@@ -61,7 +61,7 @@ require (

 	github.com/miekg/dns v1.1.57

 	github.com/mistifyio/go-zfs/v3 v3.0.1

 	github.com/mitchellh/copystructure v1.2.0

-	github.com/moby/buildkit v0.13.1

+	github.com/moby/buildkit v0.14.0-rc1.0.20240605195929-c1f5352a1b7e

 	github.com/moby/docker-image-spec v1.3.1

 	github.com/moby/ipvs v1.1.0

 	github.com/moby/locker v1.0.1

@@ -88,7 +88,7 @@ require (

 	github.com/sirupsen/logrus v1.9.3

 	github.com/spf13/cobra v1.8.0

 	github.com/spf13/pflag v1.0.5

-	github.com/tonistiigi/fsutil v0.0.0-20240301111122-7525a1af2bb5

+	github.com/tonistiigi/fsutil v0.0.0-20240424095704-91a3fc46842c

 	github.com/tonistiigi/go-archvariant v1.0.0

 	github.com/vbatts/tar-split v0.11.5

 	github.com/vishvananda/netlink v1.2.1-beta.2

@@ -193,9 +193,9 @@ require (

 	github.com/stretchr/testify v1.8.4 // indirect

 	github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 // indirect

 	github.com/tinylib/msgp v1.1.8 // indirect

-	github.com/tonistiigi/go-actions-cache v0.0.0-20240227172821-a0b64f338598 // indirect

+	github.com/tonistiigi/go-actions-cache v0.0.0-20240320205438-9794bdbb2fb4 // indirect

 	github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea // indirect

-	github.com/tonistiigi/vt100 v0.0.0-20230623042737-f9a4f7ef6531 // indirect

+	github.com/tonistiigi/vt100 v0.0.0-20240514184818-90bafcd6abab // indirect

 	github.com/weppos/publicsuffix-go v0.15.1-0.20210511084619-b1f36a2d6c0b // indirect

 	github.com/zmap/zcrypto v0.0.0-20210511125630-18f1e0152cfc // indirect

 	github.com/zmap/zlint/v3 v3.1.0 // indirect

@@ -210,7 +210,6 @@ require (

 	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v0.42.0 // indirect

 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 // indirect

 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0 // indirect

-	go.opentelemetry.io/otel/exporters/prometheus v0.42.0 // indirect

 	go.opentelemetry.io/otel/metric v1.21.0 // indirect

 	go.opentelemetry.io/otel/sdk/metric v1.21.0 // indirect

 	go.opentelemetry.io/proto/otlp v1.0.0 // indirect

@@ -480,8 +480,8 @@ github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh

 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=

 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=

 github.com/mndrix/tap-go v0.0.0-20171203230836-629fa407e90b/go.mod h1:pzzDgJWZ34fGzaAZGFW22KVZDfyrYW+QABMrWnJBnSs=

-github.com/moby/buildkit v0.13.1 h1:L8afOFhPq2RPJJSr/VyzbufwID7jquZVB7oFHbPRcPE=

-github.com/moby/buildkit v0.13.1/go.mod h1:aNmNQKLBFYAOFuzQjR3VA27/FijlvtBD1pjNwTSN37k=

+github.com/moby/buildkit v0.14.0-rc1.0.20240605195929-c1f5352a1b7e h1:/qEvjulGGA7ykkCzK+5HHsA/TyFkwpDeOXQNYXbSYZc=

+github.com/moby/buildkit v0.14.0-rc1.0.20240605195929-c1f5352a1b7e/go.mod h1:qeJJeU1GhOhzPJVn2opBGLjR005LpG5KlB8FXMoY46Y=

 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=

 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=

 github.com/moby/ipvs v1.1.0 h1:ONN4pGaZQgAx+1Scz5RvWV4Q7Gb+mvfRh3NsPS+1XQQ=

@@ -675,16 +675,16 @@ github.com/tinylib/msgp v1.1.8 h1:FCXC1xanKO4I8plpHGH2P7koL/RzZs12l/+r7vakfm0=

 github.com/tinylib/msgp v1.1.8/go.mod h1:qkpG+2ldGg4xRFmx+jfTvZPxfGFhi64BcnL9vkCm/Tw=

 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=

 github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=

-github.com/tonistiigi/fsutil v0.0.0-20240301111122-7525a1af2bb5 h1:oZS8KCqAg62sxJkEq/Ppzqrb6EooqzWtL8Oaex7bc5c=

-github.com/tonistiigi/fsutil v0.0.0-20240301111122-7525a1af2bb5/go.mod h1:vbbYqJlnswsbJqWUcJN8fKtBhnEgldDrcagTgnBVKKM=

-github.com/tonistiigi/go-actions-cache v0.0.0-20240227172821-a0b64f338598 h1:DA/NDC0YbMdnfcOSUzAnbUZE6dSM54d+0hrBqG+bOfs=

-github.com/tonistiigi/go-actions-cache v0.0.0-20240227172821-a0b64f338598/go.mod h1:anhKd3mnC1shAbQj1Q4IJ+w6xqezxnyDYlx/yKa7IXM=

+github.com/tonistiigi/fsutil v0.0.0-20240424095704-91a3fc46842c h1:+6wg/4ORAbnSoGDzg2Q1i3CeMcT/jjhye/ZfnBHy7/M=

+github.com/tonistiigi/fsutil v0.0.0-20240424095704-91a3fc46842c/go.mod h1:vbbYqJlnswsbJqWUcJN8fKtBhnEgldDrcagTgnBVKKM=

+github.com/tonistiigi/go-actions-cache v0.0.0-20240320205438-9794bdbb2fb4 h1:R0lM8Jo3aZL95yjQHWQti7nszllleKBxCs9uyFbykII=

+github.com/tonistiigi/go-actions-cache v0.0.0-20240320205438-9794bdbb2fb4/go.mod h1:anhKd3mnC1shAbQj1Q4IJ+w6xqezxnyDYlx/yKa7IXM=

 github.com/tonistiigi/go-archvariant v1.0.0 h1:5LC1eDWiBNflnTF1prCiX09yfNHIxDC/aukdhCdTyb0=

 github.com/tonistiigi/go-archvariant v1.0.0/go.mod h1:TxFmO5VS6vMq2kvs3ht04iPXtu2rUT/erOnGFYfk5Ho=

 github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea h1:SXhTLE6pb6eld/v/cCndK0AMpt1wiVFb/YYmqB3/QG0=

 github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea/go.mod h1:WPnis/6cRcDZSUvVmezrxJPkiO87ThFYsoUiMwWNDJk=

-github.com/tonistiigi/vt100 v0.0.0-20230623042737-f9a4f7ef6531 h1:Y/M5lygoNPKwVNLMPXgVfsRT40CSFKXCxuU8LoHySjs=

-github.com/tonistiigi/vt100 v0.0.0-20230623042737-f9a4f7ef6531/go.mod h1:ulncasL3N9uLrVann0m+CDlJKWsIAP34MPcOJF6VRvc=

+github.com/tonistiigi/vt100 v0.0.0-20240514184818-90bafcd6abab h1:H6aJ0yKQ0gF49Qb2z5hI1UHxSQt4JMyxebFR15KnApw=

+github.com/tonistiigi/vt100 v0.0.0-20240514184818-90bafcd6abab/go.mod h1:ulncasL3N9uLrVann0m+CDlJKWsIAP34MPcOJF6VRvc=

 github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=

 github.com/urfave/cli v1.19.1/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=

 github.com/vbatts/tar-split v0.11.5 h1:3bHCTIheBm1qFTcgh9oPu+nNBtX+XJIupG/vacinCts=

@@ -759,8 +759,6 @@ go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0 h1:tIqhe

 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0/go.mod h1:nUeKExfxAQVbiVFn32YXpXZZHZ61Cc3s3Rn1pDBGAb0=

 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.21.0 h1:digkEZCJWobwBqMwC0cwCq8/wkkRy/OowZg5OArWZrM=

 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.21.0/go.mod h1:/OpE/y70qVkndM0TrxT4KBoN3RsFZP0QaofcfYrj76I=

-go.opentelemetry.io/otel/exporters/prometheus v0.42.0 h1:jwV9iQdvp38fxXi8ZC+lNpxjK16MRcZlpDYvbuO1FiA=

-go.opentelemetry.io/otel/exporters/prometheus v0.42.0/go.mod h1:f3bYiqNqhoPxkvI2LrXqQVC546K7BuRDL/kKuxkujhA=

 go.opentelemetry.io/otel/metric v1.21.0 h1:tlYWfeo+Bocx5kLEloTjbcDwBuELRrIFxwdQ36PlJu4=

 go.opentelemetry.io/otel/metric v1.21.0/go.mod h1:o1p3CA8nNHW8j5yuQLdc1eeqEaPfzug24uvsyIEJRWM=

 go.opentelemetry.io/otel/sdk v1.0.1/go.mod h1:HrdXne+BiwsOHYYkBE5ysIcv2bvdZstxzmCQhxTcZkI=

@@ -9,9 +9,9 @@ import (

 	"io"

 	"github.com/containerd/containerd/content"

-	"github.com/containerd/containerd/errdefs"

 	labelspkg "github.com/containerd/containerd/labels"

 	"github.com/containerd/containerd/mount"

+	cerrdefs "github.com/containerd/errdefs"

 	"github.com/moby/buildkit/util/bklog"

 	"github.com/moby/buildkit/util/compression"

 	"github.com/moby/buildkit/util/overlay"

@@ -80,10 +80,9 @@ func (sr *immutableRef) tryComputeOverlayBlob(ctx context.Context, lower, upper

 		if err := compressed.Close(); err != nil {

 			return emptyDesc, false, errors.Wrap(err, "failed to close compressed diff writer")

 		}

-		if labels == nil {

-			labels = map[string]string{}

+		labels = map[string]string{

+			labelspkg.LabelUncompressed: dgstr.Digest().String(),

 		}

-		labels[labelspkg.LabelUncompressed] = dgstr.Digest().String()

 	} else {

 		if err = overlay.WriteUpperdir(ctx, bufW, upperdir, lower); err != nil {

 			return emptyDesc, false, errors.Wrap(err, "failed to write diff")

@@ -99,7 +98,7 @@ func (sr *immutableRef) tryComputeOverlayBlob(ctx context.Context, lower, upper

 	}

 	dgst := cw.Digest()

 	if err := cw.Commit(ctx, 0, dgst, commitopts...); err != nil {

-		if !errdefs.IsAlreadyExists(err) {

+		if !cerrdefs.IsAlreadyExists(err) {

 			return emptyDesc, false, errors.Wrap(err, "failed to commit")

 		}

 	}

@@ -12,6 +12,6 @@ import (

 	"github.com/pkg/errors"

 )

-func (sr *immutableRef) tryComputeOverlayBlob(ctx context.Context, lower, upper []mount.Mount, mediaType string, ref string, compressorFunc compression.Compressor) (_ ocispecs.Descriptor, ok bool, err error) {

+func (sr *immutableRef) tryComputeOverlayBlob(_ context.Context, _, _ []mount.Mount, _ string, _ string, _ compression.Compressor) (_ ocispecs.Descriptor, ok bool, err error) {

 	return ocispecs.Descriptor{}, true, errors.Errorf("overlayfs-based diff computing is unsupported")

 }

@@ -9,8 +9,8 @@ import (

 	"io"

 	"github.com/containerd/containerd/content"

-	"github.com/containerd/containerd/errdefs"

 	"github.com/containerd/containerd/labels"

+	cerrdefs "github.com/containerd/errdefs"

 	"github.com/moby/buildkit/session"

 	"github.com/moby/buildkit/util/compression"

 	digest "github.com/opencontainers/go-digest"

@@ -95,7 +95,7 @@ func MergeNydus(ctx context.Context, ref ImmutableRef, comp compression.Config,

 	if err := cw.Commit(ctx, 0, compressedDgst, content.WithLabels(map[string]string{

 		labels.LabelUncompressed: uncompressedDgst.Digest().String(),

 	})); err != nil {

-		if !errdefs.IsAlreadyExists(err) {

+		if !cerrdefs.IsAlreadyExists(err) {

 			return nil, errors.Wrap(err, "commit to content store")

 		}

 	}

@@ -290,7 +290,7 @@ func keyPath(p string) string {

 // HandleChange notifies the source about a modification operation

 func (cc *cacheContext) HandleChange(kind fsutil.ChangeKind, p string, fi os.FileInfo, err error) (retErr error) {

 	p = keyPath(p)

-	k := convertPathToKey([]byte(p))

+	k := convertPathToKey(p)

 	deleteDir := func(cr *CacheRecord) {

 		if cr.Type == CacheRecordTypeDir {

@@ -369,7 +369,7 @@ func (cc *cacheContext) HandleChange(kind fsutil.ChangeKind, p string, fi os.Fil

 	// note that the source may be called later because data writing is async

 	if fi.Mode()&os.ModeSymlink == 0 && stat.Linkname != "" {

 		ln := path.Join("/", filepath.ToSlash(stat.Linkname))

-		v, ok := cc.txn.Get(convertPathToKey([]byte(ln)))

+		v, ok := cc.txn.Get(convertPathToKey(ln))

 		if ok {

 			cp := *v.(*CacheRecord)

 			cr = &cp

@@ -536,7 +536,7 @@ func (cc *cacheContext) includedPaths(ctx context.Context, m *mount, p string, o

 		}

 	} else {

 		origPrefix = p

-		k = convertPathToKey([]byte(origPrefix))

+		k = convertPathToKey(origPrefix)

 		// We need to resolve symlinks here, in case the base path

 		// involves a symlink. That will match fsutil behavior of

@@ -554,7 +554,7 @@ func (cc *cacheContext) includedPaths(ctx context.Context, m *mount, p string, o

 			iter.SeekLowerBound(append(append([]byte{}, k...), 0))

 		}

-		resolvedPrefix = string(convertKeyToPath(k))

+		resolvedPrefix = convertKeyToPath(k)

 	} else {

 		k, _, keyOk = iter.Next()

 	}

@@ -565,7 +565,7 @@ func (cc *cacheContext) includedPaths(ctx context.Context, m *mount, p string, o

 	)

 	for keyOk {

-		fn := string(convertKeyToPath(k))

+		fn := convertKeyToPath(k)

 		// Convert the path prefix from what we found in the prefix

 		// tree to what the argument specified.

@@ -752,7 +752,7 @@ func wildcardPrefix(root *iradix.Node, p string) (string, []byte, bool, error) {

 	}

 	linksWalked := 0

-	k, cr, err := getFollowLinksWalk(root, convertPathToKey([]byte(d1)), true, &linksWalked)

+	k, cr, err := getFollowLinksWalk(root, convertPathToKey(d1), true, &linksWalked)

 	if err != nil {

 		return "", k, false, err

 	}

@@ -761,7 +761,7 @@ func wildcardPrefix(root *iradix.Node, p string) (string, []byte, bool, error) {

 		// getFollowLinks only handles symlinks in path

 		// components before the last component, so

 		// handle last component in d1 specially.

-		resolved := string(convertKeyToPath(k))

+		resolved := convertKeyToPath(k)

 		for {

 			v, ok := root.Get(k)

@@ -778,7 +778,7 @@ func wildcardPrefix(root *iradix.Node, p string) (string, []byte, bool, error) {

 			}

 			resolved := cleanLink(resolved, v.(*CacheRecord).Linkname)

-			k = convertPathToKey([]byte(resolved))

+			k = convertPathToKey(resolved)

 		}

 	}

 	return d1, k, cr != nil, nil

@@ -823,7 +823,7 @@ func (cc *cacheContext) checksumNoFollow(ctx context.Context, m *mount, p string

 	if cc.txn == nil {

 		root := cc.tree.Root()

 		cc.mu.RUnlock()

-		v, ok := root.Get(convertPathToKey([]byte(p)))

+		v, ok := root.Get(convertPathToKey(p))

 		if ok {

 			cr := v.(*CacheRecord)

 			if cr.Digest != "" {

@@ -856,7 +856,7 @@ func (cc *cacheContext) commitActiveTransaction() {

 		addParentToMap(d, cc.dirtyMap)

 	}

 	for d := range cc.dirtyMap {

-		k := convertPathToKey([]byte(d))

+		k := convertPathToKey(d)

 		if _, ok := cc.txn.Get(k); ok {

 			cc.txn.Insert(k, &CacheRecord{Type: CacheRecordTypeDir})

 		}

@@ -878,7 +878,7 @@ func (cc *cacheContext) lazyChecksum(ctx context.Context, m *mount, p string) (*

 			return nil, err

 		}

 	}

-	k := convertPathToKey([]byte(p))

+	k := convertPathToKey(p)

 	txn := cc.tree.Txn()

 	root = txn.Root()

 	cr, updated, err := cc.checksum(ctx, root, txn, m, k, true)

@@ -935,7 +935,7 @@ func (cc *cacheContext) checksum(ctx context.Context, root *iradix.Node, txn *ir

 		dgst = digest.NewDigest(digest.SHA256, h)

 	default:

-		p := string(convertKeyToPath(bytes.TrimSuffix(k, []byte{0})))

+		p := convertKeyToPath(bytes.TrimSuffix(k, []byte{0}))

 		target, err := m.mount(ctx)

 		if err != nil {

@@ -978,7 +978,7 @@ func (cc *cacheContext) needsScanFollow(root *iradix.Node, p string, linksWalked

 	if p == "/" {

 		p = ""

 	}

-	v, ok := root.Get(convertPathToKey([]byte(p)))

+	v, ok := root.Get(convertPathToKey(p))

 	if !ok {

 		if p == "" {

 			return true, nil

@@ -1017,9 +1017,8 @@ func (cc *cacheContext) scanPath(ctx context.Context, m *mount, p string) (retEr

 			Type:     CacheRecordTypeSymlink,

 			Linkname: filepath.ToSlash(link),

 		}

-		k := []byte(path.Join("/", filepath.ToSlash(p)))

-		k = convertPathToKey(k)

-		txn.Insert(k, cr)

+		p = path.Join("/", filepath.ToSlash(p))

+		txn.Insert(convertPathToKey(p), cr)

 		return nil

 	})

 	if err != nil {

@@ -1034,11 +1033,11 @@ func (cc *cacheContext) scanPath(ctx context.Context, m *mount, p string) (retEr

 		if err != nil {

 			return err

 		}

-		k := []byte(path.Join("/", filepath.ToSlash(rel)))

-		if string(k) == "/" {

-			k = []byte{}

+		p := path.Join("/", filepath.ToSlash(rel))

+		if p == "/" {

+			p = ""

 		}

-		k = convertPathToKey(k)

+		k := convertPathToKey(p)

 		if _, ok := n.Get(k); !ok {

 			cr := &CacheRecord{

 				Type: CacheRecordTypeFile,

@@ -1098,8 +1097,8 @@ func getFollowLinksWalk(root *iradix.Node, k []byte, follow bool, linksWalked *i

 				return nil, nil, errors.Errorf("too many links")

 			}

-			link := cleanLink(string(convertKeyToPath(dir)), parent.Linkname)

-			return getFollowLinksWalk(root, append(convertPathToKey([]byte(link)), file...), follow, linksWalked)

+			link := cleanLink(convertKeyToPath(dir), parent.Linkname)

+			return getFollowLinksWalk(root, append(convertPathToKey(link), file...), follow, linksWalked)

 		}

 	}

 	k = append(k, file...)

@@ -1176,12 +1175,12 @@ func poolsCopy(dst io.Writer, src io.Reader) (written int64, err error) {

 	return

 }

-func convertPathToKey(p []byte) []byte {

-	return bytes.Replace([]byte(p), []byte("/"), []byte{0}, -1)

+func convertPathToKey(p string) []byte {

+	return bytes.ReplaceAll([]byte(p), []byte("/"), []byte{0})

 }

-func convertKeyToPath(p []byte) []byte {

-	return bytes.Replace([]byte(p), []byte{0}, []byte("/"), -1)

+func convertKeyToPath(p []byte) string {

+	return string(bytes.ReplaceAll(p, []byte{0}, []byte("/")))

 }

 func splitKey(k []byte) ([]byte, []byte) {

@@ -9,6 +9,6 @@ import (

 	fstypes "github.com/tonistiigi/fsutil/types"

 )

-func setUnixOpt(path string, fi os.FileInfo, stat *fstypes.Stat) error {

+func setUnixOpt(_ string, _ os.FileInfo, _ *fstypes.Stat) error {

 	return nil

 }

@@ -10,11 +10,11 @@ import (

 	"github.com/containerd/containerd/content"

 	"github.com/containerd/containerd/diff"

-	"github.com/containerd/containerd/errdefs"

 	"github.com/containerd/containerd/filters"

 	"github.com/containerd/containerd/gc"

 	"github.com/containerd/containerd/labels"

 	"github.com/containerd/containerd/leases"

+	cerrdefs "github.com/containerd/errdefs"

 	"github.com/docker/docker/pkg/idtools"

 	"github.com/moby/buildkit/cache/metadata"

 	"github.com/moby/buildkit/client"

@@ -137,7 +137,7 @@ func (cm *cacheManager) GetByBlob(ctx context.Context, desc ocispecs.Descriptor,

 	descHandlers := descHandlersOf(opts...)

 	if desc.Digest != "" && (descHandlers == nil || descHandlers[desc.Digest] == nil) {

-		if _, err := cm.ContentStore.Info(ctx, desc.Digest); errors.Is(err, errdefs.ErrNotFound) {

+		if _, err := cm.ContentStore.Info(ctx, desc.Digest); errors.Is(err, cerrdefs.ErrNotFound) {

 			return nil, NeedsRemoteProviderError([]digest.Digest{desc.Digest})

 		} else if err != nil {

 			return nil, err

@@ -253,7 +253,7 @@ func (cm *cacheManager) GetByBlob(ctx context.Context, desc ocispecs.Descriptor,

 	if err := cm.LeaseManager.AddResource(ctx, l, leases.Resource{

 		ID:   snapshotID,

 		Type: "snapshots/" + cm.Snapshotter.Name(),

-	}); err != nil && !errdefs.IsAlreadyExists(err) {

+	}); err != nil && !cerrdefs.IsAlreadyExists(err) {

 		return nil, errors.Wrapf(err, "failed to add snapshot %s to lease", id)

 	}

@@ -374,7 +374,7 @@ func (cm *cacheManager) get(ctx context.Context, id string, pg progress.Controll

 		if rec.equalImmutable != nil {

 			return rec.equalImmutable.ref(triggerUpdate, descHandlers, pg), nil

 		}

-		return rec.mref(triggerUpdate, descHandlers).commit(ctx)

+		return rec.mref(triggerUpdate, descHandlers).commit()

 	}

 	return rec.ref(triggerUpdate, descHandlers, pg), nil

@@ -484,7 +484,7 @@ func (cm *cacheManager) getRecord(ctx context.Context, id string, opts ...RefOpt

 	if rec.mutable {

 		// If the record is mutable, then the snapshot must exist

 		if _, err := cm.Snapshotter.Stat(ctx, rec.ID()); err != nil {

-			if !errdefs.IsNotFound(err) {

+			if !cerrdefs.IsNotFound(err) {

 				return nil, errors.Wrap(err, "failed to check mutable ref snapshot")

 			}

 			// the snapshot doesn't exist, clear this record

@@ -609,7 +609,7 @@ func (cm *cacheManager) New(ctx context.Context, s ImmutableRef, sess session.Gr

 	if err := cm.LeaseManager.AddResource(ctx, l, leases.Resource{

 		ID:   snapshotID,

 		Type: "snapshots/" + cm.Snapshotter.Name(),

-	}); err != nil && !errdefs.IsAlreadyExists(err) {

+	}); err != nil && !cerrdefs.IsAlreadyExists(err) {

 		return nil, errors.Wrapf(err, "failed to add snapshot %s to lease", snapshotID)

 	}

@@ -1109,10 +1109,11 @@ func (cm *cacheManager) prune(ctx context.Context, ch chan client.UsageInfo, opt

 			}

 			c := &client.UsageInfo{

-				ID:         cr.ID(),

-				Mutable:    cr.mutable,

-				RecordType: recordType,

-				Shared:     shared,

+				ID:          cr.ID(),

+				Mutable:     cr.mutable,

+				RecordType:  recordType,

+				Shared:      shared,

+				Description: cr.GetDescription(),

 			}

 			usageCount, lastUsedAt := cr.getLastUsed()

@@ -7,10 +7,10 @@ import (

 	"time"

 	"github.com/containerd/containerd/content"

-	"github.com/containerd/containerd/errdefs"

 	"github.com/containerd/containerd/images"

 	"github.com/containerd/containerd/leases"

 	"github.com/containerd/containerd/snapshots"

+	cerrdefs "github.com/containerd/errdefs"

 	"github.com/moby/buildkit/cache/metadata"

 	"github.com/moby/buildkit/snapshot"

 	"github.com/moby/buildkit/util/bklog"

@@ -185,7 +185,7 @@ func MigrateV2(ctx context.Context, from, to string, cs content.Store, s snapsho

 		})

 		if err != nil {

 			// if we are running the migration twice

-			if errors.Is(err, errdefs.ErrAlreadyExists) {

+			if errors.Is(err, cerrdefs.ErrAlreadyExists) {

 				continue

 			}

 			return errors.Wrap(err, "failed to create lease")

@@ -216,7 +216,7 @@ func MigrateV2(ctx context.Context, from, to string, cs content.Store, s snapsho

 			if _, err := s.Update(ctx, snapshots.Info{

 				Name: md.getSnapshotID(),

 			}, "labels.containerd.io/gc.root"); err != nil {

-				if !errors.Is(err, errdefs.ErrNotFound) {

+				if !errors.Is(err, cerrdefs.ErrNotFound) {

 					return err

 				}

 			}

@@ -237,7 +237,7 @@ func MigrateV2(ctx context.Context, from, to string, cs content.Store, s snapsho

 			if _, err := s.Update(ctx, snapshots.Info{

 				Name: info.Name,

 			}, "labels.containerd.io/gc.root"); err != nil {

-				if !errors.Is(err, errdefs.ErrNotFound) {

+				if !errors.Is(err, cerrdefs.ErrNotFound) {

 					return err

 				}

 			}

@@ -10,13 +10,13 @@ import (

 	"time"

 	"github.com/containerd/containerd/content"

-	"github.com/containerd/containerd/errdefs"

 	"github.com/containerd/containerd/images"

 	"github.com/containerd/containerd/labels"

 	"github.com/containerd/containerd/leases"

 	"github.com/containerd/containerd/mount"

 	"github.com/containerd/containerd/pkg/userns"

 	"github.com/containerd/containerd/snapshots"

+	cerrdefs "github.com/containerd/errdefs"

 	"github.com/docker/docker/pkg/idtools"

 	"github.com/hashicorp/go-multierror"

 	"github.com/moby/buildkit/cache/config"

@@ -292,7 +292,7 @@ func (cr *cacheRecord) isLazy(ctx context.Context) (bool, error) {

 		return false, nil

 	}

 	_, err := cr.cm.ContentStore.Info(ctx, dgst)

-	if errors.Is(err, errdefs.ErrNotFound) {

+	if errors.Is(err, cerrdefs.ErrNotFound) {

 		return true, nil

 	} else if err != nil {

 		return false, err

@@ -349,7 +349,7 @@ func (cr *cacheRecord) size(ctx context.Context) (int64, error) {

 				if isDead {

 					return 0, nil

 				}

-				if !errors.Is(err, errdefs.ErrNotFound) {

+				if !errors.Is(err, cerrdefs.ErrNotFound) {

 					return s, errors.Wrapf(err, "failed to get usage for %s", cr.ID())

 				}

 			}

@@ -383,7 +383,7 @@ func (cr *cacheRecord) size(ctx context.Context) (int64, error) {

 }

 // caller must hold cr.mu

-func (cr *cacheRecord) mount(ctx context.Context, s session.Group) (_ snapshot.Mountable, rerr error) {

+func (cr *cacheRecord) mount(ctx context.Context) (_ snapshot.Mountable, rerr error) {

 	if cr.mountCache != nil {

 		return cr.mountCache, nil

 	}

@@ -401,7 +401,7 @@ func (cr *cacheRecord) mount(ctx context.Context, s session.Group) (_ snapshot.M

 				"containerd.io/gc.flat": time.Now().UTC().Format(time.RFC3339Nano),

 			}

 			return nil

-		}, leaseutil.MakeTemporary); err != nil && !errdefs.IsAlreadyExists(err) {

+		}, leaseutil.MakeTemporary); err != nil && !cerrdefs.IsAlreadyExists(err) {

 			return nil, err

 		}

 		defer func() {

@@ -412,14 +412,14 @@ func (cr *cacheRecord) mount(ctx context.Context, s session.Group) (_ snapshot.M

 		if err := cr.cm.LeaseManager.AddResource(ctx, leases.Lease{ID: cr.viewLeaseID()}, leases.Resource{

 			ID:   mountSnapshotID,

 			Type: "snapshots/" + cr.cm.Snapshotter.Name(),

-		}); err != nil && !errdefs.IsAlreadyExists(err) {

+		}); err != nil && !cerrdefs.IsAlreadyExists(err) {

 			return nil, err

 		}

 		// Return the mount direct from View rather than setting it using the Mounts call below.

 		// The two are equivalent for containerd snapshotters but the moby snapshotter requires

 		// the use of the mountable returned by View in this case.

 		mnts, err := cr.cm.Snapshotter.View(ctx, mountSnapshotID, cr.getSnapshotID())

-		if err != nil && !errdefs.IsAlreadyExists(err) {

+		if err != nil && !cerrdefs.IsAlreadyExists(err) {

 			return nil, err

 		}

 		cr.mountCache = mnts

@@ -455,12 +455,12 @@ func (cr *cacheRecord) remove(ctx context.Context, removeSnapshot bool) (rerr er

 	if removeSnapshot {

 		if err := cr.cm.LeaseManager.Delete(ctx, leases.Lease{

 			ID: cr.ID(),

-		}); err != nil && !errdefs.IsNotFound(err) {

+		}); err != nil && !cerrdefs.IsNotFound(err) {

 			return errors.Wrapf(err, "failed to delete lease for %s", cr.ID())

 		}

 		if err := cr.cm.LeaseManager.Delete(ctx, leases.Lease{

 			ID: cr.compressionVariantsLeaseID(),

-		}); err != nil && !errdefs.IsNotFound(err) {

+		}); err != nil && !cerrdefs.IsNotFound(err) {

 			return errors.Wrapf(err, "failed to delete compression variant lease for %s", cr.ID())

 		}

 	}

@@ -764,7 +764,7 @@ func (sr *immutableRef) linkBlob(ctx context.Context, desc ocispecs.Descriptor)

 		l.ID = sr.compressionVariantsLeaseID()

 		// do not make it flat lease to allow linking blobs using gc label

 		return nil

-	}); err != nil && !errdefs.IsAlreadyExists(err) {

+	}); err != nil && !cerrdefs.IsAlreadyExists(err) {

 		return err

 	}

 	if err := sr.cm.LeaseManager.AddResource(ctx, leases.Lease{ID: sr.compressionVariantsLeaseID()}, leases.Resource{

@@ -828,7 +828,7 @@ func getBlobWithCompression(ctx context.Context, cs content.Store, desc ocispecs

 		}

 		return true

 	}); err != nil || target == nil {

-		return ocispecs.Descriptor{}, errdefs.ErrNotFound

+		return ocispecs.Descriptor{}, cerrdefs.ErrNotFound

 	}

 	return *target, nil

 }

@@ -849,7 +849,7 @@ func walkBlobVariantsOnly(ctx context.Context, cs content.Store, dgst digest.Dig

 	}

 	visited[dgst] = struct{}{}

 	info, err := cs.Info(ctx, dgst)

-	if errors.Is(err, errdefs.ErrNotFound) {

+	if errors.Is(err, cerrdefs.ErrNotFound) {

 		return true, nil

 	} else if err != nil {

 		return false, err

@@ -975,12 +975,12 @@ func (sr *immutableRef) Mount(ctx context.Context, readonly bool, s session.Grou

 	var mnt snapshot.Mountable

 	if sr.cm.Snapshotter.Name() == "stargz" {

 		if err := sr.withRemoteSnapshotLabelsStargzMode(ctx, s, func() {

-			mnt, rerr = sr.mount(ctx, s)

+			mnt, rerr = sr.mount(ctx)

 		}); err != nil {

 			return nil, err

 		}

 	} else {

-		mnt, rerr = sr.mount(ctx, s)

+		mnt, rerr = sr.mount(ctx)

 	}

 	if rerr != nil {

 		return nil, rerr

@@ -1025,9 +1025,9 @@ func (sr *immutableRef) withRemoteSnapshotLabelsStargzMode(ctx context.Context,

 	for _, r := range sr.layerChain() {

 		r := r

 		info, err := r.cm.Snapshotter.Stat(ctx, r.getSnapshotID())

-		if err != nil && !errdefs.IsNotFound(err) {

+		if err != nil && !cerrdefs.IsNotFound(err) {

 			return err

-		} else if errdefs.IsNotFound(err) {

+		} else if cerrdefs.IsNotFound(err) {

 			continue // This snpashot doesn't exist; skip

 		} else if _, ok := info.Labels["containerd.io/snapshot/remote"]; !ok {

 			continue // This isn't a remote snapshot; skip

@@ -1100,7 +1100,7 @@ func (sr *immutableRef) prepareRemoteSnapshotsStargzMode(ctx context.Context, s

 				parentID = r.layerParent.getSnapshotID()

 			}

 			if err := r.cm.Snapshotter.Prepare(ctx, key, parentID, opts...); err != nil {

-				if errdefs.IsAlreadyExists(err) {

+				if cerrdefs.IsAlreadyExists(err) {

 					// Check if the targeting snapshot ID has been prepared as

 					// a remote snapshot in the snapshotter.

 					info, err := r.cm.Snapshotter.Stat(ctx, snapshotID)

@@ -1332,7 +1332,7 @@ func (sr *immutableRef) unlazyLayer(ctx context.Context, dhs DescHandlers, pg pr

 		return err

 	}

 	if err := sr.cm.Snapshotter.Commit(ctx, sr.getSnapshotID(), key); err != nil {

-		if !errors.Is(err, errdefs.ErrAlreadyExists) {

+		if !errors.Is(err, cerrdefs.ErrAlreadyExists) {

 			return err

 		}

 	}

@@ -1391,7 +1391,7 @@ func (sr *immutableRef) release(ctx context.Context) (rerr error) {

 		if sr.equalMutable != nil {

 			sr.equalMutable.release(ctx)

 		} else {

-			if err := sr.cm.LeaseManager.Delete(ctx, leases.Lease{ID: sr.viewLeaseID()}); err != nil && !errdefs.IsNotFound(err) {

+			if err := sr.cm.LeaseManager.Delete(ctx, leases.Lease{ID: sr.viewLeaseID()}); err != nil && !cerrdefs.IsNotFound(err) {

 				return err

 			}

 			sr.mountCache = nil

@@ -1422,7 +1422,7 @@ func (cr *cacheRecord) finalize(ctx context.Context) error {

 		return nil

 	})

 	if err != nil {

-		if !errors.Is(err, errdefs.ErrAlreadyExists) { // migrator adds leases for everything

+		if !errors.Is(err, cerrdefs.ErrAlreadyExists) { // migrator adds leases for everything

 			return errors.Wrap(err, "failed to create lease")

 		}

 	}

@@ -1459,7 +1459,7 @@ func (sr *mutableRef) shouldUpdateLastUsed() bool {

 	return sr.triggerLastUsed

 }

-func (sr *mutableRef) commit(ctx context.Context) (_ *immutableRef, rerr error) {

+func (sr *mutableRef) commit() (_ *immutableRef, rerr error) {

 	if !sr.mutable || len(sr.refs) == 0 {

 		return nil, errors.Wrapf(errInvalid, "invalid mutable ref %p", sr)

 	}

@@ -1518,12 +1518,12 @@ func (sr *mutableRef) Mount(ctx context.Context, readonly bool, s session.Group)

 	var mnt snapshot.Mountable

 	if sr.cm.Snapshotter.Name() == "stargz" && sr.layerParent != nil {

 		if err := sr.layerParent.withRemoteSnapshotLabelsStargzMode(ctx, s, func() {

-			mnt, rerr = sr.mount(ctx, s)

+			mnt, rerr = sr.mount(ctx)

 		}); err != nil {

 			return nil, err

 		}

 	} else {

-		mnt, rerr = sr.mount(ctx, s)

+		mnt, rerr = sr.mount(ctx)

 	}

 	if rerr != nil {

 		return nil, rerr

@@ -1546,7 +1546,7 @@ func (sr *mutableRef) Commit(ctx context.Context) (ImmutableRef, error) {

 	sr.mu.Lock()

 	defer sr.mu.Unlock()

-	return sr.commit(ctx)

+	return sr.commit()

 }

 func (sr *mutableRef) Release(ctx context.Context) error {

@@ -7,8 +7,8 @@ import (

 	"strings"

 	"github.com/containerd/containerd/content"

-	"github.com/containerd/containerd/errdefs"

 	"github.com/containerd/containerd/reference"

+	cerrdefs "github.com/containerd/errdefs"

 	"github.com/moby/buildkit/cache/config"

 	"github.com/moby/buildkit/session"

 	"github.com/moby/buildkit/solver"

@@ -52,7 +52,7 @@ func (sr *immutableRef) GetRemotes(ctx context.Context, createIfNeeded bool, ref

 	}

 	// Search all available remotes that has the topmost blob with the specified

-	// compression with all combination of copmressions

+	// compression with all combination of compressions

 	res := []*solver.Remote{remote}

 	topmost, parentChain := remote.Descriptors[len(remote.Descriptors)-1], remote.Descriptors[:len(remote.Descriptors)-1]

 	vDesc, err := getBlobWithCompression(ctx, sr.cm.ContentStore, topmost, refCfg.Compression.Type)

@@ -301,7 +301,7 @@ type lazyRefProvider struct {

 func (p lazyRefProvider) ReaderAt(ctx context.Context, desc ocispecs.Descriptor) (content.ReaderAt, error) {

 	if desc.Digest != p.desc.Digest {

-		return nil, errdefs.ErrNotFound

+		return nil, cerrdefs.ErrNotFound

 	}

 	if err := p.Unlazy(ctx); err != nil {

 		return nil, err

@@ -311,12 +311,24 @@ func (p lazyRefProvider) ReaderAt(ctx context.Context, desc ocispecs.Descriptor)

 func (p lazyRefProvider) Info(ctx context.Context, dgst digest.Digest) (content.Info, error) {

 	if dgst != p.desc.Digest {

-		return content.Info{}, errdefs.ErrNotFound

+		return content.Info{}, cerrdefs.ErrNotFound

 	}

-	if err := p.Unlazy(ctx); err != nil {

-		return content.Info{}, errdefs.ErrNotFound

+	info, err := p.ref.cm.ContentStore.Info(ctx, dgst)

+	if err == nil {

+		return info, nil

+	}

+

+	if isLazy, err1 := p.ref.isLazy(ctx); err1 != nil {

+		return content.Info{}, err1

+	} else if !isLazy {

+		return content.Info{}, err

 	}

-	return p.ref.cm.ContentStore.Info(ctx, dgst)

+

+	// for lazy records don't unlazy without read request

+	return content.Info{

+		Digest: p.desc.Digest,

+		Size:   p.desc.Size,

+	}, nil

 }

 func (p lazyRefProvider) Unlazy(ctx context.Context) error {

@@ -33,20 +33,24 @@ func init() {

 }

 const (

-	attrScope   = "scope"

-	attrTimeout = "timeout"

-	attrToken   = "token"

-	attrURL     = "url"

-	version     = "1"

+	attrScope      = "scope"

+	attrTimeout    = "timeout"

+	attrToken      = "token"

+	attrURL        = "url"

+	attrRepository = "repository"

+	attrGHToken    = "ghtoken"

+	version        = "1"

 	defaultTimeout = 10 * time.Minute

 )

 type Config struct {

-	Scope   string

-	URL     string

-	Token   string

-	Timeout time.Duration

+	Scope      string

+	URL        string

+	Token      string // token for the Github Cache runtime API

+	GHToken    string // token for the Github REST API

+	Repository string

+	Timeout    time.Duration

 }

 func getConfig(attrs map[string]string) (*Config, error) {

@@ -62,6 +66,7 @@ func getConfig(attrs map[string]string) (*Config, error) {

 	if !ok {

 		return nil, errors.Errorf("token not set for github actions cache")

 	}

+

 	timeout := defaultTimeout

 	if v, ok := attrs[attrTimeout]; ok {

 		var err error

@@ -71,10 +76,12 @@ func getConfig(attrs map[string]string) (*Config, error) {

 		}

 	}

 	return &Config{

-		Scope:   scope,

-		URL:     url,

-		Token:   token,

-		Timeout: timeout,

+		Scope:      scope,

+		URL:        url,

+		Token:      token,

+		Timeout:    timeout,

+		GHToken:    attrs[attrGHToken],

+		Repository: attrs[attrRepository],

 	}, nil

 }

@@ -91,9 +98,11 @@ func ResolveCacheExporterFunc() remotecache.ResolveCacheExporterFunc {

 type exporter struct {

 	solver.CacheExporterTarget

-	chains *v1.CacheChains

-	cache  *actionscache.Cache

-	config *Config

+	chains     *v1.CacheChains

+	cache      *actionscache.Cache

+	config     *Config

+	keyMapOnce sync.Once

+	keyMap     map[string]struct{}

 }

 func NewExporter(c *Config) (remotecache.Exporter, error) {

@@ -118,8 +127,12 @@ func (ce *exporter) Config() remotecache.Config {

 	}

 }

+func (ce *exporter) blobKeyPrefix() string {

+	return "buildkit-blob-" + version + "-"

+}

+

 func (ce *exporter) blobKey(dgst digest.Digest) string {

-	return "buildkit-blob-" + version + "-" + dgst.String()

+	return ce.blobKeyPrefix() + dgst.String()

 }

 func (ce *exporter) indexKey() string {

@@ -133,6 +146,35 @@ func (ce *exporter) indexKey() string {

 	return "index-" + ce.config.Scope + "-" + version + "-" + scope

 }

+func (ce *exporter) initActiveKeyMap(ctx context.Context) {

+	ce.keyMapOnce.Do(func() {

+		if ce.config.Repository == "" || ce.config.GHToken == "" {

+			return

+		}

+		m, err := ce.initActiveKeyMapOnce(ctx)

+		if err != nil {

+			bklog.G(ctx).Errorf("error initializing active key map: %v", err)

+			return

+		}

+		ce.keyMap = m

+	})

+}

+

+func (ce *exporter) initActiveKeyMapOnce(ctx context.Context) (map[string]struct{}, error) {

+	api, err := actionscache.NewRestAPI(ce.config.Repository, ce.config.GHToken, actionscache.Opt{

+		Client:  tracing.DefaultClient,

+		Timeout: ce.config.Timeout,

+	})

+	if err != nil {

+		return nil, err

+	}

+	keys, err := ce.cache.AllKeys(ctx, api, ce.blobKeyPrefix())

+	if err != nil {

+		return nil, err

+	}

+	return keys, nil

+}

+

 func (ce *exporter) Finalize(ctx context.Context) (map[string]string, error) {

 	// res := make(map[string]string)

 	config, descs, err := ce.chains.Marshal(ctx)

@@ -159,13 +201,25 @@ func (ce *exporter) Finalize(ctx context.Context) (map[string]string, error) {

 			return nil, errors.Wrapf(err, "failed to parse uncompressed annotation")

 		}

 		diffID = dgst

+		ce.initActiveKeyMap(ctx)