@@ -31,13 +31,11 @@ import (

 	"github.com/moby/buildkit/cache"

 	"github.com/moby/buildkit/client/llb"

 	"github.com/moby/buildkit/session"

-	"github.com/moby/buildkit/session/auth"

 	"github.com/moby/buildkit/source"

 	"github.com/moby/buildkit/util/flightcontrol"

 	"github.com/moby/buildkit/util/imageutil"

 	"github.com/moby/buildkit/util/progress"

 	"github.com/moby/buildkit/util/resolver"

-	"github.com/moby/buildkit/util/tracing"

 	digest "github.com/opencontainers/go-digest"

 	"github.com/opencontainers/image-spec/identity"

 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"

@@ -54,7 +52,7 @@ type SourceOpt struct {

 	DownloadManager distribution.RootFSDownloadManager

 	MetadataStore   metadata.V2MetadataService

 	ImageStore      image.Store

-	ResolverOpt     resolver.ResolveOptionsFunc

+	RegistryHosts   docker.RegistryHosts

 	LayerStore      layer.Store

 }

@@ -78,44 +76,15 @@ func (is *imageSource) ID() string {

 	return source.DockerImageScheme

 }

-func (is *imageSource) getResolver(ctx context.Context, rfn resolver.ResolveOptionsFunc, ref string, sm *session.Manager) remotes.Resolver {

+func (is *imageSource) getResolver(ctx context.Context, hosts docker.RegistryHosts, ref string, sm *session.Manager) remotes.Resolver {

 	if res := is.resolverCache.Get(ctx, ref); res != nil {

 		return res

 	}

-

-	opt := docker.ResolverOptions{

-		Client: tracing.DefaultClient,

-	}

-	if rfn != nil {

-		opt = rfn(ref)

-	}

-	opt.Credentials = is.getCredentialsFromSession(ctx, sm)

-	r := docker.NewResolver(opt)

+	r := resolver.New(ctx, hosts, sm)

 	r = is.resolverCache.Add(ctx, ref, r)

 	return r

 }

-func (is *imageSource) getCredentialsFromSession(ctx context.Context, sm *session.Manager) func(string) (string, string, error) {

-	id := session.FromContext(ctx)

-	if id == "" {

-		// can be removed after containerd/containerd#2812

-		return func(string) (string, string, error) {

-			return "", "", nil

-		}

-	}

-	return func(host string) (string, string, error) {

-		timeoutCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)

-		defer cancel()

-

-		caller, err := sm.Get(timeoutCtx, id)

-		if err != nil {

-			return "", "", err

-		}

-

-		return auth.CredentialsFunc(tracing.ContextWithSpanFromContext(context.TODO(), ctx), caller)(host)

-	}

-}

-

 func (is *imageSource) resolveLocal(refStr string) (*image.Image, error) {

 	ref, err := distreference.ParseNormalizedNamed(refStr)

 	if err != nil {

@@ -138,7 +107,7 @@ func (is *imageSource) resolveRemote(ctx context.Context, ref string, platform *

 		dt   []byte

 	}

 	res, err := is.g.Do(ctx, ref, func(ctx context.Context) (interface{}, error) {

-		dgst, dt, err := imageutil.Config(ctx, ref, is.getResolver(ctx, is.ResolverOpt, ref, sm), is.ContentStore, nil, platform)

+		dgst, dt, err := imageutil.Config(ctx, ref, is.getResolver(ctx, is.RegistryHosts, ref, sm), is.ContentStore, nil, platform)

 		if err != nil {

 			return nil, err

 		}

@@ -208,7 +177,7 @@ func (is *imageSource) Resolve(ctx context.Context, id source.Identifier, sm *se

 	p := &puller{

 		src:      imageIdentifier,

 		is:       is,

-		resolver: is.getResolver(ctx, is.ResolverOpt, imageIdentifier.Reference.String(), sm),

+		resolver: is.getResolver(ctx, is.RegistryHosts, imageIdentifier.Reference.String(), sm),

 		platform: platform,

 		sm:       sm,

 	}

@@ -7,6 +7,7 @@ import (

 	"github.com/containerd/containerd/content"

 	"github.com/containerd/containerd/images"

+	"github.com/containerd/containerd/remotes/docker"

 	distreference "github.com/docker/distribution/reference"

 	imagestore "github.com/docker/docker/image"

 	"github.com/docker/docker/reference"

@@ -15,7 +16,6 @@ import (

 	v1 "github.com/moby/buildkit/cache/remotecache/v1"

 	"github.com/moby/buildkit/session"

 	"github.com/moby/buildkit/solver"

-	"github.com/moby/buildkit/util/resolver"

 	"github.com/moby/buildkit/worker"

 	digest "github.com/opencontainers/go-digest"

 	specs "github.com/opencontainers/image-spec/specs-go/v1"

@@ -23,9 +23,9 @@ import (

 )

 // ResolveCacheImporterFunc returns a resolver function for local inline cache

-func ResolveCacheImporterFunc(sm *session.Manager, resolverOpt resolver.ResolveOptionsFunc, cs content.Store, rs reference.Store, is imagestore.Store) remotecache.ResolveCacheImporterFunc {

+func ResolveCacheImporterFunc(sm *session.Manager, resolverFunc docker.RegistryHosts, cs content.Store, rs reference.Store, is imagestore.Store) remotecache.ResolveCacheImporterFunc {

-	upstream := registryremotecache.ResolveCacheImporterFunc(sm, cs, resolverOpt)

+	upstream := registryremotecache.ResolveCacheImporterFunc(sm, cs, resolverFunc)

 	return func(ctx context.Context, attrs map[string]string) (remotecache.Importer, specs.Descriptor, error) {

 		if dt, err := tryImportLocal(rs, is, attrs["ref"]); err == nil {

@@ -11,6 +11,7 @@ import (

 	"time"

 	"github.com/containerd/containerd/platforms"

+	"github.com/containerd/containerd/remotes/docker"

 	"github.com/docker/docker/api/types"

 	"github.com/docker/docker/api/types/backend"

 	"github.com/docker/docker/builder"

@@ -26,7 +27,6 @@ import (

 	"github.com/moby/buildkit/identity"

 	"github.com/moby/buildkit/session"

 	"github.com/moby/buildkit/util/entitlements"

-	"github.com/moby/buildkit/util/resolver"

 	"github.com/moby/buildkit/util/tracing"

 	"github.com/pkg/errors"

 	"golang.org/x/sync/errgroup"

@@ -70,7 +70,7 @@ type Opt struct {

 	Dist                images.DistributionServices

 	NetworkController   libnetwork.NetworkController

 	DefaultCgroupParent string

-	ResolverOpt         resolver.ResolveOptionsFunc

+	RegistryHosts       docker.RegistryHosts

 	BuilderConfig       config.BuilderConfig

 	Rootless            bool

 	IdentityMapping     *idtools.IdentityMapping

@@ -119,7 +119,7 @@ func newController(rt http.RoundTripper, opt Opt) (*control.Controller, error) {

 		MetadataStore:   dist.V2MetadataService,

 		ImageStore:      dist.ImageStore,

 		ReferenceStore:  dist.ReferenceStore,

-		ResolverOpt:     opt.ResolverOpt,

+		RegistryHosts:   opt.RegistryHosts,

 		LayerStore:      dist.LayerStore,

 	})

 	if err != nil {

@@ -210,7 +210,7 @@ func newController(rt http.RoundTripper, opt Opt) (*control.Controller, error) {

 		Frontends:        frontends,

 		CacheKeyStorage:  cacheStorage,

 		ResolveCacheImporterFuncs: map[string]remotecache.ResolveCacheImporterFunc{

-			"registry": localinlinecache.ResolveCacheImporterFunc(opt.SessionManager, opt.ResolverOpt, store, dist.ReferenceStore, dist.ImageStore),

+			"registry": localinlinecache.ResolveCacheImporterFunc(opt.SessionManager, opt.RegistryHosts, store, dist.ReferenceStore, dist.ImageStore),

 			"local":    localremotecache.ResolveCacheImporterFunc(opt.SessionManager),

 		},

 		ResolveCacheExporterFuncs: map[string]remotecache.ResolveCacheExporterFunc{

@@ -292,7 +292,7 @@ func newRouterOptions(config *config.Config, d *daemon.Daemon) (routerOptions, e

 		Dist:                d.DistributionServices(),

 		NetworkController:   d.NetworkController(),

 		DefaultCgroupParent: cgroupParent,

-		ResolverOpt:         d.NewResolveOptionsFunc(),

+		RegistryHosts:       d.RegistryHosts(),

 		BuilderConfig:       config.Builder,

 		Rootless:            d.Rootless(),

 		IdentityMapping:     d.IdentityMapping(),

@@ -9,7 +9,6 @@ import (

 	"context"

 	"fmt"

 	"io/ioutil"

-	"math/rand"

 	"net"

 	"net/url"

 	"os"

@@ -28,7 +27,6 @@ import (

 	"github.com/containerd/containerd/defaults"

 	"github.com/containerd/containerd/pkg/dialer"

 	"github.com/containerd/containerd/remotes/docker"

-	"github.com/docker/distribution/reference"

 	"github.com/docker/docker/api/types"

 	containertypes "github.com/docker/docker/api/types/container"

 	"github.com/docker/docker/api/types/swarm"

@@ -42,8 +40,8 @@ import (

 	"github.com/docker/docker/daemon/logger"

 	"github.com/docker/docker/daemon/network"

 	"github.com/docker/docker/errdefs"

+	bkconfig "github.com/moby/buildkit/cmd/buildkitd/config"

 	"github.com/moby/buildkit/util/resolver"

-	"github.com/moby/buildkit/util/tracing"

 	"github.com/sirupsen/logrus"

 	// register graph drivers

@@ -153,63 +151,46 @@ func (daemon *Daemon) Features() *map[string]bool {

 	return &daemon.configStore.Features

 }

-// NewResolveOptionsFunc returns a call back function to resolve "registry-mirrors" and

-// "insecure-registries" for buildkit

-func (daemon *Daemon) NewResolveOptionsFunc() resolver.ResolveOptionsFunc {

-	return func(ref string) docker.ResolverOptions {

-		var (

-			registryKey = "docker.io"

-			mirrors     = make([]string, len(daemon.configStore.Mirrors))

-			m           = map[string]resolver.RegistryConf{}

-		)

-		// must trim "https://" or "http://" prefix

-		for i, v := range daemon.configStore.Mirrors {

-			if uri, err := url.Parse(v); err == nil {

-				v = uri.Host

-			}

-			mirrors[i] = v

-		}

-		// set "registry-mirrors"

-		m[registryKey] = resolver.RegistryConf{Mirrors: mirrors}

-		// set "insecure-registries"

-		for _, v := range daemon.configStore.InsecureRegistries {

-			if uri, err := url.Parse(v); err == nil {

-				v = uri.Host

-			}

-			plainHTTP := true

-			m[v] = resolver.RegistryConf{

-				PlainHTTP: &plainHTTP,

-			}

-		}

-		def := docker.ResolverOptions{

-			Client: tracing.DefaultClient,

-		}

-

-		parsed, err := reference.ParseNormalizedNamed(ref)

-		if err != nil {

-			return def

+// RegistryHosts returns registry configuration in containerd resolvers format

+func (daemon *Daemon) RegistryHosts() docker.RegistryHosts {

+	var (

+		registryKey = "docker.io"

+		mirrors     = make([]string, len(daemon.configStore.Mirrors))

+		m           = map[string]bkconfig.RegistryConfig{}

+	)

+	// must trim "https://" or "http://" prefix

+	for i, v := range daemon.configStore.Mirrors {

+		if uri, err := url.Parse(v); err == nil {

+			v = uri.Host

 		}

-		host := reference.Domain(parsed)

-

-		c, ok := m[host]

-		if !ok {

-			return def

-		}

-

-		if len(c.Mirrors) > 0 {

-			// TODO ResolverOptions.Host is deprecated; ResolverOptions.Hosts should be used

-			def.Host = func(string) (string, error) {

-				return c.Mirrors[rand.Intn(len(c.Mirrors))], nil

+		mirrors[i] = v

+	}

+	// set mirrors for default registry

+	m[registryKey] = bkconfig.RegistryConfig{Mirrors: mirrors}

+

+	for _, v := range daemon.configStore.InsecureRegistries {

+		u, err := url.Parse(v)

+		c := bkconfig.RegistryConfig{}

+		if err == nil {

+			v = u.Host

+			t := true

+			if u.Scheme == "http" {

+				c.PlainHTTP = &t

+			} else {

+				c.Insecure = &t

 			}

 		}

+		m[v] = c

+	}

-		// TODO ResolverOptions.PlainHTTP is deprecated; ResolverOptions.Hosts should be used

-		if c.PlainHTTP != nil {

-			def.PlainHTTP = *c.PlainHTTP

+	for k, v := range m {

+		if d, err := registry.HostCertsDir(k); err == nil {

+			v.TLSConfigDir = []string{d}

+			m[k] = v

 		}

-

-		return def

 	}

+

+	return resolver.NewRegistryConfig(m)

 }

 func (daemon *Daemon) restore() error {

@@ -26,6 +26,24 @@ var (

 	ErrAlreadyExists = errors.New("Image already exists")

 )

+// HostCertsDir returns the config directory for a specific host

+func HostCertsDir(hostname string) (string, error) {

+	certsDir := CertsDir

+

+	if rootless.RunningWithRootlessKit() {

+		configHome, err := homedir.GetConfigHome()

+		if err != nil {

+			return "", err

+		}

+

+		certsDir = filepath.Join(configHome, "docker/certs.d")

+	}

+

+	hostDir := filepath.Join(certsDir, cleanPath(hostname))

+

+	return hostDir, nil

+}

+

 func newTLSConfig(hostname string, isSecure bool) (*tls.Config, error) {

 	// PreferredServerCipherSuites should have no effect

 	tlsConfig := tlsconfig.ServerDefault()

@@ -33,19 +51,11 @@ func newTLSConfig(hostname string, isSecure bool) (*tls.Config, error) {

 	tlsConfig.InsecureSkipVerify = !isSecure

 	if isSecure && CertsDir != "" {

-		certsDir := CertsDir

-

-		if rootless.RunningWithRootlessKit() {

-			configHome, err := homedir.GetConfigHome()

-			if err != nil {

-				return nil, err

-			}

-

-			certsDir = filepath.Join(configHome, "docker/certs.d")

+		hostDir, err := HostCertsDir(hostname)

+		if err != nil {

+			return nil, err

 		}

-		hostDir := filepath.Join(certsDir, cleanPath(hostname))

-

 		logrus.Debugf("hostDir: %s", hostDir)

 		if err := ReadCertsDirectory(tlsConfig, hostDir); err != nil {

 			return nil, err

@@ -27,8 +27,8 @@ github.com/imdario/mergo                            1afb36080aec31e0d1528973ebe6

 golang.org/x/sync                                   cd5d95a43a6e21273425c7ae415d3df9ea832eeb

 # buildkit

-github.com/moby/buildkit                            4d8d91bf49c769b8458e9aa84746c842b4a0e39a

-github.com/tonistiigi/fsutil                        013a9fe6aee2d1658457075bf9e688bc8c0be2e0

+github.com/moby/buildkit                            ae7ff7174f73bcb4df89b97e1623b3fb0bfb0a0c

+github.com/tonistiigi/fsutil                        c2c7d7b0e1441705cd802e5699c0a10b1dfe39fd

 github.com/grpc-ecosystem/grpc-opentracing          8e809c8a86450a29b90dcc9efbf062d0fe6d9746

 github.com/opentracing/opentracing-go               1361b9cd60be79c4c3a7fa9841b3c132e40066a7

 github.com/google/shlex                             e7afc7fbc51079733e9468cdfd1efcd7d196cd1d

@@ -128,7 +128,7 @@ See [Expose BuildKit as a TCP service](#expose-buildkit-as-a-tcp-service).

 :information_source: Notice to Fedora 31 users:

-* As runc still does not work on cgroup v2 environment like Fedora 31, you need to substitute runc with crun. Run `rm -f $(which buildkit-runc) && ln -s $(which crun) /usr/local/bin/buildkit-runc` .

+* As runc still does not work on cgroup v2 environment like Fedora 31, you need to substitute runc with crun. Run `buildkitd` with `--oci-worker-binary=crun`.

 * If you want to use runc, you need to configure the system to use cgroup v1. Run `sudo grubby --update-kernel=ALL --args="systemd.unified_cgroup_hierarchy=0"` and reboot.

 ### Exploring LLB

@@ -205,8 +205,8 @@ By default, the build result and intermediate cache will only remain internally

 buildctl build ... --output type=image,name=docker.io/username/image,push=true

 ```

-To export and import the cache along with the image, you need to specify `--export-cache type=inline` and `--import-cache type=registry,ref=...`.

-See [Export cache](#export-cache).

+To export the cache embed with the image and pushing them to registry together, type `registry` is required to import the cache, you should specify `--export-cache type=inline` and `--import-cache type=registry,ref=...`. To export the cache to a local directy, you should specify `--export-cache type=local`.

+Details in [Export cache](#export-cache).

 ```bash

 buildctl build ...\

@@ -357,7 +357,8 @@ The directory layout conforms to OCI Image Spec v1.0.

 -   `ref=docker.io/user/image:tag`: reference for `registry` cache importer

 -   `src=path/to/input-dir`: directory for `local` cache importer

 -   `digest=sha256:deadbeef`: digest of the manifest list to import for `local` cache importer.

-    Defaults to the digest of "latest" tag in `index.json`

+-   `tag=customtag`: custom tag of image for `local` cache importer.

+    Defaults to the digest of "latest" tag in `index.json` is for digest, not for tag

 ### Consistent hashing

@@ -5,6 +5,7 @@ import (

 	"io"

 	"sort"

 	"strconv"

+	"strings"

 )

 // WriteV1TarsumHeaders writes a tar header to a writer in V1 tarsum format.

@@ -38,7 +39,9 @@ func v1TarHeaderSelect(h *tar.Header) (orderedHeaders [][2]string) {

 	// Get extended attributes.

 	xAttrKeys := make([]string, len(h.Xattrs))

 	for k := range h.Xattrs {

-		xAttrKeys = append(xAttrKeys, k)

+		if !strings.HasPrefix(k, "security.") && !strings.HasPrefix(k, "system.") {

+			xAttrKeys = append(xAttrKeys, k)

+		}

 	}

 	sort.Strings(xAttrKeys)

@@ -2,15 +2,12 @@ package registry

 import (

 	"context"

-	"time"

 	"github.com/containerd/containerd/content"

-	"github.com/containerd/containerd/remotes"

 	"github.com/containerd/containerd/remotes/docker"

 	"github.com/docker/distribution/reference"

 	"github.com/moby/buildkit/cache/remotecache"

 	"github.com/moby/buildkit/session"

-	"github.com/moby/buildkit/session/auth"

 	"github.com/moby/buildkit/util/contentutil"

 	"github.com/moby/buildkit/util/resolver"

 	"github.com/opencontainers/go-digest"

@@ -34,13 +31,13 @@ const (

 	attrRef = "ref"

 )

-func ResolveCacheExporterFunc(sm *session.Manager, resolverOpt resolver.ResolveOptionsFunc) remotecache.ResolveCacheExporterFunc {

+func ResolveCacheExporterFunc(sm *session.Manager, hosts docker.RegistryHosts) remotecache.ResolveCacheExporterFunc {

 	return func(ctx context.Context, attrs map[string]string) (remotecache.Exporter, error) {

 		ref, err := canonicalizeRef(attrs[attrRef])

 		if err != nil {

 			return nil, err

 		}

-		remote := newRemoteResolver(ctx, resolverOpt, sm, ref)

+		remote := resolver.New(ctx, hosts, sm)

 		pusher, err := remote.Pusher(ctx, ref)

 		if err != nil {

 			return nil, err

@@ -49,13 +46,13 @@ func ResolveCacheExporterFunc(sm *session.Manager, resolverOpt resolver.ResolveO

 	}

 }

-func ResolveCacheImporterFunc(sm *session.Manager, cs content.Store, resolverOpt resolver.ResolveOptionsFunc) remotecache.ResolveCacheImporterFunc {

+func ResolveCacheImporterFunc(sm *session.Manager, cs content.Store, hosts docker.RegistryHosts) remotecache.ResolveCacheImporterFunc {

 	return func(ctx context.Context, attrs map[string]string) (remotecache.Importer, specs.Descriptor, error) {

 		ref, err := canonicalizeRef(attrs[attrRef])

 		if err != nil {

 			return nil, specs.Descriptor{}, err

 		}

-		remote := newRemoteResolver(ctx, resolverOpt, sm, ref)

+		remote := resolver.New(ctx, hosts, sm)

 		xref, desc, err := remote.Resolve(ctx, ref)

 		if err != nil {

 			return nil, specs.Descriptor{}, err

@@ -97,27 +94,3 @@ func (dsl *withDistributionSourceLabel) SetDistributionSourceAnnotation(desc oci

 	desc.Annotations["containerd.io/distribution.source.ref"] = dsl.ref

 	return desc

 }

-

-func newRemoteResolver(ctx context.Context, resolverOpt resolver.ResolveOptionsFunc, sm *session.Manager, ref string) remotes.Resolver {

-	opt := resolverOpt(ref)

-	opt.Credentials = getCredentialsFunc(ctx, sm)

-	return docker.NewResolver(opt)

-}

-

-func getCredentialsFunc(ctx context.Context, sm *session.Manager) func(string) (string, string, error) {

-	id := session.FromContext(ctx)

-	if id == "" {

-		return nil

-	}

-	return func(host string) (string, string, error) {

-		timeoutCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)

-		defer cancel()

-

-		caller, err := sm.Get(timeoutCtx, id)

-		if err != nil {

-			return "", "", err

-		}

-

-		return auth.CredentialsFunc(context.TODO(), caller)(host)

-	}

-}

@@ -11,6 +11,8 @@ import (

 	"github.com/grpc-ecosystem/grpc-opentracing/go/otgrpc"

 	controlapi "github.com/moby/buildkit/api/services/control"

 	"github.com/moby/buildkit/client/connhelper"

+	"github.com/moby/buildkit/session"

+	"github.com/moby/buildkit/session/grpchijack"

 	"github.com/moby/buildkit/util/appdefaults"

 	opentracing "github.com/opentracing/opentracing-go"

 	"github.com/pkg/errors"

@@ -80,6 +82,10 @@ func (c *Client) controlClient() controlapi.ControlClient {

 	return controlapi.NewControlClient(c.conn)

 }

+func (c *Client) Dialer() session.Dialer {

+	return grpchijack.Dialer(c.controlClient())

+}

+

 func (c *Client) Close() error {

 	return c.conn.Close()

 }

new file mode 100644

@@ -0,0 +1,98 @@

+package llb

+

+import (

+	"context"

+

+	"github.com/moby/buildkit/solver/pb"

+	"github.com/moby/buildkit/util/flightcontrol"

+	digest "github.com/opencontainers/go-digest"

+	"github.com/pkg/errors"

+)

+

+type asyncState struct {

+	f      func(context.Context, State) (State, error)

+	prev   State

+	target State

+	set    bool

+	err    error

+	g      flightcontrol.Group

+}

+

+func (as *asyncState) Output() Output {

+	return as

+}

+

+func (as *asyncState) Vertex(ctx context.Context) Vertex {

+	err := as.Do(ctx)

+	if err != nil {

+		return &errVertex{err}

+	}

+	if as.set {

+		out := as.target.Output()

+		if out == nil {

+			return nil

+		}

+		return out.Vertex(ctx)

+	}

+	return nil

+}

+

+func (as *asyncState) ToInput(ctx context.Context, c *Constraints) (*pb.Input, error) {

+	err := as.Do(ctx)

+	if err != nil {

+		return nil, err

+	}

+	if as.set {

+		out := as.target.Output()

+		if out == nil {

+			return nil, nil

+		}

+		return out.ToInput(ctx, c)

+	}

+	return nil, nil

+}

+

+func (as *asyncState) Do(ctx context.Context) error {

+	_, err := as.g.Do(ctx, "", func(ctx context.Context) (interface{}, error) {

+		if as.set {

+			return as.target, as.err

+		}

+		res, err := as.f(ctx, as.prev)

+		if err != nil {

+			select {

+			case <-ctx.Done():

+				if errors.Cause(err) == ctx.Err() {

+					return res, err

+				}

+			default:

+			}

+		}

+		as.target = res

+		as.err = err

+		as.set = true

+		return res, err

+	})

+	if err != nil {

+		return err

+	}

+	return as.err

+}

+

+type errVertex struct {

+	err error

+}

+

+func (v *errVertex) Validate(context.Context) error {

+	return v.err

+}

+func (v *errVertex) Marshal(context.Context, *Constraints) (digest.Digest, []byte, *pb.OpMetadata, error) {

+	return "", nil, nil, v.err

+}

+func (v *errVertex) Output() Output {

+	return nil

+}

+func (v *errVertex) Inputs() []Output {

+	return nil

+}

+

+var _ Vertex = &errVertex{}

@@ -1,6 +1,9 @@

 package llb

 import (

+	"context"

+	"sync"

+

 	"github.com/moby/buildkit/solver/pb"

 	digest "github.com/opencontainers/go-digest"

 	specs "github.com/opencontainers/image-spec/specs-go/v1"

@@ -13,6 +16,7 @@ import (

 // LLB state can be reconstructed from the definition.

 type DefinitionOp struct {

 	MarshalCache

+	mu        sync.Mutex

 	ops       map[digest.Digest]*pb.Op

 	defs      map[digest.Digest][]byte

 	metas     map[digest.Digest]pb.OpMetadata

@@ -25,6 +29,7 @@ type DefinitionOp struct {

 func NewDefinitionOp(def *pb.Definition) (*DefinitionOp, error) {

 	ops := make(map[digest.Digest]*pb.Op)

 	defs := make(map[digest.Digest][]byte)

+	platforms := make(map[digest.Digest]*specs.Platform)

 	var dgst digest.Digest

 	for _, dt := range def.Def {

@@ -35,6 +40,13 @@ func NewDefinitionOp(def *pb.Definition) (*DefinitionOp, error) {

 		dgst = digest.FromBytes(dt)

 		ops[dgst] = &op

 		defs[dgst] = dt

+

+		var platform *specs.Platform

+		if op.Platform != nil {

+			spec := op.Platform.Spec()

+			platform = &spec

+		}

+		platforms[dgst] = platform

 	}

 	var index pb.OutputIndex

@@ -47,26 +59,29 @@ func NewDefinitionOp(def *pb.Definition) (*DefinitionOp, error) {

 		ops:       ops,

 		defs:      defs,

 		metas:     def.Metadata,

-		platforms: make(map[digest.Digest]*specs.Platform),

+		platforms: platforms,

 		dgst:      dgst,

 		index:     index,

 	}, nil

 }

-func (d *DefinitionOp) ToInput(c *Constraints) (*pb.Input, error) {

-	return d.Output().ToInput(c)

+func (d *DefinitionOp) ToInput(ctx context.Context, c *Constraints) (*pb.Input, error) {

+	return d.Output().ToInput(ctx, c)

 }

-func (d *DefinitionOp) Vertex() Vertex {

+func (d *DefinitionOp) Vertex(context.Context) Vertex {

 	return d

 }

-func (d *DefinitionOp) Validate() error {

+func (d *DefinitionOp) Validate(context.Context) error {

 	// Scratch state has no digest, ops or metas.

 	if d.dgst == "" {

 		return nil

 	}

+	d.mu.Lock()

+	defer d.mu.Unlock()

+

 	if len(d.ops) == 0 || len(d.defs) == 0 || len(d.metas) == 0 {

 		return errors.Errorf("invalid definition op with no ops %d %d", len(d.ops), len(d.metas))

 	}

@@ -95,15 +110,18 @@ func (d *DefinitionOp) Validate() error {

 	return nil

 }

-func (d *DefinitionOp) Marshal(c *Constraints) (digest.Digest, []byte, *pb.OpMetadata, error) {

+func (d *DefinitionOp) Marshal(ctx context.Context, c *Constraints) (digest.Digest, []byte, *pb.OpMetadata, error) {

 	if d.dgst == "" {

 		return "", nil, nil, errors.Errorf("cannot marshal empty definition op")

 	}

-	if err := d.Validate(); err != nil {

+	if err := d.Validate(ctx); err != nil {

 		return "", nil, nil, err

 	}

+	d.mu.Lock()

+	defer d.mu.Unlock()

+

 	meta := d.metas[d.dgst]

 	return d.dgst, d.defs[d.dgst], &meta, nil

@@ -114,7 +132,11 @@ func (d *DefinitionOp) Output() Output {

 		return nil

 	}

-	return &output{vertex: d, platform: d.platform(), getIndex: func() (pb.OutputIndex, error) {

+	d.mu.Lock()

+	platform := d.platforms[d.dgst]

+	d.mu.Unlock()

+

+	return &output{vertex: d, platform: platform, getIndex: func() (pb.OutputIndex, error) {

 		return d.index, nil

 	}}

 }

@@ -126,7 +148,11 @@ func (d *DefinitionOp) Inputs() []Output {

 	var inputs []Output

+	d.mu.Lock()

 	op := d.ops[d.dgst]

+	platform := d.platforms[d.dgst]

+	d.mu.Unlock()

+

 	for _, input := range op.Inputs {

 		vtx := &DefinitionOp{

 			ops:       d.ops,

@@ -136,26 +162,10 @@ func (d *DefinitionOp) Inputs() []Output {

 			dgst:      input.Digest,

 			index:     input.Index,

 		}

-		inputs = append(inputs, &output{vertex: vtx, platform: d.platform(), getIndex: func() (pb.OutputIndex, error) {

+		inputs = append(inputs, &output{vertex: vtx, platform: platform, getIndex: func() (pb.OutputIndex, error) {

 			return pb.OutputIndex(vtx.index), nil

 		}})

 	}

 	return inputs

 }

-

-func (d *DefinitionOp) platform() *specs.Platform {

-	platform, ok := d.platforms[d.dgst]

-	if ok {

-		return platform

-	}

-

-	op := d.ops[d.dgst]

-	if op.Platform != nil {

-		spec := op.Platform.Spec()

-		platform = &spec

-	}

-

-	d.platforms[d.dgst] = platform

-	return platform

-}

@@ -1,6 +1,7 @@

 package llb

 import (

+	"context"

 	_ "crypto/sha256"

 	"fmt"

 	"net"

@@ -12,19 +13,9 @@ import (

 	"github.com/pkg/errors"

 )

-type Meta struct {

-	Args       []string

-	Env        EnvList

-	Cwd        string

-	User       string

-	ProxyEnv   *ProxyEnv

-	ExtraHosts []HostIP

-	Network    pb.NetMode

-	Security   pb.SecurityMode

-}

-

-func NewExecOp(root Output, meta Meta, readOnly bool, c Constraints) *ExecOp {

-	e := &ExecOp{meta: meta, constraints: c}

+func NewExecOp(base State, proxyEnv *ProxyEnv, readOnly bool, c Constraints) *ExecOp {

+	e := &ExecOp{base: base, constraints: c, proxyEnv: proxyEnv}

+	root := base.Output()

 	rootMount := &mount{

 		target:   pb.RootMount,

 		source:   root,

@@ -58,9 +49,10 @@ type mount struct {

 type ExecOp struct {

 	MarshalCache

+	proxyEnv    *ProxyEnv

 	root        Output

 	mounts      []*mount

-	meta        Meta

+	base        State

 	constraints Constraints

 	isValidated bool

 	secrets     []SecretInfo

@@ -103,19 +95,27 @@ func (e *ExecOp) GetMount(target string) Output {

 	return nil

 }

-func (e *ExecOp) Validate() error {

+func (e *ExecOp) Validate(ctx context.Context) error {

 	if e.isValidated {

 		return nil

 	}

-	if len(e.meta.Args) == 0 {

+	args, err := getArgs(e.base)(ctx)

+	if err != nil {

+		return err

+	}

+	if len(args) == 0 {

 		return errors.Errorf("arguments are required")

 	}

-	if e.meta.Cwd == "" {

+	cwd, err := getDir(e.base)(ctx)

+	if err != nil {

+		return err

+	}

+	if cwd == "" {

 		return errors.Errorf("working directory is required")

 	}

 	for _, m := range e.mounts {

 		if m.source != nil {

-			if err := m.source.Vertex().Validate(); err != nil {

+			if err := m.source.Vertex(ctx).Validate(ctx); err != nil {

 				return err

 			}

 		}

@@ -124,11 +124,11 @@ func (e *ExecOp) Validate() error {

 	return nil

 }

-func (e *ExecOp) Marshal(c *Constraints) (digest.Digest, []byte, *pb.OpMetadata, error) {

+func (e *ExecOp) Marshal(ctx context.Context, c *Constraints) (digest.Digest, []byte, *pb.OpMetadata, error) {

 	if e.Cached(c) {

 		return e.Load()

 	}

-	if err := e.Validate(); err != nil {

+	if err := e.Validate(ctx); err != nil {

 		return "", nil, nil, err

 	}

 	// make sure mounts are sorted

@@ -136,52 +136,86 @@ func (e *ExecOp) Marshal(c *Constraints) (digest.Digest, []byte, *pb.OpMetadata,

 		return e.mounts[i].target < e.mounts[j].target

 	})

+	env, err := getEnv(e.base)(ctx)

+	if err != nil {

+		return "", nil, nil, err

+	}

+

 	if len(e.ssh) > 0 {

 		for i, s := range e.ssh {

 			if s.Target == "" {

 				e.ssh[i].Target = fmt.Sprintf("/run/buildkit/ssh_agent.%d", i)

 			}

 		}

-		if _, ok := e.meta.Env.Get("SSH_AUTH_SOCK"); !ok {

-			e.meta.Env = e.meta.Env.AddOrReplace("SSH_AUTH_SOCK", e.ssh[0].Target)

+		if _, ok := env.Get("SSH_AUTH_SOCK"); !ok {

+			env = env.AddOrReplace("SSH_AUTH_SOCK", e.ssh[0].Target)

 		}

 	}

 	if c.Caps != nil {

 		if err := c.Caps.Supports(pb.CapExecMetaSetsDefaultPath); err != nil {

-			e.meta.Env = e.meta.Env.SetDefault("PATH", system.DefaultPathEnv)

+			env = env.SetDefault("PATH", system.DefaultPathEnv)

 		} else {

 			addCap(&e.constraints, pb.CapExecMetaSetsDefaultPath)

 		}

 	}

+	args, err := getArgs(e.base)(ctx)

+	if err != nil {

+		return "", nil, nil, err