Repository: docker/buildx

Issue:
`docker build` quiet `-q` with output `-o` specified prints empty line
### Contributing guidelines

- [x] I've read the [contributing guidelines](https://github.com/docker/buildx/blob/master/.github/CONTRIBUTING.md) and wholeheartedly agree

### I've found a bug and checked that ...

- [x] ... the documentation does not mention anything about my problem
- [x] ... there are no open or closed issues that are related to my problem

### Description

I ran `docker build -q -t myimage:local -o output-path/ .`

I'm aware that `-q` explicitly states that it prints the Image ID on success.

### Expected behaviour

It should print nothing and just put all files to the output directory.

### Actual behaviour

I get an empty line in my output.

### Buildx version

github.com/docker/buildx 0.25.0 faaea65da4ba0e58a13cd9cadcb950c51cf3b3c9

### Docker info

```text

```

### Builders list

```text
not relevant
```

### Configuration

I could provide, if necessary - but this is probably not related.

### Build logs

```text

```

### Additional info

I know it is a nitpick, but I run this command in a `make` command and it just looks as if there is something missing. I could `sed` or `awk` it away, but this just works around the root cause.

I'm happy to open a PR for this small inconvenience, I just need some input, if the output should be skipped if:
1. the image id is empty anyway? (could break scripts that check the last line of the output)
2. only if a special flag is set? (would be explicit, non-breaking and fit my use-case just fine)
3. only local and tar exports are specified? (is the image id always empty then?)

Discussion:
@jonasbadstuebner: I found an argument against option 1: https://github.com/docker/buildx/pull/740/files#r702071754

I would prefer option 2 and call the flag `--suppress-iid-output`.
But that would not make it clear, that it is only in quiet mode...

I wish `quiet` would just mean "no-output on success"...@tonistiigi: I think we should just add `--progress=none`. `-q` is an old flag with weird behavior, where it controls multiple things and is only meant for build with special conditions. Controlling progress should be done with `--progress` and getting image ID/metadata with `--iidfile` or more powerful `--metadata-file`.

I was actually surprised we didn't support this already. We have `--progress=quiet`, but unfortunately, that copies the behavior of printing image ID.@jsternberg: Closing this since `--progress=none` was added in #3431.

Solution patch:
diff --git a/build/build.go b/build/build.go
index 9dcd5c96..7d7e3dcc 100644
--- a/build/build.go
+++ b/build/build.go
@@ -723,7 +723,7 @@ func BuildWithResultHandler(ctx context.Context, nodes []builder.Node, opts map[
 								return err
 							}
 
-							dt, desc, err := itpull.Combine(ctx, srcs, indexAnnotations, false)
+							dt, desc, _, err := itpull.Combine(ctx, srcs, indexAnnotations, false)
 							if err != nil {
 								return err
 							}
diff --git a/commands/build.go b/commands/build.go
index bdbed6d0..39888bdb 100644
--- a/commands/build.go
+++ b/commands/build.go
@@ -210,7 +210,14 @@ func (o *buildOptions) toOptions() (*BuildOptions, error) {
 }
 
 func (o *buildOptions) toDisplayMode() (progressui.DisplayMode, error) {
-	progress := progressui.DisplayMode(o.progress)
+	progressMode := o.progress
+	if progressMode == "quiet" {
+		o.quiet = true
+	}
+	if progressMode == "none" { // in buildx "quiet" means printing image ID in the end
+		progressMode = "quiet"
+	}
+	progress := progressui.DisplayMode(progressMode)
 	if o.quiet {
 		if progress != progressui.AutoMode && progress != progressui.QuietMode {
 			return "", errors.Errorf("progress=%s and quiet cannot be used together", o.progress)
@@ -386,7 +393,9 @@ func runBuild(ctx context.Context, dockerCli command.Cli, debugOpts debuggerOpti
 	case progressui.RawJSONMode:
 		// no additional display
 	case progressui.QuietMode:
-		fmt.Println(getImageID(resp.ExporterResponse))
+		if options.quiet {
+			fmt.Println(getImageID(resp.ExporterResponse))
+		}
 	default:
 		desktop.PrintBuildDetails(os.Stderr, printer.BuildRefs(), term)
 	}
@@ -624,7 +633,7 @@ type commonFlags struct {
 
 func commonBuildFlags(options *commonFlags, flags *pflag.FlagSet) {
 	options.noCache = flags.Bool("no-cache", false, "Do not use cache when building the image")
-	flags.StringVar(&options.progress, "progress", "auto", `Set type of progress output ("auto", "quiet", "plain", "tty", "rawjson"). Use plain to show container output`)
+	flags.StringVar(&options.progress, "progress", "auto", `Set type of progress output ("auto", "none",  "plain", "quiet", "rawjson", "tty"). Use plain to show container output`)
 	options.pull = flags.Bool("pull", false, "Always attempt to pull all referenced images")
 	flags.StringVar(&options.metadataFile, "metadata-file", "", "Write build result metadata to a file")
 }
diff --git a/commands/dial_stdio.go b/commands/dial_stdio.go
index 0aa265bc..e848efba 100644
--- a/commands/dial_stdio.go
+++ b/commands/dial_stdio.go
@@ -44,7 +44,12 @@ func runDialStdio(dockerCli command.Cli, opts stdioOptions) error {
 		return err
 	}
 
-	printer, err := progress.NewPrinter(ctx, os.Stderr, progressui.DisplayMode(opts.progress), progress.WithPhase("dial-stdio"), progress.WithDesc("builder: "+b.Name, "builder:"+b.Name))
+	progressMode := opts.progress
+	if progressMode == "none" { // in buildx "quiet" means printing image ID in the end
+		progressMode = "quiet"
+	}
+
+	printer, err := progress.NewPrinter(ctx, os.Stderr, progressui.DisplayMode(progressMode), progress.WithPhase("dial-stdio"), progress.WithDesc("builder: "+b.Name, "builder:"+b.Name))
 	if err != nil {
 		return err
 	}
@@ -127,6 +132,6 @@ func dialStdioCmd(dockerCli command.Cli, rootOpts *rootOptions) *cobra.Command {
 
 	flags := cmd.Flags()
 	flags.StringVar(&opts.platform, "platform", os.Getenv("DOCKER_DEFAULT_PLATFORM"), "Target platform: this is used for node selection")
-	flags.StringVar(&opts.progress, "progress", "quiet", `Set type of progress output ("auto", "plain", "tty", "rawjson"). Use plain to show container output`)
+	flags.StringVar(&opts.progress, "progress", "none", `Set type of progress output ("auto", "plain", "rawjson", "tty"). Use plain to show container output`)
 	return cmd
 }
diff --git a/commands/imagetools/create.go b/commands/imagetools/create.go
index 8a90e8ba..c23935b2 100644
--- a/commands/imagetools/create.go
+++ b/commands/imagetools/create.go
@@ -7,6 +7,8 @@ import (
 	"os"
 	"strings"
 
+	"github.com/containerd/containerd/v2/core/images"
+	"github.com/containerd/platforms"
 	"github.com/distribution/reference"
 	"github.com/docker/buildx/builder"
 	"github.com/docker/buildx/util/buildflags"
@@ -14,6 +16,7 @@ import (
 	"github.com/docker/buildx/util/imagetools"
 	"github.com/docker/buildx/util/progress"
 	"github.com/docker/cli/cli/command"
+	"github.com/moby/buildkit/util/attestation"
 	"github.com/moby/buildkit/util/progress/progressui"
 	"github.com/opencontainers/go-digest"
 	ocispecs "github.com/opencontainers/image-spec/specs-go/v1"
@@ -31,6 +34,7 @@ type createOptions struct {
 	actionAppend bool
 	progress     string
 	preferIndex  bool
+	platforms    []string
 }
 
 func runCreate(ctx context.Context, dockerCli command.Cli, in createOptions, args []string) error {
@@ -67,6 +71,11 @@ func runCreate(ctx context.Context, dockerCli command.Cli, in createOptions, arg
 		return err
 	}
 
+	platforms, err := parsePlatforms(in.platforms)
+	if err != nil {
+		return err
+	}
+
 	repos := map[string]struct{}{}
 
 	for _, t := range tags {
@@ -160,7 +169,12 @@ func runCreate(ctx context.Context, dockerCli command.Cli, in createOptions, arg
 		return errors.Wrapf(err, "failed to parse annotations")
 	}
 
-	dt, desc, err := r.Combine(ctx, srcs, annotations, in.preferIndex)
+	dt, desc, srcMap, err := r.Combine(ctx, srcs, annotations, in.preferIndex)
+	if err != nil {
+		return err
+	}
+
+	dt, desc, manifests, err := filterPlatforms(dt, desc, srcMap, platforms)
 	if err != nil {
 		return err
 	}
@@ -170,12 +184,21 @@ func runCreate(ctx context.Context, dockerCli command.Cli, in createOptions, arg
 		return nil
 	}
 
+	// manifests can be nil only if pushing one single-platform desc directly
+	if manifests == nil {
+		manifests = []descWithSource{{Descriptor: desc, Source: srcs[0]}}
+	}
+
 	// new resolver cause need new auth
 	r = imagetools.New(imageopt)
 
 	ctx2, cancel := context.WithCancelCause(context.TODO())
 	defer func() { cancel(errors.WithStack(context.Canceled)) }()
-	printer, err := progress.NewPrinter(ctx2, os.Stderr, progressui.DisplayMode(in.progress))
+	progressMode := in.progress
+	if progressMode == "none" {
+		progressMode = "quiet"
+	}
+	printer, err := progress.NewPrinter(ctx2, os.Stderr, progressui.DisplayMode(progressMode))
 	if err != nil {
 		return err
 	}
@@ -187,17 +210,12 @@ func runCreate(ctx context.Context, dockerCli command.Cli, in createOptions, arg
 		eg.Go(func() error {
 			return progress.Wrap(fmt.Sprintf("pushing %s", t.String()), pw.Write, func(sub progress.SubLogger) error {
 				eg2, _ := errgroup.WithContext(ctx)
-				for _, s := range srcs {
-					if reference.Domain(s.Ref) == reference.Domain(t) && reference.Path(s.Ref) == reference.Path(t) {
-						continue
-					}
-					s := s
+				for _, desc := range manifests {
 					eg2.Go(func() error {
-						sub.Log(1, fmt.Appendf(nil, "copying %s from %s to %s\n", s.Desc.Digest.String(), s.Ref.String(), t.String()))
-						return r.Copy(ctx, s, t)
+						sub.Log(1, fmt.Appendf(nil, "copying %s from %s to %s\n", desc.Digest.String(), desc.Source.Ref.String(), t.String()))
+						return r.Copy(ctx, desc.Source, t)
 					})
 				}
-
 				if err := eg2.Wait(); err != nil {
 					return err
 				}
@@ -216,6 +234,107 @@ func runCreate(ctx context.Context, dockerCli command.Cli, in createOptions, arg
 	return err
 }
 
+type descWithSource struct {
+	ocispecs.Descriptor
+	Source *imagetools.Source
+}
+
+func filterPlatforms(dt []byte, desc ocispecs.Descriptor, srcMap map[digest.Digest]*imagetools.Source, plats []ocispecs.Platform) ([]byte, ocispecs.Descriptor, []descWithSource, error) {
+	if len(plats) == 0 {
+		return dt, desc, nil, nil
+	}
+
+	matcher := platforms.Any(plats...)
+
+	if !images.IsIndexType(desc.MediaType) {
+		var mfst ocispecs.Manifest
+		if err := json.Unmarshal(dt, &mfst); err != nil {
+			return nil, ocispecs.Descriptor{}, nil, errors.Wrapf(err, "failed to parse manifest")
+		}
+		if desc.Platform == nil {
+			return nil, ocispecs.Descriptor{}, nil, errors.Errorf("cannot filter platforms from a manifest without platform information")
+		}
+		if !matcher.Match(*desc.Platform) {
+			return nil, ocispecs.Descriptor{}, nil, errors.Errorf("input platform %s does not match any of the provided platforms", platforms.Format(*desc.Platform))
+		}
+		return dt, desc, nil, nil
+	}
+
+	var idx ocispecs.Index
+	if err := json.Unmarshal(dt, &idx); err != nil {
+		return nil, ocispecs.Descriptor{}, nil, errors.Wrapf(err, "failed to parse index")
+	}
+
+	manifestMap := map[digest.Digest]ocispecs.Descriptor{}
+	for _, m := range idx.Manifests {
+		manifestMap[m.Digest] = m
+	}
+	references := map[digest.Digest]struct{}{}
+	for _, m := range idx.Manifests {
+		if refType, ok := m.Annotations[attestation.DockerAnnotationReferenceType]; ok && refType == attestation.DockerAnnotationReferenceTypeDefault {
+			dgstStr, ok := m.Annotations[attestation.DockerAnnotationReferenceDigest]
+			if !ok {
+				continue
+			}
+			dgst, err := digest.Parse(dgstStr)
+			if err != nil {
+				continue
+			}
+			subject, ok := manifestMap[dgst]
+			if !ok {
+				continue
+			}
+			if subject.Platform == nil || matcher.Match(*subject.Platform) {
+				references[m.Digest] = struct{}{}
+			}
+		}
+	}
+
+	var mfsts []ocispecs.Descriptor
+	var mfstsWithSource []descWithSource
+
+	for _, m := range idx.Manifests {
+		if _, isRef := references[m.Digest]; isRef || m.Platform == nil || matcher.Match(*m.Platform) {
+			src, ok := srcMap[m.Digest]
+			if !ok {
+				defaultSource, ok := srcMap[desc.Digest]
+				if !ok {
+					return nil, ocispecs.Descriptor{}, nil, errors.Errorf("internal error: no source found for %s", m.Digest)
+				}
+				src = defaultSource
+			}
+			mfsts = append(mfsts, m)
+			mfstsWithSource = append(mfstsWithSource, descWithSource{
+				Descriptor: m,
+				Source:     src,
+			})
+		}
+	}
+	if len(mfsts) == len(idx.Manifests) {
+		// all platforms matched, no need to rewrite index
+		return dt, desc, mfstsWithSource, nil
+	}
+
+	if len(mfsts) == 0 {
+		return nil, ocispecs.Descriptor{}, nil, errors.Errorf("none of the manifests match the provided platforms")
+	}
+
+	idx.Manifests = mfsts
+	idxBytes, err := json.MarshalIndent(&idx, "", "  ")
+	if err != nil {
+		return nil, ocispecs.Descriptor{}, nil, errors.Wrap(err, "failed to marshal index")
+	}
+
+	desc = ocispecs.Descriptor{
+		MediaType:   desc.MediaType,
+		Size:        int64(len(idxBytes)),
+		Digest:      digest.FromBytes(idxBytes),
+		Annotations: desc.Annotations,
+	}
+
+	return idxBytes, desc, mfstsWithSource, nil
+}
+
 func parseSources(in []string) ([]*imagetools.Source, error) {
 	out := make([]*imagetools.Source, len(in))
 	for i, in := range in {
@@ -228,6 +347,26 @@ func parseSources(in []string) ([]*imagetools.Source, error) {
 	return out, nil
 }
 
+func parsePlatforms(in []string) ([]ocispecs.Platform, error) {
+	out := make([]ocispecs.Platform, 0, len(in))
+	for _, p := range in {
+		if arr := strings.Split(p, ","); len(arr) > 1 {
+			v, err := parsePlatforms(arr)
+			if err != nil {
+				return nil, err
+			}
+			out = append(out, v...)
+			continue
+		}
+		plat, err := platforms.Parse(p)
+		if err != nil {
+			return nil, errors.Wrapf(err, "invalid platform %q", p)
+		}
+		out = append(out, plat)
+	}
+	return out, nil
+}
+
 func parseRefs(in []string) ([]reference.Named, error) {
 	refs := make([]reference.Named, len(in))
 	for i, in := range in {
@@ -288,9 +427,10 @@ func createCmd(dockerCli command.Cli, opts RootOptions) *cobra.Command {
 	flags.StringArrayVarP(&options.tags, "tag", "t", []string{}, "Set reference for new image")
 	flags.BoolVar(&options.dryrun, "dry-run", false, "Show final image instead of pushing")
 	flags.BoolVar(&options.actionAppend, "append", false, "Append to existing manifest")
-	flags.StringVar(&options.progress, "progress", "auto", `Set type of progress output ("auto", "plain", "tty", "rawjson"). Use plain to show container output`)
+	flags.StringVar(&options.progress, "progress", "auto", `Set type of progress output ("auto", "none", "plain", "rawjson", "tty"). Use plain to show container output`)
 	flags.StringArrayVarP(&options.annotations, "annotation", "", []string{}, "Add annotation to the image")
 	flags.BoolVar(&options.preferIndex, "prefer-index", true, "When only a single source is specified, prefer outputting an image index or manifest list instead of performing a carbon copy")
+	flags.StringArrayVarP(&options.platforms, "platform", "p", []string{}, "Filter specified platforms of target image")
 
 	return cmd
 }
diff --git a/docs/dap.md b/docs/dap.md
index bc7a2ba3..a01d29b0 100644
--- a/docs/dap.md
+++ b/docs/dap.md
@@ -61,3 +61,17 @@ Please refer to the documentation in each of these repositories for installation
 
 - [Visual Studio Code](https://github.com/docker/vscode-extension/)
 - [Neovim](https://github.com/docker/nvim-dap-docker/)
+
+### Plugin Integration Guidelines
+
+An official debug adapter plugin must meet the requirements indicated in this section.
+
+The plugin MUST support `args` as a launch argument. The `args` value must be an array and it MUST be passed at the end of the tool invocation.
+
+The plugin MUST support `builder` as a launch argument. If present, `builder` will be passed as `--builder <value>` after the invocation of `buildx` but before the `build` argument.
+
+The plugin MUST provide a way to run the DAP command through the `docker` command (i.e. `docker buildx`).
+
+The plugin SHOULD provide a way to run the `buildx` binary in standalone mode.
+
+The plugin SHOULD invoke the DAP command from the workspace root. If it cannot invoke the command from the workspace root for some reason, it MUST invoke it from the current working directory.
diff --git a/docs/reference/buildx_bake.md b/docs/reference/buildx_bake.md
index deee4f84..d8fd2084 100644
--- a/docs/reference/buildx_bake.md
+++ b/docs/reference/buildx_bake.md
@@ -13,25 +13,25 @@ Build from a file
 
 ### Options
 
-| Name                                | Type          | Default | Description                                                                                                  |
-|:------------------------------------|:--------------|:--------|:-------------------------------------------------------------------------------------------------------------|
-| [`--allow`](#allow)                 | `stringArray` |         | Allow build to access specified resources                                                                    |
-| [`--builder`](#builder)             | `string`      |         | Override the configured builder instance                                                                     |
-| [`--call`](#call)                   | `string`      | `build` | Set method for evaluating build (`check`, `outline`, `targets`)                                              |
-| [`--check`](#check)                 | `bool`        |         | Shorthand for `--call=check`                                                                                 |
-| `-D`, `--debug`                     | `bool`        |         | Enable debug logging                                                                                         |
-| [`-f`](#file), [`--file`](#file)    | `stringArray` |         | Build definition file                                                                                        |
-| [`--list`](#list)                   | `string`      |         | List targets or variables                                                                                    |
-| [`--load`](#load)                   | `bool`        |         | Shorthand for `--set=*.output=type=docker`. Conditional.                                                     |
-| [`--metadata-file`](#metadata-file) | `string`      |         | Write build result metadata to a file                                                                        |
-| [`--no-cache`](#no-cache)           | `bool`        |         | Do not use cache when building the image                                                                     |
-| [`--print`](#print)                 | `bool`        |         | Print the options without building                                                                           |
-| [`--progress`](#progress)           | `string`      | `auto`  | Set type of progress output (`auto`, `quiet`, `plain`, `tty`, `rawjson`). Use plain to show container output |
-| [`--provenance`](#provenance)       | `string`      |         | Shorthand for `--set=*.attest=type=provenance`                                                               |
-| [`--pull`](#pull)                   | `bool`        |         | Always attempt to pull all referenced images                                                                 |
-| [`--push`](#push)                   | `bool`        |         | Shorthand for `--set=*.output=type=registry`. Conditional.                                                   |
-| [`--sbom`](#sbom)                   | `string`      |         | Shorthand for `--set=*.attest=type=sbom`                                                                     |
-| [`--set`](#set)                     | `stringArray` |         | Override target value (e.g., `targetpattern.key=value`)                                                      |
+| Name                                | Type          | Default | Description                                                                                                           |
+|:------------------------------------|:--------------|:--------|:----------------------------------------------------------------------------------------------------------------------|
+| [`--allow`](#allow)                 | `stringArray` |         | Allow build to access specified resources                                                                             |
+| [`--builder`](#builder)             | `string`      |         | Override the configured builder instance                                                                              |
+| [`--call`](#call)                   | `string`      | `build` | Set method for evaluating build (`check`, `outline`, `targets`)                                                       |
+| [`--check`](#check)                 | `bool`        |         | Shorthand for `--call=check`                                                                                          |
+| `-D`, `--debug`                     | `bool`        |         | Enable debug logging                                                                                                  |
+| [`-f`](#file), [`--file`](#file)    | `stringArray` |         | Build definition file                                                                                                 |
+| [`--list`](#list)                   | `string`      |         | List targets or variables                                                                                             |
+| [`--load`](#load)                   | `bool`        |         | Shorthand for `--set=*.output=type=docker`. Conditional.                                                              |
+| [`--metadata-file`](#metadata-file) | `string`      |         | Write build result metadata to a file                                                                                 |
+| [`--no-cache`](#no-cache)           | `bool`        |         | Do not use cache when building the image                                                                              |
+| [`--print`](#print)                 | `bool`        |         | Print the options without building                                                                                    |
+| [`--progress`](#progress)           | `string`      | `auto`  | Set type of progress output (`auto`, `none`,  `plain`, `quiet`, `rawjson`, `tty`). Use plain to show container output |
+| [`--provenance`](#provenance)       | `string`      |         | Shorthand for `--set=*.attest=type=provenance`                                                                        |
+| [`--pull`](#pull)                   | `bool`        |         | Always attempt to pull all referenced images                                                                          |
+| [`--push`](#push)                   | `bool`        |         | Shorthand for `--set=*.output=type=registry`. Conditional.                                                            |
+| [`--sbom`](#sbom)                   | `string`      |         | Shorthand for `--set=*.attest=type=sbom`                                                                              |
+| [`--set`](#set)                     | `stringArray` |         | Override target value (e.g., `targetpattern.key=value`)                                                               |
 
 
 <!---MARKER_GEN_END-->
diff --git a/docs/reference/buildx_build.md b/docs/reference/buildx_build.md
index 464a7152..a4af3447 100644
--- a/docs/reference/buildx_build.md
+++ b/docs/reference/buildx_build.md
@@ -13,43 +13,43 @@ Start a build
 
 ### Options
 
-| Name                                    | Type          | Default   | Description                                                                                                  |
-|:----------------------------------------|:--------------|:----------|:-------------------------------------------------------------------------------------------------------------|
-| [`--add-host`](#add-host)               | `stringSlice` |           | Add a custom host-to-IP mapping (format: `host:ip`)                                                          |
-| [`--allow`](#allow)                     | `stringArray` |           | Allow extra privileged entitlement (e.g., `network.host`, `security.insecure`, `device`)                     |
-| [`--annotation`](#annotation)           | `stringArray` |           | Add annotation to the image                                                                                  |
-| [`--attest`](#attest)                   | `stringArray` |           | Attestation parameters (format: `type=sbom,generator=image`)                                                 |
-| [`--build-arg`](#build-arg)             | `stringArray` |           | Set build-time variables                                                                                     |
-| [`--build-context`](#build-context)     | `stringArray` |           | Additional build contexts (e.g., name=path)                                                                  |
-| [`--builder`](#builder)                 | `string`      |           | Override the configured builder instance                                                                     |
-| [`--cache-from`](#cache-from)           | `stringArray` |           | External cache sources (e.g., `user/app:cache`, `type=local,src=path/to/dir`)                                |
-| [`--cache-to`](#cache-to)               | `stringArray` |           | Cache export destinations (e.g., `user/app:cache`, `type=local,dest=path/to/dir`)                            |
-| [`--call`](#call)                       | `string`      | `build`   | Set method for evaluating build (`check`, `outline`, `targets`)                                              |
-| [`--cgroup-parent`](#cgroup-parent)     | `string`      |           | Set the parent cgroup for the `RUN` instructions during build                                                |
-| [`--check`](#check)                     | `bool`        |           | Shorthand for `--call=check`                                                                                 |
-| `-D`, `--debug`                         | `bool`        |           | Enable debug logging                                                                                         |
-| [`-f`](#file), [`--file`](#file)        | `string`      |           | Name of the Dockerfile (default: `PATH/Dockerfile`)                                                          |
-| `--iidfile`                             | `string`      |           | Write the image ID to a file                                                                                 |
-| `--label`                               | `stringArray` |           | Set metadata for an image                                                                                    |
-| [`--load`](#load)                       | `bool`        |           | Shorthand for `--output=type=docker`                                                                         |
-| [`--metadata-file`](#metadata-file)     | `string`      |           | Write build result metadata to a file                                                                        |
-| [`--network`](#network)                 | `string`      | `default` | Set the networking mode for the `RUN` instructions during build                                              |
-| `--no-cache`                            | `bool`        |           | Do not use cache when building the image                                                                     |
-| [`--no-cache-filter`](#no-cache-filter) | `stringArray` |           | Do not cache specified stages                                                                                |
-| [`-o`](#output), [`--output`](#output)  | `stringArray` |           | Output destination (format: `type=local,dest=path`)                                                          |
-| [`--platform`](#platform)               | `stringArray` |           | Set target platform for build                                                                                |
-| [`--progress`](#progress)               | `string`      | `auto`    | Set type of progress output (`auto`, `quiet`, `plain`, `tty`, `rawjson`). Use plain to show container output |
-| [`--provenance`](#provenance)           | `string`      |           | Shorthand for `--attest=type=provenance`                                                                     |
-| `--pull`                                | `bool`        |           | Always attempt to pull all referenced images                                                                 |
-| [`--push`](#push)                       | `bool`        |           | Shorthand for `--output=type=registry`                                                                       |
-| `-q`, `--quiet`                         | `bool`        |           | Suppress the build output and print image ID on success                                                      |
-| [`--sbom`](#sbom)                       | `string`      |           | Shorthand for `--attest=type=sbom`                                                                           |
-| [`--secret`](#secret)                   | `stringArray` |           | Secret to expose to the build (format: `id=mysecret[,src=/local/secret]`)                                    |
-| [`--shm-size`](#shm-size)               | `bytes`       | `0`       | Shared memory size for build containers                                                                      |
-| [`--ssh`](#ssh)                         | `stringArray` |           | SSH agent socket or keys to expose to the build (format: `default\|<id>[=<socket>\|<key>[,<key>]]`)          |
-| [`-t`](#tag), [`--tag`](#tag)           | `stringArray` |           | Name and optionally a tag (format: `name:tag`)                                                               |
-| [`--target`](#target)                   | `string`      |           | Set the target build stage to build                                                                          |
-| [`--ulimit`](#ulimit)                   | `ulimit`      |           | Ulimit options                                                                                               |
+| Name                                    | Type          | Default   | Description                                                                                                           |
+|:----------------------------------------|:--------------|:----------|:----------------------------------------------------------------------------------------------------------------------|
+| [`--add-host`](#add-host)               | `stringSlice` |           | Add a custom host-to-IP mapping (format: `host:ip`)                                                                   |
+| [`--allow`](#allow)                     | `stringArray` |           | Allow extra privileged entitlement (e.g., `network.host`, `security.insecure`, `device`)                              |
+| [`--annotation`](#annotation)           | `stringArray` |           | Add annotation to the image                                                                                           |
+| [`--attest`](#attest)                   | `stringArray` |           | Attestation parameters (format: `type=sbom,generator=image`)                                                          |
+| [`--build-arg`](#build-arg)             | `stringArray` |           | Set build-time variables                                                                                              |
+| [`--build-context`](#build-context)     | `stringArray` |           | Additional build contexts (e.g., name=path)                                                                           |
+| [`--builder`](#builder)                 | `string`      |           | Override the configured builder instance                                                                              |
+| [`--cache-from`](#cache-from)           | `stringArray` |           | External cache sources (e.g., `user/app:cache`, `type=local,src=path/to/dir`)                                         |
+| [`--cache-to`](#cache-to)               | `stringArray` |           | Cache export destinations (e.g., `user/app:cache`, `type=local,dest=path/to/dir`)                                     |
+| [`--call`](#call)                       | `string`      | `build`   | Set method for evaluating build (`check`, `outline`, `targets`)                                                       |
+| [`--cgroup-parent`](#cgroup-parent)     | `string`      |           | Set the parent cgroup for the `RUN` instructions during build                                                         |
+| [`--check`](#check)                     | `bool`        |           | Shorthand for `--call=check`                                                                                          |
+| `-D`, `--debug`                         | `bool`        |           | Enable debug logging                                                                                                  |
+| [`-f`](#file), [`--file`](#file)        | `string`      |           | Name of the Dockerfile (default: `PATH/Dockerfile`)                                                                   |
+| `--iidfile`                             | `string`      |           | Write the image ID to a file                                                                                          |
+| `--label`                               | `stringArray` |           | Set metadata for an image                                                                                             |
+| [`--load`](#load)                       | `bool`        |           | Shorthand for `--output=type=docker`                                                                                  |
+| [`--metadata-file`](#metadata-file)     | `string`      |           | Write build result metadata to a file                                                                                 |
+| [`--network`](#network)                 | `string`      | `default` | Set the networking mode for the `RUN` instructions during build                                                       |
+| `--no-cache`                            | `bool`        |           | Do not use cache when building the image                                                                              |
+| [`--no-cache-filter`](#no-cache-filter) | `stringArray` |           | Do not cache specified stages                                                                                         |
+| [`-o`](#output), [`--output`](#output)  | `stringArray` |           | Output destination (format: `type=local,dest=path`)                                                                   |
+| [`--platform`](#platform)               | `stringArray` |           | Set target platform for build                                                                                         |
+| [`--progress`](#progress)               | `string`      | `auto`    | Set type of progress output (`auto`, `none`,  `plain`, `quiet`, `rawjson`, `tty`). Use plain to show container output |
+| [`--provenance`](#provenance)           | `string`      |           | Shorthand for `--attest=type=provenance`                                                                              |
+| `--pull`                                | `bool`        |           | Always attempt to pull all referenced images                                                                          |
+| [`--push`](#push)                       | `bool`        |           | Shorthand for `--output=type=registry`                                                                                |
+| `-q`, `--quiet`                         | `bool`        |           | Suppress the build output and print image ID on success                                                               |
+| [`--sbom`](#sbom)                       | `string`      |           | Shorthand for `--attest=type=sbom`                                                                                    |
+| [`--secret`](#secret)                   | `stringArray` |           | Secret to expose to the build (format: `id=mysecret[,src=/local/secret]`)                                             |
+| [`--shm-size`](#shm-size)               | `bytes`       | `0`       | Shared memory size for build containers                                                                               |
+| [`--ssh`](#ssh)                         | `stringArray` |           | SSH agent socket or keys to expose to the build (format: `default\|<id>[=<socket>\|<key>[,<key>]]`)                   |
+| [`-t`](#tag), [`--tag`](#tag)           | `stringArray` |           | Name and optionally a tag (format: `name:tag`)                                                                        |
+| [`--target`](#target)                   | `string`      |           | Set the target build stage to build                                                                                   |
+| [`--ulimit`](#ulimit)                   | `ulimit`      |           | Ulimit options                                                                                                        |
 
 
 <!---MARKER_GEN_END-->
diff --git a/docs/reference/buildx_dap_build.md b/docs/reference/buildx_dap_build.md
index 8d041661..3454e6d1 100644
--- a/docs/reference/buildx_dap_build.md
+++ b/docs/reference/buildx_dap_build.md
@@ -5,43 +5,43 @@ Start a build
 
 ### Options
 
-| Name                | Type          | Default   | Description                                                                                                  |
-|:--------------------|:--------------|:----------|:-------------------------------------------------------------------------------------------------------------|
-| `--add-host`        | `stringSlice` |           | Add a custom host-to-IP mapping (format: `host:ip`)                                                          |
-| `--allow`           | `stringArray` |           | Allow extra privileged entitlement (e.g., `network.host`, `security.insecure`, `device`)                     |
-| `--annotation`      | `stringArray` |           | Add annotation to the image                                                                                  |
-| `--attest`          | `stringArray` |           | Attestation parameters (format: `type=sbom,generator=image`)                                                 |
-| `--build-arg`       | `stringArray` |           | Set build-time variables                                                                                     |
-| `--build-context`   | `stringArray` |           | Additional build contexts (e.g., name=path)                                                                  |
-| `--builder`         | `string`      |           | Override the configured builder instance                                                                     |
-| `--cache-from`      | `stringArray` |           | External cache sources (e.g., `user/app:cache`, `type=local,src=path/to/dir`)                                |
-| `--cache-to`        | `stringArray` |           | Cache export destinations (e.g., `user/app:cache`, `type=local,dest=path/to/dir`)                            |
-| `--call`            | `string`      | `build`   | Set method for evaluating build (`check`, `outline`, `targets`)                                              |
-| `--cgroup-parent`   | `string`      |           | Set the parent cgroup for the `RUN` instructions during build                                                |
-| `--check`           | `bool`        |           | Shorthand for `--call=check`                                                                                 |
-| `-D`, `--debug`     | `bool`        |           | Enable debug logging                                                                                         |
-| `-f`, `--file`      | `string`      |           | Name of the Dockerfile (default: `PATH/Dockerfile`)                                                          |
-| `--iidfile`         | `string`      |           | Write the image ID to a file                                                                                 |
-| `--label`           | `stringArray` |           | Set metadata for an image                                                                                    |
-| `--load`            | `bool`        |           | Shorthand for `--output=type=docker`                                                                         |
-| `--metadata-file`   | `string`      |           | Write build result metadata to a file                                                                        |
-| `--network`         | `string`      | `default` | Set the networking mode for the `RUN` instructions during build                                              |
-| `--no-cache`        | `bool`        |           | Do not use cache when building the image                                                                     |
-| `--no-cache-filter` | `stringArray` |           | Do not cache specified stages                                                                                |
-| `-o`, `--output`    | `stringArray` |           | Output destination (format: `type=local,dest=path`)                                                          |
-| `--platform`        | `stringArray` |           | Set target platform for build                                                                                |
-| `--progress`        | `string`      | `auto`    | Set type of progress output (`auto`, `quiet`, `plain`, `tty`, `rawjson`). Use plain to show container output |
-| `--provenance`      | `string`      |           | Shorthand for `--attest=type=provenance`                                                                     |
-| `--pull`            | `bool`        |           | Always attempt to pull all referenced images                                                                 |
-| `--push`            | `bool`        |           | Shorthand for `--output=type=registry`                                                                       |
-| `-q`, `--quiet`     | `bool`        |           | Suppress the build output and print image ID on success                                                      |
-| `--sbom`            | `string`      |           | Shorthand for `--attest=type=sbom`                                                                           |
-| `--secret`          | `stringArray` |           | Secret to expose to the build (format: `id=mysecret[,src=/local/secret]`)                                    |
-| `--shm-size`        | `bytes`       | `0`       | Shared memory size for build containers                                                                      |
-| `--ssh`             | `stringArray` |           | SSH agent socket or keys to expose to the build (format: `default\|<id>[=<socket>\|<key>[,<key>]]`)          |
-| `-t`, `--tag`       | `stringArray` |           | Name and optionally a tag (format: `name:tag`)                                                               |
-| `--target`          | `string`      |           | Set the target build stage to build                                                                          |
-| `--ulimit`          | `ulimit`      |           | Ulimit options                                                                                               |
+| Name                | Type          | Default   | Description                                                                                                           |
+|:--------------------|:--------------|:----------|:----------------------------------------------------------------------------------------------------------------------|
+| `--add-host`        | `stringSlice` |           | Add a custom host-to-IP mapping (format: `host:ip`)                                                                   |
+| `--allow`           | `stringArray` |           | Allow extra privileged entitlement (e.g., `network.host`, `security.insecure`, `device`)                              |
+| `--annotation`      | `stringArray` |           | Add annotation to the image                                                                                           |
+| `--attest`          | `stringArray` |           | Attestation parameters (format: `type=sbom,generator=image`)                                                          |
+| `--build-arg`       | `stringArray` |           | Set build-time variables                                                                                              |
+| `--build-context`   | `stringArray` |           | Additional build contexts (e.g., name=path)                                                                           |
+| `--builder`         | `string`      |           | Override the configured builder instance                                                                              |
+| `--cache-from`      | `stringArray` |           | External cache sources (e.g., `user/app:cache`, `type=local,src=path/to/dir`)                                         |
+| `--cache-to`        | `stringArray` |           | Cache export destinations (e.g., `user/app:cache`, `type=local,dest=path/to/dir`)                                     |
+| `--call`            | `string`      | `build`   | Set method for evaluating build (`check`, `outline`, `targets`)                                                       |
+| `--cgroup-parent`   | `string`      |           | Set the parent cgroup for the `RUN` instructions during build                                                         |
+| `--check`           | `bool`        |           | Shorthand for `--call=check`                                                                                          |
+| `-D`, `--debug`     | `bool`        |           | Enable debug logging                                                                                                  |
+| `-f`, `--file`      | `string`      |           | Name of the Dockerfile (default: `PATH/Dockerfile`)                                                                   |
+| `--iidfile`         | `string`      |           | Write the image ID to a file                                                                                          |
+| `--label`           | `stringArray` |           | Set metadata for an image                                                                                             |
+| `--load`            | `bool`        |           | Shorthand for `--output=type=docker`                                                                                  |
+| `--metadata-file`   | `string`      |           | Write build result metadata to a file                                                                                 |
+| `--network`         | `string`      | `default` | Set the networking mode for the `RUN` instructions during build                                                       |
+| `--no-cache`        | `bool`        |           | Do not use cache when building the image                                                                              |
+| `--no-cache-filter` | `stringArray` |           | Do not cache specified stages                                                                                         |
+| `-o`, `--output`    | `stringArray` |           | Output destination (format: `type=local,dest=path`)                                                                   |
+| `--platform`        | `stringArray` |           | Set target platform for build                                                                                         |
+| `--progress`        | `string`      | `auto`    | Set type of progress output (`auto`, `none`,  `plain`, `quiet`, `rawjson`, `tty`). Use plain to show container output |
+| `--provenance`      | `string`      |           | Shorthand for `--attest=type=provenance`                                                                              |
+| `--pull`            | `bool`        |           | Always attempt to pull all referenced images                                                                          |
+| `--push`            | `bool`        |           | Shorthand for `--output=type=registry`                                                                                |
+| `-q`, `--quiet`     | `bool`        |           | Suppress the build output and print image ID on success                                                               |
+| `--sbom`            | `string`      |           | Shorthand for `--attest=type=sbom`                                                                                    |
+| `--secret`          | `stringArray` |           | Secret to expose to the build (format: `id=mysecret[,src=/local/secret]`)                                             |
+| `--shm-size`        | `bytes`       | `0`       | Shared memory size for build containers                                                                               |
+| `--ssh`             | `stringArray` |           | SSH agent socket or keys to expose to the build (format: `default\|<id>[=<socket>\|<key>[,<key>]]`)                   |
+| `-t`, `--tag`       | `stringArray` |           | Name and optionally a tag (format: `name:tag`)                                                                        |
+| `--target`          | `string`      |           | Set the target build stage to build                                                                                   |
+| `--ulimit`          | `ulimit`      |           | Ulimit options                                                                                                        |
 
 
 <!---MARKER_GEN_END-->
diff --git a/docs/reference/buildx_debug_build.md b/docs/reference/buildx_debug_build.md
index 6d363df9..268b82ef 100644
--- a/docs/reference/buildx_debug_build.md
+++ b/docs/reference/buildx_debug_build.md
@@ -9,43 +9,43 @@ Start a build
 
 ### Options
 
-| Name                | Type          | Default   | Description                                                                                                  |
-|:--------------------|:--------------|:----------|:-------------------------------------------------------------------------------------------------------------|
-| `--add-host`        | `stringSlice` |           | Add a custom host-to-IP mapping (format: `host:ip`)                                                          |
-| `--allow`           | `stringArray` |           | Allow extra privileged entitlement (e.g., `network.host`, `security.insecure`, `device`)                     |
-| `--annotation`      | `stringArray` |           | Add annotation to the image                                                                                  |
-| `--attest`          | `stringArray` |           | Attestation parameters (format: `type=sbom,generator=image`)                                                 |
-| `--build-arg`       | `stringArray` |           | Set build-time variables                                                                                     |
-| `--build-context`   | `stringArray` |           | Additional build contexts (e.g., name=path)                                                                  |
-| `--builder`         | `string`      |           | Override the configured builder instance                                                                     |
-| `--cache-from`      | `stringArray` |           | External cache sources (e.g., `user/app:cache`, `type=local,src=path/to/dir`)                                |
-| `--cache-to`        | `stringArray` |           | Cache export destinations (e.g., `user/app:cache`, `type=local,dest=path/to/dir`)                            |
-| `--call`            | `string`      | `build`   | Set method for evaluating build (`check`, `outline`, `targets`)                                              |
-| `--cgroup-parent`   | `string`      |           | Set the parent cgroup for the `RUN` instructions during build                                                |
-| `--check`           | `bool`        |           | Shorthand for `--call=check`                                                                                 |
-| `-D`, `--debug`     | `bool`        |           | Enable debug logging                                                                                         |
-| `-f`, `--file`      | `string`      |           | Name of the Dockerfile (default: `PATH/Dockerfile`)                                                          |
-| `--iidfile`         | `string`      |           | Write the image ID to a file                                                                                 |
-| `--label`           | `stringArray` |           | Set metadata for an image                                                                                    |
-| `--load`            | `bool`        |           | Shorthand for `--output=type=docker`                                                                         |
-| `--metadata-file`   | `string`      |           | Write build result metadata to a file                                                                        |
-| `--network`         | `string`      | `default` | Set the networking mode for the `RUN` instructions during build                                              |
-| `--no-cache`        | `bool`        |           | Do not use cache when building the image                                                                     |
-| `--no-cache-filter` | `stringArray` |           | Do not cache specified stages                                                                                |
-| `-o`, `--output`    | `stringArray` |           | Output destination (format: `type=local,dest=path`)                                                          |
-| `--platform`        | `stringArray` |           | Set target platform for build                                                                                |
-| `--progress`        | `string`      | `auto`    | Set type of progress output (`auto`, `quiet`, `plain`, `tty`, `rawjson`). Use plain to show container output |
-| `--provenance`      | `string`      |           | Shorthand for `--attest=type=provenance`                                                                     |
-| `--pull`            | `bool`        |           | Always attempt to pull all referenced images                                                                 |
-| `--push`            | `bool`        |           | Shorthand for `--output=type=registry`                                                                       |
-| `-q`, `--quiet`     | `bool`        |           | Suppress the build output and print image ID on success                                                      |
-| `--sbom`            | `string`      |           | Shorthand for `--attest=type=sbom`                                                                           |
-| `--secret`          | `stringArray` |           | Secret to expose to the build (format: `id=mysecret[,src=/local/secret]`)                                    |
-| `--shm-size`        | `bytes`       | `0`       | Shared memory size for build containers                                                                      |
-| `--ssh`             | `stringArray` |           | SSH agent socket or keys to expose to the build (format: `default\|<id>[=<socket>\|<key>[,<key>]]`)          |
-| `-t`, `--tag`       | `stringArray` |           | Name and optionally a tag (format: `name:tag`)                                                               |
-| `--target`          | `string`      |           | Set the target build stage to build                                                                          |
-| `--ulimit`          | `ulimit`      |           | Ulimit options                                                                                               |
+| Name                | Type          | Default   | Description                                                                                                           |
+|:--------------------|:--------------|:----------|:----------------------------------------------------------------------------------------------------------------------|
+| `--add-host`        | `stringSlice` |           | Add a custom host-to-IP mapping (format: `host:ip`)                                                                   |
+| `--allow`           | `stringArray` |           | Allow extra privileged entitlement (e.g., `network.host`, `security.insecure`, `device`)                              |
+| `--annotation`      | `stringArray` |           | Add annotation to the image                                                                                           |
+| `--attest`          | `stringArray` |           | Attestation parameters (format: `type=sbom,generator=image`)                                                          |
+| `--build-arg`       | `stringArray` |           | Set build-time variables                                                                                              |
+| `--build-context`   | `stringArray` |           | Additional build contexts (e.g., name=path)                                                                           |
+| `--builder`         | `string`      |           | Override the configured builder instance                                                                              |
+| `--cache-from`      | `stringArray` |           | External cache sources (e.g., `user/app:cache`, `type=local,src=path/to/dir`)                                         |
+| `--cache-to`        | `stringArray` |           | Cache export destinations (e.g., `user/app:cache`, `type=local,dest=path/to/dir`)                                     |
+| `--call`            | `string`      | `build`   | Set method for evaluating build (`check`, `outline`, `targets`)                                                       |
+| `--cgroup-parent`   | `string`      |           | Set the parent cgroup for the `RUN` instructions during build                                                         |
+| `--check`           | `bool`        |           | Shorthand for `--call=check`                                                                                          |
+| `-D`, `--debug`     | `bool`        |           | Enable debug logging                                                                                                  |
+| `-f`, `--file`      | `string`      |           | Name of the Dockerfile (default: `PATH/Dockerfile`)                                                                   |
+| `--iidfile`         | `string`      |           | Write the image ID to a file                                                                                          |
+| `--label`           | `stringArray` |           | Set metadata for an image                                                                                             |
+| `--load`            | `bool`        |           | Shorthand for `--output=type=docker`                                                                                  |
+| `--metadata-file`   | `string`      |           | Write build result metadata to a file                                                                                 |
+| `--network`         | `string`      | `default` | Set the networking mode for the `RUN` instructions during build                                                       |
+| `--no-cache`        | `bool`        |           | Do not use cache when building the image                                                                              |
+| `--no-cache-filter` | `stringArray` |           | Do not cache specified stages                                                                                         |
+| `-o`, `--output`    | `stringArray` |           | Output destination (format: `type=local,dest=path`)                                                                   |
+| `--platform`        | `stringArray` |           | Set target platform for build                                                                                         |
+| `--progress`        | `string`      | `auto`    | Set type of progress output (`auto`, `none`,  `plain`, `quiet`, `rawjson`, `tty`). Use plain to show container output |
+| `--provenance`      | `string`      |           | Shorthand for `--attest=type=provenance`                                                                              |
+| `--pull`            | `bool`        |           | Always attempt to pull all referenced images                                                                          |
+| `--push`            | `bool`        |           | Shorthand for `--output=type=registry`                                                                                |
+| `-q`, `--quiet`     | `bool`        |           | Suppress the build output and print image ID on success                                                               |
+| `--sbom`            | `string`      |           | Shorthand for `--attest=type=sbom`                                                                                    |
+| `--secret`          | `stringArray` |           | Secret to expose to the build (format: `id=mysecret[,src=/local/secret]`)                                             |
+| `--shm-size`        | `bytes`       | `0`       | Shared memory size for build containers                                                                               |
+| `--ssh`             | `stringArray` |           | SSH agent socket or keys to expose to the build (format: `default\|<id>[=<socket>\|<key>[,<key>]]`)                   |
+| `-t`, `--tag`       | `stringArray` |           | Name and optionally a tag (format: `name:tag`)                                                                        |
+| `--target`          | `string`      |           | Set the target build stage to build                                                                                   |
+| `--ulimit`          | `ulimit`      |           | Ulimit options                                                                                                        |
 
 
 <!---MARKER_GEN_END-->
diff --git a/docs/reference/buildx_dial-stdio.md b/docs/reference/buildx_dial-stdio.md
index b7c0a290..981771c1 100644
--- a/docs/reference/buildx_dial-stdio.md
+++ b/docs/reference/buildx_dial-stdio.md
@@ -14,7 +14,7 @@ Proxy current stdio streams to builder instance
 | `--builder`     | `string` |         | Override the configured builder instance                                                            |
 | `-D`, `--debug` | `bool`   |         | Enable debug logging                                                                                |
 | `--platform`    | `string` |         | Target platform: this is used for node selection                                                    |
-| `--progress`    | `string` | `quiet` | Set type of progress output (`auto`, `plain`, `tty`, `rawjson`). Use plain to show container output |
+| `--progress`    | `string` | `none`  | Set type of progress output (`auto`, `plain`, `rawjson`, `tty`). Use plain to show container output |
 
 
 <!---MARKER_GEN_END-->
diff --git a/docs/reference/buildx_imagetools_create.md b/docs/reference/buildx_imagetools_create.md
index 4e74b03a..c69fb31a 100644
--- a/docs/reference/buildx_imagetools_create.md
+++ b/docs/reference/buildx_imagetools_create.md
@@ -17,8 +17,9 @@ Create a new image based on source images
 | `-D`, `--debug`                  | `bool`        |         | Enable debug logging                                                                                                          |
 | [`--dry-run`](#dry-run)          | `bool`        |         | Show final image instead of pushing                                                                                           |
 | [`-f`](#file), [`--file`](#file) | `stringArray` |         | Read source descriptor from file                                                                                              |
+| `-p`, `--platform`               | `stringArray` |         | Filter specified platforms of target image                                                                                    |
 | `--prefer-index`                 | `bool`        | `true`  | When only a single source is specified, prefer outputting an image index or manifest list instead of performing a carbon copy |
-| `--progress`                     | `string`      | `auto`  | Set type of progress output (`auto`, `plain`, `tty`, `rawjson`). Use plain to show container output                           |
+| `--progress`                     | `string`      | `auto`  | Set type of progress output (`auto`, `none`, `plain`, `rawjson`, `tty`). Use plain to show container output                   |
 | [`-t`](#tag), [`--tag`](#tag)    | `stringArray` |         | Set reference for new image                                                                                                   |
 
 
diff --git a/util/imagetools/create.go b/util/imagetools/create.go
index 91afce35..b266286e 100644
--- a/util/imagetools/create.go
+++ b/util/imagetools/create.go
@@ -28,7 +28,7 @@ type Source struct {
 	Ref  reference.Named
 }
 
-func (r *Resolver) Combine(ctx context.Context, srcs []*Source, ann map[exptypes.AnnotationKey]string, preferIndex bool) ([]byte, ocispecs.Descriptor, error) {
+func (r *Resolver) Combine(ctx context.Context, srcs []*Source, ann map[exptypes.AnnotationKey]string, preferIndex bool) ([]byte, ocispecs.Descriptor, map[digest.Digest]*Source, error) {
 	eg, ctx := errgroup.WithContext(ctx)
 
 	dts := make([][]byte, len(srcs))
@@ -73,7 +73,7 @@ func (r *Resolver) Combine(ctx context.Context, srcs []*Source, ann map[exptypes
 	}
 
 	if err := eg.Wait(); err != nil {
-		return nil, ocispecs.Descriptor{}, err
+		return nil, ocispecs.Descriptor{}, nil, err
 	}
 
 	// on single source, return original bytes
@@ -83,21 +83,25 @@ func (r *Resolver) Combine(ctx context.Context, srcs []*Source, ann map[exptypes
 		// of preferIndex since if set to true then the source is already in the preferred format, and if false
 		// it doesn't matter since we're not going to split it into separate manifests
 		case images.MediaTypeDockerSchema2ManifestList, ocispecs.MediaTypeImageIndex:
-			return dts[0], srcs[0].Desc, nil
+			srcMap := map[digest.Digest]*Source{
+				srcs[0].Desc.Digest: srcs[0],
+			}
+			return dts[0], srcs[0].Desc, srcMap, nil
 		default:
 			if !preferIndex {
-				return dts[0], srcs[0].Desc, nil
+				return dts[0], srcs[0].Desc, nil, nil
 			}
 		}
 	}
 
-	m := map[digest.Digest]int{}
-	newDescs := make([]ocispecs.Descriptor, 0, len(srcs))
+	indexes := map[digest.Digest]int{}
+	sources := map[digest.Digest]*Source{}
+	descs := make([]ocispecs.Descriptor, 0, len(srcs))
 
-	addDesc := func(d ocispecs.Descriptor) {
-		idx, ok := m[d.Digest]
+	addDesc := func(d ocispecs.Descriptor, src *Source) {
+		idx, ok := indexes[d.Digest]
 		if ok {
-			old := newDescs[idx]
+			old := descs[idx]
 			if old.MediaType == "" {
 				old.MediaType = d.MediaType
 			}
@@ -108,11 +112,12 @@ func (r *Resolver) Combine(ctx context.Context, srcs []*Source, ann map[exptypes
 				old.Annotations = map[string]string{}
 			}
 			maps.Copy(old.Annotations, d.Annotations)
-			newDescs[idx] = old
+			descs[idx] = old
 		} else {
-			m[d.Digest] = len(newDescs)
-			newDescs = append(newDescs, d)
+			indexes[d.Digest] = len(descs)
+			descs = append(descs, d)
 		}
+		sources[d.Digest] = src
 	}
 
 	for i, src := range srcs {
@@ -120,25 +125,25 @@ func (r *Resolver) Combine(ctx context.Context, srcs []*Source, ann map[exptypes
 		case images.MediaTypeDockerSchema2ManifestList, ocispecs.MediaTypeImageIndex:
 			var mfst ocispecs.Index
 			if err := json.Unmarshal(dts[i], &mfst); err != nil {
-				return nil, ocispecs.Descriptor{}, errors.WithStack(err)
+				return nil, ocispecs.Descriptor{}, nil, errors.WithStack(err)
 			}
 			for _, d := range mfst.Manifests {
-				addDesc(d)
+				addDesc(d, src)
 			}
 		default:
-			addDesc(src.Desc)
+			addDesc(src.Desc, src)
 		}
 	}
 
 	dockerMfsts := 0
-	for _, desc := range newDescs {
+	for _, desc := range descs {
 		if strings.HasPrefix(desc.MediaType, "application/vnd.docker.") {
 			dockerMfsts++
 		}
 	}
 
 	var mt string
-	if dockerMfsts == len(newDescs) {
+	if dockerMfsts == len(descs) {
 		// all manifests are Docker types, use Docker manifest list
 		mt = images.MediaTypeDockerSchema2ManifestList
 	} else {
@@ -154,18 +159,18 @@ func (r *Resolver) Combine(ctx context.Context, srcs []*Source, ann map[exptypes
 			case exptypes.AnnotationIndex:
 				indexAnnotation[k.Key] = v
 			case exptypes.AnnotationManifestDescriptor:
-				for i := range newDescs {
-					if newDescs[i].Annotations == nil {
-						newDescs[i].Annotations = map[string]string{}
+				for i := range descs {
+					if descs[i].Annotations == nil {
+						descs[i].Annotations = map[string]string{}
 					}
-					if k.Platform == nil || k.PlatformString() == platforms.Format(*newDescs[i].Platform) {
-						newDescs[i].Annotations[k.Key] = v
+					if k.Platform == nil || k.PlatformString() == platforms.Format(*descs[i].Platform) {
+						descs[i].Annotations[k.Key] = v
 					}
 				}
 			case exptypes.AnnotationManifest, "":
-				return nil, ocispecs.Descriptor{}, errors.Errorf("%q annotations are not supported yet", k.Type)
+				return nil, ocispecs.Descriptor{}, nil, errors.Errorf("%q annotations are not supported yet", k.Type)
 			case exptypes.AnnotationIndexDescriptor:
-				return nil, ocispecs.Descriptor{}, errors.Errorf("%q annotations are invalid while creating an image", k.Type)
+				return nil, ocispecs.Descriptor{}, nil, errors.Errorf("%q annotations are invalid while creating an image", k.Type)
 			}
 		}
 	}
@@ -175,18 +180,18 @@ func (r *Resolver) Combine(ctx context.Context, srcs []*Source, ann map[exptypes
 		Versioned: specs.Versioned{
 			SchemaVersion: 2,
 		},
-		Manifests:   newDescs,
+		Manifests:   descs,
 		Annotations: indexAnnotation,
 	}, "", "  ")
 	if err != nil {
-		return nil, ocispecs.Descriptor{}, errors.Wrap(err, "failed to marshal index")
+		return nil, ocispecs.Descriptor{}, nil, errors.Wrap(err, "failed to marshal index")
 	}
 
 	return idxBytes, ocispecs.Descriptor{
 		MediaType: mt,
 		Size:      int64(len(idxBytes)),
 		Digest:    digest.FromBytes(idxBytes),
-	}, nil
+	}, sources, nil
 }
 
 func (r *Resolver) Push(ctx context.Context, ref reference.Named, desc ocispecs.Descriptor, dt []byte) error {
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 8a40f6fd..a8c54a14 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -504,6 +504,7 @@ github.com/moby/buildkit/util/apicaps
 github.com/moby/buildkit/util/apicaps/pb
 github.com/moby/buildkit/util/appcontext
 github.com/moby/buildkit/util/appdefaults
+github.com/moby/buildkit/util/attestation
 github.com/moby/buildkit/util/bklog
 github.com/moby/buildkit/util/contentutil
 github.com/moby/buildkit/util/disk



Test patch:
diff --git a/vendor/github.com/moby/buildkit/util/attestation/types.go b/vendor/github.com/moby/buildkit/util/attestation/types.go
new file mode 100644
index 00000000..accccd30
--- /dev/null
+++ b/vendor/github.com/moby/buildkit/util/attestation/types.go
@@ -0,0 +1,9 @@
+package attestation
+
+const (
+	DockerAnnotationReferenceType        = "vnd.docker.reference.type"
+	DockerAnnotationReferenceDigest      = "vnd.docker.reference.digest"
+	DockerAnnotationReferenceDescription = "vnd.docker.reference.description"
+
+	DockerAnnotationReferenceTypeDefault = "attestation-manifest"
+)