Merge pull request #690 from crazy-max/history-export-finalize

history: finalize when exporting
2025-05-27 13:23:15 +02:00 · 2025-05-27 13:09:52 +02:00 · 2025-05-26 13:24:01 +02:00 · 2025-05-26 12:01:55 +02:00 · 2025-05-26 09:54:29 +02:00 · 2025-05-26 07:54:14 +00:00
90 changed files with 16128 additions and 825 deletions
--- a/.github/actions/macos-setup-qemu/action.yml
+++ b/.github/actions/macos-setup-qemu/action.yml
@@ -0,0 +1,17 @@
+name: 'Setup QEMU on macOS'
+description: 'Set up QEMU on macOS runners'
+
+# FIXME: Remove this composite once QEMU issue is fixed on macOS runners
+#  https://github.com/docker/actions-toolkit/issues/455
+
+runs:
+  using: composite
+  steps:
+    - run: |
+        set -ex
+        brew uninstall --ignore-dependencies qemu || true
+        brew autoremove || true
+        curl -o /tmp/qemu.rb https://raw.githubusercontent.com/Homebrew/homebrew-core/f1a9cf104a9a51779c7a532b658c490f69974839/Formula/q/qemu.rb
+        brew install /tmp/qemu.rb
+      continue-on-error: true
+      shell: bash
--- a/.github/buildx-lab-releases.json
+++ b/.github/buildx-lab-releases.json
--- a/.github/buildx-releases.json
+++ b/.github/buildx-releases.json
--- a/.github/compose-lab-releases.json
+++ b/.github/compose-lab-releases.json
--- a/.github/compose-releases.json
+++ b/.github/compose-releases.json
--- a/.github/docker-releases.json
+++ b/.github/docker-releases.json
@@ -1,8 +1,206 @@
 {
  "latest": {
-    "id": 176167883,
-    "tag_name": "v27.3.1",
-    "html_url": "https://github.com/moby/moby/releases/tag/v27.3.1",
+    "id": 213296967,
+    "tag_name": "v28.1.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.1.1",
+    "assets": []
+  },
+  "edge": {
+    "id": 220155575,
+    "tag_name": "v28.2.0-rc.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.2.0-rc.2",
+    "assets": []
+  },
+  "v28.2.0-rc.2": {
+    "id": 220155575,
+    "tag_name": "v28.2.0-rc.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.2.0-rc.2",
+    "assets": []
+  },
+  "v28.2.0-rc.1": {
+    "id": 218898330,
+    "tag_name": "v28.2.0-rc.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.2.0-rc.1",
+    "assets": []
+  },
+  "v25.0.10": {
+    "id": 218958962,
+    "tag_name": "v25.0.10",
+    "html_url": "https://github.com/moby/moby/releases/tag/v25.0.10",
+    "assets": []
+  },
+  "v25.0.9": {
+    "id": 218957753,
+    "tag_name": "v25.0.9",
+    "html_url": "https://github.com/moby/moby/releases/tag/v25.0.9",
+    "assets": []
+  },
+  "v23.0.18": {
+    "id": 218962082,
+    "tag_name": "v23.0.18",
+    "html_url": "https://github.com/moby/moby/releases/tag/v23.0.18",
+    "assets": []
+  },
+  "v23.0.17": {
+    "id": 218961915,
+    "tag_name": "v23.0.17",
+    "html_url": "https://github.com/moby/moby/releases/tag/v23.0.17",
+    "assets": []
+  },
+  "v28.1.1": {
+    "id": 213296967,
+    "tag_name": "v28.1.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.1.1",
+    "assets": []
+  },
+  "v28.1.0": {
+    "id": 213053128,
+    "tag_name": "v28.1.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.1.0",
+    "assets": []
+  },
+  "v28.1.0-rc.2": {
+    "id": 212786864,
+    "tag_name": "v28.1.0-rc.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.1.0-rc.2",
+    "assets": []
+  },
+  "v28.1.0-rc.1": {
+    "id": 211865941,
+    "tag_name": "v28.1.0-rc.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.1.0-rc.1",
+    "assets": []
+  },
+  "v28.0.4": {
+    "id": 208163246,
+    "tag_name": "v28.0.4",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.0.4",
+    "assets": []
+  },
+  "v28.0.3": {
+    "id": 208121902,
+    "tag_name": "v28.0.3",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.0.3",
+    "assets": []
+  },
+  "v28.0.2": {
+    "id": 205678192,
+    "tag_name": "v28.0.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.0.2",
+    "assets": []
+  },
+  "v28.0.1": {
+    "id": 202550735,
+    "tag_name": "v28.0.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.0.1",
+    "assets": []
+  },
+  "v28.0.0": {
+    "id": 201152110,
+    "tag_name": "v28.0.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.0.0",
+    "assets": []
+  },
+  "v28.0.0-rc.3": {
+    "id": 201046359,
+    "tag_name": "v28.0.0-rc.3",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.0.0-rc.3",
+    "assets": []
+  },
+  "v28.0.0-rc.2": {
+    "id": 200732563,
+    "tag_name": "v28.0.0-rc.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.0.0-rc.2",
+    "assets": []
+  },
+  "v28.0.0-rc.1": {
+    "id": 198950838,
+    "tag_name": "v28.0.0-rc.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.0.0-rc.1",
+    "assets": []
+  },
+  "v25.0.8": {
+    "id": 198023936,
+    "tag_name": "v25.0.8",
+    "html_url": "https://github.com/moby/moby/releases/tag/v25.0.8",
+    "assets": []
+  },
+  "v27.5.1": {
+    "id": 196137348,
+    "tag_name": "v27.5.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v27.5.1",
+    "assets": []
+  },
+  "v27.5.0": {
+    "id": 194138446,
+    "tag_name": "v27.5.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/v27.5.0",
+    "assets": []
+  },
+  "v27.5.0-rc.2": {
+    "id": 193567140,
+    "tag_name": "v27.5.0-rc.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v27.5.0-rc.2",
+    "assets": []
+  },
+  "v27.5.0-rc.1": {
+    "id": 192090825,
+    "tag_name": "v27.5.0-rc.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v27.5.0-rc.1",
+    "assets": []
+  },
+  "v27.4.1": {
+    "id": 190678909,
+    "tag_name": "v27.4.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v27.4.1",
+    "assets": []
+  },
+  "v27.4.0": {
+    "id": 189756585,
+    "tag_name": "v27.4.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/v27.4.0",
+    "assets": []
+  },
+  "v25.0.7": {
+    "id": 189262441,
+    "tag_name": "v25.0.7",
+    "html_url": "https://github.com/moby/moby/releases/tag/v25.0.7",
+    "assets": []
+  },
+  "v23.0.16": {
+    "id": 189261618,
+    "tag_name": "v23.0.16",
+    "html_url": "https://github.com/moby/moby/releases/tag/v23.0.16",
+    "assets": []
+  },
+  "v27.4.0-rc.4": {
+    "id": 189120203,
+    "tag_name": "v27.4.0-rc.4",
+    "html_url": "https://github.com/moby/moby/releases/tag/v27.4.0-rc.4",
+    "assets": []
+  },
+  "v27.4.0-rc.3": {
+    "id": 188263557,
+    "tag_name": "v27.4.0-rc.3",
+    "html_url": "https://github.com/moby/moby/releases/tag/v27.4.0-rc.3",
+    "assets": []
+  },
+  "v27.4.0-rc.2": {
+    "id": 186229632,
+    "tag_name": "v27.4.0-rc.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v27.4.0-rc.2",
+    "assets": []
+  },
+  "v27.4.0-rc.1": {
+    "id": 185528936,
+    "tag_name": "v27.4.0-rc.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v27.4.0-rc.1",
+    "assets": []
+  },
+  "v23.0.15": {
+    "id": 178729348,
+    "tag_name": "v23.0.15",
+    "html_url": "https://github.com/moby/moby/releases/tag/v23.0.15",
    "assets": []
  },
  "v27.3.1": {
--- a/.github/regclient-releases.json
+++ b/.github/regclient-releases.json
--- a/.github/undock-releases.json
+++ b/.github/undock-releases.json
@@ -0,0 +1,383 @@
+{
+  "latest": {
+    "id": 213293369,
+    "tag_name": "v0.10.0",
+    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.10.0",
+    "assets": [
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/checksums.txt",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv5.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv5.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv5.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv6.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv6.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv6.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv7.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv7.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv7.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_ppc64le.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_ppc64le.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_ppc64le.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_riscv64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_riscv64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_riscv64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_s390x.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_s390x.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_s390x.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_amd64.zip",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_arm64.zip"
+    ]
+  },
+  "v0.10.0": {
+    "id": 213293369,
+    "tag_name": "v0.10.0",
+    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.10.0",
+    "assets": [
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/checksums.txt",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv5.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv5.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv5.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv6.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv6.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv6.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv7.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv7.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv7.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_ppc64le.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_ppc64le.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_ppc64le.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_riscv64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_riscv64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_riscv64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_s390x.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_s390x.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_s390x.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_amd64.zip",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_arm64.zip"
+    ]
+  },
+  "v0.9.0": {
+    "id": 192171889,
+    "tag_name": "v0.9.0",
+    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.9.0",
+    "assets": [
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/checksums.txt",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_darwin_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_darwin_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_darwin_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_darwin_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_darwin_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_darwin_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv5.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv5.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv5.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv6.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv6.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv6.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv7.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv7.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv7.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_ppc64le.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_ppc64le.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_ppc64le.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_riscv64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_riscv64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_riscv64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_s390x.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_s390x.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_s390x.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_windows_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_windows_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_windows_amd64.zip",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_windows_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_windows_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_windows_arm64.zip"
+    ]
+  },
+  "v0.8.0": {
+    "id": 162880608,
+    "tag_name": "v0.8.0",
+    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.8.0",
+    "assets": [
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/checksums.txt",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_darwin_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_darwin_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_darwin_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_darwin_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_darwin_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_darwin_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_armv5.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_armv5.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_armv5.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_armv6.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_armv6.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_armv6.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_armv7.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_armv7.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_armv7.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_ppc64le.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_ppc64le.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_ppc64le.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_riscv64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_riscv64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_riscv64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_s390x.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_s390x.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_s390x.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_windows_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_windows_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_windows_amd64.zip",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_windows_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_windows_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_windows_arm64.zip"
+    ]
+  },
+  "v0.7.0": {
+    "id": 134823476,
+    "tag_name": "v0.7.0",
+    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.7.0",
+    "assets": [
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0/checksums.txt",
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0/provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0/undock_0.7.0_darwin_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0/undock_0.7.0_darwin_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0/undock_0.7.0_linux_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0/undock_0.7.0_linux_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0/undock_0.7.0_linux_armv5.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0/undock_0.7.0_linux_armv6.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0/undock_0.7.0_linux_armv7.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0/undock_0.7.0_linux_ppc64le.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0/undock_0.7.0_linux_riscv64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0/undock_0.7.0_linux_s390x.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0/undock_0.7.0_windows_amd64.zip",
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0/undock_0.7.0_windows_arm64.zip"
+    ]
+  },
+  "edge": {
+    "id": 213293369,
+    "tag_name": "v0.10.0",
+    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.10.0",
+    "assets": [
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/checksums.txt",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv5.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv5.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv5.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv6.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv6.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv6.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv7.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv7.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv7.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_ppc64le.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_ppc64le.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_ppc64le.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_riscv64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_riscv64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_riscv64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_s390x.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_s390x.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_s390x.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_amd64.zip",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_arm64.zip"
+    ]
+  },
+  "v0.7.0-rc.1": {
+    "id": 134495651,
+    "tag_name": "v0.7.0-rc.1",
+    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.7.0-rc.1",
+    "assets": [
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0-rc.1/checksums.txt",
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0-rc.1/provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0-rc.1/undock_0.7.0-rc.1_darwin_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0-rc.1/undock_0.7.0-rc.1_darwin_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0-rc.1/undock_0.7.0-rc.1_linux_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0-rc.1/undock_0.7.0-rc.1_linux_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0-rc.1/undock_0.7.0-rc.1_linux_armv5.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0-rc.1/undock_0.7.0-rc.1_linux_armv6.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0-rc.1/undock_0.7.0-rc.1_linux_armv7.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0-rc.1/undock_0.7.0-rc.1_linux_ppc64le.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0-rc.1/undock_0.7.0-rc.1_linux_riscv64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0-rc.1/undock_0.7.0-rc.1_linux_s390x.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0-rc.1/undock_0.7.0-rc.1_windows_amd64.zip",
+      "https://github.com/crazy-max/undock/releases/download/v0.7.0-rc.1/undock_0.7.0-rc.1_windows_arm64.zip"
+    ]
+  },
+  "v0.6.0": {
+    "id": 121362767,
+    "tag_name": "v0.6.0",
+    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.6.0",
+    "assets": [
+      "https://github.com/crazy-max/undock/releases/download/v0.6.0/checksums.txt",
+      "https://github.com/crazy-max/undock/releases/download/v0.6.0/provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.6.0/undock_0.6.0_darwin_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.6.0/undock_0.6.0_darwin_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.6.0/undock_0.6.0_linux_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.6.0/undock_0.6.0_linux_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.6.0/undock_0.6.0_linux_armv5.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.6.0/undock_0.6.0_linux_armv6.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.6.0/undock_0.6.0_linux_armv7.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.6.0/undock_0.6.0_linux_ppc64le.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.6.0/undock_0.6.0_linux_riscv64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.6.0/undock_0.6.0_linux_s390x.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.6.0/undock_0.6.0_windows_amd64.zip",
+      "https://github.com/crazy-max/undock/releases/download/v0.6.0/undock_0.6.0_windows_arm64.zip"
+    ]
+  },
+  "v0.5.0": {
+    "id": 110766698,
+    "tag_name": "v0.5.0",
+    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.5.0",
+    "assets": [
+      "https://github.com/crazy-max/undock/releases/download/v0.5.0/checksums.txt",
+      "https://github.com/crazy-max/undock/releases/download/v0.5.0/provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.5.0/undock_0.5.0_darwin_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.5.0/undock_0.5.0_darwin_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.5.0/undock_0.5.0_linux_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.5.0/undock_0.5.0_linux_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.5.0/undock_0.5.0_linux_armv5.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.5.0/undock_0.5.0_linux_armv6.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.5.0/undock_0.5.0_linux_armv7.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.5.0/undock_0.5.0_linux_ppc64le.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.5.0/undock_0.5.0_linux_riscv64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.5.0/undock_0.5.0_linux_s390x.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.5.0/undock_0.5.0_windows_amd64.zip",
+      "https://github.com/crazy-max/undock/releases/download/v0.5.0/undock_0.5.0_windows_arm64.zip"
+    ]
+  },
+  "v0.4.0": {
+    "id": 92330136,
+    "tag_name": "v0.4.0",
+    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.4.0",
+    "assets": [
+      "https://github.com/crazy-max/undock/releases/download/v0.4.0/checksums.txt",
+      "https://github.com/crazy-max/undock/releases/download/v0.4.0/undock_0.4.0_darwin_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.4.0/undock_0.4.0_darwin_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.4.0/undock_0.4.0_linux_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.4.0/undock_0.4.0_linux_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.4.0/undock_0.4.0_linux_armv5.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.4.0/undock_0.4.0_linux_armv6.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.4.0/undock_0.4.0_linux_armv7.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.4.0/undock_0.4.0_linux_ppc64le.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.4.0/undock_0.4.0_linux_riscv64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.4.0/undock_0.4.0_linux_s390x.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.4.0/undock_0.4.0_windows_amd64.zip",
+      "https://github.com/crazy-max/undock/releases/download/v0.4.0/undock_0.4.0_windows_arm64.zip"
+    ]
+  },
+  "v0.3.0": {
+    "id": 62906231,
+    "tag_name": "v0.3.0",
+    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.3.0",
+    "assets": [
+      "https://github.com/crazy-max/undock/releases/download/v0.3.0/undock_0.3.0_darwin_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.3.0/undock_0.3.0_darwin_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.3.0/undock_0.3.0_linux_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.3.0/undock_0.3.0_linux_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.3.0/undock_0.3.0_linux_armv5.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.3.0/undock_0.3.0_linux_armv6.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.3.0/undock_0.3.0_linux_armv7.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.3.0/undock_0.3.0_linux_ppc64le.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.3.0/undock_0.3.0_linux_riscv64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.3.0/undock_0.3.0_linux_s390x.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.3.0/undock_0.3.0_windows_amd64.zip",
+      "https://github.com/crazy-max/undock/releases/download/v0.3.0/undock_0.3.0_windows_arm64.zip"
+    ]
+  },
+  "v0.2.0": {
+    "id": 59443285,
+    "tag_name": "v0.2.0",
+    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.2.0",
+    "assets": [
+      "https://github.com/crazy-max/undock/releases/download/v0.2.0/undock_0.2.0_darwin_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.2.0/undock_0.2.0_darwin_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.2.0/undock_0.2.0_linux_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.2.0/undock_0.2.0_linux_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.2.0/undock_0.2.0_linux_armv5.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.2.0/undock_0.2.0_linux_armv6.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.2.0/undock_0.2.0_linux_armv7.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.2.0/undock_0.2.0_linux_ppc64le.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.2.0/undock_0.2.0_linux_riscv64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.2.0/undock_0.2.0_linux_s390x.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.2.0/undock_0.2.0_windows_amd64.zip",
+      "https://github.com/crazy-max/undock/releases/download/v0.2.0/undock_0.2.0_windows_arm64.zip"
+    ]
+  },
+  "v0.1.0": {
+    "id": 57827645,
+    "tag_name": "v0.1.0",
+    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.1.0",
+    "assets": [
+      "https://github.com/crazy-max/undock/releases/download/v0.1.0/undock_0.1.0_darwin_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.1.0/undock_0.1.0_darwin_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.1.0/undock_0.1.0_linux_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.1.0/undock_0.1.0_linux_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.1.0/undock_0.1.0_linux_armv5.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.1.0/undock_0.1.0_linux_armv6.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.1.0/undock_0.1.0_linux_armv7.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.1.0/undock_0.1.0_linux_ppc64le.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.1.0/undock_0.1.0_linux_riscv64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.1.0/undock_0.1.0_linux_s390x.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.1.0/undock_0.1.0_windows_amd64.zip",
+      "https://github.com/crazy-max/undock/releases/download/v0.1.0/undock_0.1.0_windows_arm64.zip"
+    ]
+  }
+}
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -15,12 +15,17 @@ on:
 jobs:
  build:
    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node_version:
+          - 20
+          - 18
    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
      -
        name: Build
-        uses: docker/bake-action@v5
+        uses: docker/bake-action@v6
        with:
          targets: build
+        env:
+          NODE_VERSION: ${{ matrix.node_version }}
--- a/.github/workflows/buildx-lab-releases-json.yml
+++ b/.github/workflows/buildx-lab-releases-json.yml
@@ -17,7 +17,7 @@ on:

 jobs:
  generate:
-    uses: crazy-max/.github/.github/workflows/releases-json.yml@fa6141aedf23596fb8bdcceab9cce8dadaa31bd9
+    uses: crazy-max/.github/.github/workflows/releases-json.yml@7f83a5a887650a38e4d0e05d5262309cfaa31459
    with:
      repository: docker/buildx-desktop
      artifact_name: buildx-lab-releases-json
--- a/.github/workflows/buildx-releases-json.yml
+++ b/.github/workflows/buildx-releases-json.yml
@@ -17,7 +17,7 @@ on:

 jobs:
  generate:
-    uses: crazy-max/.github/.github/workflows/releases-json.yml@fa6141aedf23596fb8bdcceab9cce8dadaa31bd9
+    uses: crazy-max/.github/.github/workflows/releases-json.yml@7f83a5a887650a38e4d0e05d5262309cfaa31459
    with:
      repository: docker/buildx
      artifact_name: buildx-releases-json
--- a/.github/workflows/compose-lab-releases-json.yml
+++ b/.github/workflows/compose-lab-releases-json.yml
@@ -0,0 +1,58 @@
+name: compose-lab-releases-json
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 */12 * * *'
+  push:
+    branches:
+      - 'main'
+  pull_request:
+    paths:
+      - '.github/workflows/compose-lab-releases-json.yml'
+
+jobs:
+  generate:
+    uses: crazy-max/.github/.github/workflows/releases-json.yml@7f83a5a887650a38e4d0e05d5262309cfaa31459
+    with:
+      repository: docker/compose-desktop
+      artifact_name: compose-lab-releases-json
+      filename: compose-lab-releases.json
+    secrets: inherit
+
+  open-pr:
+    runs-on: ubuntu-22.04
+    if: github.event_name != 'pull_request'
+    needs:
+      - generate
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+      -
+        name: Download
+        uses: actions/download-artifact@v4
+        with:
+          name: compose-lab-releases-json
+          path: .github
+      -
+        name: Commit changes
+        run: |
+          git add -A .
+      -
+        name: Create PR
+        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f  # v7.0.5
+        with:
+          base: main
+          branch: bot/compose-lab-releases-json
+          commit-message: "github: update .github/compose-lab-releases.json"
+          signoff: true
+          delete-branch: true
+          title: "Update `.github/compose-lab-releases.json`"
+          body: |
+            Update `.github/compose-lab-releases.json` to keep in sync with [https://github.com/docker/compose-desktop](https://github.com/docker/compose-desktop).
+          draft: false
--- a/.github/workflows/compose-releases-json.yml
+++ b/.github/workflows/compose-releases-json.yml
@@ -0,0 +1,58 @@
+name: compose-releases-json
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 */12 * * *'
+  push:
+    branches:
+      - 'main'
+  pull_request:
+    paths:
+      - '.github/workflows/compose-releases-json.yml'
+
+jobs:
+  generate:
+    uses: crazy-max/.github/.github/workflows/releases-json.yml@7f83a5a887650a38e4d0e05d5262309cfaa31459
+    with:
+      repository: docker/compose
+      artifact_name: compose-releases-json
+      filename: compose-releases.json
+    secrets: inherit
+
+  open-pr:
+    runs-on: ubuntu-22.04
+    if: github.event_name != 'pull_request'
+    needs:
+      - generate
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+      -
+        name: Download
+        uses: actions/download-artifact@v4
+        with:
+          name: compose-releases-json
+          path: .github
+      -
+        name: Commit changes
+        run: |
+          git add -A .
+      -
+        name: Create PR
+        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f  # v7.0.5
+        with:
+          base: main
+          branch: bot/compose-releases-json
+          commit-message: "github: update .github/compose-releases.json"
+          signoff: true
+          delete-branch: true
+          title: "Update `.github/compose-releases.json`"
+          body: |
+            Update `.github/compose-releases.json` to keep in sync with [https://github.com/docker/compose](https://github.com/docker/compose).
+          draft: false
--- a/.github/workflows/docker-releases-json.yml
+++ b/.github/workflows/docker-releases-json.yml
@@ -17,7 +17,7 @@ on:

 jobs:
  generate:
-    uses: crazy-max/.github/.github/workflows/releases-json.yml@fa6141aedf23596fb8bdcceab9cce8dadaa31bd9
+    uses: crazy-max/.github/.github/workflows/releases-json.yml@7f83a5a887650a38e4d0e05d5262309cfaa31459
    with:
      repository: moby/moby
      artifact_name: docker-releases-json
--- a/.github/workflows/pr-assign-author.yml
+++ b/.github/workflows/pr-assign-author.yml
@@ -0,0 +1,17 @@
+name: pr-assign-author
+
+permissions:
+  contents: read
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+
+jobs:
+  run:
+    uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@1b673f36fad86812f538c1df9794904038a23cbf
+    permissions:
+      contents: read
+      pull-requests: write
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -13,15 +13,12 @@ jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      -
        name: Publish
-        uses: docker/bake-action@v5
+        uses: docker/bake-action@v6
        with:
          targets: publish
        env:
--- a/.github/workflows/regclient-releases-json.yml
+++ b/.github/workflows/regclient-releases-json.yml
@@ -0,0 +1,58 @@
+name: regclient-releases-json
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 */12 * * *'
+  push:
+    branches:
+      - 'main'
+  pull_request:
+    paths:
+      - '.github/workflows/regclient-releases-json.yml'
+
+jobs:
+  generate:
+    uses: crazy-max/.github/.github/workflows/releases-json.yml@7f83a5a887650a38e4d0e05d5262309cfaa31459
+    with:
+      repository: regclient/regclient
+      artifact_name: regclient-releases-json
+      filename: regclient-releases.json
+    secrets: inherit
+
+  open-pr:
+    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request'
+    needs:
+      - generate
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+      -
+        name: Download
+        uses: actions/download-artifact@v4
+        with:
+          name: regclient-releases-json
+          path: .github
+      -
+        name: Commit changes
+        run: |
+          git add -A .
+      -
+        name: Create PR
+        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f  # v7.0.5
+        with:
+          base: main
+          branch: bot/regclient-releases-json
+          commit-message: "github: update .github/regclient-releases.json"
+          signoff: true
+          delete-branch: true
+          title: "Update `.github/regclient-releases.json`"
+          body: |
+            Update `.github/regclient-releases.json` to keep in sync with [https://github.com/regclient/regclient](https://github.com/regclient/regclient).
+          draft: false
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -15,23 +15,34 @@ on:

 env:
  NODE_VERSION: "20"
-  BUILDX_VERSION: "v0.17.1"
-  BUILDKIT_IMAGE: "moby/buildkit:v0.16.0"
+  BUILDX_VERSION: "edge"
+  BUILDKIT_IMAGE: "moby/buildkit:v0.22.0"

 jobs:
  test:
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - ubuntu-22.04-arm
+        node_version:
+          - 20
+          - 18
    steps:
      -
        name: Checkout
        uses: actions/checkout@v4
      -
        name: Test
-        uses: docker/bake-action@v5
+        uses: docker/bake-action@v6
        with:
+          source: .
          targets: test-coverage
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NODE_VERSION: ${{ matrix.node_version }}
      -
        name: Check coverage
        run: |
@@ -43,17 +54,17 @@ jobs:
        shell: bash
      -
        name: Upload coverage
-        uses: codecov/codecov-action@v4
-        if: env.RUN_CODECOV == 'true'
+        uses: codecov/codecov-action@v5
+        if: env.RUN_CODECOV == 'true' && matrix.node_version == env.NODE_VERSION
        with:
-          file: ./coverage/clover.xml
+          files: ./coverage/clover.xml
          flags: unit
          token: ${{ secrets.CODECOV_TOKEN }}

  prepare-itg:
    runs-on: ubuntu-latest
    outputs:
-      matrix: ${{ steps.tests.outputs.matrix }}
+      includes: ${{ steps.set.outputs.includes }}
    steps:
      -
        name: Checkout
@@ -73,14 +84,53 @@ jobs:
        name: Install
        run: yarn install
      -
-        name: Create matrix
-        id: tests
-        run: |
-          declare -a tests
-          for test in $(yarn run test:itg-list); do
-            tests+=("${test#$(pwd)/__tests__/}")
-          done
-          echo "matrix=$(echo ${tests[@]} | jq -cR 'split(" ")')" >>${GITHUB_OUTPUT}
+        name: Create includes
+        id: set
+        uses: actions/github-script@v7
+        with:
+          script: |
+            let tests = [];
+            await core.group(`Get tests`, async () => {
+              const res = await exec.getExecOutput('yarn', ['run', 'test:itg-list'], {
+                silent: true,
+                ignoreReturnCode: true
+              });
+              if (res.stderr.length > 0 && res.exitCode != 0) {
+                throw new Error(res.stderr);
+              }
+              for (const test of res.stdout.trim().split('\n')) {
+                tests.push(test.replace(/^.*__tests__\//, ''));
+              }
+              core.info(`tests: ${JSON.stringify(tests)}`);
+            });
+            await core.group(`Set includes`, async () => {
+              let includes = [];
+              for (const os of ['ubuntu-latest', 'ubuntu-22.04-arm', 'macos-13', 'windows-latest']) {
+                for (const test of tests) {
+                  if (test === 'docker/install.test.itg.ts') {
+                    if (os !== 'windows-latest') {
+                      includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'image', docker_install_version: '27.3.1' });
+                      includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'image', docker_install_version: 'master' });
+                      includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'image', docker_install_version: 'latest' });
+                    }
+                    includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'archive', docker_install_version: 'v26.1.4' });
+                    includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'archive', docker_install_version: 'latest' });
+                    if (os === 'ubuntu-latest') {
+                      includes.push({ os: os, test: test, test_name: 'rootless', docker_install_type: 'image', docker_install_version: 'latest' });
+                      includes.push({ os: os, test: test, test_name: 'rootless', docker_install_type: 'archive', docker_install_version: 'latest' });
+                    }
+                    if (os !== 'windows-latest') {
+                      includes.push({ os: os, test: test, test_name: 'tcp', docker_install_type: 'image', docker_install_version: 'latest' });
+                    }
+                    includes.push({ os: os, test: test, test_name: 'tcp', docker_install_type: 'archive', docker_install_version: 'latest' });
+                  } else {
+                    includes.push({ os: os, test: test });
+                  }
+                }
+              }
+              core.info(`includes: ${JSON.stringify(includes)}`);
+              core.setOutput('includes', JSON.stringify(includes));
+            });
      -
        name: Show matrix
        run: |
@@ -93,13 +143,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        test: ${{ fromJson(needs.prepare-itg.outputs.matrix) }}
-        os:
-          - ubuntu-latest
-          #- macos-14  # no virt: https://github.com/docker/actions-toolkit/issues/317
-          - macos-13
-          - macos-12
-          - windows-latest
+        include: ${{ fromJson(needs.prepare-itg.outputs.includes) }}
    steps:
      -
        name: Checkout
@@ -146,12 +190,22 @@ jobs:
        run: yarn install
      -
        name: Test
-        run: |
-          yarn test:itg-coverage --runTestsByPath __tests__/${{ matrix.test }} --coverageDirectory=./coverage
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const testName = `${{ matrix.test_name }}`;
+            let args = ['test:itg-coverage'];
+            if (testName) {
+              args.push(`--testNamePattern=^${testName} `);
+            }
+            args.push(`--runTestsByPath`, `__tests__/${{ matrix.test }}`, `--coverageDirectory=./coverage`);
+            await exec.exec('yarn', args);
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CTN_BUILDER_NAME: ${{ steps.builder.outputs.name }}
          TEST_FOR_SUMMARY: ${{ secrets.TEST_FOR_SUMMARY }}
+          DOCKER_INSTALL_TYPE: ${{ matrix.docker_install_type }}
+          DOCKER_INSTALL_VERSION: ${{ matrix.docker_install_version }}
      -
        name: Check coverage
        run: |
@@ -163,9 +217,9 @@ jobs:
        shell: bash
      -
        name: Upload coverage
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v5
        if: env.RUN_CODECOV == 'true'
        with:
-          file: ./coverage/clover.xml
+          files: ./coverage/clover.xml
          flags: itg
          token: ${{ secrets.CODECOV_TOKEN }}
--- a/.github/workflows/undock-releases-json.yml
+++ b/.github/workflows/undock-releases-json.yml
@@ -0,0 +1,58 @@
+name: undock-releases-json
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 */12 * * *'
+  push:
+    branches:
+      - 'main'
+  pull_request:
+    paths:
+      - '.github/workflows/undock-releases-json.yml'
+
+jobs:
+  generate:
+    uses: crazy-max/.github/.github/workflows/releases-json.yml@7f83a5a887650a38e4d0e05d5262309cfaa31459
+    with:
+      repository: crazy-max/undock
+      artifact_name: undock-releases-json
+      filename: undock-releases.json
+    secrets: inherit
+
+  open-pr:
+    runs-on: ubuntu-22.04
+    if: github.event_name != 'pull_request'
+    needs:
+      - generate
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+      -
+        name: Download
+        uses: actions/download-artifact@v4
+        with:
+          name: undock-releases-json
+          path: .github
+      -
+        name: Commit changes
+        run: |
+          git add -A .
+      -
+        name: Create PR
+        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f  # v7.0.5
+        with:
+          base: main
+          branch: bot/undock-releases-json
+          commit-message: "github: update .github/undock-releases.json"
+          signoff: true
+          delete-branch: true
+          title: "Update `.github/undock-releases.json`"
+          body: |
+            Update `.github/undock-releases.json` to keep in sync with [https://github.com/crazy-max/undock](https://github.com/crazy-max/undock).
+          draft: false
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -15,18 +15,19 @@ on:

 jobs:
  prepare:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
    outputs:
-      targets: ${{ steps.targets.outputs.matrix }}
+      targets: ${{ steps.generate.outputs.targets }}
    steps:
      -
        name: Checkout
        uses: actions/checkout@v4
      -
-        name: Matrix
-        id: targets
-        run: |
-          echo "matrix=$(docker buildx bake validate --print | jq -cr '.group.validate.targets')" >> $GITHUB_OUTPUT
+        name: List targets
+        id: generate
+        uses: docker/bake-action/subaction/list-targets@v6
+        with:
+          target: validate

  validate:
    runs-on: ubuntu-latest
@@ -37,11 +38,8 @@ jobs:
      matrix:
        target: ${{ fromJson(needs.prepare.outputs.targets) }}
    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
      -
        name: Validate
-        uses: docker/bake-action@v5
+        uses: docker/bake-action@v6
        with:
          targets: ${{ matrix.target }}
--- a/.github/workflows/virtual-env.yml
+++ b/.github/workflows/virtual-env.yml
@@ -23,7 +23,8 @@ jobs:
          - ubuntu-latest
          - ubuntu-24.04
          - ubuntu-22.04
-          - ubuntu-20.04
+          - ubuntu-24.04-arm
+          - ubuntu-22.04-arm
    steps:
      -
        name: File system
--- a/README.md
+++ b/README.md
@@ -25,6 +25,8 @@ a library by most of our GitHub Actions:
 * [docker/login-action](https://github.com/docker/login-action)
 * [docker/metadata-action](https://github.com/docker/metadata-action)
 * [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action)
+* [docker/setup-compose-action](https://github.com/docker/setup-compose-action)
+* [docker/setup-docker-action](https://github.com/docker/setup-docker-action)
 * [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action)

 This toolkit provides some utilities and common logic when developing GitHub
--- a/tests/.fixtures/bake-01-overrides.json
+++ b/tests/.fixtures/bake-01-overrides.json
@@ -22,7 +22,9 @@
        "linux/amd64"
      ],
      "output": [
-        "type=docker"
+        {
+          "type": "docker"
+        }
      ]
    }
  }
--- a/tests/.fixtures/bake-01-validate.json
+++ b/tests/.fixtures/bake-01-validate.json
@@ -22,7 +22,9 @@
        "GO_VERSION": "1.20"
      },
      "output": [
-        "type=cacheonly"
+        {
+          "type": "cacheonly"
+        }
      ]
    },
    "validate-docs": {
@@ -36,7 +38,9 @@
      },
      "target": "validate",
      "output": [
-        "type=cacheonly"
+        {
+          "type": "cacheonly"
+        }
      ]
    },
    "validate-vendor": {
@@ -48,7 +52,9 @@
      },
      "target": "validate",
      "output": [
-        "type=cacheonly"
+        {
+          "type": "cacheonly"
+        }
      ]
    }
  }
--- a/tests/.fixtures/bake-03-default.json
+++ b/tests/.fixtures/bake-03-default.json
@@ -0,0 +1,68 @@
+{
+  "group": {
+    "default": {
+      "targets": [
+        "default"
+      ]
+    }
+  },
+  "target": {
+    "default": {
+      "context": ".",
+      "dockerfile": "Dockerfile",
+      "attest": [
+        {
+          "mode": "max",
+          "type": "provenance"
+        },
+        {
+          "disabled": true,
+          "type": "sbom"
+        }
+      ],
+      "cache-from": [
+        {
+          "scope": "build",
+          "type": "gha"
+        },
+        {
+          "ref": "user/repo:cache",
+          "type": "registry"
+        }
+      ],
+      "cache-to": [
+        {
+          "mode": "max",
+          "scope": "build",
+          "type": "gha"
+        },
+        {
+          "type": "inline"
+        }
+      ],
+      "output": [
+        {
+          "dest": "./release-out",
+          "type": "local"
+        },
+        {
+          "ref": "user/app",
+          "type": "registry"
+        }
+      ],
+      "secret": [
+        {
+          "env": "GITHUB_TOKEN",
+          "id": "GITHUB_TOKEN"
+        },
+        {
+          "id": "aws",
+          "src": "__tests__/.fixtures/secret.txt"
+        },
+        {
+          "id": "GITHUB_REPOSITORY"
+        }
+      ]
+    }
+  }
+}
--- a/tests/.fixtures/bake-03.hcl
+++ b/tests/.fixtures/bake-03.hcl
@@ -0,0 +1,37 @@
+// Copyright 2024 actions-toolkit authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+target "default" {
+  attest = [
+    "type=provenance,mode=max",
+    "type=sbom,disabled=true",
+  ]
+  cache-from = [
+    "type=gha,scope=build",
+    "user/repo:cache",
+  ]
+  cache-to = [
+    "type=gha,scope=build,mode=max",
+    "type=inline"
+  ]
+  output = [
+    "./release-out",
+    "type=registry,ref=user/app"
+  ]
+  secret = [
+    "id=GITHUB_TOKEN,env=GITHUB_TOKEN",
+    "id=aws,src=__tests__/.fixtures/secret.txt",
+    "id=GITHUB_REPOSITORY"
+  ]
+}
--- a/tests/.fixtures/bake-buildx-0.10.4-binaries-cross.json
+++ b/tests/.fixtures/bake-buildx-0.10.4-binaries-cross.json
@@ -29,7 +29,10 @@
        "windows/arm64"
      ],
      "output": [
-        "./bin/build"
+        {
+          "dest": "./bin/build",
+          "type": "local"
+        }
      ]
    }
  }
--- a/tests/.fixtures/imagetools-01.json
+++ b/tests/.fixtures/imagetools-01.json
@@ -0,0 +1,74 @@
+{
+  "created": "2024-12-16T23:44:38.698098711Z",
+  "architecture": "amd64",
+  "os": "linux",
+  "config": {
+    "Env": [
+      "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+      "BUILDKIT_SETUP_CGROUPV2_ROOT=1"
+    ],
+    "Entrypoint": [
+      "buildkitd"
+    ],
+    "Volumes": {
+      "/var/lib/buildkit": {}
+    },
+    "WorkingDir": "/",
+    "ArgsEscaped": true
+  },
+  "rootfs": {
+    "type": "layers",
+    "diff_ids": [
+      "sha256:75654b8eeebd3beae97271a102f57cdeb794cc91e442648544963a7e951e9558",
+      "sha256:6a1b167dc4f30367cc713f6d48710dff20eb913bfaf14d7df23cfbe8a235319c",
+      "sha256:37453f29fa93eccde9d8ffa21c0b92c41a981c727ad6c32acee11caf4f5e42a8",
+      "sha256:cc4513cba548800cba786895e269f78eff73e7685e80b0447070f8c116652eea"
+    ]
+  },
+  "history": [
+    {
+      "created": "2024-09-06T12:05:36Z",
+      "created_by": "ADD alpine-minirootfs-3.20.3-x86_64.tar.gz / # buildkit",
+      "comment": "buildkit.dockerfile.v0"
+    },
+    {
+      "created": "2024-09-06T12:05:36Z",
+      "created_by": "CMD [\"/bin/sh\"]",
+      "comment": "buildkit.dockerfile.v0",
+      "empty_layer": true
+    },
+    {
+      "created": "2024-12-16T23:35:52.845698088Z",
+      "created_by": "RUN /bin/sh -c apk add --no-cache fuse3 git openssh pigz xz iptables ip6tables   \u0026\u0026 ln -s fusermount3 /usr/bin/fusermount # buildkit",
+      "comment": "buildkit.dockerfile.v0"
+    },
+    {
+      "created": "2024-12-16T23:35:49.452745107Z",
+      "created_by": "COPY examples/buildctl-daemonless/buildctl-daemonless.sh /usr/bin/ # buildkit",
+      "comment": "buildkit.dockerfile.v0"
+    },
+    {
+      "created": "2024-12-16T23:44:38.698098711Z",
+      "created_by": "VOLUME [/var/lib/buildkit]",
+      "comment": "buildkit.dockerfile.v0",
+      "empty_layer": true
+    },
+    {
+      "created": "2024-12-16T23:44:38.698098711Z",
+      "created_by": "COPY / /usr/bin/ # buildkit",
+      "comment": "buildkit.dockerfile.v0"
+    },
+    {
+      "created": "2024-12-16T23:44:38.698098711Z",
+      "created_by": "ENV BUILDKIT_SETUP_CGROUPV2_ROOT=1",
+      "comment": "buildkit.dockerfile.v0",
+      "empty_layer": true
+    },
+    {
+      "created": "2024-12-16T23:44:38.698098711Z",
+      "created_by": "ENTRYPOINT [\"buildkitd\"]",
+      "comment": "buildkit.dockerfile.v0",
+      "empty_layer": true
+    }
+  ]
+}
--- a/tests/.fixtures/imagetools-02.json
+++ b/tests/.fixtures/imagetools-02.json
@@ -0,0 +1,447 @@
+{
+  "linux/amd64": {
+    "created": "2024-12-16T23:44:38.698098711Z",
+    "architecture": "amd64",
+    "os": "linux",
+    "config": {
+      "Env": [
+        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+        "BUILDKIT_SETUP_CGROUPV2_ROOT=1"
+      ],
+      "Entrypoint": [
+        "buildkitd"
+      ],
+      "Volumes": {
+        "/var/lib/buildkit": {}
+      },
+      "WorkingDir": "/",
+      "ArgsEscaped": true
+    },
+    "rootfs": {
+      "type": "layers",
+      "diff_ids": [
+        "sha256:75654b8eeebd3beae97271a102f57cdeb794cc91e442648544963a7e951e9558",
+        "sha256:6a1b167dc4f30367cc713f6d48710dff20eb913bfaf14d7df23cfbe8a235319c",
+        "sha256:37453f29fa93eccde9d8ffa21c0b92c41a981c727ad6c32acee11caf4f5e42a8",
+        "sha256:cc4513cba548800cba786895e269f78eff73e7685e80b0447070f8c116652eea"
+      ]
+    },
+    "history": [
+      {
+        "created": "2024-09-06T12:05:36Z",
+        "created_by": "ADD alpine-minirootfs-3.20.3-x86_64.tar.gz / # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-09-06T12:05:36Z",
+        "created_by": "CMD [\"/bin/sh\"]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:35:52.845698088Z",
+        "created_by": "RUN /bin/sh -c apk add --no-cache fuse3 git openssh pigz xz iptables ip6tables   \u0026\u0026 ln -s fusermount3 /usr/bin/fusermount # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:35:49.452745107Z",
+        "created_by": "COPY examples/buildctl-daemonless/buildctl-daemonless.sh /usr/bin/ # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:44:38.698098711Z",
+        "created_by": "VOLUME [/var/lib/buildkit]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:44:38.698098711Z",
+        "created_by": "COPY / /usr/bin/ # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:44:38.698098711Z",
+        "created_by": "ENV BUILDKIT_SETUP_CGROUPV2_ROOT=1",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:44:38.698098711Z",
+        "created_by": "ENTRYPOINT [\"buildkitd\"]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      }
+    ]
+  },
+  "linux/arm/v7": {
+    "created": "2024-12-16T23:44:35.805758197Z",
+    "architecture": "arm",
+    "os": "linux",
+    "variant": "v7",
+    "config": {
+      "Env": [
+        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+        "BUILDKIT_SETUP_CGROUPV2_ROOT=1"
+      ],
+      "Entrypoint": [
+        "buildkitd"
+      ],
+      "Volumes": {
+        "/var/lib/buildkit": {}
+      },
+      "WorkingDir": "/",
+      "ArgsEscaped": true
+    },
+    "rootfs": {
+      "type": "layers",
+      "diff_ids": [
+        "sha256:0cee9b6e126689480f812b337d8926e8b051e2c1e40b3e36701ea2554f367b9d",
+        "sha256:4cfff05f912cc67c6ff688b2f53f84e6d74fe415725a228115a296634d919fd3",
+        "sha256:37453f29fa93eccde9d8ffa21c0b92c41a981c727ad6c32acee11caf4f5e42a8",
+        "sha256:e0962dfb9d203ce37963e41ec72119610633651f760570d20b0217db3632b5d5"
+      ]
+    },
+    "history": [
+      {
+        "created": "2024-09-06T12:05:36Z",
+        "created_by": "ADD alpine-minirootfs-3.20.3-armv7.tar.gz / # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-09-06T12:05:36Z",
+        "created_by": "CMD [\"/bin/sh\"]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:36:02.690991835Z",
+        "created_by": "RUN /bin/sh -c apk add --no-cache fuse3 git openssh pigz xz iptables ip6tables   \u0026\u0026 ln -s fusermount3 /usr/bin/fusermount # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:35:49.452745107Z",
+        "created_by": "COPY examples/buildctl-daemonless/buildctl-daemonless.sh /usr/bin/ # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:44:35.805758197Z",
+        "created_by": "VOLUME [/var/lib/buildkit]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:44:35.805758197Z",
+        "created_by": "COPY / /usr/bin/ # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:44:35.805758197Z",
+        "created_by": "ENV BUILDKIT_SETUP_CGROUPV2_ROOT=1",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:44:35.805758197Z",
+        "created_by": "ENTRYPOINT [\"buildkitd\"]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      }
+    ]
+  },
+  "linux/arm64": {
+    "created": "2024-12-16T23:44:45.848423966Z",
+    "architecture": "arm64",
+    "os": "linux",
+    "config": {
+      "Env": [
+        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+        "BUILDKIT_SETUP_CGROUPV2_ROOT=1"
+      ],
+      "Entrypoint": [
+        "buildkitd"
+      ],
+      "Volumes": {
+        "/var/lib/buildkit": {}
+      },
+      "WorkingDir": "/",
+      "ArgsEscaped": true
+    },
+    "rootfs": {
+      "type": "layers",
+      "diff_ids": [
+        "sha256:651d9022c23486dfbd396c13db293af6845731cbd098a5f5606db4bc9f5573e8",
+        "sha256:9c138da7f7ea7cc8190f71ce15f125e2eb79fd360f4cc2d34513dad016cb1096",
+        "sha256:37453f29fa93eccde9d8ffa21c0b92c41a981c727ad6c32acee11caf4f5e42a8",
+        "sha256:9422ca7e65701d8eba4a5a31e325443dcbc753c2edef64e431c96702c94d2672"
+      ]
+    },
+    "history": [
+      {
+        "created": "2024-09-06T12:05:36Z",
+        "created_by": "ADD alpine-minirootfs-3.20.3-aarch64.tar.gz / # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-09-06T12:05:36Z",
+        "created_by": "CMD [\"/bin/sh\"]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:36:03.586014466Z",
+        "created_by": "RUN /bin/sh -c apk add --no-cache fuse3 git openssh pigz xz iptables ip6tables   \u0026\u0026 ln -s fusermount3 /usr/bin/fusermount # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:35:49.452745107Z",
+        "created_by": "COPY examples/buildctl-daemonless/buildctl-daemonless.sh /usr/bin/ # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:44:45.848423966Z",
+        "created_by": "VOLUME [/var/lib/buildkit]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:44:45.848423966Z",
+        "created_by": "COPY / /usr/bin/ # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:44:45.848423966Z",
+        "created_by": "ENV BUILDKIT_SETUP_CGROUPV2_ROOT=1",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:44:45.848423966Z",
+        "created_by": "ENTRYPOINT [\"buildkitd\"]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      }
+    ]
+  },
+  "linux/ppc64le": {
+    "created": "2024-12-16T23:44:45.864267959Z",
+    "architecture": "ppc64le",
+    "os": "linux",
+    "config": {
+      "Env": [
+        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+        "BUILDKIT_SETUP_CGROUPV2_ROOT=1"
+      ],
+      "Entrypoint": [
+        "buildkitd"
+      ],
+      "Volumes": {
+        "/var/lib/buildkit": {}
+      },
+      "WorkingDir": "/",
+      "ArgsEscaped": true
+    },
+    "rootfs": {
+      "type": "layers",
+      "diff_ids": [
+        "sha256:fc80c1f6e8bee4861c27b2cee0f8edf887bd4d88d20063ba179f0caa93088770",
+        "sha256:e9fbfe005c7e2cd7d4f3159f07f6fbe82dad25c7e868a1ee2dd6503830d468c4",
+        "sha256:37453f29fa93eccde9d8ffa21c0b92c41a981c727ad6c32acee11caf4f5e42a8",
+        "sha256:86e0c30fb5e087f5cd324e082a0529c6326af1025f1a030fc1d2ac2979dec81c"
+      ]
+    },
+    "history": [
+      {
+        "created": "2024-09-06T12:05:36Z",
+        "created_by": "ADD alpine-minirootfs-3.20.3-ppc64le.tar.gz / # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-09-06T12:05:36Z",
+        "created_by": "CMD [\"/bin/sh\"]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:36:03.82451378Z",
+        "created_by": "RUN /bin/sh -c apk add --no-cache fuse3 git openssh pigz xz iptables ip6tables   \u0026\u0026 ln -s fusermount3 /usr/bin/fusermount # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:35:49.452745107Z",
+        "created_by": "COPY examples/buildctl-daemonless/buildctl-daemonless.sh /usr/bin/ # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:44:45.864267959Z",
+        "created_by": "VOLUME [/var/lib/buildkit]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:44:45.864267959Z",
+        "created_by": "COPY / /usr/bin/ # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:44:45.864267959Z",
+        "created_by": "ENV BUILDKIT_SETUP_CGROUPV2_ROOT=1",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:44:45.864267959Z",
+        "created_by": "ENTRYPOINT [\"buildkitd\"]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      }
+    ]
+  },
+  "linux/riscv64": {
+    "created": "2024-12-16T23:44:51.369236518Z",
+    "architecture": "riscv64",
+    "os": "linux",
+    "config": {
+      "Env": [
+        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+        "BUILDKIT_SETUP_CGROUPV2_ROOT=1"
+      ],
+      "Entrypoint": [
+        "buildkitd"
+      ],
+      "Volumes": {
+        "/var/lib/buildkit": {}
+      },
+      "WorkingDir": "/",
+      "ArgsEscaped": true
+    },
+    "rootfs": {
+      "type": "layers",
+      "diff_ids": [
+        "sha256:f9a3c4be4be59ad69b98da83e848450a28193c63ecdb40736f854308873152f9",
+        "sha256:231aa6f6a7db1c4ac8dc807a8bdd250f92be3ffac79ef9fec89ca8ac2f78e688",
+        "sha256:37453f29fa93eccde9d8ffa21c0b92c41a981c727ad6c32acee11caf4f5e42a8",
+        "sha256:555c2f18bbe5d71e09387bdf745023055a8e5a6667905143c09a689e65f5ceff"
+      ]
+    },
+    "history": [
+      {
+        "created": "2024-09-06T12:05:36Z",
+        "created_by": "ADD alpine-minirootfs-3.20.3-riscv64.tar.gz / # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-09-06T12:05:36Z",
+        "created_by": "CMD [\"/bin/sh\"]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:36:02.869897238Z",
+        "created_by": "RUN /bin/sh -c apk add --no-cache fuse3 git openssh pigz xz iptables ip6tables   \u0026\u0026 ln -s fusermount3 /usr/bin/fusermount # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:35:49.452745107Z",
+        "created_by": "COPY examples/buildctl-daemonless/buildctl-daemonless.sh /usr/bin/ # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:44:51.369236518Z",
+        "created_by": "VOLUME [/var/lib/buildkit]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:44:51.369236518Z",
+        "created_by": "COPY / /usr/bin/ # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:44:51.369236518Z",
+        "created_by": "ENV BUILDKIT_SETUP_CGROUPV2_ROOT=1",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:44:51.369236518Z",
+        "created_by": "ENTRYPOINT [\"buildkitd\"]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      }
+    ]
+  },
+  "linux/s390x": {
+    "created": "2024-12-16T23:44:38.777675109Z",
+    "architecture": "s390x",
+    "os": "linux",
+    "config": {
+      "Env": [
+        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+        "BUILDKIT_SETUP_CGROUPV2_ROOT=1"
+      ],
+      "Entrypoint": [
+        "buildkitd"
+      ],
+      "Volumes": {
+        "/var/lib/buildkit": {}
+      },
+      "WorkingDir": "/",
+      "ArgsEscaped": true
+    },
+    "rootfs": {
+      "type": "layers",
+      "diff_ids": [
+        "sha256:a772154591ea8d876b24f25db93db4753a9f05c6500413a5ff966d581957655e",
+        "sha256:920529bf8be4087e77ec129bbcd9f3c4a179ede2f35cac38c6f8517fc9e41b9b",
+        "sha256:37453f29fa93eccde9d8ffa21c0b92c41a981c727ad6c32acee11caf4f5e42a8",
+        "sha256:2b99eb6f0070abe514fde85b61fa4993f1edfb32365b2a246841521f24fc38c0"
+      ]
+    },
+    "history": [
+      {
+        "created": "2024-09-06T12:05:36Z",
+        "created_by": "ADD alpine-minirootfs-3.20.3-s390x.tar.gz / # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-09-06T12:05:36Z",
+        "created_by": "CMD [\"/bin/sh\"]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:36:04.705568496Z",
+        "created_by": "RUN /bin/sh -c apk add --no-cache fuse3 git openssh pigz xz iptables ip6tables   \u0026\u0026 ln -s fusermount3 /usr/bin/fusermount # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:35:49.452745107Z",
+        "created_by": "COPY examples/buildctl-daemonless/buildctl-daemonless.sh /usr/bin/ # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:44:38.777675109Z",
+        "created_by": "VOLUME [/var/lib/buildkit]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:44:38.777675109Z",
+        "created_by": "COPY / /usr/bin/ # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:44:38.777675109Z",
+        "created_by": "ENV BUILDKIT_SETUP_CGROUPV2_ROOT=1",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:44:38.777675109Z",
+        "created_by": "ENTRYPOINT [\"buildkitd\"]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      }
+    ]
+  }
+}
--- a/tests/.fixtures/inspect11.txt
+++ b/tests/.fixtures/inspect11.txt
@@ -37,3 +37,15 @@ GC Policy rule#2:
 GC Policy rule#3:
 All:        true
 Keep Bytes: 94.06GiB
+File#buildkitd.toml:
+ > debug = true
+ > insecure-entitlements = ["network.host", "security.insecure"]
+ > trace = true
+ >
+ > [log]
+ >   format = "text"
+ >
+File#foo.txt:
+ > foo = bar
+ > baz = qux
+ >
--- a/tests/.fixtures/inspect12.txt
+++ b/tests/.fixtures/inspect12.txt
@@ -0,0 +1,55 @@
+Name:          nvidia
+Driver:        docker-container
+Last Activity: 2025-02-14 15:57:45 +0000 UTC
+
+Nodes:
+Name:                  nvidia0
+Endpoint:              unix:///var/run/docker.sock
+Driver Options:        image="moby/buildkit:local"
+Status:                running
+BuildKit daemon flags: --allow-insecure-entitlement=network.host
+BuildKit version:      v0.20.0-rc2-4-gd30d8e22c.m
+Platforms:             linux/amd64, linux/amd64/v2, linux/amd64/v3, linux/arm64, linux/riscv64, linux/ppc64le, linux/s390x, linux/386, linux/arm/v7, linux/arm/v6
+Features:
+ Cache export:         true
+ Docker exporter:      true
+ Multi-platform build: true
+ OCI exporter:         true
+Labels:
+ org.mobyproject.buildkit.worker.executor:         oci
+ org.mobyproject.buildkit.worker.hostname:         76ac9a510d96
+ org.mobyproject.buildkit.worker.network:          host
+ org.mobyproject.buildkit.worker.oci.process-mode: sandbox
+ org.mobyproject.buildkit.worker.selinux.enabled:  false
+ org.mobyproject.buildkit.worker.snapshotter:      overlayfs
+Devices:
+ Name:                  nvidia.com/gpu=all
+ Automatically allowed: true
+ Annotations:
+  foo:                                       bar
+  org.mobyproject.buildkit.device.autoallow: true
+ Name:                  docker.com/gpu=venus
+ Automatically allowed: false
+ Annotations:
+  bar:                                       baz
+GC Policy rule#0:
+ All:            false
+ Filters:        type==source.local,type==exec.cachemount,type==source.git.checkout
+ Keep Duration:  48h0m0s
+ Max Used Space: 488.3MiB
+GC Policy rule#1:
+ All:            false
+ Keep Duration:  1440h0m0s
+ Reserved Space: 9.313GiB
+ Max Used Space: 93.13GiB
+ Min Free Space: 188.1GiB
+GC Policy rule#2:
+ All:            false
+ Reserved Space: 9.313GiB
+ Max Used Space: 93.13GiB
+ Min Free Space: 188.1GiB
+GC Policy rule#3:
+ All:            true
+ Reserved Space: 9.313GiB
+ Max Used Space: 93.13GiB
+ Min Free Space: 188.1GiB
--- a/tests/buildx/bake.test.ts
+++ b/tests/buildx/bake.test.ts
@@ -94,7 +94,14 @@ describe('getDefinition', () => {
      ['*.output=type=docker', '*.platform=linux/amd64'],
      undefined,
      path.join(fixturesDir, 'bake-01-overrides.json')
-    ]
+    ],
+    [
+      [path.join(fixturesDir, 'bake-03.hcl')],
+      [],
+      [],
+      undefined,
+      path.join(fixturesDir, 'bake-03-default.json')
+    ],
  ])('given %p', async (files: string[], targets: string[], overrides: string[], execOptions: ExecOptions | undefined, out: string) => {
    const bake = new Bake();
    const expectedDef = <BakeDefinition>JSON.parse(fs.readFileSync(out, {encoding: 'utf-8'}).trim())
@@ -103,7 +110,7 @@ describe('getDefinition', () => {
      targets: targets,
      overrides: overrides
    }, execOptions)).toEqual(expectedDef);
-  });
+  }, 30 * 60 * 1000);
 });

 describe('hasLocalExporter', () => {
@@ -114,7 +121,9 @@ describe('hasLocalExporter', () => {
        "target": {
          "build": {
            "output": [
-              "type=docker"
+              {
+                "type": "docker"
+              }
            ]
          },
        }
@@ -136,7 +145,10 @@ describe('hasLocalExporter', () => {
        "target": {
          "local": {
            "output": [
-              "type=local,dest=./release-out"
+              {
+                "type": "local",
+                "dest": "./release-out"
+              }
            ]
          },
        }
@@ -148,19 +160,10 @@ describe('hasLocalExporter', () => {
        "target": {
          "tar": {
            "output": [
-              "type=tar,dest=/tmp/image.tar"
-            ]
-          },
-        }
-      } as unknown as BakeDefinition,
-      false
-    ],
-    [
-      {
-        "target": {
-          "tar": {
-            "output": [
-              '"type=tar","dest=/tmp/image.tar"',
+              {
+                "type": "tar",
+                "dest": "/tmp/image.tar"
+              }
            ]
          },
        }
@@ -172,19 +175,10 @@ describe('hasLocalExporter', () => {
        "target": {
          "local": {
            "output": [
-              '" type= local" , dest=./release-out',
-            ]
-          },
-        }
-      } as unknown as BakeDefinition,
-      true
-    ],
-    [
-      {
-        "target": {
-          "local": {
-            "output": [
-              ".",
+              {
+                "type": "local",
+                "dest": "."
+              }
            ]
          },
        }
@@ -204,7 +198,10 @@ describe('hasTarExporter', () => {
        "target": {
          "reg": {
            "output": [
-              "type=registry,ref=user/app"
+              {
+                "type": "registry",
+                "ref": "user/app"
+              }
            ]
          },
        }
@@ -216,7 +213,9 @@ describe('hasTarExporter', () => {
        "target": {
          "build": {
            "output": [
-              "type=docker"
+              {
+                "type": "docker"
+              }
            ]
          },
        }
@@ -228,7 +227,10 @@ describe('hasTarExporter', () => {
        "target": {
          "local": {
            "output": [
-              "type=local,dest=./release-out"
+              {
+                "type": "local",
+                "dest": "./release-out"
+              }
            ]
          },
        }
@@ -240,7 +242,10 @@ describe('hasTarExporter', () => {
        "target": {
          "tar": {
            "output": [
-              "type=tar,dest=/tmp/image.tar"
+              {
+                "type": "tar",
+                "dest": "/tmp/image.tar"
+              }
            ]
          },
        }
@@ -252,20 +257,13 @@ describe('hasTarExporter', () => {
        "target": {
          "multi": {
            "output": [
-              "type=docker",
-              "type=tar,dest=/tmp/image.tar"
-            ]
-          },
-        }
-      } as unknown as BakeDefinition,
-      true
-    ],
-    [
-      {
-        "target": {
-          "tar": {
-            "output": [
-              '"type=tar","dest=/tmp/image.tar"',
+              {
+                "type": "docker"
+              },
+              {
+                "type": "tar",
+                "dest": "/tmp/image.tar"
+              }
            ]
          },
        }
@@ -277,19 +275,10 @@ describe('hasTarExporter', () => {
        "target": {
          "local": {
            "output": [
-              '" type= local" , dest=./release-out',
-            ]
-          },
-        }
-      } as unknown as BakeDefinition,
-      false
-    ],
-    [
-      {
-        "target": {
-          "local": {
-            "output": [
-              ".",
+              {
+                "type": "local",
+                "dest": "."
+              }
            ]
          },
        }
@@ -309,7 +298,10 @@ describe('hasDockerExporter', () => {
        "target": {
          "reg": {
            "output": [
-              "type=registry,ref=user/app"
+              {
+                "type": "registry",
+                "ref": "user/app"
+              }
            ]
          },
        }
@@ -322,7 +314,9 @@ describe('hasDockerExporter', () => {
        "target": {
          "build": {
            "output": [
-              "type=docker"
+              {
+                "type": "docker"
+              }
            ]
          },
        }
@@ -335,8 +329,13 @@ describe('hasDockerExporter', () => {
        "target": {
          "multi": {
            "output": [
-              "type=docker",
-              "type=tar,dest=/tmp/image.tar"
+              {
+                "type": "docker"
+              },
+              {
+                "type": "tar",
+                "dest": "/tmp/image.tar"
+              }
            ]
          },
        }
@@ -349,20 +348,10 @@ describe('hasDockerExporter', () => {
        "target": {
          "local": {
            "output": [
-              '" type= local" , dest=./release-out'
-            ]
-          },
-        }
-      } as unknown as BakeDefinition,
-      false,
-      undefined
-    ],
-    [
-      {
-        "target": {
-          "local": {
-            "output": [
-              "type=local,dest=./release-out"
+              {
+                "type": "local",
+                "dest": "./release-out"
+              }
            ]
          },
        }
@@ -375,7 +364,10 @@ describe('hasDockerExporter', () => {
        "target": {
          "tar": {
            "output": [
-              "type=tar,dest=/tmp/image.tar"
+              {
+                "type": "tar",
+                "dest": "/tmp/image.tar"
+              }
            ]
          },
        }
@@ -388,8 +380,13 @@ describe('hasDockerExporter', () => {
        "target": {
          "multi": {
            "output": [
-              "type=docker",
-              "type=tar,dest=/tmp/image.tar"
+              {
+                "type": "docker"
+              },
+              {
+                "type": "tar",
+                "dest": "/tmp/image.tar"
+              }
            ]
          },
        }
@@ -397,51 +394,14 @@ describe('hasDockerExporter', () => {
      true,
      undefined
    ],
-    [
-      {
-        "target": {
-          "tar": {
-            "output": [
-              '"type=tar","dest=/tmp/image.tar"'
-            ]
-          },
-        }
-      } as unknown as BakeDefinition,
-      false,
-      undefined
-    ],
-    [
-      {
-        "target": {
-          "tar": {
-            "output": [
-              '"type=tar","dest=/tmp/image.tar"'
-            ]
-          },
-        }
-      } as unknown as BakeDefinition,
-      false,
-      undefined
-    ],
-    [
-      {
-        "target": {
-          "local": {
-            "output": [
-              '" type= local" , dest=./release-out'
-            ]
-          },
-        }
-      } as unknown as BakeDefinition,
-      false,
-      undefined
-    ],
    [
      {
        "target": {
          "build": {
            "output": [
-              "type=docker"
+              {
+                "type": "docker"
+              }
            ]
          },
        }
@@ -454,7 +414,9 @@ describe('hasDockerExporter', () => {
        "target": {
          "build": {
            "output": [
-              "type=docker"
+              {
+                "type": "docker"
+              }
            ]
          },
        }
@@ -467,7 +429,10 @@ describe('hasDockerExporter', () => {
        "target": {
          "build": {
            "output": [
-              "."
+              {
+                "type": "local",
+                "dest": "."
+              }
            ]
          },
        }
@@ -479,3 +444,44 @@ describe('hasDockerExporter', () => {
    expect(Bake.hasDockerExporter(def, load)).toEqual(expected);
  });
 });
+
+describe('hasGitAuthTokenSecret', () => {
+  // prettier-ignore
+  test.each([
+    [
+      {
+        "target": {
+          "reg": {
+            "secret": [
+              {
+                "id": "A_SECRET",
+                "env": "A_SECRET"
+              }
+            ]
+          },
+        }
+      } as unknown as BakeDefinition,
+      false
+    ],
+    [
+      {
+        "target": {
+          "reg": {
+            "secret": [
+              {
+                "id": "A_SECRET",
+                "env": "A_SECRET"
+              },
+              {
+                "id": "GIT_AUTH_TOKEN"
+              }
+            ]
+          },
+        }
+      } as unknown as BakeDefinition,
+      true
+    ],
+  ])('given %o returns %p', async (def: BakeDefinition, expected: boolean) => {
+    expect(Bake.hasGitAuthTokenSecret(def)).toEqual(expected);
+  });
+});
--- a/tests/buildx/builder.test.ts
+++ b/tests/buildx/builder.test.ts
@@ -449,6 +449,101 @@ describe('parseInspect', () => {
               "all": true,
               "keepBytes": "94.06GiB",
             }
+           ],
+           "files": {
+             "buildkitd.toml": `debug = true
+insecure-entitlements = ["network.host", "security.insecure"]
+trace = true
+
+[log]
+  format = "text"
+`,
+             "foo.txt": `foo = bar
+baz = qux
+`,
+           }
+         }
+       ]
+     }
+    ],
+    [
+     'inspect12.txt',
+     {
+       "name": "nvidia",
+       "driver": "docker-container",
+       "lastActivity": new Date("2025-02-14T15:57:45.000Z"),
+       "nodes": [
+         {
+           "buildkit": "v0.20.0-rc2-4-gd30d8e22c.m",
+           "buildkitd-flags": "--allow-insecure-entitlement=network.host",
+           "driver-opts": [
+             "image=moby/buildkit:local",
+           ],
+           "endpoint": "unix:///var/run/docker.sock",
+           "name": "nvidia0",
+           "platforms": "linux/amd64,linux/amd64/v2,linux/amd64/v3,linux/arm64,linux/riscv64,linux/ppc64le,linux/s390x,linux/386,linux/arm/v7,linux/arm/v6",
+           "status": "running",
+           "features": {
+             "Cache export": true,
+             "Docker exporter": true,
+             "Multi-platform build": true,
+             "OCI exporter": true,
+           },
+           "labels": {
+             "org.mobyproject.buildkit.worker.executor": "oci",
+             "org.mobyproject.buildkit.worker.hostname": "76ac9a510d96",
+             "org.mobyproject.buildkit.worker.network": "host",
+             "org.mobyproject.buildkit.worker.oci.process-mode": "sandbox",
+             "org.mobyproject.buildkit.worker.selinux.enabled": "false",
+             "org.mobyproject.buildkit.worker.snapshotter": "overlayfs",
+           },
+           "devices": [
+             {
+               "annotations": {
+                 "foo": "bar",
+                 "org.mobyproject.buildkit.device.autoallow": "true"
+               },
+               "autoAllow": true,
+               "name": "nvidia.com/gpu=all"
+             },
+             {
+               "annotations": {
+                 "bar": "baz"
+               },
+               "autoAllow": false,
+               "name": "docker.com/gpu=venus"
+             }
+           ],
+           "gcPolicy": [
+             {
+               "all": false,
+               "filter": [
+                 "type==source.local",
+                 "type==exec.cachemount",
+                 "type==source.git.checkout"
+               ],
+               "keepDuration": "48h0m0s",
+               "maxUsedSpace": "488.3MiB",
+             },
+             {
+               "all": false,
+               "keepDuration": "1440h0m0s",
+               "maxUsedSpace": "93.13GiB",
+               "minFreeSpace": "188.1GiB",
+               "reservedSpace": "9.313GiB",
+             },
+             {
+               "all": false,
+               "maxUsedSpace": "93.13GiB",
+               "minFreeSpace": "188.1GiB",
+               "reservedSpace": "9.313GiB",
+             },
+             {
+               "all": true,
+               "maxUsedSpace": "93.13GiB",
+               "minFreeSpace": "188.1GiB",
+               "reservedSpace": "9.313GiB",
+             }
           ]
         }
       ]
--- a/tests/buildx/history.test.itg.ts
+++ b/tests/buildx/history.test.itg.ts
@@ -14,7 +14,7 @@
 * limitations under the License.
 */

-import {afterEach, beforeEach, describe, expect, it, jest, test} from '@jest/globals';
+import {describe, expect, it, test} from '@jest/globals';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
@@ -30,7 +30,49 @@ const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'buildx

 const maybe = !process.env.GITHUB_ACTIONS || (process.env.GITHUB_ACTIONS === 'true' && process.env.ImageOS && process.env.ImageOS.startsWith('ubuntu')) ? describe : describe.skip;

-maybe('exportBuild', () => {
+maybe('inspect', () => {
+  it('build', async () => {
+    const buildx = new Buildx();
+    const build = new Build({buildx: buildx});
+
+    fs.mkdirSync(tmpDir, {recursive: true});
+    await expect(
+      (async () => {
+        // prettier-ignore
+        const buildCmd = await buildx.getCommand([
+          '--builder', process.env.CTN_BUILDER_NAME ?? 'default',
+          'build', '-f', path.join(fixturesDir, 'hello.Dockerfile'),
+          '--metadata-file', build.getMetadataFilePath(),
+          fixturesDir
+        ]);
+        await Exec.exec(buildCmd.command, buildCmd.args);
+      })()
+    ).resolves.not.toThrow();
+
+    const metadata = build.resolveMetadata();
+    expect(metadata).toBeDefined();
+    const buildRef = build.resolveRef(metadata);
+    if (!buildRef) {
+      throw new Error('buildRef is undefined');
+    }
+    const [builderName, nodeName, ref] = buildRef.split('/');
+    expect(builderName).toBeDefined();
+    expect(nodeName).toBeDefined();
+    expect(ref).toBeDefined();
+
+    const history = new History({buildx: buildx});
+    const res = await history.inspect({
+      ref: ref,
+      builder: builderName
+    });
+
+    expect(res).toBeDefined();
+    expect(res?.Name).toBeDefined();
+    expect(res?.Ref).toBeDefined();
+  });
+});
+
+maybe('export', () => {
  // prettier-ignore
  test.each([
    [
@@ -50,7 +92,7 @@ maybe('exportBuild', () => {
        fixturesDir
      ],
    ]
-  ])('export build %p', async (_, bargs) => {
+  ])('export with build %p', async (_, bargs) => {
    const buildx = new Buildx();
    const build = new Build({buildx: buildx});

@@ -110,7 +152,7 @@ maybe('exportBuild', () => {
        'hello-matrix'
      ],
    ]
-  ])('export bake build %p', async (_, bargs) => {
+  ])('export with bake %p', async (_, bargs) => {
    const buildx = new Buildx();
    const bake = new Bake({buildx: buildx});

@@ -145,22 +187,8 @@ maybe('exportBuild', () => {
    expect(fs.existsSync(exportRes?.dockerbuildFilename)).toBe(true);
    expect(exportRes?.summaries).toBeDefined();
  });
-});

-maybe('exportBuild custom image', () => {
-  const originalEnv = process.env;
-  beforeEach(() => {
-    jest.resetModules();
-    process.env = {
-      ...originalEnv,
-      DOCKER_BUILD_EXPORT_BUILD_IMAGE: 'docker.io/dockereng/export-build:0.2.2'
-    };
-  });
-  afterEach(() => {
-    process.env = originalEnv;
-  });
-
-  it('with custom image', async () => {
+  it('export using container', async () => {
    const buildx = new Buildx();
    const build = new Build({buildx: buildx});

@@ -185,7 +213,8 @@ maybe('exportBuild custom image', () => {

    const history = new History({buildx: buildx});
    const exportRes = await history.export({
-      refs: [buildRef ?? '']
+      refs: [buildRef ?? ''],
+      useContainer: true
    });

    expect(exportRes).toBeDefined();
--- a/tests/buildx/imagetools.test.itg.ts
+++ b/tests/buildx/imagetools.test.itg.ts
@@ -0,0 +1,39 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, it} from '@jest/globals';
+import * as fs from 'fs';
+import * as path from 'path';
+
+import {ImageTools} from '../../src/buildx/imagetools';
+import {Image} from '../../src/types/oci/config';
+
+const fixturesDir = path.join(__dirname, '..', '.fixtures');
+
+const maybe = !process.env.GITHUB_ACTIONS || (process.env.GITHUB_ACTIONS === 'true' && process.env.ImageOS && process.env.ImageOS.startsWith('ubuntu')) ? describe : describe.skip;
+
+maybe('inspectImage', () => {
+  it('inspect single platform', async () => {
+    const image = await new ImageTools().inspectImage('moby/buildkit:latest@sha256:5769c54b98840147b74128f38fb0b0a049e24b11a75bd81664131edd2854593f');
+    const expectedImage = <Image>JSON.parse(fs.readFileSync(path.join(fixturesDir, 'imagetools-01.json'), {encoding: 'utf-8'}).trim());
+    expect(image).toEqual(expectedImage);
+  });
+  it('inspect multi platform', async () => {
+    const image = await new ImageTools().inspectImage('moby/buildkit:latest@sha256:86c0ad9d1137c186e9d455912167df20e530bdf7f7c19de802e892bb8ca16552');
+    const expectedImage = <Record<string, Image>>JSON.parse(fs.readFileSync(path.join(fixturesDir, 'imagetools-02.json'), {encoding: 'utf-8'}).trim());
+    expect(image).toEqual(expectedImage);
+  });
+});
--- a/tests/buildx/install.test.itg.ts
+++ b/tests/buildx/install.test.itg.ts
@@ -24,7 +24,7 @@ const maybe = !process.env.GITHUB_ACTIONS || (process.env.GITHUB_ACTIONS === 'tr
 maybe('download', () => {
  // prettier-ignore
  test.each(['latest'])(
-    'install docker %s', async (version) => {
+    'install buildx %s', async (version) => {
      await expect((async () => {
        const install = new Install({
          standalone: true
--- a/tests/buildx/install.test.ts
+++ b/tests/buildx/install.test.ts
@@ -37,19 +37,17 @@ describe('download', () => {
    ['latest', true]
  ])(
  'acquires %p of buildx (standalone: %p)', async (version, standalone) => {
-      const install = new Install({standalone: standalone});
-      const toolPath = await install.download(version);
-      expect(fs.existsSync(toolPath)).toBe(true);
-      let buildxBin: string;
-      if (standalone) {
-        buildxBin = await install.installStandalone(toolPath, tmpDir);
-      } else {
-        buildxBin = await install.installPlugin(toolPath, tmpDir);
-      }
-      expect(fs.existsSync(buildxBin)).toBe(true);
-    },
-    100000
-  );
+    const install = new Install({standalone: standalone});
+    const toolPath = await install.download(version);
+    expect(fs.existsSync(toolPath)).toBe(true);
+    let buildxBin: string;
+    if (standalone) {
+      buildxBin = await install.installStandalone(toolPath, tmpDir);
+    } else {
+      buildxBin = await install.installPlugin(toolPath, tmpDir);
+    }
+    expect(fs.existsSync(buildxBin)).toBe(true);
+  }, 100000);

  // prettier-ignore
  test.each([
@@ -61,7 +59,7 @@ describe('download', () => {
    const install = new Install({standalone: false});
    const toolPath = await install.download(version);
    expect(fs.existsSync(toolPath)).toBe(true);
-  });
+  }, 100000);

  // prettier-ignore
  test.each([
@@ -72,7 +70,7 @@ describe('download', () => {
    const install = new Install({standalone: false});
    const toolPath = await install.download(version, true);
    expect(fs.existsSync(toolPath)).toBe(true);
-  });
+  }, 100000);

  // TODO: add tests for arm
  // prettier-ignore
@@ -87,14 +85,12 @@ describe('download', () => {
    ['linux', 's390x'],
  ])(
  'acquires buildx for %s/%s', async (os, arch) => {
-      jest.spyOn(osm, 'platform').mockImplementation(() => os as NodeJS.Platform);
-      jest.spyOn(osm, 'arch').mockImplementation(() => arch);
-      const install = new Install();
-      const buildxBin = await install.download('latest');
-      expect(fs.existsSync(buildxBin)).toBe(true);
-    },
-    100000
-  );
+    jest.spyOn(osm, 'platform').mockImplementation(() => os as NodeJS.Platform);
+    jest.spyOn(osm, 'arch').mockImplementation(() => arch);
+    const install = new Install();
+    const buildxBin = await install.download('latest');
+    expect(fs.existsSync(buildxBin)).toBe(true);
+  }, 100000);
 });

 describe('build', () => {
@@ -134,22 +130,30 @@ describe('getDownloadVersion', () => {
    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/buildx-releases.json');
  });

-  it('returns lab latest download version', async () => {
-    const version = await Install.getDownloadVersion('lab:latest');
-    expect(version.key).toEqual('lab');
+  it('returns cloud latest download version', async () => {
+    const version = await Install.getDownloadVersion('cloud:latest');
+    expect(version.key).toEqual('cloud');
    expect(version.version).toEqual('latest');
    expect(version.downloadURL).toEqual('https://github.com/docker/buildx-desktop/releases/download/v%s/%s');
    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/buildx-lab-releases.json');
  });

-  it('returns lab v0.11.2-desktop.2 download version', async () => {
-    const version = await Install.getDownloadVersion('lab:v0.11.2-desktop.2');
-    expect(version.key).toEqual('lab');
+  it('returns cloud v0.11.2-desktop.2 download version', async () => {
+    const version = await Install.getDownloadVersion('cloud:v0.11.2-desktop.2');
+    expect(version.key).toEqual('cloud');
    expect(version.version).toEqual('v0.11.2-desktop.2');
    expect(version.downloadURL).toEqual('https://github.com/docker/buildx-desktop/releases/download/v%s/%s');
    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/buildx-lab-releases.json');
  });

+  it('returns cloud for lab version', async () => {
+    const version = await Install.getDownloadVersion('lab:latest');
+    expect(version.key).toEqual('cloud');
+    expect(version.version).toEqual('latest');
+    expect(version.downloadURL).toEqual('https://github.com/docker/buildx-desktop/releases/download/v%s/%s');
+    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/buildx-lab-releases.json');
+  });
+
  it('unknown repo', async () => {
    await expect(Install.getDownloadVersion('foo:bar')).rejects.toThrow(new Error('Cannot find buildx version for foo:bar'));
  });
@@ -172,8 +176,8 @@ describe('getRelease', () => {
    expect(release?.html_url).toEqual('https://github.com/docker/buildx/releases/tag/v0.10.1');
  });

-  it('returns v0.11.2-desktop.2 lab GitHub release', async () => {
-    const version = await Install.getDownloadVersion('lab:v0.11.2-desktop.2');
+  it('returns v0.11.2-desktop.2 cloud GitHub release', async () => {
+    const version = await Install.getDownloadVersion('cloud:v0.11.2-desktop.2');
    const release = await Install.getRelease(version);
    expect(release).not.toBeNull();
    expect(release?.id).toEqual(118213369);
--- a/tests/cache.test.itg.ts
+++ b/tests/cache.test.itg.ts
@@ -20,13 +20,27 @@ import os from 'os';
 import path from 'path';

 import {Cache} from '../src/cache';
+import {Util} from '../src/util';

 const fixturesDir = path.join(__dirname, '.fixtures');
 const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'cache-itg-'));

 describe('cache', () => {
-  it('github-repo', async () => {
-    const r = (Math.random() + 1).toString(36).substring(7);
+  it('caches github-repo', async () => {
+    const r = Util.generateRandomString();
+    const htcName = `cache-test-github-repo-${r}`;
+    const c = new Cache({
+      htcName: htcName,
+      htcVersion: `v1.0.0+${r}`,
+      baseCacheDir: path.join(tmpDir, '.cache-test'),
+      cacheFile: 'github-repo.json'
+    });
+    expect(await c.save(path.join(fixturesDir, 'github-repo.json'), true)).not.toEqual('');
+    expect(await c.find()).not.toEqual('');
+  });
+
+  it('caches github-repo with post state', async () => {
+    const r = Util.generateRandomString();
    const htcName = `cache-test-github-repo-${r}`;
    const c = new Cache({
      htcName: htcName,
@@ -35,6 +49,7 @@ describe('cache', () => {
      cacheFile: 'github-repo.json'
    });
    expect(await c.save(path.join(fixturesDir, 'github-repo.json'))).not.toEqual('');
+    expect(await Cache.post()).not.toBeNull();
    expect(await c.find()).not.toEqual('');
  });
 });
--- a/tests/compose/compose.test.ts
+++ b/tests/compose/compose.test.ts
@@ -0,0 +1,109 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, it, jest, test, afterEach} from '@jest/globals';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import * as rimraf from 'rimraf';
+import * as semver from 'semver';
+
+import {Context} from '../../src/context';
+import {Exec} from '../../src/exec';
+
+import {Compose} from '../../src/compose/compose';
+
+const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'compose-compose-'));
+const tmpName = path.join(tmpDir, '.tmpname-jest');
+
+jest.spyOn(Context, 'tmpDir').mockImplementation((): string => {
+  fs.mkdirSync(tmpDir, {recursive: true});
+  return tmpDir;
+});
+
+jest.spyOn(Context, 'tmpName').mockImplementation((): string => {
+  return tmpName;
+});
+
+afterEach(() => {
+  rimraf.sync(tmpDir);
+});
+
+describe('isAvailable', () => {
+  it('docker cli', async () => {
+    const execSpy = jest.spyOn(Exec, 'getExecOutput');
+    const compose = new Compose({
+      standalone: false
+    });
+    await compose.isAvailable();
+    // eslint-disable-next-line jest/no-standalone-expect
+    expect(execSpy).toHaveBeenCalledWith(`docker`, ['compose'], {
+      silent: true,
+      ignoreReturnCode: true
+    });
+  });
+  it('standalone', async () => {
+    const execSpy = jest.spyOn(Exec, 'getExecOutput');
+    const compose = new Compose({
+      standalone: true
+    });
+    await compose.isAvailable();
+    // eslint-disable-next-line jest/no-standalone-expect
+    expect(execSpy).toHaveBeenCalledWith(`compose`, [], {
+      silent: true,
+      ignoreReturnCode: true
+    });
+  });
+});
+
+describe('printVersion', () => {
+  it('docker cli', async () => {
+    const execSpy = jest.spyOn(Exec, 'exec');
+    const compose = new Compose({
+      standalone: false
+    });
+    await compose.printVersion();
+    expect(execSpy).toHaveBeenCalledWith(`docker`, ['compose', 'version'], {
+      failOnStdErr: false
+    });
+  });
+  it('standalone', async () => {
+    const execSpy = jest.spyOn(Exec, 'exec');
+    const compose = new Compose({
+      standalone: true
+    });
+    await compose.printVersion();
+    expect(execSpy).toHaveBeenCalledWith(`compose`, ['version'], {
+      failOnStdErr: false
+    });
+  });
+});
+
+describe('version', () => {
+  it('valid', async () => {
+    const compose = new Compose();
+    expect(semver.valid(await compose.version())).not.toBeUndefined();
+  });
+});
+
+describe('parseVersion', () => {
+  // prettier-ignore
+  test.each([
+    ['Docker Compose version v2.31.0', '2.31.0'],
+  ])('given %p', async (stdout, expected) => {
+    expect(Compose.parseVersion(stdout)).toEqual(expected);
+  });
+});
--- a/tests/compose/install.test.itg.ts
+++ b/tests/compose/install.test.itg.ts
@@ -0,0 +1,42 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, test} from '@jest/globals';
+import * as fs from 'fs';
+
+import {Install} from '../../src/compose/install';
+
+const maybe = !process.env.GITHUB_ACTIONS || (process.env.GITHUB_ACTIONS === 'true' && process.env.ImageOS && process.env.ImageOS.startsWith('ubuntu')) ? describe : describe.skip;
+
+maybe('download', () => {
+  // prettier-ignore
+  test.each(['latest'])(
+    'install compose %s', async (version) => {
+      await expect((async () => {
+        const install = new Install({
+          standalone: true
+        });
+        const toolPath = await install.download(version);
+        if (!fs.existsSync(toolPath)) {
+          throw new Error('toolPath does not exist');
+        }
+        const binPath = await install.installStandalone(toolPath);
+        if (!fs.existsSync(binPath)) {
+          throw new Error('binPath does not exist');
+        }
+      })()).resolves.not.toThrow();
+    }, 60000);
+});
--- a/tests/compose/install.test.ts
+++ b/tests/compose/install.test.ts
@@ -0,0 +1,157 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, it, jest, test, afterEach} from '@jest/globals';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import * as rimraf from 'rimraf';
+import osm = require('os');
+
+import {Install} from '../../src/compose/install';
+
+const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'compose-install-'));
+
+afterEach(function () {
+  rimraf.sync(tmpDir);
+});
+
+describe('download', () => {
+  // prettier-ignore
+  test.each([
+    ['v2.31.0', false],
+    ['v2.32.4', true],
+    ['latest', true]
+  ])(
+  'acquires %p of compose (standalone: %p)', async (version, standalone) => {
+    const install = new Install({standalone: standalone});
+    const toolPath = await install.download(version);
+    expect(fs.existsSync(toolPath)).toBe(true);
+    let composeBin: string;
+    if (standalone) {
+      composeBin = await install.installStandalone(toolPath, tmpDir);
+    } else {
+      composeBin = await install.installPlugin(toolPath, tmpDir);
+    }
+    expect(fs.existsSync(composeBin)).toBe(true);
+  }, 100000);
+
+  // prettier-ignore
+  test.each([
+    // following versions are already cached to htc from previous test cases
+    ['v2.31.0'],
+    ['v2.32.4'],
+  ])(
+  'acquires %p of compose with cache', async (version) => {
+    const install = new Install({standalone: false});
+    const toolPath = await install.download(version);
+    expect(fs.existsSync(toolPath)).toBe(true);
+  }, 100000);
+
+  // prettier-ignore
+  test.each([
+    ['v2.27.1'],
+    ['v2.28.0'],
+  ])(
+  'acquires %p of compose without cache', async (version) => {
+    const install = new Install({standalone: false});
+    const toolPath = await install.download(version, true);
+    expect(fs.existsSync(toolPath)).toBe(true);
+  }, 100000);
+
+  // TODO: add tests for arm
+  // prettier-ignore
+  test.each([
+    ['win32', 'x64'],
+    ['win32', 'arm64'],
+    ['darwin', 'x64'],
+    ['darwin', 'arm64'],
+    ['linux', 'x64'],
+    ['linux', 'arm64'],
+    ['linux', 'ppc64'],
+    ['linux', 's390x'],
+  ])(
+  'acquires compose for %s/%s', async (os, arch) => {
+    jest.spyOn(osm, 'platform').mockImplementation(() => os as NodeJS.Platform);
+    jest.spyOn(osm, 'arch').mockImplementation(() => arch);
+    const install = new Install();
+    const composeBin = await install.download('latest');
+    expect(fs.existsSync(composeBin)).toBe(true);
+  }, 100000);
+});
+
+describe('getDownloadVersion', () => {
+  it('returns official latest download version', async () => {
+    const version = await Install.getDownloadVersion('latest');
+    expect(version.key).toEqual('official');
+    expect(version.version).toEqual('latest');
+    expect(version.downloadURL).toEqual('https://github.com/docker/compose/releases/download/v%s/%s');
+    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/compose-releases.json');
+  });
+  it('returns official v2.24.3 download version', async () => {
+    const version = await Install.getDownloadVersion('v2.24.3');
+    expect(version.key).toEqual('official');
+    expect(version.version).toEqual('v2.24.3');
+    expect(version.downloadURL).toEqual('https://github.com/docker/compose/releases/download/v%s/%s');
+    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/compose-releases.json');
+  });
+  it('returns cloud latest download version', async () => {
+    const version = await Install.getDownloadVersion('cloud:latest');
+    expect(version.key).toEqual('cloud');
+    expect(version.version).toEqual('latest');
+    expect(version.downloadURL).toEqual('https://github.com/docker/compose-desktop/releases/download/v%s/%s');
+    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/compose-lab-releases.json');
+  });
+  it('returns cloud v2.27.1-desktop.1 download version', async () => {
+    const version = await Install.getDownloadVersion('cloud:v2.27.1-desktop.1');
+    expect(version.key).toEqual('cloud');
+    expect(version.version).toEqual('v2.27.1-desktop.1');
+    expect(version.downloadURL).toEqual('https://github.com/docker/compose-desktop/releases/download/v%s/%s');
+    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/compose-lab-releases.json');
+  });
+  it('unknown repo', async () => {
+    await expect(Install.getDownloadVersion('foo:bar')).rejects.toThrow(new Error('Cannot find compose version for foo:bar'));
+  });
+});
+
+describe('getRelease', () => {
+  it('returns latest official GitHub release', async () => {
+    const version = await Install.getDownloadVersion('latest');
+    const release = await Install.getRelease(version);
+    expect(release).not.toBeNull();
+    expect(release?.tag_name).not.toEqual('');
+  });
+  it('returns v2.24.3 official GitHub release', async () => {
+    const version = await Install.getDownloadVersion('v2.24.3');
+    const release = await Install.getRelease(version);
+    expect(release).not.toBeNull();
+    expect(release?.id).toEqual(138380726);
+    expect(release?.tag_name).toEqual('v2.24.3');
+    expect(release?.html_url).toEqual('https://github.com/docker/compose/releases/tag/v2.24.3');
+  });
+  it('returns v2.27.1-desktop.1 cloud GitHub release', async () => {
+    const version = await Install.getDownloadVersion('cloud:v2.27.1-desktop.1');
+    const release = await Install.getRelease(version);
+    expect(release).not.toBeNull();
+    expect(release?.id).toEqual(157591108);
+    expect(release?.tag_name).toEqual('v2.27.1-desktop.1');
+    expect(release?.html_url).toEqual('https://github.com/docker/compose-desktop/releases/tag/v2.27.1-desktop.1');
+  });
+  it('unknown release', async () => {
+    const version = await Install.getDownloadVersion('foo');
+    await expect(Install.getRelease(version)).rejects.toThrow(new Error('Cannot find Compose release foo in https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/compose-releases.json'));
+  });
+});
--- a/tests/context.test.ts
+++ b/tests/context.test.ts
@@ -14,7 +14,7 @@
 * limitations under the License.
 */

-import {describe, expect, jest, it, afterEach} from '@jest/globals';
+import {describe, expect, jest, it, afterEach, beforeEach, test} from '@jest/globals';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
@@ -44,6 +44,34 @@ describe('gitRef', () => {
  });
 });

+describe('parseGitRef', () => {
+  const originalEnv = process.env;
+  beforeEach(() => {
+    jest.resetModules();
+    process.env = {
+      ...originalEnv,
+      DOCKER_GIT_CONTEXT_PR_HEAD_REF: ''
+    };
+  });
+  afterEach(() => {
+    process.env = originalEnv;
+  });
+  // prettier-ignore
+  test.each([
+    ['refs/heads/master', '860c1904a1ce19322e91ac35af1ab07466440c37', false, '860c1904a1ce19322e91ac35af1ab07466440c37'],
+    ['master', '860c1904a1ce19322e91ac35af1ab07466440c37', false, '860c1904a1ce19322e91ac35af1ab07466440c37'],
+    ['refs/pull/15/merge', '860c1904a1ce19322e91ac35af1ab07466440c37', false, 'refs/pull/15/merge'],
+    ['refs/heads/master', '', false, 'refs/heads/master'],
+    ['master', '', false, 'master'],
+    ['refs/tags/v1.0.0', '', false, 'refs/tags/v1.0.0'],
+    ['refs/pull/15/merge', '', false, 'refs/pull/15/merge'],
+    ['refs/pull/15/merge', '', true, 'refs/pull/15/head'],
+  ])('given %p and %p, should return %p', async (ref: string, sha: string, prHeadRef: boolean, expected: string) => {
+    process.env.DOCKER_DEFAULT_GIT_CONTEXT_PR_HEAD_REF = prHeadRef ? 'true' : '';
+    expect(Context.parseGitRef(ref, sha)).toEqual(expected);
+  });
+});
+
 describe('gitContext', () => {
  it('returns refs/heads/master', async () => {
    expect(Context.gitContext()).toEqual('https://github.com/docker/actions-toolkit.git#refs/heads/master');
--- a/tests/docker/install.test.itg.ts
+++ b/tests/docker/install.test.itg.ts
@@ -14,57 +14,172 @@
 * limitations under the License.
 */

-import {jest, describe, expect, test, beforeEach, afterEach} from '@jest/globals';
+import {beforeAll, describe, test, expect} from '@jest/globals';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';

-import {Install} from '../../src/docker/install';
+import {Install, InstallSource, InstallSourceArchive, InstallSourceImage} from '../../src/docker/install';
 import {Docker} from '../../src/docker/docker';
+import {Regctl} from '../../src/regclient/regctl';
+import {Install as RegclientInstall} from '../../src/regclient/install';
+import {Undock} from '../../src/undock/undock';
+import {Install as UndockInstall} from '../../src/undock/install';
 import {Exec} from '../../src/exec';

-const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'docker-install-itg-'));
+const tmpDir = () => fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'docker-install-itg-'));

-describe('install', () => {
-  const originalEnv = process.env;
-  beforeEach(() => {
-    jest.resetModules();
-    process.env = {
-      ...originalEnv,
-      LIMA_START_ARGS: '--cpus 4 --memory 8',
-      LIMA_IMAGES: `x86_64:https://cloud.debian.org/images/cloud/bookworm/20231013-1532/debian-12-genericcloud-amd64-20231013-1532.qcow2@sha512:6b55e88b027c14da1b55c85a25a9f7069d4560a8fdb2d948c986a585db469728a06d2c528303e34bb62d8b2984def38fd9ddfc00965846ff6e05b01d6e883bfe
-aarch64:https://cloud.debian.org/images/cloud/bookworm/20231013-1532/debian-12-genericcloud-arm64-20231013-1532.qcow2`
-    };
-  });
-  afterEach(() => {
-    process.env = originalEnv;
-  });
+beforeAll(async () => {
+  const undockInstall = new UndockInstall();
+  const undockBinPath = await undockInstall.download('v0.10.0', true);
+  await undockInstall.install(undockBinPath);
+
+  const regclientInstall = new RegclientInstall();
+  const regclientBinPath = await regclientInstall.download('v0.8.2', true);
+  await regclientInstall.install(regclientBinPath);
+}, 100000);
+
+describe('root', () => {
  // prettier-ignore
-  test.each(['v26.1.4'])(
-    'install docker %s', async (version) => {
-      if (process.env.ImageOS && process.env.ImageOS.startsWith('ubuntu')) {
-        // Remove containerd first on ubuntu runners to make sure it takes
-        // ones packaged with docker
-        await Exec.exec('sudo', ['apt-get', 'remove', '-y', 'containerd.io'], {
-          env: Object.assign({}, process.env, {
-            DEBIAN_FRONTEND: 'noninteractive'
-          }) as {
-            [key: string]: string;
-          }
-        });
-      }
-      await expect((async () => {
-        const install = new Install({
-          version: version,
-          runDir: tmpDir,
-          contextName: 'foo',
-          daemonConfig: `{"debug":true,"features":{"containerd-snapshotter":true}}`
-        });
-        await install.download();
-        await install.install();
-        await Docker.printVersion();
-        await Docker.printInfo();
-        await install.tearDown();
-      })()).resolves.not.toThrow();
-    }, 1200000);
+  test.each(getSources(true))(
+    'install docker %s', async (source) => {
+      await ensureNoSystemContainerd();
+      const install = new Install({
+        source: source,
+        runDir: tmpDir(),
+        contextName: 'foo',
+        daemonConfig: `{"debug":true,"features":{"containerd-snapshotter":true}}`,
+        regctl: new Regctl(),
+        undock: new Undock()
+      });
+      await expect(tryInstall(install)).resolves.not.toThrow();
+    }, 30 * 60 * 1000);
 });
+
+describe('rootless', () => {
+  // prettier-ignore
+  test.each(getSources(false))(
+    'install %s', async (source) => {
+      // Skip on non linux
+      if (os.platform() !== 'linux') {
+        return;
+      }
+      await ensureNoSystemContainerd();
+      const install = new Install({
+        source: source,
+        runDir: tmpDir(),
+        contextName: 'foo',
+        daemonConfig: `{"debug":true}`,
+        rootless: true,
+        regctl: new Regctl(),
+        undock: new Undock()
+      });
+      await expect(
+        tryInstall(install, async () => {
+          const out = await Docker.getExecOutput(['info', '-f', '{{json .SecurityOptions}}']);
+          expect(out.exitCode).toBe(0);
+          expect(out.stderr.trim()).toBe('');
+          expect(out.stdout.trim()).toContain('rootless');
+        })
+      ).resolves.not.toThrow();
+    },
+    30 * 60 * 1000
+  );
+});
+
+describe('tcp', () => {
+  // prettier-ignore
+  test.each(getSources(false))(
+    'install %s', async (source) => {
+      await ensureNoSystemContainerd();
+      const install = new Install({
+        source: source,
+        runDir: tmpDir(),
+        contextName: 'foo',
+        daemonConfig: `{"debug":true}`,
+        localTCPPort: 2378,
+        regctl: new Regctl(),
+        undock: new Undock()
+      });
+      await expect(
+        tryInstall(install, async () => {
+          const out = await Docker.getExecOutput(['info'], {
+            env: Object.assign({}, process.env, {
+              DOCKER_HOST: 'tcp://localhost:2378',
+              DOCKER_CONTENT_TRUST: 'false'
+            }) as {
+              [key: string]: string;
+            }
+          });
+          expect(out.exitCode).toBe(0);
+        })
+      ).resolves.not.toThrow();
+    },
+    30 * 60 * 1000
+  );
+});
+
+async function tryInstall(install: Install, extraCheck?: () => Promise<void>): Promise<void> {
+  try {
+    await install.download();
+    await install.install();
+    await Docker.printVersion();
+    await Docker.printInfo();
+    if (extraCheck) {
+      await extraCheck();
+    }
+  } catch (error) {
+    console.error(error);
+    throw error;
+  } finally {
+    await install.tearDown();
+  }
+}
+
+async function ensureNoSystemContainerd() {
+  if (process.env.ImageOS && process.env.ImageOS.startsWith('ubuntu')) {
+    // Remove containerd first on ubuntu runners to make sure it takes
+    // ones packaged with docker
+    await Exec.exec('sudo', ['apt-get', 'remove', '-y', 'containerd.io'], {
+      env: Object.assign({}, process.env, {
+        DEBIAN_FRONTEND: 'noninteractive'
+      }) as {
+        [key: string]: string;
+      }
+    });
+  }
+}
+
+function getSources(root: boolean): Array<InstallSource> {
+  const dockerInstallType = process.env.DOCKER_INSTALL_TYPE;
+  const dockerInstallVersion = process.env.DOCKER_INSTALL_VERSION;
+  if (dockerInstallType && dockerInstallVersion) {
+    if (dockerInstallType === 'archive') {
+      // prettier-ignore
+      return [
+        { type: dockerInstallType, version: dockerInstallVersion, channel: 'stable'} as InstallSourceArchive
+      ];
+    } else {
+      // prettier-ignore
+      return [
+        { type: dockerInstallType, tag: dockerInstallVersion} as InstallSourceImage
+      ];
+    }
+  }
+  if (root) {
+    // prettier-ignore
+    return [
+      {type: 'image', tag: '27.3.1'} as InstallSourceImage,
+      {type: 'image', tag: 'master'} as InstallSourceImage,
+      {type: 'image', tag: 'latest'} as InstallSourceImage,
+      {type: 'archive', version: 'v26.1.4', channel: 'stable'} as InstallSourceArchive,
+      {type: 'archive', version: 'latest', channel: 'stable'} as InstallSourceArchive
+    ];
+  } else {
+    // prettier-ignore
+    return [
+      {type: 'image', tag: 'latest'} as InstallSourceImage,
+      {type: 'archive', version: 'latest', channel: 'stable'} as InstallSourceArchive
+    ];
+  }
+}
--- a/tests/docker/install.test.ts
+++ b/tests/docker/install.test.ts
@@ -21,7 +21,9 @@ import path from 'path';
 import * as rimraf from 'rimraf';
 import osm = require('os');

-import {Install} from '../../src/docker/install';
+import {Install, InstallSourceArchive, InstallSourceImage} from '../../src/docker/install';
+import {Regctl} from '../../src/regclient/regctl';
+import {Undock} from '../../src/undock/undock';

 const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'docker-install-'));

@@ -29,19 +31,43 @@ afterEach(function () {
  rimraf.sync(tmpDir);
 });

+const archive = (version: string, channel: string): InstallSourceArchive => {
+  return {
+    type: 'archive',
+    version: version,
+    channel: channel
+  };
+};
+
+const image = (tag: string): InstallSourceImage => {
+  return {
+    type: 'image',
+    tag: tag
+  };
+};
+
 describe('download', () => {
  // prettier-ignore
  test.each([
-    ['v19.03.14', 'linux'],
-    ['v20.10.22', 'linux'],
-    ['v20.10.22', 'darwin'],
-    ['v20.10.22', 'win32'],
+    [archive('v19.03.14', 'stable'), 'linux'],
+    [archive('v20.10.22', 'stable'), 'linux'],
+    [archive('v20.10.22', 'stable'), 'darwin'],
+    [archive('v20.10.22', 'stable'), 'win32'],
+
+    [image('master'), 'linux'],
+    [image('master'), 'win32'],
+
+    [image('27.3.1'), 'linux'],
+    [image('27.3.1'), 'win32'],
  ])(
-  'acquires %p of docker (%s)', async (version, platformOS) => {
+  'acquires %p of docker (%s)', async (source, platformOS) => {
    jest.spyOn(osm, 'platform').mockImplementation(() => platformOS as NodeJS.Platform);
+    jest.spyOn(osm, 'arch').mockImplementation(() => 'x64');
    const install = new Install({
-      version: version,
+      source: source,
      runDir: tmpDir,
+      regctl: new Regctl(),
+      undock: new Undock()
    });
    const toolPath = await install.download();
    expect(fs.existsSync(toolPath)).toBe(true);
--- a/tests/git.test.ts
+++ b/tests/git.test.ts
@@ -279,3 +279,10 @@ describe('tag', () => {
    });
  });
 });
+
+describe('getCommitDate', () => {
+  it('head', async () => {
+    const date = await Git.commitDate('HEAD');
+    await expect(date).toBeInstanceOf(Date);
+  });
+});
--- a/tests/github.test.itg.ts
+++ b/tests/github.test.itg.ts
@@ -25,6 +25,7 @@ import {Build} from '../src/buildx/build';
 import {Exec} from '../src/exec';
 import {GitHub} from '../src/github';
 import {History} from '../src/buildx/history';
+import {Util} from '../src/util';

 const fixturesDir = path.join(__dirname, '.fixtures');
 const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'github-itg-'));
@@ -33,8 +34,10 @@ const maybe = !process.env.GITHUB_ACTIONS || (process.env.GITHUB_ACTIONS === 'tr

 maybe('uploadArtifact', () => {
  it('uploads an artifact', async () => {
+    const filename = path.join(tmpDir, `github-repo-${Util.generateRandomString()}.json`);
+    fs.copyFileSync(path.join(fixturesDir, `github-repo.json`), filename);
    const res = await GitHub.uploadArtifact({
-      filename: path.join(fixturesDir, 'github-repo.json'),
+      filename: filename,
      mimeType: 'application/json',
      retentionDays: 1
    });
--- a/tests/regclient/install.test.itg.ts
+++ b/tests/regclient/install.test.itg.ts
@@ -0,0 +1,38 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, test} from '@jest/globals';
+import * as fs from 'fs';
+
+import {Install} from '../../src/regclient/install';
+
+describe('download', () => {
+  // prettier-ignore
+  test.each(['latest'])(
+    'install regclient %s', async (version) => {
+      await expect((async () => {
+        const install = new Install();
+        const toolPath = await install.download(version);
+        if (!fs.existsSync(toolPath)) {
+          throw new Error('toolPath does not exist');
+        }
+        const binPath = await install.install(toolPath);
+        if (!fs.existsSync(binPath)) {
+          throw new Error('binPath does not exist');
+        }
+      })()).resolves.not.toThrow();
+    }, 60000);
+});
--- a/tests/regclient/install.test.ts
+++ b/tests/regclient/install.test.ts
@@ -0,0 +1,120 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, it, jest, test, afterEach} from '@jest/globals';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import * as rimraf from 'rimraf';
+import osm = require('os');
+
+import {Install} from '../../src/regclient/install';
+
+const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'regclient-install-'));
+
+afterEach(function () {
+  rimraf.sync(tmpDir);
+});
+
+describe('download', () => {
+  // prettier-ignore
+  test.each([
+    ['v0.8.2'],
+    ['latest']
+  ])(
+  'acquires %p of regclient', async (version) => {
+    const install = new Install();
+    const toolPath = await install.download(version);
+    expect(fs.existsSync(toolPath)).toBe(true);
+    const regclientBin = await install.install(toolPath, tmpDir);
+    expect(fs.existsSync(regclientBin)).toBe(true);
+  }, 100000);
+
+  // prettier-ignore
+  test.each([
+    // following versions are already cached to htc from previous test cases
+    ['v0.8.2'],
+  ])(
+  'acquires %p of regclient with cache', async (version) => {
+    const install = new Install();
+    const toolPath = await install.download(version);
+    expect(fs.existsSync(toolPath)).toBe(true);
+  }, 100000);
+
+  // prettier-ignore
+  test.each([
+    ['v0.8.1'],
+  ])(
+  'acquires %p of regclient without cache', async (version) => {
+    const install = new Install();
+    const toolPath = await install.download(version, true);
+    expect(fs.existsSync(toolPath)).toBe(true);
+  }, 100000);
+
+  // prettier-ignore
+  test.each([
+    ['win32', 'x64'],
+    ['darwin', 'x64'],
+    ['darwin', 'arm64'],
+    ['linux', 'x64'],
+    ['linux', 'arm64'],
+    ['linux', 'ppc64'],
+    ['linux', 's390x'],
+  ])(
+  'acquires regclient for %s/%s', async (os, arch) => {
+    jest.spyOn(osm, 'platform').mockImplementation(() => os as NodeJS.Platform);
+    jest.spyOn(osm, 'arch').mockImplementation(() => arch);
+    const install = new Install();
+    const regclientBin = await install.download('latest');
+    expect(fs.existsSync(regclientBin)).toBe(true);
+  }, 100000);
+});
+
+describe('getDownloadVersion', () => {
+  it('returns latest download version', async () => {
+    const version = await Install.getDownloadVersion('latest');
+    expect(version.version).toEqual('latest');
+    expect(version.downloadURL).toEqual('https://github.com/regclient/regclient/releases/download/v%s/%s');
+    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/regclient-releases.json');
+  });
+  it('returns v0.8.1 download version', async () => {
+    const version = await Install.getDownloadVersion('v0.8.1');
+    expect(version.version).toEqual('v0.8.1');
+    expect(version.downloadURL).toEqual('https://github.com/regclient/regclient/releases/download/v%s/%s');
+    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/regclient-releases.json');
+  });
+});
+
+describe('getRelease', () => {
+  it('returns latest GitHub release', async () => {
+    const version = await Install.getDownloadVersion('latest');
+    const release = await Install.getRelease(version);
+    expect(release).not.toBeNull();
+    expect(release?.tag_name).not.toEqual('');
+  });
+  it('returns v0.8.1 GitHub release', async () => {
+    const version = await Install.getDownloadVersion('v0.8.1');
+    const release = await Install.getRelease(version);
+    expect(release).not.toBeNull();
+    expect(release?.id).toEqual(199719231);
+    expect(release?.tag_name).toEqual('v0.8.1');
+    expect(release?.html_url).toEqual('https://github.com/regclient/regclient/releases/tag/v0.8.1');
+  });
+  it('unknown release', async () => {
+    const version = await Install.getDownloadVersion('foo');
+    await expect(Install.getRelease(version)).rejects.toThrow(new Error('Cannot find regclient release foo in https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/regclient-releases.json'));
+  });
+});
--- a/tests/regclient/regctl.test.ts
+++ b/tests/regclient/regctl.test.ts
@@ -0,0 +1,126 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, it, jest, test} from '@jest/globals';
+import * as semver from 'semver';
+
+import {Exec} from '../../src/exec';
+import {Regctl} from '../../src/regclient/regctl';
+
+import {Image} from '../../src/types/oci/config';
+
+describe('manifestGet', () => {
+  // prettier-ignore
+  test.each([
+    ['moby/moby-bin:28.1.0-rc.2'],
+    ['crazymax/diun:4.17.0'],
+  ])('given %p', async image => {
+    const regctl = new Regctl();
+    const manifest = await regctl.manifestGet({
+      image: image,
+    });
+    console.log(`${image} manifest: ${JSON.stringify(manifest, null, 2)}`);
+    expect(manifest).not.toBeNull();
+    expect(manifest?.config).toBeDefined();
+    expect(manifest?.config.digest).not.toEqual('');
+    expect(manifest?.layers).toBeDefined();
+    expect(manifest?.layers.length).toBeGreaterThan(0);
+  });
+});
+
+describe('blobGet', () => {
+  // prettier-ignore
+  test.each([
+    ['moby/moby-bin', 'sha256:234fccbd13fde0ba978a19f728cbdc67e29bc76247ac560822bb6ae5236c0bf0'],
+    ['crazymax/diun', 'sha256:1e4881f66e0ec0f1710b837002107050bbbc0a231d8a42d7f422b56a139900bb'],
+  ])('given %p', async (repo, digest) => {
+    const regctl = new Regctl();
+    const blob = await regctl.blobGet({
+      repository: repo,
+      digest: digest
+    });
+    expect(blob).toBeDefined();
+    console.log(`${repo}:@${digest} blob: ${JSON.stringify(JSON.parse(blob), null, 2)}`);
+  });
+});
+
+describe('image config', () => {
+  // prettier-ignore
+  test.each([
+    ['moby/moby-bin:28.1.0-rc.2'],
+    ['crazymax/diun:4.17.0'],
+  ])('given %p', async image => {
+    const regctl = new Regctl();
+    const manifest = await regctl.manifestGet({
+      image: image,
+    });
+    expect(manifest).not.toBeNull();
+    expect(manifest?.config).toBeDefined();
+    expect(manifest?.config.digest).not.toEqual('');
+    const blob = await regctl.blobGet({
+      repository: image, // image works as well
+      digest: manifest?.config.digest
+    });
+    const imageConfig = <Image>JSON.parse(blob);
+    console.log(`${image} config: ${JSON.stringify(imageConfig, null, 2)}`);
+    expect(imageConfig).not.toBeNull();
+    expect(imageConfig.config).toBeDefined();
+    expect(imageConfig?.config?.Labels).toBeDefined();
+    expect(Object.keys(imageConfig?.config?.Labels || {}).length).toBeGreaterThan(0);
+  });
+});
+
+describe('isAvailable', () => {
+  it('checks regctl is available', async () => {
+    const execSpy = jest.spyOn(Exec, 'getExecOutput');
+    const regctl = new Regctl();
+    await regctl.isAvailable();
+    // eslint-disable-next-line jest/no-standalone-expect
+    expect(execSpy).toHaveBeenCalledWith(`regctl`, [], {
+      silent: true,
+      ignoreReturnCode: true
+    });
+  });
+});
+
+describe('printVersion', () => {
+  it('prints regctl version', async () => {
+    const execSpy = jest.spyOn(Exec, 'exec');
+    const regctl = new Regctl();
+    await regctl.printVersion();
+    expect(execSpy).toHaveBeenCalledWith(`regctl`, ['version'], {
+      failOnStdErr: false
+    });
+  });
+});
+
+describe('version', () => {
+  it('valid', async () => {
+    const regctl = new Regctl();
+    expect(semver.valid(await regctl.version())).not.toBeUndefined();
+  });
+});
+
+describe('versionSatisfies', () => {
+  test.each([
+    ['v0.8.2', '>=0.6.0', true],
+    ['v0.8.0', '>0.6.0', true],
+    ['v0.8.0', '<0.3.0', false]
+  ])('given %p', async (version, range, expected) => {
+    const regctl = new Regctl();
+    expect(await regctl.versionSatisfies(range, version)).toBe(expected);
+  });
+});
--- a/tests/undock/install.test.itg.ts
+++ b/tests/undock/install.test.itg.ts
@@ -0,0 +1,38 @@
+/**
+ * Copyright 2024 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, test} from '@jest/globals';
+import * as fs from 'fs';
+
+import {Install} from '../../src/undock/install';
+
+describe('download', () => {
+  // prettier-ignore
+  test.each(['latest'])(
+    'install undock %s', async (version) => {
+      await expect((async () => {
+        const install = new Install();
+        const toolPath = await install.download(version);
+        if (!fs.existsSync(toolPath)) {
+          throw new Error('toolPath does not exist');
+        }
+        const binPath = await install.install(toolPath);
+        if (!fs.existsSync(binPath)) {
+          throw new Error('binPath does not exist');
+        }
+      })()).resolves.not.toThrow();
+    }, 60000);
+});
--- a/tests/undock/install.test.ts
+++ b/tests/undock/install.test.ts
@@ -0,0 +1,125 @@
+/**
+ * Copyright 2024 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, it, jest, test, afterEach} from '@jest/globals';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import * as rimraf from 'rimraf';
+import osm = require('os');
+
+import {Install} from '../../src/undock/install';
+
+const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'undock-install-'));
+
+afterEach(function () {
+  rimraf.sync(tmpDir);
+});
+
+describe('download', () => {
+  // prettier-ignore
+  test.each([
+    ['v0.4.0'],
+    ['v0.7.0'],
+    ['latest']
+  ])(
+  'acquires %p of undock', async (version) => {
+    const install = new Install();
+    const toolPath = await install.download(version);
+    expect(fs.existsSync(toolPath)).toBe(true);
+    const undockBin = await install.install(toolPath, tmpDir);
+    expect(fs.existsSync(undockBin)).toBe(true);
+  }, 100000);
+
+  // prettier-ignore
+  test.each([
+    // following versions are already cached to htc from previous test cases
+    ['v0.4.0'],
+    ['v0.7.0'],
+  ])(
+  'acquires %p of undock with cache', async (version) => {
+    const install = new Install();
+    const toolPath = await install.download(version);
+    expect(fs.existsSync(toolPath)).toBe(true);
+  }, 100000);
+
+  // prettier-ignore
+  test.each([
+    ['v0.5.0'],
+    ['v0.6.0'],
+  ])(
+  'acquires %p of undock without cache', async (version) => {
+    const install = new Install();
+    const toolPath = await install.download(version, true);
+    expect(fs.existsSync(toolPath)).toBe(true);
+  }, 100000);
+
+  // TODO: add tests for arm
+  // prettier-ignore
+  test.each([
+    ['win32', 'x64'],
+    ['win32', 'arm64'],
+    ['darwin', 'x64'],
+    ['darwin', 'arm64'],
+    ['linux', 'x64'],
+    ['linux', 'arm64'],
+    ['linux', 'ppc64'],
+    ['linux', 's390x'],
+  ])(
+  'acquires undock for %s/%s', async (os, arch) => {
+    jest.spyOn(osm, 'platform').mockImplementation(() => os as NodeJS.Platform);
+    jest.spyOn(osm, 'arch').mockImplementation(() => arch);
+    const install = new Install();
+    const undockBin = await install.download('latest');
+    expect(fs.existsSync(undockBin)).toBe(true);
+  }, 100000);
+});
+
+describe('getDownloadVersion', () => {
+  it('returns latest download version', async () => {
+    const version = await Install.getDownloadVersion('latest');
+    expect(version.version).toEqual('latest');
+    expect(version.downloadURL).toEqual('https://github.com/crazy-max/undock/releases/download/v%s/%s');
+    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/undock-releases.json');
+  });
+  it('returns v0.6.0 download version', async () => {
+    const version = await Install.getDownloadVersion('v0.6.0');
+    expect(version.version).toEqual('v0.6.0');
+    expect(version.downloadURL).toEqual('https://github.com/crazy-max/undock/releases/download/v%s/%s');
+    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/undock-releases.json');
+  });
+});
+
+describe('getRelease', () => {
+  it('returns latest GitHub release', async () => {
+    const version = await Install.getDownloadVersion('latest');
+    const release = await Install.getRelease(version);
+    expect(release).not.toBeNull();
+    expect(release?.tag_name).not.toEqual('');
+  });
+  it('returns v0.6.0 GitHub release', async () => {
+    const version = await Install.getDownloadVersion('v0.6.0');
+    const release = await Install.getRelease(version);
+    expect(release).not.toBeNull();
+    expect(release?.id).toEqual(121362767);
+    expect(release?.tag_name).toEqual('v0.6.0');
+    expect(release?.html_url).toEqual('https://github.com/crazy-max/undock/releases/tag/v0.6.0');
+  });
+  it('unknown release', async () => {
+    const version = await Install.getDownloadVersion('foo');
+    await expect(Install.getRelease(version)).rejects.toThrow(new Error('Cannot find Undock release foo in https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/undock-releases.json'));
+  });
+});
--- a/tests/undock/undock.test.itg.ts
+++ b/tests/undock/undock.test.itg.ts
@@ -0,0 +1,47 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, it} from '@jest/globals';
+import fs from 'fs';
+import os from 'os';
+
+import {Undock} from '../../src/undock/undock';
+import {Install as UndockInstall} from '../../src/undock/install';
+
+describe('run', () => {
+  it('extracts moby/moby-bin:26.1.5', async () => {
+    const install = new UndockInstall();
+    const toolPath = await install.download('latest');
+    if (!fs.existsSync(toolPath)) {
+      throw new Error('toolPath does not exist');
+    }
+    const binPath = await install.install(toolPath);
+    if (!fs.existsSync(binPath)) {
+      throw new Error('binPath does not exist');
+    }
+
+    const undock = new Undock();
+    await expect(
+      (async () => {
+        // prettier-ignore
+        await undock.run({
+          source: 'docker/buildx-bin:0.23.0',
+          dist: os.tmpdir()
+        });
+      })()
+    ).resolves.not.toThrow();
+  }, 100000);
+});
--- a/tests/undock/undock.test.ts
+++ b/tests/undock/undock.test.ts
@@ -0,0 +1,84 @@
+/**
+ * Copyright 2024 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import {describe, expect, it, jest, test} from '@jest/globals';
+import * as semver from 'semver';
+
+import {Exec} from '../../src/exec';
+import {Undock} from '../../src/undock/undock';
+
+const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'undock-undock-'));
+
+describe('run', () => {
+  it('extracts moby/moby-bin:26.1.5', async () => {
+    const undock = new Undock();
+    await expect(
+      (async () => {
+        // prettier-ignore
+        await undock.run({
+          source: 'moby/moby-bin:26.1.5',
+          dist: tmpDir,
+          all: true
+        });
+      })()
+    ).resolves.not.toThrow();
+  }, 100000);
+});
+
+describe('isAvailable', () => {
+  it('checks undock is available', async () => {
+    const execSpy = jest.spyOn(Exec, 'getExecOutput');
+    const undock = new Undock();
+    await undock.isAvailable();
+    // eslint-disable-next-line jest/no-standalone-expect
+    expect(execSpy).toHaveBeenCalledWith(`undock`, [], {
+      silent: true,
+      ignoreReturnCode: true
+    });
+  });
+});
+
+describe('printVersion', () => {
+  it('prints undock version', async () => {
+    const execSpy = jest.spyOn(Exec, 'exec');
+    const undock = new Undock();
+    await undock.printVersion();
+    expect(execSpy).toHaveBeenCalledWith(`undock`, ['--version'], {
+      failOnStdErr: false
+    });
+  });
+});
+
+describe('version', () => {
+  it('valid', async () => {
+    const undock = new Undock();
+    expect(semver.valid(await undock.version())).not.toBeUndefined();
+  });
+});
+
+describe('versionSatisfies', () => {
+  test.each([
+    ['v0.4.1', '>=0.3.2', true],
+    ['v0.8.0', '>0.6.0', true],
+    ['v0.8.0', '<0.3.0', false]
+  ])('given %p', async (version, range, expected) => {
+    const undock = new Undock();
+    expect(await undock.versionSatisfies(range, version)).toBe(expected);
+  });
+});
--- a/tests/util.test.ts
+++ b/tests/util.test.ts
@@ -201,6 +201,31 @@ ccccccccc`,
  });
 });

+describe('getInputNumber', () => {
+  it('should return a number when input is a valid number string', () => {
+    setInput('foo', '42');
+    const result = Util.getInputNumber('foo');
+    expect(result).toBe(42);
+  });
+
+  it('should return undefined when input is an empty string', () => {
+    setInput('foo', '');
+    const result = Util.getInputNumber('foo');
+    expect(result).toBeUndefined();
+  });
+
+  it('should return undefined when input is not provided', () => {
+    const result = Util.getInputNumber('foo');
+    expect(result).toBeUndefined();
+  });
+
+  it('should return NaN when input is not a valid number', () => {
+    setInput('foo', 'invalid');
+    const result = Util.getInputNumber('foo');
+    expect(result).toBeNaN();
+  });
+});
+
 describe('asyncForEach', () => {
  it('executes async tasks sequentially', async () => {
    const testValues = [1, 2, 3, 4, 5];
@@ -444,6 +469,36 @@ describe('isPathRelativeTo', () => {
  });
 });

+describe('formatDuration', () => {
+  it('formats 0 nanoseconds as "0s"', () => {
+    expect(Util.formatDuration(0)).toBe('0s');
+  });
+  it('formats only seconds', () => {
+    expect(Util.formatDuration(5e9)).toBe('5s');
+    expect(Util.formatDuration(59e9)).toBe('59s');
+  });
+  it('formats minutes and seconds', () => {
+    expect(Util.formatDuration(65e9)).toBe('1m5s');
+    expect(Util.formatDuration(600e9)).toBe('10m');
+  });
+  it('formats hours, minutes, and seconds', () => {
+    expect(Util.formatDuration(3661e9)).toBe('1h1m1s');
+    expect(Util.formatDuration(7322e9)).toBe('2h2m2s');
+  });
+  it('formats hours only', () => {
+    expect(Util.formatDuration(3 * 3600e9)).toBe('3h');
+  });
+  it('formats hours and minutes', () => {
+    expect(Util.formatDuration(3900e9)).toBe('1h5m');
+  });
+  it('formats minutes only', () => {
+    expect(Util.formatDuration(120e9)).toBe('2m');
+  });
+  it('rounds down partial seconds', () => {
+    expect(Util.formatDuration(1799999999)).toBe('1s');
+  });
+});
+
 // See: https://github.com/actions/toolkit/blob/a1b068ec31a042ff1e10a522d8fdf0b8869d53ca/packages/core/src/core.ts#L89
 function getInputName(name: string): string {
  return `INPUT_${name.replace(/ /g, '_').toUpperCase()}`;
--- a/dev.Dockerfile
+++ b/dev.Dockerfile
@@ -16,7 +16,10 @@

 ARG NODE_VERSION=20
 ARG DOCKER_VERSION=27.2.1
-ARG BUILDX_VERSION=0.17.1
+ARG BUILDX_VERSION=0.24.0
+ARG COMPOSE_VERSION=2.32.4
+ARG UNDOCK_VERSION=0.10.0
+ARG REGCTL_VERSION=v0.8.2

 FROM node:${NODE_VERSION}-alpine AS base
 RUN apk add --no-cache cpio findutils git
@@ -73,8 +76,11 @@ RUN --mount=type=bind,target=.,rw \
  --mount=type=cache,target=/src/node_modules \
  yarn run lint

-FROM docker:${DOCKER_VERSION} as docker
-FROM docker/buildx-bin:${BUILDX_VERSION} as buildx
+FROM docker:${DOCKER_VERSION} AS docker
+FROM docker/buildx-bin:${BUILDX_VERSION} AS buildx
+FROM docker/compose-bin:v${COMPOSE_VERSION} AS compose
+FROM crazymax/undock:${UNDOCK_VERSION} AS undock
+FROM ghcr.io/regclient/regctl:${REGCTL_VERSION} AS regctl

 FROM deps AS test
 RUN --mount=type=bind,target=.,rw \
@@ -83,6 +89,10 @@ RUN --mount=type=bind,target=.,rw \
    --mount=type=bind,from=docker,source=/usr/local/bin/docker,target=/usr/bin/docker \
    --mount=type=bind,from=buildx,source=/buildx,target=/usr/libexec/docker/cli-plugins/docker-buildx \
    --mount=type=bind,from=buildx,source=/buildx,target=/usr/bin/buildx \
+    --mount=type=bind,from=compose,source=/docker-compose,target=/usr/libexec/docker/cli-plugins/docker-compose \
+    --mount=type=bind,from=compose,source=/docker-compose,target=/usr/bin/compose \
+    --mount=type=bind,from=undock,source=/usr/local/bin/undock,target=/usr/bin/undock \
+    --mount=type=bind,from=regctl,source=/regctl,target=/usr/bin/regctl \
    --mount=type=secret,id=GITHUB_TOKEN \
  GITHUB_TOKEN=$(cat /run/secrets/GITHUB_TOKEN) yarn run test:coverage --coverageDirectory=/tmp/coverage

--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -12,6 +12,10 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

+variable "NODE_VERSION" {
+  default = null
+}
+
 group "default" {
  targets = ["build"]
 }
@@ -21,40 +25,66 @@ group "pre-checkin" {
 }

 group "validate" {
-  targets = ["lint", "vendor-validate", "license-validate"]
+  targets = ["lint", "vendor-validate", "dockerfile-validate", "license-validate"]
+}
+
+target "_common" {
+  args = {
+    BUILDKIT_CONTEXT_KEEP_GIT_DIR = 1
+    NODE_VERSION = NODE_VERSION
+  }
 }

 target "build" {
+  inherits = ["_common"]
  dockerfile = "dev.Dockerfile"
  target = "build-update"
  output = ["."]
 }

 target "format" {
+  inherits = ["_common"]
  dockerfile = "dev.Dockerfile"
  target = "format-update"
  output = ["."]
 }

 target "lint" {
+  inherits = ["_common"]
  dockerfile = "dev.Dockerfile"
  target = "lint"
  output = ["type=cacheonly"]
 }

 target "vendor" {
+  inherits = ["_common"]
  dockerfile = "dev.Dockerfile"
  target = "vendor-update"
  output = ["."]
 }

 target "vendor-validate" {
+  inherits = ["_common"]
  dockerfile = "dev.Dockerfile"
  target = "vendor-validate"
  output = ["type=cacheonly"]
 }

+target "dockerfile-validate" {
+  matrix = {
+    dockerfile = [
+      "dev.Dockerfile",
+      "./hack/dockerfiles/license.Dockerfile"
+    ]
+  }
+  inherits = ["_common"]
+  name = "dockerfile-validate-${md5(dockerfile)}"
+  dockerfile = dockerfile
+  call = "check"
+}
+
 target "test" {
+  inherits = ["_common"]
  dockerfile = "dev.Dockerfile"
  target = "test"
  output = ["type=cacheonly"]
@@ -62,6 +92,7 @@ target "test" {
 }

 target "test-coverage" {
+  inherits = ["_common"]
  dockerfile = "dev.Dockerfile"
  target = "test-coverage"
  output = ["./coverage"]
@@ -75,6 +106,7 @@ variable "GITHUB_REF" {
 }

 target "publish" {
+  inherits = ["_common"]
  dockerfile = "dev.Dockerfile"
  args = {
    GITHUB_REF = GITHUB_REF
@@ -85,12 +117,14 @@ target "publish" {
 }

 target "license-validate" {
+  inherits = ["_common"]
  dockerfile = "./hack/dockerfiles/license.Dockerfile"
  target = "validate"
  output = ["type=cacheonly"]
 }

 target "license-update" {
+  inherits = ["_common"]
  dockerfile = "./hack/dockerfiles/license.Dockerfile"
  target = "update"
  output = ["."]
--- a/hack/dockerfiles/license.Dockerfile
+++ b/hack/dockerfiles/license.Dockerfile
@@ -14,23 +14,44 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

+ARG ADDLICENSE_VERSION="v1.1.1"
+ARG ALPINE_VERSION="3.21"
+ARG GO_VERSION="1.23"
+ARG XX_VERSION="1.6.1"
+
 ARG LICENSE_HOLDER="actions-toolkit authors"
 ARG LICENSE_TYPE="apache"
 ARG LICENSE_FILES=".*\(Dockerfile\|Makefile\|\.js\|\.ts\|\.hcl\|\.sh|\.ps1\)"
-ARG ADDLICENSE_VERSION="v1.0.0"

-FROM ghcr.io/google/addlicense:${ADDLICENSE_VERSION} AS addlicense
+FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx

-FROM alpine:3.17 AS base
-WORKDIR /src
+FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS base
 RUN apk add --no-cache cpio findutils git
+ENV CGO_ENABLED=0
+WORKDIR /src
+COPY --link --from=xx / /
+
+FROM base AS addlicense
+ARG ADDLICENSE_VERSION
+ARG TARGETPLATFORM
+RUN --mount=target=/root/.cache,type=cache \
+    --mount=type=cache,target=/go/pkg/mod <<EOT
+  set -ex
+  xx-go install "github.com/google/addlicense@${ADDLICENSE_VERSION}"
+  mkdir /out
+  if ! xx-info is-cross; then
+    mv /go/bin/addlicense /out
+  else
+    mv /go/bin/*/addlicense* /out
+  fi
+EOT

 FROM base AS set
 ARG LICENSE_HOLDER
 ARG LICENSE_TYPE
 ARG LICENSE_FILES
 RUN --mount=type=bind,target=.,rw \
-    --mount=from=addlicense,source=/app/addlicense,target=/usr/bin/addlicense \
+    --mount=from=addlicense,source=/out/addlicense,target=/usr/bin/addlicense \
    find . -regex "${LICENSE_FILES}" -not -path "./.yarn/*" -not -path "./node_modules/*" | xargs addlicense -c "$LICENSE_HOLDER" -l "$LICENSE_TYPE" && \
    mkdir /out && \
    find . -regex "${LICENSE_FILES}" -not -path "./.yarn/*" -not -path "./node_modules/*" | cpio -pdm /out
@@ -43,5 +64,5 @@ ARG LICENSE_HOLDER
 ARG LICENSE_TYPE
 ARG LICENSE_FILES
 RUN --mount=type=bind,target=. \
-    --mount=from=addlicense,source=/app/addlicense,target=/usr/bin/addlicense \
+    --mount=from=addlicense,source=/out/addlicense,target=/usr/bin/addlicense \
    find . -regex "${LICENSE_FILES}" -not -path "./.yarn/*" -not -path "./node_modules/*" | xargs addlicense -check -c "$LICENSE_HOLDER" -l "$LICENSE_TYPE"
--- a/jest.config.itg.ts
+++ b/jest.config.itg.ts
@@ -14,20 +14,6 @@
 * limitations under the License.
 */

-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-
-const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'docker-actions-toolkit-'));
-
-process.env = Object.assign({}, process.env, {
-  TEMP: tmpDir,
-  RUNNER_TEMP: path.join(tmpDir, 'runner-temp'),
-  RUNNER_TOOL_CACHE: path.join(tmpDir, 'runner-tool-cache')
-}) as {
-  [key: string]: string;
-};
-
 module.exports = {
  testEnvironment: 'node',
  moduleFileExtensions: ['js', 'ts'],
--- a/package.json
+++ b/package.json
@@ -45,25 +45,25 @@
    "registry": "https://registry.npmjs.org/"
  },
  "dependencies": {
-    "@actions/artifact": "^2.1.9",
-    "@actions/cache": "^3.2.4",
-    "@actions/core": "^1.10.1",
+    "@actions/artifact": "^2.3.2",
+    "@actions/cache": "^4.0.3",
+    "@actions/core": "^1.11.1",
    "@actions/exec": "^1.1.1",
-    "@actions/github": "^6.0.0",
+    "@actions/github": "^6.0.1",
    "@actions/http-client": "^2.2.3",
    "@actions/io": "^1.1.3",
-    "@actions/tool-cache": "^2.0.1",
+    "@actions/tool-cache": "^2.0.2",
    "@azure/storage-blob": "^12.15.0",
    "@octokit/core": "^5.1.0",
    "@octokit/plugin-rest-endpoint-methods": "^10.4.0",
    "async-retry": "^1.3.3",
-    "csv-parse": "^5.5.6",
+    "csv-parse": "^5.6.0",
    "gunzip-maybe": "^1.4.2",
    "handlebars": "^4.7.8",
    "he": "^1.2.0",
    "js-yaml": "^4.1.0",
    "jwt-decode": "^4.0.0",
-    "semver": "^7.6.3",
+    "semver": "^7.7.2",
    "tar-stream": "^3.1.7",
    "tmp": "^0.2.3"
  },
@@ -73,7 +73,7 @@
    "@types/he": "^1.2.3",
    "@types/js-yaml": "^4.0.9",
    "@types/node": "^20.12.10",
-    "@types/semver": "^7.5.8",
+    "@types/semver": "^7.7.0",
    "@types/tar-stream": "^3.1.3",
    "@types/tmp": "^0.2.6",
    "@typescript-eslint/eslint-plugin": "^7.8.0",
--- a/src/buildx/bake.ts
+++ b/src/buildx/bake.ts
@@ -16,15 +16,15 @@

 import fs from 'fs';
 import path from 'path';
+import {parse} from 'csv-parse/sync';

-import {Build} from './build';
 import {Buildx} from './buildx';
 import {Context} from '../context';
 import {Exec} from '../exec';
 import {Util} from '../util';

 import {ExecOptions} from '@actions/exec';
-import {BakeDefinition} from '../types/buildx/bake';
+import {AttestEntry, BakeDefinition, CacheEntry, ExportEntry, SecretEntry, SSHEntry} from '../types/buildx/bake';
 import {BuildMetadata} from '../types/buildx/build';
 import {VertexWarning} from '../types/buildkit/client';

@@ -33,6 +33,8 @@ export interface BakeOpts {
 }

 export interface BakeCmdOpts {
+  allow?: Array<string>;
+  call?: string;
  files?: Array<string>;
  load?: boolean;
  noCache?: boolean;
@@ -142,6 +144,14 @@ export class Bake {
        args.push('--set', override);
      }
    }
+    if (cmdOpts.allow) {
+      for (const allow of cmdOpts.allow) {
+        args.push('--allow', allow);
+      }
+    }
+    if (cmdOpts.call) {
+      args.push('--call', cmdOpts.call);
+    }
    if (cmdOpts.load) {
      args.push('--load');
    }
@@ -168,29 +178,250 @@ export class Bake {
  }

  public static parseDefinition(dt: string): BakeDefinition {
-    return <BakeDefinition>JSON.parse(dt);
+    const definition = <BakeDefinition>JSON.parse(dt);
+
+    // convert to composable attributes: https://github.com/docker/buildx/pull/2758
+    for (const name in definition.target) {
+      const target = definition.target[name];
+      if (target['attest'] && Array.isArray(target['attest'])) {
+        target['attest'] = target['attest'].map((item: string | AttestEntry): AttestEntry => {
+          return Bake.parseAttestEntry(item);
+        });
+      }
+      if (target['cache-from'] && Array.isArray(target['cache-from'])) {
+        target['cache-from'] = target['cache-from'].map((item: string | CacheEntry): CacheEntry => {
+          return Bake.parseCacheEntry(item);
+        });
+      }
+      if (target['cache-to'] && Array.isArray(target['cache-to'])) {
+        target['cache-to'] = target['cache-to'].map((item: string | CacheEntry): CacheEntry => {
+          return Bake.parseCacheEntry(item);
+        });
+      }
+      if (target['output'] && Array.isArray(target['output'])) {
+        target['output'] = target['output'].map((item: string | ExportEntry): ExportEntry => {
+          return Bake.parseExportEntry(item);
+        });
+      }
+      if (target['secret'] && Array.isArray(target['secret'])) {
+        target['secret'] = target['secret'].map((item: string | SecretEntry): SecretEntry => {
+          return Bake.parseSecretEntry(item);
+        });
+      }
+      if (target['ssh'] && Array.isArray(target['ssh'])) {
+        target['ssh'] = target['ssh'].map((item: string | SSHEntry): SSHEntry => {
+          return Bake.parseSSHEntry(item);
+        });
+      }
+    }
+
+    return definition;
+  }
+
+  private static parseAttestEntry(item: AttestEntry | string): AttestEntry {
+    if (typeof item !== 'string') {
+      return item;
+    }
+
+    const attestEntry: AttestEntry = {type: ''};
+    const fields = parse(item, {
+      relaxColumnCount: true,
+      skipEmptyLines: true
+    })[0];
+
+    for (const field of fields) {
+      const [key, value] = field
+        .toString()
+        .split(/(?<=^[^=]+?)=/)
+        .map((item: string) => item.trim());
+      switch (key) {
+        case 'type':
+          attestEntry.type = value;
+          break;
+        case 'disabled':
+          attestEntry.disabled = Util.parseBool(value);
+          break;
+        default:
+          attestEntry[key] = value;
+      }
+    }
+
+    return attestEntry;
+  }
+
+  private static parseCacheEntry(item: CacheEntry | string): CacheEntry {
+    if (typeof item !== 'string') {
+      return item;
+    }
+
+    const cacheEntry: CacheEntry = {type: ''};
+    const fields = parse(item, {
+      relaxColumnCount: true,
+      skipEmptyLines: true
+    })[0];
+
+    if (fields.length === 1 && !fields[0].includes('=')) {
+      cacheEntry.type = 'registry';
+      cacheEntry.ref = fields[0];
+      return cacheEntry;
+    }
+
+    for (const field of fields) {
+      const [key, value] = field
+        .toString()
+        .split(/(?<=^[^=]+?)=/)
+        .map((item: string) => item.trim());
+      switch (key) {
+        case 'type':
+          cacheEntry.type = value;
+          break;
+        default:
+          cacheEntry[key] = value;
+      }
+    }
+
+    return cacheEntry;
+  }
+
+  private static parseExportEntry(item: ExportEntry | string): ExportEntry {
+    if (typeof item !== 'string') {
+      return item;
+    }
+
+    const exportEntry: ExportEntry = {type: ''};
+    const fields = parse(item, {
+      relaxColumnCount: true,
+      skipEmptyLines: true
+    })[0];
+
+    if (fields.length === 1 && fields[0] === item && !item.startsWith('type=')) {
+      if (item !== '-') {
+        exportEntry.type = 'local';
+        exportEntry.dest = item;
+        return exportEntry;
+      }
+      exportEntry.type = 'tar';
+      exportEntry.dest = item;
+      return exportEntry;
+    }
+
+    for (const field of fields) {
+      const [key, value] = field
+        .toString()
+        .split(/(?<=^[^=]+?)=/)
+        .map((item: string) => item.trim());
+      switch (key) {
+        case 'type':
+          exportEntry.type = value;
+          break;
+        default:
+          exportEntry[key] = value;
+      }
+    }
+
+    return exportEntry;
+  }
+
+  private static parseSecretEntry(item: SecretEntry | string): SecretEntry {
+    if (typeof item !== 'string') {
+      return item;
+    }
+
+    const secretEntry: SecretEntry = {};
+    const fields = parse(item, {
+      relaxColumnCount: true,
+      skipEmptyLines: true
+    })[0];
+
+    let typ = '';
+    for (const field of fields) {
+      const [key, value] = field
+        .toString()
+        .split(/(?<=^[^=]+?)=/)
+        .map((item: string) => item.trim());
+      switch (key) {
+        case 'type':
+          typ = value;
+          break;
+        case 'id':
+          secretEntry.id = value;
+          break;
+        case 'source':
+        case 'src':
+          secretEntry.src = value;
+          break;
+        case 'env':
+          secretEntry.env = value;
+          break;
+      }
+    }
+    if (typ === 'env' && !secretEntry.env) {
+      secretEntry.env = secretEntry.src;
+      secretEntry.src = undefined;
+    }
+    return secretEntry;
+  }
+
+  private static parseSSHEntry(item: SSHEntry | string): SSHEntry {
+    if (typeof item !== 'string') {
+      return item;
+    }
+
+    const sshEntry: SSHEntry = {};
+    const [key, value] = item.split('=', 2);
+    sshEntry.id = key;
+    if (value) {
+      sshEntry.paths = value.split(',');
+    }
+
+    return sshEntry;
  }

  public static hasLocalExporter(def: BakeDefinition): boolean {
-    return Build.hasExporterType('local', Bake.exporters(def));
+    return Bake.hasExporterType('local', Bake.exporters(def));
  }

  public static hasTarExporter(def: BakeDefinition): boolean {
-    return Build.hasExporterType('tar', Bake.exporters(def));
+    return Bake.hasExporterType('tar', Bake.exporters(def));
  }

  public static hasDockerExporter(def: BakeDefinition, load?: boolean): boolean {
-    return load || Build.hasExporterType('docker', Bake.exporters(def));
+    return load || Bake.hasExporterType('docker', Bake.exporters(def));
  }

-  private static exporters(def: BakeDefinition): Array<string> {
-    const exporters = new Array<string>();
+  public static hasExporterType(name: string, exporters: Array<ExportEntry>): boolean {
+    for (const exporter of exporters) {
+      if (exporter.type == name) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  private static exporters(def: BakeDefinition): Array<ExportEntry> {
+    const exporters = new Array<ExportEntry>();
    for (const key in def.target) {
      const target = def.target[key];
      if (target.output) {
-        exporters.push(...target.output);
+        for (const output of target.output) {
+          exporters.push(Bake.parseExportEntry(output));
+        }
      }
    }
    return exporters;
  }
+
+  public static hasGitAuthTokenSecret(def: BakeDefinition): boolean {
+    for (const key in def.target) {
+      const target = def.target[key];
+      if (target.secret) {
+        for (const secret of target.secret) {
+          if (Bake.parseSecretEntry(secret).id === 'GIT_AUTH_TOKEN') {
+            return true;
+          }
+        }
+      }
+    }
+    return false;
+  }
 }
--- a/src/buildx/build.ts
+++ b/src/buildx/build.ts
@@ -32,6 +32,11 @@ export interface BuildOpts {
  buildx?: Buildx;
 }

+export interface ResolveSecretsOpts {
+  asFile?: boolean;
+  redact?: boolean;
+}
+
 export class Build {
  private readonly buildx: Buildx;
  private readonly iidFilename: string;
@@ -124,12 +129,16 @@ export class Build {
  }

  public static resolveSecretString(kvp: string): string {
-    const [key, file] = Build.resolveSecret(kvp, false);
+    const [key, file] = Build.resolveSecret(kvp, {
+      redact: true
+    });
    return `id=${key},src=${file}`;
  }

  public static resolveSecretFile(kvp: string): string {
-    const [key, file] = Build.resolveSecret(kvp, true);
+    const [key, file] = Build.resolveSecret(kvp, {
+      asFile: true
+    });
    return `id=${key},src=${file}`;
  }

@@ -138,17 +147,17 @@ export class Build {
    return `id=${key},env=${value}`;
  }

-  public static resolveSecret(kvp: string, file: boolean): [string, string] {
-    const [key, _value] = Build.parseSecretKvp(kvp);
-    let value = _value;
-    if (file) {
+  public static resolveSecret(kvp: string, opts?: ResolveSecretsOpts): [string, string] {
+    const [key, value] = Build.parseSecretKvp(kvp, opts?.redact);
+    const secretFile = Context.tmpName({tmpdir: Context.tmpDir()});
+    if (opts?.asFile) {
      if (!fs.existsSync(value)) {
        throw new Error(`secret file ${value} not found`);
      }
-      value = fs.readFileSync(value, {encoding: 'utf-8'});
+      fs.copyFileSync(value, secretFile);
+    } else {
+      fs.writeFileSync(secretFile, value);
    }
-    const secretFile = Context.tmpName({tmpdir: Context.tmpDir()});
-    fs.writeFileSync(secretFile, value);
    return [key, secretFile];
  }

@@ -310,13 +319,16 @@ export class Build {
    return false;
  }

-  private static parseSecretKvp(kvp: string): [string, string] {
+  public static parseSecretKvp(kvp: string, redact?: boolean): [string, string] {
    const delimiterIndex = kvp.indexOf('=');
    const key = kvp.substring(0, delimiterIndex);
    const value = kvp.substring(delimiterIndex + 1);
    if (key.length == 0 || value.length == 0) {
      throw new Error(`${kvp} is not a valid secret`);
    }
+    if (redact) {
+      core.setSecret(value);
+    }
    return [key, value];
  }
 }
--- a/src/buildx/builder.ts
+++ b/src/buildx/builder.ts
@@ -19,7 +19,7 @@ import * as core from '@actions/core';
 import {Buildx} from './buildx';
 import {Exec} from '../exec';

-import {BuilderInfo, GCPolicy, NodeInfo} from '../types/buildx/builder';
+import {BuilderInfo, Device, GCPolicy, NodeInfo} from '../types/buildx/builder';

 export interface BuilderOpts {
  buildx?: Buildx;
@@ -89,6 +89,8 @@ export class Builder {
    let parsingType: string | undefined;
    let currentNode: NodeInfo = {};
    let currentGCPolicy: GCPolicy | undefined;
+    let currentDevice: Device | undefined;
+    let currentFile: string | undefined;
    for (const line of data.trim().split(`\n`)) {
      const [key, ...rest] = line.split(':');
      const lkey = key.toLowerCase();
@@ -171,6 +173,10 @@ export class Builder {
          parsingType = 'label';
          currentNode.labels = {};
          break;
+        case lkey == 'devices':
+          parsingType = 'devices';
+          currentNode.devices = currentNode.devices || [];
+          break;
        case lkey.startsWith('gc policy rule#'):
          parsingType = 'gcpolicy';
          if (currentNode.gcPolicy && currentGCPolicy) {
@@ -178,7 +184,17 @@ export class Builder {
            currentGCPolicy = undefined;
          }
          break;
+        case lkey.startsWith('file#'):
+          parsingType = 'file';
+          currentFile = key.split('#')[1];
+          currentNode.files = currentNode.files || {};
+          currentNode.files[currentFile] = '';
+          break;
        default: {
+          if (parsingType && parsingType !== 'devices' && currentNode.devices && currentDevice) {
+            currentNode.devices.push(currentDevice);
+            currentDevice = undefined;
+          }
          switch (parsingType || '') {
            case 'features': {
              currentNode.features = currentNode.features || {};
@@ -190,6 +206,42 @@ export class Builder {
              currentNode.labels[key.trim()] = value;
              break;
            }
+            case 'devices': {
+              switch (lkey.trim()) {
+                case 'name': {
+                  if (currentNode.devices && currentDevice) {
+                    currentNode.devices.push(currentDevice);
+                  }
+                  currentDevice = {};
+                  currentDevice.name = value;
+                  break;
+                }
+                case 'on-demand': {
+                  if (currentDevice && value) {
+                    currentDevice.onDemand = value == 'true';
+                  }
+                  break;
+                }
+                case 'automatically allowed': {
+                  if (currentDevice && value) {
+                    currentDevice.autoAllow = value == 'true';
+                  }
+                  break;
+                }
+                case 'annotations': {
+                  if (currentDevice) {
+                    currentDevice.annotations = currentDevice.annotations || {};
+                  }
+                  break;
+                }
+                default: {
+                  if (currentDevice && currentDevice.annotations) {
+                    currentDevice.annotations[key.trim()] = value;
+                  }
+                }
+              }
+              break;
+            }
            case 'gcpolicy': {
              currentNode.gcPolicy = currentNode.gcPolicy || [];
              currentGCPolicy = currentGCPolicy || {};
@@ -212,6 +264,27 @@ export class Builder {
                  currentGCPolicy.keepBytes = value;
                  break;
                }
+                case 'reserved space': {
+                  currentGCPolicy.reservedSpace = value;
+                  break;
+                }
+                case 'max used space': {
+                  currentGCPolicy.maxUsedSpace = value;
+                  break;
+                }
+                case 'min free space': {
+                  currentGCPolicy.minFreeSpace = value;
+                  break;
+                }
+              }
+              break;
+            }
+            case 'file': {
+              if (currentFile && currentNode.files) {
+                if (currentNode.files[currentFile].length > 0) {
+                  currentNode.files[currentFile] += '\n';
+                }
+                currentNode.files[currentFile] += line.replace(/^\s>\s?/, '');
              }
              break;
            }
@@ -219,6 +292,9 @@ export class Builder {
        }
      }
    }
+    if (currentDevice && currentNode.devices) {
+      currentNode.devices.push(currentDevice);
+    }
    if (currentGCPolicy && currentNode.gcPolicy) {
      currentNode.gcPolicy.push(currentGCPolicy);
    }
--- a/src/buildx/history.ts
+++ b/src/buildx/history.ts
@@ -26,8 +26,9 @@ import {Context} from '../context';
 import {Docker} from '../docker/docker';
 import {Exec} from '../exec';
 import {GitHub} from '../github';
+import {Util} from '../util';

-import {ExportRecordOpts, ExportRecordResponse, Summaries} from '../types/buildx/history';
+import {ExportOpts, ExportResponse, InspectOpts, InspectResponse, Summaries} from '../types/buildx/history';

 export interface HistoryOpts {
  buildx?: Buildx;
@@ -36,27 +37,43 @@ export interface HistoryOpts {
 export class History {
  private readonly buildx: Buildx;

-  private static readonly EXPORT_BUILD_IMAGE_DEFAULT: string = 'docker.io/dockereng/export-build:latest';
-  private static readonly EXPORT_BUILD_IMAGE_ENV: string = 'DOCKER_BUILD_EXPORT_BUILD_IMAGE';
-
  constructor(opts?: HistoryOpts) {
    this.buildx = opts?.buildx || new Buildx();
  }

-  public async export(opts: ExportRecordOpts): Promise<ExportRecordResponse> {
-    if (os.platform() === 'win32') {
-      throw new Error('Exporting a build record is currently not supported on Windows');
-    }
-    if (!(await Docker.isAvailable())) {
-      throw new Error('Docker is required to export a build record');
-    }
-    if (!(await Docker.isDaemonRunning())) {
-      throw new Error('Docker daemon needs to be running to export a build record');
-    }
-    if (!(await this.buildx.versionSatisfies('>=0.13.0'))) {
-      throw new Error('Buildx >= 0.13.0 is required to export a build record');
-    }
+  public async getCommand(args: Array<string>) {
+    return await this.buildx.getCommand(['history', ...args]);
+  }

+  public async getInspectCommand(args: Array<string>) {
+    return await this.getCommand(['inspect', ...args]);
+  }
+
+  public async getExportCommand(args: Array<string>) {
+    return await this.getCommand(['export', ...args]);
+  }
+
+  public async inspect(opts: InspectOpts): Promise<InspectResponse> {
+    const args: Array<string> = ['--format', 'json'];
+    if (opts.builder) {
+      args.push('--builder', opts.builder);
+    }
+    if (opts.ref) {
+      args.push(opts.ref);
+    }
+    const cmd = await this.getInspectCommand(args);
+    return await Exec.getExecOutput(cmd.command, cmd.args, {
+      ignoreReturnCode: true,
+      silent: true
+    }).then(res => {
+      if (res.stderr.length > 0 && res.exitCode != 0) {
+        throw new Error(res.stderr.trim());
+      }
+      return <InspectResponse>JSON.parse(res.stdout);
+    });
+  }
+
+  public async export(opts: ExportOpts): Promise<ExportResponse> {
    let builderName: string = '';
    let nodeName: string = '';
    const refs: Array<string> = [];
@@ -84,8 +101,83 @@ export class History {
    core.info(`exporting build record to ${outDir}`);
    fs.mkdirSync(outDir, {recursive: true});

+    if (opts.useContainer || (await this.buildx.versionSatisfies('<0.23.0'))) {
+      return await this.exportLegacy(builderName, nodeName, refs, outDir, opts.image);
+    }
+
+    if (await this.buildx.versionSatisfies('<0.24.0')) {
+      // wait 3 seconds to ensure build records are finalized: https://github.com/moby/buildkit/pull/5109
+      // not necessary since buildx 0.24.0: https://github.com/docker/buildx/pull/3152
+      await Util.sleep(3);
+    }
+
+    const summaries: Summaries = {};
+    if (!opts.noSummaries) {
+      for (const ref of refs) {
+        await this.inspect({
+          ref: ref,
+          builder: builderName
+        }).then(res => {
+          let errorLogs = '';
+          if (res.Error && res.Status !== 'canceled') {
+            if (res.Error.Message) {
+              errorLogs = res.Error.Message;
+            } else if (res.Error.Name && res.Error.Logs) {
+              errorLogs = `=> ${res.Error.Name}\n${res.Error.Logs}`;
+            }
+          }
+          summaries[ref] = {
+            name: res.Name,
+            status: res.Status,
+            duration: Util.formatDuration(res.Duration),
+            numCachedSteps: res.NumCachedSteps,
+            numTotalSteps: res.NumTotalSteps,
+            numCompletedSteps: res.NumCompletedSteps,
+            defaultPlatform: res.Platform?.[0],
+            error: errorLogs
+          };
+        });
+      }
+    }
+
+    const dockerbuildPath = path.join(outDir, `${History.exportFilename(refs)}.dockerbuild`);
+
+    const exportArgs = ['--builder', builderName, '--output', dockerbuildPath, ...refs];
+    if (await this.buildx.versionSatisfies('>=0.24.0')) {
+      exportArgs.push('--finalize');
+    }
+
+    const cmd = await this.getExportCommand(exportArgs);
+    await Exec.getExecOutput(cmd.command, cmd.args);
+
+    const dockerbuildStats = fs.statSync(dockerbuildPath);
+
+    return {
+      dockerbuildFilename: dockerbuildPath,
+      dockerbuildSize: dockerbuildStats.size,
+      builderName: builderName,
+      nodeName: nodeName,
+      refs: refs,
+      summaries: summaries
+    };
+  }
+
+  private async exportLegacy(builderName: string, nodeName: string, refs: Array<string>, outDir: string, image?: string): Promise<ExportResponse> {
+    if (os.platform() === 'win32') {
+      throw new Error('Exporting a build record is currently not supported on Windows');
+    }
+    if (!(await Docker.isAvailable())) {
+      throw new Error('Docker is required to export a build record');
+    }
+    if (!(await Docker.isDaemonRunning())) {
+      throw new Error('Docker daemon needs to be running to export a build record');
+    }
+    if (!(await this.buildx.versionSatisfies('>=0.13.0'))) {
+      throw new Error('Buildx >= 0.13.0 is required to export a build record');
+    }
+
    // wait 3 seconds to ensure build records are finalized: https://github.com/moby/buildkit/pull/5109
-    await new Promise(resolve => setTimeout(resolve, 3000));
+    await Util.sleep(3);

    const buildxInFifoPath = Context.tmpName({
      template: 'buildx-in-XXXXXX.fifo',
@@ -138,7 +230,7 @@ export class History {
        'run', '--rm', '-i',
        '-v', `${Buildx.refsDir}:/buildx-refs`,
        '-v', `${outDir}:/out`,
-        opts.image || process.env[History.EXPORT_BUILD_IMAGE_ENV] || History.EXPORT_BUILD_IMAGE_DEFAULT,
+        image || process.env['DOCKER_BUILD_EXPORT_BUILD_IMAGE'] || 'docker.io/dockereng/export-build:latest',
        ...ebargs
      ]
      core.info(`[command]docker ${dockerRunArgs.join(' ')}`);
@@ -189,12 +281,7 @@ export class History {
        }
      });

-    let dockerbuildFilename = `${GitHub.context.repo.owner}~${GitHub.context.repo.repo}~${refs[0].substring(0, 6).toUpperCase()}`;
-    if (refs.length > 1) {
-      dockerbuildFilename += `+${refs.length - 1}`;
-    }
-
-    const dockerbuildPath = path.join(outDir, `${dockerbuildFilename}.dockerbuild`);
+    const dockerbuildPath = path.join(outDir, `${History.exportFilename(refs)}.dockerbuild`);
    fs.renameSync(tmpDockerbuildFilename, dockerbuildPath);
    const dockerbuildStats = fs.statSync(dockerbuildPath);

@@ -205,10 +292,18 @@ export class History {
    return {
      dockerbuildFilename: dockerbuildPath,
      dockerbuildSize: dockerbuildStats.size,
-      summaries: summaries,
      builderName: builderName,
      nodeName: nodeName,
-      refs: refs
+      refs: refs,
+      summaries: summaries
    };
  }
+
+  private static exportFilename(refs: Array<string>): string {
+    let name = `${GitHub.context.repo.owner}~${GitHub.context.repo.repo}~${refs[0].substring(0, 6).toUpperCase()}`;
+    if (refs.length > 1) {
+      name += `+${refs.length - 1}`;
+    }
+    return name;
+  }
 }
--- a/src/buildx/imagetools.ts
+++ b/src/buildx/imagetools.ts
@@ -0,0 +1,61 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {Buildx} from './buildx';
+import {Exec} from '../exec';
+
+import {Image} from '../types/oci/config';
+
+export interface ImageToolsOpts {
+  buildx?: Buildx;
+}
+
+export class ImageTools {
+  private readonly buildx: Buildx;
+
+  constructor(opts?: ImageToolsOpts) {
+    this.buildx = opts?.buildx || new Buildx();
+  }
+
+  public async getCommand(args: Array<string>) {
+    return await this.buildx.getCommand(['imagetools', ...args]);
+  }
+
+  public async getInspectCommand(args: Array<string>) {
+    return await this.getCommand(['inspect', ...args]);
+  }
+
+  public async inspectImage(name: string): Promise<Record<string, Image> | Image> {
+    const cmd = await this.getInspectCommand([name, '--format', '{{json .Image}}']);
+    return await Exec.getExecOutput(cmd.command, cmd.args, {
+      ignoreReturnCode: true,
+      silent: true
+    }).then(res => {
+      if (res.stderr.length > 0 && res.exitCode != 0) {
+        throw new Error(res.stderr.trim());
+      }
+      const parsedOutput = JSON.parse(res.stdout);
+      if (typeof parsedOutput === 'object' && !Array.isArray(parsedOutput) && parsedOutput !== null) {
+        if (Object.prototype.hasOwnProperty.call(parsedOutput, 'config')) {
+          return <Image>parsedOutput;
+        } else {
+          return <Record<string, Image>>parsedOutput;
+        }
+      }
+      throw new Error('Unexpected output format');
+    });
+  }
+}
--- a/src/buildx/install.ts
+++ b/src/buildx/install.ts
@@ -276,6 +276,9 @@ export class Install {
      version = repoKey;
      repoKey = 'official';
    }
+    if (repoKey === 'lab') {
+      repoKey = 'cloud';
+    }
    switch (repoKey) {
      case 'official': {
        return {
@@ -285,7 +288,7 @@ export class Install {
          releasesURL: 'https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/buildx-releases.json'
        };
      }
-      case 'lab': {
+      case 'cloud': {
        return {
          key: repoKey,
          version: version,
--- a/src/cache.ts
+++ b/src/cache.ts
@@ -55,7 +55,7 @@ export class Cache {
    }
  }

-  public async save(file: string): Promise<string> {
+  public async save(file: string, skipState?: boolean): Promise<string> {
    core.debug(`Cache.save ${file}`);
    const cachePath = this.copyToCache(file);

@@ -63,14 +63,19 @@ export class Cache {
    core.debug(`Cache.save cached to hosted tool cache ${htcPath}`);

    if (!this.ghaNoCache && cache.isFeatureAvailable()) {
-      core.debug(`Cache.save sending ${this.ghaCacheKey} to post state`);
-      core.saveState(
-        Cache.POST_CACHE_KEY,
-        JSON.stringify({
-          dir: this.cacheDir,
-          key: this.ghaCacheKey
-        } as CachePostState)
-      );
+      if (skipState) {
+        core.debug(`Cache.save caching ${this.ghaCacheKey} to GitHub Actions cache`);
+        await cache.saveCache([this.cacheDir], this.ghaCacheKey);
+      } else {
+        core.debug(`Cache.save sending ${this.ghaCacheKey} to post state`);
+        core.saveState(
+          Cache.POST_CACHE_KEY,
+          JSON.stringify({
+            dir: this.cacheDir,
+            key: this.ghaCacheKey
+          } as CachePostState)
+        );
+      }
    }

    return cachePath;
--- a/src/compose/compose.ts
+++ b/src/compose/compose.ts
@@ -0,0 +1,106 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import * as core from '@actions/core';
+
+import {Docker} from '../docker/docker';
+import {Exec} from '../exec';
+
+export interface ComposeOpts {
+  standalone?: boolean;
+}
+
+export class Compose {
+  private _version: string;
+  private _versionOnce: boolean;
+  private readonly _standalone: boolean | undefined;
+
+  constructor(opts?: ComposeOpts) {
+    this._standalone = opts?.standalone;
+    this._version = '';
+    this._versionOnce = false;
+  }
+
+  public async isStandalone(): Promise<boolean> {
+    const standalone = this._standalone ?? !(await Docker.isAvailable());
+    core.debug(`Compose.isStandalone: ${standalone}`);
+    return standalone;
+  }
+
+  public async getCommand(args: Array<string>) {
+    const standalone = await this.isStandalone();
+    return {
+      command: standalone ? 'compose' : 'docker',
+      args: standalone ? args : ['compose', ...args]
+    };
+  }
+
+  public async isAvailable(): Promise<boolean> {
+    const cmd = await this.getCommand([]);
+
+    const ok: boolean = await Exec.getExecOutput(cmd.command, cmd.args, {
+      ignoreReturnCode: true,
+      silent: true
+    })
+      .then(res => {
+        if (res.stderr.length > 0 && res.exitCode != 0) {
+          core.debug(`Compose.isAvailable cmd err: ${res.stderr.trim()}`);
+          return false;
+        }
+        return res.exitCode == 0;
+      })
+      .catch(error => {
+        core.debug(`Compose.isAvailable error: ${error}`);
+        return false;
+      });
+
+    core.debug(`Compose.isAvailable: ${ok}`);
+    return ok;
+  }
+
+  public async version(): Promise<string> {
+    if (this._versionOnce) {
+      return this._version;
+    }
+    this._versionOnce = true;
+    const cmd = await this.getCommand(['version']);
+    this._version = await Exec.getExecOutput(cmd.command, cmd.args, {
+      ignoreReturnCode: true,
+      silent: true
+    }).then(res => {
+      if (res.stderr.length > 0 && res.exitCode != 0) {
+        throw new Error(res.stderr.trim());
+      }
+      return Compose.parseVersion(res.stdout.trim());
+    });
+    return this._version;
+  }
+
+  public async printVersion() {
+    const cmd = await this.getCommand(['version']);
+    await Exec.exec(cmd.command, cmd.args, {
+      failOnStdErr: false
+    });
+  }
+
+  public static parseVersion(stdout: string): string {
+    const matches = /\sv?([0-9a-f]{7}|[0-9.]+)/.exec(stdout);
+    if (!matches) {
+      throw new Error(`Cannot parse compose version`);
+    }
+    return matches[1];
+  }
+}
--- a/src/compose/install.ts
+++ b/src/compose/install.ts
@@ -0,0 +1,217 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import * as core from '@actions/core';
+import * as httpm from '@actions/http-client';
+import * as tc from '@actions/tool-cache';
+import * as semver from 'semver';
+import * as util from 'util';
+
+import {Cache} from '../cache';
+import {Context} from '../context';
+
+import {DownloadVersion} from '../types/compose/compose';
+import {GitHubRelease} from '../types/github';
+import {Docker} from '../docker/docker';
+
+export interface InstallOpts {
+  standalone?: boolean;
+}
+
+export class Install {
+  private readonly _standalone: boolean | undefined;
+
+  constructor(opts?: InstallOpts) {
+    this._standalone = opts?.standalone;
+  }
+
+  /*
+   * Download compose binary from GitHub release
+   * @param v: version semver version or latest
+   * @param ghaNoCache: disable binary caching in GitHub Actions cache backend
+   * @returns path to the compose binary
+   */
+  public async download(v: string, ghaNoCache?: boolean): Promise<string> {
+    const version: DownloadVersion = await Install.getDownloadVersion(v);
+    core.debug(`Install.download version: ${version.version}`);
+
+    const release: GitHubRelease = await Install.getRelease(version);
+    core.debug(`Install.download release tag name: ${release.tag_name}`);
+
+    const vspec = await this.vspec(release.tag_name);
+    core.debug(`Install.download vspec: ${vspec}`);
+
+    const c = semver.clean(vspec) || '';
+    if (!semver.valid(c)) {
+      throw new Error(`Invalid Compose version "${vspec}".`);
+    }
+
+    const installCache = new Cache({
+      htcName: version.key != 'official' ? `compose-dl-bin-${version.key}` : 'compose-dl-bin',
+      htcVersion: vspec,
+      baseCacheDir: path.join(os.homedir(), '.bin', 'docker-compose'),
+      cacheFile: os.platform() == 'win32' ? 'docker-compose.exe' : 'docker-compose',
+      ghaNoCache: ghaNoCache
+    });
+
+    const cacheFoundPath = await installCache.find();
+    if (cacheFoundPath) {
+      core.info(`Compose binary found in ${cacheFoundPath}`);
+      return cacheFoundPath;
+    }
+
+    const downloadURL = util.format(version.downloadURL, vspec, this.filename());
+    core.info(`Downloading ${downloadURL}`);
+
+    const htcDownloadPath = await tc.downloadTool(downloadURL);
+    core.debug(`Install.download htcDownloadPath: ${htcDownloadPath}`);
+
+    const cacheSavePath = await installCache.save(htcDownloadPath);
+    core.info(`Cached to ${cacheSavePath}`);
+    return cacheSavePath;
+  }
+
+  public async installStandalone(binPath: string, dest?: string): Promise<string> {
+    core.info('Standalone mode');
+    dest = dest || Context.tmpDir();
+
+    const binDir = path.join(dest, 'compose-bin-standalone');
+    if (!fs.existsSync(binDir)) {
+      fs.mkdirSync(binDir, {recursive: true});
+    }
+    const binName: string = os.platform() == 'win32' ? 'compose.exe' : 'compose';
+    const composePath: string = path.join(binDir, binName);
+    fs.copyFileSync(binPath, composePath);
+
+    core.info('Fixing perms');
+    fs.chmodSync(composePath, '0755');
+
+    core.addPath(binDir);
+    core.info('Added Compose to PATH');
+
+    core.info(`Binary path: ${composePath}`);
+    return composePath;
+  }
+
+  public async installPlugin(binPath: string, dest?: string): Promise<string> {
+    core.info('Docker plugin mode');
+    dest = dest || Docker.configDir;
+
+    const pluginsDir: string = path.join(dest, 'cli-plugins');
+    if (!fs.existsSync(pluginsDir)) {
+      fs.mkdirSync(pluginsDir, {recursive: true});
+    }
+    const binName: string = os.platform() == 'win32' ? 'docker-compose.exe' : 'docker-compose';
+    const pluginPath: string = path.join(pluginsDir, binName);
+    fs.copyFileSync(binPath, pluginPath);
+
+    core.info('Fixing perms');
+    fs.chmodSync(pluginPath, '0755');
+
+    core.info(`Plugin path: ${pluginPath}`);
+    return pluginPath;
+  }
+
+  private async isStandalone(): Promise<boolean> {
+    const standalone = this._standalone ?? !(await Docker.isAvailable());
+    core.debug(`Install.isStandalone: ${standalone}`);
+    return standalone;
+  }
+
+  private filename(): string {
+    let arch: string;
+    switch (os.arch()) {
+      case 'x64': {
+        arch = 'x86_64';
+        break;
+      }
+      case 'ppc64': {
+        arch = 'ppc64le';
+        break;
+      }
+      case 'arm': {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const arm_version = (process.config.variables as any).arm_version;
+        arch = arm_version ? 'armv' + arm_version : 'arm';
+        break;
+      }
+      case 'arm64': {
+        arch = 'aarch64';
+        break;
+      }
+      default: {
+        arch = os.arch();
+        break;
+      }
+    }
+    const platform: string = os.platform() == 'win32' ? 'windows' : os.platform();
+    const ext: string = os.platform() == 'win32' ? '.exe' : '';
+    return util.format('docker-compose-%s-%s%s', platform, arch, ext);
+  }
+
+  private async vspec(version: string): Promise<string> {
+    const v = version.replace(/^v+|v+$/g, '');
+    core.info(`Use ${v} version spec cache key for ${version}`);
+    return v;
+  }
+
+  public static async getDownloadVersion(v: string): Promise<DownloadVersion> {
+    let [repoKey, version] = v.split(':');
+    if (!version) {
+      version = repoKey;
+      repoKey = 'official';
+    }
+    switch (repoKey) {
+      case 'official': {
+        return {
+          key: repoKey,
+          version: version,
+          downloadURL: 'https://github.com/docker/compose/releases/download/v%s/%s',
+          releasesURL: 'https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/compose-releases.json'
+        };
+      }
+      case 'cloud': {
+        return {
+          key: repoKey,
+          version: version,
+          downloadURL: 'https://github.com/docker/compose-desktop/releases/download/v%s/%s',
+          releasesURL: 'https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/compose-lab-releases.json'
+        };
+      }
+      default: {
+        throw new Error(`Cannot find compose version for ${v}`);
+      }
+    }
+  }
+
+  public static async getRelease(version: DownloadVersion): Promise<GitHubRelease> {
+    const http: httpm.HttpClient = new httpm.HttpClient('docker-actions-toolkit');
+    const resp: httpm.HttpClientResponse = await http.get(version.releasesURL);
+    const body = await resp.readBody();
+    const statusCode = resp.message.statusCode || 500;
+    if (statusCode >= 400) {
+      throw new Error(`Failed to get Compose releases from ${version.releasesURL} with status code ${statusCode}: ${body}`);
+    }
+    const releases = <Record<string, GitHubRelease>>JSON.parse(body);
+    if (!releases[version.version]) {
+      throw new Error(`Cannot find Compose release ${version.version} in ${version.releasesURL}`);
+    }
+    return releases[version.version];
+  }
+}
--- a/src/context.ts
+++ b/src/context.ts
@@ -39,23 +39,23 @@ export class Context {
  }

  public static gitRef(): string {
-    let gitRef = github.context.ref;
-    if (github.context.sha && gitRef && !gitRef.startsWith('refs/')) {
-      gitRef = `refs/heads/${github.context.ref}`;
+    return Context.parseGitRef(github.context.ref, github.context.sha);
+  }
+
+  public static parseGitRef(ref: string, sha: string): string {
+    const setPullRequestHeadRef: boolean = !!(process.env.DOCKER_DEFAULT_GIT_CONTEXT_PR_HEAD_REF && process.env.DOCKER_DEFAULT_GIT_CONTEXT_PR_HEAD_REF === 'true');
+    if (sha && ref && !ref.startsWith('refs/')) {
+      ref = `refs/heads/${ref}`;
    }
-    if (github.context.sha && !gitRef.startsWith(`refs/pull/`)) {
-      gitRef = github.context.sha;
-    } else if (gitRef.startsWith(`refs/pull/`)) {
-      gitRef = gitRef.replace(/\/merge$/g, '/head');
+    if (sha && !ref.startsWith(`refs/pull/`)) {
+      ref = sha;
+    } else if (ref.startsWith(`refs/pull/`) && setPullRequestHeadRef) {
+      ref = ref.replace(/\/merge$/g, '/head');
    }
-    return gitRef;
+    return ref;
  }

  public static gitContext(): string {
    return `${GitHub.serverURL}/${github.context.repo.owner}/${github.context.repo.repo}.git#${Context.gitRef()}`;
  }
-
-  public static provenanceBuilderID(): string {
-    return `${GitHub.serverURL}/${github.context.repo.owner}/${github.context.repo.repo}/actions/runs/${github.context.runId}`;
-  }
 }
--- a/src/docker/assets.ts
+++ b/src/docker/assets.ts
@@ -51,7 +51,10 @@ param(
    [string]$RunDir,

    [Parameter(Mandatory = $true)]
-    [string]$DockerHost,
+    [string]$DockerHostSocket,
+
+    [Parameter(Mandatory = $false)]
+    [string]$DockerHostTCP,

    [Parameter(Mandatory = $false)]
    [string]$DaemonConfig)
@@ -82,7 +85,7 @@ if (Get-Service docker -ErrorAction SilentlyContinue) {
 $env:Path = "$ToolDir;" + [System.Environment]::GetEnvironmentVariable("Path","Machine") + ";" + [System.Environment]::GetEnvironmentVariable("Path","User")
 Write-Host "Path: $env:Path"

-$env:DOCKER_HOST = $DockerHost
+$env:DOCKER_HOST = $DockerHostSocket
 Write-Host "DOCKER_HOST: $env:DOCKER_HOST"

 if ($DaemonConfig) {
@@ -91,16 +94,21 @@ if ($DaemonConfig) {
  $DaemonConfig | Out-File -FilePath "$env:ProgramData\\Docker\\config\\daemon.json"
 }

+$arguments = @(
+  "--host=$DockerHostSocket",
+  "--data-root=$RunDir\\\\moby-root",
+  "--exec-root=$RunDir\\\\moby-exec",
+  "--pidfile=$RunDir\\\\docker.pid",
+  "--register-service"
+)
+if ($DockerHostTCP) {
+  $arguments += "--host=$DockerHostTCP"
+}
+
 Write-Host "Creating service"
 New-Item -ItemType Directory "$RunDir\\moby-root" -ErrorAction SilentlyContinue | Out-Null
 New-Item -ItemType Directory "$RunDir\\moby-exec" -ErrorAction SilentlyContinue | Out-Null
-Start-Process -Wait -NoNewWindow "$ToolDir\\dockerd" \`
-  -ArgumentList \`
-    "--host=$DockerHost", \`
-    "--data-root=$RunDir\\moby-root", \`
-    "--exec-root=$RunDir\\moby-exec", \`
-    "--pidfile=$RunDir\\docker.pid", \`
-    "--register-service"
+Start-Process -Wait -NoNewWindow "$ToolDir\\dockerd" -ArgumentList $arguments
 Write-Host "Starting service"
 Start-Service -Name docker
 Write-Host "Service started successfully!"
@@ -132,6 +140,8 @@ Get-WinEvent -ea SilentlyContinue \`
 `;

 export const limaYamlData = `
+# Source: https://github.com/lima-vm/lima/blob/master/templates/docker-rootful.yaml
+
 # VM type: "qemu" or "vz" (on macOS 13 and later).
 # The vmType can be specified only on creating the instance.
 # The vmType of existing instances cannot be changed.
@@ -152,12 +162,25 @@ images:
  arch: "{{arch}}"
  digest: "{{digest}}"
 {{/each}}
- location: "https://cloud-images.ubuntu.com/releases/22.04/release-20231026/ubuntu-22.04-server-cloudimg-amd64.img"
+- location: "https://cloud-images.ubuntu.com/releases/24.04/release-20250228/ubuntu-24.04-server-cloudimg-amd64.img"
  arch: "x86_64"
-  digest: "sha256:054db2d88c454bb0ad8dfd8883955e3946b57d2b0bf0d023f3ade3c93cdd14e5"
- location: "https://cloud-images.ubuntu.com/releases/22.04/release-20231026/ubuntu-22.04-server-cloudimg-arm64.img"
+  digest: "sha256:a3aea891c930ee0c762077b963834f5e083eb8102574f1e4dfc9e6e4c1c73ac0"
+  kernel:
+    location: "https://cloud-images.ubuntu.com/releases/24.04/release-20250228/unpacked/ubuntu-24.04-server-cloudimg-amd64-vmlinuz-generic"
+    digest: "sha256:2d9f30959f01675fd28aa1c2fe8934728e46766d04ecfad2d206823696a3f830"
+    cmdline: "root=LABEL=cloudimg-rootfs ro console=tty1 console=ttyAMA0 no_timer_check"
+  initrd:
+    location: "https://cloud-images.ubuntu.com/releases/24.04/release-20250228/unpacked/ubuntu-24.04-server-cloudimg-amd64-initrd-generic"
+    digest: "sha256:231352d027aeebf0bb7dca281dfebae894c86e789c7377788d3c2c149471caa3"
+- location: "https://cloud-images.ubuntu.com/releases/24.04/release-20250228/ubuntu-24.04-server-cloudimg-arm64.img"
+  arch: "aarch64"
+  digest: "sha256:278a0e8475008673d9d3da10ae66a7b1a3dda059746b83d749eca386a5670bd4"
+# Fallback to the latest release image.
+# Hint: run \`limactl prune\` to invalidate the cache
+- location: "https://cloud-images.ubuntu.com/releases/24.04/release/ubuntu-24.04-server-cloudimg-amd64.img"
+  arch: "x86_64"
+- location: "https://cloud-images.ubuntu.com/releases/24.04/release/ubuntu-24.04-server-cloudimg-arm64.img"
  arch: "aarch64"
-  digest: "sha256:eafa7742ce5ff109222ea313d31ea366d587b4e89b900b11d8285ae775dfe8c3"

 # CPUs
 # Builtin default: min(4, host CPU cores)
@@ -221,16 +244,52 @@ provision:
    EOF
    fi
    export DEBIAN_FRONTEND=noninteractive
-    curl -fsSL https://get.docker.com | sh -s -- --channel {{dockerBinChannel}} --version {{dockerBinVersion}}
+    if [ "{{srcType}}" == "archive" ]; then
+      curl -fsSL https://get.docker.com | sh -s -- --channel {{srcArchiveChannel}} --version {{srcArchiveVersion}}
+      sed -i 's|^ExecStart=.*|ExecStart=/usr/bin/dockerd -H fd://{{#if localTCPPort}} -H tcp://0.0.0.0:2375{{/if}} --containerd=/run/containerd/containerd.sock|' /usr/lib/systemd/system/docker.service
+      systemctl daemon-reload
+      systemctl restart docker
+      systemctl status docker.socket || true
+      systemctl status docker.service || true
+    elif [ "{{srcType}}" == "image" ]; then
+      arch=$(uname -m)
+      case $arch in
+        x86_64) arch=amd64;;
+        aarch64) arch=arm64;;
+      esac
+      url="https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_$arch.tar.gz"
+
+      wget "$url" -O /tmp/undock.tar.gz
+      tar -C /usr/local/bin -xvf /tmp/undock.tar.gz
+      undock --version
+
+      HOME=/tmp undock moby/moby-bin:{{srcImageTag}} /usr/local/bin
+
+      wget https://raw.githubusercontent.com/moby/moby/{{gitCommit}}/contrib/init/systemd/docker.service \
+        -O /etc/systemd/system/docker.service
+      wget https://raw.githubusercontent.com/moby/moby/{{gitCommit}}/contrib/init/systemd/docker.socket \
+        -O /etc/systemd/system/docker.socket
+
+      sed -i 's|^ExecStart=.*|ExecStart=/usr/local/bin/dockerd -H fd://{{#if localTCPPort}} -H tcp://0.0.0.0:2375{{/if}}|' /etc/systemd/system/docker.service
+      sed -i 's|containerd.service||' /etc/systemd/system/docker.service
+      if ! getent group docker; then
+        groupadd --system docker
+      fi
+      systemctl daemon-reload
+      fail=0
+      if ! systemctl enable --now docker; then
+        fail=1
+      fi
+      systemctl status docker.socket || true
+      systemctl status docker.service || true
+      exit $fail
+    fi

 probes:
 - script: |
    #!/bin/bash
    set -eux -o pipefail
-    if ! timeout 30s bash -c "until command -v docker >/dev/null 2>&1; do sleep 3; done"; then
-      echo >&2 "docker is not installed yet"
-      exit 1
-    fi
+    # Don't check for docker CLI as it's not installed in the VM (only on the host)
    if ! timeout 30s bash -c "until pgrep dockerd; do sleep 3; done"; then
      echo >&2 "dockerd is not running"
      exit 1
@@ -246,6 +305,10 @@ hostResolver:
 portForwards:
 - guestSocket: "/var/run/docker.sock"
  hostSocket: "{{dockerSock}}"
+{{#if localTCPPort}}
+- guestPort: 2375
+  hostPort: {{localTCPPort}}
+{{/if}}

 audio:
  # EXPERIMENTAL
--- a/src/docker/install.ts
+++ b/src/docker/install.ts
@@ -21,7 +21,6 @@ import os from 'os';
 import path from 'path';
 import retry from 'async-retry';
 import * as handlebars from 'handlebars';
-import * as util from 'util';
 import * as core from '@actions/core';
 import * as httpm from '@actions/http-client';
 import * as io from '@actions/io';
@@ -29,17 +28,40 @@ import * as tc from '@actions/tool-cache';

 import {Context} from '../context';
 import {Docker} from './docker';
+import {Regctl} from '../regclient/regctl';
+import {Undock} from '../undock/undock';
 import {Exec} from '../exec';
 import {Util} from '../util';
 import {limaYamlData, dockerServiceLogsPs1, setupDockerWinPs1} from './assets';
+
 import {GitHubRelease} from '../types/github';
+import {Image} from '../types/oci/config';
+
+export interface InstallSourceImage {
+  type: 'image';
+  tag: string;
+}
+
+export interface InstallSourceArchive {
+  type: 'archive';
+  version: string;
+  channel: string;
+}
+
+export type InstallSource = InstallSourceImage | InstallSourceArchive;

 export interface InstallOpts {
-  version?: string;
-  channel?: string;
+  source?: InstallSource;
+
+  // ...
  runDir: string;
  contextName?: string;
  daemonConfig?: string;
+  rootless?: boolean;
+  localTCPPort?: number;
+
+  regctl?: Regctl;
+  undock?: Undock;
 }

 interface LimaImage {
@@ -50,21 +72,34 @@ interface LimaImage {

 export class Install {
  private readonly runDir: string;
-  private readonly version: string;
-  private readonly channel: string;
+  private readonly source: InstallSource;
  private readonly contextName: string;
  private readonly daemonConfig?: string;
+  private readonly rootless: boolean;
+  private readonly localTCPPort?: number;
+  private readonly regctl: Regctl;
+  private readonly undock: Undock;
+
  private _version: string | undefined;
  private _toolDir: string | undefined;

+  private gitCommit: string | undefined;
+
  private readonly limaInstanceName = 'docker-actions-toolkit';

  constructor(opts: InstallOpts) {
    this.runDir = opts.runDir;
-    this.version = opts.version || 'latest';
-    this.channel = opts.channel || 'stable';
+    this.source = opts.source || {
+      type: 'archive',
+      version: 'latest',
+      channel: 'stable'
+    };
    this.contextName = opts.contextName || 'setup-docker-action';
    this.daemonConfig = opts.daemonConfig;
+    this.rootless = opts.rootless || false;
+    this.localTCPPort = opts.localTCPPort;
+    this.regctl = opts.regctl || new Regctl();
+    this.undock = opts.undock || new Undock();
  }

  get toolDir(): string {
@@ -72,26 +107,37 @@ export class Install {
  }

  public async download(): Promise<string> {
-    const release: GitHubRelease = await Install.getRelease(this.version);
-    this._version = release.tag_name.replace(/^v+|v+$/g, '');
-    core.debug(`docker.Install.download version: ${this._version}`);
-
-    const downloadURL = this.downloadURL(this._version, this.channel);
-    core.info(`Downloading ${downloadURL}`);
-
-    const downloadPath = await tc.downloadTool(downloadURL);
-    core.debug(`docker.Install.download downloadPath: ${downloadPath}`);
-
    let extractFolder: string;
-    if (os.platform() == 'win32') {
-      extractFolder = await tc.extractZip(downloadPath);
-    } else {
-      extractFolder = await tc.extractTar(downloadPath);
+    let cacheKey: string;
+    const platform = os.platform();
+
+    switch (this.source.type) {
+      case 'image': {
+        this._version = this.source.tag;
+        cacheKey = `docker-image`;
+        extractFolder = await this.downloadSourceImage(platform);
+        break;
+      }
+      case 'archive': {
+        const version = this.source.version;
+        const channel = this.source.channel;
+        cacheKey = `docker-archive-${channel}`;
+        this._version = version;
+
+        core.info(`Downloading Docker ${version} from ${this.source.channel} at download.docker.com`);
+        extractFolder = await this.downloadSourceArchive('docker', this.source);
+        if (this.rootless) {
+          core.info(`Downloading Docker rootless extras ${version} from ${this.source.channel} at download.docker.com`);
+          const extrasFolder = await this.downloadSourceArchive('docker-rootless-extras', this.source);
+          fs.readdirSync(extrasFolder).forEach(file => {
+            const src = path.join(extrasFolder, file);
+            const dest = path.join(extractFolder, file);
+            fs.copyFileSync(src, dest);
+          });
+        }
+        break;
+      }
    }
-    if (Util.isDirectory(path.join(extractFolder, 'docker'))) {
-      extractFolder = path.join(extractFolder, 'docker');
-    }
-    core.debug(`docker.Install.download extractFolder: ${extractFolder}`);

    core.info('Fixing perms');
    fs.readdir(path.join(extractFolder), function (err, files) {
@@ -100,11 +146,13 @@ export class Install {
      }
      // eslint-disable-next-line @typescript-eslint/no-unused-vars
      files.forEach(function (file, index) {
-        fs.chmodSync(path.join(extractFolder, file), '0755');
+        if (!Util.isDirectory(path.join(extractFolder, file))) {
+          fs.chmodSync(path.join(extractFolder, file), '0755');
+        }
      });
    });

-    const tooldir = await tc.cacheDir(extractFolder, `docker-${this.channel}`, this._version.replace(/(0+)([1-9]+)/, '$2'));
+    const tooldir = await tc.cacheDir(extractFolder, cacheKey, this._version.replace(/(0+)([1-9]+)/, '$2'));
    core.addPath(tooldir);
    core.info('Added Docker to PATH');

@@ -112,6 +160,72 @@ export class Install {
    return tooldir;
  }

+  private async downloadSourceImage(platform: string): Promise<string> {
+    const dest = path.join(Context.tmpDir(), 'docker-install-image');
+    const cliImage = `dockereng/cli-bin:${this._version}`;
+    const engineImage = `moby/moby-bin:${this._version}`;
+
+    core.info(`Downloading Docker CLI from ${cliImage}`);
+    await this.undock.run({
+      source: cliImage,
+      dist: dest
+    });
+
+    if (['win32', 'linux'].includes(platform)) {
+      core.info(`Downloading Docker engine from ${engineImage}`);
+      await this.undock.run({
+        source: engineImage,
+        dist: dest
+      });
+    } else if (platform == 'darwin') {
+      // On macOS, the docker daemon binary will be downloaded inside the lima VM.
+      // However, we will get the exact git revision from the image config
+      // to get the matching systemd unit files. There's no macOS image for
+      // moby/moby-bin - a linux daemon is run inside lima.
+      try {
+        const engineImageConfig = await this.imageConfig(engineImage, 'linux/arm64');
+        core.debug(`docker.Install.downloadSourceImage engineImageConfig: ${JSON.stringify(engineImageConfig)}`);
+        this.gitCommit = engineImageConfig.config?.Labels?.['org.opencontainers.image.revision'];
+        if (!this.gitCommit) {
+          throw new Error(`No git revision can be determined from the image`);
+        }
+      } catch (e) {
+        core.warning(e);
+        this.gitCommit = 'master';
+      }
+
+      core.debug(`docker.Install.downloadSourceImage gitCommit: ${this.gitCommit}`);
+    } else {
+      core.warning(`Docker engine not supported on ${platform}, only the Docker cli will be available`);
+    }
+
+    return dest;
+  }
+
+  private async downloadSourceArchive(component: 'docker' | 'docker-rootless-extras', src: InstallSourceArchive): Promise<string> {
+    const release: GitHubRelease = await Install.getRelease(src.version);
+    this._version = release.tag_name.replace(/^v+|v+$/g, '');
+    core.debug(`docker.Install.downloadSourceArchive version: ${this._version}`);
+
+    const downloadURL = this.downloadURL(component, this._version, src.channel);
+    core.info(`Downloading ${downloadURL}`);
+
+    const downloadPath = await tc.downloadTool(downloadURL);
+    core.debug(`docker.Install.downloadSourceArchive downloadPath: ${downloadPath}`);
+
+    let extractFolder;
+    if (os.platform() == 'win32') {
+      extractFolder = await tc.extractZip(downloadPath, extractFolder);
+    } else {
+      extractFolder = await tc.extractTar(downloadPath, extractFolder);
+    }
+    if (Util.isDirectory(path.join(extractFolder, component))) {
+      extractFolder = path.join(extractFolder, component);
+    }
+    core.debug(`docker.Install.downloadSourceArchive extractFolder: ${extractFolder}`);
+    return extractFolder;
+  }
+
  public async install(): Promise<string> {
    if (!this.toolDir) {
      throw new Error('toolDir must be set. Run download first.');
@@ -119,7 +233,13 @@ export class Install {
    if (!this.runDir) {
      throw new Error('runDir must be set');
    }
-    switch (os.platform()) {
+
+    const platform = os.platform();
+    if (this.rootless && platform != 'linux') {
+      // TODO: Support on macOS (via lima)
+      throw new Error(`rootless is only supported on linux`);
+    }
+    switch (platform) {
      case 'darwin': {
        return await this.installDarwin();
      }
@@ -136,6 +256,10 @@ export class Install {
  }

  private async installDarwin(): Promise<string> {
+    if (this.source.type == 'image' && !this.gitCommit) {
+      throw new Error('gitCommit must be set. Run download first.');
+    }
+    const src = this.source;
    const limaDir = path.join(os.homedir(), '.lima', this.limaInstanceName);
    await io.mkdirP(limaDir);
    const dockerHost = `unix://${limaDir}/docker.sock`;
@@ -166,21 +290,31 @@ export class Install {
      handlebars.registerHelper('stringify', function (obj) {
        return new handlebars.SafeString(JSON.stringify(obj));
      });
+      const srcArchive = src as InstallSourceArchive;
      const limaCfg = handlebars.compile(limaYamlData)({
        customImages: Install.limaCustomImages(),
        daemonConfig: limaDaemonConfig,
        dockerSock: `${limaDir}/docker.sock`,
-        dockerBinVersion: this._version,
-        dockerBinChannel: this.channel
+        localTCPPort: this.localTCPPort,
+        gitCommit: this.gitCommit,
+        srcType: src.type,
+        srcArchiveVersion: this._version, // Use the resolved version (e.g. latest -> 27.4.0)
+        srcArchiveChannel: srcArchive.channel,
+        srcImageTag: (src as InstallSourceImage).tag
      });
      core.info(`Writing lima config to ${path.join(limaDir, 'lima.yaml')}`);
      fs.writeFileSync(path.join(limaDir, 'lima.yaml'), limaCfg);
      core.info(limaCfg);
    });

-    const qemuArch = await Install.qemuArch();
+    if (!(await Install.qemuInstalled())) {
+      await core.group('Installing QEMU', async () => {
+        await Exec.exec('brew', ['install', 'qemu'], {env: envs});
+      });
+    }
+    const qemuBin = await Install.qemuBin();
    await core.group('QEMU version', async () => {
-      await Exec.exec(`qemu-system-${qemuArch} --version`);
+      await Exec.exec(qemuBin, ['--version']);
    });

    // lima might already be started on the runner so env var added in download
@@ -255,21 +389,36 @@ export class Install {
    }

    const envs = Object.assign({}, process.env, {
-      PATH: `${this.toolDir}:${process.env.PATH}`
+      PATH: `${this.toolDir}:${process.env.PATH}`,
+      XDG_RUNTIME_DIR: (this.rootless && this.runDir) || undefined
    }) as {
      [key: string]: string;
    };

    await core.group('Start Docker daemon', async () => {
      const bashPath: string = await io.which('bash', true);
-      const cmd = `${this.toolDir}/dockerd --host="${dockerHost}" --config-file="${daemonConfigPath}" --exec-root="${this.runDir}/execroot" --data-root="${this.runDir}/data" --pidfile="${this.runDir}/docker.pid" --userland-proxy=false`;
+      let dockerPath = `${this.toolDir}/dockerd`;
+      if (this.rootless) {
+        dockerPath = `${this.toolDir}/dockerd-rootless.sh`;
+        if (fs.existsSync('/proc/sys/kernel/apparmor_restrict_unprivileged_userns')) {
+          await Exec.exec('sudo', ['sh', '-c', 'echo 0 > /proc/sys/kernel/apparmor_restrict_unprivileged_userns']);
+        }
+      }
+      let cmd = `${dockerPath} --host="${dockerHost}" --config-file="${daemonConfigPath}" --exec-root="${this.runDir}/execroot" --data-root="${this.runDir}/data" --pidfile="${this.runDir}/docker.pid"`;
+      if (this.localTCPPort) {
+        cmd += ` --host="tcp://127.0.0.1:${this.localTCPPort}"`;
+      }
      core.info(`[command] ${cmd}`); // https://github.com/actions/toolkit/blob/3d652d3133965f63309e4b2e1c8852cdbdcb3833/packages/exec/src/toolrunner.ts#L47
+      let sudo = 'sudo';
+      if (this.rootless) {
+        sudo += ' -u \\#1001';
+      }
      const proc = await child_process.spawn(
        // We can't use Exec.exec here because we need to detach the process to
        // avoid killing it when the action finishes running. Even if detached,
        // we also need to run dockerd in a subshell and unref the process so
        // GitHub Action doesn't wait for it to finish.
-        `sudo env "PATH=$PATH" ${bashPath} << EOF
+        `${sudo} env "PATH=$PATH" ${bashPath} << EOF
 ( ${cmd} 2>&1 | tee "${this.runDir}/dockerd.log" ) &
 EOF`,
        [],
@@ -319,7 +468,7 @@ EOF`,
  }

  private async installWindows(): Promise<string> {
-    const dockerHost = 'npipe:////./pipe/setup_docker_action';
+    const dockerHostSocket = 'npipe:////./pipe/setup_docker_action';

    let daemonConfig = undefined;
    const daemonConfigPath = path.join(this.runDir, 'daemon.json');
@@ -341,24 +490,29 @@ EOF`,
      });
    }

+    const params = {
+      ToolDir: this.toolDir,
+      RunDir: this.runDir,
+      DockerHostSocket: dockerHostSocket,
+      DaemonConfig: daemonConfigStr
+    };
+    if (this.localTCPPort) {
+      params['DockerHostTCP'] = `tcp://127.0.0.1:${this.localTCPPort}`;
+    }
+
    await core.group('Install Docker daemon service', async () => {
-      const setupCmd = await Util.powershellCommand(setupDockerWinPs1(), {
-        ToolDir: this.toolDir,
-        RunDir: this.runDir,
-        DockerHost: dockerHost,
-        DaemonConfig: daemonConfigStr
-      });
+      const setupCmd = await Util.powershellCommand(setupDockerWinPs1(), params);
      await Exec.exec(setupCmd.command, setupCmd.args);
      const logCmd = await Util.powershellCommand(dockerServiceLogsPs1());
      await Exec.exec(logCmd.command, logCmd.args);
    });

    await core.group('Create Docker context', async () => {
-      await Docker.exec(['context', 'create', this.contextName, '--docker', `host=${dockerHost}`]);
+      await Docker.exec(['context', 'create', this.contextName, '--docker', `host=${dockerHostSocket}`]);
      await Docker.exec(['context', 'use', this.contextName]);
    });

-    return dockerHost;
+    return dockerHostSocket;
  }

  public async tearDown(): Promise<void> {
@@ -382,6 +536,13 @@ EOF`,
        throw new Error(`Unsupported platform: ${os.platform()}`);
      }
    }
+
+    await core.group(`Cleaning up toolDir`, async () => {
+      if (!this._toolDir) {
+        return;
+      }
+      fs.rmSync(this._toolDir, {recursive: true, force: true});
+    });
  }

  private async tearDownDarwin(): Promise<void> {
@@ -431,13 +592,16 @@ EOF`,
    await core.group('Removing Docker context', async () => {
      await Docker.exec(['context', 'rm', '-f', this.contextName]);
    });
+    await core.group('Stopping Docker daemon service', async () => {
+      await Exec.exec('powershell', ['-Command', `Stop-Service -Name docker -Force`]);
+    });
  }

-  private downloadURL(version: string, channel: string): string {
+  private downloadURL(component: 'docker' | 'docker-rootless-extras', version: string, channel: string): string {
    const platformOS = Install.platformOS();
    const platformArch = Install.platformArch();
    const ext = platformOS === 'win' ? '.zip' : '.tgz';
-    return util.format('https://download.docker.com/%s/static/%s/%s/docker-%s%s', platformOS, channel, platformArch, version, ext);
+    return `https://download.docker.com/${platformOS}/static/${channel}/${platformArch}/${component}-${version}${ext}`;
  }

  private static platformOS(): string {
@@ -493,29 +657,42 @@ EOF`,
    return await io
      .which('lima', true)
      .then(res => {
-        core.debug(`docker.Install.limaAvailable ok: ${res}`);
+        core.debug(`docker.Install.limaInstalled ok: ${res}`);
        return true;
      })
      .catch(error => {
-        core.debug(`docker.Install.limaAvailable error: ${error}`);
+        core.debug(`docker.Install.limaInstalled error: ${error}`);
        return false;
      });
  }

-  private static async qemuArch(): Promise<string> {
+  private static async qemuBin(): Promise<string> {
    switch (os.arch()) {
      case 'x64': {
-        return 'x86_64';
+        return `qemu-system-x86_64`;
      }
      case 'arm64': {
-        return 'aarch64';
+        return `qemu-system-aarch64`;
      }
      default: {
-        return os.arch();
+        return `qemu-system-${os.arch()}`;
      }
    }
  }

+  private static async qemuInstalled(): Promise<boolean> {
+    return await io
+      .which(await Install.qemuBin(), true)
+      .then(res => {
+        core.debug(`docker.Install.qemuInstalled ok: ${res}`);
+        return true;
+      })
+      .catch(error => {
+        core.debug(`docker.Install.qemuInstalled error: ${error}`);
+        return false;
+      });
+  }
+
  public static async getRelease(version: string): Promise<GitHubRelease> {
    const url = `https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/docker-releases.json`;
    const http: httpm.HttpClient = new httpm.HttpClient('docker-actions-toolkit');
@@ -527,7 +704,10 @@ EOF`,
    }
    const releases = <Record<string, GitHubRelease>>JSON.parse(body);
    if (!releases[version]) {
-      throw new Error(`Cannot find Docker release ${version} in ${url}`);
+      if (!releases['v' + version]) {
+        throw new Error(`Cannot find Docker release ${version} in ${url}`);
+      }
+      return releases['v' + version];
    }
    return releases[version];
  }
@@ -552,4 +732,20 @@ EOF`,
    }
    return res;
  }
+
+  private async imageConfig(image: string, platform?: string): Promise<Image> {
+    const manifest = await this.regctl.manifestGet({
+      image: image,
+      platform: platform
+    });
+    const configDigest = manifest?.config?.digest;
+    if (!configDigest) {
+      throw new Error(`No config digest found for image ${image}`);
+    }
+    const blob = await this.regctl.blobGet({
+      repository: image,
+      digest: configDigest
+    });
+    return <Image>JSON.parse(blob);
+  }
 }
--- a/src/dockerhub.ts
+++ b/src/dockerhub.ts
@@ -111,17 +111,21 @@ export class DockerHub {
    const body = await resp.readBody();
    resp.message.statusCode = resp.message.statusCode || HttpCodes.InternalServerError;
    if (resp.message.statusCode < 200 || resp.message.statusCode >= 300) {
-      if (resp.message.statusCode == HttpCodes.Unauthorized) {
-        throw new Error(`Docker Hub API: operation not permitted`);
-      }
-      const errResp = <Record<string, string>>JSON.parse(body);
-      for (const k of ['message', 'detail', 'error']) {
-        if (errResp[k]) {
-          throw new Error(`Docker Hub API: bad status code ${resp.message.statusCode}: ${errResp[k]}`);
-        }
-      }
-      throw new Error(`Docker Hub API: bad status code ${resp.message.statusCode}`);
+      throw DockerHub.parseError(resp, body);
    }
    return body;
  }
+
+  public static parseError(resp: httpm.HttpClientResponse, body: string): Error {
+    if (resp.message.statusCode == HttpCodes.Unauthorized) {
+      throw new Error(`Docker Hub API: operation not permitted`);
+    }
+    const errResp = <Record<string, string>>JSON.parse(body);
+    for (const k of ['message', 'detail', 'error']) {
+      if (errResp[k]) {
+        throw new Error(`Docker Hub API: bad status code ${resp.message.statusCode}: ${errResp[k]}`);
+      }
+    }
+    throw new Error(`Docker Hub API: bad status code ${resp.message.statusCode}`);
+  }
 }
--- a/src/git.ts
+++ b/src/git.ts
@@ -163,4 +163,8 @@ export class Git {
      return res.stdout.trim();
    });
  }
+
+  public static async commitDate(ref: string): Promise<Date> {
+    return new Date(await Git.exec(['show', '-s', '--format="%ci"', ref]));
+  }
 }
--- a/src/github.ts
+++ b/src/github.ts
@@ -234,9 +234,23 @@ export class GitHub {
    };

    const refsSize = Object.keys(opts.exportRes.refs).length;
+    const singleRef = refsSize === 1 ? Object.keys(opts.exportRes.refs)[0] : undefined;
+    const singleSummary = singleRef && opts.exportRes.summaries?.[singleRef];
+    const dbcAccount = opts.driver === 'cloud' && opts.endpoint?.split('/')[0];

    const sum = core.summary.addHeading('Docker Build summary', 2);

+    if (dbcAccount && singleRef && singleSummary) {
+      const buildURL = GitHub.formatDBCBuildURL(dbcAccount, singleRef, singleSummary.defaultPlatform);
+      // prettier-ignore
+      sum.addRaw(`<p>`)
+        .addRaw(`For a detailed look at the build, you can check the results at:`)
+      .addRaw('</p>')
+      .addRaw(`<p>`)
+        .addRaw(`:whale: ${addLink(`<strong>${buildURL}</strong>`, buildURL)}`)
+      .addRaw(`</p>`);
+    }
+
    if (opts.uploadRes) {
      // we just need the last two parts of the URL as they are always relative
      // to the workflow run URL otherwise URL could be broken if GitHub
@@ -246,17 +260,29 @@ export class GitHub {
      // https://github.com/docker/actions-toolkit/issues/367
      const artifactRelativeURL = `./${GitHub.runId}/${opts.uploadRes.url.split('/').slice(-2).join('/')}`;

+      if (dbcAccount && refsSize === 1) {
+        // prettier-ignore
+        sum.addRaw(`<p>`)
+          .addRaw(`You can also download the following build record archive and import it into Docker Desktop's Builds view. `)
+          .addBreak()
+          .addRaw(`Build records include details such as timing, dependencies, results, logs, traces, and other information about a build. `)
+          .addRaw(addLink('Learn more', 'https://www.docker.com/blog/new-beta-feature-deep-dive-into-github-actions-docker-builds-with-docker-desktop/?utm_source=github&utm_medium=actions'))
+        .addRaw('</p>')
+      } else {
+        // prettier-ignore
+        sum.addRaw(`<p>`)
+          .addRaw(`For a detailed look at the build, download the following build record archive and import it into Docker Desktop's Builds view. `)
+          .addBreak()
+          .addRaw(`Build records include details such as timing, dependencies, results, logs, traces, and other information about a build. `)
+          .addRaw(addLink('Learn more', 'https://www.docker.com/blog/new-beta-feature-deep-dive-into-github-actions-docker-builds-with-docker-desktop/?utm_source=github&utm_medium=actions'))
+        .addRaw('</p>')
+      }
+
      // prettier-ignore
      sum.addRaw(`<p>`)
-        .addRaw(`For a detailed look at the build, download the following build record archive and import it into Docker Desktop's Builds view. `)
-        .addBreak()
-        .addRaw(`Build records include details such as timing, dependencies, results, logs, traces, and other information about a build. `)
-        .addRaw(addLink('Learn more', 'https://www.docker.com/blog/new-beta-feature-deep-dive-into-github-actions-docker-builds-with-docker-desktop/?utm_source=github&utm_medium=actions'))
-      .addRaw('</p>')
-      .addRaw(`<p>`)
        .addRaw(`:arrow_down: ${addLink(`<strong>${Util.stringToUnicodeEntities(opts.uploadRes.filename)}</strong>`, artifactRelativeURL)} (${Util.formatFileSize(opts.uploadRes.size)} - includes <strong>${refsSize} build record${refsSize > 1 ? 's' : ''}</strong>)`)
      .addRaw(`</p>`);
-    } else {
+    } else if (opts.exportRes.summaries) {
      // prettier-ignore
      sum.addRaw(`<p>`)
        .addRaw(`The following table provides a brief summary of your build.`)
@@ -269,56 +295,61 @@ export class GitHub {
    // Feedback survey
    sum.addRaw(`<p>`).addRaw(`Find this useful? `).addRaw(addLink('Let us know', 'https://docs.docker.com/feedback/gha-build-summary')).addRaw('</p>');

-    // Preview
-    sum.addRaw('<p>');
-    const summaryTableData: Array<Array<SummaryTableCell>> = [
-      [
-        {header: true, data: 'ID'},
-        {header: true, data: 'Name'},
-        {header: true, data: 'Status'},
-        {header: true, data: 'Cached'},
-        {header: true, data: 'Duration'}
-      ]
-    ];
-    let buildError: string | undefined;
-    for (const ref in opts.exportRes.summaries) {
-      if (Object.prototype.hasOwnProperty.call(opts.exportRes.summaries, ref)) {
-        const summary = opts.exportRes.summaries[ref];
+    if (opts.exportRes.summaries) {
+      // Preview
+      sum.addRaw('<p>');
+      const summaryTableData: Array<Array<SummaryTableCell>> = [
        // prettier-ignore
-        summaryTableData.push([
-          {data: `<code>${ref.substring(0, 6).toUpperCase()}</code>`},
-          {data: `<strong>${Util.stringToUnicodeEntities(summary.name)}</strong>`},
-          {data: `${summary.status === 'completed' ? ':white_check_mark:' : summary.status === 'canceled' ? ':no_entry_sign:' : ':x:'} ${summary.status}`},
-          {data: `${summary.numCachedSteps > 0 ? Math.round((summary.numCachedSteps / summary.numTotalSteps) * 100) : 0}%`},
-          {data: summary.duration}
-        ]);
-        if (summary.error) {
-          buildError = summary.error;
+        [
+          {header: true, data: 'ID'},
+          {header: true, data: 'Name'},
+          {header: true, data: 'Status'},
+          {header: true, data: 'Cached'},
+          {header: true, data: 'Duration'},
+          ...(dbcAccount && refsSize > 1 ? [{header: true, data: 'Build result URL'}] : [])
+        ]
+      ];
+      let buildError: string | undefined;
+      for (const ref in opts.exportRes.summaries) {
+        if (Object.prototype.hasOwnProperty.call(opts.exportRes.summaries, ref)) {
+          const summary = opts.exportRes.summaries[ref];
+          // prettier-ignore
+          summaryTableData.push([
+            {data: `<code>${ref.substring(0, 6).toUpperCase()}</code>`},
+            {data: `<strong>${Util.stringToUnicodeEntities(summary.name)}</strong>`},
+            {data: `${summary.status === 'completed' ? ':white_check_mark:' : summary.status === 'canceled' ? ':no_entry_sign:' : ':x:'} ${summary.status}`},
+            {data: `${summary.numCachedSteps > 0 ? Math.round((summary.numCachedSteps / summary.numTotalSteps) * 100) : 0}%`},
+            {data: summary.duration},
+            ...(dbcAccount && refsSize > 1 ? [{data: addLink(':whale: Open', GitHub.formatDBCBuildURL(dbcAccount, ref, summary.defaultPlatform))}] : [])
+          ]);
+          if (summary.error) {
+            buildError = summary.error;
+          }
        }
      }
-    }
-    sum.addTable([...summaryTableData]);
-    sum.addRaw(`</p>`);
+      sum.addTable([...summaryTableData]);
+      sum.addRaw(`</p>`);

-    // Build error
-    if (buildError) {
-      sum.addRaw(`<blockquote>`);
-      if (Util.countLines(buildError) > 10) {
-        // prettier-ignore
-        sum
+      // Build error
+      if (buildError) {
+        sum.addRaw(`<blockquote>`);
+        if (Util.countLines(buildError) > 10) {
+          // prettier-ignore
+          sum
          .addRaw(`<details><summary><strong>Error</strong></summary>`)
            .addCodeBlock(he.encode(buildError), 'text')
          .addRaw(`</details>`);
-      } else {
-        // prettier-ignore
-        sum
+        } else {
+          // prettier-ignore
+          sum
          .addRaw(`<strong>Error</strong>`)
          .addBreak()
          .addRaw(`<p>`)
            .addCodeBlock(he.encode(buildError), 'text')
          .addRaw(`</p>`);
+        }
+        sum.addRaw(`</blockquote>`);
      }
-      sum.addRaw(`</blockquote>`);
    }

    // Build inputs
@@ -345,4 +376,8 @@ export class GitHub {
    core.info(`Writing summary`);
    await sum.addSeparator().write();
  }
+
+  private static formatDBCBuildURL(account: string, ref: string, platform?: string): string {
+    return `https://app.docker.com/build/accounts/${account}/builds/${(platform ?? 'linux/amd64').replace('/', '-')}/${ref}`;
+  }
 }
--- a/src/regclient/install.ts
+++ b/src/regclient/install.ts
@@ -0,0 +1,155 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import * as core from '@actions/core';
+import * as httpm from '@actions/http-client';
+import * as tc from '@actions/tool-cache';
+import * as semver from 'semver';
+import * as util from 'util';
+
+import {Cache} from '../cache';
+import {Context} from '../context';
+
+import {GitHubRelease} from '../types/github';
+import {DownloadVersion} from '../types/regclient/regclient';
+
+export class Install {
+  /*
+   * Download regclient binary from GitHub release
+   * @param v: version semver version or latest
+   * @param ghaNoCache: disable binary caching in GitHub Actions cache backend
+   * @returns path to the regclient binary
+   */
+  public async download(v: string, ghaNoCache?: boolean): Promise<string> {
+    const version: DownloadVersion = await Install.getDownloadVersion(v);
+    core.debug(`Install.download version: ${version.version}`);
+
+    const release: GitHubRelease = await Install.getRelease(version);
+    core.debug(`Install.download release tag name: ${release.tag_name}`);
+
+    const vspec = await this.vspec(release.tag_name);
+    core.debug(`Install.download vspec: ${vspec}`);
+
+    const c = semver.clean(vspec) || '';
+    if (!semver.valid(c)) {
+      throw new Error(`Invalid regclient version "${vspec}".`);
+    }
+
+    const installCache = new Cache({
+      htcName: 'regctl-dl-bin',
+      htcVersion: vspec,
+      baseCacheDir: path.join(os.homedir(), '.bin'),
+      cacheFile: os.platform() == 'win32' ? 'regctl.exe' : 'regctl',
+      ghaNoCache: ghaNoCache
+    });
+
+    const cacheFoundPath = await installCache.find();
+    if (cacheFoundPath) {
+      core.info(`regctl binary found in ${cacheFoundPath}`);
+      return cacheFoundPath;
+    }
+
+    const downloadURL = util.format(version.downloadURL, vspec, this.filename());
+    core.info(`Downloading ${downloadURL}`);
+
+    const htcDownloadPath = await tc.downloadTool(downloadURL);
+    core.debug(`Install.download htcDownloadPath: ${htcDownloadPath}`);
+
+    const cacheSavePath = await installCache.save(htcDownloadPath);
+    core.info(`Cached to ${cacheSavePath}`);
+    return cacheSavePath;
+  }
+
+  public async install(binPath: string, dest?: string): Promise<string> {
+    dest = dest || Context.tmpDir();
+
+    const binDir = path.join(dest, 'regctl-bin');
+    if (!fs.existsSync(binDir)) {
+      fs.mkdirSync(binDir, {recursive: true});
+    }
+    const binName: string = os.platform() == 'win32' ? 'regctl.exe' : 'regctl';
+    const regctlPath: string = path.join(binDir, binName);
+    fs.copyFileSync(binPath, regctlPath);
+
+    core.info('Fixing perms');
+    fs.chmodSync(regctlPath, '0755');
+
+    core.addPath(binDir);
+    core.info('Added regctl to PATH');
+
+    core.info(`Binary path: ${regctlPath}`);
+    return regctlPath;
+  }
+
+  private filename(): string {
+    let arch: string;
+    switch (os.arch()) {
+      case 'x64': {
+        arch = 'amd64';
+        break;
+      }
+      case 'ppc64': {
+        arch = 'ppc64le';
+        break;
+      }
+      case 'arm': {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const arm_version = (process.config.variables as any).arm_version;
+        arch = arm_version ? 'armv' + arm_version : 'arm';
+        break;
+      }
+      default: {
+        arch = os.arch();
+        break;
+      }
+    }
+    const platform: string = os.platform() == 'win32' ? 'windows' : os.platform();
+    const ext: string = os.platform() == 'win32' ? '.exe' : '';
+    return util.format('regctl-%s-%s%s', platform, arch, ext);
+  }
+
+  private async vspec(version: string): Promise<string> {
+    const v = version.replace(/^v+|v+$/g, '');
+    core.info(`Use ${v} version spec cache key for ${version}`);
+    return v;
+  }
+
+  public static async getDownloadVersion(v: string): Promise<DownloadVersion> {
+    return {
+      version: v,
+      downloadURL: 'https://github.com/regclient/regclient/releases/download/v%s/%s',
+      releasesURL: 'https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/regclient-releases.json'
+    };
+  }
+
+  public static async getRelease(version: DownloadVersion): Promise<GitHubRelease> {
+    const http: httpm.HttpClient = new httpm.HttpClient('docker-actions-toolkit');
+    const resp: httpm.HttpClientResponse = await http.get(version.releasesURL);
+    const body = await resp.readBody();
+    const statusCode = resp.message.statusCode || 500;
+    if (statusCode >= 400) {
+      throw new Error(`Failed to get regclient releases from ${version.releasesURL} with status code ${statusCode}: ${body}`);
+    }
+    const releases = <Record<string, GitHubRelease>>JSON.parse(body);
+    if (!releases[version.version]) {
+      throw new Error(`Cannot find regclient release ${version.version} in ${version.releasesURL}`);
+    }
+    return releases[version.version];
+  }
+}
--- a/src/regclient/regctl.ts
+++ b/src/regclient/regctl.ts
@@ -0,0 +1,128 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import * as core from '@actions/core';
+import * as semver from 'semver';
+
+import {Exec} from '../exec';
+
+import {Manifest} from '../types/oci/manifest';
+
+export interface RegctlOpts {
+  binPath?: string;
+}
+
+export interface RegctlBlobGetOpts {
+  repository: string;
+  digest: string;
+}
+
+export interface RegctlManifestGetOpts {
+  image: string;
+  platform?: string;
+}
+
+export class Regctl {
+  private readonly binPath: string;
+  private _version: string;
+  private _versionOnce: boolean;
+
+  constructor(opts?: RegctlOpts) {
+    this.binPath = opts?.binPath || 'regctl';
+    this._version = '';
+    this._versionOnce = false;
+  }
+
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  public async blobGet(opts: RegctlBlobGetOpts): Promise<any> {
+    return await Exec.getExecOutput(this.binPath, ['blob', 'get', opts.repository, opts.digest], {
+      ignoreReturnCode: true,
+      silent: true
+    }).then(res => {
+      if (res.stderr.length > 0 && res.exitCode != 0) {
+        throw new Error(res.stderr.trim());
+      }
+      return res.stdout;
+    });
+  }
+
+  public async manifestGet(opts: RegctlManifestGetOpts): Promise<Manifest> {
+    return await Exec.getExecOutput(this.binPath, ['manifest', 'get', opts.image, `--platform=${opts.platform ?? 'local'}`, `--format={{json .}}`], {
+      ignoreReturnCode: true,
+      silent: true
+    }).then(res => {
+      if (res.stderr.length > 0 && res.exitCode != 0) {
+        throw new Error(res.stderr.trim());
+      }
+      return <Manifest>JSON.parse(res.stdout.trim());
+    });
+  }
+
+  public async isAvailable(): Promise<boolean> {
+    const ok: boolean = await Exec.getExecOutput(this.binPath, [], {
+      ignoreReturnCode: true,
+      silent: true
+    })
+      .then(res => {
+        if (res.stderr.length > 0 && res.exitCode != 0) {
+          core.debug(`Regctl.isAvailable cmd err: ${res.stderr.trim()}`);
+          return false;
+        }
+        return res.exitCode == 0;
+      })
+      .catch(error => {
+        core.debug(`Regctl.isAvailable error: ${error}`);
+        return false;
+      });
+
+    core.debug(`Regctl.isAvailable: ${ok}`);
+    return ok;
+  }
+
+  public async version(): Promise<string> {
+    if (this._versionOnce) {
+      return this._version;
+    }
+    this._versionOnce = true;
+    this._version = await Exec.getExecOutput(this.binPath, ['version', '--format', '{{.VCSTag}}'], {
+      ignoreReturnCode: true,
+      silent: true
+    }).then(res => {
+      if (res.stderr.length > 0 && res.exitCode != 0) {
+        throw new Error(res.stderr.trim());
+      }
+      return res.stdout.trim();
+    });
+    return this._version;
+  }
+
+  public async printVersion() {
+    await Exec.exec(this.binPath, ['version'], {
+      failOnStdErr: false
+    });
+  }
+
+  public async versionSatisfies(range: string, version?: string): Promise<boolean> {
+    const ver = version ?? (await this.version());
+    if (!ver) {
+      core.debug(`Regctl.versionSatisfies false: undefined version`);
+      return false;
+    }
+    const res = semver.satisfies(ver, range) || /^[0-9a-f]{7}$/.exec(ver) !== null;
+    core.debug(`Regctl.versionSatisfies ${ver} statisfies ${range}: ${res}`);
+    return res;
+  }
+}
--- a/src/toolkit.ts
+++ b/src/toolkit.ts
@@ -20,6 +20,9 @@ import {Bake as BuildxBake} from './buildx/bake';
 import {Install as BuildxInstall} from './buildx/install';
 import {Builder} from './buildx/builder';
 import {BuildKit} from './buildkit/buildkit';
+import {Compose} from './compose/compose';
+import {Install as ComposeInstall} from './compose/install';
+import {Undock} from './undock/undock';
 import {GitHub} from './github';

 export interface ToolkitOpts {
@@ -38,6 +41,9 @@ export class Toolkit {
  public buildxInstall: BuildxInstall;
  public builder: Builder;
  public buildkit: BuildKit;
+  public compose: Compose;
+  public composeInstall: ComposeInstall;
+  public undock: Undock;

  constructor(opts: ToolkitOpts = {}) {
    this.github = new GitHub({token: opts.githubToken});
@@ -47,5 +53,8 @@ export class Toolkit {
    this.buildxInstall = new BuildxInstall();
    this.builder = new Builder({buildx: this.buildx});
    this.buildkit = new BuildKit({buildx: this.buildx});
+    this.compose = new Compose();
+    this.composeInstall = new ComposeInstall();
+    this.undock = new Undock();
  }
 }
--- a/src/types/buildx/bake.ts
+++ b/src/types/buildx/bake.ts
@@ -20,28 +20,59 @@ export interface BakeDefinition {
 }

 export interface Group {
+  description?: string;
  targets: Array<string>;
 }

 export interface Target {
+  description?: string;
  args?: Record<string, string>;
-  attest?: Array<string>;
-  'cache-from'?: Array<string>;
-  'cache-to'?: Array<string>;
+  attest?: Array<AttestEntry> | Array<string>;
+  'cache-from'?: Array<CacheEntry> | Array<string>;
+  'cache-to'?: Array<CacheEntry> | Array<string>;
+  call?: string;
  context: string;
  contexts?: Record<string, string>;
  dockerfile: string;
  'dockerfile-inline'?: string;
+  entitlements?: Array<string>;
  labels?: Record<string, string>;
  'no-cache'?: boolean;
  'no-cache-filter'?: Array<string>;
-  output?: Array<string>;
+  output?: Array<ExportEntry> | Array<string>;
  platforms?: Array<string>;
  pull?: boolean;
-  secret?: Array<string>;
+  secret?: Array<SecretEntry> | Array<string>;
  'shm-size'?: string;
-  ssh?: Array<string>;
+  ssh?: Array<SSHEntry> | Array<string>;
  tags?: Array<string>;
  target?: string;
  ulimits?: Array<string>;
 }
+
+export interface AttestEntry {
+  type: string;
+  disabled?: string | boolean;
+  [key: string]: string | boolean | undefined;
+}
+
+export interface CacheEntry {
+  type: string;
+  [key: string]: string;
+}
+
+export interface ExportEntry {
+  type: string;
+  [key: string]: string;
+}
+
+export interface SecretEntry {
+  id?: string;
+  src?: string;
+  env?: string;
+}
+
+export interface SSHEntry {
+  id?: string;
+  paths?: Array<string>;
+}
--- a/src/types/buildx/builder.ts
+++ b/src/types/buildx/builder.ts
@@ -34,12 +34,24 @@ export interface NodeInfo extends Node {
  buildkit?: string;
  features?: Record<string, boolean>;
  labels?: Record<string, string>;
+  devices?: Array<Device>;
  gcPolicy?: Array<GCPolicy>;
+  files?: Record<string, string>;
+}
+
+export interface Device {
+  name?: string;
+  annotations?: Record<string, string>;
+  autoAllow?: boolean;
+  onDemand?: boolean;
 }

 export interface GCPolicy {
  all?: boolean;
  filter?: string[];
  keepDuration?: string;
-  keepBytes?: string;
+  keepBytes?: string; // deprecated, use reservedSpace instead
+  reservedSpace?: string;
+  maxUsedSpace?: string;
+  minFreeSpace?: string;
 }
--- a/src/types/buildx/history.ts
+++ b/src/types/buildx/history.ts
@@ -14,31 +14,123 @@
 * limitations under the License.
 */

-export interface ExportRecordOpts {
-  refs: Array<string>;
-  image?: string;
+export interface InspectOpts {
+  ref?: string;
+  builder?: string;
 }

-export interface ExportRecordResponse {
+export type BuildStatus = 'completed' | 'running' | 'failed' | 'canceled';
+
+export interface InspectResponse {
+  Name: string;
+  Ref: string;
+
+  Context?: string;
+  Dockerfile?: string;
+  VCSRepository?: string;
+  VCSRevision?: string;
+  Target?: string;
+  Platform?: Array<string>;
+  KeepGitDir?: boolean;
+
+  NamedContexts?: Array<InspectKeyValueOutput>;
+
+  StartedAt?: Date;
+  CompletedAt?: Date;
+  Duration: number;
+  Status: BuildStatus;
+  Error?: InspectErrorOutput;
+
+  NumCompletedSteps: number;
+  NumTotalSteps: number;
+  NumCachedSteps: number;
+
+  BuildArgs?: Array<InspectKeyValueOutput>;
+  Labels?: Array<InspectKeyValueOutput>;
+
+  Config?: InspectConfigOutput;
+
+  Materials?: InspectMaterialOutput[];
+  Attachments?: InspectAttachmentOutput[];
+
+  Errors?: Array<string>;
+}
+
+export interface InspectConfigOutput {
+  Network?: string;
+  ExtraHosts?: Array<string>;
+  Hostname?: string;
+  CgroupParent?: string;
+  ImageResolveMode?: string;
+  MultiPlatform?: boolean;
+  NoCache?: boolean;
+  NoCacheFilter?: Array<string>;
+
+  ShmSize?: string;
+  Ulimit?: string;
+  CacheMountNS?: string;
+  DockerfileCheckConfig?: string;
+  SourceDateEpoch?: string;
+  SandboxHostname?: string;
+
+  RestRaw?: Array<InspectKeyValueOutput>;
+}
+
+export interface InspectMaterialOutput {
+  URI?: string;
+  Digests?: Array<string>;
+}
+
+export interface InspectAttachmentOutput {
+  Digest?: string;
+  Platform?: string;
+  Type?: string;
+}
+
+export interface InspectErrorOutput {
+  Code?: number;
+  Message?: string;
+  Name?: string;
+  Logs?: Array<string>;
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  Sources?: any;
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  Stack?: any;
+}
+
+export interface InspectKeyValueOutput {
+  Name?: string;
+  Value?: string;
+}
+
+export interface ExportOpts {
+  refs: Array<string>;
+  noSummaries?: boolean;
+  image?: string;
+  useContainer?: boolean;
+}
+
+export interface ExportResponse {
  dockerbuildFilename: string;
  dockerbuildSize: number;
-  summaries: Summaries;
  builderName: string;
  nodeName: string;
  refs: Array<string>;
+  summaries?: Summaries;
 }

 export interface Summaries {
-  [ref: string]: RecordSummary;
+  [ref: string]: Summary;
 }

-export interface RecordSummary {
+export interface Summary {
  name: string;
  status: string;
  duration: string;
  numCachedSteps: number;
  numTotalSteps: number;
  numCompletedSteps: number;
-  frontendAttrs: Record<string, string>;
+  frontendAttrs?: Record<string, string>;
+  defaultPlatform?: string;
  error?: string;
 }
--- a/src/types/compose/compose.ts
+++ b/src/types/compose/compose.ts
@@ -0,0 +1,22 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export interface DownloadVersion {
+  key: string;
+  version: string;
+  downloadURL: string;
+  releasesURL: string;
+}
--- a/src/types/docker/mediatype.ts
+++ b/src/types/docker/mediatype.ts
@@ -0,0 +1,21 @@
+/**
+ * Copyright 2023 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export const MEDIATYPE_IMAGE_MANIFEST_LIST_V2 = 'application/vnd.docker.distribution.manifest.list.v2+json';
+
+export const MEDIATYPE_IMAGE_MANIFEST_V2 = 'application/vnd.docker.distribution.manifest.v2+json';
+
+export const MEDIATYPE_IMAGE_CONFIG_V1 = 'application/vnd.docker.container.image.v1+json';
--- a/src/types/github.ts
+++ b/src/types/github.ts
@@ -19,7 +19,7 @@ import {components as OctoOpenApiTypes} from '@octokit/openapi-types';
 import {JwtPayload} from 'jwt-decode';

 import {BakeDefinition} from './buildx/bake';
-import {ExportRecordResponse} from './buildx/history';
+import {ExportResponse} from './buildx/history';

 export interface GitHubRelease {
  id: number;
@@ -57,9 +57,12 @@ export interface UploadArtifactResponse {
 }

 export interface BuildSummaryOpts {
-  exportRes: ExportRecordResponse;
+  exportRes: ExportResponse;
  uploadRes?: UploadArtifactResponse;
  // eslint-disable-next-line @typescript-eslint/no-explicit-any
  inputs?: any;
  bakeDefinition?: BakeDefinition;
+  // builder options
+  driver?: string;
+  endpoint?: string;
 }
--- a/src/types/oci/mediatype.ts
+++ b/src/types/oci/mediatype.ts
@@ -23,3 +23,5 @@ export const MEDIATYPE_IMAGE_INDEX_V1 = 'application/vnd.oci.image.index.v1+json
 export const MEDIATYPE_IMAGE_LAYER_V1 = 'application/vnd.oci.image.layer.v1.tar';

 export const MEDIATYPE_EMPTY_JSON_V1 = 'application/vnd.oci.empty.v1+json';
+
+export const MEDIATYPE_IMAGE_CONFIG_V1 = 'application/vnd.oci.image.config.v1+json';
--- a/src/types/regclient/regclient.ts
+++ b/src/types/regclient/regclient.ts
@@ -0,0 +1,21 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export interface DownloadVersion {
+  version: string;
+  downloadURL: string;
+  releasesURL: string;
+}
--- a/src/types/undock/undock.ts
+++ b/src/types/undock/undock.ts
@@ -0,0 +1,21 @@
+/**
+ * Copyright 2024 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export interface DownloadVersion {
+  version: string;
+  downloadURL: string;
+  releasesURL: string;
+}
--- a/src/undock/install.ts
+++ b/src/undock/install.ts
@@ -0,0 +1,166 @@
+/**
+ * Copyright 2024 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import * as core from '@actions/core';
+import * as httpm from '@actions/http-client';
+import * as tc from '@actions/tool-cache';
+import * as semver from 'semver';
+import * as util from 'util';
+
+import {Cache} from '../cache';
+import {Context} from '../context';
+
+import {GitHubRelease} from '../types/github';
+import {DownloadVersion} from '../types/undock/undock';
+
+export class Install {
+  /*
+   * Download undock binary from GitHub release
+   * @param v: version semver version or latest
+   * @param ghaNoCache: disable binary caching in GitHub Actions cache backend
+   * @returns path to the undock binary
+   */
+  public async download(v: string, ghaNoCache?: boolean): Promise<string> {
+    const version: DownloadVersion = await Install.getDownloadVersion(v);
+    core.debug(`Install.download version: ${version.version}`);
+
+    const release: GitHubRelease = await Install.getRelease(version);
+    core.debug(`Install.download release tag name: ${release.tag_name}`);
+
+    const vspec = await this.vspec(release.tag_name);
+    core.debug(`Install.download vspec: ${vspec}`);
+
+    const c = semver.clean(vspec) || '';
+    if (!semver.valid(c)) {
+      throw new Error(`Invalid Undock version "${vspec}".`);
+    }
+
+    const installCache = new Cache({
+      htcName: 'undock-dl-bin',
+      htcVersion: vspec,
+      baseCacheDir: path.join(os.homedir(), '.bin'),
+      cacheFile: os.platform() == 'win32' ? 'undock.exe' : 'undock',
+      ghaNoCache: ghaNoCache
+    });
+
+    const cacheFoundPath = await installCache.find();
+    if (cacheFoundPath) {
+      core.info(`Unodck binary found in ${cacheFoundPath}`);
+      return cacheFoundPath;
+    }
+
+    const downloadURL = util.format(version.downloadURL, vspec, this.filename(vspec));
+    core.info(`Downloading ${downloadURL}`);
+
+    const htcDownloadPath = await tc.downloadTool(downloadURL);
+    core.debug(`Install.download htcDownloadPath: ${htcDownloadPath}`);
+
+    let htcExtPath: string;
+    if (os.platform() == 'win32') {
+      htcExtPath = await tc.extractZip(htcDownloadPath);
+    } else {
+      htcExtPath = await tc.extractTar(htcDownloadPath);
+    }
+    core.info(`Extracted to ${htcExtPath}`);
+
+    const exePath: string = path.join(htcExtPath, os.platform() == 'win32' ? 'undock.exe' : 'undock');
+    core.debug(`Install.download exePath: ${exePath}`);
+
+    const cacheSavePath = await installCache.save(exePath);
+    core.info(`Cached to ${cacheSavePath}`);
+    return cacheSavePath;
+  }
+
+  public async install(binPath: string, dest?: string): Promise<string> {
+    dest = dest || Context.tmpDir();
+
+    const binDir = path.join(dest, 'undock-bin');
+    if (!fs.existsSync(binDir)) {
+      fs.mkdirSync(binDir, {recursive: true});
+    }
+    const binName: string = os.platform() == 'win32' ? 'undock.exe' : 'undock';
+    const undockPath: string = path.join(binDir, binName);
+    fs.copyFileSync(binPath, undockPath);
+
+    core.info('Fixing perms');
+    fs.chmodSync(undockPath, '0755');
+
+    core.addPath(binDir);
+    core.info('Added Unodck to PATH');
+
+    core.info(`Binary path: ${undockPath}`);
+    return undockPath;
+  }
+
+  private filename(version: string): string {
+    let arch: string;
+    switch (os.arch()) {
+      case 'x64': {
+        arch = 'amd64';
+        break;
+      }
+      case 'ppc64': {
+        arch = 'ppc64le';
+        break;
+      }
+      case 'arm': {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const arm_version = (process.config.variables as any).arm_version;
+        arch = arm_version ? 'armv' + arm_version : 'arm';
+        break;
+      }
+      default: {
+        arch = os.arch();
+        break;
+      }
+    }
+    const platform: string = os.platform() == 'win32' ? 'windows' : os.platform();
+    const ext: string = os.platform() == 'win32' ? '.zip' : '.tar.gz';
+    return util.format('undock_%s_%s_%s%s', version, platform, arch, ext);
+  }
+
+  private async vspec(version: string): Promise<string> {
+    const v = version.replace(/^v+|v+$/g, '');
+    core.info(`Use ${v} version spec cache key for ${version}`);
+    return v;
+  }
+
+  public static async getDownloadVersion(v: string): Promise<DownloadVersion> {
+    return {
+      version: v,
+      downloadURL: 'https://github.com/crazy-max/undock/releases/download/v%s/%s',
+      releasesURL: 'https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/undock-releases.json'
+    };
+  }
+
+  public static async getRelease(version: DownloadVersion): Promise<GitHubRelease> {
+    const http: httpm.HttpClient = new httpm.HttpClient('docker-actions-toolkit');
+    const resp: httpm.HttpClientResponse = await http.get(version.releasesURL);
+    const body = await resp.readBody();
+    const statusCode = resp.message.statusCode || 500;
+    if (statusCode >= 400) {
+      throw new Error(`Failed to get Undock releases from ${version.releasesURL} with status code ${statusCode}: ${body}`);
+    }
+    const releases = <Record<string, GitHubRelease>>JSON.parse(body);
+    if (!releases[version.version]) {
+      throw new Error(`Cannot find Undock release ${version.version} in ${version.releasesURL}`);
+    }
+    return releases[version.version];
+  }
+}
--- a/src/undock/undock.ts
+++ b/src/undock/undock.ts
@@ -0,0 +1,148 @@
+/**
+ * Copyright 2024 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import * as core from '@actions/core';
+import * as semver from 'semver';
+
+import {Exec} from '../exec';
+
+export interface UndockOpts {
+  binPath?: string;
+}
+
+export interface UndockRunOpts {
+  source: string;
+  dist: string;
+  logLevel?: string;
+  logCaller?: boolean;
+  cacheDir?: string;
+  platform?: string;
+  all?: boolean;
+  include?: Array<string>;
+  insecure?: boolean;
+  rmDist?: boolean;
+  wrap?: boolean;
+}
+
+export class Undock {
+  private readonly binPath: string;
+  private _version: string;
+  private _versionOnce: boolean;
+
+  constructor(opts?: UndockOpts) {
+    this.binPath = opts?.binPath || 'undock';
+    this._version = '';
+    this._versionOnce = false;
+  }
+
+  public async run(opts: UndockRunOpts): Promise<void> {
+    if (!opts.source) {
+      throw new Error('source is required');
+    }
+    if (!opts.dist) {
+      throw new Error('dist is required');
+    }
+    const args: Array<string> = [];
+    if (opts.logLevel) {
+      args.push(`--log-level=${opts.logLevel}`);
+    }
+    if (opts.logCaller) {
+      args.push('--log-caller');
+    }
+    if (opts.cacheDir) {
+      args.push(`--cachedir=${opts.cacheDir}`);
+    }
+    if (opts.platform) {
+      args.push(`--platform=${opts.platform}`);
+    }
+    if (opts.all) {
+      args.push('--all');
+    }
+    if (opts.include) {
+      opts.include.forEach(i => {
+        args.push(`--include=${i}`);
+      });
+    }
+    if (opts.insecure) {
+      args.push('--insecure');
+    }
+    if (opts.rmDist) {
+      args.push('--rm-dist');
+    }
+    if (opts.wrap) {
+      args.push('--wrap');
+    }
+    args.push(opts.source, opts.dist);
+    await Exec.exec(this.binPath, args, {
+      failOnStdErr: false
+    });
+  }
+
+  public async isAvailable(): Promise<boolean> {
+    const ok: boolean = await Exec.getExecOutput(this.binPath, [], {
+      ignoreReturnCode: true,
+      silent: true
+    })
+      .then(res => {
+        if (res.stderr.length > 0 && res.exitCode != 0) {
+          core.debug(`Undock.isAvailable cmd err: ${res.stderr.trim()}`);
+          return false;
+        }
+        return res.exitCode == 0;
+      })
+      .catch(error => {
+        core.debug(`Undock.isAvailable error: ${error}`);
+        return false;
+      });
+
+    core.debug(`Undock.isAvailable: ${ok}`);
+    return ok;
+  }
+
+  public async version(): Promise<string> {
+    if (this._versionOnce) {
+      return this._version;
+    }
+    this._versionOnce = true;
+    this._version = await Exec.getExecOutput(this.binPath, ['--version'], {
+      ignoreReturnCode: true,
+      silent: true
+    }).then(res => {
+      if (res.stderr.length > 0 && res.exitCode != 0) {
+        throw new Error(res.stderr.trim());
+      }
+      return res.stdout.trim();
+    });
+    return this._version;
+  }
+
+  public async printVersion() {
+    await Exec.exec(this.binPath, ['--version'], {
+      failOnStdErr: false
+    });
+  }
+
+  public async versionSatisfies(range: string, version?: string): Promise<boolean> {
+    const ver = version ?? (await this.version());
+    if (!ver) {
+      core.debug(`Undock.versionSatisfies false: undefined version`);
+      return false;
+    }
+    const res = semver.satisfies(ver, range) || /^[0-9a-f]{7}$/.exec(ver) !== null;
+    core.debug(`Undock.versionSatisfies ${ver} statisfies ${range}: ${res}`);
+    return res;
+  }
+}
--- a/src/util.ts
+++ b/src/util.ts
@@ -64,6 +64,14 @@ export class Util {
    return res.filter(item => item).map(pat => pat.trim());
  }

+  public static getInputNumber(name: string): number | undefined {
+    const value = core.getInput(name);
+    if (!value) {
+      return undefined;
+    }
+    return parseInt(value);
+  }
+
  public static async asyncForEach(array, callback) {
    for (let index = 0; index < array.length; index++) {
      await callback(array[index], index, array);
@@ -196,4 +204,20 @@ export class Util {
    const rcp = path.resolve(childPath);
    return rcp.startsWith(rpp.endsWith(path.sep) ? rpp : `${rpp}${path.sep}`);
  }
+
+  public static formatDuration(ns: number): string {
+    if (ns === 0) return '0s';
+
+    const totalSeconds = Math.floor(ns / 1e9);
+    const hours = Math.floor(totalSeconds / 3600);
+    const minutes = Math.floor((totalSeconds % 3600) / 60);
+    const seconds = totalSeconds % 60;
+
+    const parts: string[] = [];
+    if (hours) parts.push(`${hours}h`);
+    if (minutes) parts.push(`${minutes}m`);
+    if (seconds || parts.length === 0) parts.push(`${seconds}s`);
+
+    return parts.join('');
+  }
 }
--- a/yarn.lock
+++ b/yarn.lock
@@ -12,9 +12,9 @@ __metadata:
  languageName: node
  linkType: hard

-"@actions/artifact@npm:^2.1.9":
-  version: 2.1.9
-  resolution: "@actions/artifact@npm:2.1.9"
+"@actions/artifact@npm:^2.3.2":
+  version: 2.3.2
+  resolution: "@actions/artifact@npm:2.3.2"
  dependencies:
    "@actions/core": ^1.10.0
    "@actions/github": ^5.1.1
@@ -26,19 +26,17 @@ __metadata:
    "@octokit/request-error": ^5.0.0
    "@protobuf-ts/plugin": ^2.2.3-alpha.1
    archiver: ^7.0.1
-    crypto: ^1.0.1
    jwt-decode: ^3.1.2
-    twirp-ts: ^2.5.0
    unzip-stream: ^0.3.1
-  checksum: b01404aa6b4d47186e04a64c0002100ff68a8473eafb811a3d49275a7e1135d1981ccaf527b81c4856f6da764beabe7489fd296bb287906fd7c1964dfaeef3df
+  checksum: 78ee41b43800accb2f3527e1733217c43d53693e7f96ce2470b16890fb84f5c2ebaaa6048ccdb6cfe188b54c02779ec99623c6932558e757f6829cfde203cf2c
  languageName: node
  linkType: hard

-"@actions/cache@npm:^3.2.4":
-  version: 3.2.4
-  resolution: "@actions/cache@npm:3.2.4"
+"@actions/cache@npm:^4.0.3":
+  version: 4.0.3
+  resolution: "@actions/cache@npm:4.0.3"
  dependencies:
-    "@actions/core": ^1.10.0
+    "@actions/core": ^1.11.1
    "@actions/exec": ^1.0.1
    "@actions/glob": ^0.1.0
    "@actions/http-client": ^2.1.1
@@ -46,9 +44,9 @@ __metadata:
    "@azure/abort-controller": ^1.1.0
    "@azure/ms-rest-js": ^2.6.0
    "@azure/storage-blob": ^12.13.0
+    "@protobuf-ts/plugin": ^2.9.4
    semver: ^6.3.1
-    uuid: ^3.3.3
-  checksum: 5bf5f7541bea4906b553440a9ffee5699e11dfb729365c6cb0bbd37e147a1a0993369fdad16bfa3e2b01ec7fa57dac66276278bfd4a389009246a75ea953e61d
+  checksum: ee9c2a21a70bd3f35c63f302af478e23f135c26deb77ea2e4eed29c62766a4b201fc7435651c0d56fa504c02d203107e3bdfda1dba18a3ee09338e1dfc3f2fe8
  languageName: node
  linkType: hard

@@ -62,13 +60,13 @@ __metadata:
  languageName: node
  linkType: hard

-"@actions/core@npm:^1.10.1":
-  version: 1.10.1
-  resolution: "@actions/core@npm:1.10.1"
+"@actions/core@npm:^1.11.1":
+  version: 1.11.1
+  resolution: "@actions/core@npm:1.11.1"
  dependencies:
+    "@actions/exec": ^1.1.1
    "@actions/http-client": ^2.0.1
-    uuid: ^8.3.2
-  checksum: 96524c2725e70e3c3176b4e4d93a1358a86f3c5ca777db9a2f65eadfa672f00877db359bf60fffc416c33838ffb4743db93bcc5bf53e76199dd28bf7f7ff8e80
+  checksum: 9ac7a3e0b478bfefd862dcb4ddaa1d8c3f9076bb1931d3d280918d1749e7783480c6a009c1b009c8bf5093e2d77d9f4e023d70416145bf246f0071736d4ef839
  languageName: node
  linkType: hard

@@ -93,15 +91,18 @@ __metadata:
  languageName: node
  linkType: hard

-"@actions/github@npm:^6.0.0":
-  version: 6.0.0
-  resolution: "@actions/github@npm:6.0.0"
+"@actions/github@npm:^6.0.1":
+  version: 6.0.1
+  resolution: "@actions/github@npm:6.0.1"
  dependencies:
    "@actions/http-client": ^2.2.0
    "@octokit/core": ^5.0.1
-    "@octokit/plugin-paginate-rest": ^9.0.0
-    "@octokit/plugin-rest-endpoint-methods": ^10.0.0
-  checksum: 81831a78377175d8825fc0b94247ff366c0e87ad1dfa48df9b30b8659506f216dcf1e2d3124fcd318839b92c24ba20165e238b3cc11a34db89c69c40825e9ccf
+    "@octokit/plugin-paginate-rest": ^9.2.2
+    "@octokit/plugin-rest-endpoint-methods": ^10.4.0
+    "@octokit/request": ^8.4.1
+    "@octokit/request-error": ^5.1.1
+    undici: ^5.28.5
+  checksum: ba6a162a5727dea2f3f3fc450e02c5b336ceb65a0e26ba9ad9c62b20f4f5b2625ca347a9311a4905ef3c92378ca022caba841a283cb7f2e4175d79e3d1ecaf12
  languageName: node
  linkType: hard

@@ -170,17 +171,16 @@ __metadata:
  languageName: node
  linkType: hard

-"@actions/tool-cache@npm:^2.0.1":
-  version: 2.0.1
-  resolution: "@actions/tool-cache@npm:2.0.1"
+"@actions/tool-cache@npm:^2.0.2":
+  version: 2.0.2
+  resolution: "@actions/tool-cache@npm:2.0.2"
  dependencies:
-    "@actions/core": ^1.2.6
+    "@actions/core": ^1.11.1
    "@actions/exec": ^1.0.0
    "@actions/http-client": ^2.0.1
    "@actions/io": ^1.1.1
    semver: ^6.1.0
-    uuid: ^3.3.2
-  checksum: 33f6393b9b163e4af2b9759e8d37cda4f018f10ddda3643355bb8a9f92d732e5bdff089cf8036b46d181e1ef2b3210b895b2f746fdf54487afe88f1d340aa9e1
+  checksum: c2bab4297be752bdda9dd61f8159a201ad0d37d026134b960f1edcc9418a80387f44d1f24a070fe992c44dcfc28a152f70600e76669bb0578132789a6f37a596
  languageName: node
  linkType: hard

@@ -1109,14 +1109,14 @@ __metadata:
  version: 0.0.0-use.local
  resolution: "@docker/actions-toolkit@workspace:."
  dependencies:
-    "@actions/artifact": ^2.1.9
-    "@actions/cache": ^3.2.4
-    "@actions/core": ^1.10.1
+    "@actions/artifact": ^2.3.2
+    "@actions/cache": ^4.0.3
+    "@actions/core": ^1.11.1
    "@actions/exec": ^1.1.1
-    "@actions/github": ^6.0.0
+    "@actions/github": ^6.0.1
    "@actions/http-client": ^2.2.3
    "@actions/io": ^1.1.3
-    "@actions/tool-cache": ^2.0.1
+    "@actions/tool-cache": ^2.0.2
    "@azure/storage-blob": ^12.15.0
    "@octokit/core": ^5.1.0
    "@octokit/plugin-rest-endpoint-methods": ^10.4.0
@@ -1125,13 +1125,13 @@ __metadata:
    "@types/he": ^1.2.3
    "@types/js-yaml": ^4.0.9
    "@types/node": ^20.12.10
-    "@types/semver": ^7.5.8
+    "@types/semver": ^7.7.0
    "@types/tar-stream": ^3.1.3
    "@types/tmp": ^0.2.6
    "@typescript-eslint/eslint-plugin": ^7.8.0
    "@typescript-eslint/parser": ^7.8.0
    async-retry: ^1.3.3
-    csv-parse: ^5.5.6
+    csv-parse: ^5.6.0
    dotenv: ^16.4.5
    eslint: ^8.57.0
    eslint-config-prettier: ^9.1.0
@@ -1146,7 +1146,7 @@ __metadata:
    jwt-decode: ^4.0.0
    prettier: ^3.2.5
    rimraf: ^5.0.5
-    semver: ^7.6.3
+    semver: ^7.7.2
    tar-stream: ^3.1.7
    tmp: ^0.2.3
    ts-jest: ^29.1.2
@@ -1770,6 +1770,16 @@ __metadata:
  languageName: node
  linkType: hard

+"@octokit/endpoint@npm:^9.0.6":
+  version: 9.0.6
+  resolution: "@octokit/endpoint@npm:9.0.6"
+  dependencies:
+    "@octokit/types": ^13.1.0
+    universal-user-agent: ^6.0.0
+  checksum: f853c08f0777a8cc7c3d2509835d478e11a76d722f807d4f2ad7c0e64bf4dd159536409f466b367a907886aa3b78574d3d09ed95ac462c769e4fccaaad81e72a
+  languageName: node
+  linkType: hard
+
 "@octokit/graphql@npm:^4.5.8":
  version: 4.8.0
  resolution: "@octokit/graphql@npm:4.8.0"
@@ -1820,6 +1830,13 @@ __metadata:
  languageName: node
  linkType: hard

+"@octokit/openapi-types@npm:^24.2.0":
+  version: 24.2.0
+  resolution: "@octokit/openapi-types@npm:24.2.0"
+  checksum: 3c2d2f4cafd21c8a1e6a6fe6b56df6a3c09bc52ab6f829c151f9397694d028aa183ae856f08e006ee7ecaa7bd7eb413a903fbc0ffa6403e7b284ddcda20b1294
+  languageName: node
+  linkType: hard
+
 "@octokit/plugin-paginate-rest@npm:^2.17.0":
  version: 2.21.3
  resolution: "@octokit/plugin-paginate-rest@npm:2.21.3"
@@ -1831,14 +1848,14 @@ __metadata:
  languageName: node
  linkType: hard

-"@octokit/plugin-paginate-rest@npm:^9.0.0":
-  version: 9.0.0
-  resolution: "@octokit/plugin-paginate-rest@npm:9.0.0"
+"@octokit/plugin-paginate-rest@npm:^9.2.2":
+  version: 9.2.2
+  resolution: "@octokit/plugin-paginate-rest@npm:9.2.2"
  dependencies:
-    "@octokit/types": ^12.0.0
+    "@octokit/types": ^12.6.0
  peerDependencies:
-    "@octokit/core": ">=5"
-  checksum: 4a8543f3e45c4916f94edc57d66106ee60da9fd4edccd7c3a2ddd00da1fc4eb2e1b2bcb3d6cb981a050edf883100c5004d0b81497568d4ac9138310a2188a458
+    "@octokit/core": 5
+  checksum: ea2a3ebf6abc128a1996c5ff7148ebe755ee2ed001aa0c1d3088d67a9d78b093d84820e3ec73bfb165ca8774943a1158afdae4cf7b90b0a07f12ebbe1d8a428b
  languageName: node
  linkType: hard

@@ -1851,17 +1868,6 @@ __metadata:
  languageName: node
  linkType: hard

-"@octokit/plugin-rest-endpoint-methods@npm:^10.0.0":
-  version: 10.0.1
-  resolution: "@octokit/plugin-rest-endpoint-methods@npm:10.0.1"
-  dependencies:
-    "@octokit/types": ^12.0.0
-  peerDependencies:
-    "@octokit/core": ">=5"
-  checksum: 4873a76976308dac3a6426d7f4fdd680568f05a3b511dbc47225b7f80feda39771f0cd104ef769dbb7c6fadd2af21a4eab0709f2547fa7f1b55cb9019d93b8e5
-  languageName: node
-  linkType: hard
-
 "@octokit/plugin-rest-endpoint-methods@npm:^10.4.0":
  version: 10.4.0
  resolution: "@octokit/plugin-rest-endpoint-methods@npm:10.4.0"
@@ -1917,6 +1923,17 @@ __metadata:
  languageName: node
  linkType: hard

+"@octokit/request-error@npm:^5.1.1":
+  version: 5.1.1
+  resolution: "@octokit/request-error@npm:5.1.1"
+  dependencies:
+    "@octokit/types": ^13.1.0
+    deprecation: ^2.0.0
+    once: ^1.4.0
+  checksum: 17d0b3f59c2a8a285715bfe6a85168d9c417aa7a0ff553b9be4198a3bc8bb00384a3530221a448eb19f8f07ea9fc48d264869624f5f84fa63a948a7af8cddc8c
+  languageName: node
+  linkType: hard
+
 "@octokit/request@npm:^5.6.0, @octokit/request@npm:^5.6.3":
  version: 5.6.3
  resolution: "@octokit/request@npm:5.6.3"
@@ -1944,6 +1961,18 @@ __metadata:
  languageName: node
  linkType: hard

+"@octokit/request@npm:^8.4.1":
+  version: 8.4.1
+  resolution: "@octokit/request@npm:8.4.1"
+  dependencies:
+    "@octokit/endpoint": ^9.0.6
+    "@octokit/request-error": ^5.1.1
+    "@octokit/types": ^13.1.0
+    universal-user-agent: ^6.0.0
+  checksum: 0ba76728583543baeef9fda98690bc86c57e0a3ccac8c189d2b7d144d248c89167eb37a071ed8fead8f4da0a1c55c4dd98a8fc598769c263b95179fb200959de
+  languageName: node
+  linkType: hard
+
 "@octokit/types@npm:^11.0.0, @octokit/types@npm:^11.1.0":
  version: 11.1.0
  resolution: "@octokit/types@npm:11.1.0"
@@ -1971,6 +2000,15 @@ __metadata:
  languageName: node
  linkType: hard

+"@octokit/types@npm:^13.1.0":
+  version: 13.10.0
+  resolution: "@octokit/types@npm:13.10.0"
+  dependencies:
+    "@octokit/openapi-types": ^24.2.0
+  checksum: fca3764548d5872535b9025c3b5fe6373fe588b287cb5b5259364796c1931bbe5e9ab8a86a5274ce43bb2b3e43b730067c3b86b6b1ade12a98cd59b2e8b3610d
+  languageName: node
+  linkType: hard
+
 "@octokit/types@npm:^6.0.3, @octokit/types@npm:^6.16.1, @octokit/types@npm:^6.39.0, @octokit/types@npm:^6.40.0":
  version: 6.41.0
  resolution: "@octokit/types@npm:6.41.0"
@@ -2001,7 +2039,7 @@ __metadata:
  languageName: node
  linkType: hard

-"@protobuf-ts/plugin-framework@npm:^2.0.7, @protobuf-ts/plugin-framework@npm:^2.9.4":
+"@protobuf-ts/plugin-framework@npm:^2.9.4":
  version: 2.9.4
  resolution: "@protobuf-ts/plugin-framework@npm:2.9.4"
  dependencies:
@@ -2011,7 +2049,7 @@ __metadata:
  languageName: node
  linkType: hard

-"@protobuf-ts/plugin@npm:^2.2.3-alpha.1":
+"@protobuf-ts/plugin@npm:^2.2.3-alpha.1, @protobuf-ts/plugin@npm:^2.9.4":
  version: 2.9.4
  resolution: "@protobuf-ts/plugin@npm:2.9.4"
  dependencies:
@@ -2273,6 +2311,13 @@ __metadata:
  languageName: node
  linkType: hard

+"@types/semver@npm:^7.7.0":
+  version: 7.7.0
+  resolution: "@types/semver@npm:7.7.0"
+  checksum: d488eaeddb23879a0a8a759bed667e1a76cb0dd4d23e3255538e24c189db387357953ca9e7a3bda2bb7f95e84cac8fe0db4fbe6b3456e893043337732d1d23cc
+  languageName: node
+  linkType: hard
+
 "@types/stack-utils@npm:^2.0.0":
  version: 2.0.0
  resolution: "@types/stack-utils@npm:2.0.0"
@@ -3126,16 +3171,6 @@ __metadata:
  languageName: node
  linkType: hard

-"camel-case@npm:^4.1.2":
-  version: 4.1.2
-  resolution: "camel-case@npm:4.1.2"
-  dependencies:
-    pascal-case: ^3.1.2
-    tslib: ^2.0.3
-  checksum: bcbd25cd253b3cbc69be3f535750137dbf2beb70f093bdc575f73f800acc8443d34fd52ab8f0a2413c34f1e8203139ffc88428d8863e4dfe530cfb257a379ad6
-  languageName: node
-  linkType: hard
-
 "camelcase@npm:^5.3.1":
  version: 5.3.1
  resolution: "camelcase@npm:5.3.1"
@@ -3304,13 +3339,6 @@ __metadata:
  languageName: node
  linkType: hard

-"commander@npm:^4.0.0":
-  version: 4.1.1
-  resolution: "commander@npm:4.1.1"
-  checksum: d7b9913ff92cae20cb577a4ac6fcc121bd6223319e54a40f51a14740a681ad5c574fd29a57da478a5f234a6fa6c52cbf0b7c641353e03c648b1ae85ba670b977
-  languageName: node
-  linkType: hard
-
 "compress-commons@npm:^6.0.2":
  version: 6.0.2
  resolution: "compress-commons@npm:6.0.2"
@@ -3405,20 +3433,13 @@ __metadata:
  linkType: hard

 "cross-spawn@npm:^7.0.0, cross-spawn@npm:^7.0.2, cross-spawn@npm:^7.0.3":
-  version: 7.0.3
-  resolution: "cross-spawn@npm:7.0.3"
+  version: 7.0.6
+  resolution: "cross-spawn@npm:7.0.6"
  dependencies:
    path-key: ^3.1.0
    shebang-command: ^2.0.0
    which: ^2.0.1
-  checksum: 671cc7c7288c3a8406f3c69a3ae2fc85555c04169e9d611def9a675635472614f1c0ed0ef80955d5b6d4e724f6ced67f0ad1bb006c2ea643488fcfef994d7f52
-  languageName: node
-  linkType: hard
-
-"crypto@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "crypto@npm:1.0.1"
-  checksum: 087fe3165bd94c333a49e6ed66a0193911f63eac38a24f379b3001a5fe260a59c413646e53a0f67875ba13902b2686d81dc703cb2c147a4ec727dcdc04e5645e
+  checksum: 8d306efacaf6f3f60e0224c287664093fa9185680b2d195852ba9a863f85d02dcc737094c6e512175f8ee0161f9b87c73c6826034c2422e39de7d6569cf4503b
  languageName: node
  linkType: hard

@@ -3429,10 +3450,10 @@ __metadata:
  languageName: node
  linkType: hard

-"csv-parse@npm:^5.5.6":
-  version: 5.5.6
-  resolution: "csv-parse@npm:5.5.6"
-  checksum: ee06f97f674487dc1d001b360de8ea510a41b9d971abf43bcf9c3be22c83a3634df0d3ebfbe52fd49d145077066be7ff9f25de3fc6b71aefb973099b04147a25
+"csv-parse@npm:^5.6.0":
+  version: 5.6.0
+  resolution: "csv-parse@npm:5.6.0"
+  checksum: 173e176bdaf212bab37d0f6d39a06d039d24a1c0ee40b9f1023ebf8b36095934807deeb493c0fb58592b39b0682ccd0be5c9e8d2b137c08807e7031595ea7a51
  languageName: node
  linkType: hard

@@ -3658,18 +3679,6 @@ __metadata:
  languageName: node
  linkType: hard

-"dot-object@npm:^2.1.4":
-  version: 2.1.4
-  resolution: "dot-object@npm:2.1.4"
-  dependencies:
-    commander: ^4.0.0
-    glob: ^7.1.5
-  bin:
-    dot-object: bin/dot-object
-  checksum: d56842129dead664e75089f7f610518dfe4d9548cec1b5f9b5df35ae916efe21e05a3b999f926ee73906a270c60f9a255d53968aa0becc8cf45ad7678b3dc626
-  languageName: node
-  linkType: hard
-
 "dotenv@npm:^16.4.5":
  version: 16.4.5
  resolution: "dotenv@npm:16.4.5"
@@ -4702,20 +4711,6 @@ __metadata:
  languageName: node
  linkType: hard

-"glob@npm:^7.1.5":
-  version: 7.2.3
-  resolution: "glob@npm:7.2.3"
-  dependencies:
-    fs.realpath: ^1.0.0
-    inflight: ^1.0.4
-    inherits: 2
-    minimatch: ^3.1.1
-    once: ^1.3.0
-    path-is-absolute: ^1.0.0
-  checksum: 29452e97b38fa704dabb1d1045350fb2467cf0277e155aa9ff7077e90ad81d1ea9d53d3ee63bd37c05b09a065e90f16aec4a65f5b8de401d1dac40bc5605d133
-  languageName: node
-  linkType: hard
-
 "glob@npm:^8.0.1":
  version: 8.1.0
  resolution: "glob@npm:8.1.0"
@@ -6183,15 +6178,6 @@ __metadata:
  languageName: node
  linkType: hard

-"lower-case@npm:^2.0.2":
-  version: 2.0.2
-  resolution: "lower-case@npm:2.0.2"
-  dependencies:
-    tslib: ^2.0.3
-  checksum: 83a0a5f159ad7614bee8bf976b96275f3954335a84fad2696927f609ddae902802c4f3312d86668722e668bef41400254807e1d3a7f2e8c3eede79691aa1f010
-  languageName: node
-  linkType: hard
-
 "lru-cache@npm:^10.2.0":
  version: 10.2.0
  resolution: "lru-cache@npm:10.2.0"
@@ -6320,7 +6306,7 @@ __metadata:
  languageName: node
  linkType: hard

-"minimatch@npm:^3.0.4, minimatch@npm:^3.0.5, minimatch@npm:^3.1.1, minimatch@npm:^3.1.2":
+"minimatch@npm:^3.0.4, minimatch@npm:^3.0.5, minimatch@npm:^3.1.2":
  version: 3.1.2
  resolution: "minimatch@npm:3.1.2"
  dependencies:
@@ -6518,16 +6504,6 @@ __metadata:
  languageName: node
  linkType: hard

-"no-case@npm:^3.0.4":
-  version: 3.0.4
-  resolution: "no-case@npm:3.0.4"
-  dependencies:
-    lower-case: ^2.0.2
-    tslib: ^2.0.3
-  checksum: 0b2ebc113dfcf737d48dde49cfebf3ad2d82a8c3188e7100c6f375e30eafbef9e9124aadc3becef237b042fd5eb0aad2fd78669c20972d045bbe7fea8ba0be5c
-  languageName: node
-  linkType: hard
-
 "node-fetch@npm:^2.6.7":
  version: 2.6.7
  resolution: "node-fetch@npm:2.6.7"
@@ -6813,16 +6789,6 @@ __metadata:
  languageName: node
  linkType: hard

-"pascal-case@npm:^3.1.2":
-  version: 3.1.2
-  resolution: "pascal-case@npm:3.1.2"
-  dependencies:
-    no-case: ^3.0.4
-    tslib: ^2.0.3
-  checksum: ba98bfd595fc91ef3d30f4243b1aee2f6ec41c53b4546bfa3039487c367abaa182471dcfc830a1f9e1a0df00c14a370514fa2b3a1aacc68b15a460c31116873e
-  languageName: node
-  linkType: hard
-
 "path-exists@npm:^4.0.0":
  version: 4.0.0
  resolution: "path-exists@npm:4.0.0"
@@ -6861,13 +6827,6 @@ __metadata:
  languageName: node
  linkType: hard

-"path-to-regexp@npm:^6.2.0":
-  version: 6.3.0
-  resolution: "path-to-regexp@npm:6.3.0"
-  checksum: eca78602e6434a1b6799d511d375ec044e8d7e28f5a48aa5c28d57d8152fb52f3fc62fb1cfc5dfa2198e1f041c2a82ed14043d75740a2fe60e91b5089a153250
-  languageName: node
-  linkType: hard
-
 "path-type@npm:^4.0.0":
  version: 4.0.0
  resolution: "path-type@npm:4.0.0"
@@ -6939,15 +6898,6 @@ __metadata:
  languageName: node
  linkType: hard

-"prettier@npm:^2.5.1":
-  version: 2.8.8
-  resolution: "prettier@npm:2.8.8"
-  bin:
-    prettier: bin-prettier.js
-  checksum: b49e409431bf129dd89238d64299ba80717b57ff5a6d1c1a8b1a28b590d998a34e083fa13573bc732bb8d2305becb4c9a4407f8486c81fa7d55100eb08263cf8
-  languageName: node
-  linkType: hard
-
 "prettier@npm:^3.2.5":
  version: 3.2.5
  resolution: "prettier@npm:3.2.5"
@@ -7416,12 +7366,12 @@ __metadata:
  languageName: node
  linkType: hard

-"semver@npm:^7.6.3":
-  version: 7.6.3
-  resolution: "semver@npm:7.6.3"
+"semver@npm:^7.7.2":
+  version: 7.7.2
+  resolution: "semver@npm:7.7.2"
  bin:
    semver: bin/semver.js
-  checksum: 4110ec5d015c9438f322257b1c51fe30276e5f766a3f64c09edd1d7ea7118ecbc3f379f3b69032bacf13116dc7abc4ad8ce0d7e2bd642e26b0d271b56b61a7d8
+  checksum: dd94ba8f1cbc903d8eeb4dd8bf19f46b3deb14262b6717d0de3c804b594058ae785ef2e4b46c5c3b58733c99c83339068203002f9e37cfe44f7e2cc5e3d2f621
  languageName: node
  linkType: hard

@@ -8026,16 +7976,6 @@ __metadata:
  languageName: node
  linkType: hard

-"ts-poet@npm:^4.5.0":
-  version: 4.15.0
-  resolution: "ts-poet@npm:4.15.0"
-  dependencies:
-    lodash: ^4.17.15
-    prettier: ^2.5.1
-  checksum: 93490e8b5921e23ac65afdecc00b4dd53f3560d7d9c19778a3f0bd9a300ba7ca71585a989d564508313bc73e8c431413714d513ebca2d5c428f909ec36bcf6e9
-  languageName: node
-  linkType: hard
-
 "tsconfig-paths@npm:^3.15.0":
  version: 3.15.0
  resolution: "tsconfig-paths@npm:3.15.0"
@@ -8055,13 +7995,6 @@ __metadata:
  languageName: node
  linkType: hard

-"tslib@npm:^2.0.3, tslib@npm:^2.6.2":
-  version: 2.6.2
-  resolution: "tslib@npm:2.6.2"
-  checksum: 329ea56123005922f39642318e3d1f0f8265d1e7fcb92c633e0809521da75eeaca28d2cf96d7248229deb40e5c19adf408259f4b9640afd20d13aecc1430f3ad
-  languageName: node
-  linkType: hard
-
 "tslib@npm:^2.2.0":
  version: 2.6.0
  resolution: "tslib@npm:2.6.0"
@@ -8069,6 +8002,13 @@ __metadata:
  languageName: node
  linkType: hard

+"tslib@npm:^2.6.2":
+  version: 2.6.2
+  resolution: "tslib@npm:2.6.2"
+  checksum: 329ea56123005922f39642318e3d1f0f8265d1e7fcb92c633e0809521da75eeaca28d2cf96d7248229deb40e5c19adf408259f4b9640afd20d13aecc1430f3ad
+  languageName: node
+  linkType: hard
+
 "tunnel@npm:0.0.6, tunnel@npm:^0.0.6":
  version: 0.0.6
  resolution: "tunnel@npm:0.0.6"
@@ -8076,30 +8016,6 @@ __metadata:
  languageName: node
  linkType: hard

-"twirp-ts@npm:^2.5.0":
-  version: 2.5.0
-  resolution: "twirp-ts@npm:2.5.0"
-  dependencies:
-    "@protobuf-ts/plugin-framework": ^2.0.7
-    camel-case: ^4.1.2
-    dot-object: ^2.1.4
-    path-to-regexp: ^6.2.0
-    ts-poet: ^4.5.0
-    yaml: ^1.10.2
-  peerDependencies:
-    "@protobuf-ts/plugin": ^2.5.0
-    ts-proto: ^1.81.3
-  peerDependenciesMeta:
-    "@protobuf-ts/plugin":
-      optional: true
-    ts-proto:
-      optional: true
-  bin:
-    protoc-gen-twirp_ts: protoc-gen-twirp_ts
-  checksum: e7cf87d77ab4d2cd327c9d8307e82ff61afc5af56883aed5fb6ac7d57999b646945e11158be87c10f0340aeef2efde6eb896f2efd60599498f17b4f310d66e4f
-  languageName: node
-  linkType: hard
-
 "type-check@npm:^0.4.0, type-check@npm:~0.4.0":
  version: 0.4.0
  resolution: "type-check@npm:0.4.0"
@@ -8306,6 +8222,15 @@ __metadata:
  languageName: node
  linkType: hard

+"undici@npm:^5.28.5":
+  version: 5.29.0
+  resolution: "undici@npm:5.29.0"
+  dependencies:
+    "@fastify/busboy": ^2.0.0
+  checksum: a25b5462c1b6ffb974f5ffc492ffd64146a9983aad0cbda6fde65e2b22f6f1acd43f09beacc66cc47624a113bd0c684ffc60366102b6a21b038fbfafb7d75195
+  languageName: node
+  linkType: hard
+
 "unique-filename@npm:^2.0.0":
  version: 2.0.1
  resolution: "unique-filename@npm:2.0.1"
@@ -8371,15 +8296,6 @@ __metadata:
  languageName: node
  linkType: hard

-"uuid@npm:^3.3.2, uuid@npm:^3.3.3":
-  version: 3.4.0
-  resolution: "uuid@npm:3.4.0"
-  bin:
-    uuid: ./bin/uuid
-  checksum: 58de2feed61c59060b40f8203c0e4ed7fd6f99d42534a499f1741218a1dd0c129f4aa1de797bcf822c8ea5da7e4137aa3673431a96dae729047f7aca7b27866f
-  languageName: node
-  linkType: hard
-
 "uuid@npm:^8.3.0, uuid@npm:^8.3.2":
  version: 8.3.2
  resolution: "uuid@npm:8.3.2"
@@ -8597,13 +8513,6 @@ __metadata:
  languageName: node
  linkType: hard

-"yaml@npm:^1.10.2":
-  version: 1.10.2
-  resolution: "yaml@npm:1.10.2"
-  checksum: ce4ada136e8a78a0b08dc10b4b900936912d15de59905b2bf415b4d33c63df1d555d23acb2a41b23cf9fb5da41c256441afca3d6509de7247daa062fd2c5ea5f
-  languageName: node
-  linkType: hard
-
 "yargs-parser@npm:^21.0.1, yargs-parser@npm:^21.1.1":
  version: 21.1.1
  resolution: "yargs-parser@npm:21.1.1"