Merge pull request #751 from crazy-max/yarn-update

update yarn to 4.9.2
2025-08-06 12:57:49 +02:00 · 2025-08-06 12:41:29 +02:00 · 2025-08-06 12:04:41 +02:00 · 2025-08-06 11:39:14 +02:00 · 2025-08-06 11:39:14 +02:00 · 2025-08-06 11:39:13 +02:00
52 changed files with 11106 additions and 4449 deletions
--- a/.github/buildx-lab-releases.json
+++ b/.github/buildx-lab-releases.json
--- a/.github/buildx-releases.json
+++ b/.github/buildx-releases.json
--- a/.github/compose-lab-releases.json
+++ b/.github/compose-lab-releases.json
--- a/.github/compose-releases.json
+++ b/.github/compose-releases.json
--- a/.github/docker-releases.json
+++ b/.github/docker-releases.json
@@ -1,14 +1,170 @@
 {
  "latest": {
-    "id": 196137348,
-    "tag_name": "v27.5.1",
-    "html_url": "https://github.com/moby/moby/releases/tag/v27.5.1",
+    "id": 235196329,
+    "tag_name": "v28.3.3",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.3.3",
+    "assets": []
+  },
+  "v28.3.3": {
+    "id": 235196329,
+    "tag_name": "v28.3.3",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.3.3",
+    "assets": []
+  },
+  "v25.0.12": {
+    "id": 232634573,
+    "tag_name": "v25.0.12",
+    "html_url": "https://github.com/moby/moby/releases/tag/v25.0.12",
+    "assets": []
+  },
+  "v28.3.2": {
+    "id": 231184033,
+    "tag_name": "v28.3.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.3.2",
+    "assets": []
+  },
+  "v28.3.1": {
+    "id": 229534501,
+    "tag_name": "v28.3.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.3.1",
+    "assets": []
+  },
+  "v28.3.0": {
+    "id": 227302240,
+    "tag_name": "v28.3.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.3.0",
    "assets": []
  },
  "edge": {
-    "id": 201046359,
-    "tag_name": "v28.0.0-rc.3",
-    "html_url": "https://github.com/moby/moby/releases/tag/v28.0.0-rc.3",
+    "id": 235196329,
+    "tag_name": "v28.3.3",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.3.3",
+    "assets": []
+  },
+  "v28.3.0-rc.2": {
+    "id": 226745561,
+    "tag_name": "v28.3.0-rc.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.3.0-rc.2",
+    "assets": []
+  },
+  "v25.0.11": {
+    "id": 226304708,
+    "tag_name": "v25.0.11",
+    "html_url": "https://github.com/moby/moby/releases/tag/v25.0.11",
+    "assets": []
+  },
+  "v28.3.0-rc.1": {
+    "id": 225132759,
+    "tag_name": "v28.3.0-rc.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.3.0-rc.1",
+    "assets": []
+  },
+  "v28.2.2": {
+    "id": 222034216,
+    "tag_name": "v28.2.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.2.2",
+    "assets": []
+  },
+  "v28.2.1": {
+    "id": 221664376,
+    "tag_name": "v28.2.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.2.1",
+    "assets": []
+  },
+  "v28.2.0": {
+    "id": 221225663,
+    "tag_name": "v28.2.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.2.0",
+    "assets": []
+  },
+  "v28.2.0-rc.2": {
+    "id": 220155575,
+    "tag_name": "v28.2.0-rc.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.2.0-rc.2",
+    "assets": []
+  },
+  "v28.2.0-rc.1": {
+    "id": 218898330,
+    "tag_name": "v28.2.0-rc.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.2.0-rc.1",
+    "assets": []
+  },
+  "v25.0.10": {
+    "id": 218958962,
+    "tag_name": "v25.0.10",
+    "html_url": "https://github.com/moby/moby/releases/tag/v25.0.10",
+    "assets": []
+  },
+  "v25.0.9": {
+    "id": 218957753,
+    "tag_name": "v25.0.9",
+    "html_url": "https://github.com/moby/moby/releases/tag/v25.0.9",
+    "assets": []
+  },
+  "v23.0.18": {
+    "id": 218962082,
+    "tag_name": "v23.0.18",
+    "html_url": "https://github.com/moby/moby/releases/tag/v23.0.18",
+    "assets": []
+  },
+  "v23.0.17": {
+    "id": 218961915,
+    "tag_name": "v23.0.17",
+    "html_url": "https://github.com/moby/moby/releases/tag/v23.0.17",
+    "assets": []
+  },
+  "v28.1.1": {
+    "id": 213296967,
+    "tag_name": "v28.1.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.1.1",
+    "assets": []
+  },
+  "v28.1.0": {
+    "id": 213053128,
+    "tag_name": "v28.1.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.1.0",
+    "assets": []
+  },
+  "v28.1.0-rc.2": {
+    "id": 212786864,
+    "tag_name": "v28.1.0-rc.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.1.0-rc.2",
+    "assets": []
+  },
+  "v28.1.0-rc.1": {
+    "id": 211865941,
+    "tag_name": "v28.1.0-rc.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.1.0-rc.1",
+    "assets": []
+  },
+  "v28.0.4": {
+    "id": 208163246,
+    "tag_name": "v28.0.4",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.0.4",
+    "assets": []
+  },
+  "v28.0.3": {
+    "id": 208121902,
+    "tag_name": "v28.0.3",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.0.3",
+    "assets": []
+  },
+  "v28.0.2": {
+    "id": 205678192,
+    "tag_name": "v28.0.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.0.2",
+    "assets": []
+  },
+  "v28.0.1": {
+    "id": 202550735,
+    "tag_name": "v28.0.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.0.1",
+    "assets": []
+  },
+  "v28.0.0": {
+    "id": 201152110,
+    "tag_name": "v28.0.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.0.0",
    "assets": []
  },
  "v28.0.0-rc.3": {
--- a/.github/regclient-releases.json
+++ b/.github/regclient-releases.json
--- a/.github/undock-releases.json
+++ b/.github/undock-releases.json
@@ -1,46 +1,90 @@
 {
  "latest": {
-    "id": 192171889,
-    "tag_name": "v0.9.0",
-    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.9.0",
+    "id": 213293369,
+    "tag_name": "v0.10.0",
+    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.10.0",
    "assets": [
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/checksums.txt",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_darwin_amd64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_darwin_amd64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_darwin_amd64.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_darwin_arm64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_darwin_arm64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_darwin_arm64.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_amd64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_amd64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_amd64.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_arm64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_arm64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_arm64.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv5.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv5.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv5.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv6.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv6.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv6.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv7.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv7.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv7.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_ppc64le.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_ppc64le.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_ppc64le.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_riscv64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_riscv64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_riscv64.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_s390x.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_s390x.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_s390x.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_windows_amd64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_windows_amd64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_windows_amd64.zip",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_windows_arm64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_windows_arm64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_windows_arm64.zip"
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/checksums.txt",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv5.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv5.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv5.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv6.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv6.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv6.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv7.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv7.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv7.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_ppc64le.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_ppc64le.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_ppc64le.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_riscv64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_riscv64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_riscv64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_s390x.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_s390x.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_s390x.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_amd64.zip",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_arm64.zip"
+    ]
+  },
+  "v0.10.0": {
+    "id": 213293369,
+    "tag_name": "v0.10.0",
+    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.10.0",
+    "assets": [
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/checksums.txt",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv5.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv5.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv5.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv6.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv6.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv6.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv7.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv7.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv7.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_ppc64le.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_ppc64le.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_ppc64le.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_riscv64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_riscv64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_riscv64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_s390x.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_s390x.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_s390x.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_amd64.zip",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_arm64.zip"
    ]
  },
  "v0.9.0": {
@@ -153,47 +197,47 @@
    ]
  },
  "edge": {
-    "id": 192171889,
-    "tag_name": "v0.9.0",
-    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.9.0",
+    "id": 213293369,
+    "tag_name": "v0.10.0",
+    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.10.0",
    "assets": [
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/checksums.txt",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_darwin_amd64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_darwin_amd64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_darwin_amd64.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_darwin_arm64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_darwin_arm64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_darwin_arm64.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_amd64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_amd64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_amd64.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_arm64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_arm64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_arm64.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv5.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv5.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv5.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv6.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv6.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv6.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv7.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv7.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv7.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_ppc64le.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_ppc64le.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_ppc64le.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_riscv64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_riscv64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_riscv64.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_s390x.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_s390x.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_s390x.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_windows_amd64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_windows_amd64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_windows_amd64.zip",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_windows_arm64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_windows_arm64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_windows_arm64.zip"
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/checksums.txt",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv5.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv5.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv5.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv6.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv6.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv6.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv7.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv7.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv7.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_ppc64le.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_ppc64le.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_ppc64le.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_riscv64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_riscv64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_riscv64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_s390x.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_s390x.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_s390x.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_amd64.zip",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_arm64.zip"
    ]
  },
  "v0.7.0-rc.1": {
--- a/.github/workflows/buildx-lab-releases-json.yml
+++ b/.github/workflows/buildx-lab-releases-json.yml
@@ -25,7 +25,7 @@ jobs:
    secrets: inherit

  open-pr:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    if: github.event_name != 'pull_request'
    needs:
      - generate
--- a/.github/workflows/buildx-releases-json.yml
+++ b/.github/workflows/buildx-releases-json.yml
@@ -25,7 +25,7 @@ jobs:
    secrets: inherit

  open-pr:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    if: github.event_name != 'pull_request'
    needs:
      - generate
--- a/.github/workflows/compose-lab-releases-json.yml
+++ b/.github/workflows/compose-lab-releases-json.yml
@@ -25,7 +25,7 @@ jobs:
    secrets: inherit

  open-pr:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    if: github.event_name != 'pull_request'
    needs:
      - generate
--- a/.github/workflows/compose-releases-json.yml
+++ b/.github/workflows/compose-releases-json.yml
@@ -25,7 +25,7 @@ jobs:
    secrets: inherit

  open-pr:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    if: github.event_name != 'pull_request'
    needs:
      - generate
--- a/.github/workflows/docker-releases-json.yml
+++ b/.github/workflows/docker-releases-json.yml
@@ -25,7 +25,7 @@ jobs:
    secrets: inherit

  open-pr:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    if: github.event_name != 'pull_request'
    needs:
      - generate
--- a/.github/workflows/pr-assign-author.yml
+++ b/.github/workflows/pr-assign-author.yml
@@ -0,0 +1,17 @@
+name: pr-assign-author
+
+permissions:
+  contents: read
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+
+jobs:
+  run:
+    uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@1b673f36fad86812f538c1df9794904038a23cbf
+    permissions:
+      contents: read
+      pull-requests: write
--- a/.github/workflows/regclient-releases-json.yml
+++ b/.github/workflows/regclient-releases-json.yml
@@ -0,0 +1,58 @@
+name: regclient-releases-json
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 */12 * * *'
+  push:
+    branches:
+      - 'main'
+  pull_request:
+    paths:
+      - '.github/workflows/regclient-releases-json.yml'
+
+jobs:
+  generate:
+    uses: crazy-max/.github/.github/workflows/releases-json.yml@7f83a5a887650a38e4d0e05d5262309cfaa31459
+    with:
+      repository: regclient/regclient
+      artifact_name: regclient-releases-json
+      filename: regclient-releases.json
+    secrets: inherit
+
+  open-pr:
+    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request'
+    needs:
+      - generate
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+      -
+        name: Download
+        uses: actions/download-artifact@v4
+        with:
+          name: regclient-releases-json
+          path: .github
+      -
+        name: Commit changes
+        run: |
+          git add -A .
+      -
+        name: Create PR
+        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f  # v7.0.5
+        with:
+          base: main
+          branch: bot/regclient-releases-json
+          commit-message: "github: update .github/regclient-releases.json"
+          signoff: true
+          delete-branch: true
+          title: "Update `.github/regclient-releases.json`"
+          body: |
+            Update `.github/regclient-releases.json` to keep in sync with [https://github.com/regclient/regclient](https://github.com/regclient/regclient).
+          draft: false
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -16,7 +16,7 @@ on:
 env:
  NODE_VERSION: "20"
  BUILDX_VERSION: "edge"
-  BUILDKIT_IMAGE: "moby/buildkit:v0.19.0"
+  BUILDKIT_IMAGE: "moby/buildkit:v0.23.2"

 jobs:
  test:
@@ -26,15 +26,19 @@ jobs:
      matrix:
        os:
          - ubuntu-latest
-          - ubuntu-22.04-arm
+          - ubuntu-24.04-arm
        node_version:
          - 20
          - 18
    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
      -
        name: Test
        uses: docker/bake-action@v6
        with:
+          source: .
          targets: test-coverage
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -101,19 +105,23 @@ jobs:
            });
            await core.group(`Set includes`, async () => {
              let includes = [];
-              for (const os of ['ubuntu-latest', 'ubuntu-22.04-arm', 'macos-13', 'windows-latest']) {
+              for (const os of ['ubuntu-latest', 'ubuntu-24.04-arm', 'macos-13', 'windows-latest']) {
                for (const test of tests) {
                  if (test === 'docker/install.test.itg.ts') {
-                    includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'image', docker_install_version: '27.3.1' });
-                    includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'image', docker_install_version: 'master' });
-                    includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'image', docker_install_version: 'latest' });
+                    if (os !== 'windows-latest') {
+                      includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'image', docker_install_version: '27.3.1' });
+                      includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'image', docker_install_version: 'master' });
+                      includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'image', docker_install_version: 'latest' });
+                    }
                    includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'archive', docker_install_version: 'v26.1.4' });
                    includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'archive', docker_install_version: 'latest' });
                    if (os === 'ubuntu-latest') {
                      includes.push({ os: os, test: test, test_name: 'rootless', docker_install_type: 'image', docker_install_version: 'latest' });
                      includes.push({ os: os, test: test, test_name: 'rootless', docker_install_type: 'archive', docker_install_version: 'latest' });
                    }
-                    includes.push({ os: os, test: test, test_name: 'tcp', docker_install_type: 'image', docker_install_version: 'latest' });
+                    if (os !== 'windows-latest') {
+                      includes.push({ os: os, test: test, test_name: 'tcp', docker_install_type: 'image', docker_install_version: 'latest' });
+                    }
                    includes.push({ os: os, test: test, test_name: 'tcp', docker_install_type: 'archive', docker_install_version: 'latest' });
                  } else {
                    includes.push({ os: os, test: test });
--- a/.github/workflows/undock-releases-json.yml
+++ b/.github/workflows/undock-releases-json.yml
@@ -25,7 +25,7 @@ jobs:
    secrets: inherit

  open-pr:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    if: github.event_name != 'pull_request'
    needs:
      - generate
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -15,7 +15,7 @@ on:

 jobs:
  prepare:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
    outputs:
      targets: ${{ steps.generate.outputs.targets }}
    steps:
--- a/.github/workflows/virtual-env.yml
+++ b/.github/workflows/virtual-env.yml
@@ -23,7 +23,6 @@ jobs:
          - ubuntu-latest
          - ubuntu-24.04
          - ubuntu-22.04
-          - ubuntu-20.04
          - ubuntu-24.04-arm
          - ubuntu-22.04-arm
    steps:
--- a/.yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs
+++ b/.yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs
--- a/.yarnrc.yml
+++ b/.yarnrc.yml
@@ -1,3 +1,9 @@
+# https://yarnpkg.com/configuration/yarnrc
+
+compressionLevel: mixed
+enableGlobalCache: false
+enableHardenedMode: true
+
 logFilters:
  - code: YN0013
    level: discard
@@ -5,11 +11,9 @@ logFilters:
    level: discard
  - code: YN0076
    level: discard
+  - code: YN0086
+    level: discard

 nodeLinker: node-modules

 npmAuthToken: "${NODE_AUTH_TOKEN:-fallback}"
-
-plugins:
-  - path: .yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs
-    spec: "@yarnpkg/plugin-interactive-tools"
--- a/tests/.fixtures/inspect12.txt
+++ b/tests/.fixtures/inspect12.txt
@@ -0,0 +1,55 @@
+Name:          nvidia
+Driver:        docker-container
+Last Activity: 2025-02-14 15:57:45 +0000 UTC
+
+Nodes:
+Name:                  nvidia0
+Endpoint:              unix:///var/run/docker.sock
+Driver Options:        image="moby/buildkit:local"
+Status:                running
+BuildKit daemon flags: --allow-insecure-entitlement=network.host
+BuildKit version:      v0.20.0-rc2-4-gd30d8e22c.m
+Platforms:             linux/amd64, linux/amd64/v2, linux/amd64/v3, linux/arm64, linux/riscv64, linux/ppc64le, linux/s390x, linux/386, linux/arm/v7, linux/arm/v6
+Features:
+ Cache export:         true
+ Docker exporter:      true
+ Multi-platform build: true
+ OCI exporter:         true
+Labels:
+ org.mobyproject.buildkit.worker.executor:         oci
+ org.mobyproject.buildkit.worker.hostname:         76ac9a510d96
+ org.mobyproject.buildkit.worker.network:          host
+ org.mobyproject.buildkit.worker.oci.process-mode: sandbox
+ org.mobyproject.buildkit.worker.selinux.enabled:  false
+ org.mobyproject.buildkit.worker.snapshotter:      overlayfs
+Devices:
+ Name:                  nvidia.com/gpu=all
+ Automatically allowed: true
+ Annotations:
+  foo:                                       bar
+  org.mobyproject.buildkit.device.autoallow: true
+ Name:                  docker.com/gpu=venus
+ Automatically allowed: false
+ Annotations:
+  bar:                                       baz
+GC Policy rule#0:
+ All:            false
+ Filters:        type==source.local,type==exec.cachemount,type==source.git.checkout
+ Keep Duration:  48h0m0s
+ Max Used Space: 488.3MiB
+GC Policy rule#1:
+ All:            false
+ Keep Duration:  1440h0m0s
+ Reserved Space: 9.313GiB
+ Max Used Space: 93.13GiB
+ Min Free Space: 188.1GiB
+GC Policy rule#2:
+ All:            false
+ Reserved Space: 9.313GiB
+ Max Used Space: 93.13GiB
+ Min Free Space: 188.1GiB
+GC Policy rule#3:
+ All:            true
+ Reserved Space: 9.313GiB
+ Max Used Space: 93.13GiB
+ Min Free Space: 188.1GiB
--- a/tests/buildx/builder.test.ts
+++ b/tests/buildx/builder.test.ts
@@ -466,6 +466,89 @@ baz = qux
       ]
     }
    ],
+    [
+     'inspect12.txt',
+     {
+       "name": "nvidia",
+       "driver": "docker-container",
+       "lastActivity": new Date("2025-02-14T15:57:45.000Z"),
+       "nodes": [
+         {
+           "buildkit": "v0.20.0-rc2-4-gd30d8e22c.m",
+           "buildkitd-flags": "--allow-insecure-entitlement=network.host",
+           "driver-opts": [
+             "image=moby/buildkit:local",
+           ],
+           "endpoint": "unix:///var/run/docker.sock",
+           "name": "nvidia0",
+           "platforms": "linux/amd64,linux/amd64/v2,linux/amd64/v3,linux/arm64,linux/riscv64,linux/ppc64le,linux/s390x,linux/386,linux/arm/v7,linux/arm/v6",
+           "status": "running",
+           "features": {
+             "Cache export": true,
+             "Docker exporter": true,
+             "Multi-platform build": true,
+             "OCI exporter": true,
+           },
+           "labels": {
+             "org.mobyproject.buildkit.worker.executor": "oci",
+             "org.mobyproject.buildkit.worker.hostname": "76ac9a510d96",
+             "org.mobyproject.buildkit.worker.network": "host",
+             "org.mobyproject.buildkit.worker.oci.process-mode": "sandbox",
+             "org.mobyproject.buildkit.worker.selinux.enabled": "false",
+             "org.mobyproject.buildkit.worker.snapshotter": "overlayfs",
+           },
+           "devices": [
+             {
+               "annotations": {
+                 "foo": "bar",
+                 "org.mobyproject.buildkit.device.autoallow": "true"
+               },
+               "autoAllow": true,
+               "name": "nvidia.com/gpu=all"
+             },
+             {
+               "annotations": {
+                 "bar": "baz"
+               },
+               "autoAllow": false,
+               "name": "docker.com/gpu=venus"
+             }
+           ],
+           "gcPolicy": [
+             {
+               "all": false,
+               "filter": [
+                 "type==source.local",
+                 "type==exec.cachemount",
+                 "type==source.git.checkout"
+               ],
+               "keepDuration": "48h0m0s",
+               "maxUsedSpace": "488.3MiB",
+             },
+             {
+               "all": false,
+               "keepDuration": "1440h0m0s",
+               "maxUsedSpace": "93.13GiB",
+               "minFreeSpace": "188.1GiB",
+               "reservedSpace": "9.313GiB",
+             },
+             {
+               "all": false,
+               "maxUsedSpace": "93.13GiB",
+               "minFreeSpace": "188.1GiB",
+               "reservedSpace": "9.313GiB",
+             },
+             {
+               "all": true,
+               "maxUsedSpace": "93.13GiB",
+               "minFreeSpace": "188.1GiB",
+               "reservedSpace": "9.313GiB",
+             }
+           ]
+         }
+       ]
+     }
+    ],
  ])('given %p', async (inspectFile, expected) => {
    expect(await Builder.parseInspect(fs.readFileSync(path.join(fixturesDir, inspectFile)).toString())).toEqual(expected);
  });
--- a/tests/buildx/history.test.itg.ts
+++ b/tests/buildx/history.test.itg.ts
@@ -14,7 +14,7 @@
 * limitations under the License.
 */

-import {afterEach, beforeEach, describe, expect, it, jest, test} from '@jest/globals';
+import {describe, expect, it, test} from '@jest/globals';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
@@ -30,7 +30,49 @@ const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'buildx

 const maybe = !process.env.GITHUB_ACTIONS || (process.env.GITHUB_ACTIONS === 'true' && process.env.ImageOS && process.env.ImageOS.startsWith('ubuntu')) ? describe : describe.skip;

-maybe('exportBuild', () => {
+maybe('inspect', () => {
+  it('build', async () => {
+    const buildx = new Buildx();
+    const build = new Build({buildx: buildx});
+
+    fs.mkdirSync(tmpDir, {recursive: true});
+    await expect(
+      (async () => {
+        // prettier-ignore
+        const buildCmd = await buildx.getCommand([
+          '--builder', process.env.CTN_BUILDER_NAME ?? 'default',
+          'build', '-f', path.join(fixturesDir, 'hello.Dockerfile'),
+          '--metadata-file', build.getMetadataFilePath(),
+          fixturesDir
+        ]);
+        await Exec.exec(buildCmd.command, buildCmd.args);
+      })()
+    ).resolves.not.toThrow();
+
+    const metadata = build.resolveMetadata();
+    expect(metadata).toBeDefined();
+    const buildRef = build.resolveRef(metadata);
+    if (!buildRef) {
+      throw new Error('buildRef is undefined');
+    }
+    const [builderName, nodeName, ref] = buildRef.split('/');
+    expect(builderName).toBeDefined();
+    expect(nodeName).toBeDefined();
+    expect(ref).toBeDefined();
+
+    const history = new History({buildx: buildx});
+    const res = await history.inspect({
+      ref: ref,
+      builder: builderName
+    });
+
+    expect(res).toBeDefined();
+    expect(res?.Name).toBeDefined();
+    expect(res?.Ref).toBeDefined();
+  });
+});
+
+maybe('export', () => {
  // prettier-ignore
  test.each([
    [
@@ -50,7 +92,7 @@ maybe('exportBuild', () => {
        fixturesDir
      ],
    ]
-  ])('export build %p', async (_, bargs) => {
+  ])('export with build %p', async (_, bargs) => {
    const buildx = new Buildx();
    const build = new Build({buildx: buildx});

@@ -110,7 +152,7 @@ maybe('exportBuild', () => {
        'hello-matrix'
      ],
    ]
-  ])('export bake build %p', async (_, bargs) => {
+  ])('export with bake %p', async (_, bargs) => {
    const buildx = new Buildx();
    const bake = new Bake({buildx: buildx});

@@ -145,22 +187,8 @@ maybe('exportBuild', () => {
    expect(fs.existsSync(exportRes?.dockerbuildFilename)).toBe(true);
    expect(exportRes?.summaries).toBeDefined();
  });
-});

-maybe('exportBuild custom image', () => {
-  const originalEnv = process.env;
-  beforeEach(() => {
-    jest.resetModules();
-    process.env = {
-      ...originalEnv,
-      DOCKER_BUILD_EXPORT_BUILD_IMAGE: 'docker.io/dockereng/export-build:0.2.2'
-    };
-  });
-  afterEach(() => {
-    process.env = originalEnv;
-  });
-
-  it('with custom image', async () => {
+  it('export using container', async () => {
    const buildx = new Buildx();
    const build = new Build({buildx: buildx});

@@ -185,7 +213,8 @@ maybe('exportBuild custom image', () => {

    const history = new History({buildx: buildx});
    const exportRes = await history.export({
-      refs: [buildRef ?? '']
+      refs: [buildRef ?? ''],
+      useContainer: true
    });

    expect(exportRes).toBeDefined();
--- a/tests/buildx/install.test.ts
+++ b/tests/buildx/install.test.ts
@@ -37,19 +37,17 @@ describe('download', () => {
    ['latest', true]
  ])(
  'acquires %p of buildx (standalone: %p)', async (version, standalone) => {
-      const install = new Install({standalone: standalone});
-      const toolPath = await install.download(version);
-      expect(fs.existsSync(toolPath)).toBe(true);
-      let buildxBin: string;
-      if (standalone) {
-        buildxBin = await install.installStandalone(toolPath, tmpDir);
-      } else {
-        buildxBin = await install.installPlugin(toolPath, tmpDir);
-      }
-      expect(fs.existsSync(buildxBin)).toBe(true);
-    },
-    100000
-  );
+    const install = new Install({standalone: standalone});
+    const toolPath = await install.download(version);
+    expect(fs.existsSync(toolPath)).toBe(true);
+    let buildxBin: string;
+    if (standalone) {
+      buildxBin = await install.installStandalone(toolPath, tmpDir);
+    } else {
+      buildxBin = await install.installPlugin(toolPath, tmpDir);
+    }
+    expect(fs.existsSync(buildxBin)).toBe(true);
+  }, 100000);

  // prettier-ignore
  test.each([
@@ -57,26 +55,22 @@ describe('download', () => {
    ['v0.9.0'],
    ['v0.10.5'],
  ])(
-    'acquires %p of buildx with cache', async (version) => {
-      const install = new Install({standalone: false});
-      const toolPath = await install.download(version);
-      expect(fs.existsSync(toolPath)).toBe(true);
-    },
-    100000
-  );
+  'acquires %p of buildx with cache', async (version) => {
+    const install = new Install({standalone: false});
+    const toolPath = await install.download(version);
+    expect(fs.existsSync(toolPath)).toBe(true);
+  }, 100000);

  // prettier-ignore
  test.each([
    ['v0.11.2'],
    ['v0.12.0'],
  ])(
-    'acquires %p of buildx without cache', async (version) => {
-      const install = new Install({standalone: false});
-      const toolPath = await install.download(version, true);
-      expect(fs.existsSync(toolPath)).toBe(true);
-    },
-    100000
-  );
+  'acquires %p of buildx without cache', async (version) => {
+    const install = new Install({standalone: false});
+    const toolPath = await install.download(version, true);
+    expect(fs.existsSync(toolPath)).toBe(true);
+  }, 100000);

  // TODO: add tests for arm
  // prettier-ignore
@@ -90,15 +84,13 @@ describe('download', () => {
    ['linux', 'ppc64'],
    ['linux', 's390x'],
  ])(
-    'acquires buildx for %s/%s', async (os, arch) => {
-      jest.spyOn(osm, 'platform').mockImplementation(() => os as NodeJS.Platform);
-      jest.spyOn(osm, 'arch').mockImplementation(() => arch);
-      const install = new Install();
-      const buildxBin = await install.download('latest');
-      expect(fs.existsSync(buildxBin)).toBe(true);
-    },
-    100000
-  );
+  'acquires buildx for %s/%s', async (os, arch) => {
+    jest.spyOn(osm, 'platform').mockImplementation(() => os as NodeJS.Platform);
+    jest.spyOn(osm, 'arch').mockImplementation(() => arch);
+    const install = new Install();
+    const buildxBin = await install.download('latest');
+    expect(fs.existsSync(buildxBin)).toBe(true);
+  }, 100000);
 });

 describe('build', () => {
--- a/tests/compose/install.test.ts
+++ b/tests/compose/install.test.ts
@@ -36,20 +36,18 @@ describe('download', () => {
    ['v2.32.4', true],
    ['latest', true]
  ])(
-    'acquires %p of compose (standalone: %p)', async (version, standalone) => {
-      const install = new Install({standalone: standalone});
-      const toolPath = await install.download(version);
-      expect(fs.existsSync(toolPath)).toBe(true);
-      let composeBin: string;
-      if (standalone) {
-        composeBin = await install.installStandalone(toolPath, tmpDir);
-      } else {
-        composeBin = await install.installPlugin(toolPath, tmpDir);
-      }
-      expect(fs.existsSync(composeBin)).toBe(true);
-    },
-    100000
-  );
+  'acquires %p of compose (standalone: %p)', async (version, standalone) => {
+    const install = new Install({standalone: standalone});
+    const toolPath = await install.download(version);
+    expect(fs.existsSync(toolPath)).toBe(true);
+    let composeBin: string;
+    if (standalone) {
+      composeBin = await install.installStandalone(toolPath, tmpDir);
+    } else {
+      composeBin = await install.installPlugin(toolPath, tmpDir);
+    }
+    expect(fs.existsSync(composeBin)).toBe(true);
+  }, 100000);

  // prettier-ignore
  test.each([
@@ -57,26 +55,22 @@ describe('download', () => {
    ['v2.31.0'],
    ['v2.32.4'],
  ])(
-    'acquires %p of compose with cache', async (version) => {
-      const install = new Install({standalone: false});
-      const toolPath = await install.download(version);
-      expect(fs.existsSync(toolPath)).toBe(true);
-    },
-    100000
-  );
+  'acquires %p of compose with cache', async (version) => {
+    const install = new Install({standalone: false});
+    const toolPath = await install.download(version);
+    expect(fs.existsSync(toolPath)).toBe(true);
+  }, 100000);

  // prettier-ignore
  test.each([
    ['v2.27.1'],
    ['v2.28.0'],
  ])(
-    'acquires %p of compose without cache', async (version) => {
-      const install = new Install({standalone: false});
-      const toolPath = await install.download(version, true);
-      expect(fs.existsSync(toolPath)).toBe(true);
-    },
-    100000
-  );
+  'acquires %p of compose without cache', async (version) => {
+    const install = new Install({standalone: false});
+    const toolPath = await install.download(version, true);
+    expect(fs.existsSync(toolPath)).toBe(true);
+  }, 100000);

  // TODO: add tests for arm
  // prettier-ignore
@@ -90,15 +84,13 @@ describe('download', () => {
    ['linux', 'ppc64'],
    ['linux', 's390x'],
  ])(
-    'acquires compose for %s/%s', async (os, arch) => {
-      jest.spyOn(osm, 'platform').mockImplementation(() => os as NodeJS.Platform);
-      jest.spyOn(osm, 'arch').mockImplementation(() => arch);
-      const install = new Install();
-      const composeBin = await install.download('latest');
-      expect(fs.existsSync(composeBin)).toBe(true);
-    },
-    100000
-  );
+  'acquires compose for %s/%s', async (os, arch) => {
+    jest.spyOn(osm, 'platform').mockImplementation(() => os as NodeJS.Platform);
+    jest.spyOn(osm, 'arch').mockImplementation(() => arch);
+    const install = new Install();
+    const composeBin = await install.download('latest');
+    expect(fs.existsSync(composeBin)).toBe(true);
+  }, 100000);
 });

 describe('getDownloadVersion', () => {
--- a/tests/docker/install.test.itg.ts
+++ b/tests/docker/install.test.itg.ts
@@ -14,17 +14,31 @@
 * limitations under the License.
 */

-import {describe, test, expect} from '@jest/globals';
+import {beforeAll, describe, test, expect} from '@jest/globals';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';

 import {Install, InstallSource, InstallSourceArchive, InstallSourceImage} from '../../src/docker/install';
 import {Docker} from '../../src/docker/docker';
+import {Regctl} from '../../src/regclient/regctl';
+import {Install as RegclientInstall} from '../../src/regclient/install';
+import {Undock} from '../../src/undock/undock';
+import {Install as UndockInstall} from '../../src/undock/install';
 import {Exec} from '../../src/exec';

 const tmpDir = () => fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'docker-install-itg-'));

+beforeAll(async () => {
+  const undockInstall = new UndockInstall();
+  const undockBinPath = await undockInstall.download('v0.10.0', true);
+  await undockInstall.install(undockBinPath);
+
+  const regclientInstall = new RegclientInstall();
+  const regclientBinPath = await regclientInstall.download('v0.8.2', true);
+  await regclientInstall.install(regclientBinPath);
+}, 100000);
+
 describe('root', () => {
  // prettier-ignore
  test.each(getSources(true))(
@@ -34,7 +48,9 @@ describe('root', () => {
        source: source,
        runDir: tmpDir(),
        contextName: 'foo',
-        daemonConfig: `{"debug":true,"features":{"containerd-snapshotter":true}}`
+        daemonConfig: `{"debug":true,"features":{"containerd-snapshotter":true}}`,
+        regctl: new Regctl(),
+        undock: new Undock()
      });
      await expect(tryInstall(install)).resolves.not.toThrow();
    }, 30 * 60 * 1000);
@@ -54,7 +70,9 @@ describe('rootless', () => {
        runDir: tmpDir(),
        contextName: 'foo',
        daemonConfig: `{"debug":true}`,
-        rootless: true
+        rootless: true,
+        regctl: new Regctl(),
+        undock: new Undock()
      });
      await expect(
        tryInstall(install, async () => {
@@ -79,7 +97,9 @@ describe('tcp', () => {
        runDir: tmpDir(),
        contextName: 'foo',
        daemonConfig: `{"debug":true}`,
-        localTCPPort: 2378
+        localTCPPort: 2378,
+        regctl: new Regctl(),
+        undock: new Undock()
      });
      await expect(
        tryInstall(install, async () => {
--- a/tests/docker/install.test.ts
+++ b/tests/docker/install.test.ts
@@ -22,6 +22,8 @@ import * as rimraf from 'rimraf';
 import osm = require('os');

 import {Install, InstallSourceArchive, InstallSourceImage} from '../../src/docker/install';
+import {Regctl} from '../../src/regclient/regctl';
+import {Undock} from '../../src/undock/undock';

 const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'docker-install-'));

@@ -64,6 +66,8 @@ describe('download', () => {
    const install = new Install({
      source: source,
      runDir: tmpDir,
+      regctl: new Regctl(),
+      undock: new Undock()
    });
    const toolPath = await install.download();
    expect(fs.existsSync(toolPath)).toBe(true);
--- a/tests/regclient/install.test.itg.ts
+++ b/tests/regclient/install.test.itg.ts
@@ -0,0 +1,38 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, test} from '@jest/globals';
+import * as fs from 'fs';
+
+import {Install} from '../../src/regclient/install';
+
+describe('download', () => {
+  // prettier-ignore
+  test.each(['latest'])(
+    'install regclient %s', async (version) => {
+      await expect((async () => {
+        const install = new Install();
+        const toolPath = await install.download(version);
+        if (!fs.existsSync(toolPath)) {
+          throw new Error('toolPath does not exist');
+        }
+        const binPath = await install.install(toolPath);
+        if (!fs.existsSync(binPath)) {
+          throw new Error('binPath does not exist');
+        }
+      })()).resolves.not.toThrow();
+    }, 60000);
+});
--- a/tests/regclient/install.test.ts
+++ b/tests/regclient/install.test.ts
@@ -0,0 +1,120 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, it, jest, test, afterEach} from '@jest/globals';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import * as rimraf from 'rimraf';
+import osm = require('os');
+
+import {Install} from '../../src/regclient/install';
+
+const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'regclient-install-'));
+
+afterEach(function () {
+  rimraf.sync(tmpDir);
+});
+
+describe('download', () => {
+  // prettier-ignore
+  test.each([
+    ['v0.8.2'],
+    ['latest']
+  ])(
+  'acquires %p of regclient', async (version) => {
+    const install = new Install();
+    const toolPath = await install.download(version);
+    expect(fs.existsSync(toolPath)).toBe(true);
+    const regclientBin = await install.install(toolPath, tmpDir);
+    expect(fs.existsSync(regclientBin)).toBe(true);
+  }, 100000);
+
+  // prettier-ignore
+  test.each([
+    // following versions are already cached to htc from previous test cases
+    ['v0.8.2'],
+  ])(
+  'acquires %p of regclient with cache', async (version) => {
+    const install = new Install();
+    const toolPath = await install.download(version);
+    expect(fs.existsSync(toolPath)).toBe(true);
+  }, 100000);
+
+  // prettier-ignore
+  test.each([
+    ['v0.8.1'],
+  ])(
+  'acquires %p of regclient without cache', async (version) => {
+    const install = new Install();
+    const toolPath = await install.download(version, true);
+    expect(fs.existsSync(toolPath)).toBe(true);
+  }, 100000);
+
+  // prettier-ignore
+  test.each([
+    ['win32', 'x64'],
+    ['darwin', 'x64'],
+    ['darwin', 'arm64'],
+    ['linux', 'x64'],
+    ['linux', 'arm64'],
+    ['linux', 'ppc64'],
+    ['linux', 's390x'],
+  ])(
+  'acquires regclient for %s/%s', async (os, arch) => {
+    jest.spyOn(osm, 'platform').mockImplementation(() => os as NodeJS.Platform);
+    jest.spyOn(osm, 'arch').mockImplementation(() => arch);
+    const install = new Install();
+    const regclientBin = await install.download('latest');
+    expect(fs.existsSync(regclientBin)).toBe(true);
+  }, 100000);
+});
+
+describe('getDownloadVersion', () => {
+  it('returns latest download version', async () => {
+    const version = await Install.getDownloadVersion('latest');
+    expect(version.version).toEqual('latest');
+    expect(version.downloadURL).toEqual('https://github.com/regclient/regclient/releases/download/v%s/%s');
+    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/regclient-releases.json');
+  });
+  it('returns v0.8.1 download version', async () => {
+    const version = await Install.getDownloadVersion('v0.8.1');
+    expect(version.version).toEqual('v0.8.1');
+    expect(version.downloadURL).toEqual('https://github.com/regclient/regclient/releases/download/v%s/%s');
+    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/regclient-releases.json');
+  });
+});
+
+describe('getRelease', () => {
+  it('returns latest GitHub release', async () => {
+    const version = await Install.getDownloadVersion('latest');
+    const release = await Install.getRelease(version);
+    expect(release).not.toBeNull();
+    expect(release?.tag_name).not.toEqual('');
+  });
+  it('returns v0.8.1 GitHub release', async () => {
+    const version = await Install.getDownloadVersion('v0.8.1');
+    const release = await Install.getRelease(version);
+    expect(release).not.toBeNull();
+    expect(release?.id).toEqual(199719231);
+    expect(release?.tag_name).toEqual('v0.8.1');
+    expect(release?.html_url).toEqual('https://github.com/regclient/regclient/releases/tag/v0.8.1');
+  });
+  it('unknown release', async () => {
+    const version = await Install.getDownloadVersion('foo');
+    await expect(Install.getRelease(version)).rejects.toThrow(new Error('Cannot find regclient release foo in https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/regclient-releases.json'));
+  });
+});
--- a/tests/regclient/regctl.test.ts
+++ b/tests/regclient/regctl.test.ts
@@ -0,0 +1,123 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, it, jest, test} from '@jest/globals';
+import * as semver from 'semver';
+
+import {Exec} from '../../src/exec';
+import {Regctl} from '../../src/regclient/regctl';
+
+import {Image} from '../../src/types/oci/config';
+
+describe('manifestGet', () => {
+  // prettier-ignore
+  test.each([
+    ['moby/moby-bin:28.1.0-rc.2'],
+    ['crazymax/diun:4.17.0'],
+  ])('given %p', async image => {
+    const regctl = new Regctl();
+    const manifest = await regctl.manifestGet({
+      image: image,
+    });
+    expect(manifest).not.toBeNull();
+    expect(manifest?.config).toBeDefined();
+    expect(manifest?.config.digest).not.toEqual('');
+    expect(manifest?.layers).toBeDefined();
+    expect(manifest?.layers.length).toBeGreaterThan(0);
+  }, 100000);
+});
+
+describe('blobGet', () => {
+  // prettier-ignore
+  test.each([
+    ['moby/moby-bin', 'sha256:234fccbd13fde0ba978a19f728cbdc67e29bc76247ac560822bb6ae5236c0bf0'],
+    ['crazymax/diun', 'sha256:1e4881f66e0ec0f1710b837002107050bbbc0a231d8a42d7f422b56a139900bb'],
+  ])('given %p', async (repo, digest) => {
+    const regctl = new Regctl();
+    const blob = await regctl.blobGet({
+      repository: repo,
+      digest: digest
+    });
+    expect(blob).toBeDefined();
+  }, 100000);
+});
+
+describe('image config', () => {
+  // prettier-ignore
+  test.each([
+    ['moby/moby-bin:28.1.0-rc.2'],
+    ['crazymax/diun:4.17.0'],
+  ])('given %p', async image => {
+    const regctl = new Regctl();
+    const manifest = await regctl.manifestGet({
+      image: image,
+    });
+    expect(manifest).not.toBeNull();
+    expect(manifest?.config).toBeDefined();
+    expect(manifest?.config.digest).not.toEqual('');
+    const blob = await regctl.blobGet({
+      repository: image, // image works as well
+      digest: manifest?.config.digest
+    });
+    const imageConfig = <Image>JSON.parse(blob);
+    expect(imageConfig).not.toBeNull();
+    expect(imageConfig.config).toBeDefined();
+    expect(imageConfig?.config?.Labels).toBeDefined();
+    expect(Object.keys(imageConfig?.config?.Labels || {}).length).toBeGreaterThan(0);
+  }, 100000);
+});
+
+describe('isAvailable', () => {
+  it('checks regctl is available', async () => {
+    const execSpy = jest.spyOn(Exec, 'getExecOutput');
+    const regctl = new Regctl();
+    await regctl.isAvailable();
+    // eslint-disable-next-line jest/no-standalone-expect
+    expect(execSpy).toHaveBeenCalledWith(`regctl`, [], {
+      silent: true,
+      ignoreReturnCode: true
+    });
+  });
+});
+
+describe('printVersion', () => {
+  it('prints regctl version', async () => {
+    const execSpy = jest.spyOn(Exec, 'exec');
+    const regctl = new Regctl();
+    await regctl.printVersion();
+    expect(execSpy).toHaveBeenCalledWith(`regctl`, ['version'], {
+      failOnStdErr: false
+    });
+  });
+});
+
+describe('version', () => {
+  it('valid', async () => {
+    const regctl = new Regctl();
+    expect(semver.valid(await regctl.version())).not.toBeUndefined();
+  });
+});
+
+describe('versionSatisfies', () => {
+  test.each([
+    ['v0.8.2', '>=0.6.0', true],
+    ['v0.8.0', '>0.6.0', true],
+    ['v0.8.0', '<0.3.0', false]
+  ])('given %p', async (version, range, expected) => {
+    const regctl = new Regctl();
+    expect(await regctl.versionSatisfies(range, version)).toBe(expected);
+  });
+});
--- a/tests/undock/install.test.ts
+++ b/tests/undock/install.test.ts
@@ -36,15 +36,13 @@ describe('download', () => {
    ['v0.7.0'],
    ['latest']
  ])(
-  'acquires %p of undock (standalone: %p)', async (version) => {
-      const install = new Install();
-      const toolPath = await install.download(version);
-      expect(fs.existsSync(toolPath)).toBe(true);
-      const undockBin = await install.install(toolPath, tmpDir);
-      expect(fs.existsSync(undockBin)).toBe(true);
-    },
-    100000
-  );
+  'acquires %p of undock', async (version) => {
+    const install = new Install();
+    const toolPath = await install.download(version);
+    expect(fs.existsSync(toolPath)).toBe(true);
+    const undockBin = await install.install(toolPath, tmpDir);
+    expect(fs.existsSync(undockBin)).toBe(true);
+  }, 100000);

  // prettier-ignore
  test.each([
@@ -56,7 +54,7 @@ describe('download', () => {
    const install = new Install();
    const toolPath = await install.download(version);
    expect(fs.existsSync(toolPath)).toBe(true);
-  });
+  }, 100000);

  // prettier-ignore
  test.each([
@@ -67,7 +65,7 @@ describe('download', () => {
    const install = new Install();
    const toolPath = await install.download(version, true);
    expect(fs.existsSync(toolPath)).toBe(true);
-  });
+  }, 100000);

  // TODO: add tests for arm
  // prettier-ignore
@@ -82,14 +80,12 @@ describe('download', () => {
    ['linux', 's390x'],
  ])(
  'acquires undock for %s/%s', async (os, arch) => {
-      jest.spyOn(osm, 'platform').mockImplementation(() => os as NodeJS.Platform);
-      jest.spyOn(osm, 'arch').mockImplementation(() => arch);
-      const install = new Install();
-      const undockBin = await install.download('latest');
-      expect(fs.existsSync(undockBin)).toBe(true);
-    },
-    100000
-  );
+    jest.spyOn(osm, 'platform').mockImplementation(() => os as NodeJS.Platform);
+    jest.spyOn(osm, 'arch').mockImplementation(() => arch);
+    const install = new Install();
+    const undockBin = await install.download('latest');
+    expect(fs.existsSync(undockBin)).toBe(true);
+  }, 100000);
 });

 describe('getDownloadVersion', () => {
--- a/tests/undock/undock.test.itg.ts
+++ b/tests/undock/undock.test.itg.ts
@@ -0,0 +1,47 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, it} from '@jest/globals';
+import fs from 'fs';
+import os from 'os';
+
+import {Undock} from '../../src/undock/undock';
+import {Install as UndockInstall} from '../../src/undock/install';
+
+describe('run', () => {
+  it('extracts moby/moby-bin:26.1.5', async () => {
+    const install = new UndockInstall();
+    const toolPath = await install.download('latest');
+    if (!fs.existsSync(toolPath)) {
+      throw new Error('toolPath does not exist');
+    }
+    const binPath = await install.install(toolPath);
+    if (!fs.existsSync(binPath)) {
+      throw new Error('binPath does not exist');
+    }
+
+    const undock = new Undock();
+    await expect(
+      (async () => {
+        // prettier-ignore
+        await undock.run({
+          source: 'docker/buildx-bin:0.23.0',
+          dist: os.tmpdir()
+        });
+      })()
+    ).resolves.not.toThrow();
+  }, 500000);
+});
--- a/tests/undock/undock.test.ts
+++ b/tests/undock/undock.test.ts
@@ -38,7 +38,7 @@ describe('run', () => {
        });
      })()
    ).resolves.not.toThrow();
-  }, 100000);
+  }, 500000);
 });

 describe('isAvailable', () => {
--- a/tests/util.test.ts
+++ b/tests/util.test.ts
@@ -469,6 +469,36 @@ describe('isPathRelativeTo', () => {
  });
 });

+describe('formatDuration', () => {
+  it('formats 0 nanoseconds as "0s"', () => {
+    expect(Util.formatDuration(0)).toBe('0s');
+  });
+  it('formats only seconds', () => {
+    expect(Util.formatDuration(5e9)).toBe('5s');
+    expect(Util.formatDuration(59e9)).toBe('59s');
+  });
+  it('formats minutes and seconds', () => {
+    expect(Util.formatDuration(65e9)).toBe('1m5s');
+    expect(Util.formatDuration(600e9)).toBe('10m');
+  });
+  it('formats hours, minutes, and seconds', () => {
+    expect(Util.formatDuration(3661e9)).toBe('1h1m1s');
+    expect(Util.formatDuration(7322e9)).toBe('2h2m2s');
+  });
+  it('formats hours only', () => {
+    expect(Util.formatDuration(3 * 3600e9)).toBe('3h');
+  });
+  it('formats hours and minutes', () => {
+    expect(Util.formatDuration(3900e9)).toBe('1h5m');
+  });
+  it('formats minutes only', () => {
+    expect(Util.formatDuration(120e9)).toBe('2m');
+  });
+  it('rounds down partial seconds', () => {
+    expect(Util.formatDuration(1799999999)).toBe('1s');
+  });
+});
+
 // See: https://github.com/actions/toolkit/blob/a1b068ec31a042ff1e10a522d8fdf0b8869d53ca/packages/core/src/core.ts#L89
 function getInputName(name: string): string {
  return `INPUT_${name.replace(/ /g, '_').toUpperCase()}`;
--- a/dev.Dockerfile
+++ b/dev.Dockerfile
@@ -16,9 +16,10 @@

 ARG NODE_VERSION=20
 ARG DOCKER_VERSION=27.2.1
-ARG BUILDX_VERSION=0.20.1
+ARG BUILDX_VERSION=0.26.1
 ARG COMPOSE_VERSION=2.32.4
-ARG UNDOCK_VERSION=0.8.0
+ARG UNDOCK_VERSION=0.10.0
+ARG REGCTL_VERSION=v0.8.2

 FROM node:${NODE_VERSION}-alpine AS base
 RUN apk add --no-cache cpio findutils git
@@ -79,6 +80,7 @@ FROM docker:${DOCKER_VERSION} AS docker
 FROM docker/buildx-bin:${BUILDX_VERSION} AS buildx
 FROM docker/compose-bin:v${COMPOSE_VERSION} AS compose
 FROM crazymax/undock:${UNDOCK_VERSION} AS undock
+FROM ghcr.io/regclient/regctl:${REGCTL_VERSION} AS regctl

 FROM deps AS test
 RUN --mount=type=bind,target=.,rw \
@@ -90,6 +92,7 @@ RUN --mount=type=bind,target=.,rw \
    --mount=type=bind,from=compose,source=/docker-compose,target=/usr/libexec/docker/cli-plugins/docker-compose \
    --mount=type=bind,from=compose,source=/docker-compose,target=/usr/bin/compose \
    --mount=type=bind,from=undock,source=/usr/local/bin/undock,target=/usr/bin/undock \
+    --mount=type=bind,from=regctl,source=/regctl,target=/usr/bin/regctl \
    --mount=type=secret,id=GITHUB_TOKEN \
  GITHUB_TOKEN=$(cat /run/secrets/GITHUB_TOKEN) yarn run test:coverage --coverageDirectory=/tmp/coverage

@@ -101,7 +104,7 @@ ARG GITHUB_REF
 RUN --mount=type=bind,target=.,rw \
    --mount=type=cache,target=/src/.yarn/cache \
    --mount=type=cache,target=/src/node_modules \
-    --mount=type=secret,id=NODE_AUTH_TOKEN <<EOT
+    --mount=type=secret,id=NODE_AUTH_TOKEN,env=NODE_AUTH_TOKEN <<EOT
  set -e
  if ! [[ $GITHUB_REF =~ ^refs/tags/v ]]; then
    echo "GITHUB_REF is not a tag"
@@ -109,10 +112,10 @@ RUN --mount=type=bind,target=.,rw \
  fi
  yarn install
  yarn run build
-  npm config set //registry.npmjs.org/:_authToken $(cat /run/secrets/NODE_AUTH_TOKEN)
+  npm config set //registry.npmjs.org/:_authToken $NODE_AUTH_TOKEN
  npm version --no-git-tag-version ${GITHUB_REF#refs/tags/v}
  npm publish --access public

  # FIXME: Can't publish with yarn berry atm: https://github.com/changesets/changesets/pull/674
-  #NODE_AUTH_TOKEN=$(cat /run/secrets/NODE_AUTH_TOKEN) yarn publish --no-git-tag-version --new-version ${GITHUB_REF#refs/tags/v}
+  #yarn publish --no-git-tag-version --new-version ${GITHUB_REF#refs/tags/v}
 EOT
--- a/jest.config.itg.ts
+++ b/jest.config.itg.ts
@@ -14,20 +14,6 @@
 * limitations under the License.
 */

-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-
-const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'docker-actions-toolkit-'));
-
-process.env = Object.assign({}, process.env, {
-  TEMP: tmpDir,
-  RUNNER_TEMP: path.join(tmpDir, 'runner-temp'),
-  RUNNER_TOOL_CACHE: path.join(tmpDir, 'runner-tool-cache')
-}) as {
-  [key: string]: string;
-};
-
 module.exports = {
  testEnvironment: 'node',
  moduleFileExtensions: ['js', 'ts'],
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
  ],
  "author": "Docker Inc.",
  "license": "Apache-2.0",
-  "packageManager": "yarn@3.6.3",
+  "packageManager": "yarn@4.9.2",
  "main": "lib/index.js",
  "types": "lib/index.d.ts",
  "directories": {
@@ -45,17 +45,17 @@
    "registry": "https://registry.npmjs.org/"
  },
  "dependencies": {
-    "@actions/artifact": "^2.2.1",
-    "@actions/cache": "^4.0.1",
+    "@actions/artifact": "^2.3.2",
+    "@actions/cache": "^4.0.3",
    "@actions/core": "^1.11.1",
    "@actions/exec": "^1.1.1",
-    "@actions/github": "^6.0.0",
+    "@actions/github": "^6.0.1",
    "@actions/http-client": "^2.2.3",
    "@actions/io": "^1.1.3",
    "@actions/tool-cache": "^2.0.2",
    "@azure/storage-blob": "^12.15.0",
-    "@octokit/core": "^5.1.0",
-    "@octokit/plugin-rest-endpoint-methods": "^10.4.0",
+    "@octokit/core": "^5.2.2",
+    "@octokit/plugin-rest-endpoint-methods": "^10.4.1",
    "async-retry": "^1.3.3",
    "csv-parse": "^5.6.0",
    "gunzip-maybe": "^1.4.2",
@@ -63,32 +63,31 @@
    "he": "^1.2.0",
    "js-yaml": "^4.1.0",
    "jwt-decode": "^4.0.0",
-    "semver": "^7.7.1",
+    "semver": "^7.7.2",
    "tar-stream": "^3.1.7",
-    "tmp": "^0.2.3"
+    "tmp": "^0.2.4"
  },
  "devDependencies": {
-    "@types/csv-parse": "^1.2.2",
    "@types/gunzip-maybe": "^1.4.2",
    "@types/he": "^1.2.3",
    "@types/js-yaml": "^4.0.9",
-    "@types/node": "^20.12.10",
-    "@types/semver": "^7.5.8",
-    "@types/tar-stream": "^3.1.3",
+    "@types/node": "^20.19.9",
+    "@types/semver": "^7.7.0",
+    "@types/tar-stream": "^3.1.4",
    "@types/tmp": "^0.2.6",
-    "@typescript-eslint/eslint-plugin": "^7.8.0",
-    "@typescript-eslint/parser": "^7.8.0",
-    "dotenv": "^16.4.5",
-    "eslint": "^8.57.0",
-    "eslint-config-prettier": "^9.1.0",
-    "eslint-plugin-import": "^2.29.1",
-    "eslint-plugin-jest": "^28.5.0",
-    "eslint-plugin-prettier": "^5.1.3",
+    "@typescript-eslint/eslint-plugin": "^7.18.0",
+    "@typescript-eslint/parser": "^7.18.0",
+    "dotenv": "^17.2.1",
+    "eslint": "^8.57.1",
+    "eslint-config-prettier": "^9.1.2",
+    "eslint-plugin-import": "^2.32.0",
+    "eslint-plugin-jest": "^28.14.0",
+    "eslint-plugin-prettier": "^5.5.3",
    "jest": "^29.7.0",
-    "prettier": "^3.2.5",
-    "rimraf": "^5.0.5",
-    "ts-jest": "^29.1.2",
+    "prettier": "^3.6.2",
+    "rimraf": "^6.0.1",
+    "ts-jest": "^29.4.1",
    "ts-node": "^10.9.2",
-    "typescript": "^5.4.5"
+    "typescript": "^5.9.2"
  }
 }
--- a/src/buildx/build.ts
+++ b/src/buildx/build.ts
@@ -32,6 +32,11 @@ export interface BuildOpts {
  buildx?: Buildx;
 }

+export interface ResolveSecretsOpts {
+  asFile?: boolean;
+  redact?: boolean;
+}
+
 export class Build {
  private readonly buildx: Buildx;
  private readonly iidFilename: string;
@@ -124,12 +129,16 @@ export class Build {
  }

  public static resolveSecretString(kvp: string): string {
-    const [key, file] = Build.resolveSecret(kvp, false);
+    const [key, file] = Build.resolveSecret(kvp, {
+      redact: true
+    });
    return `id=${key},src=${file}`;
  }

  public static resolveSecretFile(kvp: string): string {
-    const [key, file] = Build.resolveSecret(kvp, true);
+    const [key, file] = Build.resolveSecret(kvp, {
+      asFile: true
+    });
    return `id=${key},src=${file}`;
  }

@@ -138,10 +147,10 @@ export class Build {
    return `id=${key},env=${value}`;
  }

-  public static resolveSecret(kvp: string, file: boolean): [string, string] {
-    const [key, value] = Build.parseSecretKvp(kvp);
+  public static resolveSecret(kvp: string, opts?: ResolveSecretsOpts): [string, string] {
+    const [key, value] = Build.parseSecretKvp(kvp, opts?.redact);
    const secretFile = Context.tmpName({tmpdir: Context.tmpDir()});
-    if (file) {
+    if (opts?.asFile) {
      if (!fs.existsSync(value)) {
        throw new Error(`secret file ${value} not found`);
      }
@@ -310,13 +319,16 @@ export class Build {
    return false;
  }

-  private static parseSecretKvp(kvp: string): [string, string] {
+  public static parseSecretKvp(kvp: string, redact?: boolean): [string, string] {
    const delimiterIndex = kvp.indexOf('=');
    const key = kvp.substring(0, delimiterIndex);
    const value = kvp.substring(delimiterIndex + 1);
    if (key.length == 0 || value.length == 0) {
      throw new Error(`${kvp} is not a valid secret`);
    }
+    if (redact) {
+      core.setSecret(value);
+    }
    return [key, value];
  }
 }
--- a/src/buildx/builder.ts
+++ b/src/buildx/builder.ts
@@ -19,7 +19,7 @@ import * as core from '@actions/core';
 import {Buildx} from './buildx';
 import {Exec} from '../exec';

-import {BuilderInfo, GCPolicy, NodeInfo} from '../types/buildx/builder';
+import {BuilderInfo, Device, GCPolicy, NodeInfo} from '../types/buildx/builder';

 export interface BuilderOpts {
  buildx?: Buildx;
@@ -89,6 +89,7 @@ export class Builder {
    let parsingType: string | undefined;
    let currentNode: NodeInfo = {};
    let currentGCPolicy: GCPolicy | undefined;
+    let currentDevice: Device | undefined;
    let currentFile: string | undefined;
    for (const line of data.trim().split(`\n`)) {
      const [key, ...rest] = line.split(':');
@@ -172,6 +173,10 @@ export class Builder {
          parsingType = 'label';
          currentNode.labels = {};
          break;
+        case lkey == 'devices':
+          parsingType = 'devices';
+          currentNode.devices = currentNode.devices || [];
+          break;
        case lkey.startsWith('gc policy rule#'):
          parsingType = 'gcpolicy';
          if (currentNode.gcPolicy && currentGCPolicy) {
@@ -186,6 +191,10 @@ export class Builder {
          currentNode.files[currentFile] = '';
          break;
        default: {
+          if (parsingType && parsingType !== 'devices' && currentNode.devices && currentDevice) {
+            currentNode.devices.push(currentDevice);
+            currentDevice = undefined;
+          }
          switch (parsingType || '') {
            case 'features': {
              currentNode.features = currentNode.features || {};
@@ -197,6 +206,42 @@ export class Builder {
              currentNode.labels[key.trim()] = value;
              break;
            }
+            case 'devices': {
+              switch (lkey.trim()) {
+                case 'name': {
+                  if (currentNode.devices && currentDevice) {
+                    currentNode.devices.push(currentDevice);
+                  }
+                  currentDevice = {};
+                  currentDevice.name = value;
+                  break;
+                }
+                case 'on-demand': {
+                  if (currentDevice && value) {
+                    currentDevice.onDemand = value == 'true';
+                  }
+                  break;
+                }
+                case 'automatically allowed': {
+                  if (currentDevice && value) {
+                    currentDevice.autoAllow = value == 'true';
+                  }
+                  break;
+                }
+                case 'annotations': {
+                  if (currentDevice) {
+                    currentDevice.annotations = currentDevice.annotations || {};
+                  }
+                  break;
+                }
+                default: {
+                  if (currentDevice && currentDevice.annotations) {
+                    currentDevice.annotations[key.trim()] = value;
+                  }
+                }
+              }
+              break;
+            }
            case 'gcpolicy': {
              currentNode.gcPolicy = currentNode.gcPolicy || [];
              currentGCPolicy = currentGCPolicy || {};
@@ -219,6 +264,18 @@ export class Builder {
                  currentGCPolicy.keepBytes = value;
                  break;
                }
+                case 'reserved space': {
+                  currentGCPolicy.reservedSpace = value;
+                  break;
+                }
+                case 'max used space': {
+                  currentGCPolicy.maxUsedSpace = value;
+                  break;
+                }
+                case 'min free space': {
+                  currentGCPolicy.minFreeSpace = value;
+                  break;
+                }
              }
              break;
            }
@@ -235,6 +292,9 @@ export class Builder {
        }
      }
    }
+    if (currentDevice && currentNode.devices) {
+      currentNode.devices.push(currentDevice);
+    }
    if (currentGCPolicy && currentNode.gcPolicy) {
      currentNode.gcPolicy.push(currentGCPolicy);
    }
--- a/src/buildx/history.ts
+++ b/src/buildx/history.ts
@@ -28,7 +28,7 @@ import {Exec} from '../exec';
 import {GitHub} from '../github';
 import {Util} from '../util';

-import {ExportRecordOpts, ExportRecordResponse, Summaries} from '../types/buildx/history';
+import {ExportOpts, ExportResponse, InspectOpts, InspectResponse, Summaries} from '../types/buildx/history';

 export interface HistoryOpts {
  buildx?: Buildx;
@@ -37,27 +37,43 @@ export interface HistoryOpts {
 export class History {
  private readonly buildx: Buildx;

-  private static readonly EXPORT_BUILD_IMAGE_DEFAULT: string = 'docker.io/dockereng/export-build:latest';
-  private static readonly EXPORT_BUILD_IMAGE_ENV: string = 'DOCKER_BUILD_EXPORT_BUILD_IMAGE';
-
  constructor(opts?: HistoryOpts) {
    this.buildx = opts?.buildx || new Buildx();
  }

-  public async export(opts: ExportRecordOpts): Promise<ExportRecordResponse> {
-    if (os.platform() === 'win32') {
-      throw new Error('Exporting a build record is currently not supported on Windows');
-    }
-    if (!(await Docker.isAvailable())) {
-      throw new Error('Docker is required to export a build record');
-    }
-    if (!(await Docker.isDaemonRunning())) {
-      throw new Error('Docker daemon needs to be running to export a build record');
-    }
-    if (!(await this.buildx.versionSatisfies('>=0.13.0'))) {
-      throw new Error('Buildx >= 0.13.0 is required to export a build record');
-    }
+  public async getCommand(args: Array<string>) {
+    return await this.buildx.getCommand(['history', ...args]);
+  }

+  public async getInspectCommand(args: Array<string>) {
+    return await this.getCommand(['inspect', ...args]);
+  }
+
+  public async getExportCommand(args: Array<string>) {
+    return await this.getCommand(['export', ...args]);
+  }
+
+  public async inspect(opts: InspectOpts): Promise<InspectResponse> {
+    const args: Array<string> = ['--format', 'json'];
+    if (opts.builder) {
+      args.push('--builder', opts.builder);
+    }
+    if (opts.ref) {
+      args.push(opts.ref);
+    }
+    const cmd = await this.getInspectCommand(args);
+    return await Exec.getExecOutput(cmd.command, cmd.args, {
+      ignoreReturnCode: true,
+      silent: true
+    }).then(res => {
+      if (res.stderr.length > 0 && res.exitCode != 0) {
+        throw new Error(res.stderr.trim());
+      }
+      return <InspectResponse>JSON.parse(res.stdout);
+    });
+  }
+
+  public async export(opts: ExportOpts): Promise<ExportResponse> {
    let builderName: string = '';
    let nodeName: string = '';
    const refs: Array<string> = [];
@@ -85,6 +101,81 @@ export class History {
    core.info(`exporting build record to ${outDir}`);
    fs.mkdirSync(outDir, {recursive: true});

+    if (opts.useContainer || (await this.buildx.versionSatisfies('<0.23.0'))) {
+      return await this.exportLegacy(builderName, nodeName, refs, outDir, opts.image);
+    }
+
+    if (await this.buildx.versionSatisfies('<0.24.0')) {
+      // wait 3 seconds to ensure build records are finalized: https://github.com/moby/buildkit/pull/5109
+      // not necessary since buildx 0.24.0: https://github.com/docker/buildx/pull/3152
+      await Util.sleep(3);
+    }
+
+    const summaries: Summaries = {};
+    if (!opts.noSummaries) {
+      for (const ref of refs) {
+        await this.inspect({
+          ref: ref,
+          builder: builderName
+        }).then(res => {
+          let errorLogs = '';
+          if (res.Error && res.Status !== 'canceled') {
+            if (res.Error.Message) {
+              errorLogs = res.Error.Message;
+            } else if (res.Error.Name && res.Error.Logs) {
+              errorLogs = `=> ${res.Error.Name}\n${res.Error.Logs}`;
+            }
+          }
+          summaries[ref] = {
+            name: res.Name,
+            status: res.Status,
+            duration: Util.formatDuration(res.Duration),
+            numCachedSteps: res.NumCachedSteps,
+            numTotalSteps: res.NumTotalSteps,
+            numCompletedSteps: res.NumCompletedSteps,
+            defaultPlatform: res.Platform?.[0],
+            error: errorLogs
+          };
+        });
+      }
+    }
+
+    const dockerbuildPath = path.join(outDir, `${History.exportFilename(refs)}.dockerbuild`);
+
+    const exportArgs = ['--builder', builderName, '--output', dockerbuildPath, ...refs];
+    if (await this.buildx.versionSatisfies('>=0.24.0')) {
+      exportArgs.push('--finalize');
+    }
+
+    const cmd = await this.getExportCommand(exportArgs);
+    await Exec.getExecOutput(cmd.command, cmd.args);
+
+    const dockerbuildStats = fs.statSync(dockerbuildPath);
+
+    return {
+      dockerbuildFilename: dockerbuildPath,
+      dockerbuildSize: dockerbuildStats.size,
+      builderName: builderName,
+      nodeName: nodeName,
+      refs: refs,
+      summaries: summaries
+    };
+  }
+
+  private async exportLegacy(builderName: string, nodeName: string, refs: Array<string>, outDir: string, image?: string): Promise<ExportResponse> {
+    if (os.platform() === 'win32') {
+      throw new Error('Exporting a build record is currently not supported on Windows');
+    }
+    if (!(await Docker.isAvailable())) {
+      throw new Error('Docker is required to export a build record');
+    }
+    if (!(await Docker.isDaemonRunning())) {
+      throw new Error('Docker daemon needs to be running to export a build record');
+    }
+    if (!(await this.buildx.versionSatisfies('>=0.13.0'))) {
+      throw new Error('Buildx >= 0.13.0 is required to export a build record');
+    }
+
    // wait 3 seconds to ensure build records are finalized: https://github.com/moby/buildkit/pull/5109
    await Util.sleep(3);

@@ -139,7 +230,7 @@ export class History {
        'run', '--rm', '-i',
        '-v', `${Buildx.refsDir}:/buildx-refs`,
        '-v', `${outDir}:/out`,
-        opts.image || process.env[History.EXPORT_BUILD_IMAGE_ENV] || History.EXPORT_BUILD_IMAGE_DEFAULT,
+        image || process.env['DOCKER_BUILD_EXPORT_BUILD_IMAGE'] || 'docker.io/dockereng/export-build:latest',
        ...ebargs
      ]
      core.info(`[command]docker ${dockerRunArgs.join(' ')}`);
@@ -190,12 +281,7 @@ export class History {
        }
      });

-    let dockerbuildFilename = `${GitHub.context.repo.owner}~${GitHub.context.repo.repo}~${refs[0].substring(0, 6).toUpperCase()}`;
-    if (refs.length > 1) {
-      dockerbuildFilename += `+${refs.length - 1}`;
-    }
-
-    const dockerbuildPath = path.join(outDir, `${dockerbuildFilename}.dockerbuild`);
+    const dockerbuildPath = path.join(outDir, `${History.exportFilename(refs)}.dockerbuild`);
    fs.renameSync(tmpDockerbuildFilename, dockerbuildPath);
    const dockerbuildStats = fs.statSync(dockerbuildPath);

@@ -206,10 +292,18 @@ export class History {
    return {
      dockerbuildFilename: dockerbuildPath,
      dockerbuildSize: dockerbuildStats.size,
-      summaries: summaries,
      builderName: builderName,
      nodeName: nodeName,
-      refs: refs
+      refs: refs,
+      summaries: summaries
    };
  }
+
+  private static exportFilename(refs: Array<string>): string {
+    let name = `${GitHub.context.repo.owner}~${GitHub.context.repo.repo}~${refs[0].substring(0, 6).toUpperCase()}`;
+    if (refs.length > 1) {
+      name += `+${refs.length - 1}`;
+    }
+    return name;
+  }
 }
--- a/src/docker/assets.ts
+++ b/src/docker/assets.ts
@@ -162,12 +162,19 @@ images:
  arch: "{{arch}}"
  digest: "{{digest}}"
 {{/each}}
- location: "https://cloud-images.ubuntu.com/releases/24.04/release-20241004/ubuntu-24.04-server-cloudimg-amd64.img"
+- location: "https://cloud-images.ubuntu.com/releases/24.04/release-20250228/ubuntu-24.04-server-cloudimg-amd64.img"
  arch: "x86_64"
-  digest: "sha256:fad101d50b06b26590cf30542349f9e9d3041ad7929e3bc3531c81ec27f2c788"
- location: "https://cloud-images.ubuntu.com/releases/24.04/release-20241004/ubuntu-24.04-server-cloudimg-arm64.img"
+  digest: "sha256:a3aea891c930ee0c762077b963834f5e083eb8102574f1e4dfc9e6e4c1c73ac0"
+  kernel:
+    location: "https://cloud-images.ubuntu.com/releases/24.04/release-20250228/unpacked/ubuntu-24.04-server-cloudimg-amd64-vmlinuz-generic"
+    digest: "sha256:2d9f30959f01675fd28aa1c2fe8934728e46766d04ecfad2d206823696a3f830"
+    cmdline: "root=LABEL=cloudimg-rootfs ro console=tty1 console=ttyAMA0 no_timer_check"
+  initrd:
+    location: "https://cloud-images.ubuntu.com/releases/24.04/release-20250228/unpacked/ubuntu-24.04-server-cloudimg-amd64-initrd-generic"
+    digest: "sha256:231352d027aeebf0bb7dca281dfebae894c86e789c7377788d3c2c149471caa3"
+- location: "https://cloud-images.ubuntu.com/releases/24.04/release-20250228/ubuntu-24.04-server-cloudimg-arm64.img"
  arch: "aarch64"
-  digest: "sha256:e380b683b0c497d2a87af8a5dbe94c42eb54548fa976167f307ed8cf3944ec57"
+  digest: "sha256:278a0e8475008673d9d3da10ae66a7b1a3dda059746b83d749eca386a5670bd4"
 # Fallback to the latest release image.
 # Hint: run \`limactl prune\` to invalidate the cache
 - location: "https://cloud-images.ubuntu.com/releases/24.04/release/ubuntu-24.04-server-cloudimg-amd64.img"
@@ -250,7 +257,7 @@ provision:
        x86_64) arch=amd64;;
        aarch64) arch=arm64;;
      esac
-      url="https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_$arch.tar.gz"
+      url="https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_$arch.tar.gz"

      wget "$url" -O /tmp/undock.tar.gz
      tar -C /usr/local/bin -xvf /tmp/undock.tar.gz
--- a/src/docker/install.ts
+++ b/src/docker/install.ts
@@ -28,11 +28,13 @@ import * as tc from '@actions/tool-cache';

 import {Context} from '../context';
 import {Docker} from './docker';
+import {Regctl} from '../regclient/regctl';
+import {Undock} from '../undock/undock';
 import {Exec} from '../exec';
 import {Util} from '../util';
 import {limaYamlData, dockerServiceLogsPs1, setupDockerWinPs1} from './assets';
+
 import {GitHubRelease} from '../types/github';
-import {HubRepository} from '../hubRepository';
 import {Image} from '../types/oci/config';

 export interface InstallSourceImage {
@@ -57,6 +59,9 @@ export interface InstallOpts {
  daemonConfig?: string;
  rootless?: boolean;
  localTCPPort?: number;
+
+  regctl?: Regctl;
+  undock?: Undock;
 }

 interface LimaImage {
@@ -72,6 +77,8 @@ export class Install {
  private readonly daemonConfig?: string;
  private readonly rootless: boolean;
  private readonly localTCPPort?: number;
+  private readonly regctl: Regctl;
+  private readonly undock: Undock;

  private _version: string | undefined;
  private _toolDir: string | undefined;
@@ -91,36 +98,14 @@ export class Install {
    this.daemonConfig = opts.daemonConfig;
    this.rootless = opts.rootless || false;
    this.localTCPPort = opts.localTCPPort;
+    this.regctl = opts.regctl || new Regctl();
+    this.undock = opts.undock || new Undock();
  }

  get toolDir(): string {
    return this._toolDir || Context.tmpDir();
  }

-  async downloadStaticArchive(component: 'docker' | 'docker-rootless-extras', src: InstallSourceArchive): Promise<string> {
-    const release: GitHubRelease = await Install.getRelease(src.version);
-    this._version = release.tag_name.replace(/^v+|v+$/g, '');
-    core.debug(`docker.Install.download version: ${this._version}`);
-
-    const downloadURL = this.downloadURL(component, this._version, src.channel);
-    core.info(`Downloading ${downloadURL}`);
-
-    const downloadPath = await tc.downloadTool(downloadURL);
-    core.debug(`docker.Install.download downloadPath: ${downloadPath}`);
-
-    let extractFolder;
-    if (os.platform() == 'win32') {
-      extractFolder = await tc.extractZip(downloadPath, extractFolder);
-    } else {
-      extractFolder = await tc.extractTar(downloadPath, extractFolder);
-    }
-    if (Util.isDirectory(path.join(extractFolder, component))) {
-      extractFolder = path.join(extractFolder, component);
-    }
-    core.debug(`docker.Install.download extractFolder: ${extractFolder}`);
-    return extractFolder;
-  }
-
  public async download(): Promise<string> {
    let extractFolder: string;
    let cacheKey: string;
@@ -128,39 +113,9 @@ export class Install {

    switch (this.source.type) {
      case 'image': {
-        const tag = this.source.tag;
-        this._version = tag;
+        this._version = this.source.tag;
        cacheKey = `docker-image`;
-
-        core.info(`Downloading docker cli from dockereng/cli-bin:${tag}`);
-        const cli = await HubRepository.build('dockereng/cli-bin');
-        extractFolder = await cli.extractImage(tag);
-
-        const moby = await HubRepository.build('moby/moby-bin');
-        if (['win32', 'linux'].includes(platform)) {
-          core.info(`Downloading dockerd from moby/moby-bin:${tag}`);
-          await moby.extractImage(tag, extractFolder);
-        } else if (platform == 'darwin') {
-          // On macOS, the docker daemon binary will be downloaded inside the lima VM.
-          // However, we will get the exact git revision from the image config
-          // to get the matching systemd unit files.
-          core.info(`Getting git revision from moby/moby-bin:${tag}`);
-
-          // There's no macOS image for moby/moby-bin - a linux daemon is run inside lima.
-          const manifest = await moby.getPlatformManifest(tag, 'linux');
-
-          const config = await moby.getJSONBlob<Image>(manifest.config.digest);
-          core.debug(`Config ${JSON.stringify(config.config)}`);
-
-          this.gitCommit = config.config?.Labels?.['org.opencontainers.image.revision'];
-          if (!this.gitCommit) {
-            core.warning(`No git revision can be determined from the image. Will use master.`);
-            this.gitCommit = 'master';
-          }
-          core.info(`Git revision is ${this.gitCommit}`);
-        } else {
-          core.warning(`dockerd not supported on ${platform}, only the Docker cli will be available`);
-        }
+        extractFolder = await this.downloadSourceImage(platform);
        break;
      }
      case 'archive': {
@@ -170,10 +125,10 @@ export class Install {
        this._version = version;

        core.info(`Downloading Docker ${version} from ${this.source.channel} at download.docker.com`);
-        extractFolder = await this.downloadStaticArchive('docker', this.source);
+        extractFolder = await this.downloadSourceArchive('docker', this.source);
        if (this.rootless) {
          core.info(`Downloading Docker rootless extras ${version} from ${this.source.channel} at download.docker.com`);
-          const extrasFolder = await this.downloadStaticArchive('docker-rootless-extras', this.source);
+          const extrasFolder = await this.downloadSourceArchive('docker-rootless-extras', this.source);
          fs.readdirSync(extrasFolder).forEach(file => {
            const src = path.join(extrasFolder, file);
            const dest = path.join(extractFolder, file);
@@ -191,7 +146,9 @@ export class Install {
      }
      // eslint-disable-next-line @typescript-eslint/no-unused-vars
      files.forEach(function (file, index) {
-        fs.chmodSync(path.join(extractFolder, file), '0755');
+        if (!Util.isDirectory(path.join(extractFolder, file))) {
+          fs.chmodSync(path.join(extractFolder, file), '0755');
+        }
      });
    });

@@ -203,6 +160,72 @@ export class Install {
    return tooldir;
  }

+  private async downloadSourceImage(platform: string): Promise<string> {
+    const dest = path.join(Context.tmpDir(), 'docker-install-image');
+    const cliImage = `dockereng/cli-bin:${this._version}`;
+    const engineImage = `moby/moby-bin:${this._version}`;
+
+    core.info(`Downloading Docker CLI from ${cliImage}`);
+    await this.undock.run({
+      source: cliImage,
+      dist: dest
+    });
+
+    if (['win32', 'linux'].includes(platform)) {
+      core.info(`Downloading Docker engine from ${engineImage}`);
+      await this.undock.run({
+        source: engineImage,
+        dist: dest
+      });
+    } else if (platform == 'darwin') {
+      // On macOS, the docker daemon binary will be downloaded inside the lima VM.
+      // However, we will get the exact git revision from the image config
+      // to get the matching systemd unit files. There's no macOS image for
+      // moby/moby-bin - a linux daemon is run inside lima.
+      try {
+        const engineImageConfig = await this.imageConfig(engineImage, 'linux/arm64');
+        core.debug(`docker.Install.downloadSourceImage engineImageConfig: ${JSON.stringify(engineImageConfig)}`);
+        this.gitCommit = engineImageConfig.config?.Labels?.['org.opencontainers.image.revision'];
+        if (!this.gitCommit) {
+          throw new Error(`No git revision can be determined from the image`);
+        }
+      } catch (e) {
+        core.warning(e);
+        this.gitCommit = 'master';
+      }
+
+      core.debug(`docker.Install.downloadSourceImage gitCommit: ${this.gitCommit}`);
+    } else {
+      core.warning(`Docker engine not supported on ${platform}, only the Docker cli will be available`);
+    }
+
+    return dest;
+  }
+
+  private async downloadSourceArchive(component: 'docker' | 'docker-rootless-extras', src: InstallSourceArchive): Promise<string> {
+    const release: GitHubRelease = await Install.getRelease(src.version);
+    this._version = release.tag_name.replace(/^v+|v+$/g, '');
+    core.debug(`docker.Install.downloadSourceArchive version: ${this._version}`);
+
+    const downloadURL = this.downloadURL(component, this._version, src.channel);
+    core.info(`Downloading ${downloadURL}`);
+
+    const downloadPath = await tc.downloadTool(downloadURL);
+    core.debug(`docker.Install.downloadSourceArchive downloadPath: ${downloadPath}`);
+
+    let extractFolder;
+    if (os.platform() == 'win32') {
+      extractFolder = await tc.extractZip(downloadPath, extractFolder);
+    } else {
+      extractFolder = await tc.extractTar(downloadPath, extractFolder);
+    }
+    if (Util.isDirectory(path.join(extractFolder, component))) {
+      extractFolder = path.join(extractFolder, component);
+    }
+    core.debug(`docker.Install.downloadSourceArchive extractFolder: ${extractFolder}`);
+    return extractFolder;
+  }
+
  public async install(): Promise<string> {
    if (!this.toolDir) {
      throw new Error('toolDir must be set. Run download first.');
@@ -709,4 +732,20 @@ EOF`,
    }
    return res;
  }
+
+  private async imageConfig(image: string, platform?: string): Promise<Image> {
+    const manifest = await this.regctl.manifestGet({
+      image: image,
+      platform: platform
+    });
+    const configDigest = manifest?.config?.digest;
+    if (!configDigest) {
+      throw new Error(`No config digest found for image ${image}`);
+    }
+    const blob = await this.regctl.blobGet({
+      repository: image,
+      digest: configDigest
+    });
+    return <Image>JSON.parse(blob);
+  }
 }
--- a/src/github.ts
+++ b/src/github.ts
@@ -17,7 +17,7 @@
 import crypto from 'crypto';
 import fs from 'fs';
 import he from 'he';
-import jsyaml from 'js-yaml';
+import {dump as yamldump} from 'js-yaml';
 import os from 'os';
 import path from 'path';
 import {CreateArtifactRequest, FinalizeArtifactRequest, StringValue} from '@actions/artifact/lib/generated';
@@ -233,10 +233,24 @@ export class GitHub {
      return `<a href="${url}">${text}</a>` + (addEOL ? os.EOL : '');
    };

-    const refsSize = Object.keys(opts.exportRes.refs).length;
+    const refsSize = opts.exportRes.refs.length;
+    const firstRef = refsSize > 0 ? opts.exportRes.refs?.[0] : undefined;
+    const firstSummary = firstRef ? opts.exportRes.summaries?.[firstRef] : undefined;
+    const dbcAccount = opts.driver === 'cloud' && opts.endpoint ? opts.endpoint?.replace(/^cloud:\/\//, '').split('/')[0] : undefined;

    const sum = core.summary.addHeading('Docker Build summary', 2);

+    if (dbcAccount && refsSize === 1 && firstRef && firstSummary) {
+      const buildURL = GitHub.formatDBCBuildURL(dbcAccount, firstRef, firstSummary.defaultPlatform);
+      // prettier-ignore
+      sum.addRaw(`<p>`)
+        .addRaw(`For a detailed look at the build, you can check the results at:`)
+      .addRaw('</p>')
+      .addRaw(`<p>`)
+        .addRaw(`:whale: ${addLink(`<strong>${buildURL}</strong>`, buildURL)}`)
+      .addRaw(`</p>`);
+    }
+
    if (opts.uploadRes) {
      // we just need the last two parts of the URL as they are always relative
      // to the workflow run URL otherwise URL could be broken if GitHub
@@ -246,17 +260,29 @@ export class GitHub {
      // https://github.com/docker/actions-toolkit/issues/367
      const artifactRelativeURL = `./${GitHub.runId}/${opts.uploadRes.url.split('/').slice(-2).join('/')}`;

+      if (dbcAccount && refsSize === 1) {
+        // prettier-ignore
+        sum.addRaw(`<p>`)
+          .addRaw(`You can also download the following build record archive and import it into Docker Desktop's Builds view. `)
+          .addBreak()
+          .addRaw(`Build records include details such as timing, dependencies, results, logs, traces, and other information about a build. `)
+          .addRaw(addLink('Learn more', 'https://www.docker.com/blog/new-beta-feature-deep-dive-into-github-actions-docker-builds-with-docker-desktop/?utm_source=github&utm_medium=actions'))
+        .addRaw('</p>')
+      } else {
+        // prettier-ignore
+        sum.addRaw(`<p>`)
+          .addRaw(`For a detailed look at the build, download the following build record archive and import it into Docker Desktop's Builds view. `)
+          .addBreak()
+          .addRaw(`Build records include details such as timing, dependencies, results, logs, traces, and other information about a build. `)
+          .addRaw(addLink('Learn more', 'https://www.docker.com/blog/new-beta-feature-deep-dive-into-github-actions-docker-builds-with-docker-desktop/?utm_source=github&utm_medium=actions'))
+        .addRaw('</p>')
+      }
+
      // prettier-ignore
      sum.addRaw(`<p>`)
-        .addRaw(`For a detailed look at the build, download the following build record archive and import it into Docker Desktop's Builds view. `)
-        .addBreak()
-        .addRaw(`Build records include details such as timing, dependencies, results, logs, traces, and other information about a build. `)
-        .addRaw(addLink('Learn more', 'https://www.docker.com/blog/new-beta-feature-deep-dive-into-github-actions-docker-builds-with-docker-desktop/?utm_source=github&utm_medium=actions'))
-      .addRaw('</p>')
-      .addRaw(`<p>`)
        .addRaw(`:arrow_down: ${addLink(`<strong>${Util.stringToUnicodeEntities(opts.uploadRes.filename)}</strong>`, artifactRelativeURL)} (${Util.formatFileSize(opts.uploadRes.size)} - includes <strong>${refsSize} build record${refsSize > 1 ? 's' : ''}</strong>)`)
      .addRaw(`</p>`);
-    } else {
+    } else if (opts.exportRes.summaries) {
      // prettier-ignore
      sum.addRaw(`<p>`)
        .addRaw(`The following table provides a brief summary of your build.`)
@@ -269,56 +295,61 @@ export class GitHub {
    // Feedback survey
    sum.addRaw(`<p>`).addRaw(`Find this useful? `).addRaw(addLink('Let us know', 'https://docs.docker.com/feedback/gha-build-summary')).addRaw('</p>');

-    // Preview
-    sum.addRaw('<p>');
-    const summaryTableData: Array<Array<SummaryTableCell>> = [
-      [
-        {header: true, data: 'ID'},
-        {header: true, data: 'Name'},
-        {header: true, data: 'Status'},
-        {header: true, data: 'Cached'},
-        {header: true, data: 'Duration'}
-      ]
-    ];
-    let buildError: string | undefined;
-    for (const ref in opts.exportRes.summaries) {
-      if (Object.prototype.hasOwnProperty.call(opts.exportRes.summaries, ref)) {
-        const summary = opts.exportRes.summaries[ref];
+    if (opts.exportRes.summaries) {
+      // Preview
+      sum.addRaw('<p>');
+      const summaryTableData: Array<Array<SummaryTableCell>> = [
        // prettier-ignore
-        summaryTableData.push([
-          {data: `<code>${ref.substring(0, 6).toUpperCase()}</code>`},
-          {data: `<strong>${Util.stringToUnicodeEntities(summary.name)}</strong>`},
-          {data: `${summary.status === 'completed' ? ':white_check_mark:' : summary.status === 'canceled' ? ':no_entry_sign:' : ':x:'} ${summary.status}`},
-          {data: `${summary.numCachedSteps > 0 ? Math.round((summary.numCachedSteps / summary.numTotalSteps) * 100) : 0}%`},
-          {data: summary.duration}
-        ]);
-        if (summary.error) {
-          buildError = summary.error;
+        [
+          {header: true, data: 'ID'},
+          {header: true, data: 'Name'},
+          {header: true, data: 'Status'},
+          {header: true, data: 'Cached'},
+          {header: true, data: 'Duration'},
+          ...(dbcAccount && refsSize > 1 ? [{header: true, data: 'Build result URL'}] : [])
+        ]
+      ];
+      let buildError: string | undefined;
+      for (const ref in opts.exportRes.summaries) {
+        if (Object.prototype.hasOwnProperty.call(opts.exportRes.summaries, ref)) {
+          const summary = opts.exportRes.summaries[ref];
+          // prettier-ignore
+          summaryTableData.push([
+            {data: `<code>${ref.substring(0, 6).toUpperCase()}</code>`},
+            {data: `<strong>${Util.stringToUnicodeEntities(summary.name)}</strong>`},
+            {data: `${summary.status === 'completed' ? ':white_check_mark:' : summary.status === 'canceled' ? ':no_entry_sign:' : ':x:'} ${summary.status}`},
+            {data: `${summary.numCachedSteps > 0 ? Math.round((summary.numCachedSteps / summary.numTotalSteps) * 100) : 0}%`},
+            {data: summary.duration},
+            ...(dbcAccount && refsSize > 1 ? [{data: addLink(':whale: Open', GitHub.formatDBCBuildURL(dbcAccount, ref, summary.defaultPlatform))}] : [])
+          ]);
+          if (summary.error) {
+            buildError = summary.error;
+          }
        }
      }
-    }
-    sum.addTable([...summaryTableData]);
-    sum.addRaw(`</p>`);
+      sum.addTable([...summaryTableData]);
+      sum.addRaw(`</p>`);

-    // Build error
-    if (buildError) {
-      sum.addRaw(`<blockquote>`);
-      if (Util.countLines(buildError) > 10) {
-        // prettier-ignore
-        sum
+      // Build error
+      if (buildError) {
+        sum.addRaw(`<blockquote>`);
+        if (Util.countLines(buildError) > 10) {
+          // prettier-ignore
+          sum
          .addRaw(`<details><summary><strong>Error</strong></summary>`)
            .addCodeBlock(he.encode(buildError), 'text')
          .addRaw(`</details>`);
-      } else {
-        // prettier-ignore
-        sum
+        } else {
+          // prettier-ignore
+          sum
          .addRaw(`<strong>Error</strong>`)
          .addBreak()
          .addRaw(`<p>`)
            .addCodeBlock(he.encode(buildError), 'text')
          .addRaw(`</p>`);
+        }
+        sum.addRaw(`</blockquote>`);
      }
-      sum.addRaw(`</blockquote>`);
    }

    // Build inputs
@@ -326,7 +357,7 @@ export class GitHub {
      // prettier-ignore
      sum.addRaw(`<details><summary><strong>Build inputs</strong></summary>`)
        .addCodeBlock(
-          jsyaml.dump(opts.inputs, {
+          yamldump(opts.inputs, {
            indent: 2,
            lineWidth: -1
          }), 'yaml'
@@ -345,4 +376,8 @@ export class GitHub {
    core.info(`Writing summary`);
    await sum.addSeparator().write();
  }
+
+  private static formatDBCBuildURL(account: string, ref: string, platform?: string): string {
+    return `https://app.docker.com/build/accounts/${account}/builds/${(platform ?? 'linux/amd64').replace('/', '-')}/${ref}`;
+  }
 }
--- a/src/hubRepository.ts
+++ b/src/hubRepository.ts
@@ -1,174 +0,0 @@
-/**
- * Copyright 2023 actions-toolkit authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import * as httpm from '@actions/http-client';
-import {Index} from './types/oci';
-import os from 'os';
-import * as core from '@actions/core';
-import {Manifest} from './types/oci/manifest';
-import * as tc from '@actions/tool-cache';
-import fs from 'fs';
-import {MEDIATYPE_IMAGE_CONFIG_V1, MEDIATYPE_IMAGE_INDEX_V1, MEDIATYPE_IMAGE_MANIFEST_V1} from './types/oci/mediatype';
-import {MEDIATYPE_IMAGE_CONFIG_V1 as DOCKER_MEDIATYPE_IMAGE_CONFIG_V1, MEDIATYPE_IMAGE_MANIFEST_LIST_V2, MEDIATYPE_IMAGE_MANIFEST_V2} from './types/docker/mediatype';
-import {DockerHub} from './dockerhub';
-
-export class HubRepository {
-  private repo: string;
-  private token: string;
-  private static readonly http: httpm.HttpClient = new httpm.HttpClient('setup-docker-action');
-
-  private constructor(repository: string, token: string) {
-    this.repo = repository;
-    this.token = token;
-  }
-
-  public static async build(repository: string): Promise<HubRepository> {
-    const token = await this.getToken(repository);
-    return new HubRepository(repository, token);
-  }
-
-  public async getPlatformManifest(tagOrDigest: string, os?: string): Promise<Manifest> {
-    const index = await this.getManifest<Index>(tagOrDigest);
-    if (index.mediaType != MEDIATYPE_IMAGE_INDEX_V1 && index.mediaType != MEDIATYPE_IMAGE_MANIFEST_LIST_V2) {
-      core.error(`Unsupported image media type: ${index.mediaType}`);
-      throw new Error(`Unsupported image media type: ${index.mediaType}`);
-    }
-    const digest = HubRepository.getPlatformManifestDigest(index, os);
-    return await this.getManifest<Manifest>(digest);
-  }
-
-  // Unpacks the image layers and returns the path to the extracted image.
-  // Only OCI indexes/manifest list are supported for now.
-  public async extractImage(tag: string, destDir?: string): Promise<string> {
-    const manifest = await this.getPlatformManifest(tag);
-
-    const paths = manifest.layers.map(async layer => {
-      const url = this.blobUrl(layer.digest);
-
-      return await tc.downloadTool(url, undefined, undefined, {
-        authorization: `Bearer ${this.token}`
-      });
-    });
-
-    let files = await Promise.all(paths);
-    let extractFolder: string;
-    if (!destDir) {
-      extractFolder = await tc.extractTar(files[0]);
-      files = files.slice(1);
-    } else {
-      extractFolder = destDir;
-    }
-
-    await Promise.all(
-      files.map(async file => {
-        return await tc.extractTar(file, extractFolder);
-      })
-    );
-
-    fs.readdirSync(extractFolder).forEach(file => {
-      core.info(`extractImage(${this.repo}:${tag}) file: ${file}`);
-    });
-
-    return extractFolder;
-  }
-
-  private static async getToken(repo: string): Promise<string> {
-    const url = `https://auth.docker.io/token?service=registry.docker.io&scope=repository:${repo}:pull`;
-
-    const resp = await this.http.get(url);
-    const body = await resp.readBody();
-    const statusCode = resp.message.statusCode || 500;
-    if (statusCode != 200) {
-      throw DockerHub.parseError(resp, body);
-    }
-
-    const json = JSON.parse(body);
-    return json.token;
-  }
-
-  private blobUrl(digest: string): string {
-    return `https://registry-1.docker.io/v2/${this.repo}/blobs/${digest}`;
-  }
-
-  public async getManifest<T>(tagOrDigest: string): Promise<T> {
-    return await this.registryGet<T>(tagOrDigest, 'manifests', [MEDIATYPE_IMAGE_INDEX_V1, MEDIATYPE_IMAGE_MANIFEST_LIST_V2, MEDIATYPE_IMAGE_MANIFEST_V1, MEDIATYPE_IMAGE_MANIFEST_V2]);
-  }
-
-  public async getJSONBlob<T>(tagOrDigest: string): Promise<T> {
-    return await this.registryGet<T>(tagOrDigest, 'blobs', [MEDIATYPE_IMAGE_CONFIG_V1, DOCKER_MEDIATYPE_IMAGE_CONFIG_V1]);
-  }
-
-  private async registryGet<T>(tagOrDigest: string, endpoint: 'manifests' | 'blobs', accept: Array<string>): Promise<T> {
-    const url = `https://registry-1.docker.io/v2/${this.repo}/${endpoint}/${tagOrDigest}`;
-
-    const headers = {
-      Authorization: `Bearer ${this.token}`,
-      Accept: accept.join(', ')
-    };
-
-    const resp = await HubRepository.http.get(url, headers);
-    const body = await resp.readBody();
-    const statusCode = resp.message.statusCode || 500;
-    if (statusCode != 200) {
-      core.error(`registryGet(${this.repo}:${tagOrDigest}) failed: ${statusCode} ${body}`);
-      throw DockerHub.parseError(resp, body);
-    }
-
-    return <T>JSON.parse(body);
-  }
-
-  private static getPlatformManifestDigest(index: Index, osOverride?: string): string {
-    // This doesn't handle all possible platforms normalizations, but it's good enough for now.
-    let pos: string = osOverride || os.platform();
-    if (pos == 'win32') {
-      pos = 'windows';
-    }
-    let arch = os.arch();
-    if (arch == 'x64') {
-      arch = 'amd64';
-    }
-    let variant = '';
-    if (arch == 'arm') {
-      variant = 'v7';
-    }
-
-    const manifest = index.manifests.find(m => {
-      if (!m.platform) {
-        return false;
-      }
-      if (m.platform.os != pos) {
-        core.debug(`Skipping manifest ${m.digest} because of os: ${m.platform.os} != ${pos}`);
-        return false;
-      }
-      if (m.platform.architecture != arch) {
-        core.debug(`Skipping manifest ${m.digest} because of arch: ${m.platform.architecture} != ${arch}`);
-        return false;
-      }
-      if ((m.platform.variant || '') != variant) {
-        core.debug(`Skipping manifest ${m.digest} because of variant: ${m.platform.variant} != ${variant}`);
-        return false;
-      }
-
-      return true;
-    });
-    if (!manifest) {
-      core.error(`Cannot find manifest for ${pos}/${arch}/${variant}`);
-      throw new Error(`Cannot find manifest for ${pos}/${arch}/${variant}`);
-    }
-
-    return manifest.digest;
-  }
-}
--- a/src/regclient/install.ts
+++ b/src/regclient/install.ts
@@ -0,0 +1,155 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import * as core from '@actions/core';
+import * as httpm from '@actions/http-client';
+import * as tc from '@actions/tool-cache';
+import * as semver from 'semver';
+import * as util from 'util';
+
+import {Cache} from '../cache';
+import {Context} from '../context';
+
+import {GitHubRelease} from '../types/github';
+import {DownloadVersion} from '../types/regclient/regclient';
+
+export class Install {
+  /*
+   * Download regclient binary from GitHub release
+   * @param v: version semver version or latest
+   * @param ghaNoCache: disable binary caching in GitHub Actions cache backend
+   * @returns path to the regclient binary
+   */
+  public async download(v: string, ghaNoCache?: boolean): Promise<string> {
+    const version: DownloadVersion = await Install.getDownloadVersion(v);
+    core.debug(`Install.download version: ${version.version}`);
+
+    const release: GitHubRelease = await Install.getRelease(version);
+    core.debug(`Install.download release tag name: ${release.tag_name}`);
+
+    const vspec = await this.vspec(release.tag_name);
+    core.debug(`Install.download vspec: ${vspec}`);
+
+    const c = semver.clean(vspec) || '';
+    if (!semver.valid(c)) {
+      throw new Error(`Invalid regclient version "${vspec}".`);
+    }
+
+    const installCache = new Cache({
+      htcName: 'regctl-dl-bin',
+      htcVersion: vspec,
+      baseCacheDir: path.join(os.homedir(), '.bin'),
+      cacheFile: os.platform() == 'win32' ? 'regctl.exe' : 'regctl',
+      ghaNoCache: ghaNoCache
+    });
+
+    const cacheFoundPath = await installCache.find();
+    if (cacheFoundPath) {
+      core.info(`regctl binary found in ${cacheFoundPath}`);
+      return cacheFoundPath;
+    }
+
+    const downloadURL = util.format(version.downloadURL, vspec, this.filename());
+    core.info(`Downloading ${downloadURL}`);
+
+    const htcDownloadPath = await tc.downloadTool(downloadURL);
+    core.debug(`Install.download htcDownloadPath: ${htcDownloadPath}`);
+
+    const cacheSavePath = await installCache.save(htcDownloadPath);
+    core.info(`Cached to ${cacheSavePath}`);
+    return cacheSavePath;
+  }
+
+  public async install(binPath: string, dest?: string): Promise<string> {
+    dest = dest || Context.tmpDir();
+
+    const binDir = path.join(dest, 'regctl-bin');
+    if (!fs.existsSync(binDir)) {
+      fs.mkdirSync(binDir, {recursive: true});
+    }
+    const binName: string = os.platform() == 'win32' ? 'regctl.exe' : 'regctl';
+    const regctlPath: string = path.join(binDir, binName);
+    fs.copyFileSync(binPath, regctlPath);
+
+    core.info('Fixing perms');
+    fs.chmodSync(regctlPath, '0755');
+
+    core.addPath(binDir);
+    core.info('Added regctl to PATH');
+
+    core.info(`Binary path: ${regctlPath}`);
+    return regctlPath;
+  }
+
+  private filename(): string {
+    let arch: string;
+    switch (os.arch()) {
+      case 'x64': {
+        arch = 'amd64';
+        break;
+      }
+      case 'ppc64': {
+        arch = 'ppc64le';
+        break;
+      }
+      case 'arm': {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const arm_version = (process.config.variables as any).arm_version;
+        arch = arm_version ? 'armv' + arm_version : 'arm';
+        break;
+      }
+      default: {
+        arch = os.arch();
+        break;
+      }
+    }
+    const platform: string = os.platform() == 'win32' ? 'windows' : os.platform();
+    const ext: string = os.platform() == 'win32' ? '.exe' : '';
+    return util.format('regctl-%s-%s%s', platform, arch, ext);
+  }
+
+  private async vspec(version: string): Promise<string> {
+    const v = version.replace(/^v+|v+$/g, '');
+    core.info(`Use ${v} version spec cache key for ${version}`);
+    return v;
+  }
+
+  public static async getDownloadVersion(v: string): Promise<DownloadVersion> {
+    return {
+      version: v,
+      downloadURL: 'https://github.com/regclient/regclient/releases/download/v%s/%s',
+      releasesURL: 'https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/regclient-releases.json'
+    };
+  }
+
+  public static async getRelease(version: DownloadVersion): Promise<GitHubRelease> {
+    const http: httpm.HttpClient = new httpm.HttpClient('docker-actions-toolkit');
+    const resp: httpm.HttpClientResponse = await http.get(version.releasesURL);
+    const body = await resp.readBody();
+    const statusCode = resp.message.statusCode || 500;
+    if (statusCode >= 400) {
+      throw new Error(`Failed to get regclient releases from ${version.releasesURL} with status code ${statusCode}: ${body}`);
+    }
+    const releases = <Record<string, GitHubRelease>>JSON.parse(body);
+    if (!releases[version.version]) {
+      throw new Error(`Cannot find regclient release ${version.version} in ${version.releasesURL}`);
+    }
+    return releases[version.version];
+  }
+}
--- a/src/regclient/regctl.ts
+++ b/src/regclient/regctl.ts
@@ -0,0 +1,128 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import * as core from '@actions/core';
+import * as semver from 'semver';
+
+import {Exec} from '../exec';
+
+import {Manifest} from '../types/oci/manifest';
+
+export interface RegctlOpts {
+  binPath?: string;
+}
+
+export interface RegctlBlobGetOpts {
+  repository: string;
+  digest: string;
+}
+
+export interface RegctlManifestGetOpts {
+  image: string;
+  platform?: string;
+}
+
+export class Regctl {
+  private readonly binPath: string;
+  private _version: string;
+  private _versionOnce: boolean;
+
+  constructor(opts?: RegctlOpts) {
+    this.binPath = opts?.binPath || 'regctl';
+    this._version = '';
+    this._versionOnce = false;
+  }
+
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  public async blobGet(opts: RegctlBlobGetOpts): Promise<any> {
+    return await Exec.getExecOutput(this.binPath, ['blob', 'get', opts.repository, opts.digest], {
+      ignoreReturnCode: true,
+      silent: true
+    }).then(res => {
+      if (res.stderr.length > 0 && res.exitCode != 0) {
+        throw new Error(res.stderr.trim());
+      }
+      return res.stdout;
+    });
+  }
+
+  public async manifestGet(opts: RegctlManifestGetOpts): Promise<Manifest> {
+    return await Exec.getExecOutput(this.binPath, ['manifest', 'get', opts.image, `--platform=${opts.platform ?? 'local'}`, `--format={{json .}}`], {
+      ignoreReturnCode: true,
+      silent: true
+    }).then(res => {
+      if (res.stderr.length > 0 && res.exitCode != 0) {
+        throw new Error(res.stderr.trim());
+      }
+      return <Manifest>JSON.parse(res.stdout.trim());
+    });
+  }
+
+  public async isAvailable(): Promise<boolean> {
+    const ok: boolean = await Exec.getExecOutput(this.binPath, [], {
+      ignoreReturnCode: true,
+      silent: true
+    })
+      .then(res => {
+        if (res.stderr.length > 0 && res.exitCode != 0) {
+          core.debug(`Regctl.isAvailable cmd err: ${res.stderr.trim()}`);
+          return false;
+        }
+        return res.exitCode == 0;
+      })
+      .catch(error => {
+        core.debug(`Regctl.isAvailable error: ${error}`);
+        return false;
+      });
+
+    core.debug(`Regctl.isAvailable: ${ok}`);
+    return ok;
+  }
+
+  public async version(): Promise<string> {
+    if (this._versionOnce) {
+      return this._version;
+    }
+    this._versionOnce = true;
+    this._version = await Exec.getExecOutput(this.binPath, ['version', '--format', '{{.VCSTag}}'], {
+      ignoreReturnCode: true,
+      silent: true
+    }).then(res => {
+      if (res.stderr.length > 0 && res.exitCode != 0) {
+        throw new Error(res.stderr.trim());
+      }
+      return res.stdout.trim();
+    });
+    return this._version;
+  }
+
+  public async printVersion() {
+    await Exec.exec(this.binPath, ['version'], {
+      failOnStdErr: false
+    });
+  }
+
+  public async versionSatisfies(range: string, version?: string): Promise<boolean> {
+    const ver = version ?? (await this.version());
+    if (!ver) {
+      core.debug(`Regctl.versionSatisfies false: undefined version`);
+      return false;
+    }
+    const res = semver.satisfies(ver, range) || /^[0-9a-f]{7}$/.exec(ver) !== null;
+    core.debug(`Regctl.versionSatisfies ${ver} statisfies ${range}: ${res}`);
+    return res;
+  }
+}
--- a/src/types/buildx/builder.ts
+++ b/src/types/buildx/builder.ts
@@ -34,13 +34,24 @@ export interface NodeInfo extends Node {
  buildkit?: string;
  features?: Record<string, boolean>;
  labels?: Record<string, string>;
+  devices?: Array<Device>;
  gcPolicy?: Array<GCPolicy>;
  files?: Record<string, string>;
 }

+export interface Device {
+  name?: string;
+  annotations?: Record<string, string>;
+  autoAllow?: boolean;
+  onDemand?: boolean;
+}
+
 export interface GCPolicy {
  all?: boolean;
  filter?: string[];
  keepDuration?: string;
-  keepBytes?: string;
+  keepBytes?: string; // deprecated, use reservedSpace instead
+  reservedSpace?: string;
+  maxUsedSpace?: string;
+  minFreeSpace?: string;
 }
--- a/src/types/buildx/history.ts
+++ b/src/types/buildx/history.ts
@@ -14,31 +14,123 @@
 * limitations under the License.
 */

-export interface ExportRecordOpts {
-  refs: Array<string>;
-  image?: string;
+export interface InspectOpts {
+  ref?: string;
+  builder?: string;
 }

-export interface ExportRecordResponse {
+export type BuildStatus = 'completed' | 'running' | 'failed' | 'canceled';
+
+export interface InspectResponse {
+  Name: string;
+  Ref: string;
+
+  Context?: string;
+  Dockerfile?: string;
+  VCSRepository?: string;
+  VCSRevision?: string;
+  Target?: string;
+  Platform?: Array<string>;
+  KeepGitDir?: boolean;
+
+  NamedContexts?: Array<InspectKeyValueOutput>;
+
+  StartedAt?: Date;
+  CompletedAt?: Date;
+  Duration: number;
+  Status: BuildStatus;
+  Error?: InspectErrorOutput;
+
+  NumCompletedSteps: number;
+  NumTotalSteps: number;
+  NumCachedSteps: number;
+
+  BuildArgs?: Array<InspectKeyValueOutput>;
+  Labels?: Array<InspectKeyValueOutput>;
+
+  Config?: InspectConfigOutput;
+
+  Materials?: InspectMaterialOutput[];
+  Attachments?: InspectAttachmentOutput[];
+
+  Errors?: Array<string>;
+}
+
+export interface InspectConfigOutput {
+  Network?: string;
+  ExtraHosts?: Array<string>;
+  Hostname?: string;
+  CgroupParent?: string;
+  ImageResolveMode?: string;
+  MultiPlatform?: boolean;
+  NoCache?: boolean;
+  NoCacheFilter?: Array<string>;
+
+  ShmSize?: string;
+  Ulimit?: string;
+  CacheMountNS?: string;
+  DockerfileCheckConfig?: string;
+  SourceDateEpoch?: string;
+  SandboxHostname?: string;
+
+  RestRaw?: Array<InspectKeyValueOutput>;
+}
+
+export interface InspectMaterialOutput {
+  URI?: string;
+  Digests?: Array<string>;
+}
+
+export interface InspectAttachmentOutput {
+  Digest?: string;
+  Platform?: string;
+  Type?: string;
+}
+
+export interface InspectErrorOutput {
+  Code?: number;
+  Message?: string;
+  Name?: string;
+  Logs?: Array<string>;
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  Sources?: any;
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  Stack?: any;
+}
+
+export interface InspectKeyValueOutput {
+  Name?: string;
+  Value?: string;
+}
+
+export interface ExportOpts {
+  refs: Array<string>;
+  noSummaries?: boolean;
+  image?: string;
+  useContainer?: boolean;
+}
+
+export interface ExportResponse {
  dockerbuildFilename: string;
  dockerbuildSize: number;
-  summaries: Summaries;
  builderName: string;
  nodeName: string;
  refs: Array<string>;
+  summaries?: Summaries;
 }

 export interface Summaries {
-  [ref: string]: RecordSummary;
+  [ref: string]: Summary;
 }

-export interface RecordSummary {
+export interface Summary {
  name: string;
  status: string;
  duration: string;
  numCachedSteps: number;
  numTotalSteps: number;
  numCompletedSteps: number;
-  frontendAttrs: Record<string, string>;
+  frontendAttrs?: Record<string, string>;
+  defaultPlatform?: string;
  error?: string;
 }
--- a/src/types/github.ts
+++ b/src/types/github.ts
@@ -19,7 +19,7 @@ import {components as OctoOpenApiTypes} from '@octokit/openapi-types';
 import {JwtPayload} from 'jwt-decode';

 import {BakeDefinition} from './buildx/bake';
-import {ExportRecordResponse} from './buildx/history';
+import {ExportResponse} from './buildx/history';

 export interface GitHubRelease {
  id: number;
@@ -57,9 +57,12 @@ export interface UploadArtifactResponse {
 }

 export interface BuildSummaryOpts {
-  exportRes: ExportRecordResponse;
+  exportRes: ExportResponse;
  uploadRes?: UploadArtifactResponse;
  // eslint-disable-next-line @typescript-eslint/no-explicit-any
  inputs?: any;
  bakeDefinition?: BakeDefinition;
+  // builder options
+  driver?: string;
+  endpoint?: string;
 }
--- a/src/types/regclient/regclient.ts
+++ b/src/types/regclient/regclient.ts
@@ -0,0 +1,21 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export interface DownloadVersion {
+  version: string;
+  downloadURL: string;
+  releasesURL: string;
+}
--- a/src/util.ts
+++ b/src/util.ts
@@ -204,4 +204,20 @@ export class Util {
    const rcp = path.resolve(childPath);
    return rcp.startsWith(rpp.endsWith(path.sep) ? rpp : `${rpp}${path.sep}`);
  }
+
+  public static formatDuration(ns: number): string {
+    if (ns === 0) return '0s';
+
+    const totalSeconds = Math.floor(ns / 1e9);
+    const hours = Math.floor(totalSeconds / 3600);
+    const minutes = Math.floor((totalSeconds % 3600) / 60);
+    const seconds = totalSeconds % 60;
+
+    const parts: string[] = [];
+    if (hours) parts.push(`${hours}h`);
+    if (minutes) parts.push(`${minutes}m`);
+    if (seconds || parts.length === 0) parts.push(`${seconds}s`);
+
+    return parts.join('');
+  }
 }
--- a/yarn.lock
+++ b/yarn.lock