@@ -75,6 +75,7 @@ type Opt struct {

 	BuilderConfig       config.BuilderConfig

 	Rootless            bool

 	IdentityMapping     *idtools.IdentityMapping

+	DNSConfig           config.DNSConfig

 }

 // Builder can build using BuildKit backend

@@ -113,7 +113,9 @@ func newController(rt http.RoundTripper, opt Opt) (*control.Controller, error) {

 		return nil, err

 	}

-	exec, err := newExecutor(root, opt.DefaultCgroupParent, opt.NetworkController, opt.Rootless, opt.IdentityMapping)

+	dns := getDNSConfig(opt.DNSConfig)

+

+	exec, err := newExecutor(root, opt.DefaultCgroupParent, opt.NetworkController, dns, opt.Rootless, opt.IdentityMapping)

 	if err != nil {

 		return nil, err

 	}

@@ -8,9 +8,11 @@ import (

 	"strconv"

 	"sync"

+	"github.com/docker/docker/daemon/config"

 	"github.com/docker/docker/pkg/idtools"

 	"github.com/docker/libnetwork"

 	"github.com/moby/buildkit/executor"

+	"github.com/moby/buildkit/executor/oci"

 	"github.com/moby/buildkit/executor/runcexecutor"

 	"github.com/moby/buildkit/identity"

 	"github.com/moby/buildkit/solver/pb"

@@ -21,7 +23,7 @@ import (

 const networkName = "bridge"

-func newExecutor(root, cgroupParent string, net libnetwork.NetworkController, rootless bool, idmap *idtools.IdentityMapping) (executor.Executor, error) {

+func newExecutor(root, cgroupParent string, net libnetwork.NetworkController, dnsConfig *oci.DNSConfig, rootless bool, idmap *idtools.IdentityMapping) (executor.Executor, error) {

 	networkProviders := map[pb.NetMode]network.Provider{

 		pb.NetMode_UNSET: &bridgeProvider{NetworkController: net, Root: filepath.Join(root, "net")},

 		pb.NetMode_HOST:  network.NewHostProvider(),

@@ -34,6 +36,7 @@ func newExecutor(root, cgroupParent string, net libnetwork.NetworkController, ro

 		Rootless:            rootless,

 		NoPivot:             os.Getenv("DOCKER_RAMDISK") != "",

 		IdentityMapping:     idmap,

+		DNS:                 dnsConfig,

 	}, networkProviders)

 }

@@ -117,3 +120,14 @@ func (iface *lnInterface) Close() error {

 	}

 	return iface.err

 }

+

+func getDNSConfig(cfg config.DNSConfig) *oci.DNSConfig {

+	if cfg.DNS != nil || cfg.DNSSearch != nil || cfg.DNSOptions != nil {

+		return &oci.DNSConfig{

+			Nameservers:   cfg.DNS,

+			SearchDomains: cfg.DNSSearch,

+			Options:       cfg.DNSOptions,

+		}

+	}

+	return nil

+}

@@ -5,13 +5,15 @@ import (

 	"errors"

 	"io"

+	"github.com/docker/docker/daemon/config"

 	"github.com/docker/docker/pkg/idtools"

 	"github.com/docker/libnetwork"

 	"github.com/moby/buildkit/cache"

 	"github.com/moby/buildkit/executor"

+	"github.com/moby/buildkit/executor/oci"

 )

-func newExecutor(_, _ string, _ libnetwork.NetworkController, _ bool, _ *idtools.IdentityMapping) (executor.Executor, error) {

+func newExecutor(_, _ string, _ libnetwork.NetworkController, _ *oci.DNSConfig, _ bool, _ *idtools.IdentityMapping) (executor.Executor, error) {

 	return &winExecutor{}, nil

 }

@@ -21,3 +23,7 @@ type winExecutor struct {

 func (e *winExecutor) Exec(ctx context.Context, meta executor.Meta, rootfs cache.Mountable, mounts []executor.Mount, stdin io.ReadCloser, stdout, stderr io.WriteCloser) error {

 	return errors.New("buildkit executor not implemented for windows")

 }

+

+func getDNSConfig(config.DNSConfig) *oci.DNSConfig {

+	return nil

+}

@@ -319,6 +319,7 @@ func newRouterOptions(config *config.Config, d *daemon.Daemon) (routerOptions, e

 		BuilderConfig:       config.Builder,

 		Rootless:            d.Rootless(),

 		IdentityMapping:     d.IdentityMapping(),

+		DNSConfig:           config.DNSConfig,

 	})

 	if err != nil {

 		return opts, err

@@ -109,6 +109,13 @@ type CommonTLSOptions struct {

 	KeyFile  string `json:"tlskey,omitempty"`

 }

+// DNSConfig defines the DNS configurations.

+type DNSConfig struct {

+	DNS        []string `json:"dns,omitempty"`

+	DNSOptions []string `json:"dns-opts,omitempty"`

+	DNSSearch  []string `json:"dns-search,omitempty"`

+}

+

 // CommonConfig defines the configuration of a docker daemon which is

 // common across platforms.

 // It includes json tags to deserialize configuration from a file

@@ -119,9 +126,6 @@ type CommonConfig struct {

 	AutoRestart           bool                      `json:"-"`

 	Context               map[string][]string       `json:"-"`

 	DisableBridge         bool                      `json:"-"`

-	DNS                   []string                  `json:"dns,omitempty"`

-	DNSOptions            []string                  `json:"dns-opts,omitempty"`

-	DNSSearch             []string                  `json:"dns-search,omitempty"`

 	ExecOptions           []string                  `json:"exec-opts,omitempty"`

 	GraphDriver           string                    `json:"storage-driver,omitempty"`

 	GraphOptions          []string                  `json:"storage-opts,omitempty"`

@@ -200,6 +204,7 @@ type CommonConfig struct {

 	MetricsAddress string `json:"metrics-addr"`

+	DNSConfig

 	LogConfig

 	BridgeConfig // bridgeConfig holds bridge network specific configuration.

 	NetworkConfig

@@ -244,28 +244,36 @@ func TestValidateConfigurationErrors(t *testing.T) {

 		{

 			config: &Config{

 				CommonConfig: CommonConfig{

-					DNS: []string{"1.1.1.1o"},

+					DNSConfig: DNSConfig{

+						DNS: []string{"1.1.1.1o"},

+					},

 				},

 			},

 		},

 		{

 			config: &Config{

 				CommonConfig: CommonConfig{

-					DNS: []string{"2.2.2.2", "1.1.1.1o"},

+					DNSConfig: DNSConfig{

+						DNS: []string{"2.2.2.2", "1.1.1.1o"},

+					},

 				},

 			},

 		},

 		{

 			config: &Config{

 				CommonConfig: CommonConfig{

-					DNSSearch: []string{"123456"},

+					DNSConfig: DNSConfig{

+						DNSSearch: []string{"123456"},

+					},

 				},

 			},

 		},

 		{

 			config: &Config{

 				CommonConfig: CommonConfig{

-					DNSSearch: []string{"a.b.c", "123456"},

+					DNSConfig: DNSConfig{

+						DNSSearch: []string{"a.b.c", "123456"},

+					},

 				},

 			},

 		},

@@ -329,14 +337,18 @@ func TestValidateConfiguration(t *testing.T) {

 		{

 			config: &Config{

 				CommonConfig: CommonConfig{

-					DNS: []string{"1.1.1.1"},

+					DNSConfig: DNSConfig{

+						DNS: []string{"1.1.1.1"},

+					},

 				},

 			},

 		},

 		{

 			config: &Config{

 				CommonConfig: CommonConfig{

-					DNSSearch: []string{"a.b.c"},

+					DNSConfig: DNSConfig{

+						DNSSearch: []string{"a.b.c"},

+					},

 				},

 			},

 		},

@@ -27,7 +27,7 @@ github.com/imdario/mergo                            7c29201646fa3de8506f70121347

 golang.org/x/sync                                   e225da77a7e68af35c70ccbf71af2b83e6acac3c

 # buildkit

-github.com/moby/buildkit                            c24275065aca6605bd83c57c6735510f4ebeb6d9

+github.com/moby/buildkit                            a258bd18b2c55aac4e8a10a3074757d66d45cef6

 github.com/tonistiigi/fsutil                        3bbb99cdbd76619ab717299830c60f6f2a533a6b

 github.com/grpc-ecosystem/grpc-opentracing          8e809c8a86450a29b90dcc9efbf062d0fe6d9746

 github.com/opentracing/opentracing-go               1361b9cd60be79c4c3a7fa9841b3c132e40066a7

@@ -299,7 +299,7 @@ Run `make images` to build the images as `moby/buildkit:local` and `moby/buildki

 If you are running `moby/buildkit:master` or `moby/buildkit:master-rootless` as a Docker/Kubernetes container, you can use special `BUILDKIT_HOST` URL for connecting to the BuildKit daemon in the container:

 ```

-export BUILDKIT_HOST=docker://<container>

+export BUILDKIT_HOST=docker-container://<container>

 ```

 ```

@@ -157,14 +157,14 @@ func (cm *cacheManager) get(ctx context.Context, id string, fromSnapshotter bool

 func (cm *cacheManager) getRecord(ctx context.Context, id string, fromSnapshotter bool, opts ...RefOption) (cr *cacheRecord, retErr error) {

 	if rec, ok := cm.records[id]; ok {

 		if rec.isDead() {

-			return nil, errNotFound

+			return nil, errors.Wrapf(errNotFound, "failed to get dead record %s", id)

 		}

 		return rec, nil

 	}

 	md, ok := cm.md.Get(id)

 	if !ok && !fromSnapshotter {

-		return nil, errNotFound

+		return nil, errors.WithStack(errNotFound)

 	}

 	if mutableID := getEqualMutable(md); mutableID != "" {

 		mutable, err := cm.getRecord(ctx, mutableID, fromSnapshotter)

@@ -222,7 +222,7 @@ func (cm *cacheManager) getRecord(ctx context.Context, id string, fromSnapshotte

 		if err := rec.remove(ctx, true); err != nil {

 			return nil, err

 		}

-		return nil, errNotFound

+		return nil, errors.Wrapf(errNotFound, "failed to get deleted record %s", id)

 	}

 	if err := initializeMetadata(rec, opts...); err != nil {

@@ -330,14 +330,14 @@ func (cm *cacheManager) Prune(ctx context.Context, ch chan client.UsageInfo, opt

 func (cm *cacheManager) pruneOnce(ctx context.Context, ch chan client.UsageInfo, opt client.PruneInfo) error {

 	filter, err := filters.ParseAll(opt.Filter...)

 	if err != nil {

-		return err

+		return errors.Wrapf(err, "failed to parse prune filters %v", opt.Filter)

 	}

 	var check ExternalRefChecker

 	if f := cm.PruneRefChecker; f != nil && (!opt.All || len(opt.Filter) > 0) {

 		c, err := f()

 		if err != nil {

-			return err

+			return errors.WithStack(err)

 		}

 		check = c

 	}

@@ -549,7 +549,7 @@ func (cm *cacheManager) markShared(m map[string]*cacheUsageInfo) error {

 	}

 	c, err := cm.PruneRefChecker()

 	if err != nil {

-		return err

+		return errors.WithStack(err)

 	}

 	var markAllParentsShared func(string)

@@ -590,7 +590,7 @@ type cacheUsageInfo struct {

 func (cm *cacheManager) DiskUsage(ctx context.Context, opt client.DiskUsageInfo) ([]*client.UsageInfo, error) {

 	filter, err := filters.ParseAll(opt.Filter...)

 	if err != nil {

-		return nil, err

+		return nil, errors.Wrapf(err, "failed to parse diskusage filters %v", opt.Filter)

 	}

 	cm.mu.Lock()

@@ -55,7 +55,7 @@ func (s *Store) All() ([]*StorageItem, error) {

 			return nil

 		})

 	})

-	return out, err

+	return out, errors.WithStack(err)

 }

 func (s *Store) Probe(index string) (bool, error) {

@@ -77,7 +77,7 @@ func (s *Store) Probe(index string) (bool, error) {

 		}

 		return nil

 	})

-	return exists, err

+	return exists, errors.WithStack(err)

 }

 func (s *Store) Search(index string) ([]*StorageItem, error) {

@@ -114,7 +114,7 @@ func (s *Store) Search(index string) ([]*StorageItem, error) {

 		}

 		return nil

 	})

-	return out, err

+	return out, errors.WithStack(err)

 }

 func (s *Store) View(id string, fn func(b *bolt.Bucket) error) error {

@@ -132,7 +132,7 @@ func (s *Store) View(id string, fn func(b *bolt.Bucket) error) error {

 }

 func (s *Store) Clear(id string) error {

-	return s.db.Update(func(tx *bolt.Tx) error {

+	return errors.WithStack(s.db.Update(func(tx *bolt.Tx) error {

 		external := tx.Bucket([]byte(externalBucket))

 		if external != nil {

 			external.DeleteBucket([]byte(id))

@@ -160,21 +160,21 @@ func (s *Store) Clear(id string) error {

 			}

 		}

 		return main.DeleteBucket([]byte(id))

-	})

+	}))

 }

 func (s *Store) Update(id string, fn func(b *bolt.Bucket) error) error {

-	return s.db.Update(func(tx *bolt.Tx) error {

+	return errors.WithStack(s.db.Update(func(tx *bolt.Tx) error {

 		b, err := tx.CreateBucketIfNotExists([]byte(mainBucket))

 		if err != nil {

-			return err

+			return errors.WithStack(err)

 		}

 		b, err = b.CreateBucketIfNotExists([]byte(id))

 		if err != nil {

-			return err

+			return errors.WithStack(err)

 		}

 		return fn(b)

-	})

+	}))

 }

 func (s *Store) Get(id string) (*StorageItem, bool) {

@@ -200,7 +200,7 @@ func (s *Store) Get(id string) (*StorageItem, bool) {

 }

 func (s *Store) Close() error {

-	return s.db.Close()

+	return errors.WithStack(s.db.Close())

 }

 type StorageItem struct {

@@ -222,13 +222,13 @@ func newStorageItem(id string, b *bolt.Bucket, s *Store) (*StorageItem, error) {

 			var sv Value

 			if len(v) > 0 {

 				if err := json.Unmarshal(v, &sv); err != nil {

-					return err

+					return errors.WithStack(err)

 				}

 				si.values[string(k)] = &sv

 			}

 			return nil

 		}); err != nil {

-			return si, err

+			return si, errors.WithStack(err)

 		}

 	}

 	return si, nil

@@ -283,23 +283,23 @@ func (s *StorageItem) GetExternal(k string) ([]byte, error) {

 		return nil

 	})

 	if err != nil {

-		return nil, err

+		return nil, errors.WithStack(err)

 	}

 	return dt, nil

 }

 func (s *StorageItem) SetExternal(k string, dt []byte) error {

-	return s.storage.db.Update(func(tx *bolt.Tx) error {

+	return errors.WithStack(s.storage.db.Update(func(tx *bolt.Tx) error {

 		b, err := tx.CreateBucketIfNotExists([]byte(externalBucket))

 		if err != nil {

-			return err

+			return errors.WithStack(err)

 		}

 		b, err = b.CreateBucketIfNotExists([]byte(s.id))

 		if err != nil {

-			return err

+			return errors.WithStack(err)

 		}

 		return b.Put([]byte(k), dt)

-	})

+	}))

 }

 func (s *StorageItem) Queue(fn func(b *bolt.Bucket) error) {

@@ -311,15 +311,15 @@ func (s *StorageItem) Queue(fn func(b *bolt.Bucket) error) {

 func (s *StorageItem) Commit() error {

 	s.mu.Lock()

 	defer s.mu.Unlock()

-	return s.Update(func(b *bolt.Bucket) error {

+	return errors.WithStack(s.Update(func(b *bolt.Bucket) error {

 		for _, fn := range s.queue {

 			if err := fn(b); err != nil {

-				return err

+				return errors.WithStack(err)

 			}

 		}

 		s.queue = s.queue[:0]

 		return nil

-	})

+	}))

 }

 func (s *StorageItem) Indexes() (out []string) {

@@ -341,18 +341,18 @@ func (s *StorageItem) SetValue(b *bolt.Bucket, key string, v *Value) error {

 	}

 	dt, err := json.Marshal(v)

 	if err != nil {

-		return err

+		return errors.WithStack(err)

 	}

 	if err := b.Put([]byte(key), dt); err != nil {

-		return err

+		return errors.WithStack(err)

 	}

 	if v.Index != "" {

 		b, err := b.Tx().CreateBucketIfNotExists([]byte(indexBucket))

 		if err != nil {

-			return err

+			return errors.WithStack(err)

 		}

 		if err := b.Put([]byte(indexKey(v.Index, s.ID())), []byte{}); err != nil {

-			return err

+			return errors.WithStack(err)

 		}

 	}

 	s.values[key] = v

@@ -367,14 +367,13 @@ type Value struct {

 func NewValue(v interface{}) (*Value, error) {

 	dt, err := json.Marshal(v)

 	if err != nil {

-		return nil, err

+		return nil, errors.WithStack(err)

 	}

 	return &Value{Value: json.RawMessage(dt)}, nil

 }

 func (v *Value) Unmarshal(target interface{}) error {

-	err := json.Unmarshal(v.Value, target)

-	return err

+	return errors.WithStack(json.Unmarshal(v.Value, target))

 }

 func indexKey(index, target string) string {

@@ -190,7 +190,7 @@ func (cr *cacheRecord) remove(ctx context.Context, removeSnapshot bool) error {

 	}

 	if removeSnapshot {

 		if err := cr.cm.Snapshotter.Remove(ctx, cr.ID()); err != nil {

-			return err

+			return errors.Wrapf(err, "failed to remove %s", cr.ID())

 		}

 	}

 	if err := cr.cm.md.Clear(cr.ID()); err != nil {

@@ -259,7 +259,7 @@ func (sr *immutableRef) release(ctx context.Context) error {

 	if len(sr.refs) == 0 {

 		if sr.viewMount != nil { // TODO: release viewMount earlier if possible

 			if err := sr.cm.Snapshotter.Remove(ctx, sr.view); err != nil {

-				return err

+				return errors.Wrapf(err, "failed to remove view %s", sr.view)

 			}

 			sr.view = ""

 			sr.viewMount = nil

@@ -100,7 +100,7 @@ func readBlob(ctx context.Context, provider content.Provider, desc ocispec.Descr

 			}

 		}

 	}

-	return dt, err

+	return dt, errors.WithStack(err)

 }

 func (ci *contentCacheImporter) importInlineCache(ctx context.Context, dt []byte, id string, w worker.Worker) (solver.CacheManager, error) {

@@ -120,7 +120,7 @@ func (ci *contentCacheImporter) importInlineCache(ctx context.Context, dt []byte

 				var m ocispec.Manifest

 				if err := json.Unmarshal(dt, &m); err != nil {

-					return err

+					return errors.WithStack(err)

 				}

 				if m.Config.Digest == "" || len(m.Layers) == 0 {

@@ -129,13 +129,13 @@ func (ci *contentCacheImporter) importInlineCache(ctx context.Context, dt []byte

 				p, err := content.ReadBlob(ctx, ci.provider, m.Config)

 				if err != nil {

-					return err

+					return errors.WithStack(err)

 				}

 				var img image

 				if err := json.Unmarshal(p, &img); err != nil {

-					return err

+					return errors.WithStack(err)

 				}

 				if len(img.Rootfs.DiffIDs) != len(m.Layers) {

@@ -149,7 +149,7 @@ func (ci *contentCacheImporter) importInlineCache(ctx context.Context, dt []byte

 				var config v1.CacheConfig

 				if err := json.Unmarshal(img.Cache, &config.Records); err != nil {

-					return err

+					return errors.WithStack(err)

 				}

 				createdDates, createdMsg, err := parseCreatedLayerInfo(img)

@@ -181,7 +181,7 @@ func (ci *contentCacheImporter) importInlineCache(ctx context.Context, dt []byte

 				dt, err = json.Marshal(config)

 				if err != nil {

-					return err

+					return errors.WithStack(err)

 				}

 				mu.Lock()

@@ -217,7 +217,7 @@ func (ci *contentCacheImporter) allDistributionManifests(ctx context.Context, dt

 	case images.MediaTypeDockerSchema2ManifestList, ocispec.MediaTypeImageIndex:

 		var index ocispec.Index

 		if err := json.Unmarshal(dt, &index); err != nil {

-			return err

+			return errors.WithStack(err)

 		}

 		for _, d := range index.Manifests {

@@ -226,7 +226,7 @@ func (ci *contentCacheImporter) allDistributionManifests(ctx context.Context, dt

 			}

 			p, err := content.ReadBlob(ctx, ci.provider, d)

 			if err != nil {

-				return err

+				return errors.WithStack(err)

 			}

 			if err := ci.allDistributionManifests(ctx, p, m); err != nil {

 				return err

@@ -254,7 +254,7 @@ func (cs *cacheResultStorage) Load(ctx context.Context, res solver.CacheResult)

 	ref, err := cs.w.FromRemote(ctx, item.result)

 	if err != nil {

-		return nil, err

+		return nil, errors.Wrap(err, "failed to load result from remote")

 	}

 	return worker.NewWorkerRefResult(ref, cs.w), nil

 }

@@ -12,7 +12,7 @@ import (

 func Parse(configJSON []byte, provider DescriptorProvider, t solver.CacheExporterTarget) error {

 	var config CacheConfig

 	if err := json.Unmarshal(configJSON, &config); err != nil {

-		return err

+		return errors.WithStack(err)

 	}

 	return ParseConfig(config, provider, t)

@@ -61,23 +61,23 @@ func ReadFile(ctx context.Context, ref cache.ImmutableRef, req ReadRequest) ([]b

 	err := withMount(ctx, ref, func(root string) error {

 		fp, err := fs.RootPath(root, req.Filename)

 		if err != nil {

-			return err

+			return errors.WithStack(err)

 		}

 		if req.Range == nil {

 			dt, err = ioutil.ReadFile(fp)

 			if err != nil {

-				return err

+				return errors.WithStack(err)

 			}

 		} else {

 			f, err := os.Open(fp)

 			if err != nil {

-				return err

+				return errors.WithStack(err)

 			}

 			dt, err = ioutil.ReadAll(io.NewSectionReader(f, int64(req.Range.Offset), int64(req.Range.Length)))

 			f.Close()

 			if err != nil {

-				return err

+				return errors.WithStack(err)

 			}

 		}

 		return nil

@@ -101,7 +101,7 @@ func ReadDir(ctx context.Context, ref cache.ImmutableRef, req ReadDirRequest) ([

 	err := withMount(ctx, ref, func(root string) error {

 		fp, err := fs.RootPath(root, req.Path)

 		if err != nil {

-			return err

+			return errors.WithStack(err)

 		}

 		return fsutil.Walk(ctx, fp, &wo, func(path string, info os.FileInfo, err error) error {

 			if err != nil {

@@ -128,10 +128,10 @@ func StatFile(ctx context.Context, ref cache.ImmutableRef, path string) (*fstype

 	err := withMount(ctx, ref, func(root string) error {

 		fp, err := fs.RootPath(root, path)

 		if err != nil {

-			return err

+			return errors.WithStack(err)

 		}

 		if st, err = fsutil.Stat(fp); err != nil {

-			return err

+			return errors.WithStack(err)

 		}

 		return nil

 	})

@@ -427,11 +427,13 @@ func Security(s pb.SecurityMode) RunOption {

 }

 func Shlex(str string) RunOption {

-	return Shlexf(str)

+	return runOptionFunc(func(ei *ExecInfo) {

+		ei.State = shlexf(str, false)(ei.State)

+	})

 }

 func Shlexf(str string, v ...interface{}) RunOption {

 	return runOptionFunc(func(ei *ExecInfo) {

-		ei.State = shlexf(str, v...)(ei.State)

+		ei.State = shlexf(str, true, v...)(ei.State)

 	})

 }

@@ -442,7 +444,9 @@ func Args(a []string) RunOption {

 }

 func AddEnv(key, value string) RunOption {

-	return AddEnvf(key, value)

+	return runOptionFunc(func(ei *ExecInfo) {

+		ei.State = ei.State.AddEnv(key, value)

+	})

 }

 func AddEnvf(key, value string, v ...interface{}) RunOption {

@@ -458,7 +462,9 @@ func User(str string) RunOption {

 }

 func Dir(str string) RunOption {

-	return Dirf(str)

+	return runOptionFunc(func(ei *ExecInfo) {

+		ei.State = ei.State.Dir(str)

+	})

 }

 func Dirf(str string, v ...interface{}) RunOption {

 	return runOptionFunc(func(ei *ExecInfo) {

@@ -24,19 +24,24 @@ var (

 	keySecurity  = contextKeyT("llb.security")

 )

-func addEnvf(key, value string, v ...interface{}) StateOption {

+func addEnvf(key, value string, replace bool, v ...interface{}) StateOption {

+	if replace {

+		value = fmt.Sprintf(value, v...)

+	}

 	return func(s State) State {

-		return s.WithValue(keyEnv, getEnv(s).AddOrReplace(key, fmt.Sprintf(value, v...)))

+		return s.WithValue(keyEnv, getEnv(s).AddOrReplace(key, value))

 	}

 }

 func dir(str string) StateOption {

-	return dirf(str)

+	return dirf(str, false)

 }

-func dirf(str string, v ...interface{}) StateOption {

+func dirf(value string, replace bool, v ...interface{}) StateOption {

+	if replace {

+		value = fmt.Sprintf(value, v...)

+	}

 	return func(s State) State {

-		value := fmt.Sprintf(str, v...)

 		if !path.IsAbs(value) {

 			prev := getDir(s)

 			if prev == "" {

@@ -100,9 +105,12 @@ func args(args ...string) StateOption {

 	}

 }

-func shlexf(str string, v ...interface{}) StateOption {

+func shlexf(str string, replace bool, v ...interface{}) StateOption {

+	if replace {

+		str = fmt.Sprintf(str, v...)

+	}

 	return func(s State) State {

-		arg, err := shlex.Split(fmt.Sprintf(str, v...))

+		arg, err := shlex.Split(str)

 		if err != nil {

 			// TODO: handle error

 		}

@@ -240,18 +240,18 @@ func (s State) File(a *FileAction, opts ...ConstraintsOpt) State {

 }

 func (s State) AddEnv(key, value string) State {

-	return s.AddEnvf(key, value)

+	return addEnvf(key, value, false)(s)

 }

 func (s State) AddEnvf(key, value string, v ...interface{}) State {

-	return addEnvf(key, value, v...)(s)

+	return addEnvf(key, value, true, v...)(s)

 }

 func (s State) Dir(str string) State {

-	return s.Dirf(str)

+	return dirf(str, false)(s)

 }

 func (s State) Dirf(str string, v ...interface{}) State {

-	return dirf(str, v...)(s)

+	return dirf(str, true, v...)(s)

 }

 func (s State) GetEnv(key string) (string, bool) {

@@ -8,6 +8,7 @@ import (

 	"github.com/docker/docker/pkg/idtools"

 	"github.com/docker/libnetwork/resolvconf"

+	"github.com/docker/libnetwork/types"

 	"github.com/moby/buildkit/util/flightcontrol"

 )

@@ -15,7 +16,13 @@ var g flightcontrol.Group

 var notFirstRun bool

 var lastNotEmpty bool

-func GetResolvConf(ctx context.Context, stateDir string, idmap *idtools.IdentityMapping) (string, error) {

+type DNSConfig struct {

+	Nameservers   []string

+	Options       []string

+	SearchDomains []string

+}

+

+func GetResolvConf(ctx context.Context, stateDir string, idmap *idtools.IdentityMapping, dns *DNSConfig) (string, error) {

 	p := filepath.Join(stateDir, "resolv.conf")

 	_, err := g.Do(ctx, stateDir, func(ctx context.Context) (interface{}, error) {

 		generate := !notFirstRun

@@ -61,9 +68,34 @@ func GetResolvConf(ctx context.Context, stateDir string, idmap *idtools.Identity

 			dt = f.Content

 		}

-		f, err = resolvconf.FilterResolvDNS(dt, true)

-		if err != nil {

-			return "", err

+		if dns != nil {

+			var (

+				dnsNameservers   = resolvconf.GetNameservers(dt, types.IP)

+				dnsSearchDomains = resolvconf.GetSearchDomains(dt)

+				dnsOptions       = resolvconf.GetOptions(dt)

+			)

+			if len(dns.Nameservers) > 0 {

+				dnsNameservers = dns.Nameservers

+			}

+			if len(dns.SearchDomains) > 0 {

+				dnsSearchDomains = dns.SearchDomains

+			}

+			if len(dns.Options) > 0 {

+				dnsOptions = dns.Options

+			}

+

+			f, err = resolvconf.Build(p+".tmp", dnsNameservers, dnsSearchDomains, dnsOptions)

+			if err != nil {

+				return "", err

+			}

+		} else {

+			// Logic seems odd here: why are we filtering localhost IPs

+			// only if neither of the DNS configs were specified?

+			// Logic comes from https://github.com/docker/libnetwork/blob/164a77ee6d24fb2b1d61f8ad3403a51d8453899e/sandbox_dns_unix.go#L230-L269

+			f, err = resolvconf.FilterResolvDNS(f.Content, true)

+			if err != nil {

+				return "", err

+			}

 		}

 		tmpPath := p + ".tmp"

new file mode 100644

@@ -0,0 +1,13 @@

+package oci

+

+// ProcMode configures PID namespaces

+type ProcessMode int

+

+const (

+	// ProcessSandbox unshares pidns and mount procfs.

+	ProcessSandbox ProcessMode = iota

+	// NoProcessSandbox uses host pidns and bind-mount procfs.

+	// Note that NoProcessSandbox allows build containers to kill (and potentially ptrace) an arbitrary process in the BuildKit host namespace.

+	// NoProcessSandbox should be enabled only when the BuildKit is running in a container as an unprivileged user.

+	NoProcessSandbox

+)

@@ -27,18 +27,6 @@ import (

 // Ideally we don't have to import whole containerd just for the default spec

-// ProcMode configures PID namespaces

-type ProcessMode int

-

-const (

-	// ProcessSandbox unshares pidns and mount procfs.

-	ProcessSandbox ProcessMode = iota

-	// NoProcessSandbox uses host pidns and bind-mount procfs.

-	// Note that NoProcessSandbox allows build containers to kill (and potentially ptrace) an arbitrary process in the BuildKit host namespace.

-	// NoProcessSandbox should be enabled only when the BuildKit is running in a container as an unprivileged user.

-	NoProcessSandbox

-)

-

 // GenerateSpec generates spec using containerd functionality.

 // opts are ignored for s.Process, s.Hostname, and s.Mounts .

 func GenerateSpec(ctx context.Context, meta executor.Meta, mounts []executor.Mount, id, resolvConf, hostsFile string, namespace network.Namespace, processMode ProcessMode, idmap *idtools.IdentityMapping, opts ...oci.SpecOpts) (*specs.Spec, func(), error) {

@@ -20,19 +20,11 @@ func GetUser(ctx context.Context, root, username string) (uint32, uint32, []uint

 		return uid, gid, nil, nil

 	}

-	passwdPath, err := user.GetPasswdPath()

-	if err != nil {

-		return 0, 0, nil, err

-	}

-	groupPath, err := user.GetGroupPath()

-	if err != nil {

-		return 0, 0, nil, err

-	}

-	passwdFile, err := openUserFile(root, passwdPath)

+	passwdFile, err := openUserFile(root, "/etc/passwd")

 	if err == nil {

 		defer passwdFile.Close()

 	}

-	groupFile, err := openUserFile(root, groupPath)

+	groupFile, err := openUserFile(root, "/etc/group")

 	if err == nil {

 		defer groupFile.Close()

 	}

@@ -43,6 +43,7 @@ type Opt struct {

 	IdentityMapping *idtools.IdentityMapping

 	// runc run --no-pivot (unrecommended)

 	NoPivot bool

+	DNS     *oci.DNSConfig

 }

 var defaultCommandCandidates = []string{"buildkit-runc", "runc"}

@@ -57,6 +58,7 @@ type runcExecutor struct {

 	processMode      oci.ProcessMode

 	idmap            *idtools.IdentityMapping

 	noPivot          bool

+	dns              *oci.DNSConfig

 }

 func New(opt Opt, networkProviders map[pb.NetMode]network.Provider) (executor.Executor, error) {

@@ -115,6 +117,7 @@ func New(opt Opt, networkProviders map[pb.NetMode]network.Provider) (executor.Ex

 		processMode:      opt.ProcessMode,

 		idmap:            opt.IdentityMapping,

 		noPivot:          opt.NoPivot,

+		dns:              opt.DNS,

 	}

 	return w, nil

 }

@@ -134,7 +137,7 @@ func (w *runcExecutor) Exec(ctx context.Context, meta executor.Meta, root cache.

 		logrus.Info("enabling HostNetworking")

 	}

-	resolvConf, err := oci.GetResolvConf(ctx, w.root, w.idmap)

+	resolvConf, err := oci.GetResolvConf(ctx, w.root, w.idmap, w.dns)

 	if err != nil {

 		return err

 	}