Repository: containers/buildah

Issue:
RUN --mount=type=secret with uid seems broken in current v1 image (v1.41.3)
### Issue Description

Several of our builds that attempts to mount a build-secret have started failing after quay.io/buildah/stable:v1 was updated from v1.40.1 to v1.41.3.

The issue seems to be that specifying the uid as an argument to the --mount parameter no longer results in the expected permissions for the secret.

### Steps to reproduce the issue

With this Containerfile:

```Dockerfile
FROM docker.io/library/alpine:latest

RUN --mount=type=secret,id=test_secret \
    /bin/sh -c '\
      ls -lh /run/secrets/test_secret \
      && [ -e /run/secrets/test_secret ] \
      && cat /run/secrets/test_secret \
      && [ "$(cat /run/secrets/test_secret)" = "some-expected-secret-value" ]' \
    && echo "Test OK"

USER nobody
RUN --mount=type=secret,uid=65534,id=test_secret_user \
    /bin/sh -c '\
      ls -lh /run/secrets/test_secret_user \
      && [ -e /run/secrets/test_secret_user ] \
      && cat /run/secrets/test_secret_user \
      && [ "$(cat /run/secrets/test_secret_user)" = "some-other-secret-value" ]' \
    && echo "Test OK"
```

... do this:

```bash
export SECRET1=some-expected-secret-value
export SECRET2=some-other-secret-value
buildah build --secret id=test_secret,src=env,env=SECRET1 --secret id=test_secret_user,src=env,env=SECRET2 .
```

### Describe the results you received

STEP 3/4: USER nobody
--> Pushing cache [<cut>]
--> 58e995db39e6
STEP 4/4: RUN --mount=type=secret,uid=65534,id=test_secret_user     /bin/sh -c '      ls -lh /run/secrets/test_secret_user       && [ -e /run/secrets/test_secret_user ]       && cat /run/secrets/test_secret_user       && [ "$(cat /run/secrets/test_secret_user)" = "some-other-secret-value" ]'     && echo "Test OK"
ls: /run/secrets/test_secret_user: Permission denied
subprocess exited with status 1
subprocess exited with status 1
Error: building at STEP "RUN --mount=type=secret,uid=65534,id=test_secret_user /bin/sh -c '      ls -lh /run/secrets/test_secret_user       && [ -e /run/secrets/test_secret_user ]       && cat /run/secrets/test_secret_user       && [ "$(cat /run/secrets/test_secret_user)" = "some-other-secret-value" ]'     && echo "Test OK"": exit status 1

### Describe the results you expected

--> Pushing cache [<cut>]
--> c794fe725496
STEP 4/4: RUN --mount=type=secret,uid=65534,id=test_secret_user     /bin/sh -c '      ls -lh /run/secrets/test_secret_user       && [ -e /run/secrets/test_secret_user ]       && cat /run/secrets/test_secret_user       && [ "$(cat /run/secrets/test_secret_user)" = "some-other-secret-value" ]'     && echo "Test OK"
-r--------    1 nobody   root          23 Sep  1 12:40 /run/secrets/test_secret_user
some-other-secret-valueTest OK

### buildah version output

```yaml
We're following the latest quay.io/buildah/stable:v1 image, which we update nightly. This image was recently updated from v1.40.1 to v1.41.3.
```

### buildah info output

```yaml
We're running the official image on kubernetes, with slight customizations:


FROM quay.io/buildah/stable:v1

RUN sed -i \
    's/^.\+secrets\/\(etc-pki-entitlement\|rhsm\).\+$/#&/' \
    /etc/containers/mounts.conf \
    && sed -i \
      -e 's/^mount_program/#mount_program/g' \
      -e 's/^mountopt/#mountopt/g' \
      /etc/containers/storage.conf \
    && dnf remove -y fuse-overlayfs

COPY registries.conf.d/* /etc/containers/registries.conf.d/
```

### Provide your storage.conf

```toml
Official buildah image with customizations as above.
```

### Upstream Latest Release

Yes

### Additional environment details

_No response_

### Additional information

Additional information like issue happens only occasionally or issue happens with a particular architecture or on a particular setting

Discussion:

Solution patch:
diff --git a/go.mod b/go.mod
index 59a36b37d..652a12c66 100644
--- a/go.mod
+++ b/go.mod
@@ -14,16 +14,16 @@ require (
 	github.com/docker/docker v28.3.3+incompatible
 	github.com/docker/go-connections v0.6.0
 	github.com/docker/go-units v0.5.0
-	github.com/fsouza/go-dockerclient v1.12.1
+	github.com/fsouza/go-dockerclient v1.12.2
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/mattn/go-shellwords v1.0.12
-	github.com/moby/buildkit v0.23.2
+	github.com/moby/buildkit v0.24.0
 	github.com/moby/sys/capability v0.4.0
 	github.com/moby/sys/userns v0.1.0
-	github.com/opencontainers/cgroups v0.0.4
+	github.com/opencontainers/cgroups v0.0.5
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.1
-	github.com/opencontainers/runc v1.3.0
+	github.com/opencontainers/runc v1.3.1
 	github.com/opencontainers/runtime-spec v1.2.1
 	github.com/opencontainers/runtime-tools v0.9.1-0.20250523060157-0ea5ed0382a2
 	github.com/opencontainers/selinux v1.12.0
@@ -31,14 +31,14 @@ require (
 	github.com/seccomp/libseccomp-golang v0.11.1
 	github.com/sirupsen/logrus v1.9.3
 	github.com/spf13/cobra v1.10.1
-	github.com/spf13/pflag v1.0.9
+	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.11.1
 	go.etcd.io/bbolt v1.4.3
 	go.podman.io/common v0.0.0-20250826054041-6e4bed3c9118
 	go.podman.io/image/v5 v5.36.1-0.20250820085751-a13b38f45723
 	go.podman.io/storage v1.59.1-0.20250820085751-a13b38f45723
 	golang.org/x/crypto v0.41.0
-	golang.org/x/sync v0.16.0
+	golang.org/x/sync v0.17.0
 	golang.org/x/sys v0.35.0
 	golang.org/x/term v0.34.0
 	tags.cncf.io/container-device-interface v1.0.1
diff --git a/go.sum b/go.sum
index 2f9755c53..3aa2b0165 100644
--- a/go.sum
+++ b/go.sum
@@ -90,8 +90,8 @@ github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/fsouza/go-dockerclient v1.12.1 h1:FMoLq+Zhv9Oz/rFmu6JWkImfr6CBgZOPcL+bHW4gS0o=
-github.com/fsouza/go-dockerclient v1.12.1/go.mod h1:OqsgJJcpCwqyM3JED7TdfM9QVWS5O7jSYwXxYKmOooY=
+github.com/fsouza/go-dockerclient v1.12.2 h1:+pbP/SacoHfqaVZuiudvcdYGd9jzU7y9EcgoBOHivEI=
+github.com/fsouza/go-dockerclient v1.12.2/go.mod h1:ZGCkAsnBGjnTRG9wV6QaICPJ5ig2KlaxTccDQy5WQ38=
 github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
 github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
 github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
@@ -164,8 +164,8 @@ github.com/miekg/pkcs11 v1.1.1 h1:Ugu9pdy6vAYku5DEpVWVFPYnzV+bxB+iRdbuFSu7TvU=
 github.com/miekg/pkcs11 v1.1.1/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
 github.com/mistifyio/go-zfs/v3 v3.0.1 h1:YaoXgBePoMA12+S1u/ddkv+QqxcfiZK4prI6HPnkFiU=
 github.com/mistifyio/go-zfs/v3 v3.0.1/go.mod h1:CzVgeB0RvF2EGzQnytKVvVSDwmKJXxkOTUGbNrTja/k=
-github.com/moby/buildkit v0.23.2 h1:gt/dkfcpgTXKx+B9I310kV767hhVqTvEyxGgI3mqsGQ=
-github.com/moby/buildkit v0.23.2/go.mod h1:iEjAfPQKIuO+8y6OcInInvzqTMiKMbb2RdJz1K/95a0=
+github.com/moby/buildkit v0.24.0 h1:qYfTl7W1SIJzWDIDCcPT8FboHIZCYfi++wvySi3eyFE=
+github.com/moby/buildkit v0.24.0/go.mod h1:4qovICAdR2H4C7+EGMRva5zgHW1gyhT4/flHI7F5F9k=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/go-archive v0.1.0 h1:Kk/5rdW/g+H8NHdJW2gsXyZ7UnzvJNOy6VKJqueWdcQ=
@@ -199,14 +199,14 @@ github.com/onsi/ginkgo/v2 v2.25.1 h1:Fwp6crTREKM+oA6Cz4MsO8RhKQzs2/gOIVOUscMAfZY
 github.com/onsi/ginkgo/v2 v2.25.1/go.mod h1:ppTWQ1dh9KM/F1XgpeRqelR+zHVwV81DGRSDnFxK7Sk=
 github.com/onsi/gomega v1.38.0 h1:c/WX+w8SLAinvuKKQFh77WEucCnPk4j2OTUr7lt7BeY=
 github.com/onsi/gomega v1.38.0/go.mod h1:OcXcwId0b9QsE7Y49u+BTrL4IdKOBOKnD6VQNTJEB6o=
-github.com/opencontainers/cgroups v0.0.4 h1:XVj8P/IHVms/j+7eh8ggdkTLAxjz84ZzuFyGoE28DR4=
-github.com/opencontainers/cgroups v0.0.4/go.mod h1:s8lktyhlGUqM7OSRL5P7eAW6Wb+kWPNvt4qvVfzA5vs=
+github.com/opencontainers/cgroups v0.0.5 h1:DRITAqcOnY0uSBzIpt1RYWLjh5DPDiqUs4fY6Y0ktls=
+github.com/opencontainers/cgroups v0.0.5/go.mod h1:oWVzJsKK0gG9SCRBfTpnn16WcGEqDI8PAcpMGbqWxcs=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
-github.com/opencontainers/runc v1.3.0 h1:cvP7xbEvD0QQAs0nZKLzkVog2OPZhI/V2w3WmTmUSXI=
-github.com/opencontainers/runc v1.3.0/go.mod h1:9wbWt42gV+KRxKRVVugNP6D5+PQciRbenB4fLVsqGPs=
+github.com/opencontainers/runc v1.3.1 h1:c/yY0oh2wK7tzDuD56REnSxyU8ubh8hoAIOLGLrm4SM=
+github.com/opencontainers/runc v1.3.1/go.mod h1:9wbWt42gV+KRxKRVVugNP6D5+PQciRbenB4fLVsqGPs=
 github.com/opencontainers/runtime-spec v1.2.1 h1:S4k4ryNgEpxW1dzyqffOmhI1BHYcjzU8lpJfSlR0xww=
 github.com/opencontainers/runtime-spec v1.2.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/runtime-tools v0.9.1-0.20250523060157-0ea5ed0382a2 h1:2xZEHOdeQBV6PW8ZtimN863bIOl7OCW/X10K0cnxKeA=
@@ -260,8 +260,9 @@ github.com/smallstep/pkcs7 v0.1.1 h1:x+rPdt2W088V9Vkjho4KtoggyktZJlMduZAtRHm68LU
 github.com/smallstep/pkcs7 v0.1.1/go.mod h1:dL6j5AIz9GHjVEBTXtW+QliALcgM19RtXaTeyxI+AfA=
 github.com/spf13/cobra v1.10.1 h1:lJeBwCfmrnXthfAupyUTzJ/J4Nc1RsHC/mSRU2dll/s=
 github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4XaB0=
-github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 h1:pnnLyeX7o/5aX8qUQ69P/mLojDqwda8hFOCBTmP/6hw=
 github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6/go.mod h1:39R/xuhNgVhi+K0/zst4TLrJrVmbm6LVgl4A0+ZFS5M=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -369,8 +370,8 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
-golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
+golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20181122145206-62eef0e2fa9b/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
diff --git a/run_common.go b/run_common.go
index 0863ec2fb..bd501f3bd 100644
--- a/run_common.go
+++ b/run_common.go
@@ -2121,6 +2121,12 @@ func (b *Builder) createMountTargets(spec *specs.Spec) ([]copier.ConditionalRemo
 				// forced permissions
 				mode = &perms
 			}
+			if mode == nil && destination != cleanedDestination {
+				// parent directories default to 0o755, for
+				// the sake of commands running as UID != 0
+				perms := os.FileMode(0o755)
+				mode = &perms
+			}
 			targets.Paths = append(targets.Paths, copier.EnsurePath{
 				Path:     destination,
 				Typeflag: typeFlag,
diff --git a/vendor/github.com/docker/docker/pkg/archive/archive_deprecated.go b/vendor/github.com/docker/docker/pkg/archive/archive_deprecated.go
deleted file mode 100644
index 5bdbdef20..000000000
--- a/vendor/github.com/docker/docker/pkg/archive/archive_deprecated.go
+++ /dev/null
@@ -1,259 +0,0 @@
-// Package archive provides helper functions for dealing with archive files.
-package archive
-
-import (
-	"archive/tar"
-	"io"
-	"os"
-
-	"github.com/docker/docker/pkg/idtools"
-	"github.com/moby/go-archive"
-	"github.com/moby/go-archive/compression"
-	"github.com/moby/go-archive/tarheader"
-)
-
-// ImpliedDirectoryMode represents the mode (Unix permissions) applied to directories that are implied by files in a
-// tar, but that do not have their own header entry.
-//
-// Deprecated: use [archive.ImpliedDirectoryMode] instead.
-const ImpliedDirectoryMode = archive.ImpliedDirectoryMode
-
-type (
-	// Compression is the state represents if compressed or not.
-	//
-	// Deprecated: use [compression.Compression] instead.
-	Compression = compression.Compression
-	// WhiteoutFormat is the format of whiteouts unpacked
-	//
-	// Deprecated: use [archive.WhiteoutFormat] instead.
-	WhiteoutFormat = archive.WhiteoutFormat
-
-	// TarOptions wraps the tar options.
-	//
-	// Deprecated: use [archive.TarOptions] instead.
-	TarOptions struct {
-		IncludeFiles     []string
-		ExcludePatterns  []string
-		Compression      compression.Compression
-		NoLchown         bool
-		IDMap            idtools.IdentityMapping
-		ChownOpts        *idtools.Identity
-		IncludeSourceDir bool
-		// WhiteoutFormat is the expected on disk format for whiteout files.
-		// This format will be converted to the standard format on pack
-		// and from the standard format on unpack.
-		WhiteoutFormat archive.WhiteoutFormat
-		// When unpacking, specifies whether overwriting a directory with a
-		// non-directory is allowed and vice versa.
-		NoOverwriteDirNonDir bool
-		// For each include when creating an archive, the included name will be
-		// replaced with the matching name from this map.
-		RebaseNames map[string]string
-		InUserNS    bool
-		// Allow unpacking to succeed in spite of failures to set extended
-		// attributes on the unpacked files due to the destination filesystem
-		// not supporting them or a lack of permissions. Extended attributes
-		// were probably in the archive for a reason, so set this option at
-		// your own peril.
-		BestEffortXattrs bool
-	}
-)
-
-// Archiver implements the Archiver interface and allows the reuse of most utility functions of
-// this package with a pluggable Untar function. Also, to facilitate the passing of specific id
-// mappings for untar, an Archiver can be created with maps which will then be passed to Untar operations.
-//
-// Deprecated: use [archive.Archiver] instead.
-type Archiver struct {
-	Untar     func(io.Reader, string, *TarOptions) error
-	IDMapping idtools.IdentityMapping
-}
-
-// NewDefaultArchiver returns a new Archiver without any IdentityMapping
-//
-// Deprecated: use [archive.NewDefaultArchiver] instead.
-func NewDefaultArchiver() *Archiver {
-	return &Archiver{Untar: Untar}
-}
-
-const (
-	Uncompressed = compression.None  // Deprecated: use [compression.None] instead.
-	Bzip2        = compression.Bzip2 // Deprecated: use [compression.Bzip2] instead.
-	Gzip         = compression.Gzip  // Deprecated: use [compression.Gzip] instead.
-	Xz           = compression.Xz    // Deprecated: use [compression.Xz] instead.
-	Zstd         = compression.Zstd  // Deprecated: use [compression.Zstd] instead.
-)
-
-const (
-	AUFSWhiteoutFormat    = archive.AUFSWhiteoutFormat    // Deprecated: use [archive.AUFSWhiteoutFormat] instead.
-	OverlayWhiteoutFormat = archive.OverlayWhiteoutFormat // Deprecated: use [archive.OverlayWhiteoutFormat] instead.
-)
-
-// IsArchivePath checks if the (possibly compressed) file at the given path
-// starts with a tar file header.
-//
-// Deprecated: use [archive.IsArchivePath] instead.
-func IsArchivePath(path string) bool {
-	return archive.IsArchivePath(path)
-}
-
-// DetectCompression detects the compression algorithm of the source.
-//
-// Deprecated: use [compression.Detect] instead.
-func DetectCompression(source []byte) archive.Compression {
-	return compression.Detect(source)
-}
-
-// DecompressStream decompresses the archive and returns a ReaderCloser with the decompressed archive.
-//
-// Deprecated: use [compression.DecompressStream] instead.
-func DecompressStream(arch io.Reader) (io.ReadCloser, error) {
-	return compression.DecompressStream(arch)
-}
-
-// CompressStream compresses the dest with specified compression algorithm.
-//
-// Deprecated: use [compression.CompressStream] instead.
-func CompressStream(dest io.Writer, comp compression.Compression) (io.WriteCloser, error) {
-	return compression.CompressStream(dest, comp)
-}
-
-// TarModifierFunc is a function that can be passed to ReplaceFileTarWrapper.
-//
-// Deprecated: use [archive.TarModifierFunc] instead.
-type TarModifierFunc = archive.TarModifierFunc
-
-// ReplaceFileTarWrapper converts inputTarStream to a new tar stream.
-//
-// Deprecated: use [archive.ReplaceFileTarWrapper] instead.
-func ReplaceFileTarWrapper(inputTarStream io.ReadCloser, mods map[string]archive.TarModifierFunc) io.ReadCloser {
-	return archive.ReplaceFileTarWrapper(inputTarStream, mods)
-}
-
-// FileInfoHeaderNoLookups creates a partially-populated tar.Header from fi.
-//
-// Deprecated: use [tarheader.FileInfoHeaderNoLookups] instead.
-func FileInfoHeaderNoLookups(fi os.FileInfo, link string) (*tar.Header, error) {
-	return tarheader.FileInfoHeaderNoLookups(fi, link)
-}
-
-// FileInfoHeader creates a populated Header from fi.
-//
-// Deprecated: use [archive.FileInfoHeader] instead.
-func FileInfoHeader(name string, fi os.FileInfo, link string) (*tar.Header, error) {
-	return archive.FileInfoHeader(name, fi, link)
-}
-
-// ReadSecurityXattrToTarHeader reads security.capability xattr from filesystem
-// to a tar header
-//
-// Deprecated: use [archive.ReadSecurityXattrToTarHeader] instead.
-func ReadSecurityXattrToTarHeader(path string, hdr *tar.Header) error {
-	return archive.ReadSecurityXattrToTarHeader(path, hdr)
-}
-
-// Tar creates an archive from the directory at `path`, and returns it as a
-// stream of bytes.
-//
-// Deprecated: use [archive.Tar] instead.
-func Tar(path string, compression archive.Compression) (io.ReadCloser, error) {
-	return archive.TarWithOptions(path, &archive.TarOptions{Compression: compression})
-}
-
-// TarWithOptions creates an archive with the given options.
-//
-// Deprecated: use [archive.TarWithOptions] instead.
-func TarWithOptions(srcPath string, options *TarOptions) (io.ReadCloser, error) {
-	return archive.TarWithOptions(srcPath, toArchiveOpt(options))
-}
-
-// Tarballer is a lower-level interface to TarWithOptions.
-//
-// Deprecated: use [archive.Tarballer] instead.
-type Tarballer = archive.Tarballer
-
-// NewTarballer constructs a new tarballer using TarWithOptions.
-//
-// Deprecated: use [archive.Tarballer] instead.
-func NewTarballer(srcPath string, options *TarOptions) (*archive.Tarballer, error) {
-	return archive.NewTarballer(srcPath, toArchiveOpt(options))
-}
-
-// Unpack unpacks the decompressedArchive to dest with options.
-//
-// Deprecated: use [archive.Unpack] instead.
-func Unpack(decompressedArchive io.Reader, dest string, options *TarOptions) error {
-	return archive.Unpack(decompressedArchive, dest, toArchiveOpt(options))
-}
-
-// Untar reads a stream of bytes from `archive`, parses it as a tar archive,
-// and unpacks it into the directory at `dest`.
-//
-// Deprecated: use [archive.Untar] instead.
-func Untar(tarArchive io.Reader, dest string, options *TarOptions) error {
-	return archive.Untar(tarArchive, dest, toArchiveOpt(options))
-}
-
-// UntarUncompressed reads a stream of bytes from `tarArchive`, parses it as a tar archive,
-// and unpacks it into the directory at `dest`.
-// The archive must be an uncompressed stream.
-//
-// Deprecated: use [archive.UntarUncompressed] instead.
-func UntarUncompressed(tarArchive io.Reader, dest string, options *TarOptions) error {
-	return archive.UntarUncompressed(tarArchive, dest, toArchiveOpt(options))
-}
-
-// TarUntar is a convenience function which calls Tar and Untar, with the output of one piped into the other.
-// If either Tar or Untar fails, TarUntar aborts and returns the error.
-func (archiver *Archiver) TarUntar(src, dst string) error {
-	return (&archive.Archiver{
-		Untar: func(reader io.Reader, s string, options *archive.TarOptions) error {
-			return archiver.Untar(reader, s, &TarOptions{
-				IDMap: archiver.IDMapping,
-			})
-		},
-		IDMapping: idtools.ToUserIdentityMapping(archiver.IDMapping),
-	}).TarUntar(src, dst)
-}
-
-// UntarPath untar a file from path to a destination, src is the source tar file path.
-func (archiver *Archiver) UntarPath(src, dst string) error {
-	return (&archive.Archiver{
-		Untar: func(reader io.Reader, s string, options *archive.TarOptions) error {
-			return archiver.Untar(reader, s, &TarOptions{
-				IDMap: archiver.IDMapping,
-			})
-		},
-		IDMapping: idtools.ToUserIdentityMapping(archiver.IDMapping),
-	}).UntarPath(src, dst)
-}
-
-// CopyWithTar creates a tar archive of filesystem path `src`, and
-// unpacks it at filesystem path `dst`.
-// The archive is streamed directly with fixed buffering and no
-// intermediary disk IO.
-func (archiver *Archiver) CopyWithTar(src, dst string) error {
-	return (&archive.Archiver{
-		Untar: func(reader io.Reader, s string, options *archive.TarOptions) error {
-			return archiver.Untar(reader, s, nil)
-		},
-		IDMapping: idtools.ToUserIdentityMapping(archiver.IDMapping),
-	}).CopyWithTar(src, dst)
-}
-
-// CopyFileWithTar emulates the behavior of the 'cp' command-line
-// for a single file. It copies a regular file from path `src` to
-// path `dst`, and preserves all its metadata.
-func (archiver *Archiver) CopyFileWithTar(src, dst string) (err error) {
-	return (&archive.Archiver{
-		Untar: func(reader io.Reader, s string, options *archive.TarOptions) error {
-			return archiver.Untar(reader, s, nil)
-		},
-		IDMapping: idtools.ToUserIdentityMapping(archiver.IDMapping),
-	}).CopyFileWithTar(src, dst)
-}
-
-// IdentityMapping returns the IdentityMapping of the archiver.
-func (archiver *Archiver) IdentityMapping() idtools.IdentityMapping {
-	return archiver.IDMapping
-}
diff --git a/vendor/github.com/docker/docker/pkg/archive/changes_deprecated.go b/vendor/github.com/docker/docker/pkg/archive/changes_deprecated.go
deleted file mode 100644
index 48c75235c..000000000
--- a/vendor/github.com/docker/docker/pkg/archive/changes_deprecated.go
+++ /dev/null
@@ -1,56 +0,0 @@
-package archive
-
-import (
-	"io"
-
-	"github.com/docker/docker/pkg/idtools"
-	"github.com/moby/go-archive"
-)
-
-// ChangeType represents the change
-//
-// Deprecated: use [archive.ChangeType] instead.
-type ChangeType = archive.ChangeType
-
-const (
-	ChangeModify = archive.ChangeModify // Deprecated: use [archive.ChangeModify] instead.
-	ChangeAdd    = archive.ChangeAdd    // Deprecated: use [archive.ChangeAdd] instead.
-	ChangeDelete = archive.ChangeDelete // Deprecated: use [archive.ChangeDelete] instead.
-)
-
-// Change represents a change.
-//
-// Deprecated: use [archive.Change] instead.
-type Change = archive.Change
-
-// Changes walks the path rw and determines changes for the files in the path,
-// with respect to the parent layers
-//
-// Deprecated: use [archive.Changes] instead.
-func Changes(layers []string, rw string) ([]archive.Change, error) {
-	return archive.Changes(layers, rw)
-}
-
-// FileInfo describes the information of a file.
-//
-// Deprecated: use [archive.FileInfo] instead.
-type FileInfo = archive.FileInfo
-
-// ChangesDirs compares two directories and generates an array of Change objects describing the changes.
-//
-// Deprecated: use [archive.ChangesDirs] instead.
-func ChangesDirs(newDir, oldDir string) ([]archive.Change, error) {
-	return archive.ChangesDirs(newDir, oldDir)
-}
-
-// ChangesSize calculates the size in bytes of the provided changes, based on newDir.
-//
-// Deprecated: use [archive.ChangesSize] instead.
-func ChangesSize(newDir string, changes []archive.Change) int64 {
-	return archive.ChangesSize(newDir, changes)
-}
-
-// ExportChanges produces an Archive from the provided changes, relative to dir.
-func ExportChanges(dir string, changes []archive.Change, idMap idtools.IdentityMapping) (io.ReadCloser, error) {
-	return archive.ExportChanges(dir, changes, idtools.ToUserIdentityMapping(idMap))
-}
diff --git a/vendor/github.com/docker/docker/pkg/archive/copy_deprecated.go b/vendor/github.com/docker/docker/pkg/archive/copy_deprecated.go
deleted file mode 100644
index 1901e55c5..000000000
--- a/vendor/github.com/docker/docker/pkg/archive/copy_deprecated.go
+++ /dev/null
@@ -1,130 +0,0 @@
-package archive
-
-import (
-	"io"
-
-	"github.com/moby/go-archive"
-	"github.com/moby/go-archive/compression"
-)
-
-var (
-	ErrNotDirectory      = archive.ErrNotDirectory      // Deprecated: use [archive.ErrNotDirectory] instead.
-	ErrDirNotExists      = archive.ErrDirNotExists      // Deprecated: use [archive.ErrDirNotExists] instead.
-	ErrCannotCopyDir     = archive.ErrCannotCopyDir     // Deprecated: use [archive.ErrCannotCopyDir] instead.
-	ErrInvalidCopySource = archive.ErrInvalidCopySource // Deprecated: use [archive.ErrInvalidCopySource] instead.
-)
-
-// PreserveTrailingDotOrSeparator returns the given cleaned path.
-//
-// Deprecated: use [archive.PreserveTrailingDotOrSeparator] instead.
-func PreserveTrailingDotOrSeparator(cleanedPath string, originalPath string) string {
-	return archive.PreserveTrailingDotOrSeparator(cleanedPath, originalPath)
-}
-
-// SplitPathDirEntry splits the given path between its directory name and its
-// basename.
-//
-// Deprecated: use [archive.SplitPathDirEntry] instead.
-func SplitPathDirEntry(path string) (dir, base string) {
-	return archive.SplitPathDirEntry(path)
-}
-
-// TarResource archives the resource described by the given CopyInfo to a Tar
-// archive.
-//
-// Deprecated: use [archive.TarResource] instead.
-func TarResource(sourceInfo archive.CopyInfo) (content io.ReadCloser, err error) {
-	return archive.TarResource(sourceInfo)
-}
-
-// TarResourceRebase is like TarResource but renames the first path element of
-// items in the resulting tar archive to match the given rebaseName if not "".
-//
-// Deprecated: use [archive.TarResourceRebase] instead.
-func TarResourceRebase(sourcePath, rebaseName string) (content io.ReadCloser, _ error) {
-	return archive.TarResourceRebase(sourcePath, rebaseName)
-}
-
-// TarResourceRebaseOpts does not preform the Tar, but instead just creates the rebase
-// parameters to be sent to TarWithOptions.
-//
-// Deprecated: use [archive.TarResourceRebaseOpts] instead.
-func TarResourceRebaseOpts(sourceBase string, rebaseName string) *TarOptions {
-	filter := []string{sourceBase}
-	return &TarOptions{
-		Compression:      compression.None,
-		IncludeFiles:     filter,
-		IncludeSourceDir: true,
-		RebaseNames: map[string]string{
-			sourceBase: rebaseName,
-		},
-	}
-}
-
-// CopyInfo holds basic info about the source or destination path of a copy operation.
-//
-// Deprecated: use [archive.CopyInfo] instead.
-type CopyInfo = archive.CopyInfo
-
-// CopyInfoSourcePath stats the given path to create a CopyInfo struct.
-// struct representing that resource for the source of an archive copy
-// operation.
-//
-// Deprecated: use [archive.CopyInfoSourcePath] instead.
-func CopyInfoSourcePath(path string, followLink bool) (archive.CopyInfo, error) {
-	return archive.CopyInfoSourcePath(path, followLink)
-}
-
-// CopyInfoDestinationPath stats the given path to create a CopyInfo
-// struct representing that resource for the destination of an archive copy
-// operation.
-//
-// Deprecated: use [archive.CopyInfoDestinationPath] instead.
-func CopyInfoDestinationPath(path string) (info archive.CopyInfo, err error) {
-	return archive.CopyInfoDestinationPath(path)
-}
-
-// PrepareArchiveCopy prepares the given srcContent archive.
-//
-// Deprecated: use [archive.PrepareArchiveCopy] instead.
-func PrepareArchiveCopy(srcContent io.Reader, srcInfo, dstInfo archive.CopyInfo) (dstDir string, content io.ReadCloser, err error) {
-	return archive.PrepareArchiveCopy(srcContent, srcInfo, dstInfo)
-}
-
-// RebaseArchiveEntries rewrites the given srcContent archive replacing
-// an occurrence of oldBase with newBase at the beginning of entry names.
-//
-// Deprecated: use [archive.RebaseArchiveEntries] instead.
-func RebaseArchiveEntries(srcContent io.Reader, oldBase, newBase string) io.ReadCloser {
-	return archive.RebaseArchiveEntries(srcContent, oldBase, newBase)
-}
-
-// CopyResource performs an archive copy from the given source path to the
-// given destination path.
-//
-// Deprecated: use [archive.CopyResource] instead.
-func CopyResource(srcPath, dstPath string, followLink bool) error {
-	return archive.CopyResource(srcPath, dstPath, followLink)
-}
-
-// CopyTo handles extracting the given content whose
-// entries should be sourced from srcInfo to dstPath.
-//
-// Deprecated: use [archive.CopyTo] instead.
-func CopyTo(content io.Reader, srcInfo archive.CopyInfo, dstPath string) error {
-	return archive.CopyTo(content, srcInfo, dstPath)
-}
-
-// ResolveHostSourcePath decides real path need to be copied.
-//
-// Deprecated: use [archive.ResolveHostSourcePath] instead.
-func ResolveHostSourcePath(path string, followLink bool) (resolvedPath, rebaseName string, _ error) {
-	return archive.ResolveHostSourcePath(path, followLink)
-}
-
-// GetRebaseName normalizes and compares path and resolvedPath.
-//
-// Deprecated: use [archive.GetRebaseName] instead.
-func GetRebaseName(path, resolvedPath string) (string, string) {
-	return archive.GetRebaseName(path, resolvedPath)
-}
diff --git a/vendor/github.com/docker/docker/pkg/archive/diff_deprecated.go b/vendor/github.com/docker/docker/pkg/archive/diff_deprecated.go
deleted file mode 100644
index dd5e0d5ef..000000000
--- a/vendor/github.com/docker/docker/pkg/archive/diff_deprecated.go
+++ /dev/null
@@ -1,37 +0,0 @@
-package archive
-
-import (
-	"io"
-
-	"github.com/moby/go-archive"
-)
-
-// UnpackLayer unpack `layer` to a `dest`.
-//
-// Deprecated: use [archive.UnpackLayer] instead.
-func UnpackLayer(dest string, layer io.Reader, options *TarOptions) (size int64, err error) {
-	return archive.UnpackLayer(dest, layer, toArchiveOpt(options))
-}
-
-// ApplyLayer parses a diff in the standard layer format from `layer`,
-// and applies it to the directory `dest`.
-//
-// Deprecated: use [archive.ApplyLayer] instead.
-func ApplyLayer(dest string, layer io.Reader) (int64, error) {
-	return archive.ApplyLayer(dest, layer)
-}
-
-// ApplyUncompressedLayer parses a diff in the standard layer format from
-// `layer`, and applies it to the directory `dest`.
-//
-// Deprecated: use [archive.ApplyUncompressedLayer] instead.
-func ApplyUncompressedLayer(dest string, layer io.Reader, options *TarOptions) (int64, error) {
-	return archive.ApplyUncompressedLayer(dest, layer, toArchiveOpt(options))
-}
-
-// IsEmpty checks if the tar archive is empty (doesn't contain any entries).
-//
-// Deprecated: use [archive.IsEmpty] instead.
-func IsEmpty(rd io.Reader) (bool, error) {
-	return archive.IsEmpty(rd)
-}
diff --git a/vendor/github.com/docker/docker/pkg/archive/path_deprecated.go b/vendor/github.com/docker/docker/pkg/archive/path_deprecated.go
deleted file mode 100644
index 0fa74de68..000000000
--- a/vendor/github.com/docker/docker/pkg/archive/path_deprecated.go
+++ /dev/null
@@ -1,10 +0,0 @@
-package archive
-
-import "github.com/moby/go-archive"
-
-// CheckSystemDriveAndRemoveDriveLetter verifies that a path is the system drive.
-//
-// Deprecated: use [archive.CheckSystemDriveAndRemoveDriveLetter] instead.
-func CheckSystemDriveAndRemoveDriveLetter(path string) (string, error) {
-	return archive.CheckSystemDriveAndRemoveDriveLetter(path)
-}
diff --git a/vendor/github.com/docker/docker/pkg/archive/utils.go b/vendor/github.com/docker/docker/pkg/archive/utils.go
deleted file mode 100644
index 692cf1602..000000000
--- a/vendor/github.com/docker/docker/pkg/archive/utils.go
+++ /dev/null
@@ -1,42 +0,0 @@
-package archive
-
-import (
-	"github.com/docker/docker/pkg/idtools"
-	"github.com/moby/go-archive"
-)
-
-// ToArchiveOpt converts an [TarOptions] to a [archive.TarOptions].
-//
-// Deprecated: use [archive.TarOptions] instead, this utility is for internal use to transition to the [github.com/moby/go-archive] module.
-func ToArchiveOpt(options *TarOptions) *archive.TarOptions {
-	return toArchiveOpt(options)
-}
-
-func toArchiveOpt(options *TarOptions) *archive.TarOptions {
-	if options == nil {
-		return nil
-	}
-
-	var chownOpts *archive.ChownOpts
-	if options.ChownOpts != nil {
-		chownOpts = &archive.ChownOpts{
-			UID: options.ChownOpts.UID,
-			GID: options.ChownOpts.GID,
-		}
-	}
-
-	return &archive.TarOptions{
-		IncludeFiles:         options.IncludeFiles,
-		ExcludePatterns:      options.ExcludePatterns,
-		Compression:          options.Compression,
-		NoLchown:             options.NoLchown,
-		IDMap:                idtools.ToUserIdentityMapping(options.IDMap),
-		ChownOpts:            chownOpts,
-		IncludeSourceDir:     options.IncludeSourceDir,
-		WhiteoutFormat:       options.WhiteoutFormat,
-		NoOverwriteDirNonDir: options.NoOverwriteDirNonDir,
-		RebaseNames:          options.RebaseNames,
-		InUserNS:             options.InUserNS,
-		BestEffortXattrs:     options.BestEffortXattrs,
-	}
-}
diff --git a/vendor/github.com/docker/docker/pkg/archive/whiteouts_deprecated.go b/vendor/github.com/docker/docker/pkg/archive/whiteouts_deprecated.go
deleted file mode 100644
index 0ab8590b1..000000000
--- a/vendor/github.com/docker/docker/pkg/archive/whiteouts_deprecated.go
+++ /dev/null
@@ -1,10 +0,0 @@
-package archive
-
-import "github.com/moby/go-archive"
-
-const (
-	WhiteoutPrefix     = archive.WhiteoutPrefix     // Deprecated: use [archive.WhiteoutPrefix] instead.
-	WhiteoutMetaPrefix = archive.WhiteoutMetaPrefix // Deprecated: use [archive.WhiteoutMetaPrefix] instead.
-	WhiteoutLinkDir    = archive.WhiteoutLinkDir    // Deprecated: use [archive.WhiteoutLinkDir] instead.
-	WhiteoutOpaqueDir  = archive.WhiteoutOpaqueDir  // Deprecated: use [archive.WhiteoutOpaqueDir] instead.
-)
diff --git a/vendor/github.com/docker/docker/pkg/archive/wrap_deprecated.go b/vendor/github.com/docker/docker/pkg/archive/wrap_deprecated.go
deleted file mode 100644
index e5d3fa9a9..000000000
--- a/vendor/github.com/docker/docker/pkg/archive/wrap_deprecated.go
+++ /dev/null
@@ -1,14 +0,0 @@
-package archive
-
-import (
-	"io"
-
-	"github.com/moby/go-archive"
-)
-
-// Generate generates a new archive from the content provided as input.
-//
-// Deprecated: use [archive.Generate] instead.
-func Generate(input ...string) (io.Reader, error) {
-	return archive.Generate(input...)
-}
diff --git a/vendor/github.com/docker/docker/pkg/idtools/idtools.go b/vendor/github.com/docker/docker/pkg/idtools/idtools.go
deleted file mode 100644
index 982f81d4f..000000000
--- a/vendor/github.com/docker/docker/pkg/idtools/idtools.go
+++ /dev/null
@@ -1,223 +0,0 @@
-package idtools
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/moby/sys/user"
-)
-
-// IDMap contains a single entry for user namespace range remapping. An array
-// of IDMap entries represents the structure that will be provided to the Linux
-// kernel for creating a user namespace.
-//
-// Deprecated: use [user.IDMap] instead.
-type IDMap struct {
-	ContainerID int `json:"container_id"`
-	HostID      int `json:"host_id"`
-	Size        int `json:"size"`
-}
-
-// MkdirAllAndChown creates a directory (include any along the path) and then modifies
-// ownership to the requested uid/gid.  If the directory already exists, this
-// function will still change ownership and permissions.
-//
-// Deprecated: use [user.MkdirAllAndChown] instead.
-func MkdirAllAndChown(path string, mode os.FileMode, owner Identity) error {
-	return user.MkdirAllAndChown(path, mode, owner.UID, owner.GID)
-}
-
-// MkdirAndChown creates a directory and then modifies ownership to the requested uid/gid.
-// If the directory already exists, this function still changes ownership and permissions.
-// Note that unlike os.Mkdir(), this function does not return IsExist error
-// in case path already exists.
-//
-// Deprecated: use [user.MkdirAndChown] instead.
-func MkdirAndChown(path string, mode os.FileMode, owner Identity) error {
-	return user.MkdirAndChown(path, mode, owner.UID, owner.GID)
-}
-
-// MkdirAllAndChownNew creates a directory (include any along the path) and then modifies
-// ownership ONLY of newly created directories to the requested uid/gid. If the
-// directories along the path exist, no change of ownership or permissions will be performed
-//
-// Deprecated: use [user.MkdirAllAndChown] with the [user.WithOnlyNew] option instead.
-func MkdirAllAndChownNew(path string, mode os.FileMode, owner Identity) error {
-	return user.MkdirAllAndChown(path, mode, owner.UID, owner.GID, user.WithOnlyNew)
-}
-
-// GetRootUIDGID retrieves the remapped root uid/gid pair from the set of maps.
-// If the maps are empty, then the root uid/gid will default to "real" 0/0
-//
-// Deprecated: use [(user.IdentityMapping).RootPair] instead.
-func GetRootUIDGID(uidMap, gidMap []IDMap) (int, int, error) {
-	return getRootUIDGID(uidMap, gidMap)
-}
-
-// getRootUIDGID retrieves the remapped root uid/gid pair from the set of maps.
-// If the maps are empty, then the root uid/gid will default to "real" 0/0
-func getRootUIDGID(uidMap, gidMap []IDMap) (int, int, error) {
-	uid, err := toHost(0, uidMap)
-	if err != nil {
-		return -1, -1, err
-	}
-	gid, err := toHost(0, gidMap)
-	if err != nil {
-		return -1, -1, err
-	}
-	return uid, gid, nil
-}
-
-// toContainer takes an id mapping, and uses it to translate a
-// host ID to the remapped ID. If no map is provided, then the translation
-// assumes a 1-to-1 mapping and returns the passed in id
-func toContainer(hostID int, idMap []IDMap) (int, error) {
-	if idMap == nil {
-		return hostID, nil
-	}
-	for _, m := range idMap {
-		if (hostID >= m.HostID) && (hostID <= (m.HostID + m.Size - 1)) {
-			contID := m.ContainerID + (hostID - m.HostID)
-			return contID, nil
-		}
-	}
-	return -1, fmt.Errorf("Host ID %d cannot be mapped to a container ID", hostID)
-}
-
-// toHost takes an id mapping and a remapped ID, and translates the
-// ID to the mapped host ID. If no map is provided, then the translation
-// assumes a 1-to-1 mapping and returns the passed in id #
-func toHost(contID int, idMap []IDMap) (int, error) {
-	if idMap == nil {
-		return contID, nil
-	}
-	for _, m := range idMap {
-		if (contID >= m.ContainerID) && (contID <= (m.ContainerID + m.Size - 1)) {
-			hostID := m.HostID + (contID - m.ContainerID)
-			return hostID, nil
-		}
-	}
-	return -1, fmt.Errorf("Container ID %d cannot be mapped to a host ID", contID)
-}
-
-// Identity is either a UID and GID pair or a SID (but not both)
-type Identity struct {
-	UID int
-	GID int
-	SID string
-}
-
-// Chown changes the numeric uid and gid of the named file to id.UID and id.GID.
-//
-// Deprecated: this method is deprecated and will be removed in the next release.
-func (id Identity) Chown(name string) error {
-	return os.Chown(name, id.UID, id.GID)
-}
-
-// IdentityMapping contains a mappings of UIDs and GIDs.
-// The zero value represents an empty mapping.
-//
-// Deprecated: this type is deprecated and will be removed in the next release.
-type IdentityMapping struct {
-	UIDMaps []IDMap `json:"UIDMaps"`
-	GIDMaps []IDMap `json:"GIDMaps"`
-}
-
-// FromUserIdentityMapping converts a [user.IdentityMapping] to an [idtools.IdentityMapping].
-//
-// Deprecated: use [user.IdentityMapping] directly, this is transitioning to user package.
-func FromUserIdentityMapping(u user.IdentityMapping) IdentityMapping {
-	return IdentityMapping{
-		UIDMaps: fromUserIDMap(u.UIDMaps),
-		GIDMaps: fromUserIDMap(u.GIDMaps),
-	}
-}
-
-func fromUserIDMap(u []user.IDMap) []IDMap {
-	if u == nil {
-		return nil
-	}
-	m := make([]IDMap, len(u))
-	for i := range u {
-		m[i] = IDMap{
-			ContainerID: int(u[i].ID),
-			HostID:      int(u[i].ParentID),
-			Size:        int(u[i].Count),
-		}
-	}
-	return m
-}
-
-// ToUserIdentityMapping converts an [idtools.IdentityMapping] to a [user.IdentityMapping].
-//
-// Deprecated: use [user.IdentityMapping] directly, this is transitioning to user package.
-func ToUserIdentityMapping(u IdentityMapping) user.IdentityMapping {
-	return user.IdentityMapping{
-		UIDMaps: toUserIDMap(u.UIDMaps),
-		GIDMaps: toUserIDMap(u.GIDMaps),
-	}
-}
-
-func toUserIDMap(u []IDMap) []user.IDMap {
-	if u == nil {
-		return nil
-	}
-	m := make([]user.IDMap, len(u))
-	for i := range u {
-		m[i] = user.IDMap{
-			ID:       int64(u[i].ContainerID),
-			ParentID: int64(u[i].HostID),
-			Count:    int64(u[i].Size),
-		}
-	}
-	return m
-}
-
-// RootPair returns a uid and gid pair for the root user. The error is ignored
-// because a root user always exists, and the defaults are correct when the uid
-// and gid maps are empty.
-func (i IdentityMapping) RootPair() Identity {
-	uid, gid, _ := getRootUIDGID(i.UIDMaps, i.GIDMaps)
-	return Identity{UID: uid, GID: gid}
-}
-
-// ToHost returns the host UID and GID for the container uid, gid.
-// Remapping is only performed if the ids aren't already the remapped root ids
-func (i IdentityMapping) ToHost(pair Identity) (Identity, error) {
-	var err error
-	target := i.RootPair()
-
-	if pair.UID != target.UID {
-		target.UID, err = toHost(pair.UID, i.UIDMaps)
-		if err != nil {
-			return target, err
-		}
-	}
-
-	if pair.GID != target.GID {
-		target.GID, err = toHost(pair.GID, i.GIDMaps)
-	}
-	return target, err
-}
-
-// ToContainer returns the container UID and GID for the host uid and gid
-func (i IdentityMapping) ToContainer(pair Identity) (int, int, error) {
-	uid, err := toContainer(pair.UID, i.UIDMaps)
-	if err != nil {
-		return -1, -1, err
-	}
-	gid, err := toContainer(pair.GID, i.GIDMaps)
-	return uid, gid, err
-}
-
-// Empty returns true if there are no id mappings
-func (i IdentityMapping) Empty() bool {
-	return len(i.UIDMaps) == 0 && len(i.GIDMaps) == 0
-}
-
-// CurrentIdentity returns the identity of the current process
-//
-// Deprecated: use [os.Getuid] and [os.Getegid] instead.
-func CurrentIdentity() Identity {
-	return Identity{UID: os.Getuid(), GID: os.Getegid()}
-}
diff --git a/vendor/github.com/docker/docker/pkg/idtools/idtools_windows.go b/vendor/github.com/docker/docker/pkg/idtools/idtools_windows.go
deleted file mode 100644
index f83f59f30..000000000
--- a/vendor/github.com/docker/docker/pkg/idtools/idtools_windows.go
+++ /dev/null
@@ -1,12 +0,0 @@
-package idtools
-
-const (
-	SeTakeOwnershipPrivilege = "SeTakeOwnershipPrivilege"
-)
-
-// TODO(thaJeztah): these magic consts need a source of reference, and should be defined in a canonical location
-const (
-	ContainerAdministratorSidString = "S-1-5-93-2-1"
-
-	ContainerUserSidString = "S-1-5-93-2-2"
-)
diff --git a/vendor/github.com/fsouza/go-dockerclient/.golangci.yaml b/vendor/github.com/fsouza/go-dockerclient/.golangci.yaml
index cdbf80dec..f6e588a65 100644
--- a/vendor/github.com/fsouza/go-dockerclient/.golangci.yaml
+++ b/vendor/github.com/fsouza/go-dockerclient/.golangci.yaml
@@ -1,5 +1,24 @@
+version: "2"
 linters:
-  disable-all: true
+  default: none
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
   enable:
     - gofumpt
     - goimports
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
diff --git a/vendor/github.com/fsouza/go-dockerclient/container_update.go b/vendor/github.com/fsouza/go-dockerclient/container_update.go
index e8de21365..d2116dbd7 100644
--- a/vendor/github.com/fsouza/go-dockerclient/container_update.go
+++ b/vendor/github.com/fsouza/go-dockerclient/container_update.go
@@ -30,7 +30,7 @@ type UpdateContainerOptions struct {
 //
 // See https://goo.gl/Y6fXUy for more details.
 func (c *Client) UpdateContainer(id string, opts UpdateContainerOptions) error {
-	resp, err := c.do(http.MethodPost, fmt.Sprintf("/containers/"+id+"/update"), doOptions{
+	resp, err := c.do(http.MethodPost, fmt.Sprintf("/containers/%s/update", id), doOptions{
 		data:      opts,
 		forceJSON: true,
 		context:   opts.Context,
diff --git a/vendor/github.com/fsouza/go-dockerclient/event.go b/vendor/github.com/fsouza/go-dockerclient/event.go
index ce1fb5021..22d64f6ab 100644
--- a/vendor/github.com/fsouza/go-dockerclient/event.go
+++ b/vendor/github.com/fsouza/go-dockerclient/event.go
@@ -271,11 +271,13 @@ func (eventState *eventMonitoringState) monitorEvents(c *Client, opts EventsOpti
 				return
 			}
 			if ev == EOFEvent {
-				eventState.disableEventMonitoring()
+				go eventState.disableEventMonitoring()
 				return
 			}
-			eventState.updateLastSeen(ev)
-			eventState.sendEvent(ev)
+			go func(ev *APIEvents) {
+				eventState.updateLastSeen(ev)
+				eventState.sendEvent(ev)
+			}(ev)
 		case err = <-eventState.errC:
 			if errors.Is(err, ErrNoListeners) {
 				eventState.disableEventMonitoring()
diff --git a/vendor/github.com/fsouza/go-dockerclient/tar.go b/vendor/github.com/fsouza/go-dockerclient/tar.go
index b764285b9..0d40c644a 100644
--- a/vendor/github.com/fsouza/go-dockerclient/tar.go
+++ b/vendor/github.com/fsouza/go-dockerclient/tar.go
@@ -12,7 +12,7 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/docker/docker/pkg/archive"
+	"github.com/moby/go-archive"
 	"github.com/moby/patternmatcher"
 )
 
diff --git a/vendor/github.com/opencontainers/cgroups/cgroups.go b/vendor/github.com/opencontainers/cgroups/cgroups.go
index 1f127550c..5a97bd36b 100644
--- a/vendor/github.com/opencontainers/cgroups/cgroups.go
+++ b/vendor/github.com/opencontainers/cgroups/cgroups.go
@@ -29,6 +29,11 @@ type Manager interface {
 	// can be used to merely create a cgroup.
 	Apply(pid int) error
 
+	// AddPid adds a process with a given pid to an existing cgroup.
+	// The subcgroup argument is either empty, or a path relative to
+	// a cgroup under under the manager's cgroup.
+	AddPid(subcgroup string, pid int) error
+
 	// GetPids returns the PIDs of all processes inside the cgroup.
 	GetPids() ([]int, error)
 
diff --git a/vendor/github.com/opencontainers/cgroups/fs/fs.go b/vendor/github.com/opencontainers/cgroups/fs/fs.go
index 23a8fb874..625931193 100644
--- a/vendor/github.com/opencontainers/cgroups/fs/fs.go
+++ b/vendor/github.com/opencontainers/cgroups/fs/fs.go
@@ -4,6 +4,8 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"path"
+	"strings"
 	"sync"
 
 	"golang.org/x/sys/unix"
@@ -139,6 +141,33 @@ func (m *Manager) Apply(pid int) (retErr error) {
 	return retErr
 }
 
+// AddPid adds a process with a given pid to an existing cgroup.
+// The subcgroup argument is either empty, or a path relative to
+// a cgroup under under the manager's cgroup.
+func (m *Manager) AddPid(subcgroup string, pid int) (retErr error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	c := m.cgroups
+
+	for _, dir := range m.paths {
+		path := path.Join(dir, subcgroup)
+		if !strings.HasPrefix(path, dir) {
+			return fmt.Errorf("bad sub cgroup path: %s", subcgroup)
+		}
+
+		if err := cgroups.WriteCgroupProc(path, pid); err != nil {
+			if isIgnorableError(c.Rootless, err) && c.Path == "" {
+				retErr = cgroups.ErrRootless
+				continue
+			}
+			return err
+		}
+	}
+
+	return retErr
+}
+
 func (m *Manager) Destroy() error {
 	m.mu.Lock()
 	defer m.mu.Unlock()
diff --git a/vendor/github.com/opencontainers/cgroups/fs2/fs2.go b/vendor/github.com/opencontainers/cgroups/fs2/fs2.go
index c5d5a1f8e..356d08798 100644
--- a/vendor/github.com/opencontainers/cgroups/fs2/fs2.go
+++ b/vendor/github.com/opencontainers/cgroups/fs2/fs2.go
@@ -4,6 +4,7 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"path/filepath"
 	"strings"
 
 	"github.com/opencontainers/cgroups"
@@ -83,6 +84,18 @@ func (m *Manager) Apply(pid int) error {
 	return nil
 }
 
+// AddPid adds a process with a given pid to an existing cgroup.
+// The subcgroup argument is either empty, or a path relative to
+// a cgroup under under the manager's cgroup.
+func (m *Manager) AddPid(subcgroup string, pid int) error {
+	path := filepath.Join(m.dirPath, subcgroup)
+	if !strings.HasPrefix(path, m.dirPath) {
+		return fmt.Errorf("bad sub cgroup path: %s", subcgroup)
+	}
+
+	return cgroups.WriteCgroupProc(path, pid)
+}
+
 func (m *Manager) GetPids() ([]int, error) {
 	return cgroups.GetPids(m.dirPath)
 }
diff --git a/vendor/github.com/spf13/pflag/flag.go b/vendor/github.com/spf13/pflag/flag.go
index eeed1e92b..2fd3c5759 100644
--- a/vendor/github.com/spf13/pflag/flag.go
+++ b/vendor/github.com/spf13/pflag/flag.go
@@ -143,8 +143,9 @@ type ParseErrorsAllowlist struct {
 	UnknownFlags bool
 }
 
-// DEPRECATED: please use ParseErrorsAllowlist instead
-// This type will be removed in a future release
+// ParseErrorsWhitelist defines the parsing errors that can be ignored.
+//
+// Deprecated: use [ParseErrorsAllowlist] instead. This type will be removed in a future release.
 type ParseErrorsWhitelist = ParseErrorsAllowlist
 
 // NormalizedName is a flag name that has been normalized according to rules
@@ -165,8 +166,9 @@ type FlagSet struct {
 	// ParseErrorsAllowlist is used to configure an allowlist of errors
 	ParseErrorsAllowlist ParseErrorsAllowlist
 
-	// DEPRECATED: please use ParseErrorsAllowlist instead
-	// This field will be removed in a future release
+	// ParseErrorsAllowlist is used to configure an allowlist of errors.
+	//
+	// Deprecated: use [FlagSet.ParseErrorsAllowlist] instead. This field will be removed in a future release.
 	ParseErrorsWhitelist ParseErrorsAllowlist
 
 	name              string
@@ -1185,7 +1187,7 @@ func (f *FlagSet) Parse(arguments []string) error {
 		case ContinueOnError:
 			return err
 		case ExitOnError:
-			if errors.Is(err, ErrHelp) {
+			if err == ErrHelp {
 				os.Exit(0)
 			}
 			fmt.Fprintln(f.Output(), err)
@@ -1214,7 +1216,7 @@ func (f *FlagSet) ParseAll(arguments []string, fn func(flag *Flag, value string)
 		case ContinueOnError:
 			return err
 		case ExitOnError:
-			if errors.Is(err, ErrHelp) {
+			if err == ErrHelp {
 				os.Exit(0)
 			}
 			fmt.Fprintln(f.Output(), err)
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 9ecbd3f83..d82ab5794 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -135,9 +135,7 @@ github.com/docker/docker/api/types/volume
 github.com/docker/docker/client
 github.com/docker/docker/internal/lazyregexp
 github.com/docker/docker/internal/multierror
-github.com/docker/docker/pkg/archive
 github.com/docker/docker/pkg/homedir
-github.com/docker/docker/pkg/idtools
 github.com/docker/docker/pkg/jsonmessage
 github.com/docker/docker/pkg/stdcopy
 # github.com/docker/docker-credential-helpers v0.9.3
@@ -159,8 +157,8 @@ github.com/felixge/httpsnoop
 ## explicit; go 1.17
 github.com/fsnotify/fsnotify
 github.com/fsnotify/fsnotify/internal
-# github.com/fsouza/go-dockerclient v1.12.1
-## explicit; go 1.23
+# github.com/fsouza/go-dockerclient v1.12.2
+## explicit; go 1.24.0
 github.com/fsouza/go-dockerclient
 # github.com/go-jose/go-jose/v4 v4.0.5
 ## explicit; go 1.21
@@ -254,7 +252,7 @@ github.com/miekg/pkcs11
 # github.com/mistifyio/go-zfs/v3 v3.0.1
 ## explicit; go 1.14
 github.com/mistifyio/go-zfs/v3
-# github.com/moby/buildkit v0.23.2
+# github.com/moby/buildkit v0.24.0
 ## explicit; go 1.23.0
 github.com/moby/buildkit/frontend/dockerfile/command
 github.com/moby/buildkit/frontend/dockerfile/parser
@@ -299,7 +297,7 @@ github.com/modern-go/reflect2
 # github.com/morikuni/aec v1.0.0
 ## explicit
 github.com/morikuni/aec
-# github.com/opencontainers/cgroups v0.0.4
+# github.com/opencontainers/cgroups v0.0.5
 ## explicit; go 1.23.0
 github.com/opencontainers/cgroups
 github.com/opencontainers/cgroups/devices/config
@@ -314,7 +312,7 @@ github.com/opencontainers/go-digest
 ## explicit; go 1.18
 github.com/opencontainers/image-spec/specs-go
 github.com/opencontainers/image-spec/specs-go/v1
-# github.com/opencontainers/runc v1.3.0
+# github.com/opencontainers/runc v1.3.1
 ## explicit; go 1.23.0
 github.com/opencontainers/runc/libcontainer/apparmor
 github.com/opencontainers/runc/libcontainer/devices
@@ -385,7 +383,7 @@ github.com/smallstep/pkcs7/internal/legacy/x509
 # github.com/spf13/cobra v1.10.1
 ## explicit; go 1.15
 github.com/spf13/cobra
-# github.com/spf13/pflag v1.0.9
+# github.com/spf13/pflag v1.0.10
 ## explicit; go 1.12
 github.com/spf13/pflag
 # github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6
@@ -689,8 +687,8 @@ golang.org/x/net/idna
 golang.org/x/net/internal/httpcommon
 golang.org/x/net/internal/timeseries
 golang.org/x/net/trace
-# golang.org/x/sync v0.16.0
-## explicit; go 1.23.0
+# golang.org/x/sync v0.17.0
+## explicit; go 1.24.0
 golang.org/x/sync/errgroup
 golang.org/x/sync/semaphore
 # golang.org/x/sys v0.35.0



Test patch:
diff --git a/tests/bud.bats b/tests/bud.bats
index cab4eb898..135e0702b 100644
--- a/tests/bud.bats
+++ b/tests/bud.bats
@@ -1361,6 +1361,8 @@ _EOF
   RUN --mount=type=cache,id=${cacheid},target=/var/tmp,uid=1000,gid=1000 stat / /var/tmp
   RUN --mount=type=cache,id=${cacheid},target=/var/tmp,uid=1000,gid=1000 test \`stat -c %u /var/tmp\` -eq 1000
   RUN --mount=type=cache,id=${cacheid},target=/var/tmp,uid=1000,gid=1000 touch /var/tmp/should-be-able-to-write
+  RUN --mount=type=cache,id=${cacheid},target=/new-parent/var/tmp,uid=1000,gid=1000 touch /var/tmp/should-be-able-to-write
+  RUN --mount=type=cache,id=${cacheid},target=/var/new-parent/tmp,uid=1000,gid=1000 touch /var/tmp/should-be-able-to-write
 EOF
   run_buildah build $WITH_POLICY_JSON ${contextdir}
 
@@ -1372,6 +1374,8 @@ EOF
   RUN --mount=type=cache,id=${cacheid},target=/var/tmp,uid=1000,gid=1000 stat / /var/tmp
   RUN --mount=type=cache,id=${cacheid},target=/var/tmp,uid=1000,gid=1000 test \`stat -c %u /var/tmp\` -eq 1000
   RUN --mount=type=cache,id=${cacheid},target=/var/tmp,uid=1000,gid=1000 touch /var/tmp/should-be-able-to-write
+  RUN --mount=type=cache,id=${cacheid},target=/new/parent/var/tmp,uid=1000,gid=1000 touch /new/parent/var/tmp/should-be-able-to-write
+  RUN --mount=type=cache,id=${cacheid},target=/var/new/parent/tmp,uid=1000,gid=1000 touch /var/new/parent/tmp/should-be-able-to-write
 EOF
   if test `id -u` -eq 0 ; then
     run_buildah build --userns-uid-map 0:1:1023 --userns-gid-map 0:1:1023 $WITH_POLICY_JSON ${contextdir}
@@ -1380,6 +1384,55 @@ EOF
   fi
 }
 
+@test "build-mount-cache-writeable-as-unprivileged-user" {
+  _prefetch busybox
+  local contextdir=${TEST_SCRATCH_DIR}/context
+  mkdir ${contextdir}
+
+  cat > ${contextdir}/Dockerfile << EOF
+  FROM busybox
+  USER 1000:1000
+  RUN --mount=type=cache,target=/usr/local/bin,id=/usr/local/bin/$$,uid=1000,gid=1000 touch /usr/local/bin/new-file
+  RUN --mount=type=cache,target=/var/not/already/there,id=/var/not/already/there/$$,uid=1000,gid=1000 touch /var/not/already/there/new-file
+EOF
+  run_buildah build $WITH_POLICY_JSON ${contextdir}
+}
+
+@test "build-mount-bind-readable-as-unprivileged-user" {
+  _prefetch busybox
+  local contextdir=${TEST_SCRATCH_DIR}/context
+  mkdir ${contextdir}
+
+  cat > ${contextdir}/Dockerfile << EOF
+  FROM busybox
+  USER 1000:1000
+  RUN --mount=type=bind,target=/usr/local,from=busybox busybox ls /usr/local/bin/busybox
+  RUN --mount=type=bind,target=/var/not/already/there,from=busybox busybox ls /var/not/already/there/bin/busybox
+EOF
+  run_buildah build $WITH_POLICY_JSON ${contextdir}
+}
+
+@test "build-mount-secret-readable-as-unprivileged-user" {
+  _prefetch busybox
+  local contextdir=${TEST_SCRATCH_DIR}/context
+  mkdir ${contextdir}
+  local secretfile=${TEST_SCRATCH_DIR}/secret.txt
+
+  echo -n hidingInPlainSight > ${secretfile}
+  cat > ${contextdir}/Dockerfile << EOF
+  FROM busybox
+  USER 1000:1000
+  RUN --mount=type=secret,id=theSecret,target=/var/not/already/there,uid=1000,gid=1000 wc -c /var/not/already/there
+EOF
+  run_buildah build --secret id=theSecret,type=file,src=${secretfile} $WITH_POLICY_JSON ${contextdir}
+  cat > ${contextdir}/Dockerfile << EOF
+  FROM busybox
+  USER 1000:1000
+  RUN --mount=type=secret,id=theSecret,target=/top/var/tmp/there,uid=1000,gid=1000 wc -c /top/var/tmp/there
+EOF
+  run_buildah build --secret id=theSecret,type=file,src=${secretfile} $WITH_POLICY_JSON ${contextdir}
+}
+
 @test "build test if supplemental groups has gid with --isolation chroot" {
   test "${BUILDAH_ISOLATION}" != chroot || skip "BUILDAH_ISOLATION=${BUILDAH_ISOLATION} overrides --isolation"
 
diff --git a/tests/run.bats b/tests/run.bats
index 0697d49d6..7cf50723d 100644
--- a/tests/run.bats
+++ b/tests/run.bats
@@ -982,13 +982,13 @@ _EOF
 	run_buildah from --quiet --pull=false $WITH_POLICY_JSON alpine
 	cid=$output
 	for mask in /proc/acpi /proc/interrupts /proc/kcore /proc/keys /proc/latency_stats /proc/sched_debug /proc/scsi /proc/timer_list /proc/timer_stats /sys/devices/virtual/powercap /sys/firmware /sys/fs/selinux; do
-	        if test -d $mask; then
-                   run_buildah run $cid sh -c "echo $mask/*" # globbing will fail whether it's simply unreadable, or readable but empty
-                   expect_output "$mask/*" "Directories should be empty"
+		if test -d $mask; then
+			run_buildah run $cid sh -c "echo $mask/*" # globbing will fail whether it's simply unreadable, or readable but empty
+			expect_output "$mask/*" "Directories should be empty"
 		fi
 		if test -f $mask; then
-		   run_buildah run $cid cat $mask
-		   expect_output "" "Directories should be empty"
+			run_buildah run $cid cat $mask
+			expect_output "" "Directories should be empty"
 		fi
 	done
 }