@@ -22,6 +22,7 @@ import (

 	"github.com/pkg/errors"

 	"github.com/sirupsen/logrus"

 	"github.com/tonistiigi/fsutil"

+	fsutiltypes "github.com/tonistiigi/fsutil/types"

 	bolt "go.etcd.io/bbolt"

 	"golang.org/x/sync/singleflight"

 )

@@ -614,7 +615,7 @@ func (s sortableCacheSources) Swap(i, j int) {

 	s[i], s[j] = s[j], s[i]

 }

-func newTarsumHash(stat *fsutil.Stat) (hash.Hash, error) {

+func newTarsumHash(stat *fsutiltypes.Stat) (hash.Hash, error) {

 	fi := &fsutil.StatInfo{Stat: stat}

 	p := stat.Path

 	if fi.IsDir() {

@@ -26,8 +26,8 @@ github.com/imdario/mergo v0.3.6

 golang.org/x/sync 1d60e4601c6fd243af51cc01ddf169918a5407ca

 # buildkit

-github.com/moby/buildkit 8f4dff0d16ea91cb43315d5f5aa4b27f4fe4e1f2

-github.com/tonistiigi/fsutil b19464cd1b6a00773b4f2eb7acf9c30426f9df42

+github.com/moby/buildkit 520201006c9dc676da9cf9655337ac711f7f127d 

+github.com/tonistiigi/fsutil f567071bed2416e4d87d260d3162722651182317

 github.com/grpc-ecosystem/grpc-opentracing 8e809c8a86450a29b90dcc9efbf062d0fe6d9746

 github.com/opentracing/opentracing-go 1361b9cd60be79c4c3a7fa9841b3c132e40066a7

 github.com/google/shlex 6f45313302b9c56850fc17f99e40caebce98c716

@@ -130,7 +130,7 @@ github.com/gogo/protobuf v1.0.0

 github.com/cloudflare/cfssl 1.3.2

 github.com/fernet/fernet-go 1b2437bc582b3cfbb341ee5a29f8ef5b42912ff2

 github.com/google/certificate-transparency-go v1.0.20

-golang.org/x/crypto a2144134853fc9a27a7b1e3eb4f19f1a76df13c9

+golang.org/x/crypto 0709b304e793a5edb4a2c0145f281ecdc20838a4

 golang.org/x/time fbb02b2291d28baffd63558aa44b4b56f178d650

 github.com/hashicorp/go-memdb cb9a474f84cc5e41b273b20c6927680b2a8776ad

 github.com/hashicorp/go-immutable-radix 826af9ccf0feeee615d546d69b11f8e98da8c8f1 git://github.com/tonistiigi/go-immutable-radix.git

@@ -19,6 +19,7 @@ import (

 	digest "github.com/opencontainers/go-digest"

 	"github.com/pkg/errors"

 	"github.com/tonistiigi/fsutil"

+	fstypes "github.com/tonistiigi/fsutil/types"

 )

 var errNotFound = errors.Errorf("not found")

@@ -274,7 +275,7 @@ func (cc *cacheContext) HandleChange(kind fsutil.ChangeKind, p string, fi os.Fil

 		return

 	}

-	stat, ok := fi.Sys().(*fsutil.Stat)

+	stat, ok := fi.Sys().(*fstypes.Stat)

 	if !ok {

 		return errors.Errorf("%s invalid change without stat information", p)

 	}

@@ -8,7 +8,7 @@ import (

 	"path/filepath"

 	"time"

-	"github.com/tonistiigi/fsutil"

+	fstypes "github.com/tonistiigi/fsutil/types"

 )

 // NewFileHash returns new hash that is used for the builder cache keys

@@ -22,7 +22,7 @@ func NewFileHash(path string, fi os.FileInfo) (hash.Hash, error) {

 		}

 	}

-	stat := &fsutil.Stat{

+	stat := &fstypes.Stat{

 		Mode:     uint32(fi.Mode()),

 		Size_:    fi.Size(),

 		ModTime:  fi.ModTime().UnixNano(),

@@ -39,7 +39,7 @@ func NewFileHash(path string, fi os.FileInfo) (hash.Hash, error) {

 	return NewFromStat(stat)

 }

-func NewFromStat(stat *fsutil.Stat) (hash.Hash, error) {

+func NewFromStat(stat *fstypes.Stat) (hash.Hash, error) {

 	fi := &statInfo{stat}

 	hdr, err := tar.FileInfoHeader(fi, stat.Linkname)

 	if err != nil {

@@ -75,7 +75,7 @@ func (tsh *tarsumHash) Reset() {

 }

 type statInfo struct {

-	*fsutil.Stat

+	*fstypes.Stat

 }

 func (s *statInfo) Name() string {

@@ -7,7 +7,7 @@ import (

 	"syscall"

 	"github.com/containerd/continuity/sysx"

-	"github.com/tonistiigi/fsutil"

+	fstypes "github.com/tonistiigi/fsutil/types"

 	"golang.org/x/sys/unix"

 )

@@ -16,7 +16,7 @@ func chmodWindowsTarEntry(perm os.FileMode) os.FileMode {

 	return perm

 }

-func setUnixOpt(path string, fi os.FileInfo, stat *fsutil.Stat) error {

+func setUnixOpt(path string, fi os.FileInfo, stat *fstypes.Stat) error {

 	s := fi.Sys().(*syscall.Stat_t)

 	stat.Uid = s.Uid

@@ -5,7 +5,7 @@ package contenthash

 import (

 	"os"

-	"github.com/tonistiigi/fsutil"

+	fstypes "github.com/tonistiigi/fsutil/types"

 )

 // chmodWindowsTarEntry is used to adjust the file permissions used in tar

@@ -18,6 +18,6 @@ func chmodWindowsTarEntry(perm os.FileMode) os.FileMode {

 	return perm

 }

-func setUnixOpt(path string, fi os.FileInfo, stat *fsutil.Stat) error {

+func setUnixOpt(path string, fi os.FileInfo, stat *fstypes.Stat) error {

 	return nil

 }

deleted file mode 100644

@@ -1,71 +0,0 @@

-package cache

-

-import (

-	"context"

-	"io"

-	"io/ioutil"

-	"os"

-

-	"github.com/containerd/continuity/fs"

-	"github.com/moby/buildkit/snapshot"

-)

-

-type ReadRequest struct {

-	Filename string

-	Range    *FileRange

-}

-

-type FileRange struct {

-	Offset int

-	Length int

-}

-

-func ReadFile(ctx context.Context, ref ImmutableRef, req ReadRequest) ([]byte, error) {

-	mount, err := ref.Mount(ctx, true)

-	if err != nil {

-		return nil, err

-	}

-

-	lm := snapshot.LocalMounter(mount)

-

-	root, err := lm.Mount()

-	if err != nil {

-		return nil, err

-	}

-

-	defer func() {

-		if lm != nil {

-			lm.Unmount()

-		}

-	}()

-

-	fp, err := fs.RootPath(root, req.Filename)

-	if err != nil {

-		return nil, err

-	}

-

-	var dt []byte

-

-	if req.Range == nil {

-		dt, err = ioutil.ReadFile(fp)

-		if err != nil {

-			return nil, err

-		}

-	} else {

-		f, err := os.Open(fp)

-		if err != nil {

-			return nil, err

-		}

-		dt, err = ioutil.ReadAll(io.NewSectionReader(f, int64(req.Range.Offset), int64(req.Range.Length)))

-		f.Close()

-		if err != nil {

-			return nil, err

-		}

-	}

-

-	if err := lm.Unmount(); err != nil {

-		return nil, err

-	}

-	lm = nil

-	return dt, err

-}

new file mode 100644

@@ -0,0 +1,139 @@

+package util

+

+import (

+	"context"

+	"io"

+	"io/ioutil"

+	"os"

+	"path/filepath"

+

+	"github.com/containerd/continuity/fs"

+	"github.com/moby/buildkit/cache"

+	"github.com/moby/buildkit/snapshot"

+	"github.com/pkg/errors"

+	"github.com/tonistiigi/fsutil"

+	fstypes "github.com/tonistiigi/fsutil/types"

+)

+

+type ReadRequest struct {

+	Filename string

+	Range    *FileRange

+}

+

+type FileRange struct {

+	Offset int

+	Length int

+}

+

+func withMount(ctx context.Context, ref cache.ImmutableRef, cb func(string) error) error {

+	mount, err := ref.Mount(ctx, true)

+	if err != nil {

+		return err

+	}

+

+	lm := snapshot.LocalMounter(mount)

+

+	root, err := lm.Mount()

+	if err != nil {

+		return err

+	}

+

+	defer func() {

+		if lm != nil {

+			lm.Unmount()

+		}

+	}()

+

+	if err := cb(root); err != nil {

+		return err

+	}

+

+	if err := lm.Unmount(); err != nil {

+		return err

+	}

+	lm = nil

+	return nil

+}

+

+func ReadFile(ctx context.Context, ref cache.ImmutableRef, req ReadRequest) ([]byte, error) {

+	var dt []byte

+

+	err := withMount(ctx, ref, func(root string) error {

+		fp, err := fs.RootPath(root, req.Filename)

+		if err != nil {

+			return err

+		}

+

+		if req.Range == nil {

+			dt, err = ioutil.ReadFile(fp)

+			if err != nil {

+				return err

+			}

+		} else {

+			f, err := os.Open(fp)

+			if err != nil {

+				return err

+			}

+			dt, err = ioutil.ReadAll(io.NewSectionReader(f, int64(req.Range.Offset), int64(req.Range.Length)))

+			f.Close()

+			if err != nil {

+				return err

+			}

+		}

+		return nil

+	})

+	return dt, err

+}

+

+type ReadDirRequest struct {

+	Path           string

+	IncludePattern string

+}

+

+func ReadDir(ctx context.Context, ref cache.ImmutableRef, req ReadDirRequest) ([]*fstypes.Stat, error) {

+	var (

+		rd []*fstypes.Stat

+		wo fsutil.WalkOpt

+	)

+	if req.IncludePattern != "" {

+		wo.IncludePatterns = append(wo.IncludePatterns, req.IncludePattern)

+	}

+	err := withMount(ctx, ref, func(root string) error {

+		fp, err := fs.RootPath(root, req.Path)

+		if err != nil {

+			return err

+		}

+		return fsutil.Walk(ctx, fp, &wo, func(path string, info os.FileInfo, err error) error {

+			if err != nil {

+				return errors.Wrapf(err, "walking %q", root)

+			}

+			stat, ok := info.Sys().(*fstypes.Stat)

+			if !ok {

+				// This "can't happen(tm)".

+				return errors.Errorf("expected a *fsutil.Stat but got %T", info.Sys())

+			}

+			rd = append(rd, stat)

+

+			if info.IsDir() {

+				return filepath.SkipDir

+			}

+			return nil

+		})

+	})

+	return rd, err

+}

+

+func StatFile(ctx context.Context, ref cache.ImmutableRef, path string) (*fstypes.Stat, error) {

+	var st *fstypes.Stat

+	err := withMount(ctx, ref, func(root string) error {

+		fp, err := fs.RootPath(root, path)

+		if err != nil {

+			return err

+		}

+		if st, err = fsutil.Stat(fp); err != nil {

+			return err

+		}

+		return nil

+	})

+	return st, err

+}

@@ -84,6 +84,16 @@ func (g *gatewayClientForBuild) ReadFile(ctx context.Context, in *gatewayapi.Rea

 	return g.gateway.ReadFile(ctx, in, opts...)

 }

+func (g *gatewayClientForBuild) ReadDir(ctx context.Context, in *gatewayapi.ReadDirRequest, opts ...grpc.CallOption) (*gatewayapi.ReadDirResponse, error) {

+	ctx = buildid.AppendToOutgoingContext(ctx, g.buildID)

+	return g.gateway.ReadDir(ctx, in, opts...)

+}

+

+func (g *gatewayClientForBuild) StatFile(ctx context.Context, in *gatewayapi.StatFileRequest, opts ...grpc.CallOption) (*gatewayapi.StatFileResponse, error) {

+	ctx = buildid.AppendToOutgoingContext(ctx, g.buildID)

+	return g.gateway.StatFile(ctx, in, opts...)

+}

+

 func (g *gatewayClientForBuild) Ping(ctx context.Context, in *gatewayapi.PingRequest, opts ...grpc.CallOption) (*gatewayapi.PongResponse, error) {

 	ctx = buildid.AppendToOutgoingContext(ctx, g.buildID)

 	return g.gateway.Ping(ctx, in, opts...)

@@ -7,6 +7,7 @@ import (

 	"sort"

 	"github.com/moby/buildkit/solver/pb"

+	"github.com/moby/buildkit/util/system"

 	digest "github.com/opencontainers/go-digest"

 	"github.com/pkg/errors"

 )

@@ -142,6 +143,13 @@ func (e *ExecOp) Marshal(c *Constraints) (digest.Digest, []byte, *pb.OpMetadata,

 			e.meta.Env = e.meta.Env.AddOrReplace("SSH_AUTH_SOCK", e.ssh[0].Target)

 		}

 	}

+	if c.Caps != nil {

+		if err := c.Caps.Supports(pb.CapExecMetaSetsDefaultPath); err != nil {

+			e.meta.Env = e.meta.Env.SetDefault("PATH", system.DefaultPathEnv)

+		} else {

+			addCap(&e.constraints, pb.CapExecMetaSetsDefaultPath)

+		}

+	}

 	meta := &pb.Meta{

 		Args: e.meta.Args,

@@ -191,6 +199,14 @@ func (e *ExecOp) Marshal(c *Constraints) (digest.Digest, []byte, *pb.OpMetadata,

 		}

 	}

+	if len(e.secrets) > 0 {

+		addCap(&e.constraints, pb.CapExecMountSecret)

+	}

+

+	if len(e.ssh) > 0 {

+		addCap(&e.constraints, pb.CapExecMountSSH)

+	}

+

 	pop, md := MarshalConstraints(c, &e.constraints)

 	pop.Op = &pb.Op_Exec{

 		Exec: peo,

@@ -258,10 +274,6 @@ func (e *ExecOp) Marshal(c *Constraints) (digest.Digest, []byte, *pb.OpMetadata,

 		peo.Mounts = append(peo.Mounts, pm)

 	}

-	if len(e.secrets) > 0 {

-		addCap(&e.constraints, pb.CapMountSecret)

-	}

-

 	for _, s := range e.secrets {

 		pm := &pb.Mount{

 			Dest:      s.Target,

@@ -488,6 +500,12 @@ func SSHID(id string) SSHOption {

 	})

 }

+func SSHSocketTarget(target string) SSHOption {

+	return sshOptionFunc(func(si *SSHInfo) {

+		si.Target = target

+	})

+}

+

 func SSHSocketOpt(target string, uid, gid, mode int) SSHOption {

 	return sshOptionFunc(func(si *SSHInfo) {

 		si.Target = target

@@ -23,10 +23,6 @@ var (

 	keyNetwork   = contextKeyT("llb.network")

 )

-func addEnv(key, value string) StateOption {

-	return addEnvf(key, value)

-}

-

 func addEnvf(key, value string, v ...interface{}) StateOption {

 	return func(s State) State {

 		return s.WithValue(keyEnv, getEnv(s).AddOrReplace(key, fmt.Sprintf(value, v...)))

@@ -175,6 +171,13 @@ func (e EnvList) AddOrReplace(k, v string) EnvList {

 	return e

 }

+func (e EnvList) SetDefault(k, v string) EnvList {

+	if _, ok := e.Get(k); !ok {

+		e = append(e, KeyValue{key: k, value: v})

+	}

+	return e

+}

+

 func (e EnvList) Delete(k string) EnvList {

 	e = append([]KeyValue(nil), e...)

 	if i, ok := e.Index(k); ok {

@@ -9,7 +9,6 @@ import (

 	"github.com/moby/buildkit/identity"

 	"github.com/moby/buildkit/solver/pb"

 	"github.com/moby/buildkit/util/apicaps"

-	"github.com/moby/buildkit/util/system"

 	digest "github.com/opencontainers/go-digest"

 	specs "github.com/opencontainers/image-spec/specs-go/v1"

 )

@@ -34,7 +33,6 @@ func NewState(o Output) State {

 		ctx: context.Background(),

 	}

 	s = dir("/")(s)

-	s = addEnv("PATH", system.DefaultPathEnv)(s)

 	s = s.ensurePlatform()

 	return s

 }

@@ -19,7 +19,7 @@ import (

 	opentracing "github.com/opentracing/opentracing-go"

 	"github.com/pkg/errors"

 	"github.com/sirupsen/logrus"

-	"github.com/tonistiigi/fsutil"

+	fstypes "github.com/tonistiigi/fsutil/types"

 	"golang.org/x/sync/errgroup"

 )

@@ -256,7 +256,7 @@ func prepareSyncedDirs(def *llb.Definition, localDirs map[string]string) ([]file

 			return nil, errors.Errorf("%s not a directory", d)

 		}

 	}

-	resetUIDAndGID := func(st *fsutil.Stat) bool {

+	resetUIDAndGID := func(st *fstypes.Stat) bool {

 		st.Uid = 0

 		st.Gid = 0

 		return true

@@ -125,3 +125,19 @@ func (gwf *GatewayForwarder) Return(ctx context.Context, req *gwapi.ReturnReques

 	res, err := fwd.Return(ctx, req)

 	return res, err

 }

+

+func (gwf *GatewayForwarder) ReadDir(ctx context.Context, req *gwapi.ReadDirRequest) (*gwapi.ReadDirResponse, error) {

+	fwd, err := gwf.lookupForwarder(ctx)

+	if err != nil {

+		return nil, errors.Wrap(err, "forwarding ReadDir")

+	}

+	return fwd.ReadDir(ctx, req)

+}

+

+func (gwf *GatewayForwarder) StatFile(ctx context.Context, req *gwapi.StatFileRequest) (*gwapi.StatFileResponse, error) {

+	fwd, err := gwf.lookupForwarder(ctx)

+	if err != nil {

+		return nil, errors.Wrap(err, "forwarding StatFile")

+	}

+	return fwd.StatFile(ctx, req)

+}

@@ -13,7 +13,7 @@ import (

 )

 const hostsContent = `

-127.0.0.1	localhost

+127.0.0.1	localhost buildkitsandbox

 ::1	localhost ip6-localhost ip6-loopback

 `

@@ -44,11 +44,21 @@ func GenerateSpec(ctx context.Context, meta executor.Meta, mounts []executor.Mou

 	s.Process.Args = meta.Args

 	s.Process.Env = meta.Env

 	s.Process.Cwd = meta.Cwd

+	s.Process.Rlimits = nil // reset open files limit

+	s.Hostname = "buildkitsandbox"

 	s.Mounts = GetMounts(ctx,

 		withROBind(resolvConf, "/etc/resolv.conf"),

 		withROBind(hostsFile, "/etc/hosts"),

 	)

+

+	s.Mounts = append(s.Mounts, specs.Mount{

+		Destination: "/sys/fs/cgroup",

+		Type:        "cgroup",

+		Source:      "cgroup",

+		Options:     []string{"ro", "nosuid", "noexec", "nodev"},

+	})

+

 	// TODO: User

 	sm := &submounts{}

@@ -85,6 +85,10 @@ func New(opt Opt, networkProviders map[pb.NetMode]network.Provider) (executor.Ex

 		return nil, err

 	}

+	// clean up old hosts/resolv.conf file. ignore errors

+	os.RemoveAll(filepath.Join(root, "hosts"))

+	os.RemoveAll(filepath.Join(root, "resolv.conf"))

+

 	runtime := &runc.Runc{

 		Command:      cmd,

 		Log:          filepath.Join(root, "runc-log.json"),

@@ -96,10 +96,7 @@ func Build(ctx context.Context, c client.Client) (*client.Result, error) {

 		}

 	}

-	name := "load Dockerfile"

-	if filename != "Dockerfile" {

-		name += " from " + filename

-	}

+	name := "load build definition from " + filename

 	src := llb.Local(LocalNameDockerfile,

 		llb.IncludePatterns([]string{filename}),

@@ -608,8 +608,10 @@ func dispatchRun(d *dispatchState, c *instructions.RunCommand, proxy *llb.ProxyE

 	if c.PrependShell {

 		args = withShell(d.image, args)

 	}

+	env := d.state.Env()

 	opt := []llb.RunOption{llb.Args(args)}

 	for _, arg := range d.buildArgs {

+		env = append(env, fmt.Sprintf("%s=%s", arg.Key, arg.ValueString()))

 		opt = append(opt, llb.AddEnv(arg.Key, arg.ValueString()))

 	}

 	opt = append(opt, dfCmd(c))

@@ -625,7 +627,7 @@ func dispatchRun(d *dispatchState, c *instructions.RunCommand, proxy *llb.ProxyE

 		return err

 	}

 	opt = append(opt, runMounts...)

-	opt = append(opt, llb.WithCustomName(prefixCommand(d, uppercaseCmd(processCmdEnv(dopt.shlex, c.String(), d.state.Run(opt...).Env())), d.prefixPlatform, d.state.GetPlatform())))

+	opt = append(opt, llb.WithCustomName(prefixCommand(d, uppercaseCmd(processCmdEnv(dopt.shlex, c.String(), env)), d.prefixPlatform, d.state.GetPlatform())))

 	for _, h := range dopt.extraHosts {

 		opt = append(opt, llb.AddExtraHost(h.Host, h.IP))

 	}

new file mode 100644

@@ -0,0 +1,13 @@

+// +build dfrunmount,!dfssh

+

+package dockerfile2llb

+

+import (

+	"github.com/moby/buildkit/client/llb"

+	"github.com/moby/buildkit/frontend/dockerfile/instructions"

+	"github.com/pkg/errors"

+)

+

+func dispatchSSH(m *instructions.Mount) (llb.RunOption, error) {

+	return nil, errors.Errorf("ssh mounts not allowed")

+}

@@ -65,6 +65,14 @@ func dispatchRunMounts(d *dispatchState, c *instructions.RunCommand, sources []*

 			out = append(out, secret)

 			continue

 		}

+		if mount.Type == instructions.MountTypeSSH {

+			ssh, err := dispatchSSH(mount)

+			if err != nil {

+				return nil, err

+			}

+			out = append(out, ssh)

+			continue

+		}

 		if mount.ReadOnly {

 			mountOpts = append(mountOpts, llb.Readonly)

 		}

new file mode 100644

@@ -0,0 +1,27 @@

+// +build dfssh dfextall

+

+package dockerfile2llb

+

+import (

+	"github.com/moby/buildkit/client/llb"

+	"github.com/moby/buildkit/frontend/dockerfile/instructions"

+	"github.com/pkg/errors"

+)

+

+func dispatchSSH(m *instructions.Mount) (llb.RunOption, error) {

+	if m.Source != "" {

+		return nil, errors.Errorf("ssh does not support source")

+	}

+	opts := []llb.SSHOption{llb.SSHID(m.CacheID)}

+

+	if m.Target != "" {

+		// TODO(AkihiroSuda): support specifying permission bits

+		opts = append(opts, llb.SSHSocketTarget(m.Target))

+	}

+

+	if !m.Required {

+		opts = append(opts, llb.SSHOptional)

+	}

+

+	return llb.AddSSHSocket(opts...), nil

+}

@@ -1,4 +1,4 @@

-// +build !dfsecrets

+// +build !dfsecrets,!dfextall

 package instructions

new file mode 100644

@@ -0,0 +1,7 @@

+// +build !dfssh,!dfextall

+

+package instructions

+

+func isSSHMountsSupported() bool {

+	return false

+}

@@ -14,12 +14,14 @@ const MountTypeBind = "bind"

 const MountTypeCache = "cache"

 const MountTypeTmpfs = "tmpfs"

 const MountTypeSecret = "secret"

+const MountTypeSSH = "ssh"

 var allowedMountTypes = map[string]struct{}{

 	MountTypeBind:   {},

 	MountTypeCache:  {},

 	MountTypeTmpfs:  {},

 	MountTypeSecret: {},

+	MountTypeSSH:    {},

 }

 const MountSharingShared = "shared"

@@ -47,6 +49,11 @@ func isValidMountType(s string) bool {

 			return false

 		}

 	}

+	if s == "ssh" {

+		if !isSSHMountsSupported() {

+			return false

+		}

+	}

 	_, ok := allowedMountTypes[s]

 	return ok

 }

new file mode 100644

@@ -0,0 +1,7 @@

+// +build dfssh dfextall

+

+package instructions

+

+func isSSHMountsSupported() bool {

+	return true

+}

@@ -7,6 +7,7 @@ import (

 	"github.com/moby/buildkit/util/apicaps"

 	digest "github.com/opencontainers/go-digest"

 	specs "github.com/opencontainers/image-spec/specs-go/v1"

+	fstypes "github.com/tonistiigi/fsutil/types"

 )

 type Client interface {

@@ -17,8 +18,8 @@ type Client interface {

 type Reference interface {

 	ReadFile(ctx context.Context, req ReadRequest) ([]byte, error)

-	// StatFile(ctx context.Context, req StatRequest) (*StatResponse, error)

-	// ReadDir(ctx context.Context, req ReadDirRequest) ([]*StatResponse, error)

+	StatFile(ctx context.Context, req StatRequest) (*fstypes.Stat, error)

+	ReadDir(ctx context.Context, req ReadDirRequest) ([]*fstypes.Stat, error)

 }

 type ReadRequest struct {

@@ -31,6 +32,15 @@ type FileRange struct {

 	Length int

 }

+type ReadDirRequest struct {

+	Path           string

+	IncludePattern string

+}

+

+type StatRequest struct {

+	Path string

+}

+

 // SolveRequest is same as frontend.SolveRequest but avoiding dependency

 type SolveRequest struct {

 	Definition      *pb.Definition

@@ -5,6 +5,7 @@ import (

 	"sync"

 	"github.com/moby/buildkit/cache"

+	cacheutil "github.com/moby/buildkit/cache/util"

 	clienttypes "github.com/moby/buildkit/client"

 	"github.com/moby/buildkit/frontend"

 	"github.com/moby/buildkit/frontend/gateway/client"

@@ -15,6 +16,7 @@ import (

 	"github.com/moby/buildkit/util/apicaps"

 	"github.com/moby/buildkit/worker"

 	"github.com/pkg/errors"

+	fstypes "github.com/tonistiigi/fsutil/types"

 )

 func llbBridgeToGatewayClient(ctx context.Context, llbBridge frontend.FrontendLLBBridge, opts map[string]string, workerInfos []clienttypes.WorkerInfo) (*bridgeClient, error) {

@@ -136,16 +138,36 @@ func (r *ref) ReadFile(ctx context.Context, req client.ReadRequest) ([]byte, err

 	if err != nil {

 		return nil, err

 	}

-	newReq := cache.ReadRequest{

+	newReq := cacheutil.ReadRequest{

 		Filename: req.Filename,

 	}

 	if r := req.Range; r != nil {

-		newReq.Range = &cache.FileRange{

+		newReq.Range = &cacheutil.FileRange{

 			Offset: r.Offset,

 			Length: r.Length,

 		}

 	}

-	return cache.ReadFile(ctx, ref, newReq)

+	return cacheutil.ReadFile(ctx, ref, newReq)

+}

+

+func (r *ref) ReadDir(ctx context.Context, req client.ReadDirRequest) ([]*fstypes.Stat, error) {

+	ref, err := r.getImmutableRef()

+	if err != nil {

+		return nil, err

+	}

+	newReq := cacheutil.ReadDirRequest{

+		Path:           req.Path,

+		IncludePattern: req.IncludePattern,

+	}

+	return cacheutil.ReadDir(ctx, ref, newReq)

+}

+

+func (r *ref) StatFile(ctx context.Context, req client.StatRequest) (*fstypes.Stat, error) {

+	ref, err := r.getImmutableRef()

+	if err != nil {

+		return nil, err

+	}

+	return cacheutil.StatFile(ctx, ref, req.Path)

 }

 func (r *ref) getImmutableRef() (cache.ImmutableRef, error) {

@@ -14,6 +14,7 @@ import (

 	"github.com/docker/distribution/reference"

 	apitypes "github.com/moby/buildkit/api/types"

 	"github.com/moby/buildkit/cache"

+	cacheutil "github.com/moby/buildkit/cache/util"

 	"github.com/moby/buildkit/client"

 	"github.com/moby/buildkit/client/llb"

 	"github.com/moby/buildkit/executor"

@@ -479,24 +480,24 @@ func (lbf *llbBridgeForwarder) ReadFile(ctx context.Context, req *pb.ReadFileReq

 		return nil, errors.Errorf("no such ref: %v", req.Ref)

 	}

 	if ref == nil {

-		return nil, errors.Wrapf(os.ErrNotExist, "%s no found", req.FilePath)

+		return nil, errors.Wrapf(os.ErrNotExist, "%s not found", req.FilePath)

 	}

 	workerRef, ok := ref.Sys().(*worker.WorkerRef)

 	if !ok {

 		return nil, errors.Errorf("invalid ref: %T", ref.Sys())

 	}

-	newReq := cache.ReadRequest{

+	newReq := cacheutil.ReadRequest{

 		Filename: req.FilePath,

 	}

 	if r := req.Range; r != nil {

-		newReq.Range = &cache.FileRange{

+		newReq.Range = &cacheutil.FileRange{

 			Offset: int(r.Offset),

 			Length: int(r.Length),

 		}

 	}

-	dt, err := cache.ReadFile(ctx, workerRef.ImmutableRef, newReq)

+	dt, err := cacheutil.ReadFile(ctx, workerRef.ImmutableRef, newReq)

 	if err != nil {

 		return nil, err

 	}

@@ -504,6 +505,58 @@ func (lbf *llbBridgeForwarder) ReadFile(ctx context.Context, req *pb.ReadFileReq

 	return &pb.ReadFileResponse{Data: dt}, nil

 }

+func (lbf *llbBridgeForwarder) ReadDir(ctx context.Context, req *pb.ReadDirRequest) (*pb.ReadDirResponse, error) {

+	ctx = tracing.ContextWithSpanFromContext(ctx, lbf.callCtx)

+	lbf.mu.Lock()

+	ref, ok := lbf.refs[req.Ref]

+	lbf.mu.Unlock()

+	if !ok {

+		return nil, errors.Errorf("no such ref: %v", req.Ref)

+	}

+	if ref == nil {

+		return nil, errors.Wrapf(os.ErrNotExist, "%s not found", req.DirPath)

+	}

+	workerRef, ok := ref.Sys().(*worker.WorkerRef)

+	if !ok {

+		return nil, errors.Errorf("invalid ref: %T", ref.Sys())

+	}

+

+	newReq := cacheutil.ReadDirRequest{

+		Path:           req.DirPath,

+		IncludePattern: req.IncludePattern,

+	}

+	entries, err := cacheutil.ReadDir(ctx, workerRef.ImmutableRef, newReq)

+	if err != nil {