@@ -8,7 +8,7 @@ import (

 	"github.com/docker/docker/api/types/container"

 	"github.com/docker/docker/api/types/filters"

 	containerpkg "github.com/docker/docker/container"

-	"github.com/docker/docker/pkg/archive"

+	"github.com/moby/go-archive"

 )

 // execBackend includes functions to implement to provide exec functionality.

@@ -18,6 +18,7 @@ import (

 	"github.com/moby/buildkit/snapshot"

 	"github.com/moby/buildkit/util/leaseutil"

 	"github.com/moby/locker"

+	"github.com/moby/sys/user"

 	"github.com/opencontainers/go-digest"

 	"github.com/pkg/errors"

 	bolt "go.etcd.io/bbolt"

@@ -36,7 +37,7 @@ type Opt struct {

 	GraphDriver     graphdriver.Driver

 	LayerStore      layer.Store

 	Root            string

-	IdentityMapping idtools.IdentityMapping

+	IdentityMapping user.IdentityMapping

 }

 type graphIDRegistrar interface {

@@ -112,7 +113,9 @@ func (s *snapshotter) IdentityMapping() *idtools.IdentityMapping {

 	if s.opt.IdentityMapping.Empty() {

 		return nil

 	}

-	return &s.opt.IdentityMapping

+	// TODO: Update this once BuildKit switches from idtools

+	idMap := idtools.FromUserIdentityMapping(s.opt.IdentityMapping)

+	return &idMap

 }

 func (s *snapshotter) Prepare(ctx context.Context, key, parent string, opts ...snapshots.Opt) error {

@@ -494,7 +497,7 @@ type mountable struct {

 	acquire  func() ([]mount.Mount, func() error, error)

 	release  func() error

 	refCount int

-	idmap    idtools.IdentityMapping

+	idmap    user.IdentityMapping

 }

 func (m *mountable) Mount() ([]mount.Mount, func() error, error) {

@@ -544,5 +547,7 @@ func (m *mountable) IdentityMapping() *idtools.IdentityMapping {

 	if m.idmap.Empty() {

 		return nil

 	}

-	return &m.idmap

+	// TODO: Update this once BuildKit switches from idtools

+	idtoolsMap := idtools.FromUserIdentityMapping(m.idmap)

+	return &idtoolsMap

 }

@@ -26,7 +26,6 @@ import (

 	"github.com/docker/docker/errdefs"

 	"github.com/docker/docker/libnetwork"

 	"github.com/docker/docker/opts"

-	"github.com/docker/docker/pkg/idtools"

 	"github.com/docker/docker/pkg/streamformatter"

 	controlapi "github.com/moby/buildkit/api/services/control"

 	"github.com/moby/buildkit/client"

@@ -35,6 +34,7 @@ import (

 	"github.com/moby/buildkit/session"

 	"github.com/moby/buildkit/util/entitlements"

 	"github.com/moby/buildkit/util/tracing"

+	"github.com/moby/sys/user"

 	"github.com/pkg/errors"

 	"golang.org/x/sync/errgroup"

 	"google.golang.org/grpc"

@@ -89,7 +89,7 @@ type Opt struct {

 	RegistryHosts       docker.RegistryHosts

 	BuilderConfig       config.BuilderConfig

 	Rootless            bool

-	IdentityMapping     idtools.IdentityMapping

+	IdentityMapping     user.IdentityMapping

 	DNSConfig           config.DNSConfig

 	ApparmorProfile     string

 	UseSnapshotter      bool

@@ -22,12 +22,13 @@ import (

 	"github.com/moby/buildkit/solver/llbsolver/cdidevices"

 	"github.com/moby/buildkit/solver/pb"

 	"github.com/moby/buildkit/util/network"

+	"github.com/moby/sys/user"

 	"github.com/opencontainers/runtime-spec/specs-go"

 )

 const networkName = "bridge"

-func newExecutor(root, cgroupParent string, net *libnetwork.Controller, dnsConfig *oci.DNSConfig, rootless bool, idmap idtools.IdentityMapping, apparmorProfile string, cdiManager *cdidevices.Manager) (executor.Executor, error) {

+func newExecutor(root, cgroupParent string, net *libnetwork.Controller, dnsConfig *oci.DNSConfig, rootless bool, idmap user.IdentityMapping, apparmorProfile string, cdiManager *cdidevices.Manager) (executor.Executor, error) {

 	netRoot := filepath.Join(root, "net")

 	networkProviders := map[pb.NetMode]network.Provider{

 		pb.NetMode_UNSET: &bridgeProvider{Controller: net, Root: netRoot},

@@ -48,7 +49,9 @@ func newExecutor(root, cgroupParent string, net *libnetwork.Controller, dnsConfi

 	// Returning a non-nil but empty *IdentityMapping breaks BuildKit:

 	// https://github.com/moby/moby/pull/39444

-	pidmap := &idmap

+	// TODO: Remove conversion once buildkit updates

+	idtoolsMap := idtools.FromUserIdentityMapping(idmap)

+	pidmap := &idtoolsMap

 	if idmap.Empty() {

 		pidmap = nil

 	}

@@ -9,14 +9,14 @@ import (

 	"github.com/docker/docker/daemon/config"

 	"github.com/docker/docker/libnetwork"

-	"github.com/docker/docker/pkg/idtools"

 	"github.com/moby/buildkit/executor"

 	"github.com/moby/buildkit/executor/oci"

 	resourcetypes "github.com/moby/buildkit/executor/resources/types"

 	"github.com/moby/buildkit/solver/llbsolver/cdidevices"

+	"github.com/moby/sys/user"

 )

-func newExecutor(_, _ string, _ *libnetwork.Controller, _ *oci.DNSConfig, _ bool, _ idtools.IdentityMapping, _ string, _ *cdidevices.Manager) (executor.Executor, error) {

+func newExecutor(_, _ string, _ *libnetwork.Controller, _ *oci.DNSConfig, _ bool, _ user.IdentityMapping, _ string, _ *cdidevices.Manager) (executor.Executor, error) {

 	return &stubExecutor{}, nil

 }

@@ -16,12 +16,12 @@ import (

 	"github.com/docker/docker/builder"

 	"github.com/docker/docker/builder/remotecontext"

 	"github.com/docker/docker/errdefs"

-	"github.com/docker/docker/pkg/idtools"

 	"github.com/docker/docker/pkg/streamformatter"

 	"github.com/docker/docker/pkg/stringid"

 	"github.com/moby/buildkit/frontend/dockerfile/instructions"

 	"github.com/moby/buildkit/frontend/dockerfile/parser"

 	"github.com/moby/buildkit/frontend/dockerfile/shell"

+	"github.com/moby/sys/user"

 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"

 	"github.com/pkg/errors"

 	"golang.org/x/sync/syncmap"

@@ -47,13 +47,13 @@ const (

 // BuildManager is shared across all Builder objects

 type BuildManager struct {

-	idMapping idtools.IdentityMapping

+	idMapping user.IdentityMapping

 	backend   builder.Backend

 	pathCache pathCache // TODO: make this persistent

 }

 // NewBuildManager creates a BuildManager

-func NewBuildManager(b builder.Backend, identityMapping idtools.IdentityMapping) (*BuildManager, error) {

+func NewBuildManager(b builder.Backend, identityMapping user.IdentityMapping) (*BuildManager, error) {

 	bm := &BuildManager{

 		backend:   b,

 		pathCache: &syncmap.Map{},

@@ -103,7 +103,7 @@ type builderOptions struct {

 	Backend        builder.Backend

 	ProgressWriter backend.ProgressWriter

 	PathCache      pathCache

-	IDMapping      idtools.IdentityMapping

+	IDMapping      user.IdentityMapping

 }

 // Builder is a Dockerfile builder

@@ -118,7 +118,7 @@ type Builder struct {

 	docker builder.Backend

-	idMapping        idtools.IdentityMapping

+	idMapping        user.IdentityMapping

 	disableCommit    bool

 	imageSources     *imageSources

 	pathCache        pathCache

@@ -17,14 +17,14 @@ import (

 	"github.com/docker/docker/builder"

 	"github.com/docker/docker/builder/remotecontext"

 	"github.com/docker/docker/builder/remotecontext/urlutil"

-	"github.com/docker/docker/pkg/archive"

-	"github.com/docker/docker/pkg/idtools"

 	"github.com/docker/docker/pkg/longpath"

 	"github.com/docker/docker/pkg/progress"

 	"github.com/docker/docker/pkg/streamformatter"

 	"github.com/docker/docker/pkg/system"

 	"github.com/moby/buildkit/frontend/dockerfile/instructions"

+	"github.com/moby/go-archive"

 	"github.com/moby/sys/symlink"

+	"github.com/moby/sys/user"

 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"

 	"github.com/pkg/errors"

 )

@@ -446,9 +446,15 @@ func downloadSource(output io.Writer, stdout io.Writer, srcURL string) (remote b

 	return lc, filename, err

 }

+type identity struct {

+	UID int

+	GID int

+	SID string

+}

+

 type copyFileOptions struct {

 	decompress bool

-	identity   *idtools.Identity

+	identity   *identity

 	archiver   *archive.Archiver

 }

@@ -498,7 +504,7 @@ func performCopyForInfo(dest copyInfo, source copyInfo, options copyFileOptions)

 	return copyFile(archiver, srcPath, destPath, options.identity)

 }

-func copyDirectory(archiver *archive.Archiver, source, dest string, identity *idtools.Identity) error {

+func copyDirectory(archiver *archive.Archiver, source, dest string, identity *identity) error {

 	destExists, err := isExistingDirectory(dest)

 	if err != nil {

 		return errors.Wrapf(err, "failed to query destination path")

@@ -513,13 +519,13 @@ func copyDirectory(archiver *archive.Archiver, source, dest string, identity *id

 	return nil

 }

-func copyFile(archiver *archive.Archiver, source, dest string, identity *idtools.Identity) error {

+func copyFile(archiver *archive.Archiver, source, dest string, identity *identity) error {

 	if identity == nil {

 		if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {

 			return err

 		}

 	} else {

-		if err := idtools.MkdirAllAndChownNew(filepath.Dir(dest), 0o755, *identity); err != nil {

+		if err := user.MkdirAllAndChown(filepath.Dir(dest), 0o755, identity.UID, identity.GID, user.WithOnlyNew); err != nil {

 			return errors.Wrapf(err, "failed to create new directory")

 		}

 	}

@@ -7,11 +7,9 @@ import (

 	"path"

 	"path/filepath"

 	"strings"

-

-	"github.com/docker/docker/pkg/idtools"

 )

-func fixPermissions(source, destination string, identity idtools.Identity, overrideSkip bool) error {

+func fixPermissions(source, destination string, id identity, overrideSkip bool) error {

 	var (

 		skipChownRoot bool

 		err           error

@@ -39,7 +37,7 @@ func fixPermissions(source, destination string, identity idtools.Identity, overr

 		}

 		fullpath = filepath.Join(destination, cleaned)

-		return os.Lchown(fullpath, identity.UID, identity.GID)

+		return os.Lchown(fullpath, id.UID, id.GID)

 	})

 }

@@ -8,7 +8,6 @@ import (

 	winio "github.com/Microsoft/go-winio"

 	"github.com/docker/docker/internal/usergroup"

-	"github.com/docker/docker/pkg/idtools"

 	"github.com/docker/docker/pkg/system"

 	"github.com/moby/sys/reexec"

 	"github.com/pkg/errors"

@@ -24,12 +23,12 @@ func init() {

 	reexec.Register("windows-fix-permissions", fixPermissionsReexec)

 }

-func fixPermissions(source, destination string, identity idtools.Identity, _ bool) error {

-	if identity.SID == "" {

+func fixPermissions(source, destination string, id identity, _ bool) error {

+	if id.SID == "" {

 		return nil

 	}

-	cmd := reexec.Command("windows-fix-permissions", source, destination, identity.SID)

+	cmd := reexec.Command("windows-fix-permissions", source, destination, id.SID)

 	output, err := cmd.CombinedOutput()

 	return errors.Wrapf(err, "failed to exec windows-fix-permissions: %s", output)

@@ -7,8 +7,8 @@ import (

 	"testing"

 	"github.com/docker/docker/builder/remotecontext"

-	"github.com/docker/docker/pkg/archive"

 	"github.com/moby/buildkit/frontend/dockerfile/instructions"

+	"github.com/moby/go-archive"

 	"github.com/moby/sys/reexec"

 	"gotest.tools/v3/assert"

 	is "gotest.tools/v3/assert/cmp"

@@ -19,10 +19,10 @@ import (

 	"github.com/docker/docker/builder"

 	networkSettings "github.com/docker/docker/daemon/network"

 	"github.com/docker/docker/image"

-	"github.com/docker/docker/pkg/archive"

-	"github.com/docker/docker/pkg/chrootarchive"

 	"github.com/docker/docker/pkg/stringid"

 	"github.com/docker/go-connections/nat"

+	"github.com/moby/go-archive"

+	"github.com/moby/go-archive/chrootarchive"

 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"

 	"github.com/pkg/errors"

 )

@@ -152,12 +152,13 @@ func (b *Builder) performCopy(ctx context.Context, req dispatchRequest, inst cop

 		return err

 	}

-	identity := b.idMapping.RootPair()

+	uid, gid := b.idMapping.RootPair()

+	id := identity{UID: uid, GID: gid}

 	// if a chown was requested, perform the steps to get the uid, gid

 	// translated (if necessary because of user namespaces), and replace

 	// the root pair with the chown pair for copy operations

 	if inst.chownStr != "" {

-		identity, err = parseChownFlag(ctx, b, state, inst.chownStr, destInfo.root, b.idMapping)

+		id, err = parseChownFlag(ctx, b, state, inst.chownStr, destInfo.root, b.idMapping)

 		if err != nil {

 			if b.options.Platform != "windows" {

 				return errors.Wrapf(err, "unable to convert uid/gid chown string to host mapping")

@@ -173,7 +174,7 @@ func (b *Builder) performCopy(ctx context.Context, req dispatchRequest, inst cop

 			archiver:   b.getArchiver(),

 		}

 		if !inst.preserveOwnership {

-			opts.identity = &identity

+			opts.identity = &id

 		}

 		if err := performCopyForInfo(destInfo, info, opts); err != nil {

 			return errors.Wrapf(err, "failed to copy files")

@@ -6,17 +6,16 @@ import (

 	"strconv"

 	"strings"

-	"github.com/docker/docker/pkg/idtools"

 	"github.com/moby/sys/symlink"

 	"github.com/moby/sys/user"

 	"github.com/pkg/errors"

 )

-func parseChownFlag(ctx context.Context, builder *Builder, state *dispatchState, chown, ctrRootPath string, identityMapping idtools.IdentityMapping) (idtools.Identity, error) {

+func parseChownFlag(ctx context.Context, builder *Builder, state *dispatchState, chown, ctrRootPath string, identityMapping user.IdentityMapping) (identity, error) {

 	var userStr, grpStr string

 	parts := strings.Split(chown, ":")

 	if len(parts) > 2 {

-		return idtools.Identity{}, errors.New("invalid chown string format: " + chown)

+		return identity{}, errors.New("invalid chown string format: " + chown)

 	}

 	if len(parts) == 1 {

 		// if no group specified, use the user spec as group as well

@@ -27,27 +26,27 @@ func parseChownFlag(ctx context.Context, builder *Builder, state *dispatchState,

 	passwdPath, err := symlink.FollowSymlinkInScope(filepath.Join(ctrRootPath, "etc", "passwd"), ctrRootPath)

 	if err != nil {

-		return idtools.Identity{}, errors.Wrap(err, "can't resolve /etc/passwd path in container rootfs")

+		return identity{}, errors.Wrap(err, "can't resolve /etc/passwd path in container rootfs")

 	}

 	groupPath, err := symlink.FollowSymlinkInScope(filepath.Join(ctrRootPath, "etc", "group"), ctrRootPath)

 	if err != nil {

-		return idtools.Identity{}, errors.Wrap(err, "can't resolve /etc/group path in container rootfs")

+		return identity{}, errors.Wrap(err, "can't resolve /etc/group path in container rootfs")

 	}

 	uid, err := lookupUser(userStr, passwdPath)

 	if err != nil {

-		return idtools.Identity{}, errors.Wrap(err, "can't find uid for user "+userStr)

+		return identity{}, errors.Wrap(err, "can't find uid for user "+userStr)

 	}

 	gid, err := lookupGroup(grpStr, groupPath)

 	if err != nil {

-		return idtools.Identity{}, errors.Wrap(err, "can't find gid for group "+grpStr)

+		return identity{}, errors.Wrap(err, "can't find gid for group "+grpStr)

 	}

 	// convert as necessary because of user namespaces

-	chownPair, err := identityMapping.ToHost(idtools.Identity{UID: uid, GID: gid})

+	uid, gid, err = identityMapping.ToHost(uid, gid)

 	if err != nil {

-		return idtools.Identity{}, errors.Wrap(err, "unable to convert uid/gid to host mapping")

+		return identity{}, errors.Wrap(err, "unable to convert uid/gid to host mapping")

 	}

-	return chownPair, nil

+	return identity{UID: uid, GID: gid}, nil

 }

 func lookupUser(userStr, filepath string) (int, error) {

@@ -7,7 +7,7 @@ import (

 	"testing"

 	"github.com/docker/docker/api/types"

-	"github.com/docker/docker/pkg/idtools"

+	"github.com/moby/sys/user"

 	"gotest.tools/v3/assert"

 	is "gotest.tools/v3/assert/cmp"

 )

@@ -28,15 +28,15 @@ othergrp:x:6666:

 		`,

 	}

 	// test mappings for validating use of maps

-	idMaps := []idtools.IDMap{

+	idMaps := []user.IDMap{

 		{

-			ContainerID: 0,

-			HostID:      100000,

-			Size:        65536,

+			ID:       0,

+			ParentID: 100000,

+			Count:    65536,

 		},

 	}

-	remapped := idtools.IdentityMapping{UIDMaps: idMaps, GIDMaps: idMaps}

-	unmapped := idtools.IdentityMapping{}

+	remapped := user.IdentityMapping{UIDMaps: idMaps, GIDMaps: idMaps}

+	unmapped := user.IdentityMapping{}

 	contextDir, cleanup := createTestTempDir(t, "", "builder-chown-parse-test")

 	defer cleanup()

@@ -54,9 +54,9 @@ othergrp:x:6666:

 		builder   *Builder

 		name      string

 		chownStr  string

-		idMapping idtools.IdentityMapping

+		idMapping user.IdentityMapping

 		state     *dispatchState

-		expected  idtools.Identity

+		expected  identity

 	}{

 		{

 			builder:   &Builder{options: &types.ImageBuildOptions{Platform: "linux"}},

@@ -64,7 +64,7 @@ othergrp:x:6666:

 			chownStr:  "1",

 			idMapping: unmapped,

 			state:     &dispatchState{},

-			expected:  idtools.Identity{UID: 1, GID: 1},

+			expected:  identity{UID: 1, GID: 1},

 		},

 		{

 			builder:   &Builder{options: &types.ImageBuildOptions{Platform: "linux"}},

@@ -72,7 +72,7 @@ othergrp:x:6666:

 			chownStr:  "0:1",

 			idMapping: unmapped,

 			state:     &dispatchState{},

-			expected:  idtools.Identity{UID: 0, GID: 1},

+			expected:  identity{UID: 0, GID: 1},

 		},

 		{

 			builder:   &Builder{options: &types.ImageBuildOptions{Platform: "linux"}},

@@ -80,7 +80,7 @@ othergrp:x:6666:

 			chownStr:  "0",

 			idMapping: remapped,

 			state:     &dispatchState{},

-			expected:  idtools.Identity{UID: 100000, GID: 100000},

+			expected:  identity{UID: 100000, GID: 100000},

 		},

 		{

 			builder:   &Builder{options: &types.ImageBuildOptions{Platform: "linux"}},

@@ -88,7 +88,7 @@ othergrp:x:6666:

 			chownStr:  "1:33",

 			idMapping: remapped,

 			state:     &dispatchState{},

-			expected:  idtools.Identity{UID: 100001, GID: 100033},

+			expected:  identity{UID: 100001, GID: 100033},

 		},

 		{

 			builder:   &Builder{options: &types.ImageBuildOptions{Platform: "linux"}},

@@ -96,7 +96,7 @@ othergrp:x:6666:

 			chownStr:  "bin:5555",

 			idMapping: unmapped,

 			state:     &dispatchState{},

-			expected:  idtools.Identity{UID: 1, GID: 5555},

+			expected:  identity{UID: 1, GID: 5555},

 		},

 		{

 			builder:   &Builder{options: &types.ImageBuildOptions{Platform: "linux"}},

@@ -104,7 +104,7 @@ othergrp:x:6666:

 			chownStr:  "0:unicorn",

 			idMapping: remapped,

 			state:     &dispatchState{},

-			expected:  idtools.Identity{UID: 100000, GID: 101002},

+			expected:  identity{UID: 100000, GID: 101002},

 		},

 		{

 			builder:   &Builder{options: &types.ImageBuildOptions{Platform: "linux"}},

@@ -112,7 +112,7 @@ othergrp:x:6666:

 			chownStr:  "unicorn",

 			idMapping: remapped,

 			state:     &dispatchState{},

-			expected:  idtools.Identity{UID: 101001, GID: 101002},

+			expected:  identity{UID: 101001, GID: 101002},

 		},

 	} {

 		t.Run(testcase.name, func(t *testing.T) {

@@ -127,7 +127,7 @@ othergrp:x:6666:

 		builder   *Builder

 		name      string

 		chownStr  string

-		idMapping idtools.IdentityMapping

+		idMapping user.IdentityMapping

 		state     *dispatchState

 		descr     string

 	}{

@@ -14,8 +14,8 @@ import (

 	"github.com/docker/docker/builder/remotecontext"

 	"github.com/docker/docker/image"

 	"github.com/docker/docker/layer"

-	"github.com/docker/docker/pkg/archive"

 	"github.com/docker/go-connections/nat"

+	"github.com/moby/go-archive"

 	"github.com/opencontainers/go-digest"

 	"gotest.tools/v3/assert"

 	is "gotest.tools/v3/assert/cmp"

@@ -12,27 +12,28 @@ import (

 	"github.com/docker/docker/api/types/mount"

 	"github.com/docker/docker/errdefs"

 	"github.com/docker/docker/internal/usergroup"

-	"github.com/docker/docker/pkg/idtools"

 	"github.com/docker/docker/pkg/jsonmessage"

+	"github.com/moby/sys/user"

 	"golang.org/x/sys/windows"

 )

-func parseChownFlag(ctx context.Context, builder *Builder, state *dispatchState, chown, ctrRootPath string, identityMapping idtools.IdentityMapping) (idtools.Identity, error) {

+func parseChownFlag(ctx context.Context, builder *Builder, state *dispatchState, chown, ctrRootPath string, identityMapping user.IdentityMapping) (identity, error) {

 	if builder.options.Platform == "windows" {

 		return getAccountIdentity(ctx, builder, chown, ctrRootPath, state)

 	}

-	return identityMapping.RootPair(), nil

+	uid, gid := identityMapping.RootPair()

+	return identity{UID: uid, GID: gid}, nil

 }

-func getAccountIdentity(ctx context.Context, builder *Builder, accountName string, ctrRootPath string, state *dispatchState) (idtools.Identity, error) {

+func getAccountIdentity(ctx context.Context, builder *Builder, accountName string, ctrRootPath string, state *dispatchState) (identity, error) {

 	// If this is potentially a string SID then attempt to convert it to verify

 	// this, otherwise continue looking for the account.

 	if strings.HasPrefix(accountName, "S-") || strings.HasPrefix(accountName, "s-") {

 		sid, err := windows.StringToSid(accountName)

 		if err == nil {

-			return idtools.Identity{SID: sid.String()}, nil

+			return identity{SID: sid.String()}, nil

 		}

 	}

@@ -41,14 +42,14 @@ func getAccountIdentity(ctx context.Context, builder *Builder, accountName strin

 	// If this is a SID that is built-in and hence the same across all systems then use that.

 	if err == nil && (accType == windows.SidTypeAlias || accType == windows.SidTypeWellKnownGroup) {

-		return idtools.Identity{SID: sid.String()}, nil

+		return identity{SID: sid.String()}, nil

 	}

 	// Check if the account name is one unique to containers.

 	if strings.EqualFold(accountName, "ContainerAdministrator") {

-		return idtools.Identity{SID: usergroup.ContainerAdministratorSidString}, nil

+		return identity{SID: usergroup.ContainerAdministratorSidString}, nil

 	} else if strings.EqualFold(accountName, "ContainerUser") {

-		return idtools.Identity{SID: usergroup.ContainerUserSidString}, nil

+		return identity{SID: usergroup.ContainerUserSidString}, nil

 	}

 	// All other lookups failed, so therefore determine if the account in

@@ -56,7 +57,7 @@ func getAccountIdentity(ctx context.Context, builder *Builder, accountName strin

 	return lookupNTAccount(ctx, builder, accountName, state)

 }

-func lookupNTAccount(ctx context.Context, builder *Builder, accountName string, state *dispatchState) (idtools.Identity, error) {

+func lookupNTAccount(ctx context.Context, builder *Builder, accountName string, state *dispatchState) (identity, error) {

 	source, _ := filepath.Split(os.Args[0])

 	target := "C:\\Docker"

@@ -64,7 +65,7 @@ func lookupNTAccount(ctx context.Context, builder *Builder, accountName string,

 	optionsPlatform, err := platforms.Parse(builder.options.Platform)

 	if err != nil {

-		return idtools.Identity{}, errdefs.InvalidParameter(err)

+		return identity{}, errdefs.InvalidParameter(err)

 	}

 	runConfig := copyRunConfig(state.runConfig,

@@ -85,7 +86,7 @@ func lookupNTAccount(ctx context.Context, builder *Builder, accountName string,

 	container, err := builder.containerManager.Create(ctx, runConfig, hostConfig)

 	if err != nil {

-		return idtools.Identity{}, err

+		return identity{}, err

 	}

 	stdout := new(bytes.Buffer)

@@ -93,15 +94,15 @@ func lookupNTAccount(ctx context.Context, builder *Builder, accountName string,

 	if err := builder.containerManager.Run(ctx, container.ID, stdout, stderr); err != nil {

 		if err, ok := err.(*statusCodeError); ok {

-			return idtools.Identity{}, &jsonmessage.JSONError{

+			return identity{}, &jsonmessage.JSONError{

 				Message: stderr.String(),

 				Code:    err.StatusCode(),

 			}

 		}

-		return idtools.Identity{}, err

+		return identity{}, err

 	}

 	accountSid := stdout.String()

-	return idtools.Identity{SID: accountSid}, nil

+	return identity{SID: accountSid}, nil

 }

@@ -6,11 +6,11 @@ import (

 	"path/filepath"

 	"github.com/docker/docker/builder"

-	"github.com/docker/docker/pkg/archive"

-	"github.com/docker/docker/pkg/chrootarchive"

 	"github.com/docker/docker/pkg/longpath"

 	"github.com/docker/docker/pkg/system"

 	"github.com/docker/docker/pkg/tarsum"

+	"github.com/moby/go-archive"

+	"github.com/moby/go-archive/chrootarchive"

 	"github.com/moby/sys/symlink"

 	"github.com/pkg/errors"

 )

@@ -6,8 +6,8 @@ import (

 	"hash"

 	"os"

-	"github.com/docker/docker/pkg/archive"

 	"github.com/docker/docker/pkg/tarsum"

+	"github.com/moby/go-archive"

 )

 // NewFileHash returns new hash that is used for the builder cache keys

@@ -7,7 +7,7 @@ import (

 	"github.com/containerd/log"

 	"github.com/docker/docker/builder"

 	"github.com/docker/docker/builder/remotecontext/git"

-	"github.com/docker/docker/pkg/archive"

+	"github.com/moby/go-archive"

 )

 // MakeGitContext returns a Context from gitURL that is cloned in a temporary directory.

@@ -6,7 +6,7 @@ import (

 	"testing"

 	"github.com/docker/docker/builder"

-	"github.com/docker/docker/pkg/archive"

+	"github.com/moby/go-archive"

 	"github.com/moby/sys/reexec"

 	"github.com/pkg/errors"

 	"gotest.tools/v3/skip"

@@ -5,7 +5,7 @@ import (

 	"path/filepath"

 	containertypes "github.com/docker/docker/api/types/container"

-	"github.com/docker/docker/pkg/archive"

+	"github.com/moby/go-archive"

 	"github.com/pkg/errors"

 )

@@ -1,8 +1,7 @@

 package daemon // import "github.com/docker/docker/daemon"

 import (

-	"github.com/docker/docker/pkg/archive"

-	"github.com/docker/docker/pkg/idtools"

+	"github.com/moby/go-archive"

 )

 // defaultTarCopyOptions is the setting that is used when unpacking an archive

@@ -10,6 +9,6 @@ import (

 func (daemon *Daemon) defaultTarCopyOptions(noOverwriteDirNonDir bool) *archive.TarOptions {

 	return &archive.TarOptions{

 		NoOverwriteDirNonDir: noOverwriteDirNonDir,

-		IDMap:                idtools.FromUserIdentityMapping(daemon.idMapping),

+		IDMap:                daemon.idMapping,

 	}

 }

@@ -10,8 +10,7 @@ import (

 	"github.com/docker/docker/container"

 	"github.com/docker/docker/errdefs"

-	"github.com/docker/docker/pkg/archive"

-	"github.com/docker/docker/pkg/idtools"

+	"github.com/moby/go-archive"

 	"github.com/moby/sys/user"

 )

@@ -27,7 +26,7 @@ func (daemon *Daemon) tarCopyOptions(ctr *container.Container, noOverwriteDirNon

 	return &archive.TarOptions{

 		NoOverwriteDirNonDir: noOverwriteDirNonDir,

-		ChownOpts:            &idtools.Identity{UID: uid, GID: gid},

+		ChownOpts:            &archive.ChownOpts{UID: uid, GID: gid},

 	}, nil

 }

@@ -12,9 +12,9 @@ import (

 	"github.com/docker/docker/api/types/events"

 	"github.com/docker/docker/container"

 	"github.com/docker/docker/errdefs"

-	"github.com/docker/docker/pkg/archive"

 	"github.com/docker/docker/pkg/ioutils"

 	volumemounts "github.com/docker/docker/volume/mounts"

+	"github.com/moby/go-archive"

 	"github.com/pkg/errors"

 )

@@ -10,9 +10,9 @@ import (

 	"github.com/docker/docker/api/types/events"

 	"github.com/docker/docker/container"

 	"github.com/docker/docker/errdefs"

-	"github.com/docker/docker/pkg/archive"

-	"github.com/docker/docker/pkg/chrootarchive"

 	"github.com/docker/docker/pkg/ioutils"

+	"github.com/moby/go-archive"

+	"github.com/moby/go-archive/chrootarchive"

 )

 // containerStatPath stats the filesystem resource at the specified path in this

@@ -6,7 +6,7 @@ import (

 	"time"

 	"github.com/docker/docker/internal/metrics"

-	"github.com/docker/docker/pkg/archive"

+	"github.com/moby/go-archive"

 )

 // ContainerChanges returns a list of container fs changes

@@ -19,7 +19,6 @@ import (

 	"github.com/docker/docker/errdefs"

 	"github.com/docker/docker/libnetwork"

 	"github.com/docker/docker/libnetwork/drivers/bridge"

-	"github.com/docker/docker/pkg/idtools"

 	"github.com/docker/docker/pkg/process"

 	"github.com/docker/docker/pkg/stringid"

 	"github.com/moby/sys/mount"

@@ -578,5 +577,6 @@ func (daemon *Daemon) setupContainerMountsRoot(ctr *container.Container) error {

 	if err != nil {

 		return err

 	}

-	return idtools.MkdirAllAndChown(p, 0o710, idtools.Identity{UID: idtools.CurrentIdentity().UID, GID: daemon.IdentityMapping().RootPair().GID})

+	_, gid := daemon.IdentityMapping().RootPair()

+	return user.MkdirAllAndChown(p, 0o710, os.Getuid(), gid)

 }

@@ -30,11 +30,11 @@ import (

 	"github.com/docker/docker/image"

 	dimage "github.com/docker/docker/image"

 	"github.com/docker/docker/layer"

-	"github.com/docker/docker/pkg/archive"

 	"github.com/docker/docker/pkg/progress"

 	"github.com/docker/docker/pkg/streamformatter"

 	"github.com/docker/docker/pkg/stringid"

 	imagespec "github.com/moby/docker-image-spec/specs-go/v1"

+	"github.com/moby/go-archive"

 	"github.com/opencontainers/go-digest"

 	"github.com/opencontainers/image-spec/identity"

 	"github.com/opencontainers/image-spec/specs-go"

@@ -7,8 +7,8 @@ import (

 	"github.com/containerd/containerd/v2/core/mount"

 	"github.com/containerd/log"

 	"github.com/docker/docker/container"

-	"github.com/docker/docker/pkg/archive"

 	"github.com/docker/docker/pkg/stringid"

+	"github.com/moby/go-archive"

 )

 func (i *ImageService) Changes(ctx context.Context, ctr *container.Container) ([]archive.Change, error) {

@@ -18,8 +18,8 @@ import (

 	"github.com/containerd/log"

 	"github.com/docker/docker/api/types/backend"

 	"github.com/docker/docker/image"

-	"github.com/docker/docker/pkg/archive"

 	imagespec "github.com/moby/docker-image-spec/specs-go/v1"

+	"github.com/moby/go-archive"

 	"github.com/opencontainers/go-digest"

 	"github.com/opencontainers/image-spec/identity"

 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"

@@ -152,8 +152,8 @@ func (i *ImageService) createDiff(ctx context.Context, name string, sn snapshots

 	if !i.idMapping.Empty() {

 		// The rootfs of the container is remapped if an id mapping exists, we

 		// need to "unremap" it before committing the snapshot

-		rootPair := i.idMapping.RootPair()

-		usernsID := fmt.Sprintf("%s-%d-%d-%s", name, rootPair.UID, rootPair.GID, uniquePart())

+		uid, gid := i.idMapping.RootPair()

+		usernsID := fmt.Sprintf("%s-%d-%d-%s", name, uid, gid, uniquePart())

 		remappedID := usernsID + remapSuffix

 		baseName := name

@@ -18,8 +18,8 @@ import (

 	"github.com/docker/docker/api/types/events"

 	"github.com/docker/docker/daemon/images"

 	"github.com/docker/docker/errdefs"

-	dockerarchive "github.com/docker/docker/pkg/archive"

 	"github.com/docker/docker/pkg/streamformatter"

+	dockerarchive "github.com/moby/go-archive"

 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"

 	"github.com/pkg/errors"

 )

@@ -20,10 +20,10 @@ import (

 	"github.com/docker/docker/builder/dockerfile"

 	"github.com/docker/docker/errdefs"

 	"github.com/docker/docker/image"

-	"github.com/docker/docker/pkg/archive"

 	"github.com/docker/docker/pkg/pools"

 	"github.com/google/uuid"

 	imagespec "github.com/moby/docker-image-spec/specs-go/v1"

+	"github.com/moby/go-archive"

 	"github.com/opencontainers/go-digest"

 	"github.com/opencontainers/image-spec/specs-go"

 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"

@@ -14,7 +14,7 @@ import (

 	"github.com/containerd/platforms"

 	"github.com/docker/docker/errdefs"

 	"github.com/docker/docker/internal/testutils/specialimage"

-	"github.com/docker/docker/pkg/archive"

+	"github.com/moby/go-archive"

 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"

 	"gotest.tools/v3/assert"

 	is "gotest.tools/v3/assert/cmp"

@@ -13,7 +13,6 @@ import (

 	"github.com/containerd/containerd/v2/core/snapshots"

 	"github.com/containerd/continuity/fs"

 	"github.com/containerd/continuity/sysx"

-	"github.com/docker/docker/pkg/idtools"

 )

 const (

@@ -54,12 +53,12 @@ func (i *ImageService) remapRootFS(ctx context.Context, mounts []mount.Mount) er

 				return fmt.Errorf("cannot get underlying data for %s", path)

 			}

-			ids, err := i.idMapping.ToHost(idtools.Identity{UID: int(stat.Uid), GID: int(stat.Gid)})

+			uid, gid, err := i.idMapping.ToHost(int(stat.Uid), int(stat.Gid))

 			if err != nil {

 				return err

 			}