockerfile           | 2 +-
 tests/helpers/k3s.go | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 2aa8c88f402e..4260e462f11e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,7 +13,7 @@ ARG GOTESTSUM_VERSION=v1.12.0
 ARG REGISTRY_VERSION=3.0.0
 ARG BUILDKIT_VERSION=v0.23.2
 ARG UNDOCK_VERSION=0.9.0
-ARG K3S_VERSION=v1.32.2-k3s1
+ARG K3S_VERSION=v1.32.5-k3s1
 
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
 FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS golatest
diff --git a/tests/helpers/k3s.go b/tests/helpers/k3s.go
index 26e2e6b51aba..14e0da2b4922 100644
--- a/tests/helpers/k3s.go
+++ b/tests/helpers/k3s.go
@@ -81,7 +81,8 @@ func NewK3sServer(cfg *integration.BackendConfig) (kubeConfig string, cl func()
 		stop()
 		containerdLogs, _ := os.ReadFile(filepath.Join(k3sDataDir, "agent", "containerd", "containerd.log"))
 		if len(containerdLogs) > 0 {
-			return "", nil, errors.Wrapf(err, "k3s did not start up: %s\ncontainerd.log: %s", formatLogs(cfg.Logs), containerdLogs)
+			containerdConfig, _ := os.ReadFile(filepath.Join(k3sDataDir, "agent", "etc", "containerd", "config.toml"))
+			return "", nil, errors.Wrapf(err, "k3s did not start up: %s\ncontainerd.log: %s\ncontainerd.config.toml: %s", formatLogs(cfg.Logs), containerdLogs, containerdConfig)
 		}
 		return "", nil, errors.Wrapf(err, "k3s did not start up: %s", formatLogs(cfg.Logs))
 	}

From 439d8e2fe17df4fe3a55d346bfe41d77f267624c Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Fri, 27 Jun 2025 11:32:57 +0200
Subject: [PATCH 04/11] test

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 4260e462f11e..57fd7bb9b69e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,7 +13,7 @@ ARG GOTESTSUM_VERSION=v1.12.0
 ARG REGISTRY_VERSION=3.0.0
 ARG BUILDKIT_VERSION=v0.23.2
 ARG UNDOCK_VERSION=0.9.0
-ARG K3S_VERSION=v1.32.5-k3s1
+ARG K3S_VERSION=v1.33.1-k3s1
 
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
 FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS golatest

From 9f563dd59d06915e5009a8ca7788717afa7ff827 Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Fri, 27 Jun 2025 11:42:48 +0200
Subject: [PATCH 05/11] test

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 57fd7bb9b69e..3ea5bac166bd 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,7 +13,7 @@ ARG GOTESTSUM_VERSION=v1.12.0
 ARG REGISTRY_VERSION=3.0.0
 ARG BUILDKIT_VERSION=v0.23.2
 ARG UNDOCK_VERSION=0.9.0
-ARG K3S_VERSION=v1.33.1-k3s1
+ARG K3S_VERSION=v1.21.2-k3s1
 
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
 FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS golatest

From 679d9b36fb3269c3f3e5453aff95fa2ca93d35aa Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Fri, 27 Jun 2025 15:29:25 +0200
Subject: [PATCH 06/11] test

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1075fbaae858..3363176d5ab9 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -107,7 +107,7 @@ jobs:
           fi
           testFlags="--run=//worker=$(echo "${{ matrix.worker }}" | sed 's/\+/\\+/g')$"
           case "${{ matrix.worker }}" in
-            docker | docker+containerd | docker@* | docker+containerd@*)
+            docker | docker+containerd | docker@* | docker+containerd@* | kubernetes)
               echo "TESTFLAGS=${{ env.TESTFLAGS_DOCKER }} $testFlags" >> $GITHUB_ENV
               ;;
             *)

From 92c1fa3959f57054f4b07bbc248c42494892631d Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Fri, 27 Jun 2025 15:35:53 +0200
Subject: [PATCH 07/11] test

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 3ea5bac166bd..5ef7343013f6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,7 +13,7 @@ ARG GOTESTSUM_VERSION=v1.12.0
 ARG REGISTRY_VERSION=3.0.0
 ARG BUILDKIT_VERSION=v0.23.2
 ARG UNDOCK_VERSION=0.9.0
-ARG K3S_VERSION=v1.21.2-k3s1
+ARG K3S_VERSION=v1.32.1-k3s1
 
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
 FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS golatest

From 88af8bcb46b1958bd6560700c150c16e76b1df8c Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Sat, 28 Jun 2025 01:47:16 +0200
Subject: [PATCH 08/11] test

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
---
 go.mod                                        |  4 +-
 go.sum                                        |  8 ++--
 tests/helpers/k3s.go                          | 20 ++++++++-
 .../containerd/v2/core/content/helpers.go     |  2 +-
 .../v2/core/remotes/docker/errcode.go         | 22 ++++++++++
 .../v2/core/remotes/docker/fetcher.go         | 12 +++--
 .../v2/core/remotes/docker/pusher.go          | 15 +++----
 .../v2/core/remotes/docker/resolver.go        | 13 ++----
 .../v2/core/remotes/errors/errors.go          | 15 +++++--
 .../containerd/v2/version/version.go          |  2 +-
 .../github.com/moby/buildkit/client/solve.go  | 44 ++++++++++++-------
 .../buildkit/util/testutil/integration/run.go |  1 +
 .../util/testutil/integration/sandbox.go      |  3 +-
 vendor/modules.txt                            |  5 ++-
 14 files changed, 114 insertions(+), 52 deletions(-)

diff --git a/go.mod b/go.mod
index 30d47b41f903..08a5176caab7 100644
--- a/go.mod
+++ b/go.mod
@@ -9,7 +9,7 @@ require (
 	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/compose-spec/compose-go/v2 v2.7.1
 	github.com/containerd/console v1.0.5
-	github.com/containerd/containerd/v2 v2.1.1
+	github.com/containerd/containerd/v2 v2.1.3
 	github.com/containerd/continuity v0.4.5
 	github.com/containerd/errdefs v1.0.0
 	github.com/containerd/log v0.1.0
@@ -182,3 +182,5 @@ exclude (
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
 )
+
+replace github.com/moby/buildkit => github.com/crazy-max/buildkit v0.7.1-0.20250627234256-1efcf3bd4873 // testutil-expose-mirror
diff --git a/go.sum b/go.sum
index 8cf512e9f2d4..24592073e5e8 100644
--- a/go.sum
+++ b/go.sum
@@ -70,8 +70,8 @@ github.com/containerd/console v1.0.5 h1:R0ymNeydRqH2DmakFNdmjR2k0t7UPuiOV/N/27/q
 github.com/containerd/console v1.0.5/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
 github.com/containerd/containerd/api v1.9.0 h1:HZ/licowTRazus+wt9fM6r/9BQO7S0vD5lMcWspGIg0=
 github.com/containerd/containerd/api v1.9.0/go.mod h1:GhghKFmTR3hNtyznBoQ0EMWr9ju5AqHjcZPsSpTKutI=
-github.com/containerd/containerd/v2 v2.1.1 h1:znnkm7Ajz8lg8BcIPMhc/9yjBRN3B+OkNKqKisKfwwM=
-github.com/containerd/containerd/v2 v2.1.1/go.mod h1:zIfkQj4RIodclYQkX7GSSswSwgP8d/XxDOtOAoSDIGU=
+github.com/containerd/containerd/v2 v2.1.3 h1:eMD2SLcIQPdMlnlNF6fatlrlRLAeDaiGPGwmRKLZKNs=
+github.com/containerd/containerd/v2 v2.1.3/go.mod h1:8C5QV9djwsYDNhxfTCFjWtTBZrqjditQ4/ghHSYjnHM=
 github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4=
 github.com/containerd/continuity v0.4.5/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
@@ -97,6 +97,8 @@ github.com/containerd/typeurl/v2 v2.2.3 h1:yNA/94zxWdvYACdYO8zofhrTVuQY73fFU1y++
 github.com/containerd/typeurl/v2 v2.2.3/go.mod h1:95ljDnPfD3bAbDJRugOiShd/DlAAsxGtUBhJxIn7SCk=
 github.com/cpuguy83/go-md2man/v2 v2.0.6 h1:XJtiaUW6dEEqVuZiMTn1ldk455QWwEIsMIJlo5vtkx0=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/crazy-max/buildkit v0.7.1-0.20250627234256-1efcf3bd4873 h1:itiUBP/l3u2fyXa9+wgyipgOIdkYVWfoCvFQ2/p0urA=
+github.com/crazy-max/buildkit v0.7.1-0.20250627234256-1efcf3bd4873/go.mod h1:crDmHkHBiiinzUxrpifvvjhkaf+kqa17XqT/B/UgIak=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
 github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
@@ -254,8 +256,6 @@ github.com/mitchellh/go-wordwrap v0.0.0-20150314170334-ad45545899c7/go.mod h1:ZX
 github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4NcD46KavDd4=
 github.com/mitchellh/hashstructure/v2 v2.0.2/go.mod h1:MG3aRVU/N29oo/V/IhBX8GR/zz4kQkprJgF2EVszyDE=
 github.com/mitchellh/mapstructure v0.0.0-20150613213606-2caf8efc9366/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/moby/buildkit v0.23.0-rc1.0.20250618182037-9b91d20367db h1:ZzrDuG9G1A/RwJvuogNplxCEKsIUQh1CqEnqbOGFgKE=
-github.com/moby/buildkit v0.23.0-rc1.0.20250618182037-9b91d20367db/go.mod h1:v5jMDvQgUyidk3wu3NvVAAd5JJo83nfet9Gf/o0+EAQ=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/go-archive v0.1.0 h1:Kk/5rdW/g+H8NHdJW2gsXyZ7UnzvJNOy6VKJqueWdcQ=
diff --git a/tests/helpers/k3s.go b/tests/helpers/k3s.go
index 14e0da2b4922..11846e2bcd1c 100644
--- a/tests/helpers/k3s.go
+++ b/tests/helpers/k3s.go
@@ -65,6 +65,23 @@ func NewK3sServer(cfg *integration.BackendConfig) (kubeConfig string, cl func()
 	lport := strconv.Itoa(l.Addr().(*net.TCPAddr).Port)
 	nodeName := "integrationk3s"
 
+	k3sGlobalDir := "/etc/rancher/k3s"
+	if err := os.MkdirAll(k3sGlobalDir, 0755); err != nil {
+		return "", nil, err
+	}
+	if err := os.WriteFile(filepath.Join(k3sGlobalDir, "registries.yaml"), []byte(fmt.Sprintf(`
+mirrors:
+  "docker.io":
+    endpoint:
+      - "%s"
+
+configs:
+  "%s":
+    insecure_skip_verify: true
+`, cfg.Mirror, cfg.Mirror)), 0644); err != nil {
+		return "", nil, err
+	}
+
 	stop, err := integration.StartCmd(exec.Command(k3sBin, "server",
 		"--bind-address", "127.0.0.1",
 		"--https-listen-port", lport,
@@ -82,7 +99,8 @@ func NewK3sServer(cfg *integration.BackendConfig) (kubeConfig string, cl func()
 		containerdLogs, _ := os.ReadFile(filepath.Join(k3sDataDir, "agent", "containerd", "containerd.log"))
 		if len(containerdLogs) > 0 {
 			containerdConfig, _ := os.ReadFile(filepath.Join(k3sDataDir, "agent", "etc", "containerd", "config.toml"))
-			return "", nil, errors.Wrapf(err, "k3s did not start up: %s\ncontainerd.log: %s\ncontainerd.config.toml: %s", formatLogs(cfg.Logs), containerdLogs, containerdConfig)
+			registries, _ := os.ReadFile(filepath.Join(k3sGlobalDir, "registries.yaml"))
+			return "", nil, errors.Wrapf(err, "k3s did not start up: %s\ncontainerd.log: %s\ncontainerd.config.toml: %s\nregistries.yaml: %s", formatLogs(cfg.Logs), containerdLogs, containerdConfig, registries)
 		}
 		return "", nil, errors.Wrapf(err, "k3s did not start up: %s", formatLogs(cfg.Logs))
 	}
diff --git a/vendor/github.com/containerd/containerd/v2/core/content/helpers.go b/vendor/github.com/containerd/containerd/v2/core/content/helpers.go
index 74cb566b02b9..749e65311efe 100644
--- a/vendor/github.com/containerd/containerd/v2/core/content/helpers.go
+++ b/vendor/github.com/containerd/containerd/v2/core/content/helpers.go
@@ -200,7 +200,7 @@ func Copy(ctx context.Context, cw Writer, or io.Reader, size int64, expected dig
 		}
 		if size != 0 && copied < size-ws.Offset {
 			// Short writes would return its own error, this indicates a read failure
-			return fmt.Errorf("failed to read expected number of bytes: %w", io.ErrUnexpectedEOF)
+			return fmt.Errorf("short read: expected %d bytes but got %d: %w", size-ws.Offset, copied, io.ErrUnexpectedEOF)
 		}
 		if err := cw.Commit(ctx, size, expected, opts...); err != nil {
 			if errors.Is(err, ErrReset) {
diff --git a/vendor/github.com/containerd/containerd/v2/core/remotes/docker/errcode.go b/vendor/github.com/containerd/containerd/v2/core/remotes/docker/errcode.go
index 8c623bcbef72..b62256f82a82 100644
--- a/vendor/github.com/containerd/containerd/v2/core/remotes/docker/errcode.go
+++ b/vendor/github.com/containerd/containerd/v2/core/remotes/docker/errcode.go
@@ -18,8 +18,12 @@ package docker
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
+	"net/http"
 	"strings"
+
+	remoteerrors "github.com/containerd/containerd/v2/core/remotes/errors"
 )
 
 // ErrorCoder is the base interface for ErrorCode and Error allowing
@@ -281,3 +285,21 @@ func (errs *Errors) UnmarshalJSON(data []byte) error {
 	*errs = newErrs
 	return nil
 }
+
+func unexpectedResponseErr(resp *http.Response) (retErr error) {
+	retErr = remoteerrors.NewUnexpectedStatusErr(resp)
+
+	// Decode registry error if provided
+	if rerr := retErr.(remoteerrors.ErrUnexpectedStatus); len(rerr.Body) > 0 {
+		var registryErr Errors
+		if err := json.Unmarshal(rerr.Body, &registryErr); err == nil && registryErr.Len() > 0 {
+			// Join the unexpected error with the typed errors, when printed it will
+			// show the unexpected error message and the registry errors. The body
+			// is always excluded from the unexpected error message. This also allows
+			// clients to decode into either type.
+			retErr = errors.Join(rerr, registryErr)
+		}
+	}
+
+	return
+}
diff --git a/vendor/github.com/containerd/containerd/v2/core/remotes/docker/fetcher.go b/vendor/github.com/containerd/containerd/v2/core/remotes/docker/fetcher.go
index 9388d8479ea7..3e74df8cc117 100644
--- a/vendor/github.com/containerd/containerd/v2/core/remotes/docker/fetcher.go
+++ b/vendor/github.com/containerd/containerd/v2/core/remotes/docker/fetcher.go
@@ -442,7 +442,7 @@ func (r dockerFetcher) open(ctx context.Context, req *request, mediatype string,
 
 	chunkSize := int64(r.performances.ConcurrentLayerFetchBuffer)
 	parallelism := int64(r.performances.MaxConcurrentDownloads)
-	if chunkSize < minChunkSize {
+	if chunkSize < minChunkSize || req.body != nil {
 		parallelism = 1
 	}
 	log.G(ctx).WithField("initial_parallelism", r.performances.MaxConcurrentDownloads).
@@ -452,7 +452,9 @@ func (r dockerFetcher) open(ctx context.Context, req *request, mediatype string,
 		Debug("fetching layer")
 	req.setMediaType(mediatype)
 	req.header.Set("Accept-Encoding", "zstd;q=1.0, gzip;q=0.8, deflate;q=0.5")
-	req.setOffset(offset)
+	if parallelism > 1 || offset > 0 {
+		req.setOffset(offset)
+	}
 
 	if err := r.Acquire(ctx, 1); err != nil {
 		return nil, err
@@ -478,7 +480,11 @@ func (r dockerFetcher) open(ctx context.Context, req *request, mediatype string,
 	})
 
 	remaining, _ := strconv.ParseInt(resp.Header.Get("Content-Length"), 10, 0)
-	if parallelism > 1 && req.body == nil {
+	if remaining <= chunkSize {
+		parallelism = 1
+	}
+
+	if parallelism > 1 {
 		// If we have a content length, we can use multiple requests to fetch
 		// the content in parallel. This will make download of bigger bodies
 		// faster, at the cost of parallelism more requests and max
diff --git a/vendor/github.com/containerd/containerd/v2/core/remotes/docker/pusher.go b/vendor/github.com/containerd/containerd/v2/core/remotes/docker/pusher.go
index eac7b56c174e..956e83cbbaab 100644
--- a/vendor/github.com/containerd/containerd/v2/core/remotes/docker/pusher.go
+++ b/vendor/github.com/containerd/containerd/v2/core/remotes/docker/pusher.go
@@ -36,7 +36,6 @@ import (
 	"github.com/containerd/containerd/v2/core/content"
 	"github.com/containerd/containerd/v2/core/images"
 	"github.com/containerd/containerd/v2/core/remotes"
-	remoteserrors "github.com/containerd/containerd/v2/core/remotes/errors"
 )
 
 type dockerPusher struct {
@@ -149,8 +148,8 @@ func (p dockerPusher) push(ctx context.Context, desc ocispec.Descriptor, ref str
 				return nil, fmt.Errorf("content %v on remote: %w", desc.Digest, errdefs.ErrAlreadyExists)
 			}
 		} else if resp.StatusCode != http.StatusNotFound {
-			err := remoteserrors.NewUnexpectedStatusErr(resp)
-			log.G(ctx).WithField("resp", resp).WithField("body", string(err.(remoteserrors.ErrUnexpectedStatus).Body)).Debug("unexpected response")
+			err := unexpectedResponseErr(resp)
+			log.G(ctx).WithError(err).Debug("unexpected response")
 			resp.Body.Close()
 			return nil, err
 		}
@@ -224,8 +223,8 @@ func (p dockerPusher) push(ctx context.Context, desc ocispec.Descriptor, ref str
 			})
 			return nil, fmt.Errorf("content %v on remote: %w", desc.Digest, errdefs.ErrAlreadyExists)
 		default:
-			err := remoteserrors.NewUnexpectedStatusErr(resp)
-			log.G(ctx).WithField("resp", resp).WithField("body", string(err.(remoteserrors.ErrUnexpectedStatus).Body)).Debug("unexpected response")
+			err := unexpectedResponseErr(resp)
+			log.G(ctx).WithError(err).Debug("unexpected response")
 			return nil, err
 		}
 
@@ -299,8 +298,8 @@ func (p dockerPusher) push(ctx context.Context, desc ocispec.Descriptor, ref str
 		switch resp.StatusCode {
 		case http.StatusOK, http.StatusCreated, http.StatusNoContent:
 		default:
-			err := remoteserrors.NewUnexpectedStatusErr(resp)
-			log.G(ctx).WithField("resp", resp).WithField("body", string(err.(remoteserrors.ErrUnexpectedStatus).Body)).Debug("unexpected response")
+			err := unexpectedResponseErr(resp)
+			log.G(ctx).WithError(err).Debug("unexpected response")
 			pushw.setError(err)
 			return
 		}
@@ -513,7 +512,7 @@ func (pw *pushWriter) Commit(ctx context.Context, size int64, expected digest.Di
 	switch resp.StatusCode {
 	case http.StatusOK, http.StatusCreated, http.StatusNoContent, http.StatusAccepted:
 	default:
-		return remoteserrors.NewUnexpectedStatusErr(resp)
+		return unexpectedResponseErr(resp)
 	}
 
 	status, err := pw.tracker.GetStatus(pw.ref)
diff --git a/vendor/github.com/containerd/containerd/v2/core/remotes/docker/resolver.go b/vendor/github.com/containerd/containerd/v2/core/remotes/docker/resolver.go
index 386270ddb63a..1c0f7c48421d 100644
--- a/vendor/github.com/containerd/containerd/v2/core/remotes/docker/resolver.go
+++ b/vendor/github.com/containerd/containerd/v2/core/remotes/docker/resolver.go
@@ -19,7 +19,6 @@ package docker
 import (
 	"context"
 	"crypto/tls"
-	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
@@ -39,7 +38,6 @@ import (
 
 	"github.com/containerd/containerd/v2/core/images"
 	"github.com/containerd/containerd/v2/core/remotes"
-	remoteerrors "github.com/containerd/containerd/v2/core/remotes/errors"
 	"github.com/containerd/containerd/v2/core/transfer"
 	"github.com/containerd/containerd/v2/pkg/reference"
 	"github.com/containerd/containerd/v2/pkg/tracing"
@@ -332,13 +330,13 @@ func (r *dockerResolver) Resolve(ctx context.Context, ref string) (string, ocisp
 				}
 				if resp.StatusCode > 399 {
 					if firstErrPriority < 3 {
-						firstErr = remoteerrors.NewUnexpectedStatusErr(resp)
+						firstErr = unexpectedResponseErr(resp)
 						firstErrPriority = 3
 					}
 					log.G(ctx).Infof("%s after status: %s", nextHostOrFail(i), resp.Status)
 					continue // try another host
 				}
-				return "", ocispec.Descriptor{}, remoteerrors.NewUnexpectedStatusErr(resp)
+				return "", ocispec.Descriptor{}, unexpectedResponseErr(resp)
 			}
 			size := resp.ContentLength
 			contentType := getManifestMediaType(resp)
@@ -653,11 +651,8 @@ func withErrorCheck(r *request, resp *http.Response) error {
 		if resp.StatusCode == http.StatusNotFound {
 			return fmt.Errorf("content at %v not found: %w", r.String(), errdefs.ErrNotFound)
 		}
-		var registryErr Errors
-		if err := json.NewDecoder(resp.Body).Decode(&registryErr); err != nil || registryErr.Len() < 1 {
-			return fmt.Errorf("unexpected status code %v: %v", r.String(), resp.Status)
-		}
-		return fmt.Errorf("unexpected status code %v: %s - Server message: %s", r.String(), resp.Status, registryErr.Error())
+
+		return unexpectedResponseErr(resp)
 	}
 	return nil
 }
diff --git a/vendor/github.com/containerd/containerd/v2/core/remotes/errors/errors.go b/vendor/github.com/containerd/containerd/v2/core/remotes/errors/errors.go
index f60ff0fc286c..d07d17408066 100644
--- a/vendor/github.com/containerd/containerd/v2/core/remotes/errors/errors.go
+++ b/vendor/github.com/containerd/containerd/v2/core/remotes/errors/errors.go
@@ -20,16 +20,23 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+
+	"github.com/containerd/typeurl/v2"
 )
 
 var _ error = ErrUnexpectedStatus{}
 
+func init() {
+	typeurl.Register(&ErrUnexpectedStatus{}, "github.com/containerd/containerd/v2/core/remotes/errors", "ErrUnexpectedStatus")
+}
+
 // ErrUnexpectedStatus is returned if a registry API request returned with unexpected HTTP status
 type ErrUnexpectedStatus struct {
-	Status                    string
-	StatusCode                int
-	Body                      []byte
-	RequestURL, RequestMethod string
+	Status        string `json:"status"`
+	StatusCode    int    `json:"statusCode"`
+	Body          []byte `json:"body,omitempty"`
+	RequestURL    string `json:"requestURL,omitempty"`
+	RequestMethod string `json:"requestMethod,omitempty"`
 }
 
 func (e ErrUnexpectedStatus) Error() string {
diff --git a/vendor/github.com/containerd/containerd/v2/version/version.go b/vendor/github.com/containerd/containerd/v2/version/version.go
index a1f3ae4fb708..709cbe9477db 100644
--- a/vendor/github.com/containerd/containerd/v2/version/version.go
+++ b/vendor/github.com/containerd/containerd/v2/version/version.go
@@ -24,7 +24,7 @@ var (
 	Package = "github.com/containerd/containerd/v2"
 
 	// Version holds the complete version number. Filled in at linking time.
-	Version = "2.1.1+unknown"
+	Version = "2.1.3+unknown"
 
 	// Revision is filled with the VCS (e.g. git) revision being used to build
 	// the program at linking time.
diff --git a/vendor/github.com/moby/buildkit/client/solve.go b/vendor/github.com/moby/buildkit/client/solve.go
index 603211261685..991a37418d77 100644
--- a/vendor/github.com/moby/buildkit/client/solve.go
+++ b/vendor/github.com/moby/buildkit/client/solve.go
@@ -55,10 +55,11 @@ type SolveOpt struct {
 }
 
 type ExportEntry struct {
-	Type      string
-	Attrs     map[string]string
-	Output    filesync.FileOutputFunc // for ExporterOCI and ExporterDocker
-	OutputDir string                  // for ExporterLocal
+	Type        string
+	Attrs       map[string]string
+	Output      filesync.FileOutputFunc // for ExporterOCI and ExporterDocker
+	OutputDir   string                  // for ExporterLocal
+	OutputStore content.Store
 }
 
 type CacheOptionsEntry struct {
@@ -154,26 +155,28 @@ func (c *Client) solve(ctx context.Context, def *llb.Definition, runGateway runG
 
 		var syncTargets []filesync.FSSyncTarget
 		for exID, ex := range opt.Exports {
-			var supportFile bool
-			var supportDir bool
+			var supportFile, supportDir, supportStore bool
 			switch ex.Type {
 			case ExporterLocal:
 				supportDir = true
 			case ExporterTar:
 				supportFile = true
 			case ExporterOCI, ExporterDocker:
-				supportDir = ex.OutputDir != ""
 				supportFile = ex.Output != nil
-			}
-			if supportFile && supportDir {
-				return nil, errors.Errorf("both file and directory output is not supported by %s exporter", ex.Type)
+				supportStore = ex.OutputStore != nil || ex.OutputDir != ""
+				if supportFile && supportStore {
+					return nil, errors.Errorf("both file and store output is not supported by %s exporter", ex.Type)
+				}
 			}
 			if !supportFile && ex.Output != nil {
 				return nil, errors.Errorf("output file writer is not supported by %s exporter", ex.Type)
 			}
-			if !supportDir && ex.OutputDir != "" {
+			if !supportDir && !supportStore && ex.OutputDir != "" {
 				return nil, errors.Errorf("output directory is not supported by %s exporter", ex.Type)
 			}
+			if !supportStore && ex.OutputStore != nil {
+				return nil, errors.Errorf("output store is not supported by %s exporter", ex.Type)
+			}
 			if supportFile {
 				if ex.Output == nil {
 					return nil, errors.Errorf("output file writer is required for %s exporter", ex.Type)
@@ -184,20 +187,27 @@ func (c *Client) solve(ctx context.Context, def *llb.Definition, runGateway runG
 				if ex.OutputDir == "" {
 					return nil, errors.Errorf("output directory is required for %s exporter", ex.Type)
 				}
-				switch ex.Type {
-				case ExporterOCI, ExporterDocker:
+				syncTargets = append(syncTargets, filesync.WithFSSyncDir(exID, ex.OutputDir))
+			}
+			if supportStore {
+				store := ex.OutputStore
+				if store == nil {
 					if err := os.MkdirAll(ex.OutputDir, 0755); err != nil {
 						return nil, err
 					}
-					cs, err := contentlocal.NewStore(ex.OutputDir)
+					store, err = contentlocal.NewStore(ex.OutputDir)
 					if err != nil {
 						return nil, err
 					}
-					contentStores["export"] = cs
 					storesToUpdate = append(storesToUpdate, ex.OutputDir)
-				default:
-					syncTargets = append(syncTargets, filesync.WithFSSyncDir(exID, ex.OutputDir))
 				}
+
+				// TODO: this should be dependent on the exporter id (to allow multiple oci exporters)
+				storeName := "export"
+				if _, ok := contentStores[storeName]; ok {
+					return nil, errors.Errorf("oci store key %q already exists", storeName)
+				}
+				contentStores[storeName] = store
 			}
 		}
 
diff --git a/vendor/github.com/moby/buildkit/util/testutil/integration/run.go b/vendor/github.com/moby/buildkit/util/testutil/integration/run.go
index 0ae10cc9938b..af16d5bc5cd2 100644
--- a/vendor/github.com/moby/buildkit/util/testutil/integration/run.go
+++ b/vendor/github.com/moby/buildkit/util/testutil/integration/run.go
@@ -70,6 +70,7 @@ type BackendConfig struct {
 	Logs         map[string]*bytes.Buffer
 	DaemonConfig []ConfigUpdater
 	CDISpecDir   string
+	Mirror       string
 }
 
 type Worker interface {
diff --git a/vendor/github.com/moby/buildkit/util/testutil/integration/sandbox.go b/vendor/github.com/moby/buildkit/util/testutil/integration/sandbox.go
index 791d43ab2e0c..40b701a8ced8 100644
--- a/vendor/github.com/moby/buildkit/util/testutil/integration/sandbox.go
+++ b/vendor/github.com/moby/buildkit/util/testutil/integration/sandbox.go
@@ -92,7 +92,8 @@ func (sb *sandbox) Value(k string) any {
 
 func newSandbox(ctx context.Context, t *testing.T, w Worker, mirror string, mv matrixValue) (s Sandbox, cl func() error, err error) {
 	cfg := &BackendConfig{
-		Logs: make(map[string]*bytes.Buffer),
+		Logs:   make(map[string]*bytes.Buffer),
+		Mirror: mirror,
 	}
 
 	for _, v := range mv.values {
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 507c8be092b5..395304ec9fb1 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -144,7 +144,7 @@ github.com/containerd/console
 # github.com/containerd/containerd/api v1.9.0
 ## explicit; go 1.23.0
 github.com/containerd/containerd/api/services/content/v1
-# github.com/containerd/containerd/v2 v2.1.1
+# github.com/containerd/containerd/v2 v2.1.3
 ## explicit; go 1.23.0
 github.com/containerd/containerd/v2/core/content
 github.com/containerd/containerd/v2/core/content/proxy
@@ -451,7 +451,7 @@ github.com/mitchellh/go-wordwrap
 # github.com/mitchellh/hashstructure/v2 v2.0.2
 ## explicit; go 1.14
 github.com/mitchellh/hashstructure/v2
-# github.com/moby/buildkit v0.23.0-rc1.0.20250618182037-9b91d20367db
+# github.com/moby/buildkit v0.23.0-rc1.0.20250618182037-9b91d20367db => github.com/crazy-max/buildkit v0.7.1-0.20250627234256-1efcf3bd4873
 ## explicit; go 1.23.0
 github.com/moby/buildkit/api/services/control
 github.com/moby/buildkit/api/types
@@ -1339,3 +1339,4 @@ sigs.k8s.io/structured-merge-diff/v4/value
 ## explicit; go 1.12
 sigs.k8s.io/yaml
 sigs.k8s.io/yaml/goyaml.v2
+# github.com/moby/buildkit => github.com/crazy-max/buildkit v0.7.1-0.20250627234256-1efcf3bd4873

From a1da1b204872230bc1b368b384d7227644a886cd Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Sat, 28 Jun 2025 14:34:05 +0200
Subject: [PATCH 09/11] test

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
---
 go.mod                                                     | 2 +-
 go.sum                                                     | 4 ++--
 tests/helpers/k3s.go                                       | 7 ++++++-
 .../moby/buildkit/util/testutil/integration/registry.go    | 4 ++--
 vendor/modules.txt                                         | 4 ++--
 5 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/go.mod b/go.mod
index 08a5176caab7..884081f72d12 100644
--- a/go.mod
+++ b/go.mod
@@ -183,4 +183,4 @@ exclude (
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
 )
 
-replace github.com/moby/buildkit => github.com/crazy-max/buildkit v0.7.1-0.20250627234256-1efcf3bd4873 // testutil-expose-mirror
+replace github.com/moby/buildkit => github.com/crazy-max/buildkit v0.7.1-0.20250628122957-0cbe82310f5c // testutil-expose-mirror
diff --git a/go.sum b/go.sum
index 24592073e5e8..6ab50d4b8fca 100644
--- a/go.sum
+++ b/go.sum
@@ -97,8 +97,8 @@ github.com/containerd/typeurl/v2 v2.2.3 h1:yNA/94zxWdvYACdYO8zofhrTVuQY73fFU1y++
 github.com/containerd/typeurl/v2 v2.2.3/go.mod h1:95ljDnPfD3bAbDJRugOiShd/DlAAsxGtUBhJxIn7SCk=
 github.com/cpuguy83/go-md2man/v2 v2.0.6 h1:XJtiaUW6dEEqVuZiMTn1ldk455QWwEIsMIJlo5vtkx0=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/crazy-max/buildkit v0.7.1-0.20250627234256-1efcf3bd4873 h1:itiUBP/l3u2fyXa9+wgyipgOIdkYVWfoCvFQ2/p0urA=
-github.com/crazy-max/buildkit v0.7.1-0.20250627234256-1efcf3bd4873/go.mod h1:crDmHkHBiiinzUxrpifvvjhkaf+kqa17XqT/B/UgIak=
+github.com/crazy-max/buildkit v0.7.1-0.20250628122957-0cbe82310f5c h1:BTTtSoqI/XI6M+HE6H3N8T06j4vbDQmXBjsiDZT4f5A=
+github.com/crazy-max/buildkit v0.7.1-0.20250628122957-0cbe82310f5c/go.mod h1:crDmHkHBiiinzUxrpifvvjhkaf+kqa17XqT/B/UgIak=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
 github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
diff --git a/tests/helpers/k3s.go b/tests/helpers/k3s.go
index 11846e2bcd1c..1742c3ef640d 100644
--- a/tests/helpers/k3s.go
+++ b/tests/helpers/k3s.go
@@ -65,6 +65,11 @@ func NewK3sServer(cfg *integration.BackendConfig) (kubeConfig string, cl func()
 	lport := strconv.Itoa(l.Addr().(*net.TCPAddr).Port)
 	nodeName := "integrationk3s"
 
+	mirror := cfg.Mirror
+	if rport, ok := strings.CutPrefix(cfg.Mirror, "localhost:"); ok {
+		mirror = fmt.Sprintf("host.k3s.internal:%s", rport)
+	}
+
 	k3sGlobalDir := "/etc/rancher/k3s"
 	if err := os.MkdirAll(k3sGlobalDir, 0755); err != nil {
 		return "", nil, err
@@ -78,7 +83,7 @@ mirrors:
 configs:
   "%s":
     insecure_skip_verify: true
-`, cfg.Mirror, cfg.Mirror)), 0644); err != nil {
+`, mirror, mirror)), 0644); err != nil {
 		return "", nil, err
 	}
 
diff --git a/vendor/github.com/moby/buildkit/util/testutil/integration/registry.go b/vendor/github.com/moby/buildkit/util/testutil/integration/registry.go
index ccb9a1fd6821..55b55fa73e58 100644
--- a/vendor/github.com/moby/buildkit/util/testutil/integration/registry.go
+++ b/vendor/github.com/moby/buildkit/util/testutil/integration/registry.go
@@ -48,7 +48,7 @@ storage:
     filesystem:
         rootdirectory: %s
 http:
-    addr: 127.0.0.1:0
+    addr: 0.0.0.0:0
 `, filepath.Join(dir, "data"))
 
 		if err := os.WriteFile(filepath.Join(dir, "config.yaml"), []byte(template), 0600); err != nil {
@@ -79,7 +79,7 @@ http:
 }
 
 func detectPort(ctx context.Context, rc io.ReadCloser) (string, error) {
-	r := regexp.MustCompile(`listening on 127\.0\.0\.1:(\d+)`)
+	r := regexp.MustCompile(`listening on (?:\[::\]|0\.0\.0\.0):(\d+)`)
 	s := bufio.NewScanner(rc)
 	found := make(chan struct{})
 	defer func() {
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 395304ec9fb1..41b262b4a896 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -451,7 +451,7 @@ github.com/mitchellh/go-wordwrap
 # github.com/mitchellh/hashstructure/v2 v2.0.2
 ## explicit; go 1.14
 github.com/mitchellh/hashstructure/v2
-# github.com/moby/buildkit v0.23.0-rc1.0.20250618182037-9b91d20367db => github.com/crazy-max/buildkit v0.7.1-0.20250627234256-1efcf3bd4873
+# github.com/moby/buildkit v0.23.0-rc1.0.20250618182037-9b91d20367db => github.com/crazy-max/buildkit v0.7.1-0.20250628122957-0cbe82310f5c
 ## explicit; go 1.23.0
 github.com/moby/buildkit/api/services/control
 github.com/moby/buildkit/api/types
@@ -1339,4 +1339,4 @@ sigs.k8s.io/structured-merge-diff/v4/value
 ## explicit; go 1.12
 sigs.k8s.io/yaml
 sigs.k8s.io/yaml/goyaml.v2
-# github.com/moby/buildkit => github.com/crazy-max/buildkit v0.7.1-0.20250627234256-1efcf3bd4873
+# github.com/moby/buildkit => github.com/crazy-max/buildkit v0.7.1-0.20250628122957-0cbe82310f5c

From 0e7f38ce2bfcf3c337d7170035975e833b69fe18 Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Tue, 8 Jul 2025 11:53:48 +0200
Subject: [PATCH 10/11] test

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
---
 tests/helpers/k3s.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/helpers/k3s.go b/tests/helpers/k3s.go
index 1742c3ef640d..89ca6e839f04 100644
--- a/tests/helpers/k3s.go
+++ b/tests/helpers/k3s.go
@@ -88,7 +88,7 @@ configs:
 	}
 
 	stop, err := integration.StartCmd(exec.Command(k3sBin, "server",
-		"--bind-address", "127.0.0.1",
+		"--bind-address", "0.0.0.0",
 		"--https-listen-port", lport,
 		"--data-dir", k3sDataDir, // write to /tmp for overlayfs support
 		"--write-kubeconfig", cfgfile.Name(),

From eb0ffbbfc62bacbf56451f60c5bcb9570640d4d9 Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Tue, 8 Jul 2025 13:04:30 +0200
Subject: [PATCH 11/11] test

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3363176d5ab9..1075fbaae858 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -107,7 +107,7 @@ jobs:
           fi
           testFlags="--run=//worker=$(echo "${{ matrix.worker }}" | sed 's/\+/\\+/g')$"
           case "${{ matrix.worker }}" in
-            docker | docker+containerd | docker@* | docker+containerd@* | kubernetes)
+            docker | docker+containerd | docker@* | docker+containerd@*)
               echo "TESTFLAGS=${{ env.TESTFLAGS_DOCKER }} $testFlags" >> $GITHUB_ENV
               ;;
             *)