diff --git a/go.mod b/go.mod
index aeaddc83..f5ccde96 100644
--- a/go.mod
+++ b/go.mod
@@ -57,7 +57,8 @@ require (
 
 replace (
 	github.com/docker/cli => github.com/docker/cli v20.10.3-0.20210702143511-f782d1355eff+incompatible
-	github.com/docker/docker => github.com/docker/docker v20.10.3-0.20210817025855-ba2adeebdb8d+incompatible
+	github.com/docker/docker => github.com/tonistiigi/docker v0.10.1-0.20211122204227-65a6f25dbca2
+	github.com/tonistiigi/fsutil => github.com/tonistiigi/fsutil v0.0.0-20211122210416-da5201e0b3af
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc => github.com/tonistiigi/opentelemetry-go-contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.0.0-20210714055410-d010b05b4939
 	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace => github.com/tonistiigi/opentelemetry-go-contrib/instrumentation/net/http/httptrace/otelhttptrace v0.0.0-20210714055410-d010b05b4939
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp => github.com/tonistiigi/opentelemetry-go-contrib/instrumentation/net/http/otelhttp v0.0.0-20210714055410-d010b05b4939
diff --git a/go.sum b/go.sum
index f055914f..226fb4bb 100644
--- a/go.sum
+++ b/go.sum
@@ -421,8 +421,6 @@ github.com/docker/distribution v2.6.0-rc.1.0.20180327202408-83389a148052+incompa
 github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.7.1+incompatible h1:a5mlkVzth6W5A4fOsS3D2EO5BUmsJpcB+cRlLU7cSug=
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v20.10.3-0.20210817025855-ba2adeebdb8d+incompatible h1:tSd7TeZCH0j9m4P14bfe/eO1KYawrt3DztHI8gZAmLM=
-github.com/docker/docker v20.10.3-0.20210817025855-ba2adeebdb8d+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.6.3/go.mod h1:WRaJzqw3CTB9bk10avuGsjVBZsD05qeibJ1/TYlvc0Y=
 github.com/docker/docker-credential-helpers v0.6.4 h1:axCks+yV+2MR3/kZhAmy07yC56WZ2Pwu/fKWtKuZB0o=
 github.com/docker/docker-credential-helpers v0.6.4/go.mod h1:ofX3UI0Gz1TteYBjtgs07O36Pyasyp66D2uKT7H8W1c=
@@ -915,7 +913,6 @@ github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
 github.com/moby/spdystream v0.2.0 h1:cjW1zVyyoiM0T7b6UoySUFqzXMoqRckQtXwGPiBhOM8=
 github.com/moby/spdystream v0.2.0/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c=
-github.com/moby/sys/mount v0.1.0/go.mod h1:FVQFLDRWwyBjDTBNQXDlWnSFREqOo3OKX9aqhmeoo74=
 github.com/moby/sys/mount v0.1.1/go.mod h1:FVQFLDRWwyBjDTBNQXDlWnSFREqOo3OKX9aqhmeoo74=
 github.com/moby/sys/mount v0.2.0 h1:WhCW5B355jtxndN5ovugJlMFJawbUODuW8fSnEH6SSM=
 github.com/moby/sys/mount v0.2.0/go.mod h1:aAivFE2LB3W4bACsUXChRHQ0qKWsetY4Y9V7sxOougM=
@@ -990,7 +987,6 @@ github.com/opencontainers/image-spec v1.0.2-0.20210819154149-5ad6f50d6283 h1:TVz
 github.com/opencontainers/image-spec v1.0.2-0.20210819154149-5ad6f50d6283/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
 github.com/opencontainers/runc v0.0.0-20190115041553-12f6a991201f/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
 github.com/opencontainers/runc v0.1.1/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
-github.com/opencontainers/runc v1.0.0-rc10/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
 github.com/opencontainers/runc v1.0.0-rc8.0.20190926000215-3e425f80a8c9/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
 github.com/opencontainers/runc v1.0.0-rc9/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
 github.com/opencontainers/runc v1.0.0-rc92/go.mod h1:X1zlU4p7wOlX4+WRCz+hvlRv8phdL7UqbYD+vQwNMmE=
@@ -1203,9 +1199,10 @@ github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
 github.com/tommy-muehle/go-mnd v1.1.1/go.mod h1:dSUh0FtTP8VhvkL1S+gUR1OKd9ZnSaozuI6r3m6wOig=
 github.com/tommy-muehle/go-mnd v1.3.1-0.20200224220436-e6f9a994e8fa/go.mod h1:dSUh0FtTP8VhvkL1S+gUR1OKd9ZnSaozuI6r3m6wOig=
-github.com/tonistiigi/fsutil v0.0.0-20201103201449-0834f99b7b85/go.mod h1:a7cilN64dG941IOXfhJhlH0qB92hxJ9A1ewrdUmJ6xo=
-github.com/tonistiigi/fsutil v0.0.0-20210818161904-4442383b5028 h1:uEkkUFMCPtzz1HVOa42u15OHems1ugiRt172tSRTWSk=
-github.com/tonistiigi/fsutil v0.0.0-20210818161904-4442383b5028/go.mod h1:E6osHKls9ix67jofYQ61RQKwlJhqJOZM2hintp+49iI=
+github.com/tonistiigi/docker v0.10.1-0.20211122204227-65a6f25dbca2 h1:e6PyP4Gi3HZ9hSH9gGGGSaBh3EI+HZj5E4fgEV43ZCI=
+github.com/tonistiigi/docker v0.10.1-0.20211122204227-65a6f25dbca2/go.mod h1:v9W/4hjeg+54O4ffkt1Dnh7nOIE9uHi9F0W9clN3nTQ=
+github.com/tonistiigi/fsutil v0.0.0-20211122210416-da5201e0b3af h1:G5OoRy5gm3D9uLT0JIlgjB0aJPyTM48GFDqS9ESQPW4=
+github.com/tonistiigi/fsutil v0.0.0-20211122210416-da5201e0b3af/go.mod h1:WnebnONB1EcTV5BdGlPLPlCX+FVMKhTnGZP2BvmyhgE=
 github.com/tonistiigi/go-actions-cache v0.0.0-20211002214948-4d48f2ff622a/go.mod h1:YiIBjH5gP7mao3t0dBrNNBGuKYdeJmcAJjYLXr43k6A=
 github.com/tonistiigi/opentelemetry-go-contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.0.0-20210714055410-d010b05b4939 h1:s6wDMZYNyWt8KvkjhrMpOthFPgI3JB8ipJS+eCV/psg=
 github.com/tonistiigi/opentelemetry-go-contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.0.0-20210714055410-d010b05b4939/go.mod h1:Vm5u/mtkj1OMhtao0v+BGo2LUoLCgHYXvRmj0jWITlE=
@@ -1563,7 +1560,6 @@ golang.org/x/sys v0.0.0-20200831180312-196b9ba8737a/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200909081042-eff7692f9009/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200916030750-2334cc1a136f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200917073148-efd3b9a0ff20/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200922070232-aee5d888a860/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201013081832-0aaa2718063a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
diff --git a/vendor/github.com/docker/docker/pkg/archive/archive.go b/vendor/github.com/docker/docker/pkg/archive/archive.go
index a8a23387..7e00a02e 100644
--- a/vendor/github.com/docker/docker/pkg/archive/archive.go
+++ b/vendor/github.com/docker/docker/pkg/archive/archive.go
@@ -809,8 +809,8 @@ func TarWithOptions(srcPath string, options *TarOptions) (io.ReadCloser, error)
 			rebaseName := options.RebaseNames[include]
 
 			var (
-				parentMatched []bool
-				parentDirs    []string
+				parentMatchInfo []fileutils.MatchInfo
+				parentDirs      []string
 			)
 
 			walkRoot := getWalkRoot(srcPath, include)
@@ -845,13 +845,14 @@ func TarWithOptions(srcPath string, options *TarOptions) (io.ReadCloser, error)
 							break
 						}
 						parentDirs = parentDirs[:len(parentDirs)-1]
-						parentMatched = parentMatched[:len(parentMatched)-1]
+						parentMatchInfo = parentMatchInfo[:len(parentMatchInfo)-1]
 					}
 
-					if len(parentMatched) != 0 {
-						skip, err = pm.MatchesUsingParentResult(relFilePath, parentMatched[len(parentMatched)-1])
+					var matchInfo fileutils.MatchInfo
+					if len(parentMatchInfo) != 0 {
+						skip, matchInfo, err = pm.MatchesUsingParentResults(relFilePath, parentMatchInfo[len(parentMatchInfo)-1])
 					} else {
-						skip, err = pm.MatchesOrParentMatches(relFilePath)
+						skip, matchInfo, err = pm.MatchesUsingParentResults(relFilePath, fileutils.MatchInfo{})
 					}
 					if err != nil {
 						logrus.Errorf("Error matching %s: %v", relFilePath, err)
@@ -860,7 +861,7 @@ func TarWithOptions(srcPath string, options *TarOptions) (io.ReadCloser, error)
 
 					if f.IsDir() {
 						parentDirs = append(parentDirs, relFilePath)
-						parentMatched = append(parentMatched, skip)
+						parentMatchInfo = append(parentMatchInfo, matchInfo)
 					}
 				}
 
diff --git a/vendor/github.com/docker/docker/pkg/fileutils/fileutils.go b/vendor/github.com/docker/docker/pkg/fileutils/fileutils.go
index da4ffd13..191af39d 100644
--- a/vendor/github.com/docker/docker/pkg/fileutils/fileutils.go
+++ b/vendor/github.com/docker/docker/pkg/fileutils/fileutils.go
@@ -62,9 +62,9 @@ func NewPatternMatcher(patterns []string) (*PatternMatcher, error) {
 //
 // Matches is not safe to call concurrently.
 //
-// This implementation is buggy (it only checks a single parent dir against the
-// pattern) and will be removed soon. Use either MatchesOrParentMatches or
-// MatchesUsingParentResult instead.
+// Depercated: This implementation is buggy (it only checks a single parent dir
+// against the pattern) and will be removed soon. Use either
+// MatchesOrParentMatches or MatchesUsingParentResults instead.
 func (pm *PatternMatcher) Matches(file string) (bool, error) {
 	matched := false
 	file = filepath.FromSlash(file)
@@ -150,6 +150,11 @@ func (pm *PatternMatcher) MatchesOrParentMatches(file string) (bool, error) {
 // The "file" argument should be a slash-delimited path.
 //
 // MatchesUsingParentResult is not safe to call concurrently.
+//
+// Deprecated: this function does behave correctly in some cases (see
+// https://github.com/docker/buildx/issues/850).
+//
+// Use MatchesUsingParentResults instead.
 func (pm *PatternMatcher) MatchesUsingParentResult(file string, parentMatched bool) (bool, error) {
 	matched := parentMatched
 	file = filepath.FromSlash(file)
@@ -174,6 +179,78 @@ func (pm *PatternMatcher) MatchesUsingParentResult(file string, parentMatched bo
 	return matched, nil
 }
 
+// MatchInfo tracks information about parent dir matches while traversing a
+// filesystem.
+type MatchInfo struct {
+	parentMatched []bool
+}
+
+// MatchesUsingParentResults returns true if "file" matches any of the patterns
+// and isn't excluded by any of the subsequent patterns. The functionality is
+// the same as Matches, but as an optimization, the caller passes in
+// intermediate results from matching the parent directory.
+//
+// The "file" argument should be a slash-delimited path.
+//
+// MatchesUsingParentResults is not safe to call concurrently.
+func (pm *PatternMatcher) MatchesUsingParentResults(file string, parentMatchInfo MatchInfo) (bool, MatchInfo, error) {
+	parentMatched := parentMatchInfo.parentMatched
+	if len(parentMatched) != 0 && len(parentMatched) != len(pm.patterns) {
+		return false, MatchInfo{}, errors.New("wrong number of values in parentMatched")
+	}
+
+	file = filepath.FromSlash(file)
+	matched := false
+
+	matchInfo := MatchInfo{
+		parentMatched: make([]bool, len(pm.patterns)),
+	}
+	for i, pattern := range pm.patterns {
+		match := false
+		// If the parent matched this pattern, we don't need to recheck.
+		if len(parentMatched) != 0 {
+			match = parentMatched[i]
+		}
+
+		if !match {
+			// Skip evaluation if this is an inclusion and the filename
+			// already matched the pattern, or it's an exclusion and it has
+			// not matched the pattern yet.
+			if pattern.exclusion != matched {
+				continue
+			}
+
+			var err error
+			match, err = pattern.match(file)
+			if err != nil {
+				return false, matchInfo, err
+			}
+
+			// If the zero value of MatchInfo was passed in, we don't have
+			// any information about the parent dir's match results, and we
+			// apply the same logic as MatchesOrParentMatches.
+			if len(parentMatched) == 0 {
+				if parentPath := filepath.Dir(file); parentPath != "." {
+					parentPathDirs := strings.Split(parentPath, string(os.PathSeparator))
+					// Check to see if the pattern matches one of our parent dirs.
+					for i := range parentPathDirs {
+						match, _ = pattern.match(strings.Join(parentPathDirs[:i+1], string(os.PathSeparator)))
+						if match {
+							break
+						}
+					}
+				}
+			}
+		}
+		matchInfo.parentMatched[i] = match
+
+		if match {
+			matched = !pattern.exclusion
+		}
+	}
+	return matched, matchInfo, nil
+}
+
 // Exclusions returns true if any of the patterns define exclusions
 func (pm *PatternMatcher) Exclusions() bool {
 	return pm.exclusions
diff --git a/vendor/github.com/tonistiigi/fsutil/diff_containerd.go b/vendor/github.com/tonistiigi/fsutil/diff_containerd.go
index d72f4e64..d8619abf 100644
--- a/vendor/github.com/tonistiigi/fsutil/diff_containerd.go
+++ b/vendor/github.com/tonistiigi/fsutil/diff_containerd.go
@@ -33,6 +33,19 @@ const (
 	ChangeKindDelete
 )
 
+func (k ChangeKind) String() string {
+	switch k {
+	case ChangeKindAdd:
+		return "add"
+	case ChangeKindModify:
+		return "modify"
+	case ChangeKindDelete:
+		return "delete"
+	default:
+		return "unknown"
+	}
+}
+
 // ChangeFunc is the type of function called for each change
 // computed during a directory changes calculation.
 type ChangeFunc func(ChangeKind, string, os.FileInfo, error) error
diff --git a/vendor/github.com/tonistiigi/fsutil/diskwriter_freebsd.go b/vendor/github.com/tonistiigi/fsutil/diskwriter_freebsd.go
new file mode 100644
index 00000000..6ca00618
--- /dev/null
+++ b/vendor/github.com/tonistiigi/fsutil/diskwriter_freebsd.go
@@ -0,0 +1,14 @@
+// +build freebsd
+
+package fsutil
+
+import (
+	"github.com/tonistiigi/fsutil/types"
+	"golang.org/x/sys/unix"
+)
+
+func createSpecialFile(path string, mode uint32, stat *types.Stat) error {
+	dev := unix.Mkdev(uint32(stat.Devmajor), uint32(stat.Devminor))
+
+	return unix.Mknod(path, mode, dev)
+}
diff --git a/vendor/github.com/tonistiigi/fsutil/diskwriter_unix.go b/vendor/github.com/tonistiigi/fsutil/diskwriter_unix.go
index aa2d298f..36bb7889 100644
--- a/vendor/github.com/tonistiigi/fsutil/diskwriter_unix.go
+++ b/vendor/github.com/tonistiigi/fsutil/diskwriter_unix.go
@@ -45,7 +45,7 @@ func handleTarTypeBlockCharFifo(path string, stat *types.Stat) error {
 		mode |= syscall.S_IFBLK
 	}
 
-	if err := syscall.Mknod(path, mode, int(mkdev(stat.Devmajor, stat.Devminor))); err != nil {
+	if err := createSpecialFile(path, mode, stat); err != nil {
 		return errors.WithStack(err)
 	}
 	return nil
diff --git a/vendor/github.com/tonistiigi/fsutil/diskwriter_unixnobsd.go b/vendor/github.com/tonistiigi/fsutil/diskwriter_unixnobsd.go
new file mode 100644
index 00000000..9f55ad88
--- /dev/null
+++ b/vendor/github.com/tonistiigi/fsutil/diskwriter_unixnobsd.go
@@ -0,0 +1,13 @@
+// +build !windows,!freebsd
+
+package fsutil
+
+import (
+	"syscall"
+
+	"github.com/tonistiigi/fsutil/types"
+)
+
+func createSpecialFile(path string, mode uint32, stat *types.Stat) error {
+	return syscall.Mknod(path, mode, int(mkdev(stat.Devmajor, stat.Devminor)))
+}
diff --git a/vendor/github.com/tonistiigi/fsutil/docker-bake.hcl b/vendor/github.com/tonistiigi/fsutil/docker-bake.hcl
index 39ef990f..0d3c5417 100644
--- a/vendor/github.com/tonistiigi/fsutil/docker-bake.hcl
+++ b/vendor/github.com/tonistiigi/fsutil/docker-bake.hcl
@@ -63,5 +63,5 @@ target "shfmt" {
 
 target "cross" {
   inherits = ["build"]
-  platforms = ["linux/amd64", "linux/386", "linux/arm64", "linux/arm", "linux/ppc64le", "linux/s390x"]
+  platforms = ["linux/amd64", "linux/386", "linux/arm64", "linux/arm", "linux/ppc64le", "linux/s390x", "darwin/amd64", "darwin/arm64", "windows/amd64", "freebsd/amd64", "freebsd/arm64"]
 }
diff --git a/vendor/github.com/tonistiigi/fsutil/go.mod b/vendor/github.com/tonistiigi/fsutil/go.mod
index 02e6d1b3..e302be14 100644
--- a/vendor/github.com/tonistiigi/fsutil/go.mod
+++ b/vendor/github.com/tonistiigi/fsutil/go.mod
@@ -18,3 +18,5 @@ require (
 	gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
 	gotest.tools/v3 v3.0.3 // indirect
 )
+
+replace github.com/docker/docker => github.com/aaronlehmann/docker v1.4.2-0.20211119215941-554d44fa45a2
diff --git a/vendor/github.com/tonistiigi/fsutil/go.sum b/vendor/github.com/tonistiigi/fsutil/go.sum
index 0a4c7cbd..679ac870 100644
--- a/vendor/github.com/tonistiigi/fsutil/go.sum
+++ b/vendor/github.com/tonistiigi/fsutil/go.sum
@@ -2,6 +2,8 @@ bazil.org/fuse v0.0.0-20160811212531-371fbbdaa898/go.mod h1:Xbm+BRKSBEpa4q4hTSxo
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
+github.com/aaronlehmann/docker v1.4.2-0.20211119215941-554d44fa45a2 h1:W1DM5Z2Yym6DVr1Qcx+HCECYYjoAGWfYfgS1prcqoc4=
+github.com/aaronlehmann/docker v1.4.2-0.20211119215941-554d44fa45a2/go.mod h1:fLQH6hJxU6jTc+JFQWNyw/nl0i9+jjwDmugekrLew18=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
@@ -23,8 +25,6 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
-github.com/docker/docker v20.10.3-0.20210817025855-ba2adeebdb8d+incompatible h1:tSd7TeZCH0j9m4P14bfe/eO1KYawrt3DztHI8gZAmLM=
-github.com/docker/docker v20.10.3-0.20210817025855-ba2adeebdb8d+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
diff --git a/vendor/github.com/tonistiigi/fsutil/prefix/match.go b/vendor/github.com/tonistiigi/fsutil/prefix/match.go
deleted file mode 100644
index 57e745c6..00000000
--- a/vendor/github.com/tonistiigi/fsutil/prefix/match.go
+++ /dev/null
@@ -1,45 +0,0 @@
-package prefix
-
-import (
-	"path"
-	"path/filepath"
-	"strings"
-)
-
-// Match matches a path against a pattern. It returns m = true if the path
-// matches the pattern, and partial = true if the pattern has more separators
-// than the path and the common components match (for example, name = foo and
-// pattern = foo/bar/*). slashSeparator determines whether the path and pattern
-// are '/' delimited (true) or use the native path separator (false).
-func Match(pattern, name string, slashSeparator bool) (m bool, partial bool) {
-	separator := filepath.Separator
-	if slashSeparator {
-		separator = '/'
-	}
-	count := strings.Count(name, string(separator))
-	if strings.Count(pattern, string(separator)) > count {
-		pattern = trimUntilIndex(pattern, string(separator), count)
-		partial = true
-	}
-	if slashSeparator {
-		m, _ = path.Match(pattern, name)
-	} else {
-		m, _ = filepath.Match(pattern, name)
-	}
-	return m, partial
-}
-
-func trimUntilIndex(str, sep string, count int) string {
-	s := str
-	i := 0
-	c := 0
-	for {
-		idx := strings.Index(s, sep)
-		s = s[idx+len(sep):]
-		i += idx + len(sep)
-		c++
-		if c > count {
-			return str[:i-len(sep)]
-		}
-	}
-}
diff --git a/vendor/github.com/tonistiigi/fsutil/walker.go b/vendor/github.com/tonistiigi/fsutil/walker.go
index 2eb1bc06..b41d1bd5 100644
--- a/vendor/github.com/tonistiigi/fsutil/walker.go
+++ b/vendor/github.com/tonistiigi/fsutil/walker.go
@@ -10,7 +10,6 @@ import (
 
 	"github.com/docker/docker/pkg/fileutils"
 	"github.com/pkg/errors"
-	"github.com/tonistiigi/fsutil/prefix"
 	"github.com/tonistiigi/fsutil/types"
 )
 
@@ -36,20 +35,15 @@ func Walk(ctx context.Context, p string, opt *WalkOpt, fn filepath.WalkFunc) err
 		return errors.WithStack(&os.PathError{Op: "walk", Path: root, Err: syscall.ENOTDIR})
 	}
 
-	var pm *fileutils.PatternMatcher
-	if opt != nil && opt.ExcludePatterns != nil {
-		pm, err = fileutils.NewPatternMatcher(opt.ExcludePatterns)
-		if err != nil {
-			return errors.Wrapf(err, "invalid excludepatterns: %s", opt.ExcludePatterns)
-		}
-	}
+	var (
+		includePatterns []string
+		includeMatcher  *fileutils.PatternMatcher
+		excludeMatcher  *fileutils.PatternMatcher
+	)
 
-	var includePatterns []string
 	if opt != nil && opt.IncludePatterns != nil {
 		includePatterns = make([]string, len(opt.IncludePatterns))
-		for k := range opt.IncludePatterns {
-			includePatterns[k] = filepath.Clean(opt.IncludePatterns[k])
-		}
+		copy(includePatterns, opt.IncludePatterns)
 	}
 	if opt != nil && opt.FollowPaths != nil {
 		targets, err := FollowLinks(p, opt.FollowPaths)
@@ -61,13 +55,32 @@ func Walk(ctx context.Context, p string, opt *WalkOpt, fn filepath.WalkFunc) err
 			includePatterns = dedupePaths(includePatterns)
 		}
 	}
+	if len(includePatterns) != 0 {
+		includeMatcher, err = fileutils.NewPatternMatcher(includePatterns)
+		if err != nil {
+			return errors.Wrapf(err, "invalid includepatterns: %s", opt.IncludePatterns)
+		}
+	}
 
-	var (
-		lastIncludedDir string
+	if opt != nil && opt.ExcludePatterns != nil {
+		excludeMatcher, err = fileutils.NewPatternMatcher(opt.ExcludePatterns)
+		if err != nil {
+			return errors.Wrapf(err, "invalid excludepatterns: %s", opt.ExcludePatterns)
+		}
+	}
 
-		parentDirs           []string // used only for exclude handling
-		parentMatchedExclude []bool
-	)
+	type visitedDir struct {
+		fi               os.FileInfo
+		path             string
+		origpath         string
+		pathWithSep      string
+		includeMatchInfo fileutils.MatchInfo
+		excludeMatchInfo fileutils.MatchInfo
+		calledFn         bool
+	}
+
+	// used only for include/exclude handling
+	var parentDirs []visitedDir
 
 	seenFiles := make(map[uint64]string)
 	return filepath.Walk(root, func(path string, fi os.FileInfo, err error) (retErr error) {
@@ -90,87 +103,84 @@ func Walk(ctx context.Context, p string, opt *WalkOpt, fn filepath.WalkFunc) err
 			return nil
 		}
 
-		if opt != nil {
-			if includePatterns != nil {
-				skip := false
-				if lastIncludedDir != "" {
-					if strings.HasPrefix(path, lastIncludedDir+string(filepath.Separator)) {
-						skip = true
-					}
-				}
+		var dir visitedDir
 
-				if !skip {
-					matched := false
-					partial := true
-					for _, pattern := range includePatterns {
-						if ok, p := prefix.Match(pattern, path, false); ok {
-							matched = true
-							if !p {
-								partial = false
-								break
-							}
-						}
-					}
-					if !matched {
-						if fi.IsDir() {
-							return filepath.SkipDir
-						}
-						return nil
-					}
-					if !partial && fi.IsDir() {
-						lastIncludedDir = path
-					}
+		if includeMatcher != nil || excludeMatcher != nil {
+			for len(parentDirs) != 0 {
+				lastParentDir := parentDirs[len(parentDirs)-1].pathWithSep
+				if strings.HasPrefix(path, lastParentDir) {
+					break
 				}
+				parentDirs = parentDirs[:len(parentDirs)-1]
 			}
-			if pm != nil {
-				for len(parentMatchedExclude) != 0 {
-					lastParentDir := parentDirs[len(parentDirs)-1]
-					if strings.HasPrefix(path, lastParentDir) {
-						break
-					}
-					parentDirs = parentDirs[:len(parentDirs)-1]
-					parentMatchedExclude = parentMatchedExclude[:len(parentMatchedExclude)-1]
-				}
 
-				var m bool
-				if len(parentMatchedExclude) != 0 {
-					m, err = pm.MatchesUsingParentResult(path, parentMatchedExclude[len(parentMatchedExclude)-1])
-				} else {
-					m, err = pm.MatchesOrParentMatches(path)
+			if fi.IsDir() {
+				dir = visitedDir{
+					fi:          fi,
+					path:        path,
+					origpath:    origpath,
+					pathWithSep: path + string(filepath.Separator),
 				}
-				if err != nil {
-					return errors.Wrap(err, "failed to match excludepatterns")
+			}
+		}
+
+		skip := false
+
+		if includeMatcher != nil {
+			var parentIncludeMatchInfo fileutils.MatchInfo
+			if len(parentDirs) != 0 {
+				parentIncludeMatchInfo = parentDirs[len(parentDirs)-1].includeMatchInfo
+			}
+			m, matchInfo, err := includeMatcher.MatchesUsingParentResults(path, parentIncludeMatchInfo)
+			if err != nil {
+				return errors.Wrap(err, "failed to match includepatterns")
+			}
+
+			if fi.IsDir() {
+				dir.includeMatchInfo = matchInfo
+			}
+
+			if !m {
+				skip = true
+			}
+		}
+
+		if excludeMatcher != nil {
+			var parentExcludeMatchInfo fileutils.MatchInfo
+			if len(parentDirs) != 0 {
+				parentExcludeMatchInfo = parentDirs[len(parentDirs)-1].excludeMatchInfo
+			}
+			m, matchInfo, err := excludeMatcher.MatchesUsingParentResults(path, parentExcludeMatchInfo)
+			if err != nil {
+				return errors.Wrap(err, "failed to match excludepatterns")
+			}
+
+			if fi.IsDir() {
+				dir.excludeMatchInfo = matchInfo
+			}
+
+			if m {
+				if fi.IsDir() && !excludeMatcher.Exclusions() {
+					return filepath.SkipDir
 				}
+				skip = true
+			}
+		}
 
-				var dirSlash string
+		if includeMatcher != nil || excludeMatcher != nil {
+			defer func() {
 				if fi.IsDir() {
-					dirSlash = path + string(filepath.Separator)
-					parentDirs = append(parentDirs, dirSlash)
-					parentMatchedExclude = append(parentMatchedExclude, m)
+					parentDirs = append(parentDirs, dir)
 				}
+			}()
+		}
 
-				if m {
-					if fi.IsDir() {
-						if !pm.Exclusions() {
-							return filepath.SkipDir
-						}
-						for _, pat := range pm.Patterns() {
-							if !pat.Exclusion() {
-								continue
-							}
-							patStr := pat.String() + string(filepath.Separator)
-							if strings.HasPrefix(patStr, dirSlash) {
-								goto passedFilter
-							}
-						}
-						return filepath.SkipDir
-					}
-					return nil
-				}
-			}
+		if skip {
+			return nil
 		}
 
-	passedFilter:
+		dir.calledFn = true
+
 		stat, err := mkstat(origpath, path, fi, seenFiles)
 		if err != nil {
 			return err
@@ -185,6 +195,31 @@ func Walk(ctx context.Context, p string, opt *WalkOpt, fn filepath.WalkFunc) err
 					return nil
 				}
 			}
+			for i, parentDir := range parentDirs {
+				if parentDir.calledFn {
+					continue
+				}
+				parentStat, err := mkstat(parentDir.origpath, parentDir.path, parentDir.fi, seenFiles)
+				if err != nil {
+					return err
+				}
+
+				select {
+				case <-ctx.Done():
+					return ctx.Err()
+				default:
+				}
+				if opt != nil && opt.Map != nil {
+					if allowed := opt.Map(parentStat.Path, parentStat); !allowed {
+						continue
+					}
+				}
+
+				if err := fn(parentStat.Path, &StatInfo{parentStat}, nil); err != nil {
+					return err
+				}
+				parentDirs[i].calledFn = true
+			}
 			if err := fn(stat.Path, &StatInfo{stat}, nil); err != nil {
 				return err
 			}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 49954d2a..a5eb2cb3 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -126,7 +126,7 @@ github.com/docker/distribution/registry/client/transport
 github.com/docker/distribution/registry/storage/cache
 github.com/docker/distribution/registry/storage/cache/memory
 github.com/docker/distribution/uuid
-# github.com/docker/docker v20.10.7+incompatible => github.com/docker/docker v20.10.3-0.20210817025855-ba2adeebdb8d+incompatible
+# github.com/docker/docker v20.10.7+incompatible => github.com/tonistiigi/docker v0.10.1-0.20211122204227-65a6f25dbca2
 ## explicit
 github.com/docker/docker/api
 github.com/docker/docker/api/types
@@ -416,9 +416,8 @@ github.com/theupdateframework/notary/tuf/data
 github.com/theupdateframework/notary/tuf/signed
 github.com/theupdateframework/notary/tuf/utils
 github.com/theupdateframework/notary/tuf/validation
-# github.com/tonistiigi/fsutil v0.0.0-20210818161904-4442383b5028
+# github.com/tonistiigi/fsutil v0.0.0-20210818161904-4442383b5028 => github.com/tonistiigi/fsutil v0.0.0-20211122210416-da5201e0b3af
 github.com/tonistiigi/fsutil
-github.com/tonistiigi/fsutil/prefix
 github.com/tonistiigi/fsutil/types
 # github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea
 ## explicit
@@ -872,7 +871,8 @@ sigs.k8s.io/structured-merge-diff/v4/value
 # sigs.k8s.io/yaml v1.2.0
 sigs.k8s.io/yaml
 # github.com/docker/cli => github.com/docker/cli v20.10.3-0.20210702143511-f782d1355eff+incompatible
-# github.com/docker/docker => github.com/docker/docker v20.10.3-0.20210817025855-ba2adeebdb8d+incompatible
+# github.com/docker/docker => github.com/tonistiigi/docker v0.10.1-0.20211122204227-65a6f25dbca2
+# github.com/tonistiigi/fsutil => github.com/tonistiigi/fsutil v0.0.0-20211122210416-da5201e0b3af
 # go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc => github.com/tonistiigi/opentelemetry-go-contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.0.0-20210714055410-d010b05b4939
 # go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace => github.com/tonistiigi/opentelemetry-go-contrib/instrumentation/net/http/httptrace/otelhttptrace v0.0.0-20210714055410-d010b05b4939
 # go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp => github.com/tonistiigi/opentelemetry-go-contrib/instrumentation/net/http/otelhttp v0.0.0-20210714055410-d010b05b4939