[vul-4686, vul-4688] - buildkit v0.24.0

[ddl-dclegg]

PR Type

⚠️ NOTE: If you make changes to the version of Buildkit, you must also update the values.yaml file in hephaestus. ⚠️

What kind of change does this PR introduce?

• Bugfix
• Feature
• Code style update (formatting)
• Refactoring (no functional changes)
• CI related changes
• Other... Please describe:

What is the current behavior?

Issue Number:

• VUL-4688 - buildkit rootless
• VUL-4686 - buildkit

What is the new behavior?

Does this PR introduce a breaking change?

• Yes
• No

Other information

moby/buildkit@v0.23.2...v0.24.0

Upstream notes:

Notable Changes

• Built-in Dockerfile frontend has been updated to v1.18.0
• LLB Git operation now allows controlling if submodules should be initialized (default) or skipped. add keep-git-dir and submodules controls for Git querystring URLs moby/buildkit#6173
• Max-parallelism control can now also be set with --max-parallelism daemon flag. buildkitd: add flag to set max parallelism moby/buildkit#6105
• Improve errors when using build arguments in COPY --from flag value. dockerfile: show error when args used in COPY --from moby/buildkit#6153
• Debug server now supports new endpoints for inspecting the cache key database and remote cache manifests. In order to debug plaintexts of the cache keys --save-cache-debug needs to be enabled in the daemon. debug: allow debug from remote cache config moby/buildkit#6076 add cache key debuginfo lookup moby/buildkit#6061 cache: add cache debug plaintext for image manifest and http moby/buildkit#6133
• Base Alpine version has been updated to 3.22. update alpine to 3.22 moby/buildkit#6048
• Client now allows configuring exporter content store. client: allow configuring exporter content store moby/buildkit#6045
• Release binary artifacts now use Git commit time as timestamp. Use commit date in release binary artifacts moby/buildkit#6037
• Fix incorrect empty checkout when accessing Git source with subdir pointing to a submodule. git: fix subdir filter on submodule dir moby/buildkit#6170
• Fix allowing device entitlement for buildkitd daemon with startup flags. buildkitd: handle device insecure entitlement moby/buildkit#6080
• Fix possible panic from BoltDB when copying lots of files between build steps. vendor: go.etcd.io/bbolt v1.4.3 moby/buildkit#6159 vendor: go.etcd.io/bbolt v1.4.2 moby/buildkit#6136 Panic at checksum generation (probably when copying a lot of files between build steps) moby/buildkit#6165
• Fix possible deadlocks from the error handler in the sync package. vendor: update x/sync to v0.16.0 moby/buildkit#6158
• Fix issue with exporting cache with different compression formats for images with lots of layers. [cache] Fix descriptor duplication in getAvailableBlobs moby/buildkit#6092 Worker OOM when exporting cache after builds with different compression types for images with lots of layers moby/buildkit#6088
• Fix displaying error details on unexpected response status code. fix: display error details on unexpected response status code errors moby/buildkit#6067
• Fix incorrect empty checkout when accessing Git source with subdir pointing to a submodule. git: fix subdir filter on submodule dir moby/buildkit#6170

Dependency Changes

• github.com/containerd/containerd/v2 v2.1.3 -> v2.1.4
• github.com/cpuguy83/go-md2man/v2 v2.0.5 -> v2.0.7
• github.com/docker/cli v28.2.2 -> v28.3.3
• github.com/docker/docker v28.2.2 -> v28.3.3
• github.com/moby/profiles/seccomp v0.1.0 new
• github.com/urfave/cli v1.22.16 -> v1.22.17
• go.etcd.io/bbolt v1.4.0 -> v1.4.3
• go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.56.0 -> v0.60.0
• go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.31.0 -> v1.35.0
• go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.31.0 -> v1.35.0
• golang.org/x/sync v0.14.0 -> v0.16.0