diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 489eef5f6bae..c22ff27766f9 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -23,7 +23,9 @@ env:
   CACHE_GHA_SCOPE_IT: "integration-tests"
   CACHE_GHA_SCOPE_BINARIES: "binaries"
   CACHE_GHA_SCOPE_CROSS: "cross"
+  TESTFLAGS: "-v --parallel=6 --timeout=30m"
   BUILDX_VERSION: "v0.8.2"  # leave empty to use the one available on GitHub virtual environment
+  GO_VERSION: "1.19"
 
 jobs:
   base:
@@ -108,7 +110,6 @@ jobs:
       -
         name: Test pkg=${{ matrix.pkg }} ; typ=${{ matrix.typ }} ; skipit=${{ matrix.skip-integration-tests }} ; worker=${{ matrix.worker }}
         run: |
-          export TESTFLAGS="-v --parallel=6 --timeout=20m"
           if [ -n "${{ matrix.worker }}" ]; then
             export TESTFLAGS="${TESTFLAGS} --run=//worker=${{ matrix.worker }}$"
           fi
@@ -143,7 +144,7 @@ jobs:
         name: Set up Go
         uses: actions/setup-go@v2
         with:
-          go-version: 1.16
+          go-version: ${{ env.GO_VERSION }}
       -
         name: Cache Go modules
         uses: actions/cache@v2
@@ -163,7 +164,7 @@ jobs:
           SKIP_INTEGRATION_TESTS: 1
         run: |
           mkdir -p ./coverage
-          go test -coverprofile=./coverage/coverage-${{ github.job }}-${{ matrix.os }}.txt -covermode=atomic ./...
+          go test -coverprofile=./coverage/coverage-${{ github.job }}-${{ matrix.os }}.txt -covermode=atomic ${TESTFLAGS} ./...
         shell: bash
       -
         name: Upload coverage file
diff --git a/.github/workflows/dockerd.yml b/.github/workflows/dockerd.yml
index 04ece8563be4..c76970881968 100644
--- a/.github/workflows/dockerd.yml
+++ b/.github/workflows/dockerd.yml
@@ -13,6 +13,8 @@ env:
   REPO_SLUG_ORIGIN: "moby/buildkit:latest"
   CACHE_GHA_SCOPE_IT: "integration-tests"
   CACHE_GHA_SCOPE_BINARIES: "binaries"
+  TESTFLAGS: "-v --parallel=1 --timeout=30m"
+  BUILDX_VERSION: "v0.8.2"  # leave empty to use the one available on GitHub virtual environment
 
 jobs:
   prepare:
@@ -43,6 +45,7 @@ jobs:
         name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v1
         with:
+          version: ${{ env.BUILDX_VERSION }}
           driver-opts: image=${{ env.REPO_SLUG_ORIGIN }}
           buildkitd-flags: --debug
       -
@@ -107,6 +110,7 @@ jobs:
         name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v1
         with:
+          version: ${{ env.BUILDX_VERSION }}
           driver-opts: image=${{ env.REPO_SLUG_ORIGIN }}
           buildkitd-flags: --debug
       -
@@ -134,6 +138,6 @@ jobs:
           TEST_DOCKERD: "1"
           TEST_DOCKERD_BINARY: "./build/dockerd"
           TESTPKGS: "${{ matrix.pkg }}"
-          TESTFLAGS: "-v --parallel=1 --timeout=30m --run=//worker=dockerd$"
+          TESTFLAGS: "${{ env.TESTFLAGS }} --run=//worker=dockerd$"
           SKIP_INTEGRATION_TESTS: "${{ matrix.skip-integration-tests }}"
           CACHE_FROM: "type=gha,scope=${{ env.CACHE_GHA_SCOPE_IT }} type=gha,scope=${{ env.CACHE_GHA_SCOPE_BINARIES }}"
diff --git a/.golangci.yml b/.golangci.yml
index 28911415b7d0..2093a75454ac 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -11,6 +11,7 @@ run:
 linters:
   enable:
     - deadcode
+    - depguard
     - gofmt
     - goimports
     - revive
@@ -30,6 +31,13 @@ linters:
   disable-all: true
 
 linters-settings:
+  depguard:
+    list-type: blacklist
+    include-go-root: true
+    packages:
+      # The io/ioutil package has been deprecated.
+      # https://go.dev/doc/go1.16#ioutil
+      - io/ioutil
   importas:
     alias:
       - pkg: "github.com/opencontainers/image-spec/specs-go/v1"
diff --git a/Dockerfile b/Dockerfile
index f36534b26adf..bb9a86c69847 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -22,7 +22,7 @@ RUN apk add --no-cache git
 # xx is a helper for cross-compilation
 FROM --platform=$BUILDPLATFORM tonistiigi/xx@sha256:1e96844fadaa2f9aea021b2b05299bc02fe4c39a92d8e735b93e8e2b15610128 AS xx
 
-FROM --platform=$BUILDPLATFORM golang:1.17-alpine AS golatest
+FROM --platform=$BUILDPLATFORM golang:1.19-alpine AS golatest
 
 # gobuild is base stage for compiling go/cgo
 FROM golatest AS gobuild-base
@@ -123,7 +123,7 @@ RUN git clone https://github.com/containerd/containerd.git containerd
 FROM gobuild-base AS containerd-base
 WORKDIR /go/src/github.com/containerd/containerd
 ARG TARGETPLATFORM
-ENV CGO_ENABLED=1 BUILDTAGS=no_btrfs
+ENV CGO_ENABLED=1 BUILDTAGS=no_btrfs GO111MODULE=off
 RUN xx-apk add musl-dev gcc && xx-go --wrap
 
 FROM containerd-base AS containerd
diff --git a/cache/contenthash/checksum_test.go b/cache/contenthash/checksum_test.go
index 713c7a560913..0055298bad67 100644
--- a/cache/contenthash/checksum_test.go
+++ b/cache/contenthash/checksum_test.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -43,7 +42,7 @@ const (
 
 func TestChecksumSymlinkNoParentScan(t *testing.T) {
 	t.Parallel()
-	tmpdir, err := ioutil.TempDir("", "buildkit-state")
+	tmpdir, err := os.MkdirTemp("", "buildkit-state")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -72,7 +71,7 @@ func TestChecksumSymlinkNoParentScan(t *testing.T) {
 
 func TestChecksumHardlinks(t *testing.T) {
 	t.Parallel()
-	tmpdir, err := ioutil.TempDir("", "buildkit-state")
+	tmpdir, err := os.MkdirTemp("", "buildkit-state")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -155,7 +154,7 @@ func TestChecksumHardlinks(t *testing.T) {
 
 func TestChecksumWildcardOrFilter(t *testing.T) {
 	t.Parallel()
-	tmpdir, err := ioutil.TempDir("", "buildkit-state")
+	tmpdir, err := os.MkdirTemp("", "buildkit-state")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -212,7 +211,7 @@ func TestChecksumWildcardOrFilter(t *testing.T) {
 
 func TestChecksumWildcardWithBadMountable(t *testing.T) {
 	t.Parallel()
-	tmpdir, err := ioutil.TempDir("", "buildkit-state")
+	tmpdir, err := os.MkdirTemp("", "buildkit-state")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -232,7 +231,7 @@ func TestChecksumWildcardWithBadMountable(t *testing.T) {
 
 func TestSymlinksNoFollow(t *testing.T) {
 	t.Parallel()
-	tmpdir, err := ioutil.TempDir("", "buildkit-state")
+	tmpdir, err := os.MkdirTemp("", "buildkit-state")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -291,7 +290,7 @@ func TestSymlinksNoFollow(t *testing.T) {
 
 func TestChecksumBasicFile(t *testing.T) {
 	t.Parallel()
-	tmpdir, err := ioutil.TempDir("", "buildkit-state")
+	tmpdir, err := os.MkdirTemp("", "buildkit-state")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -449,7 +448,7 @@ func TestChecksumIncludeExclude(t *testing.T) {
 func testChecksumIncludeExclude(t *testing.T, wildcard bool) {
 	t.Parallel()
 
-	tmpdir, err := ioutil.TempDir("", "buildkit-state")
+	tmpdir, err := os.MkdirTemp("", "buildkit-state")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -584,7 +583,7 @@ func testChecksumIncludeExclude(t *testing.T, wildcard bool) {
 
 func TestChecksumIncludeDoubleStar(t *testing.T) {
 	t.Parallel()
-	tmpdir, err := ioutil.TempDir("", "buildkit-state")
+	tmpdir, err := os.MkdirTemp("", "buildkit-state")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -652,7 +651,7 @@ func TestChecksumIncludeDoubleStar(t *testing.T) {
 
 func TestChecksumIncludeSymlink(t *testing.T) {
 	t.Parallel()
-	tmpdir, err := ioutil.TempDir("", "buildkit-state")
+	tmpdir, err := os.MkdirTemp("", "buildkit-state")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -725,7 +724,7 @@ func TestChecksumIncludeSymlink(t *testing.T) {
 
 func TestHandleChange(t *testing.T) {
 	t.Parallel()
-	tmpdir, err := ioutil.TempDir("", "buildkit-state")
+	tmpdir, err := os.MkdirTemp("", "buildkit-state")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -803,7 +802,7 @@ func TestHandleChange(t *testing.T) {
 
 func TestHandleRecursiveDir(t *testing.T) {
 	t.Parallel()
-	tmpdir, err := ioutil.TempDir("", "buildkit-state")
+	tmpdir, err := os.MkdirTemp("", "buildkit-state")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -852,7 +851,7 @@ func TestHandleRecursiveDir(t *testing.T) {
 
 func TestChecksumUnorderedFiles(t *testing.T) {
 	t.Parallel()
-	tmpdir, err := ioutil.TempDir("", "buildkit-state")
+	tmpdir, err := os.MkdirTemp("", "buildkit-state")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -905,7 +904,7 @@ func TestChecksumUnorderedFiles(t *testing.T) {
 
 func TestSymlinkInPathScan(t *testing.T) {
 	t.Parallel()
-	tmpdir, err := ioutil.TempDir("", "buildkit-state")
+	tmpdir, err := os.MkdirTemp("", "buildkit-state")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -936,7 +935,7 @@ func TestSymlinkInPathScan(t *testing.T) {
 
 func TestSymlinkNeedsScan(t *testing.T) {
 	t.Parallel()
-	tmpdir, err := ioutil.TempDir("", "buildkit-state")
+	tmpdir, err := os.MkdirTemp("", "buildkit-state")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -969,7 +968,7 @@ func TestSymlinkNeedsScan(t *testing.T) {
 
 func TestSymlinkAbsDirSuffix(t *testing.T) {
 	t.Parallel()
-	tmpdir, err := ioutil.TempDir("", "buildkit-state")
+	tmpdir, err := os.MkdirTemp("", "buildkit-state")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -996,7 +995,7 @@ func TestSymlinkAbsDirSuffix(t *testing.T) {
 
 func TestSymlinkThroughParent(t *testing.T) {
 	t.Parallel()
-	tmpdir, err := ioutil.TempDir("", "buildkit-state")
+	tmpdir, err := os.MkdirTemp("", "buildkit-state")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -1051,7 +1050,7 @@ func TestSymlinkThroughParent(t *testing.T) {
 
 func TestSymlinkInPathHandleChange(t *testing.T) {
 	t.Parallel()
-	tmpdir, err := ioutil.TempDir("", "buildkit-state")
+	tmpdir, err := os.MkdirTemp("", "buildkit-state")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -1114,7 +1113,7 @@ func TestSymlinkInPathHandleChange(t *testing.T) {
 
 func TestPersistence(t *testing.T) {
 	t.Parallel()
-	tmpdir, err := ioutil.TempDir("", "buildkit-state")
+	tmpdir, err := os.MkdirTemp("", "buildkit-state")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
diff --git a/cache/manager_test.go b/cache/manager_test.go
index 6dff7c177b78..ecd26de32120 100644
--- a/cache/manager_test.go
+++ b/cache/manager_test.go
@@ -8,7 +8,6 @@ import (
 	"encoding/binary"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -75,7 +74,7 @@ func newCacheManager(ctx context.Context, opt cmOpt) (co *cmOut, cleanup func()
 		opt.snapshotterName = "native"
 	}
 
-	tmpdir, err := ioutil.TempDir("", "cachemanager")
+	tmpdir, err := os.MkdirTemp("", "cachemanager")
 	if err != nil {
 		return nil, nil, err
 	}
@@ -167,14 +166,14 @@ func TestSharableMountPoolCleanup(t *testing.T) {
 	t.Parallel()
 	ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")
 
-	tmpdir, err := ioutil.TempDir("", "cachemanager")
+	tmpdir, err := os.MkdirTemp("", "cachemanager")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
 	// Emulate the situation where the pool dir is dirty
 	mountPoolDir := filepath.Join(tmpdir, "cachemounts")
 	require.NoError(t, os.MkdirAll(mountPoolDir, 0700))
-	_, err = ioutil.TempDir(mountPoolDir, "buildkit")
+	_, err = os.MkdirTemp(mountPoolDir, "buildkit")
 	require.NoError(t, err)
 
 	// Initialize cache manager and check if pool is cleaned up
@@ -194,7 +193,7 @@ func TestManager(t *testing.T) {
 
 	ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")
 
-	tmpdir, err := ioutil.TempDir("", "cachemanager")
+	tmpdir, err := os.MkdirTemp("", "cachemanager")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -317,7 +316,7 @@ func TestManager(t *testing.T) {
 	err = cm.Close()
 	require.NoError(t, err)
 
-	dirs, err := ioutil.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
+	dirs, err := os.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
 	require.NoError(t, err)
 	require.Equal(t, 0, len(dirs))
 }
@@ -326,7 +325,7 @@ func TestLazyGetByBlob(t *testing.T) {
 	t.Parallel()
 	ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")
 
-	tmpdir, err := ioutil.TempDir("", "cachemanager")
+	tmpdir, err := os.MkdirTemp("", "cachemanager")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -371,7 +370,7 @@ func TestMergeBlobchainID(t *testing.T) {
 	t.Parallel()
 	ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")
 
-	tmpdir, err := ioutil.TempDir("", "cachemanager")
+	tmpdir, err := os.MkdirTemp("", "cachemanager")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -444,7 +443,7 @@ func TestSnapshotExtract(t *testing.T) {
 	t.Parallel()
 	ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")
 
-	tmpdir, err := ioutil.TempDir("", "cachemanager")
+	tmpdir, err := os.MkdirTemp("", "cachemanager")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -487,7 +486,7 @@ func TestSnapshotExtract(t *testing.T) {
 
 	require.Equal(t, false, !snap2.(*immutableRef).getBlobOnly())
 
-	dirs, err := ioutil.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
+	dirs, err := os.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
 	require.NoError(t, err)
 	require.Equal(t, 0, len(dirs))
 
@@ -499,7 +498,7 @@ func TestSnapshotExtract(t *testing.T) {
 	require.Equal(t, true, !snap.(*immutableRef).getBlobOnly())
 	require.Equal(t, true, !snap2.(*immutableRef).getBlobOnly())
 
-	dirs, err = ioutil.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
+	dirs, err = os.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
 	require.NoError(t, err)
 	require.Equal(t, 2, len(dirs))
 
@@ -512,7 +511,7 @@ func TestSnapshotExtract(t *testing.T) {
 
 	require.Equal(t, len(buf.all), 0)
 
-	dirs, err = ioutil.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
+	dirs, err = os.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
 	require.NoError(t, err)
 	require.Equal(t, 2, len(dirs))
 
@@ -530,7 +529,7 @@ func TestSnapshotExtract(t *testing.T) {
 
 	checkDiskUsage(ctx, t, cm, 2, 0)
 
-	dirs, err = ioutil.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
+	dirs, err = os.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
 	require.NoError(t, err)
 	require.Equal(t, 2, len(dirs))
 
@@ -553,7 +552,7 @@ func TestSnapshotExtract(t *testing.T) {
 
 	require.Equal(t, len(buf.all), 1)
 
-	dirs, err = ioutil.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
+	dirs, err = os.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
 	require.NoError(t, err)
 	require.Equal(t, 1, len(dirs))
 
@@ -569,7 +568,7 @@ func TestSnapshotExtract(t *testing.T) {
 
 	checkDiskUsage(ctx, t, cm, 0, 0)
 
-	dirs, err = ioutil.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
+	dirs, err = os.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
 	require.NoError(t, err)
 	require.Equal(t, 0, len(dirs))
 
@@ -584,7 +583,7 @@ func TestExtractOnMutable(t *testing.T) {
 	t.Parallel()
 	ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")
 
-	tmpdir, err := ioutil.TempDir("", "cachemanager")
+	tmpdir, err := os.MkdirTemp("", "cachemanager")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -643,7 +642,7 @@ func TestExtractOnMutable(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, int64(len(b2)), size)
 
-	dirs, err := ioutil.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
+	dirs, err := os.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
 	require.NoError(t, err)
 	require.Equal(t, 1, len(dirs))
 
@@ -664,7 +663,7 @@ func TestExtractOnMutable(t *testing.T) {
 
 	require.Equal(t, len(buf.all), 0)
 
-	dirs, err = ioutil.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
+	dirs, err = os.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
 	require.NoError(t, err)
 	require.Equal(t, 2, len(dirs))
 
@@ -682,7 +681,7 @@ func TestExtractOnMutable(t *testing.T) {
 
 	require.Equal(t, len(buf.all), 2)
 
-	dirs, err = ioutil.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
+	dirs, err = os.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
 	require.NoError(t, err)
 	require.Equal(t, 0, len(dirs))
 
@@ -693,7 +692,7 @@ func TestSetBlob(t *testing.T) {
 	t.Parallel()
 	ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")
 
-	tmpdir, err := ioutil.TempDir("", "cachemanager")
+	tmpdir, err := os.MkdirTemp("", "cachemanager")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -866,7 +865,7 @@ func TestPrune(t *testing.T) {
 	t.Parallel()
 	ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")
 
-	tmpdir, err := ioutil.TempDir("", "cachemanager")
+	tmpdir, err := os.MkdirTemp("", "cachemanager")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -896,7 +895,7 @@ func TestPrune(t *testing.T) {
 
 	checkDiskUsage(ctx, t, cm, 2, 0)
 
-	dirs, err := ioutil.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
+	dirs, err := os.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
 	require.NoError(t, err)
 	require.Equal(t, 2, len(dirs))
 
@@ -909,7 +908,7 @@ func TestPrune(t *testing.T) {
 	checkDiskUsage(ctx, t, cm, 2, 0)
 	require.Equal(t, len(buf.all), 0)
 
-	dirs, err = ioutil.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
+	dirs, err = os.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
 	require.NoError(t, err)
 	require.Equal(t, 2, len(dirs))
 
@@ -927,7 +926,7 @@ func TestPrune(t *testing.T) {
 	checkDiskUsage(ctx, t, cm, 1, 0)
 	require.Equal(t, len(buf.all), 1)
 
-	dirs, err = ioutil.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
+	dirs, err = os.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
 	require.NoError(t, err)
 	require.Equal(t, 1, len(dirs))
 
@@ -967,7 +966,7 @@ func TestPrune(t *testing.T) {
 	checkDiskUsage(ctx, t, cm, 0, 0)
 	require.Equal(t, len(buf.all), 2)
 
-	dirs, err = ioutil.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
+	dirs, err = os.ReadDir(filepath.Join(tmpdir, "snapshots/snapshots"))
 	require.NoError(t, err)
 	require.Equal(t, 0, len(dirs))
 }
@@ -977,7 +976,7 @@ func TestLazyCommit(t *testing.T) {
 
 	ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")
 
-	tmpdir, err := ioutil.TempDir("", "cachemanager")
+	tmpdir, err := os.MkdirTemp("", "cachemanager")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -1135,7 +1134,7 @@ func TestLoopLeaseContent(t *testing.T) {
 
 	ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")
 
-	tmpdir, err := ioutil.TempDir("", "cachemanager")
+	tmpdir, err := os.MkdirTemp("", "cachemanager")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -1252,7 +1251,7 @@ func TestSharingCompressionVariant(t *testing.T) {
 
 	ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")
 
-	tmpdir, err := ioutil.TempDir("", "cachemanager")
+	tmpdir, err := os.MkdirTemp("", "cachemanager")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -1520,7 +1519,7 @@ func TestConversion(t *testing.T) {
 
 	ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")
 
-	tmpdir, err := ioutil.TempDir("", "cachemanager")
+	tmpdir, err := os.MkdirTemp("", "cachemanager")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -1617,7 +1616,7 @@ func TestGetRemotes(t *testing.T) {
 
 	ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")
 
-	tmpdir, err := ioutil.TempDir("", "cachemanager")
+	tmpdir, err := os.MkdirTemp("", "cachemanager")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -1917,7 +1916,7 @@ func TestNondistributableBlobs(t *testing.T) {
 
 	ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")
 
-	tmpdir, err := ioutil.TempDir("", "cachemanager")
+	tmpdir, err := os.MkdirTemp("", "cachemanager")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -2048,7 +2047,7 @@ func TestMergeOp(t *testing.T) {
 
 	ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")
 
-	tmpdir, err := ioutil.TempDir("", "cachemanager")
+	tmpdir, err := os.MkdirTemp("", "cachemanager")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -2168,7 +2167,7 @@ func TestDiffOp(t *testing.T) {
 
 	ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")
 
-	tmpdir, err := ioutil.TempDir("", "cachemanager")
+	tmpdir, err := os.MkdirTemp("", "cachemanager")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -2272,7 +2271,7 @@ func TestLoadHalfFinalizedRef(t *testing.T) {
 
 	ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")
 
-	tmpdir, err := ioutil.TempDir("", "cachemanager")
+	tmpdir, err := os.MkdirTemp("", "cachemanager")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -2352,7 +2351,7 @@ func TestMountReadOnly(t *testing.T) {
 
 	ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")
 
-	tmpdir, err := ioutil.TempDir("", "cachemanager")
+	tmpdir, err := os.MkdirTemp("", "cachemanager")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -2658,7 +2657,7 @@ func fileToBlob(file *os.File, compress bool) ([]byte, ocispecs.Descriptor, erro
 }
 
 func mapToSystemTarBlob(m map[string]string) ([]byte, ocispecs.Descriptor, error) {
-	tmpdir, err := ioutil.TempDir("", "tarcreation")
+	tmpdir, err := os.MkdirTemp("", "tarcreation")
 	if err != nil {
 		return nil, ocispecs.Descriptor{}, err
 	}
@@ -2667,7 +2666,7 @@ func mapToSystemTarBlob(m map[string]string) ([]byte, ocispecs.Descriptor, error
 	expected := map[string]string{}
 	for k, v := range m {
 		expected[k] = v
-		if err := ioutil.WriteFile(filepath.Join(tmpdir, k), []byte(v), 0600); err != nil {
+		if err := os.WriteFile(filepath.Join(tmpdir, k), []byte(v), 0600); err != nil {
 			return nil, ocispecs.Descriptor{}, err
 		}
 	}
@@ -2696,7 +2695,7 @@ func mapToSystemTarBlob(m map[string]string) ([]byte, ocispecs.Descriptor, error
 			return nil, ocispecs.Descriptor{}, errors.Errorf("unexpected file %s", h.Name)
 		}
 		delete(expected, k)
-		gotV, err := ioutil.ReadAll(tr)
+		gotV, err := io.ReadAll(tr)
 		if err != nil {
 			return nil, ocispecs.Descriptor{}, err
 		}
diff --git a/cache/metadata/metadata_test.go b/cache/metadata/metadata_test.go
index 7e3d5b055df6..aa129cb2e2d2 100644
--- a/cache/metadata/metadata_test.go
+++ b/cache/metadata/metadata_test.go
@@ -1,7 +1,6 @@
 package metadata
 
 import (
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -13,7 +12,7 @@ import (
 func TestGetSetSearch(t *testing.T) {
 	t.Parallel()
 
-	tmpdir, err := ioutil.TempDir("", "buildkit-storage")
+	tmpdir, err := os.MkdirTemp("", "buildkit-storage")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -112,7 +111,7 @@ func TestGetSetSearch(t *testing.T) {
 func TestIndexes(t *testing.T) {
 	t.Parallel()
 
-	tmpdir, err := ioutil.TempDir("", "buildkit-storage")
+	tmpdir, err := os.MkdirTemp("", "buildkit-storage")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -172,7 +171,7 @@ func TestIndexes(t *testing.T) {
 func TestExternalData(t *testing.T) {
 	t.Parallel()
 
-	tmpdir, err := ioutil.TempDir("", "buildkit-storage")
+	tmpdir, err := os.MkdirTemp("", "buildkit-storage")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
diff --git a/cache/refs.go b/cache/refs.go
index 0eee8fd47a06..bbc38c481245 100644
--- a/cache/refs.go
+++ b/cache/refs.go
@@ -3,7 +3,6 @@ package cache
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -1591,9 +1590,10 @@ func (p sharableMountPool) setSharable(mounts snapshot.Mountable) snapshot.Mount
 // This is useful to share writable overlayfs mounts.
 //
 // NOTE: Mount() method doesn't return the underlying mount configuration (e.g. overlayfs mounts)
-//       instead it always return bind mounts of the temporary mount point. So if the caller
-//       needs to inspect the underlying mount configuration (e.g. for optimized differ for
-//       overlayfs), this wrapper shouldn't be used.
+//
+//	instead it always return bind mounts of the temporary mount point. So if the caller
+//	needs to inspect the underlying mount configuration (e.g. for optimized differ for
+//	overlayfs), this wrapper shouldn't be used.
 type sharableMountable struct {
 	snapshot.Mountable
 
@@ -1631,7 +1631,7 @@ func (sm *sharableMountable) Mount() (_ []mount.Mount, _ func() error, retErr er
 			// Don't need temporary mount wrapper for non-overlayfs mounts
 			return mounts, release, nil
 		}
-		dir, err := ioutil.TempDir(sm.mountPoolRoot, "buildkit")
+		dir, err := os.MkdirTemp(sm.mountPoolRoot, "buildkit")
 		if err != nil {
 			return nil, nil, err
 		}
diff --git a/cache/util/fsutil.go b/cache/util/fsutil.go
index b425a002a542..e90ed45f77f4 100644
--- a/cache/util/fsutil.go
+++ b/cache/util/fsutil.go
@@ -3,7 +3,6 @@ package util
 import (
 	"context"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 
@@ -59,7 +58,7 @@ func ReadFile(ctx context.Context, mount snapshot.Mountable, req ReadRequest) ([
 		}
 
 		if req.Range == nil {
-			dt, err = ioutil.ReadFile(fp)
+			dt, err = os.ReadFile(fp)
 			if err != nil {
 				return errors.WithStack(err)
 			}
@@ -68,7 +67,7 @@ func ReadFile(ctx context.Context, mount snapshot.Mountable, req ReadRequest) ([
 			if err != nil {
 				return errors.WithStack(err)
 			}
-			dt, err = ioutil.ReadAll(io.NewSectionReader(f, int64(req.Range.Offset), int64(req.Range.Length)))
+			dt, err = io.ReadAll(io.NewSectionReader(f, int64(req.Range.Offset), int64(req.Range.Length)))
 			f.Close()
 			if err != nil {
 				return errors.WithStack(err)
diff --git a/client/build_test.go b/client/build_test.go
index 23642de80f60..95091bdb4936 100644
--- a/client/build_test.go
+++ b/client/build_test.go
@@ -7,7 +7,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -134,7 +133,7 @@ func testClientGatewaySolve(t *testing.T, sb integration.Sandbox) {
 		return r, nil
 	}
 
-	tmpdir, err := ioutil.TempDir("", "buildkit")
+	tmpdir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -153,7 +152,7 @@ func testClientGatewaySolve(t *testing.T, sb integration.Sandbox) {
 	}, product, b, nil)
 	require.NoError(t, err)
 
-	read, err := ioutil.ReadFile(filepath.Join(tmpdir, "foo"))
+	read, err := os.ReadFile(filepath.Join(tmpdir, "foo"))
 	require.NoError(t, err)
 	require.Equal(t, testStr, string(read))
 
@@ -476,7 +475,7 @@ func testClientGatewayContainerExecPipe(t *testing.T, sb integration.Sandbox) {
 			Args:   []string{"cat"},
 			Cwd:    "/",
 			Tty:    false,
-			Stdin:  ioutil.NopCloser(stdin2),
+			Stdin:  io.NopCloser(stdin2),
 			Stdout: stdout2,
 		})
 
@@ -688,11 +687,11 @@ func testClientGatewayContainerMounts(t *testing.T, sb integration.Sandbox) {
 	require.NoError(t, err)
 	defer c.Close()
 
-	tmpdir, err := ioutil.TempDir("", "buildkit-buildctl")
+	tmpdir, err := os.MkdirTemp("", "buildkit-buildctl")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
-	err = ioutil.WriteFile(filepath.Join(tmpdir, "local-file"), []byte("local"), 0644)
+	err = os.WriteFile(filepath.Join(tmpdir, "local-file"), []byte("local"), 0644)
 	require.NoError(t, err)
 
 	a := agent.NewKeyring()
diff --git a/client/client.go b/client/client.go
index 8c9259a4a9d1..e97363a4e312 100644
--- a/client/client.go
+++ b/client/client.go
@@ -4,9 +4,9 @@ import (
 	"context"
 	"crypto/tls"
 	"crypto/x509"
-	"io/ioutil"
 	"net"
 	"net/url"
+	"os"
 	"strings"
 
 	"github.com/containerd/containerd/defaults"
@@ -212,7 +212,7 @@ func WithCredentials(serverName, ca, cert, key string) ClientOpt {
 }
 
 func loadCredentials(opts *withCredentials) (grpc.DialOption, error) {
-	ca, err := ioutil.ReadFile(opts.CACert)
+	ca, err := os.ReadFile(opts.CACert)
 	if err != nil {
 		return nil, errors.Wrap(err, "could not read ca certificate")
 	}
@@ -234,7 +234,6 @@ func loadCredentials(opts *withCredentials) (grpc.DialOption, error) {
 			return nil, errors.Wrap(err, "could not read certificate/key")
 		}
 		cfg.Certificates = []tls.Certificate{cert}
-		cfg.BuildNameToCertificate()
 	}
 
 	return grpc.WithTransportCredentials(credentials.NewTLS(cfg)), nil
diff --git a/client/client_test.go b/client/client_test.go
index 34b1b67aaa49..79d5803b8ab7 100644
--- a/client/client_test.go
+++ b/client/client_test.go
@@ -12,7 +12,6 @@ import (
 	"encoding/pem"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net"
 	"net/http"
 	"os"
@@ -200,11 +199,11 @@ func testCacheExportCacheKeyLoop(t *testing.T, sb integration.Sandbox) {
 	require.NoError(t, err)
 	defer c.Close()
 
-	tmpdir, err := ioutil.TempDir("", "buildkit-buildctl")
+	tmpdir, err := os.MkdirTemp("", "buildkit-buildctl")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
-	err = ioutil.WriteFile(filepath.Join(tmpdir, "foo"), []byte("foodata"), 0600)
+	err = os.WriteFile(filepath.Join(tmpdir, "foo"), []byte("foodata"), 0600)
 	require.NoError(t, err)
 
 	for _, mode := range []bool{false, true} {
@@ -299,7 +298,7 @@ func testExportBusyboxLocal(t *testing.T, sb integration.Sandbox) {
 	def, err := llb.Image("busybox").Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -441,7 +440,7 @@ func testSSHMount(t *testing.T, sb integration.Sandbox) {
 	def, err = out.Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -456,11 +455,11 @@ func testSSHMount(t *testing.T, sb integration.Sandbox) {
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "sock"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "sock"))
 	require.NoError(t, err)
 	require.Equal(t, "/run/buildkit/ssh_agent.0", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "out"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "out"))
 	require.NoError(t, err)
 	require.Contains(t, string(dt), "2048")
 	require.Contains(t, string(dt), "(RSA)")
@@ -488,7 +487,7 @@ func testSSHMount(t *testing.T, sb integration.Sandbox) {
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "out"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "out"))
 	require.NoError(t, err)
 	require.Contains(t, string(dt), "agent refused operation")
 
@@ -512,11 +511,11 @@ func testSSHMount(t *testing.T, sb integration.Sandbox) {
 		},
 	)
 
-	tmpDir, err := ioutil.TempDir("", "buildkit")
+	tmpDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpDir)
 
-	err = ioutil.WriteFile(filepath.Join(tmpDir, "key"), dt, 0600)
+	err = os.WriteFile(filepath.Join(tmpDir, "key"), dt, 0600)
 	require.NoError(t, err)
 
 	ssh, err = sshprovider.NewSSHAgentProvider([]sshprovider.AgentConfig{{
@@ -524,7 +523,7 @@ func testSSHMount(t *testing.T, sb integration.Sandbox) {
 	}})
 	require.NoError(t, err)
 
-	destDir, err = ioutil.TempDir("", "buildkit")
+	destDir, err = os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -539,7 +538,7 @@ func testSSHMount(t *testing.T, sb integration.Sandbox) {
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "out"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "out"))
 	require.NoError(t, err)
 	require.Contains(t, string(dt), "1024")
 	require.Contains(t, string(dt), "(RSA)")
@@ -574,7 +573,7 @@ func testShmSize(t *testing.T, sb integration.Sandbox) {
 	def, err := out.Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -588,7 +587,7 @@ func testShmSize(t *testing.T, sb integration.Sandbox) {
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "out"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "out"))
 	require.NoError(t, err)
 	require.Contains(t, string(dt), `size=131072k`)
 }
@@ -611,7 +610,7 @@ func testUlimit(t *testing.T, sb integration.Sandbox) {
 	def, err := st.Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -625,11 +624,11 @@ func testUlimit(t *testing.T, sb integration.Sandbox) {
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "first"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "first"))
 	require.NoError(t, err)
 	require.Equal(t, `1062`, strings.TrimSpace(string(dt)))
 
-	dt2, err := ioutil.ReadFile(filepath.Join(destDir, "second"))
+	dt2, err := os.ReadFile(filepath.Join(destDir, "second"))
 	require.NoError(t, err)
 	require.NotEqual(t, `1062`, strings.TrimSpace(string(dt2)))
 }
@@ -656,7 +655,7 @@ func testCgroupParent(t *testing.T, sb integration.Sandbox) {
 	def, err := st.Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -670,11 +669,11 @@ func testCgroupParent(t *testing.T, sb integration.Sandbox) {
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "first"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "first"))
 	require.NoError(t, err)
 	require.Contains(t, strings.TrimSpace(string(dt)), `/foocgroup/buildkit/`)
 
-	dt2, err := ioutil.ReadFile(filepath.Join(destDir, "second"))
+	dt2, err := os.ReadFile(filepath.Join(destDir, "second"))
 	require.NoError(t, err)
 	require.NotContains(t, strings.TrimSpace(string(dt2)), `/foocgroup/buildkit/`)
 }
@@ -798,7 +797,7 @@ func testSecurityMode(t *testing.T, sb integration.Sandbox) {
 	def, err := st.Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -814,7 +813,7 @@ func testSecurityMode(t *testing.T, sb integration.Sandbox) {
 
 	require.NoError(t, err)
 
-	contents, err := ioutil.ReadFile(filepath.Join(destDir, "out"))
+	contents, err := os.ReadFile(filepath.Join(destDir, "out"))
 	require.NoError(t, err)
 
 	caps, err := strconv.ParseUint(strings.TrimSpace(string(contents)), 16, 64)
@@ -919,7 +918,7 @@ func testFrontendImageNaming(t *testing.T, sb integration.Sandbox) {
 			require.Contains(t, exporterResponse, "image.name")
 			require.Equal(t, exporterResponse["image.name"], "docker.io/library/"+imageName)
 
-			dt, err := ioutil.ReadFile(out)
+			dt, err := os.ReadFile(out)
 			require.NoError(t, err)
 
 			m, err := testutil.ReadTarToMap(dt, false)
@@ -991,7 +990,7 @@ func testFrontendImageNaming(t *testing.T, sb integration.Sandbox) {
 			for _, exp := range []string{ExporterOCI, ExporterDocker, ExporterImage} {
 				exp := exp // capture loop variable.
 				t.Run(exp, func(t *testing.T) {
-					destDir, err := ioutil.TempDir("", "buildkit")
+					destDir, err := os.MkdirTemp("", "buildkit")
 					require.NoError(t, err)
 					defer os.RemoveAll(destDir)
 
@@ -1257,7 +1256,7 @@ func testRelativeWorkDir(t *testing.T, sb integration.Sandbox) {
 	def, err := pwd.Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -1271,7 +1270,7 @@ func testRelativeWorkDir(t *testing.T, sb integration.Sandbox) {
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "pwd"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "pwd"))
 	require.NoError(t, err)
 	require.Equal(t, []byte("/test1/test2\n"), dt)
 }
@@ -1288,7 +1287,7 @@ func testFileOpMkdirMkfile(t *testing.T, sb integration.Sandbox) {
 	def, err := st.Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -1306,7 +1305,7 @@ func testFileOpMkdirMkfile(t *testing.T, sb integration.Sandbox) {
 	require.NoError(t, err)
 	require.Equal(t, true, fi.IsDir())
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "bar"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "bar"))
 	require.NoError(t, err)
 	require.Equal(t, []byte("contents"), dt)
 }
@@ -1342,7 +1341,7 @@ func testFileOpCopyRm(t *testing.T, sb integration.Sandbox) {
 	def, err := st.Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -1360,7 +1359,7 @@ func testFileOpCopyRm(t *testing.T, sb integration.Sandbox) {
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "myfile2"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "myfile2"))
 	require.NoError(t, err)
 	require.Equal(t, []byte("data0"), dt)
 
@@ -1368,14 +1367,14 @@ func testFileOpCopyRm(t *testing.T, sb integration.Sandbox) {
 	require.NoError(t, err)
 	require.Equal(t, true, fi.IsDir())
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "out/bar"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "out/bar"))
 	require.NoError(t, err)
 	require.Equal(t, []byte("bar0"), dt)
 
 	_, err = os.Stat(filepath.Join(destDir, "out/foo"))
 	require.ErrorIs(t, err, os.ErrNotExist)
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "file2"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "file2"))
 	require.NoError(t, err)
 	require.Equal(t, []byte("file2"), dt)
 }
@@ -1413,7 +1412,7 @@ func testFileOpCopyIncludeExclude(t *testing.T, sb integration.Sandbox) {
 	def, err := st.Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -1430,7 +1429,7 @@ func testFileOpCopyIncludeExclude(t *testing.T, sb integration.Sandbox) {
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "sub", "foo"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "sub", "foo"))
 	require.NoError(t, err)
 	require.Equal(t, []byte("foo0"), dt)
 
@@ -1439,7 +1438,7 @@ func testFileOpCopyIncludeExclude(t *testing.T, sb integration.Sandbox) {
 		require.ErrorIs(t, err, os.ErrNotExist)
 	}
 
-	randBytes, err := ioutil.ReadFile(filepath.Join(destDir, "unique"))
+	randBytes, err := os.ReadFile(filepath.Join(destDir, "unique"))
 	require.NoError(t, err)
 
 	// Create additional file which doesn't match the include pattern, and make
@@ -1462,7 +1461,7 @@ func testFileOpCopyIncludeExclude(t *testing.T, sb integration.Sandbox) {
 	def, err = st.Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err = ioutil.TempDir("", "buildkit")
+	destDir, err = os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -1479,7 +1478,7 @@ func testFileOpCopyIncludeExclude(t *testing.T, sb integration.Sandbox) {
 	}, nil)
 	require.NoError(t, err)
 
-	randBytes2, err := ioutil.ReadFile(filepath.Join(destDir, "unique"))
+	randBytes2, err := os.ReadFile(filepath.Join(destDir, "unique"))
 	require.NoError(t, err)
 
 	require.Equal(t, randBytes, randBytes2)
@@ -1545,7 +1544,7 @@ func testLocalSourceWithDiffer(t *testing.T, sb integration.Sandbox, d llb.DiffT
 	def, err := st.Marshal(context.TODO())
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -1562,11 +1561,11 @@ func testLocalSourceWithDiffer(t *testing.T, sb integration.Sandbox, d llb.DiffT
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "foo"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "foo"))
 	require.NoError(t, err)
 	require.Equal(t, []byte("foo"), dt)
 
-	err = ioutil.WriteFile(filepath.Join(dir, "foo"), []byte("bar"), 0600)
+	err = os.WriteFile(filepath.Join(dir, "foo"), []byte("bar"), 0600)
 	require.NoError(t, err)
 
 	err = syscall.UtimesNano(filepath.Join(dir, "foo"), []syscall.Timespec{tv, tv})
@@ -1585,7 +1584,7 @@ func testLocalSourceWithDiffer(t *testing.T, sb integration.Sandbox, d llb.DiffT
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "foo"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "foo"))
 	require.NoError(t, err)
 	if d == llb.DiffMetadata {
 		require.Equal(t, []byte("foo"), dt)
@@ -1620,7 +1619,7 @@ func testFileOpRmWildcard(t *testing.T, sb integration.Sandbox) {
 	def, err := st.Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -1637,7 +1636,7 @@ func testFileOpRmWildcard(t *testing.T, sb integration.Sandbox) {
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "bar/remaining"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "bar/remaining"))
 	require.NoError(t, err)
 	require.Equal(t, []byte("bar1"), dt)
 
@@ -1721,7 +1720,7 @@ func testBuildHTTPSource(t *testing.T, sb integration.Sandbox) {
 	require.Equal(t, server.Stats("/foo").AllRequests, 1)
 	require.Equal(t, server.Stats("/foo").CachedRequests, 0)
 
-	tmpdir, err := ioutil.TempDir("", "buildkit")
+	tmpdir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -1738,7 +1737,7 @@ func testBuildHTTPSource(t *testing.T, sb integration.Sandbox) {
 	require.Equal(t, server.Stats("/foo").AllRequests, 2)
 	require.Equal(t, server.Stats("/foo").CachedRequests, 1)
 
-	dt, err := ioutil.ReadFile(filepath.Join(tmpdir, "foo"))
+	dt, err := os.ReadFile(filepath.Join(tmpdir, "foo"))
 	require.NoError(t, err)
 	require.Equal(t, []byte("content1"), dt)
 
@@ -1761,7 +1760,7 @@ func testBuildHTTPSource(t *testing.T, sb integration.Sandbox) {
 	require.Equal(t, server.Stats("/foo").AllRequests, 3)
 	require.Equal(t, server.Stats("/foo").CachedRequests, 1)
 
-	dt, err = ioutil.ReadFile(filepath.Join(tmpdir, "bar"))
+	dt, err = os.ReadFile(filepath.Join(tmpdir, "bar"))
 	require.NoError(t, err)
 	require.Equal(t, []byte("content1"), dt)
 
@@ -1794,7 +1793,7 @@ func testResolveAndHosts(t *testing.T, sb integration.Sandbox) {
 	def, err := st.Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -1808,11 +1807,11 @@ func testResolveAndHosts(t *testing.T, sb integration.Sandbox) {
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "resolv.conf"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "resolv.conf"))
 	require.NoError(t, err)
 	require.Contains(t, string(dt), "nameserver")
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "hosts"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "hosts"))
 	require.NoError(t, err)
 	require.Contains(t, string(dt), "127.0.0.1	localhost")
 }
@@ -1848,7 +1847,7 @@ func testUser(t *testing.T, sb integration.Sandbox) {
 	def, err := out.Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -1862,32 +1861,32 @@ func testUser(t *testing.T, sb integration.Sandbox) {
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "user"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "user"))
 	require.NoError(t, err)
 	require.Equal(t, "daemon", strings.TrimSpace(string(dt)))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "group"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "group"))
 	require.NoError(t, err)
 	require.Equal(t, "daemon", strings.TrimSpace(string(dt)))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "nobody"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "nobody"))
 	require.NoError(t, err)
 	require.Equal(t, "nobody", strings.TrimSpace(string(dt)))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "userone"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "userone"))
 	require.NoError(t, err)
 	require.Equal(t, "1", strings.TrimSpace(string(dt)))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "root_supplementary"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "root_supplementary"))
 	require.NoError(t, err)
 	require.True(t, strings.HasPrefix(string(dt), "root "))
 	require.True(t, strings.Contains(string(dt), "wheel"))
 
-	dt2, err := ioutil.ReadFile(filepath.Join(destDir, "default_supplementary"))
+	dt2, err := os.ReadFile(filepath.Join(destDir, "default_supplementary"))
 	require.NoError(t, err)
 	require.Equal(t, string(dt), string(dt2))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "default_uid"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "default_uid"))
 	require.NoError(t, err)
 	require.Equal(t, "0", strings.TrimSpace(string(dt)))
 
@@ -1915,7 +1914,7 @@ func testOCIExporter(t *testing.T, sb integration.Sandbox) {
 	require.NoError(t, err)
 
 	for _, exp := range []string{ExporterOCI, ExporterDocker} {
-		destDir, err := ioutil.TempDir("", "buildkit")
+		destDir, err := os.MkdirTemp("", "buildkit")
 		require.NoError(t, err)
 		defer os.RemoveAll(destDir)
 
@@ -1938,7 +1937,7 @@ func testOCIExporter(t *testing.T, sb integration.Sandbox) {
 		}, nil)
 		require.NoError(t, err)
 
-		dt, err := ioutil.ReadFile(out)
+		dt, err := os.ReadFile(out)
 		require.NoError(t, err)
 
 		m, err := testutil.ReadTarToMap(dt, false)
@@ -2085,7 +2084,7 @@ func testFrontendUseSolveResults(t *testing.T, sb integration.Sandbox) {
 		})
 	}
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -2099,7 +2098,7 @@ func testFrontendUseSolveResults(t *testing.T, sb integration.Sandbox) {
 	}, "", frontend, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "foo2"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "foo2"))
 	require.NoError(t, err)
 	require.Equal(t, dt, []byte("data"))
 }
@@ -2153,7 +2152,7 @@ func testTarExporterWithSocket(t *testing.T, sb integration.Sandbox) {
 				Type:  ExporterTar,
 				Attrs: map[string]string{},
 				Output: func(m map[string]string) (io.WriteCloser, error) {
-					return nopWriteCloser{ioutil.Discard}, nil
+					return nopWriteCloser{io.Discard}, nil
 				},
 			},
 		},
@@ -2540,7 +2539,7 @@ func testBuildExportZstd(t *testing.T, sb integration.Sandbox) {
 	def, err := st.Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -2567,7 +2566,7 @@ func testBuildExportZstd(t *testing.T, sb integration.Sandbox) {
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(out)
+	dt, err := os.ReadFile(out)
 	require.NoError(t, err)
 
 	m, err := testutil.ReadTarToMap(dt, false)
@@ -2605,7 +2604,7 @@ func testBuildExportZstd(t *testing.T, sb integration.Sandbox) {
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err = ioutil.ReadFile(out)
+	dt, err = os.ReadFile(out)
 	require.NoError(t, err)
 
 	m, err = testutil.ReadTarToMap(dt, false)
@@ -2675,7 +2674,7 @@ func testPullZstdImage(t *testing.T, sb integration.Sandbox) {
 	def, err = st.Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -2689,7 +2688,7 @@ func testPullZstdImage(t *testing.T, sb integration.Sandbox) {
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "zdata"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "zdata"))
 	require.NoError(t, err)
 	require.Equal(t, dt, []byte("zstd"))
 }
@@ -2741,7 +2740,7 @@ func testBuildPushAndValidate(t *testing.T, sb integration.Sandbox) {
 	def, err = firstBuild.Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -2755,11 +2754,11 @@ func testBuildPushAndValidate(t *testing.T, sb integration.Sandbox) {
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "foo/sub/bar"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "foo/sub/bar"))
 	require.NoError(t, err)
 	require.Equal(t, dt, []byte("first"))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "foo/sub/baz"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "foo/sub/baz"))
 	require.NoError(t, err)
 	require.Equal(t, dt, []byte("second"))
 
@@ -2921,7 +2920,7 @@ func testStargzLazyRegistryCacheImportExport(t *testing.T, sb integration.Sandbo
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -3161,7 +3160,7 @@ func testStargzLazyInlineCacheImportExport(t *testing.T, sb integration.Sandbox)
 	checkAllReleasable(t, c, sb, true)
 
 	// stargz layers should be exportable
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 	out := filepath.Join(destDir, "out.tar")
@@ -3293,7 +3292,7 @@ func testStargzLazyPull(t *testing.T, sb integration.Sandbox) {
 	checkAllReleasable(t, c, sb, true)
 
 	// stargz layers should be exportable
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 	out := filepath.Join(destDir, "out.tar")
@@ -3467,11 +3466,11 @@ func testZstdLocalCacheExport(t *testing.T, sb integration.Sandbox) {
 	def, err := st.Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
-	destOutDir, err := ioutil.TempDir("", "buildkit")
+	destOutDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destOutDir)
 
@@ -3496,13 +3495,13 @@ func testZstdLocalCacheExport(t *testing.T, sb integration.Sandbox) {
 	require.NoError(t, err)
 
 	var index ocispecs.Index
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "index.json"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "index.json"))
 	require.NoError(t, err)
 	err = json.Unmarshal(dt, &index)
 	require.NoError(t, err)
 
 	var layerIndex ocispecs.Index
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "blobs/sha256/"+index.Manifests[0].Digest.Hex()))
+	dt, err = os.ReadFile(filepath.Join(destDir, "blobs/sha256/"+index.Manifests[0].Digest.Hex()))
 	require.NoError(t, err)
 	err = json.Unmarshal(dt, &layerIndex)
 	require.NoError(t, err)
@@ -3511,14 +3510,14 @@ func testZstdLocalCacheExport(t *testing.T, sb integration.Sandbox) {
 	require.Equal(t, ocispecs.MediaTypeImageLayer+"+zstd", lastLayer.MediaType)
 
 	zstdLayerDigest := lastLayer.Digest.Hex()
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "blobs/sha256/"+zstdLayerDigest))
+	dt, err = os.ReadFile(filepath.Join(destDir, "blobs/sha256/"+zstdLayerDigest))
 	require.NoError(t, err)
 	require.Equal(t, dt[:4], []byte{0x28, 0xb5, 0x2f, 0xfd})
 }
 
 func testUncompressedLocalCacheImportExport(t *testing.T, sb integration.Sandbox) {
 	integration.SkipIfDockerd(t, sb, "remote cache export")
-	dir, err := ioutil.TempDir("", "buildkit")
+	dir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(dir)
 	im := CacheOptionsEntry{
@@ -3569,7 +3568,7 @@ func testZstdLocalCacheImportExport(t *testing.T, sb integration.Sandbox) {
 		// containerd 1.4 doesn't support zstd compression
 		return
 	}
-	dir, err := ioutil.TempDir("", "buildkit")
+	dir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(dir)
 	im := CacheOptionsEntry{
@@ -3639,7 +3638,7 @@ func testBasicCacheImportExport(t *testing.T, sb integration.Sandbox, cacheOptio
 	def, err := st.Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -3654,16 +3653,16 @@ func testBasicCacheImportExport(t *testing.T, sb integration.Sandbox, cacheOptio
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "const"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "const"))
 	require.NoError(t, err)
 	require.Equal(t, string(dt), "foobar")
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "unique"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "unique"))
 	require.NoError(t, err)
 
 	ensurePruneAll(t, c, sb)
 
-	destDir, err = ioutil.TempDir("", "buildkit")
+	destDir, err = os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -3677,11 +3676,11 @@ func testBasicCacheImportExport(t *testing.T, sb integration.Sandbox, cacheOptio
 	}, nil)
 	require.NoError(t, err)
 
-	dt2, err := ioutil.ReadFile(filepath.Join(destDir, "const"))
+	dt2, err := os.ReadFile(filepath.Join(destDir, "const"))
 	require.NoError(t, err)
 	require.Equal(t, string(dt2), "foobar")
 
-	dt2, err = ioutil.ReadFile(filepath.Join(destDir, "unique"))
+	dt2, err = os.ReadFile(filepath.Join(destDir, "unique"))
 	require.NoError(t, err)
 	require.Equal(t, string(dt), string(dt2))
 }
@@ -3728,7 +3727,7 @@ func testMultipleRegistryCacheImportExport(t *testing.T, sb integration.Sandbox)
 
 func testBasicLocalCacheImportExport(t *testing.T, sb integration.Sandbox) {
 	integration.SkipIfDockerd(t, sb, "remote cache export")
-	dir, err := ioutil.TempDir("", "buildkit")
+	dir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(dir)
 	im := CacheOptionsEntry{
@@ -3911,7 +3910,7 @@ func readFileInImage(ctx context.Context, c *Client, ref, path string) ([]byte,
 	if err != nil {
 		return nil, err
 	}
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	if err != nil {
 		return nil, err
 	}
@@ -3928,7 +3927,7 @@ func readFileInImage(ctx context.Context, c *Client, ref, path string) ([]byte,
 	if err != nil {
 		return nil, err
 	}
-	return ioutil.ReadFile(filepath.Join(destDir, filepath.Clean(path)))
+	return os.ReadFile(filepath.Join(destDir, filepath.Clean(path)))
 }
 
 func testCachedMounts(t *testing.T, sb integration.Sandbox) {
@@ -3964,7 +3963,7 @@ func testCachedMounts(t *testing.T, sb integration.Sandbox) {
 	st.AddMount("/src0", llb.Scratch(), llb.AsPersistentCacheDir("mycache1", llb.CacheMountShared))
 	st.AddMount("/src1", base, llb.AsPersistentCacheDir("mycache2", llb.CacheMountShared))
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -3981,15 +3980,15 @@ func testCachedMounts(t *testing.T, sb integration.Sandbox) {
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "foo"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "foo"))
 	require.NoError(t, err)
 	require.Equal(t, string(dt), "first")
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "bar"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "bar"))
 	require.NoError(t, err)
 	require.Equal(t, string(dt), "second")
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "baz"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "baz"))
 	require.NoError(t, err)
 	require.Equal(t, string(dt), "base")
 
@@ -4209,7 +4208,7 @@ func testDuplicateWhiteouts(t *testing.T, sb integration.Sandbox) {
 	def, err := st.Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -4227,7 +4226,7 @@ func testDuplicateWhiteouts(t *testing.T, sb integration.Sandbox) {
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(out)
+	dt, err := os.ReadFile(out)
 	require.NoError(t, err)
 
 	m, err := testutil.ReadTarToMap(dt, false)
@@ -4281,7 +4280,7 @@ func testWhiteoutParentDir(t *testing.T, sb integration.Sandbox) {
 	def, err := st.Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -4298,7 +4297,7 @@ func testWhiteoutParentDir(t *testing.T, sb integration.Sandbox) {
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(out)
+	dt, err := os.ReadFile(out)
 	require.NoError(t, err)
 
 	m, err := testutil.ReadTarToMap(dt, false)
@@ -4347,7 +4346,7 @@ func testMoveParentDir(t *testing.T, sb integration.Sandbox) {
 	def, err := st.Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -4364,7 +4363,7 @@ func testMoveParentDir(t *testing.T, sb integration.Sandbox) {
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(out)
+	dt, err := os.ReadFile(out)
 	require.NoError(t, err)
 
 	m, err := testutil.ReadTarToMap(dt, false)
@@ -4607,7 +4606,7 @@ func testRmSymlink(t *testing.T, sb integration.Sandbox) {
 	def, err := mnt.File(llb.Rm("link")).Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -4643,7 +4642,7 @@ func testProxyEnv(t *testing.T, sb integration.Sandbox) {
 	def, err := out.Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -4657,7 +4656,7 @@ func testProxyEnv(t *testing.T, sb integration.Sandbox) {
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "env"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "env"))
 	require.NoError(t, err)
 	require.Equal(t, string(dt), "httpvalue-httpsvalue-noproxyvalue-noproxyvalue-allproxyvalue-allproxyvalue")
 
@@ -4671,7 +4670,7 @@ func testProxyEnv(t *testing.T, sb integration.Sandbox) {
 	def, err = out.Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err = ioutil.TempDir("", "buildkit")
+	destDir, err = os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -4685,7 +4684,7 @@ func testProxyEnv(t *testing.T, sb integration.Sandbox) {
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "env"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "env"))
 	require.NoError(t, err)
 	require.Equal(t, string(dt), "httpvalue-httpsvalue-noproxyvalue-noproxyvalue-allproxyvalue-allproxyvalue")
 }
@@ -4956,7 +4955,7 @@ func testMergeOpCache(t *testing.T, sb integration.Sandbox, mode string) {
 	}
 
 	// get the random value at /bar/2
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -4970,7 +4969,7 @@ func testMergeOpCache(t *testing.T, sb integration.Sandbox, mode string) {
 	}, nil)
 	require.NoError(t, err)
 
-	bar2Contents, err := ioutil.ReadFile(filepath.Join(destDir, "bar", "2"))
+	bar2Contents, err := os.ReadFile(filepath.Join(destDir, "bar", "2"))
 	require.NoError(t, err)
 
 	// clear all local state out
@@ -5062,7 +5061,7 @@ func testMergeOpCache(t *testing.T, sb integration.Sandbox, mode string) {
 	}
 
 	// check the random value at /bar/2 didn't change
-	destDir, err = ioutil.TempDir("", "buildkit")
+	destDir, err = os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -5077,7 +5076,7 @@ func testMergeOpCache(t *testing.T, sb integration.Sandbox, mode string) {
 	}, nil)
 	require.NoError(t, err)
 
-	newBar2Contents, err := ioutil.ReadFile(filepath.Join(destDir, "bar", "2"))
+	newBar2Contents, err := os.ReadFile(filepath.Join(destDir, "bar", "2"))
 	require.NoError(t, err)
 
 	require.Equalf(t, bar2Contents, newBar2Contents, "bar/2 contents changed")
@@ -5111,7 +5110,7 @@ func testMergeOpCache(t *testing.T, sb integration.Sandbox, mode string) {
 	require.NoError(t, err)
 
 	// check the random value at /bar/2 didn't change
-	destDir, err = ioutil.TempDir("", "buildkit")
+	destDir, err = os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -5126,7 +5125,7 @@ func testMergeOpCache(t *testing.T, sb integration.Sandbox, mode string) {
 	}, nil)
 	require.NoError(t, err)
 
-	newBar2Contents, err = ioutil.ReadFile(filepath.Join(destDir, "bar", "2"))
+	newBar2Contents, err = os.ReadFile(filepath.Join(destDir, "bar", "2"))
 	require.NoError(t, err)
 
 	require.Equalf(t, bar2Contents, newBar2Contents, "bar/2 contents changed")
@@ -5172,7 +5171,7 @@ func requireContents(ctx context.Context, t *testing.T, c *Client, sb integratio
 	def, err := state.Marshal(ctx)
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -5222,7 +5221,7 @@ func requireEqualContents(ctx context.Context, t *testing.T, c *Client, stateA,
 	defA, err := stateA.Marshal(ctx)
 	require.NoError(t, err)
 
-	destDirA, err := ioutil.TempDir("", "buildkit")
+	destDirA, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDirA)
 
@@ -5239,7 +5238,7 @@ func requireEqualContents(ctx context.Context, t *testing.T, c *Client, stateA,
 	defB, err := stateB.Marshal(ctx)
 	require.NoError(t, err)
 
-	destDirB, err := ioutil.TempDir("", "buildkit")
+	destDirB, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDirB)
 
@@ -5388,7 +5387,7 @@ func testInvalidExporter(t *testing.T, sb integration.Sandbox) {
 	def, err := llb.Image("busybox:latest").Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -5473,7 +5472,7 @@ func testParallelLocalBuilds(t *testing.T, sb integration.Sandbox) {
 				def, err := llb.Local("source").Marshal(sb.Context())
 				require.NoError(t, err)
 
-				destDir, err := ioutil.TempDir("", "buildkit")
+				destDir, err := os.MkdirTemp("", "buildkit")
 				require.NoError(t, err)
 				defer os.RemoveAll(destDir)
 
@@ -5490,7 +5489,7 @@ func testParallelLocalBuilds(t *testing.T, sb integration.Sandbox) {
 				}, nil)
 				require.NoError(t, err)
 
-				act, err := ioutil.ReadFile(filepath.Join(destDir, fn))
+				act, err := os.ReadFile(filepath.Join(destDir, fn))
 				require.NoError(t, err)
 
 				require.Equal(t, "contents", string(act))
@@ -5522,7 +5521,7 @@ func testRelativeMountpoint(t *testing.T, sb integration.Sandbox) {
 	def, err := st.Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -5536,7 +5535,7 @@ func testRelativeMountpoint(t *testing.T, sb integration.Sandbox) {
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "data"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "data"))
 	require.NoError(t, err)
 	require.Equal(t, dt, []byte(id))
 }
@@ -5796,7 +5795,7 @@ func testValidateDigestOrigin(t *testing.T, sb integration.Sandbox) {
 }
 
 func tmpdir(appliers ...fstest.Applier) (string, error) {
-	tmpdir, err := ioutil.TempDir("", "buildkit-client")
+	tmpdir, err := os.MkdirTemp("", "buildkit-client")
 	if err != nil {
 		return "", err
 	}
@@ -5807,7 +5806,7 @@ func tmpdir(appliers ...fstest.Applier) (string, error) {
 }
 
 func makeSSHAgentSock(agent agent.Agent) (p string, cleanup func() error, err error) {
-	tmpDir, err := ioutil.TempDir("", "buildkit")
+	tmpDir, err := os.MkdirTemp("", "buildkit")
 	if err != nil {
 		return "", nil, err
 	}
diff --git a/client/llb/marshal.go b/client/llb/marshal.go
index e59e560ee95c..553df11b3572 100644
--- a/client/llb/marshal.go
+++ b/client/llb/marshal.go
@@ -2,7 +2,6 @@ package llb
 
 import (
 	"io"
-	"io/ioutil"
 
 	"github.com/containerd/containerd/platforms"
 	"github.com/moby/buildkit/solver/pb"
@@ -67,7 +66,7 @@ func WriteTo(def *Definition, w io.Writer) error {
 }
 
 func ReadFrom(r io.Reader) (*Definition, error) {
-	b, err := ioutil.ReadAll(r)
+	b, err := io.ReadAll(r)
 	if err != nil {
 		return nil, err
 	}
diff --git a/client/ociindex/ociindex.go b/client/ociindex/ociindex.go
index a9c100a95bcd..ef1e1cf4c65e 100644
--- a/client/ociindex/ociindex.go
+++ b/client/ociindex/ociindex.go
@@ -2,7 +2,7 @@ package ociindex
 
 import (
 	"encoding/json"
-	"io/ioutil"
+	"io"
 	"os"
 
 	"github.com/gofrs/flock"
@@ -62,7 +62,7 @@ func PutDescToIndexJSONFileLocked(indexJSONPath string, desc ocispecs.Descriptor
 	}
 	defer f.Close()
 	var idx ocispecs.Index
-	b, err := ioutil.ReadAll(f)
+	b, err := io.ReadAll(f)
 	if err != nil {
 		return errors.Wrapf(err, "could not read %s", indexJSONPath)
 	}
@@ -101,7 +101,7 @@ func ReadIndexJSONFileLocked(indexJSONPath string) (*ocispecs.Index, error) {
 		lock.Unlock()
 		os.RemoveAll(lockPath)
 	}()
-	b, err := ioutil.ReadFile(indexJSONPath)
+	b, err := os.ReadFile(indexJSONPath)
 	if err != nil {
 		return nil, errors.Wrapf(err, "could not read %s", indexJSONPath)
 	}
diff --git a/cmd/buildctl/build_test.go b/cmd/buildctl/build_test.go
index bde880c9095c..1ce1f88cb107 100644
--- a/cmd/buildctl/build_test.go
+++ b/cmd/buildctl/build_test.go
@@ -6,7 +6,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -55,7 +54,7 @@ func testBuildLocalExporter(t *testing.T, sb integration.Sandbox) {
 	rdr, err := marshal(sb.Context(), out)
 	require.NoError(t, err)
 
-	tmpdir, err := ioutil.TempDir("", "buildkit-buildctl")
+	tmpdir, err := os.MkdirTemp("", "buildkit-buildctl")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -65,7 +64,7 @@ func testBuildLocalExporter(t *testing.T, sb integration.Sandbox) {
 
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(tmpdir, "foo"))
+	dt, err := os.ReadFile(filepath.Join(tmpdir, "foo"))
 	require.NoError(t, err)
 	require.Equal(t, string(dt), "bar")
 }
@@ -121,7 +120,7 @@ func testBuildMetadataFile(t *testing.T, sb integration.Sandbox) {
 	rdr, err := marshal(sb.Context(), st.Root())
 	require.NoError(t, err)
 
-	tmpDir, err := ioutil.TempDir("", "buildkit-buildctl")
+	tmpDir, err := os.MkdirTemp("", "buildkit-buildctl")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpDir)
 
@@ -140,7 +139,7 @@ func testBuildMetadataFile(t *testing.T, sb integration.Sandbox) {
 	require.NoError(t, err)
 
 	require.FileExists(t, metadataFile)
-	metadataBytes, err := ioutil.ReadFile(metadataFile)
+	metadataBytes, err := os.ReadFile(metadataFile)
 	require.NoError(t, err)
 
 	var metadata map[string]interface{}
@@ -193,7 +192,7 @@ func marshal(ctx context.Context, st llb.State) (io.Reader, error) {
 }
 
 func tmpdir(appliers ...fstest.Applier) (string, error) {
-	tmpdir, err := ioutil.TempDir("", "buildkit-buildctl")
+	tmpdir, err := os.MkdirTemp("", "buildkit-buildctl")
 	if err != nil {
 		return "", err
 	}
diff --git a/cmd/buildctl/buildctl_test.go b/cmd/buildctl/buildctl_test.go
index 66fef818f919..44ac5622c67c 100644
--- a/cmd/buildctl/buildctl_test.go
+++ b/cmd/buildctl/buildctl_test.go
@@ -2,7 +2,6 @@ package main
 
 import (
 	"encoding/json"
-	"io/ioutil"
 	"os"
 	"path"
 	"testing"
@@ -120,7 +119,7 @@ func TestWriteMetadataFile(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			fname := path.Join(tmpdir, "metadata_"+tt.name)
 			require.NoError(t, writeMetadataFile(fname, tt.exporterResponse))
-			current, err := ioutil.ReadFile(fname)
+			current, err := os.ReadFile(fname)
 			require.NoError(t, err)
 			var raw map[string]interface{}
 			require.NoError(t, json.Unmarshal(current, &raw))
diff --git a/cmd/buildctl/debug/dumpmetadata.go b/cmd/buildctl/debug/dumpmetadata.go
index 3b7e948b3990..b53fc25fd578 100644
--- a/cmd/buildctl/debug/dumpmetadata.go
+++ b/cmd/buildctl/debug/dumpmetadata.go
@@ -2,7 +2,6 @@ package debug
 
 import (
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"time"
@@ -41,7 +40,7 @@ var DumpMetadataCommand = cli.Command{
 }
 
 func findMetadataDBFiles(root string) ([]string, error) {
-	dirs, err := ioutil.ReadDir(root)
+	dirs, err := os.ReadDir(root)
 	if err != nil {
 		return nil, err
 	}
diff --git a/cmd/buildkitd/main.go b/cmd/buildkitd/main.go
index 126ba0dbe2c8..cdccc7cbf106 100644
--- a/cmd/buildkitd/main.go
+++ b/cmd/buildkitd/main.go
@@ -5,7 +5,6 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"fmt"
-	"io/ioutil"
 	"net"
 	"os"
 	"os/user"
@@ -594,7 +593,7 @@ func serverCredentials(cfg config.TLSConfig) (*tls.Config, error) {
 	}
 	if caFile != "" {
 		certPool := x509.NewCertPool()
-		ca, err := ioutil.ReadFile(caFile)
+		ca, err := os.ReadFile(caFile)
 		if err != nil {
 			return nil, errors.Wrap(err, "could not read ca certificate")
 		}
diff --git a/examples/buildkit0/buildkit.go b/examples/buildkit0/buildkit.go
index 78f988d8584d..24810e730ff5 100644
--- a/examples/buildkit0/buildkit.go
+++ b/examples/buildkit0/buildkit.go
@@ -33,7 +33,7 @@ func main() {
 }
 
 func goBuildBase() llb.State {
-	goAlpine := llb.Image("docker.io/library/golang:1.17-alpine")
+	goAlpine := llb.Image("docker.io/library/golang:1.19-alpine")
 	return goAlpine.
 		AddEnv("PATH", "/usr/local/go/bin:"+system.DefaultPathEnvUnix).
 		AddEnv("GOPATH", "/go").
diff --git a/examples/buildkit1/buildkit.go b/examples/buildkit1/buildkit.go
index 98793d0ab6e2..9f8201b2bddf 100644
--- a/examples/buildkit1/buildkit.go
+++ b/examples/buildkit1/buildkit.go
@@ -33,7 +33,7 @@ func main() {
 }
 
 func goBuildBase() llb.State {
-	goAlpine := llb.Image("docker.io/library/golang:1.17-alpine")
+	goAlpine := llb.Image("docker.io/library/golang:1.19-alpine")
 	return goAlpine.
 		AddEnv("PATH", "/usr/local/go/bin:"+system.DefaultPathEnvUnix).
 		AddEnv("GOPATH", "/go").
diff --git a/examples/buildkit2/buildkit.go b/examples/buildkit2/buildkit.go
index 7a88562cf72e..5ae6b201678b 100644
--- a/examples/buildkit2/buildkit.go
+++ b/examples/buildkit2/buildkit.go
@@ -33,7 +33,7 @@ func main() {
 }
 
 func goBuildBase() llb.State {
-	goAlpine := llb.Image("docker.io/library/golang:1.17-alpine")
+	goAlpine := llb.Image("docker.io/library/golang:1.19-alpine")
 	return goAlpine.
 		AddEnv("PATH", "/usr/local/go/bin:"+system.DefaultPathEnvUnix).
 		AddEnv("GOPATH", "/go").
diff --git a/examples/buildkit3/buildkit.go b/examples/buildkit3/buildkit.go
index fa985f18eb84..58de1ebe0666 100644
--- a/examples/buildkit3/buildkit.go
+++ b/examples/buildkit3/buildkit.go
@@ -34,7 +34,7 @@ func main() {
 }
 
 func goBuildBase() llb.State {
-	goAlpine := llb.Image("docker.io/library/golang:1.17-alpine")
+	goAlpine := llb.Image("docker.io/library/golang:1.19-alpine")
 	return goAlpine.
 		AddEnv("PATH", "/usr/local/go/bin:"+system.DefaultPathEnvUnix).
 		AddEnv("GOPATH", "/go").
diff --git a/examples/buildkit4/buildkit.go b/examples/buildkit4/buildkit.go
index c20f13ea0c05..0bae9e7899e8 100644
--- a/examples/buildkit4/buildkit.go
+++ b/examples/buildkit4/buildkit.go
@@ -37,7 +37,7 @@ func main() {
 }
 
 func goBuildBase() llb.State {
-	goAlpine := llb.Image("docker.io/library/golang:1.17-alpine")
+	goAlpine := llb.Image("docker.io/library/golang:1.19-alpine")
 	return goAlpine.
 		AddEnv("PATH", "/usr/local/go/bin:"+system.DefaultPathEnvUnix).
 		AddEnv("GOPATH", "/go").
diff --git a/examples/dockerfile2llb/main.go b/examples/dockerfile2llb/main.go
index 94455565b1ec..284c649cbab1 100644
--- a/examples/dockerfile2llb/main.go
+++ b/examples/dockerfile2llb/main.go
@@ -3,7 +3,7 @@ package main
 import (
 	"context"
 	"flag"
-	"io/ioutil"
+	"io"
 	"log"
 	"os"
 
@@ -23,7 +23,7 @@ func main() {
 	flag.StringVar(&opt.target, "target", "", "target stage")
 	flag.Parse()
 
-	df, err := ioutil.ReadAll(os.Stdin)
+	df, err := io.ReadAll(os.Stdin)
 	if err != nil {
 		panic(err)
 	}
diff --git a/examples/kubernetes/consistenthash/main.go b/examples/kubernetes/consistenthash/main.go
index ebe5f64f2840..4b100777ce3c 100644
--- a/examples/kubernetes/consistenthash/main.go
+++ b/examples/kubernetes/consistenthash/main.go
@@ -16,7 +16,7 @@ package main
 
 import (
 	"fmt"
-	"io/ioutil"
+	"io"
 	"os"
 	"strings"
 
@@ -38,7 +38,7 @@ func xmain() error {
 		return errors.New("should not reach here")
 	}
 	key := os.Args[1]
-	stdin, err := ioutil.ReadAll(os.Stdin)
+	stdin, err := io.ReadAll(os.Stdin)
 	if err != nil {
 		return err
 	}
diff --git a/examples/nested-llb/main.go b/examples/nested-llb/main.go
index 74eb58864af1..93f9d41c2dcc 100644
--- a/examples/nested-llb/main.go
+++ b/examples/nested-llb/main.go
@@ -32,7 +32,7 @@ func main() {
 }
 
 func goBuildBase() llb.State {
-	goAlpine := llb.Image("docker.io/library/golang:1.17-alpine")
+	goAlpine := llb.Image("docker.io/library/golang:1.19-alpine")
 	return goAlpine.
 		AddEnv("PATH", "/usr/local/go/bin:"+system.DefaultPathEnvUnix).
 		AddEnv("GOPATH", "/go").
diff --git a/executor/containerdexecutor/executor.go b/executor/containerdexecutor/executor.go
index 43a05cccefe9..9336a64894be 100644
--- a/executor/containerdexecutor/executor.go
+++ b/executor/containerdexecutor/executor.go
@@ -3,7 +3,6 @@ package containerdexecutor
 import (
 	"context"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"sync"
@@ -315,10 +314,10 @@ func fixProcessOutput(process *executor.ProcessInfo) {
 	// failed to start io pipe copy: unable to copy pipes: containerd-shim: opening file "" failed: open : no such file or directory: unknown
 	// So just stub out any missing output
 	if process.Stdout == nil {
-		process.Stdout = &nopCloser{ioutil.Discard}
+		process.Stdout = &nopCloser{io.Discard}
 	}
 	if process.Stderr == nil {
-		process.Stderr = &nopCloser{ioutil.Discard}
+		process.Stderr = &nopCloser{io.Discard}
 	}
 }
 
diff --git a/executor/oci/hosts.go b/executor/oci/hosts.go
index d0505c28ccd9..0d193555c941 100644
--- a/executor/oci/hosts.go
+++ b/executor/oci/hosts.go
@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 
@@ -56,7 +55,7 @@ func makeHostsFile(stateDir string, extraHosts []executor.HostIP, idmap *idtools
 	}
 
 	tmpPath := p + ".tmp"
-	if err := ioutil.WriteFile(tmpPath, b.Bytes(), 0644); err != nil {
+	if err := os.WriteFile(tmpPath, b.Bytes(), 0644); err != nil {
 		return "", nil, err
 	}
 
diff --git a/executor/oci/resolvconf.go b/executor/oci/resolvconf.go
index da7745697645..3ac0feda7aea 100644
--- a/executor/oci/resolvconf.go
+++ b/executor/oci/resolvconf.go
@@ -2,7 +2,6 @@ package oci
 
 import (
 	"context"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 
@@ -100,7 +99,7 @@ func GetResolvConf(ctx context.Context, stateDir string, idmap *idtools.Identity
 		}
 
 		tmpPath := p + ".tmp"
-		if err := ioutil.WriteFile(tmpPath, f.Content, 0644); err != nil {
+		if err := os.WriteFile(tmpPath, f.Content, 0644); err != nil {
 			return "", err
 		}
 
diff --git a/executor/oci/resolvconf_test.go b/executor/oci/resolvconf_test.go
index 316bcefda283..578abb81328c 100644
--- a/executor/oci/resolvconf_test.go
+++ b/executor/oci/resolvconf_test.go
@@ -2,7 +2,6 @@ package oci
 
 import (
 	"context"
-	"io/ioutil"
 	"os"
 	"testing"
 
@@ -27,13 +26,13 @@ nameserver 8.8.4.4
 nameserver 2001:4860:4860::8888
 nameserver 2001:4860:4860::8844`
 
-	dir, err := ioutil.TempDir("", "buildkit-test")
+	dir, err := os.MkdirTemp("", "buildkit-test")
 	require.NoError(t, err)
 	defer os.RemoveAll(dir)
 	ctx := context.Background()
 	p, err := GetResolvConf(ctx, dir, nil, nil)
 	require.NoError(t, err)
-	b, err := ioutil.ReadFile(p)
+	b, err := os.ReadFile(p)
 	require.NoError(t, err)
 	require.Equal(t, string(b), defaultResolvConf)
 }
diff --git a/exporter/local/export.go b/exporter/local/export.go
index 5daa4aa4268c..7f2b0fe83f3d 100644
--- a/exporter/local/export.go
+++ b/exporter/local/export.go
@@ -2,7 +2,6 @@ package local
 
 import (
 	"context"
-	"io/ioutil"
 	"os"
 	"strings"
 	"time"
@@ -67,7 +66,7 @@ func (e *localExporterInstance) Export(ctx context.Context, inp exporter.Source,
 			var err error
 			var idmap *idtools.IdentityMapping
 			if ref == nil {
-				src, err = ioutil.TempDir("", "buildkit")
+				src, err = os.MkdirTemp("", "buildkit")
 				if err != nil {
 					return err
 				}
diff --git a/exporter/tar/export.go b/exporter/tar/export.go
index 0febefd0b023..846efa33046a 100644
--- a/exporter/tar/export.go
+++ b/exporter/tar/export.go
@@ -2,7 +2,6 @@ package local
 
 import (
 	"context"
-	"io/ioutil"
 	"os"
 	"strconv"
 	"strings"
@@ -83,7 +82,7 @@ func (e *localExporterInstance) Export(ctx context.Context, inp exporter.Source,
 		var err error
 		var idmap *idtools.IdentityMapping
 		if ref == nil {
-			src, err = ioutil.TempDir("", "buildkit")
+			src, err = os.MkdirTemp("", "buildkit")
 			if err != nil {
 				return nil, err
 			}
diff --git a/frontend/dockerfile/cmd/dockerfile-frontend/Dockerfile b/frontend/dockerfile/cmd/dockerfile-frontend/Dockerfile
index 7f181948816b..e71903902426 100644
--- a/frontend/dockerfile/cmd/dockerfile-frontend/Dockerfile
+++ b/frontend/dockerfile/cmd/dockerfile-frontend/Dockerfile
@@ -3,7 +3,7 @@
 # xx is a helper for cross-compilation
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:golang@sha256:810dc54d5144f133a218e88e319184bf8b9ce01d37d46ddb37573e90decd9eef AS xx
 
-FROM --platform=$BUILDPLATFORM golang:1.17-alpine AS base
+FROM --platform=$BUILDPLATFORM golang:1.19-alpine AS base
 RUN apk add git bash
 COPY --from=xx / /
 WORKDIR /src
diff --git a/frontend/dockerfile/dockerfile_buildinfo_test.go b/frontend/dockerfile/dockerfile_buildinfo_test.go
index 87cd8c70813f..ae06ea094ae9 100644
--- a/frontend/dockerfile/dockerfile_buildinfo_test.go
+++ b/frontend/dockerfile/dockerfile_buildinfo_test.go
@@ -6,7 +6,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -48,7 +47,7 @@ func testBuildInfoSources(t *testing.T, sb integration.Sandbox) {
 	f := getFrontend(t, sb)
 	f.RequiresBuildctl(t)
 
-	gitDir, err := ioutil.TempDir("", "buildkit")
+	gitDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(gitDir)
 
@@ -59,7 +58,7 @@ ADD https://raw.githubusercontent.com/moby/moby/master/README.md /
 COPY --from=alpine /bin/busybox /alpine-busybox
 `
 
-	err = ioutil.WriteFile(filepath.Join(gitDir, "Dockerfile"), []byte(dockerfile), 0600)
+	err = os.WriteFile(filepath.Join(gitDir, "Dockerfile"), []byte(dockerfile), 0600)
 	require.NoError(t, err)
 
 	err = runShell(gitDir,
@@ -554,7 +553,7 @@ COPY --from=build /foo /out /
 		return res, nil
 	}
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -700,7 +699,7 @@ COPY --from=build /foo /out /
 		return res, nil
 	}
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -831,7 +830,7 @@ RUN echo "foo is $FOO" > /foo
 		return res, nil
 	}
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
diff --git a/frontend/dockerfile/dockerfile_heredoc_test.go b/frontend/dockerfile/dockerfile_heredoc_test.go
index 09f067540d99..6671fe436406 100644
--- a/frontend/dockerfile/dockerfile_heredoc_test.go
+++ b/frontend/dockerfile/dockerfile_heredoc_test.go
@@ -2,7 +2,6 @@ package dockerfile
 
 import (
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -78,7 +77,7 @@ COPY --from=build /dest /
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -104,7 +103,7 @@ COPY --from=build /dest /
 	}
 
 	for name, content := range contents {
-		dt, err := ioutil.ReadFile(filepath.Join(destDir, name))
+		dt, err := os.ReadFile(filepath.Join(destDir, name))
 		require.NoError(t, err)
 		require.Equal(t, content, string(dt))
 	}
@@ -151,7 +150,7 @@ EOF
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -169,31 +168,31 @@ EOF
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "quotefile"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "quotefile"))
 	require.NoError(t, err)
 	require.Equal(t, "\"quotes in file\"\n", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "slashfile1"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "slashfile1"))
 	require.NoError(t, err)
 	require.Equal(t, "\n", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "slashfile2"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "slashfile2"))
 	require.NoError(t, err)
 	require.Equal(t, "\\\n", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "slashfile3"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "slashfile3"))
 	require.NoError(t, err)
 	require.Equal(t, "$\n", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "rawslashfile1"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "rawslashfile1"))
 	require.NoError(t, err)
 	require.Equal(t, "\\\n", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "rawslashfile2"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "rawslashfile2"))
 	require.NoError(t, err)
 	require.Equal(t, "\\\\\n", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "rawslashfile3"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "rawslashfile3"))
 	require.NoError(t, err)
 	require.Equal(t, "\\$\n", string(dt))
 }
@@ -223,7 +222,7 @@ COPY --from=build /dest /dest
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -241,7 +240,7 @@ COPY --from=build /dest /dest
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "dest"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "dest"))
 	require.NoError(t, err)
 	require.Equal(t, "i am\nroot\n", string(dt))
 }
@@ -273,7 +272,7 @@ COPY --from=build /dest /dest
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -291,7 +290,7 @@ COPY --from=build /dest /dest
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "dest"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "dest"))
 	require.NoError(t, err)
 	require.Equal(t, "foo\n", string(dt))
 }
@@ -324,7 +323,7 @@ COPY --from=build /dest /dest
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -342,7 +341,7 @@ COPY --from=build /dest /dest
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "dest"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "dest"))
 	require.NoError(t, err)
 	require.Equal(t, "hello\nworld\n", string(dt))
 }
@@ -389,7 +388,7 @@ COPY --from=build /dest /
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -415,7 +414,7 @@ COPY --from=build /dest /
 	}
 
 	for name, content := range contents {
-		dt, err := ioutil.ReadFile(filepath.Join(destDir, name))
+		dt, err := os.ReadFile(filepath.Join(destDir, name))
 		require.NoError(t, err)
 		require.Equal(t, content, string(dt))
 	}
@@ -481,7 +480,7 @@ COPY --from=build /dest /
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -511,7 +510,7 @@ COPY --from=build /dest /
 	}
 
 	for name, content := range contents {
-		dt, err := ioutil.ReadFile(filepath.Join(destDir, name))
+		dt, err := os.ReadFile(filepath.Join(destDir, name))
 		require.NoError(t, err)
 		require.Equal(t, content, string(dt))
 	}
@@ -577,7 +576,7 @@ COPY --from=build /dest /
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -610,7 +609,7 @@ COPY --from=build /dest /
 	}
 
 	for name, content := range contents {
-		dt, err := ioutil.ReadFile(filepath.Join(destDir, name))
+		dt, err := os.ReadFile(filepath.Join(destDir, name))
 		require.NoError(t, err)
 		require.Equal(t, content, string(dt))
 	}
@@ -683,7 +682,7 @@ EOF
 	require.NoError(t, err)
 	defer os.RemoveAll(dir)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -701,7 +700,7 @@ EOF
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "dest"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "dest"))
 	require.NoError(t, err)
 	require.Equal(t, "hello world\n", string(dt))
 }
diff --git a/frontend/dockerfile/dockerfile_mount_test.go b/frontend/dockerfile/dockerfile_mount_test.go
index 731d5f2d78dc..f3b383ecb16b 100644
--- a/frontend/dockerfile/dockerfile_mount_test.go
+++ b/frontend/dockerfile/dockerfile_mount_test.go
@@ -1,7 +1,6 @@
 package dockerfile
 
 import (
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -187,7 +186,7 @@ COPY --from=second /unique /unique
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -205,7 +204,7 @@ COPY --from=second /unique /unique
 	}, nil)
 	require.NoError(t, err)
 
-	dt1, err := ioutil.ReadFile(filepath.Join(destDir, "unique"))
+	dt1, err := os.ReadFile(filepath.Join(destDir, "unique"))
 	require.NoError(t, err)
 
 	// repeat with changed file that should be still cached by content
@@ -216,7 +215,7 @@ COPY --from=second /unique /unique
 	require.NoError(t, err)
 	defer os.RemoveAll(dir)
 
-	destDir, err = ioutil.TempDir("", "buildkit")
+	destDir, err = os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -234,7 +233,7 @@ COPY --from=second /unique /unique
 	}, nil)
 	require.NoError(t, err)
 
-	dt2, err := ioutil.ReadFile(filepath.Join(destDir, "unique"))
+	dt2, err := os.ReadFile(filepath.Join(destDir, "unique"))
 	require.NoError(t, err)
 	require.Equal(t, dt1, dt2)
 }
@@ -474,7 +473,7 @@ COPY --from=base /tmpfssize /
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -492,7 +491,7 @@ COPY --from=base /tmpfssize /
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "tmpfssize"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "tmpfssize"))
 	require.NoError(t, err)
 	require.Contains(t, string(dt), `size=131072k`)
 }
diff --git a/frontend/dockerfile/dockerfile_ssh_test.go b/frontend/dockerfile/dockerfile_ssh_test.go
index 9515aad12882..9728c496c2dc 100644
--- a/frontend/dockerfile/dockerfile_ssh_test.go
+++ b/frontend/dockerfile/dockerfile_ssh_test.go
@@ -5,7 +5,6 @@ import (
 	"crypto/rsa"
 	"crypto/x509"
 	"encoding/pem"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -55,11 +54,11 @@ RUN --mount=type=ssh,mode=741,uid=100,gid=102 [ "$(stat -c "%u %g %f" $SSH_AUTH_
 		},
 	)
 
-	tmpDir, err := ioutil.TempDir("", "buildkit")
+	tmpDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpDir)
 
-	err = ioutil.WriteFile(filepath.Join(tmpDir, "key"), dt, 0600)
+	err = os.WriteFile(filepath.Join(tmpDir, "key"), dt, 0600)
 	require.NoError(t, err)
 
 	ssh, err := sshprovider.NewSSHAgentProvider([]sshprovider.AgentConfig{{
diff --git a/frontend/dockerfile/dockerfile_test.go b/frontend/dockerfile/dockerfile_test.go
index 0f2864089ec3..056e1a75ed7c 100644
--- a/frontend/dockerfile/dockerfile_test.go
+++ b/frontend/dockerfile/dockerfile_test.go
@@ -8,7 +8,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -242,7 +241,7 @@ echo -n $my_arg $1 > /out
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -271,7 +270,7 @@ echo -n $my_arg $1 > /out
 			}, nil)
 			require.NoError(t, err)
 
-			dt, err := ioutil.ReadFile(filepath.Join(destDir, "out"))
+			dt, err := os.ReadFile(filepath.Join(destDir, "out"))
 			require.NoError(t, err)
 			require.Equal(t, x.expected, string(dt))
 		})
@@ -297,7 +296,7 @@ RUN [ "$myenv" = 'foo%sbar' ]
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -434,7 +433,7 @@ COPY --from=base2 /foo /f
 	require.NoError(t, err)
 	defer os.RemoveAll(dir)
 
-	cacheDir, err := ioutil.TempDir("", "buildkit")
+	cacheDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(cacheDir)
 
@@ -584,7 +583,7 @@ WORKDIR /
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -790,7 +789,7 @@ COPY --from=base unique /
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -808,13 +807,13 @@ COPY --from=base unique /
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "unique"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "unique"))
 	require.NoError(t, err)
 
-	err = ioutil.WriteFile(filepath.Join(dir, "bar"), []byte("bar-data-mod"), 0600)
+	err = os.WriteFile(filepath.Join(dir, "bar"), []byte("bar-data-mod"), 0600)
 	require.NoError(t, err)
 
-	destDir, err = ioutil.TempDir("", "buildkit")
+	destDir, err = os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -832,14 +831,14 @@ COPY --from=base unique /
 	}, nil)
 	require.NoError(t, err)
 
-	dt2, err := ioutil.ReadFile(filepath.Join(destDir, "unique"))
+	dt2, err := os.ReadFile(filepath.Join(destDir, "unique"))
 	require.NoError(t, err)
 	require.Equal(t, string(dt), string(dt2))
 
-	err = ioutil.WriteFile(filepath.Join(dir, "foo2"), []byte("foo2-data-mod"), 0600)
+	err = os.WriteFile(filepath.Join(dir, "foo2"), []byte("foo2-data-mod"), 0600)
 	require.NoError(t, err)
 
-	destDir, err = ioutil.TempDir("", "buildkit")
+	destDir, err = os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -857,7 +856,7 @@ COPY --from=base unique /
 	}, nil)
 	require.NoError(t, err)
 
-	dt2, err = ioutil.ReadFile(filepath.Join(destDir, "unique"))
+	dt2, err = os.ReadFile(filepath.Join(destDir, "unique"))
 	require.NoError(t, err)
 	require.NotEqual(t, string(dt), string(dt2))
 }
@@ -881,7 +880,7 @@ COPY foo nomatch* /
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -899,7 +898,7 @@ COPY foo nomatch* /
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "foo"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "foo"))
 	require.NoError(t, err)
 	require.Equal(t, "contents0", string(dt))
 }
@@ -1068,7 +1067,7 @@ COPY link/foo .
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -1089,7 +1088,7 @@ COPY link/foo .
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "foo"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "foo"))
 	require.NoError(t, err)
 	require.Equal(t, "contents", string(dt))
 }
@@ -1116,7 +1115,7 @@ COPY --from=build /sub2/foo bar
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -1137,7 +1136,7 @@ COPY --from=build /sub2/foo bar
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "foo"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "foo"))
 	require.NoError(t, err)
 	require.Equal(t, "data", string(dt))
 }
@@ -1162,7 +1161,7 @@ COPY . /
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -1241,7 +1240,7 @@ COPY --from=build /out .
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -1259,7 +1258,7 @@ COPY --from=build /out .
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "out"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "out"))
 	require.NoError(t, err)
 	require.Equal(t, "bar-box-foo", string(dt))
 }
@@ -1287,7 +1286,7 @@ COPY --from=build /out .
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -1305,7 +1304,7 @@ COPY --from=build /out .
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "out"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "out"))
 	require.NoError(t, err)
 	require.Equal(t, "foo bar:box-foo:123 456", string(dt))
 }
@@ -1330,7 +1329,7 @@ COPY Dockerfile .
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -1355,7 +1354,7 @@ COPY Dockerfile .
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "out.tar"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "out.tar"))
 	require.NoError(t, err)
 
 	m, err := testutil.ReadTarToMap(dt, false)
@@ -1426,7 +1425,7 @@ COPY arch-$TARGETARCH whoami
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -1447,21 +1446,21 @@ COPY arch-$TARGETARCH whoami
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "windows_amd64/whoami"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "windows_amd64/whoami"))
 	require.NoError(t, err)
 	require.Equal(t, "i am amd64", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "linux_arm_v7/whoami"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "linux_arm_v7/whoami"))
 	require.NoError(t, err)
 	require.Equal(t, "i am arm", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "linux_s390x/whoami"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "linux_s390x/whoami"))
 	require.NoError(t, err)
 	require.Equal(t, "i am s390x", string(dt))
 
 	// repeat with oci exporter
 
-	destDir, err = ioutil.TempDir("", "buildkit")
+	destDir, err = os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -1486,7 +1485,7 @@ COPY arch-$TARGETARCH whoami
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "out.tar"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "out.tar"))
 	require.NoError(t, err)
 
 	m, err := testutil.ReadTarToMap(dt, false)
@@ -1580,7 +1579,7 @@ COPY foo /
 	require.NoError(t, err)
 	defer os.RemoveAll(dir)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -1601,7 +1600,7 @@ COPY foo /
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "foo"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "foo"))
 	require.NoError(t, err)
 	require.Equal(t, "contents2", string(dt))
 }
@@ -1681,7 +1680,7 @@ COPY foo/sub bar
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -1726,7 +1725,7 @@ COPY sub/l* alllinks/
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -1747,19 +1746,19 @@ COPY sub/l* alllinks/
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "foo"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "foo"))
 	require.NoError(t, err)
 	require.Equal(t, "bar-contents", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "alllinks/l0"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "alllinks/l0"))
 	require.NoError(t, err)
 	require.Equal(t, "subfile-contents", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "alllinks/lfile"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "alllinks/lfile"))
 	require.NoError(t, err)
 	require.Equal(t, "lfile-contents", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "alllinks/l1"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "alllinks/l1"))
 	require.NoError(t, err)
 	require.Equal(t, "baz-contents", string(dt))
 }
@@ -1774,11 +1773,11 @@ FROM scratch
 COPY --from=0 /foo /foo
 `)
 
-	srcDir, err := ioutil.TempDir("", "buildkit")
+	srcDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(srcDir)
 
-	err = ioutil.WriteFile(filepath.Join(srcDir, "Dockerfile"), dockerfile, 0600)
+	err = os.WriteFile(filepath.Join(srcDir, "Dockerfile"), dockerfile, 0600)
 	require.NoError(t, err)
 
 	resp := httpserver.Response{
@@ -1791,7 +1790,7 @@ COPY --from=0 /foo /foo
 	})
 	defer server.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -1813,7 +1812,7 @@ COPY --from=0 /foo /foo
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "foo"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "foo"))
 	require.NoError(t, err)
 	require.Equal(t, "foo-contents", string(dt))
 }
@@ -2015,7 +2014,7 @@ COPY foo .
 	def, err := echo.Marshal(sb.Context())
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -2033,7 +2032,7 @@ COPY foo .
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "foo"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "foo"))
 	require.NoError(t, err)
 	require.Equal(t, "foo0", string(dt))
 }
@@ -2237,7 +2236,7 @@ ADD %s /dest/
 	err = cmd.Run()
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "dest/foo"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "dest/foo"))
 	require.NoError(t, err)
 	require.Equal(t, []byte("content1"), dt)
 
@@ -2265,7 +2264,7 @@ ADD %s /dest/
 	require.NoError(t, err)
 
 	destFile := filepath.Join(destDir, "dest/__unnamed__")
-	dt, err = ioutil.ReadFile(destFile)
+	dt, err = os.ReadFile(destFile)
 	require.NoError(t, err)
 	require.Equal(t, []byte("content2"), dt)
 
@@ -2315,7 +2314,7 @@ ADD t.tar /
 	cmd := sb.Cmd(args + fmt.Sprintf(" --exporter=local --exporter-opt output=%s", destDir))
 	require.NoError(t, cmd.Run())
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "foo"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "foo"))
 	require.NoError(t, err)
 	require.Equal(t, expectedContent, dt)
 
@@ -2349,7 +2348,7 @@ ADD t.tar.gz /
 	cmd = sb.Cmd(args + fmt.Sprintf(" --exporter=local --exporter-opt output=%s", destDir))
 	require.NoError(t, cmd.Run())
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "foo"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "foo"))
 	require.NoError(t, err)
 	require.Equal(t, expectedContent, dt)
 
@@ -2376,7 +2375,7 @@ COPY t.tar.gz /
 	cmd = sb.Cmd(args + fmt.Sprintf(" --exporter=local --exporter-opt output=%s", destDir))
 	require.NoError(t, cmd.Run())
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "t.tar.gz"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "t.tar.gz"))
 	require.NoError(t, err)
 	require.Equal(t, buf2.Bytes(), dt)
 
@@ -2412,7 +2411,7 @@ ADD %s /
 	cmd = sb.Cmd(args + fmt.Sprintf(" --exporter=local --exporter-opt output=%s", destDir))
 	require.NoError(t, cmd.Run())
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "t.tar.gz"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "t.tar.gz"))
 	require.NoError(t, err)
 	require.Equal(t, buf2.Bytes(), dt)
 
@@ -2438,7 +2437,7 @@ ADD %s /newname.tar.gz
 	cmd = sb.Cmd(args + fmt.Sprintf(" --exporter=local --exporter-opt output=%s", destDir))
 	require.NoError(t, cmd.Run())
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "newname.tar.gz"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "newname.tar.gz"))
 	require.NoError(t, err)
 	require.Equal(t, buf2.Bytes(), dt)
 }
@@ -2489,7 +2488,7 @@ ADD *.tar /dest
 	require.NoError(t, err)
 	defer os.RemoveAll(dir)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -2511,11 +2510,11 @@ ADD *.tar /dest
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "dest/foo"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "dest/foo"))
 	require.NoError(t, err)
 	require.Equal(t, "content0", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "dest/bar"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "dest/bar"))
 	require.NoError(t, err)
 	require.Equal(t, "content1", string(dt))
 }
@@ -2597,7 +2596,7 @@ COPY foo /symlink/
 	cmd := sb.Cmd(args + fmt.Sprintf(" --exporter=local --exporter-opt output=%s", destDir))
 	require.NoError(t, cmd.Run())
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "tmp/symlink-target/foo"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "tmp/symlink-target/foo"))
 	require.NoError(t, err)
 	require.Equal(t, expectedContent, dt)
 }
@@ -2775,7 +2774,7 @@ Dockerfile
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -2793,7 +2792,7 @@ Dockerfile
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "foo"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "foo"))
 	require.NoError(t, err)
 	require.Equal(t, "foo-contents", string(dt))
 
@@ -2813,7 +2812,7 @@ Dockerfile
 	require.Error(t, err)
 	require.True(t, errors.Is(err, os.ErrNotExist))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "bay"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "bay"))
 	require.NoError(t, err)
 	require.Equal(t, "bay-contents", string(dt))
 }
@@ -3037,7 +3036,7 @@ USER nobody
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -3055,11 +3054,11 @@ USER nobody
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "rootuser"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "rootuser"))
 	require.NoError(t, err)
 	require.Equal(t, "root\n", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "daemonuser"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "daemonuser"))
 	require.NoError(t, err)
 	require.Equal(t, "daemon\n", string(dt))
 
@@ -3140,7 +3139,7 @@ COPY --from=base /out /
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -3162,15 +3161,15 @@ COPY --from=base /out /
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "fooowner"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "fooowner"))
 	require.NoError(t, err)
 	require.Equal(t, "daemon daemon\n", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "subowner"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "subowner"))
 	require.NoError(t, err)
 	require.Equal(t, "1000 nobody\n", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "foobisowner"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "foobisowner"))
 	require.NoError(t, err)
 	require.Equal(t, "1000 nobody\n", string(dt))
 }
@@ -3207,7 +3206,7 @@ COPY --from=base /out /
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -3233,15 +3232,15 @@ COPY --from=base /out /
 	}
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "fooperm"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "fooperm"))
 	require.NoError(t, err)
 	require.Equal(t, "0644\n", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "barperm"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "barperm"))
 	require.NoError(t, err)
 	require.Equal(t, "0777\n", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "foobisperm"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "foobisperm"))
 	require.NoError(t, err)
 	require.Equal(t, "0000\n", string(dt))
 }
@@ -3275,7 +3274,7 @@ COPY files dest
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -3296,11 +3295,11 @@ COPY files dest
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "sub/dir1/dir2/foo"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "sub/dir1/dir2/foo"))
 	require.NoError(t, err)
 	require.Equal(t, "foo-contents", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "dest/foo.go"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "dest/foo.go"))
 	require.NoError(t, err)
 	require.Equal(t, "foo.go-contents", string(dt))
 }
@@ -3327,7 +3326,7 @@ COPY $FOO baz
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -3348,7 +3347,7 @@ COPY $FOO baz
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "baz"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "baz"))
 	require.NoError(t, err)
 	require.Equal(t, "bar-contents", string(dt))
 }
@@ -3386,7 +3385,7 @@ COPY sub/dir1 subdest6
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -3407,45 +3406,45 @@ COPY sub/dir1 subdest6
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "gofiles/foo.go"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "gofiles/foo.go"))
 	require.NoError(t, err)
 	require.Equal(t, "foo-contents", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "gofiles/bar.go"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "gofiles/bar.go"))
 	require.NoError(t, err)
 	require.Equal(t, "bar-contents", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "foo2.go"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "foo2.go"))
 	require.NoError(t, err)
 	require.Equal(t, "foo-contents", string(dt))
 
 	if isFileOp { // non-fileop implementation is historically buggy
-		dt, err = ioutil.ReadFile(filepath.Join(destDir, "subdest/dir2/foo"))
+		dt, err = os.ReadFile(filepath.Join(destDir, "subdest/dir2/foo"))
 		require.NoError(t, err)
 		require.Equal(t, "foo-contents", string(dt))
 	}
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "subdest2/foo"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "subdest2/foo"))
 	require.NoError(t, err)
 	require.Equal(t, "foo-contents", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "subdest3/bar"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "subdest3/bar"))
 	require.NoError(t, err)
 	require.Equal(t, "foo-contents", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "all/foo.go"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "all/foo.go"))
 	require.NoError(t, err)
 	require.Equal(t, "foo-contents", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "subdest4/dir2/foo"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "subdest4/dir2/foo"))
 	require.NoError(t, err)
 	require.Equal(t, "foo-contents", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "subdest5/dir2/foo"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "subdest5/dir2/foo"))
 	require.NoError(t, err)
 	require.Equal(t, "foo-contents", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "subdest6/dir2/foo"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "subdest6/dir2/foo"))
 	require.NoError(t, err)
 	require.Equal(t, "foo-contents", string(dt))
 }
@@ -3555,7 +3554,7 @@ COPY --from=build /dest /dest
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "dest"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "dest"))
 	require.NoError(t, err)
 	require.Equal(t, []byte("0644\n0755\n0413\n"), dt)
 }
@@ -3563,7 +3562,7 @@ COPY --from=build /dest /dest
 func testDockerfileFromGit(t *testing.T, sb integration.Sandbox) {
 	f := getFrontend(t, sb)
 
-	gitDir, err := ioutil.TempDir("", "buildkit")
+	gitDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(gitDir)
 
@@ -3574,7 +3573,7 @@ FROM scratch
 COPY --from=build foo bar
 `
 
-	err = ioutil.WriteFile(filepath.Join(gitDir, "Dockerfile"), []byte(dockerfile), 0600)
+	err = os.WriteFile(filepath.Join(gitDir, "Dockerfile"), []byte(dockerfile), 0600)
 	require.NoError(t, err)
 
 	err = runShell(gitDir,
@@ -3591,7 +3590,7 @@ COPY --from=build foo bar
 COPY --from=build foo bar2
 `
 
-	err = ioutil.WriteFile(filepath.Join(gitDir, "Dockerfile"), []byte(dockerfile), 0600)
+	err = os.WriteFile(filepath.Join(gitDir, "Dockerfile"), []byte(dockerfile), 0600)
 	require.NoError(t, err)
 
 	err = runShell(gitDir,
@@ -3604,7 +3603,7 @@ COPY --from=build foo bar2
 	server := httptest.NewServer(http.FileServer(http.Dir(filepath.Join(gitDir))))
 	defer server.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -3625,7 +3624,7 @@ COPY --from=build foo bar2
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "bar"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "bar"))
 	require.NoError(t, err)
 	require.Equal(t, "fromgit", string(dt))
 
@@ -3634,7 +3633,7 @@ COPY --from=build foo bar2
 	require.True(t, errors.Is(err, os.ErrNotExist))
 
 	// second request from master branch contains both files
-	destDir, err = ioutil.TempDir("", "buildkit")
+	destDir, err = os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -3651,11 +3650,11 @@ COPY --from=build foo bar2
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "bar"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "bar"))
 	require.NoError(t, err)
 	require.Equal(t, "fromgit", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "bar2"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "bar2"))
 	require.NoError(t, err)
 	require.Equal(t, "fromgit", string(dt))
 }
@@ -3696,7 +3695,7 @@ COPY foo bar
 	})
 	defer server.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -3718,7 +3717,7 @@ COPY foo bar
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "bar"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "bar"))
 	require.NoError(t, err)
 	require.Equal(t, "foo-contents", string(dt))
 }
@@ -3741,7 +3740,7 @@ COPY --from=busybox /etc/passwd test
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -3759,7 +3758,7 @@ COPY --from=busybox /etc/passwd test
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "test"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "test"))
 	require.NoError(t, err)
 	require.Contains(t, string(dt), "root")
 
@@ -3779,7 +3778,7 @@ COPY --from=golang /usr/bin/go go
 	require.NoError(t, err)
 	defer os.RemoveAll(dir)
 
-	destDir, err = ioutil.TempDir("", "buildkit")
+	destDir, err = os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -3797,7 +3796,7 @@ COPY --from=golang /usr/bin/go go
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "go"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "go"))
 	require.NoError(t, err)
 	require.Contains(t, string(dt), "foo")
 }
@@ -3824,7 +3823,7 @@ COPY --from=stage1 baz bax
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -3845,7 +3844,7 @@ COPY --from=stage1 baz bax
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "baz"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "baz"))
 	require.NoError(t, err)
 	require.Contains(t, string(dt), "foo-contents")
 }
@@ -3868,7 +3867,7 @@ LABEL foo=bar
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -3945,7 +3944,7 @@ RUN ls /files/file1
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -4055,7 +4054,7 @@ ONBUILD RUN mkdir -p /out && echo -n 11 >> /out/foo
 	require.NoError(t, err)
 	defer os.RemoveAll(dir)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -4073,7 +4072,7 @@ ONBUILD RUN mkdir -p /out && echo -n 11 >> /out/foo
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "foo"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "foo"))
 	require.NoError(t, err)
 	require.Equal(t, "11", string(dt))
 }
@@ -4232,7 +4231,7 @@ COPY --from=base unique /
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -4258,16 +4257,16 @@ COPY --from=base unique /
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "const"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "const"))
 	require.NoError(t, err)
 	require.Equal(t, "foobar", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "unique"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "unique"))
 	require.NoError(t, err)
 
 	ensurePruneAll(t, c, sb)
 
-	destDir, err = ioutil.TempDir("", "buildkit")
+	destDir, err = os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -4288,15 +4287,15 @@ COPY --from=base unique /
 	}, nil)
 	require.NoError(t, err)
 
-	dt2, err := ioutil.ReadFile(filepath.Join(destDir, "const"))
+	dt2, err := os.ReadFile(filepath.Join(destDir, "const"))
 	require.NoError(t, err)
 	require.Equal(t, "foobar", string(dt2))
 
-	dt2, err = ioutil.ReadFile(filepath.Join(destDir, "unique"))
+	dt2, err = os.ReadFile(filepath.Join(destDir, "unique"))
 	require.NoError(t, err)
 	require.Equal(t, string(dt), string(dt2))
 
-	destDir, err = ioutil.TempDir("", "buildkit")
+	destDir, err = os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 }
@@ -4322,7 +4321,7 @@ RUN echo bar > bar
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -4403,7 +4402,7 @@ RUN echo bar > bar
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -4484,7 +4483,7 @@ COPY --from=s1 unique2 /
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -4505,7 +4504,7 @@ COPY --from=s1 unique2 /
 	_, err = f.Solve(sb.Context(), c, opt, nil)
 	require.NoError(t, err)
 
-	destDir2, err := ioutil.TempDir("", "buildkit")
+	destDir2, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -4515,22 +4514,22 @@ COPY --from=s1 unique2 /
 	_, err = f.Solve(sb.Context(), c, opt, nil)
 	require.NoError(t, err)
 
-	unique1Dir1, err := ioutil.ReadFile(filepath.Join(destDir, "unique"))
+	unique1Dir1, err := os.ReadFile(filepath.Join(destDir, "unique"))
 	require.NoError(t, err)
 
-	unique1Dir2, err := ioutil.ReadFile(filepath.Join(destDir2, "unique"))
+	unique1Dir2, err := os.ReadFile(filepath.Join(destDir2, "unique"))
 	require.NoError(t, err)
 
-	unique2Dir1, err := ioutil.ReadFile(filepath.Join(destDir, "unique2"))
+	unique2Dir1, err := os.ReadFile(filepath.Join(destDir, "unique2"))
 	require.NoError(t, err)
 
-	unique2Dir2, err := ioutil.ReadFile(filepath.Join(destDir2, "unique2"))
+	unique2Dir2, err := os.ReadFile(filepath.Join(destDir2, "unique2"))
 	require.NoError(t, err)
 
 	require.NotEqual(t, string(unique1Dir1), string(unique1Dir2))
 	require.NotEqual(t, string(unique2Dir1), string(unique2Dir2))
 
-	destDir3, err := ioutil.TempDir("", "buildkit")
+	destDir3, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -4540,10 +4539,10 @@ COPY --from=s1 unique2 /
 	_, err = f.Solve(sb.Context(), c, opt, nil)
 	require.NoError(t, err)
 
-	unique1Dir3, err := ioutil.ReadFile(filepath.Join(destDir3, "unique"))
+	unique1Dir3, err := os.ReadFile(filepath.Join(destDir3, "unique"))
 	require.NoError(t, err)
 
-	unique2Dir3, err := ioutil.ReadFile(filepath.Join(destDir3, "unique2"))
+	unique2Dir3, err := os.ReadFile(filepath.Join(destDir3, "unique2"))
 	require.NoError(t, err)
 
 	require.Equal(t, string(unique1Dir2), string(unique1Dir3))
@@ -4572,7 +4571,7 @@ COPY foo2 bar2
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -4592,11 +4591,11 @@ COPY foo2 bar2
 	_, err = f.Solve(sb.Context(), c, opt, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "bar"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "bar"))
 	require.NoError(t, err)
 	require.Equal(t, "d0", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "bar2"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "bar2"))
 	require.NoError(t, err)
 	require.Equal(t, "d1", string(dt))
 }
@@ -4623,7 +4622,7 @@ COPY --from=build out .
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -4647,11 +4646,11 @@ COPY --from=build out .
 	_, err = f.Solve(sb.Context(), c, opt, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "platform"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "platform"))
 	require.NoError(t, err)
 	require.Equal(t, "darwin/ppc64le", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "os"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "os"))
 	require.NoError(t, err)
 	require.Equal(t, "freebsd", string(dt))
 }
@@ -4679,7 +4678,7 @@ COPY --from=build /out /
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -4704,12 +4703,12 @@ COPY --from=build /out /
 	_, err = f.Solve(sb.Context(), c, opt, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "out"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "out"))
 	require.NoError(t, err)
 	require.Equal(t, "hpvalue::npvalue::foocontents::::bazcontent", string(dt))
 
 	// repeat with changed default args should match the old cache
-	destDir, err = ioutil.TempDir("", "buildkit")
+	destDir, err = os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -4733,12 +4732,12 @@ COPY --from=build /out /
 	_, err = f.Solve(sb.Context(), c, opt, nil)
 	require.NoError(t, err)
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "out"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "out"))
 	require.NoError(t, err)
 	require.Equal(t, "hpvalue::npvalue::foocontents::::bazcontent", string(dt))
 
 	// changing actual value invalidates cache
-	destDir, err = ioutil.TempDir("", "buildkit")
+	destDir, err = os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -4762,7 +4761,7 @@ COPY --from=build /out /
 	_, err = f.Solve(sb.Context(), c, opt, nil)
 	require.NoError(t, err)
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "out"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "out"))
 	require.NoError(t, err)
 	require.Equal(t, "hpvalue2::::foocontents2::::bazcontent", string(dt))
 }
@@ -4856,7 +4855,7 @@ COPY foo bar
 	url := up.Add(buf)
 
 	// repeat with changed default args should match the old cache
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -4880,7 +4879,7 @@ COPY foo bar
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "bar"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "bar"))
 	require.NoError(t, err)
 	require.Equal(t, string(dt), "contents")
 }
@@ -4933,7 +4932,7 @@ COPY foo foo2
 		})
 	}
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -4951,7 +4950,7 @@ COPY foo foo2
 	}, "", frontend, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "foo3"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "foo3"))
 	require.NoError(t, err)
 	require.Equal(t, dt, []byte("data"))
 }
@@ -4963,7 +4962,7 @@ func testFrontendInputs(t *testing.T, sb integration.Sandbox) {
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -4984,7 +4983,7 @@ func testFrontendInputs(t *testing.T, sb integration.Sandbox) {
 	}, nil)
 	require.NoError(t, err)
 
-	expected, err := ioutil.ReadFile(filepath.Join(destDir, "foo"))
+	expected, err := os.ReadFile(filepath.Join(destDir, "foo"))
 	require.NoError(t, err)
 
 	dockerfile := []byte(`
@@ -5014,7 +5013,7 @@ COPY foo foo2
 	}, nil)
 	require.NoError(t, err)
 
-	actual, err := ioutil.ReadFile(filepath.Join(destDir, "foo2"))
+	actual, err := os.ReadFile(filepath.Join(destDir, "foo2"))
 	require.NoError(t, err)
 	require.Equal(t, expected, actual)
 }
@@ -5176,7 +5175,7 @@ COPY --from=base /shmsize /
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -5197,7 +5196,7 @@ COPY --from=base /shmsize /
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "shmsize"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "shmsize"))
 	require.NoError(t, err)
 	require.Contains(t, string(dt), `size=131072k`)
 }
@@ -5221,7 +5220,7 @@ COPY --from=base /ulimit /
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -5242,7 +5241,7 @@ COPY --from=base /ulimit /
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "ulimit"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "ulimit"))
 	require.NoError(t, err)
 	require.Equal(t, `1062`, strings.TrimSpace(string(dt)))
 }
@@ -5270,7 +5269,7 @@ COPY --from=base /out /
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -5291,7 +5290,7 @@ COPY --from=base /out /
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "out"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "out"))
 	require.NoError(t, err)
 	require.Contains(t, strings.TrimSpace(string(dt)), `/foocgroup/buildkit/`)
 }
@@ -5318,7 +5317,7 @@ COPY --from=base /out /
 
 	f := getFrontend(t, sb)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -5340,7 +5339,7 @@ COPY --from=base /out /
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "out"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "out"))
 	require.NoError(t, err)
 	require.True(t, len(dt) > 0)
 
@@ -5625,7 +5624,7 @@ COPY --from=base /o* /
 
 	f := getFrontend(t, sb)
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -5647,11 +5646,11 @@ COPY --from=base /o* /
 	}, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "out"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "out"))
 	require.NoError(t, err)
 	require.True(t, len(dt) > 0)
 
-	_, err = ioutil.ReadFile(filepath.Join(destDir, "out2"))
+	_, err = os.ReadFile(filepath.Join(destDir, "out2"))
 	require.Error(t, err)
 	require.True(t, errors.Is(err, os.ErrNotExist))
 }
@@ -5739,7 +5738,7 @@ COPY --from=build /foo /out /
 
 	product := "buildkit_test"
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -5758,11 +5757,11 @@ COPY --from=build /foo /out /
 	}, product, b, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "out"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "out"))
 	require.NoError(t, err)
 	require.Equal(t, "first\n", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "foo"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "foo"))
 	require.NoError(t, err)
 	require.Equal(t, "foo is bar\n", string(dt))
 }
@@ -5881,7 +5880,7 @@ COPY --from=build /foo /out /
 
 	product := "buildkit_test"
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -5900,25 +5899,25 @@ COPY --from=build /foo /out /
 	}, product, b, nil)
 	require.NoError(t, err)
 
-	dt, err := ioutil.ReadFile(filepath.Join(destDir, "linux_amd64/out"))
+	dt, err := os.ReadFile(filepath.Join(destDir, "linux_amd64/out"))
 	require.NoError(t, err)
 	require.Equal(t, "foo amd64\n", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "linux_amd64/foo"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "linux_amd64/foo"))
 	require.NoError(t, err)
 	require.Equal(t, "foo is bar-amd64\n", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "linux_arm64/out"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "linux_arm64/out"))
 	require.NoError(t, err)
 	require.Equal(t, "foo arm64\n", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(destDir, "linux_arm64/foo"))
+	dt, err = os.ReadFile(filepath.Join(destDir, "linux_arm64/foo"))
 	require.NoError(t, err)
 	require.Equal(t, "foo is bar-arm64\n", string(dt))
 }
 
 func tmpdir(appliers ...fstest.Applier) (string, error) {
-	tmpdir, err := ioutil.TempDir("", "buildkit-dockerfile")
+	tmpdir, err := os.MkdirTemp("", "buildkit-dockerfile")
 	if err != nil {
 		return "", err
 	}
diff --git a/frontend/dockerfile/dockerignore/dockerignore_test.go b/frontend/dockerfile/dockerignore/dockerignore_test.go
index 40824367a762..7327c268f234 100644
--- a/frontend/dockerfile/dockerignore/dockerignore_test.go
+++ b/frontend/dockerfile/dockerignore/dockerignore_test.go
@@ -2,14 +2,13 @@ package dockerignore
 
 import (
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
 )
 
 func TestReadAll(t *testing.T) {
-	tmpDir, err := ioutil.TempDir("", "dockerignore-test")
+	tmpDir, err := os.MkdirTemp("", "dockerignore-test")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -26,7 +25,7 @@ func TestReadAll(t *testing.T) {
 
 	diName := filepath.Join(tmpDir, ".dockerignore")
 	content := fmt.Sprintf("test1\n/test2\n/a/file/here\n\nlastfile\n# this is a comment\n! /inverted/abs/path\n!\n! \n")
-	err = ioutil.WriteFile(diName, []byte(content), 0777)
+	err = os.WriteFile(diName, []byte(content), 0777)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/frontend/dockerfile/instructions/bflag.go b/frontend/dockerfile/instructions/bflag.go
index 1cfbf760006a..c57a2d21391c 100644
--- a/frontend/dockerfile/instructions/bflag.go
+++ b/frontend/dockerfile/instructions/bflag.go
@@ -134,7 +134,9 @@ func (fl *Flag) IsTrue() bool {
 // compile time error so it doesn't matter too much when we stop our
 // processing as long as we do stop it, so this allows the code
 // around AddXXX() to be just:
-//     defFlag := AddString("description", "")
+//
+//	defFlag := AddString("description", "")
+//
 // w/o needing to add an if-statement around each one.
 func (bf *BFlags) Parse() error {
 	// If there was an error while defining the possible flags
diff --git a/frontend/dockerfile/instructions/commands.go b/frontend/dockerfile/instructions/commands.go
index 48ebf183a965..df040e35f7da 100644
--- a/frontend/dockerfile/instructions/commands.go
+++ b/frontend/dockerfile/instructions/commands.go
@@ -157,7 +157,6 @@ func NewLabelCommand(k string, v string, NoExp bool) *LabelCommand {
 // LabelCommand : LABEL some json data describing the image
 //
 // Sets the Label variable foo to bar,
-//
 type LabelCommand struct {
 	withNameAndCode
 	Labels   KeyValuePairs // kvp slice instead of map to preserve ordering
@@ -220,7 +219,6 @@ func (s *SourcesAndDest) ExpandRaw(expander SingleWordExpander) error {
 //
 // Add the file 'foo' to '/path'. Tarball and Remote URL (http, https) handling
 // exist here. If you do not wish to have this automatic handling, use COPY.
-//
 type AddCommand struct {
 	withNameAndCode
 	SourcesAndDest
@@ -243,7 +241,6 @@ func (c *AddCommand) Expand(expander SingleWordExpander) error {
 // CopyCommand : COPY foo /path
 //
 // Same as 'ADD' but without the tar and remote url handling.
-//
 type CopyCommand struct {
 	withNameAndCode
 	SourcesAndDest
@@ -273,7 +270,6 @@ type OnbuildCommand struct {
 // WorkdirCommand : WORKDIR /tmp
 //
 // Set the working directory for future RUN/CMD/etc statements.
-//
 type WorkdirCommand struct {
 	withNameAndCode
 	Path string
@@ -312,7 +308,6 @@ type ShellDependantCmdLine struct {
 // RUN echo hi          # sh -c echo hi       (Linux)
 // RUN echo hi          # cmd /S /C echo hi   (Windows)
 // RUN [ "echo", "hi" ] # echo hi
-//
 type RunCommand struct {
 	withNameAndCode
 	withExternalData
@@ -331,7 +326,6 @@ func (c *RunCommand) Expand(expander SingleWordExpander) error {
 //
 // Set the default command to run in the container (which may be empty).
 // Argument handling is the same as RUN.
-//
 type CmdCommand struct {
 	withNameAndCode
 	ShellDependantCmdLine
@@ -341,7 +335,6 @@ type CmdCommand struct {
 //
 // Set the default healthcheck command to run in the container (which may be empty).
 // Argument handling is the same as RUN.
-//
 type HealthCheckCommand struct {
 	withNameAndCode
 	Health *container.HealthConfig
@@ -354,7 +347,6 @@ type HealthCheckCommand struct {
 //
 // Handles command processing similar to CMD and RUN, only req.runConfig.Entrypoint
 // is initialized at newBuilder time instead of through argument parsing.
-//
 type EntrypointCommand struct {
 	withNameAndCode
 	ShellDependantCmdLine
@@ -364,7 +356,6 @@ type EntrypointCommand struct {
 //
 // Expose ports for links and port mappings. This all ends up in
 // req.runConfig.ExposedPorts for runconfig.
-//
 type ExposeCommand struct {
 	withNameAndCode
 	Ports []string
@@ -374,7 +365,6 @@ type ExposeCommand struct {
 //
 // Set the user to 'foo' for future commands and when running the
 // ENTRYPOINT/CMD at container run time.
-//
 type UserCommand struct {
 	withNameAndCode
 	User string
@@ -393,7 +383,6 @@ func (c *UserCommand) Expand(expander SingleWordExpander) error {
 // VolumeCommand : VOLUME /foo
 //
 // Expose the volume /foo for use. Will also accept the JSON array form.
-//
 type VolumeCommand struct {
 	withNameAndCode
 	Volumes []string
diff --git a/frontend/dockerfile/instructions/parse.go b/frontend/dockerfile/instructions/parse.go
index d3b7326ce250..a04e9b9d4f48 100644
--- a/frontend/dockerfile/instructions/parse.go
+++ b/frontend/dockerfile/instructions/parse.go
@@ -725,7 +725,7 @@ func errExactlyOneArgument(command string) error {
 }
 
 func errNoDestinationArgument(command string) error {
-	return errors.Errorf("%s requires at least two arguments, but only one was provided. Destination could not be determined.", command)
+	return errors.Errorf("%s requires at least two arguments, but only one was provided. Destination could not be determined", command)
 }
 
 func errBadHeredoc(command string, option string) error {
diff --git a/frontend/dockerfile/parser/json_test.go b/frontend/dockerfile/parser/json_test.go
index 5ffd9bd2572d..d25804cd04d4 100644
--- a/frontend/dockerfile/parser/json_test.go
+++ b/frontend/dockerfile/parser/json_test.go
@@ -16,12 +16,12 @@ var invalidJSONArraysOfStrings = []string{
 }
 
 var validJSONArraysOfStrings = map[string][]string{
-	`[]`:           {},
-	`[""]`:         {""},
-	`["a"]`:        {"a"},
-	`["a","b"]`:    {"a", "b"},
-	`[ "a", "b" ]`: {"a", "b"},
-	`[	"a",	"b"	]`: {"a", "b"},
+	`[]`:             {},
+	`[""]`:           {""},
+	`["a"]`:          {"a"},
+	`["a","b"]`:      {"a", "b"},
+	`[ "a", "b" ]`:   {"a", "b"},
+	`[	"a",	"b"	]`:   {"a", "b"},
 	`	[	"a",	"b"	]	`: {"a", "b"},
 	`["abc 123", "♥", "☃", "\" \\ \/ \b \f \n \r \t \u0000"]`: {"abc 123", "♥", "☃", "\" \\ / \b \f \n \r \t \u0000"},
 }
diff --git a/frontend/dockerfile/parser/line_parsers.go b/frontend/dockerfile/parser/line_parsers.go
index c0d0a55d1224..2e3039f63e9a 100644
--- a/frontend/dockerfile/parser/line_parsers.go
+++ b/frontend/dockerfile/parser/line_parsers.go
@@ -34,7 +34,6 @@ func parseIgnore(rest string, d *directives) (*Node, map[string]bool, error) {
 // statement with sub-statements.
 //
 // ONBUILD RUN foo bar -> (onbuild (run foo bar))
-//
 func parseSubCommand(rest string, d *directives) (*Node, map[string]bool, error) {
 	if rest == "" {
 		return nil, nil, nil
diff --git a/frontend/dockerfile/parser/parser.go b/frontend/dockerfile/parser/parser.go
index 53165e0a481d..a9f6709d4d40 100644
--- a/frontend/dockerfile/parser/parser.go
+++ b/frontend/dockerfile/parser/parser.go
@@ -27,7 +27,6 @@ import (
 // This data structure is frankly pretty lousy for handling complex languages,
 // but lucky for us the Dockerfile isn't very complicated. This structure
 // works a little more effectively than a "proper" parse tree for our needs.
-//
 type Node struct {
 	Value       string          // actual content
 	Next        *Node           // the next item in the current sexp
diff --git a/frontend/dockerfile/parser/parser_test.go b/frontend/dockerfile/parser/parser_test.go
index 676188f1ea5f..70ae7e64b559 100644
--- a/frontend/dockerfile/parser/parser_test.go
+++ b/frontend/dockerfile/parser/parser_test.go
@@ -4,7 +4,6 @@ import (
 	"bufio"
 	"bytes"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -56,7 +55,7 @@ func TestParseCases(t *testing.T) {
 			result, err := Parse(df)
 			require.NoError(t, err, dockerfile)
 
-			content, err := ioutil.ReadFile(resultfile)
+			content, err := os.ReadFile(resultfile)
 			require.NoError(t, err, resultfile)
 
 			if runtime.GOOS == "windows" {
diff --git a/frontend/frontend_test.go b/frontend/frontend_test.go
index 29a77f03482f..8d8903019b85 100644
--- a/frontend/frontend_test.go
+++ b/frontend/frontend_test.go
@@ -2,7 +2,6 @@ package frontend
 
 import (
 	"context"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -43,7 +42,7 @@ func testReturnNil(t *testing.T, sb integration.Sandbox) {
 	require.NoError(t, err)
 	defer c.Close()
 
-	destDir, err := ioutil.TempDir("", "buildkit")
+	destDir, err := os.MkdirTemp("", "buildkit")
 	require.NoError(t, err)
 	defer os.RemoveAll(destDir)
 
@@ -297,7 +296,7 @@ func testRefStatFile(t *testing.T, sb integration.Sandbox) {
 }
 
 func tmpdir(appliers ...fstest.Applier) (string, error) {
-	tmpdir, err := ioutil.TempDir("", "buildkit-frontend")
+	tmpdir, err := os.MkdirTemp("", "buildkit-frontend")
 	if err != nil {
 		return "", err
 	}
diff --git a/frontend/gateway/pb/gateway.pb.go b/frontend/gateway/pb/gateway.pb.go
index e8e797ca7e10..236982d96f3f 100644
--- a/frontend/gateway/pb/gateway.pb.go
+++ b/frontend/gateway/pb/gateway.pb.go
@@ -35,6 +35,7 @@ const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
 
 type Result struct {
 	// Types that are valid to be assigned to Result:
+	//
 	//	*Result_RefDeprecated
 	//	*Result_RefsDeprecated
 	//	*Result_Ref
@@ -1673,6 +1674,7 @@ var xxx_messageInfo_ReleaseContainerResponse proto.InternalMessageInfo
 type ExecMessage struct {
 	ProcessID string `protobuf:"bytes,1,opt,name=ProcessID,proto3" json:"ProcessID,omitempty"`
 	// Types that are valid to be assigned to Input:
+	//
 	//	*ExecMessage_Init
 	//	*ExecMessage_File
 	//	*ExecMessage_Resize
diff --git a/hack/dockerfiles/generated-files.Dockerfile b/hack/dockerfiles/generated-files.Dockerfile
index a9f6f0bb9212..4a98712c67a1 100644
--- a/hack/dockerfiles/generated-files.Dockerfile
+++ b/hack/dockerfiles/generated-files.Dockerfile
@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile-upstream:master
 
 # protoc is dynamically linked to glibc to can't use golang:1.10-alpine
-FROM golang:1.17-buster AS gobuild-base
+FROM golang:1.19-buster AS gobuild-base
 
 RUN apt-get update && apt-get --no-install-recommends install -y \
 	unzip \
diff --git a/hack/dockerfiles/lint.Dockerfile b/hack/dockerfiles/lint.Dockerfile
index 62c3c290b51e..257a9e878196 100644
--- a/hack/dockerfiles/lint.Dockerfile
+++ b/hack/dockerfiles/lint.Dockerfile
@@ -1,8 +1,9 @@
 # syntax=docker/dockerfile-upstream:master
 
-FROM golang:1.17-alpine
+FROM golang:1.19-alpine
+ENV GOFLAGS="-buildvcs=false"
 RUN apk add --no-cache gcc musl-dev yamllint
-RUN wget -O- -nv https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s v1.43.0
+RUN wget -O- -nv https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s v1.48.0
 WORKDIR /go/src/github.com/moby/buildkit
 RUN --mount=target=/go/src/github.com/moby/buildkit --mount=target=/root/.cache,type=cache \
   GOARCH=amd64 golangci-lint run && \
diff --git a/hack/dockerfiles/vendor.Dockerfile b/hack/dockerfiles/vendor.Dockerfile
index a0d0607e4243..4108aaaecf1b 100644
--- a/hack/dockerfiles/vendor.Dockerfile
+++ b/hack/dockerfiles/vendor.Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile-upstream:master
 
-FROM golang:1.17-alpine AS vendored
+FROM golang:1.19-alpine AS vendored
 RUN  apk add --no-cache git
 WORKDIR /src
 RUN --mount=target=/src,rw \
diff --git a/session/auth/authprovider/tokenseed.go b/session/auth/authprovider/tokenseed.go
index d626e5989c30..0fdcea4c3968 100644
--- a/session/auth/authprovider/tokenseed.go
+++ b/session/auth/authprovider/tokenseed.go
@@ -3,7 +3,6 @@ package authprovider
 import (
 	"crypto/rand"
 	"encoding/json"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"sync"
@@ -47,7 +46,7 @@ func (ts *tokenSeeds) getSeed(host string) ([]byte, error) {
 	fp := filepath.Join(ts.dir, ".token_seed")
 
 	// we include client side randomness to avoid chosen plaintext attack from the daemon side
-	dt, err := ioutil.ReadFile(fp)
+	dt, err := os.ReadFile(fp)
 	if err != nil {
 		if !errors.Is(err, os.ErrNotExist) && !errors.Is(err, syscall.ENOTDIR) && !errors.Is(err, os.ErrPermission) {
 			return nil, err
@@ -68,7 +67,7 @@ func (ts *tokenSeeds) getSeed(host string) ([]byte, error) {
 		return nil, err
 	}
 
-	if err := ioutil.WriteFile(fp, dt, 0600); err != nil {
+	if err := os.WriteFile(fp, dt, 0600); err != nil {
 		if !errors.Is(err, syscall.EROFS) && !errors.Is(err, os.ErrPermission) {
 			return nil, err
 		}
diff --git a/session/content/content_test.go b/session/content/content_test.go
index 65960ac6360b..549292b14202 100644
--- a/session/content/content_test.go
+++ b/session/content/content_test.go
@@ -2,7 +2,6 @@ package content
 
 import (
 	"context"
-	"io/ioutil"
 	"os"
 	"testing"
 
@@ -24,7 +23,7 @@ func TestContentAttachable(t *testing.T) {
 	attachableStores := make(map[string]content.Store)
 	testBlobs := make(map[string]map[digest.Digest][]byte)
 	for _, id := range ids {
-		tmpDir, err := ioutil.TempDir("", "contenttest")
+		tmpDir, err := os.MkdirTemp("", "contenttest")
 		require.NoError(t, err)
 		defer os.RemoveAll(tmpDir)
 		store, err := local.NewStore(tmpDir)
diff --git a/session/filesync/filesync_test.go b/session/filesync/filesync_test.go
index b569d173166c..b80cb7ccbff9 100644
--- a/session/filesync/filesync_test.go
+++ b/session/filesync/filesync_test.go
@@ -2,7 +2,7 @@ package filesync
 
 import (
 	"context"
-	"io/ioutil"
+	"os"
 	"path/filepath"
 	"testing"
 
@@ -16,16 +16,16 @@ import (
 func TestFileSyncIncludePatterns(t *testing.T) {
 	ctx := context.TODO()
 	t.Parallel()
-	tmpDir, err := ioutil.TempDir("", "fsynctest")
+	tmpDir, err := os.MkdirTemp("", "fsynctest")
 	require.NoError(t, err)
 
-	destDir, err := ioutil.TempDir("", "fsynctest")
+	destDir, err := os.MkdirTemp("", "fsynctest")
 	require.NoError(t, err)
 
-	err = ioutil.WriteFile(filepath.Join(tmpDir, "foo"), []byte("content1"), 0600)
+	err = os.WriteFile(filepath.Join(tmpDir, "foo"), []byte("content1"), 0600)
 	require.NoError(t, err)
 
-	err = ioutil.WriteFile(filepath.Join(tmpDir, "bar"), []byte("content2"), 0600)
+	err = os.WriteFile(filepath.Join(tmpDir, "bar"), []byte("content2"), 0600)
 	require.NoError(t, err)
 
 	s, err := session.NewSession(ctx, "foo", "bar")
@@ -58,10 +58,10 @@ func TestFileSyncIncludePatterns(t *testing.T) {
 			return err
 		}
 
-		_, err = ioutil.ReadFile(filepath.Join(destDir, "foo"))
+		_, err = os.ReadFile(filepath.Join(destDir, "foo"))
 		assert.Error(t, err)
 
-		dt, err := ioutil.ReadFile(filepath.Join(destDir, "bar"))
+		dt, err := os.ReadFile(filepath.Join(destDir, "bar"))
 		if err != nil {
 			return err
 		}
diff --git a/session/secrets/secretsprovider/store.go b/session/secrets/secretsprovider/store.go
index 3a846f84e2b9..922036aed67b 100644
--- a/session/secrets/secretsprovider/store.go
+++ b/session/secrets/secretsprovider/store.go
@@ -2,7 +2,6 @@ package secretsprovider
 
 import (
 	"context"
-	"io/ioutil"
 	"os"
 
 	"github.com/moby/buildkit/session/secrets"
@@ -57,7 +56,7 @@ func (fs *fileStore) GetSecret(ctx context.Context, id string) ([]byte, error) {
 	if v.Env != "" {
 		return []byte(os.Getenv(v.Env)), nil
 	}
-	dt, err := ioutil.ReadFile(v.FilePath)
+	dt, err := os.ReadFile(v.FilePath)
 	if err != nil {
 		return nil, err
 	}
diff --git a/session/sshforward/ssh.go b/session/sshforward/ssh.go
index a7a4c2e228a3..42307d4f6ab9 100644
--- a/session/sshforward/ssh.go
+++ b/session/sshforward/ssh.go
@@ -1,7 +1,6 @@
 package sshforward
 
 import (
-	"io/ioutil"
 	"net"
 	"os"
 	"path/filepath"
@@ -64,7 +63,7 @@ type SocketOpt struct {
 }
 
 func MountSSHSocket(ctx context.Context, c session.Caller, opt SocketOpt) (sockPath string, closer func() error, err error) {
-	dir, err := ioutil.TempDir("", ".buildkit-ssh-sock")
+	dir, err := os.MkdirTemp("", ".buildkit-ssh-sock")
 	if err != nil {
 		return "", nil, errors.WithStack(err)
 	}
diff --git a/session/sshforward/sshprovider/agentprovider.go b/session/sshforward/sshprovider/agentprovider.go
index 981eb96f5628..f6501113d710 100644
--- a/session/sshforward/sshprovider/agentprovider.go
+++ b/session/sshforward/sshprovider/agentprovider.go
@@ -3,7 +3,6 @@ package sshprovider
 import (
 	"context"
 	"io"
-	"io/ioutil"
 	"net"
 	"os"
 	"runtime"
@@ -166,7 +165,7 @@ func toAgentSource(paths []string) (source, error) {
 		if err != nil {
 			return source{}, errors.Wrapf(err, "failed to open %s", p)
 		}
-		dt, err := ioutil.ReadAll(&io.LimitedReader{R: f, N: 100 * 1024})
+		dt, err := io.ReadAll(&io.LimitedReader{R: f, N: 100 * 1024})
 		if err != nil {
 			return source{}, errors.Wrapf(err, "failed to read %s", p)
 		}
diff --git a/snapshot/localmounter_unix.go b/snapshot/localmounter_unix.go
index ef73e263fc91..27cff3ebdf8c 100644
--- a/snapshot/localmounter_unix.go
+++ b/snapshot/localmounter_unix.go
@@ -4,7 +4,6 @@
 package snapshot
 
 import (
-	"io/ioutil"
 	"os"
 	"syscall"
 
@@ -38,7 +37,7 @@ func (lm *localMounter) Mount() (string, error) {
 		}
 	}
 
-	dir, err := ioutil.TempDir("", "buildkit-mount")
+	dir, err := os.MkdirTemp("", "buildkit-mount")
 	if err != nil {
 		return "", errors.Wrap(err, "failed to create temp dir")
 	}
diff --git a/snapshot/snapshotter_test.go b/snapshot/snapshotter_test.go
index c2eb0577fabf..e625d8a3a62e 100644
--- a/snapshot/snapshotter_test.go
+++ b/snapshot/snapshotter_test.go
@@ -6,7 +6,6 @@ package snapshot
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -48,7 +47,7 @@ func newSnapshotter(ctx context.Context, snapshotterName string) (_ context.Cont
 		}
 	}()
 
-	tmpdir, err := ioutil.TempDir("", "buildkit-test")
+	tmpdir, err := os.MkdirTemp("", "buildkit-test")
 	if err != nil {
 		return nil, nil, nil, err
 	}
diff --git a/solver/bboltcachestorage/storage_test.go b/solver/bboltcachestorage/storage_test.go
index 5e72c889b47d..dd98a486c034 100644
--- a/solver/bboltcachestorage/storage_test.go
+++ b/solver/bboltcachestorage/storage_test.go
@@ -1,7 +1,6 @@
 package bboltcachestorage
 
 import (
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -13,7 +12,7 @@ import (
 
 func TestBoltCacheStorage(t *testing.T) {
 	testutil.RunCacheStorageTests(t, func() (solver.CacheKeyStorage, func()) {
-		tmpDir, err := ioutil.TempDir("", "storage")
+		tmpDir, err := os.MkdirTemp("", "storage")
 		require.NoError(t, err)
 
 		cleanup := func() {
diff --git a/solver/edge.go b/solver/edge.go
index 8504d9f657d6..3493054d3e97 100644
--- a/solver/edge.go
+++ b/solver/edge.go
@@ -317,10 +317,10 @@ func (e *edge) skipPhase2FastCache(dep *dep) bool {
 // previous calls.
 // To avoid deadlocks and resource leaks this function needs to follow
 // following rules:
-// 1) this function needs to return unclosed outgoing requests if some incoming
-//    requests were not completed
-// 2) this function may not return outgoing requests if it has completed all
-//    incoming requests
+//  1. this function needs to return unclosed outgoing requests if some incoming
+//     requests were not completed
+//  2. this function may not return outgoing requests if it has completed all
+//     incoming requests
 func (e *edge) unpark(incoming []pipe.Sender, updates, allPipes []pipe.Receiver, f *pipeFactory) {
 	// process all incoming changes
 	depChanged := false
diff --git a/solver/errdefs/errdefs.pb.go b/solver/errdefs/errdefs.pb.go
index 5da34b6e591b..e02cfb9696d8 100644
--- a/solver/errdefs/errdefs.pb.go
+++ b/solver/errdefs/errdefs.pb.go
@@ -186,6 +186,7 @@ type Solve struct {
 	MountIDs []string `protobuf:"bytes,2,rep,name=mountIDs,proto3" json:"mountIDs,omitempty"`
 	Op       *pb.Op   `protobuf:"bytes,3,opt,name=op,proto3" json:"op,omitempty"`
 	// Types that are valid to be assigned to Subject:
+	//
 	//	*Solve_File
 	//	*Solve_Cache
 	Subject              isSolve_Subject `protobuf_oneof:"subject"`
diff --git a/solver/jobs_test.go b/solver/jobs_test.go
index 091bd2f8e927..880c605ee160 100644
--- a/solver/jobs_test.go
+++ b/solver/jobs_test.go
@@ -1,7 +1,6 @@
 package solver
 
 import (
-	"io/ioutil"
 	"os"
 	"testing"
 	"time"
@@ -62,7 +61,7 @@ func testParallelism(t *testing.T, sb integration.Sandbox) {
 
 	timeStart := time.Now()
 	eg, egCtx := errgroup.WithContext(ctx)
-	tmpDir, err := ioutil.TempDir("", "solver-jobs-test-")
+	tmpDir, err := os.MkdirTemp("", "solver-jobs-test-")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpDir)
 	solveOpt := client.SolveOpt{
diff --git a/solver/llbsolver/file/backend.go b/solver/llbsolver/file/backend.go
index 732e67474144..974c2e04e877 100644
--- a/solver/llbsolver/file/backend.go
+++ b/solver/llbsolver/file/backend.go
@@ -2,7 +2,6 @@ package file
 
 import (
 	"context"
-	"io/ioutil"
 	"log"
 	"os"
 	"path/filepath"
@@ -110,7 +109,7 @@ func mkfile(ctx context.Context, d string, action pb.FileActionMkFile, user *cop
 		return err
 	}
 
-	if err := ioutil.WriteFile(p, action.Data, os.FileMode(action.Mode)&0777); err != nil {
+	if err := os.WriteFile(p, action.Data, os.FileMode(action.Mode)&0777); err != nil {
 		return err
 	}
 
diff --git a/solver/llbsolver/mounts/mount.go b/solver/llbsolver/mounts/mount.go
index ffa4df5da367..dd758aecdac8 100644
--- a/solver/llbsolver/mounts/mount.go
+++ b/solver/llbsolver/mounts/mount.go
@@ -3,7 +3,6 @@ package mounts
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"sync"
@@ -282,7 +281,7 @@ type secretMountInstance struct {
 }
 
 func (sm *secretMountInstance) Mount() ([]mount.Mount, func() error, error) {
-	dir, err := ioutil.TempDir("", "buildkit-secrets")
+	dir, err := os.MkdirTemp("", "buildkit-secrets")
 	if err != nil {
 		return nil, nil, errors.Wrap(err, "failed to create temp dir")
 	}
@@ -320,7 +319,7 @@ func (sm *secretMountInstance) Mount() ([]mount.Mount, func() error, error) {
 
 	randID := identity.NewID()
 	fp := filepath.Join(dir, randID)
-	if err := ioutil.WriteFile(fp, sm.sm.data, 0600); err != nil {
+	if err := os.WriteFile(fp, sm.sm.data, 0600); err != nil {
 		cleanup()
 		return nil, nil, err
 	}
diff --git a/solver/llbsolver/mounts/mount_test.go b/solver/llbsolver/mounts/mount_test.go
index 7469aef55861..ed3861356a95 100644
--- a/solver/llbsolver/mounts/mount_test.go
+++ b/solver/llbsolver/mounts/mount_test.go
@@ -2,7 +2,6 @@ package mounts
 
 import (
 	"context"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"sync"
@@ -53,7 +52,7 @@ func newCacheManager(ctx context.Context, opt cmOpt) (co *cmOut, cleanup func()
 		opt.snapshotterName = "native"
 	}
 
-	tmpdir, err := ioutil.TempDir("", "cachemanager")
+	tmpdir, err := os.MkdirTemp("", "cachemanager")
 	if err != nil {
 		return nil, nil, err
 	}
@@ -153,7 +152,7 @@ func TestCacheMountPrivateRefs(t *testing.T) {
 	t.Parallel()
 	ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")
 
-	tmpdir, err := ioutil.TempDir("", "cachemanager")
+	tmpdir, err := os.MkdirTemp("", "cachemanager")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -220,7 +219,7 @@ func TestCacheMountSharedRefs(t *testing.T) {
 	t.Parallel()
 	ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")
 
-	tmpdir, err := ioutil.TempDir("", "cachemanager")
+	tmpdir, err := os.MkdirTemp("", "cachemanager")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -270,7 +269,7 @@ func TestCacheMountLockedRefs(t *testing.T) {
 	t.Parallel()
 	ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")
 
-	tmpdir, err := ioutil.TempDir("", "cachemanager")
+	tmpdir, err := os.MkdirTemp("", "cachemanager")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -333,7 +332,7 @@ func TestCacheMountSharedRefsDeadlock(t *testing.T) {
 	// not parallel
 	ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")
 
-	tmpdir, err := ioutil.TempDir("", "cachemanager")
+	tmpdir, err := os.MkdirTemp("", "cachemanager")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
diff --git a/solver/llbsolver/ops/exec_binfmt.go b/solver/llbsolver/ops/exec_binfmt.go
index 56433d49fdec..829e84205950 100644
--- a/solver/llbsolver/ops/exec_binfmt.go
+++ b/solver/llbsolver/ops/exec_binfmt.go
@@ -2,7 +2,6 @@ package ops
 
 import (
 	"context"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -47,7 +46,7 @@ type staticEmulatorMount struct {
 }
 
 func (m *staticEmulatorMount) Mount() ([]mount.Mount, func() error, error) {
-	tmpdir, err := ioutil.TempDir("", "buildkit-qemu-emulator")
+	tmpdir, err := os.MkdirTemp("", "buildkit-qemu-emulator")
 	if err != nil {
 		return nil, nil, err
 	}
diff --git a/solver/pb/ops.pb.go b/solver/pb/ops.pb.go
index 252227a94415..a3e3425fa29c 100644
--- a/solver/pb/ops.pb.go
+++ b/solver/pb/ops.pb.go
@@ -154,6 +154,7 @@ type Op struct {
 	// inputs is a set of input edges.
 	Inputs []*Input `protobuf:"bytes,1,rep,name=inputs,proto3" json:"inputs,omitempty"`
 	// Types that are valid to be assigned to Op:
+	//
 	//	*Op_Exec
 	//	*Op_Source
 	//	*Op_File
@@ -1948,6 +1949,7 @@ type FileAction struct {
 	SecondaryInput InputIndex  `protobuf:"varint,2,opt,name=secondaryInput,proto3,customtype=InputIndex" json:"secondaryInput"`
 	Output         OutputIndex `protobuf:"varint,3,opt,name=output,proto3,customtype=OutputIndex" json:"output"`
 	// Types that are valid to be assigned to Action:
+	//
 	//	*FileAction_Copy
 	//	*FileAction_Mkfile
 	//	*FileAction_Mkdir
@@ -2465,6 +2467,7 @@ func (m *ChownOpt) GetGroup() *UserOpt {
 
 type UserOpt struct {
 	// Types that are valid to be assigned to User:
+	//
 	//	*UserOpt_ByName
 	//	*UserOpt_ByID
 	User isUserOpt_User `protobuf_oneof:"user"`
diff --git a/solver/testutil/cachestorage_testsuite.go b/solver/testutil/cachestorage_testsuite.go
index e883ddd2a6eb..10abee7e7c61 100644
--- a/solver/testutil/cachestorage_testsuite.go
+++ b/solver/testutil/cachestorage_testsuite.go
@@ -387,7 +387,7 @@ func testWalkIDsByResult(t *testing.T, st solver.CacheKeyStorage) {
 func getFunctionName(i interface{}) string {
 	fullname := runtime.FuncForPC(reflect.ValueOf(i).Pointer()).Name()
 	dot := strings.LastIndex(fullname, ".") + 1
-	return strings.Title(fullname[dot:])
+	return strings.Title(fullname[dot:]) //nolint:staticcheck // ignoring "SA1019: strings.Title is deprecated", as for our use we don't need full unicode support
 }
 
 func rootKey(dgst digest.Digest, output solver.Index) digest.Digest {
diff --git a/source/git/gitsource.go b/source/git/gitsource.go
index 7b52c1133016..ef61f9e3efff 100644
--- a/source/git/gitsource.go
+++ b/source/git/gitsource.go
@@ -6,7 +6,6 @@ import (
 	"encoding/base64"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/url"
 	"os"
 	"os/exec"
@@ -277,7 +276,7 @@ func (gs *gitSourceHandler) mountKnownHosts(ctx context.Context) (string, func()
 	if gs.src.KnownSSHHosts == "" {
 		return "", nil, errors.Errorf("no configured known hosts forwarded from the client")
 	}
-	knownHosts, err := ioutil.TempFile("", "")
+	knownHosts, err := os.CreateTemp("", "")
 	if err != nil {
 		return "", nil, err
 	}
@@ -550,7 +549,7 @@ func (gs *gitSourceHandler) Snapshot(ctx context.Context, g session.Group) (out
 	} else {
 		cd := checkoutDir
 		if subdir != "." {
-			cd, err = ioutil.TempDir(cd, "checkout")
+			cd, err = os.MkdirTemp(cd, "checkout")
 			if err != nil {
 				return nil, errors.Wrapf(err, "failed to create temporary checkout dir")
 			}
diff --git a/source/git/gitsource_test.go b/source/git/gitsource_test.go
index 6f70175c8ff5..9598e9627483 100644
--- a/source/git/gitsource_test.go
+++ b/source/git/gitsource_test.go
@@ -3,7 +3,6 @@ package git
 import (
 	"bytes"
 	"context"
-	"io/ioutil"
 	"net/http"
 	"net/http/cgi"
 	"net/http/httptest"
@@ -91,7 +90,7 @@ func testRepeatedFetch(t *testing.T, keepGitDir bool) {
 	require.NoError(t, err)
 	defer lm.Unmount()
 
-	dt, err := ioutil.ReadFile(filepath.Join(dir, "def"))
+	dt, err := os.ReadFile(filepath.Join(dir, "def"))
 	require.NoError(t, err)
 
 	require.Equal(t, "bar\n", string(dt))
@@ -142,12 +141,12 @@ func testRepeatedFetch(t *testing.T, keepGitDir bool) {
 	require.NoError(t, err)
 	defer lm.Unmount()
 
-	dt, err = ioutil.ReadFile(filepath.Join(dir, "ghi"))
+	dt, err = os.ReadFile(filepath.Join(dir, "ghi"))
 	require.NoError(t, err)
 
 	require.Equal(t, "baz\n", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(dir, "sub/subfile"))
+	dt, err = os.ReadFile(filepath.Join(dir, "sub/subfile"))
 	require.NoError(t, err)
 
 	require.Equal(t, "subcontents\n", string(dt))
@@ -211,12 +210,12 @@ func testFetchBySHA(t *testing.T, keepGitDir bool) {
 	require.NoError(t, err)
 	defer lm.Unmount()
 
-	dt, err := ioutil.ReadFile(filepath.Join(dir, "ghi"))
+	dt, err := os.ReadFile(filepath.Join(dir, "ghi"))
 	require.NoError(t, err)
 
 	require.Equal(t, "baz\n", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(dir, "sub/subfile"))
+	dt, err = os.ReadFile(filepath.Join(dir, "sub/subfile"))
 	require.NoError(t, err)
 
 	require.Equal(t, "subcontents\n", string(dt))
@@ -280,11 +279,11 @@ func testFetchByTag(t *testing.T, tag, expectedCommitSubject string, isAnnotated
 	require.NoError(t, err)
 	defer lm.Unmount()
 
-	dt, err := ioutil.ReadFile(filepath.Join(dir, "def"))
+	dt, err := os.ReadFile(filepath.Join(dir, "def"))
 	require.NoError(t, err)
 	require.Equal(t, "bar\n", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(dir, "foo13"))
+	dt, err = os.ReadFile(filepath.Join(dir, "foo13"))
 	if hasFoo13File {
 		require.Nil(t, err)
 		require.Equal(t, "sbb\n", string(dt))
@@ -333,13 +332,13 @@ func testMultipleRepos(t *testing.T, keepGitDir bool) {
 	ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")
 	ctx = logProgressStreams(ctx, t)
 
-	tmpdir, err := ioutil.TempDir("", "buildkit-state")
+	tmpdir, err := os.MkdirTemp("", "buildkit-state")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
 	repo := setupGitRepo(t)
 
-	repodir2, err := ioutil.TempDir("", "buildkit-gitsource")
+	repodir2, err := os.MkdirTemp("", "buildkit-gitsource")
 	require.NoError(t, err)
 	defer os.RemoveAll(repodir2)
 
@@ -406,12 +405,12 @@ func testMultipleRepos(t *testing.T, keepGitDir bool) {
 	require.NoError(t, err)
 	defer lm.Unmount()
 
-	dt, err := ioutil.ReadFile(filepath.Join(dir, "def"))
+	dt, err := os.ReadFile(filepath.Join(dir, "def"))
 	require.NoError(t, err)
 
 	require.Equal(t, "bar\n", string(dt))
 
-	dt, err = ioutil.ReadFile(filepath.Join(dir2, "xyz"))
+	dt, err = os.ReadFile(filepath.Join(dir2, "xyz"))
 	require.NoError(t, err)
 
 	require.Equal(t, "xyz\n", string(dt))
@@ -426,7 +425,7 @@ func TestCredentialRedaction(t *testing.T) {
 	ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")
 	ctx = logProgressStreams(ctx, t)
 
-	tmpdir, err := ioutil.TempDir("", "buildkit-state")
+	tmpdir, err := os.MkdirTemp("", "buildkit-state")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -504,12 +503,12 @@ func testSubdir(t *testing.T, keepGitDir bool) {
 	require.NoError(t, err)
 	defer lm.Unmount()
 
-	fis, err := ioutil.ReadDir(dir)
+	fis, err := os.ReadDir(dir)
 	require.NoError(t, err)
 
 	require.Equal(t, 1, len(fis))
 
-	dt, err := ioutil.ReadFile(filepath.Join(dir, "bar"))
+	dt, err := os.ReadFile(filepath.Join(dir, "bar"))
 	require.NoError(t, err)
 
 	require.Equal(t, "abc\n", string(dt))
diff --git a/source/http/httpsource_test.go b/source/http/httpsource_test.go
index a8f90949fd9a..5066d8cb3cff 100644
--- a/source/http/httpsource_test.go
+++ b/source/http/httpsource_test.go
@@ -2,7 +2,6 @@ package http
 
 import (
 	"context"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -36,7 +35,7 @@ func TestHTTPSource(t *testing.T) {
 	t.Parallel()
 	ctx := context.TODO()
 
-	tmpdir, err := ioutil.TempDir("", "buildkit-state")
+	tmpdir, err := os.MkdirTemp("", "buildkit-state")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -159,7 +158,7 @@ func TestHTTPDefaultName(t *testing.T) {
 	t.Parallel()
 	ctx := context.TODO()
 
-	tmpdir, err := ioutil.TempDir("", "buildkit-state")
+	tmpdir, err := os.MkdirTemp("", "buildkit-state")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -209,7 +208,7 @@ func TestHTTPInvalidURL(t *testing.T) {
 	t.Parallel()
 	ctx := context.TODO()
 
-	tmpdir, err := ioutil.TempDir("", "buildkit-state")
+	tmpdir, err := os.MkdirTemp("", "buildkit-state")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -237,7 +236,7 @@ func TestHTTPChecksum(t *testing.T) {
 	t.Parallel()
 	ctx := context.TODO()
 
-	tmpdir, err := ioutil.TempDir("", "buildkit-state")
+	tmpdir, err := os.MkdirTemp("", "buildkit-state")
 	require.NoError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -328,7 +327,7 @@ func readFile(ctx context.Context, ref cache.ImmutableRef, fp string) ([]byte, e
 
 	defer lm.Unmount()
 
-	dt, err := ioutil.ReadFile(filepath.Join(dir, fp))
+	dt, err := os.ReadFile(filepath.Join(dir, fp))
 	if err != nil {
 		return nil, err
 	}
diff --git a/util/archutil/Dockerfile b/util/archutil/Dockerfile
index 6ac641f06dcb..9f831b7bfd44 100644
--- a/util/archutil/Dockerfile
+++ b/util/archutil/Dockerfile
@@ -48,7 +48,7 @@ FROM base AS exit-mips64
 COPY fixtures/exit.mips64.s .
 RUN mips64-linux-gnuabi64-as --noexecstack -o exit.o exit.mips64.s && mips64-linux-gnuabi64-ld -o exit -s exit.o
 
-FROM golang:1.17-alpine AS generate
+FROM golang:1.19-alpine AS generate
 WORKDIR /src
 COPY --from=exit-amd64 /src/exit amd64
 COPY --from=exit-386 /src/exit 386
diff --git a/util/archutil/check_unix.go b/util/archutil/check_unix.go
index 8b558a31765f..f6f90589fc1d 100644
--- a/util/archutil/check_unix.go
+++ b/util/archutil/check_unix.go
@@ -7,7 +7,6 @@ import (
 	"bytes"
 	"compress/gzip"
 	"io"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -23,7 +22,7 @@ func withChroot(cmd *exec.Cmd, dir string) {
 }
 
 func check(arch, bin string) (string, error) {
-	tmpdir, err := ioutil.TempDir("", "qemu-check")
+	tmpdir, err := os.MkdirTemp("", "qemu-check")
 	if err != nil {
 		return "", err
 	}
diff --git a/util/archutil/detect.go b/util/archutil/detect.go
index 44cb3133e1b6..837b05791a83 100644
--- a/util/archutil/detect.go
+++ b/util/archutil/detect.go
@@ -87,9 +87,9 @@ func SupportedPlatforms(noCache bool) []ocispecs.Platform {
 	return arr
 }
 
-//WarnIfUnsupported validates the platforms and show warning message if there is,
-//the end user could fix the issue based on those warning, and thus no need to drop
-//the platform from the candidates.
+// WarnIfUnsupported validates the platforms and show warning message if there is,
+// the end user could fix the issue based on those warning, and thus no need to drop
+// the platform from the candidates.
 func WarnIfUnsupported(pfs []ocispecs.Platform) {
 	def := nativePlatform()
 	for _, p := range pfs {
diff --git a/util/contentutil/buffer.go b/util/contentutil/buffer.go
index 8babab9177c6..9230b20731e1 100644
--- a/util/contentutil/buffer.go
+++ b/util/contentutil/buffer.go
@@ -3,7 +3,7 @@ package contentutil
 import (
 	"bytes"
 	"context"
-	"io/ioutil"
+	"io"
 	"strings"
 	"sync"
 	"time"
@@ -117,7 +117,7 @@ func (b *buffer) ReaderAt(ctx context.Context, desc ocispecs.Descriptor) (conten
 	if err != nil {
 		return nil, err
 	}
-	return &readerAt{Reader: r, Closer: ioutil.NopCloser(r), size: int64(r.Len())}, nil
+	return &readerAt{Reader: r, Closer: io.NopCloser(r), size: int64(r.Len())}, nil
 }
 
 func (b *buffer) getBytesReader(ctx context.Context, dgst digest.Digest) (*bytes.Reader, error) {
diff --git a/util/imageutil/schema1.go b/util/imageutil/schema1.go
index 10838bf50d9a..e2dc1440a71e 100644
--- a/util/imageutil/schema1.go
+++ b/util/imageutil/schema1.go
@@ -3,7 +3,7 @@ package imageutil
 import (
 	"context"
 	"encoding/json"
-	"io/ioutil"
+	"io"
 	"strings"
 	"time"
 
@@ -19,7 +19,7 @@ func readSchema1Config(ctx context.Context, ref string, desc ocispecs.Descriptor
 		return "", nil, err
 	}
 	defer rc.Close()
-	dt, err := ioutil.ReadAll(rc)
+	dt, err := io.ReadAll(rc)
 	if err != nil {
 		return "", nil, errors.Wrap(err, "failed to fetch schema1 manifest")
 	}
diff --git a/util/overlay/overlay_linux.go b/util/overlay/overlay_linux.go
index 12f153f0b641..1e68150a3040 100644
--- a/util/overlay/overlay_linux.go
+++ b/util/overlay/overlay_linux.go
@@ -8,7 +8,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -114,7 +113,7 @@ func GetOverlayLayers(m mount.Mount) ([]string, error) {
 // WriteUpperdir writes a layer tar archive into the specified writer, based on
 // the diff information stored in the upperdir.
 func WriteUpperdir(ctx context.Context, w io.Writer, upperdir string, lower []mount.Mount) error {
-	emptyLower, err := ioutil.TempDir("", "buildkit") // empty directory used for the lower of diff view
+	emptyLower, err := os.MkdirTemp("", "buildkit") // empty directory used for the lower of diff view
 	if err != nil {
 		return errors.Wrapf(err, "failed to create temp dir")
 	}
diff --git a/util/overlay/overlay_linux_test.go b/util/overlay/overlay_linux_test.go
index 013263bf4d26..fe91261159c5 100644
--- a/util/overlay/overlay_linux_test.go
+++ b/util/overlay/overlay_linux_test.go
@@ -6,7 +6,6 @@ package overlay
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -337,7 +336,7 @@ func TestLchtimes(t *testing.T) {
 }
 
 func testDiffWithBase(base, diff fstest.Applier, expected []TestChange, opts ...string) error {
-	t1, err := ioutil.TempDir("", "diff-with-base-lower-")
+	t1, err := os.MkdirTemp("", "diff-with-base-lower-")
 	if err != nil {
 		return errors.Wrap(err, "failed to create temp dir")
 	}
@@ -347,13 +346,13 @@ func testDiffWithBase(base, diff fstest.Applier, expected []TestChange, opts ...
 		return errors.Wrap(err, "failed to apply base filesystem")
 	}
 
-	tupper, err := ioutil.TempDir("", "diff-with-base-upperdir-")
+	tupper, err := os.MkdirTemp("", "diff-with-base-upperdir-")
 	if err != nil {
 		return errors.Wrap(err, "failed to create temp dir")
 	}
 	defer os.RemoveAll(tupper)
 
-	workdir, err := ioutil.TempDir("", "diff-with-base-workdir-")
+	workdir, err := os.MkdirTemp("", "diff-with-base-workdir-")
 	if err != nil {
 		return errors.Wrap(err, "failed to create temp dir")
 	}
@@ -420,7 +419,7 @@ func collectAndCheckChanges(base, upperdir string, expected []TestChange) error
 	ctx := context.Background()
 	changes := []TestChange{}
 
-	emptyLower, err := ioutil.TempDir("", "buildkit-test-emptylower") // empty directory used for the lower of diff view
+	emptyLower, err := os.MkdirTemp("", "buildkit-test-emptylower") // empty directory used for the lower of diff view
 	if err != nil {
 		return errors.Wrapf(err, "failed to create temp dir")
 	}
diff --git a/util/resolver/resolver.go b/util/resolver/resolver.go
index a23f4b15cfed..0639a1b623de 100644
--- a/util/resolver/resolver.go
+++ b/util/resolver/resolver.go
@@ -3,7 +3,6 @@ package resolver
 import (
 	"crypto/tls"
 	"crypto/x509"
-	"io/ioutil"
 	"net"
 	"net/http"
 	"os"
@@ -67,7 +66,7 @@ func fillInsecureOpts(host string, c config.RegistryConfig, h docker.RegistryHos
 
 func loadTLSConfig(c config.RegistryConfig) (*tls.Config, error) {
 	for _, d := range c.TLSConfigDir {
-		fs, err := ioutil.ReadDir(d)
+		fs, err := os.ReadDir(d)
 		if err != nil && !errors.Is(err, os.ErrNotExist) && !errors.Is(err, os.ErrPermission) {
 			return nil, errors.WithStack(err)
 		}
@@ -98,7 +97,7 @@ func loadTLSConfig(c config.RegistryConfig) (*tls.Config, error) {
 	}
 
 	for _, p := range c.RootCAs {
-		dt, err := ioutil.ReadFile(p)
+		dt, err := os.ReadFile(p)
 		if err != nil {
 			return nil, errors.Wrapf(err, "failed to read %s", p)
 		}
diff --git a/util/resolver/retryhandler/retry.go b/util/resolver/retryhandler/retry.go
index 554076b07b41..255485dffec0 100644
--- a/util/resolver/retryhandler/retry.go
+++ b/util/resolver/retryhandler/retry.go
@@ -60,7 +60,7 @@ func retryError(err error) bool {
 		return true
 	}
 	// catches TLS timeout or other network-related temporary errors
-	if ne, ok := errors.Cause(err).(net.Error); ok && ne.Temporary() {
+	if ne, ok := errors.Cause(err).(net.Error); ok && ne.Temporary() { //nolint:staticcheck // ignoring "SA1019: Temporary is deprecated", continue to propagate net.Error through the "temporary" status
 		return true
 	}
 	// https://github.com/containerd/containerd/pull/4724
diff --git a/util/testutil/integration/containerd.go b/util/testutil/integration/containerd.go
index 3fb3aa5e33cb..be1b7e9bd711 100644
--- a/util/testutil/integration/containerd.go
+++ b/util/testutil/integration/containerd.go
@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"context"
 	"fmt"
-	"io/ioutil"
 	"log"
 	"os"
 	"os/exec"
@@ -110,7 +109,7 @@ func (c *containerd) New(ctx context.Context, cfg *BackendConfig) (b Backend, cl
 		rootless = true
 	}
 
-	tmpdir, err := ioutil.TempDir("", "bktest_containerd")
+	tmpdir, err := os.MkdirTemp("", "bktest_containerd")
 	if err != nil {
 		return nil, nil, err
 	}
@@ -158,7 +157,7 @@ disabled_plugins = ["cri"]
 	}
 
 	configFile := filepath.Join(tmpdir, "config.toml")
-	if err := ioutil.WriteFile(configFile, []byte(config), 0644); err != nil {
+	if err := os.WriteFile(configFile, []byte(config), 0644); err != nil {
 		return nil, nil, err
 	}
 
diff --git a/util/testutil/integration/dockerd.go b/util/testutil/integration/dockerd.go
index 93b656615782..eeccbe44d132 100644
--- a/util/testutil/integration/dockerd.go
+++ b/util/testutil/integration/dockerd.go
@@ -3,7 +3,6 @@ package integration
 import (
 	"context"
 	"io"
-	"io/ioutil"
 	"net"
 	"os"
 	"os/exec"
@@ -54,7 +53,7 @@ func (c dockerd) New(ctx context.Context, cfg *BackendConfig) (b Backend, cl fun
 	var proxyGroup errgroup.Group
 	deferF.append(proxyGroup.Wait)
 
-	workDir, err := ioutil.TempDir("", "integration")
+	workDir, err := os.MkdirTemp("", "integration")
 	if err != nil {
 		return nil, nil, err
 	}
@@ -122,7 +121,7 @@ func (c dockerd) New(ctx context.Context, cfg *BackendConfig) (b Backend, cl fun
 	// Create a file descriptor to be used as a Unix domain socket.
 	// Remove it immediately (the name will still be valid for the socket) so that
 	// we don't leave files all over the users tmp tree.
-	f, err := ioutil.TempFile("", "buildkit-integration")
+	f, err := os.CreateTemp("", "buildkit-integration")
 	if err != nil {
 		return
 	}
diff --git a/util/testutil/integration/frombinary.go b/util/testutil/integration/frombinary.go
index 3f2139ec5d91..4bf68193c548 100644
--- a/util/testutil/integration/frombinary.go
+++ b/util/testutil/integration/frombinary.go
@@ -3,7 +3,6 @@ package integration
 import (
 	"context"
 	"encoding/json"
-	"io/ioutil"
 	"os"
 
 	"github.com/containerd/containerd/content"
@@ -15,7 +14,7 @@ import (
 func providerFromBinary(fn string) (_ ocispecs.Descriptor, _ content.Provider, _ func(), err error) {
 	ctx := context.TODO()
 
-	tmpDir, err := ioutil.TempDir("", "buildkit-state")
+	tmpDir, err := os.MkdirTemp("", "buildkit-state")
 	if err != nil {
 		return ocispecs.Descriptor{}, nil, nil, err
 	}
diff --git a/util/testutil/integration/registry.go b/util/testutil/integration/registry.go
index 06d1adf355ef..5e380621d9f7 100644
--- a/util/testutil/integration/registry.go
+++ b/util/testutil/integration/registry.go
@@ -5,7 +5,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -31,7 +30,7 @@ func NewRegistry(dir string) (url string, cl func() error, err error) {
 	}()
 
 	if dir == "" {
-		tmpdir, err := ioutil.TempDir("", "test-registry")
+		tmpdir, err := os.MkdirTemp("", "test-registry")
 		if err != nil {
 			return "", nil, err
 		}
@@ -52,7 +51,7 @@ http:
     addr: 127.0.0.1:0
 `, filepath.Join(dir, "data"))
 
-		if err := ioutil.WriteFile(filepath.Join(dir, "config.yaml"), []byte(template), 0600); err != nil {
+		if err := os.WriteFile(filepath.Join(dir, "config.yaml"), []byte(template), 0600); err != nil {
 			return "", nil, err
 		}
 	}
@@ -84,7 +83,7 @@ func detectPort(ctx context.Context, rc io.ReadCloser) (string, error) {
 	found := make(chan struct{})
 	defer func() {
 		close(found)
-		go io.Copy(ioutil.Discard, rc)
+		go io.Copy(io.Discard, rc)
 	}()
 
 	go func() {
diff --git a/util/testutil/integration/run.go b/util/testutil/integration/run.go
index 50d355e41104..23207ca5d054 100644
--- a/util/testutil/integration/run.go
+++ b/util/testutil/integration/run.go
@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"context"
 	"fmt"
-	"io/ioutil"
 	"math/rand"
 	"os"
 	"os/exec"
@@ -211,7 +210,7 @@ func Run(t *testing.T, testCases []Test, opt ...TestOpt) {
 func getFunctionName(i interface{}) string {
 	fullname := runtime.FuncForPC(reflect.ValueOf(i).Pointer()).Name()
 	dot := strings.LastIndex(fullname, ".") + 1
-	return strings.Title(fullname[dot:])
+	return strings.Title(fullname[dot:]) //nolint:staticcheck // ignoring "SA1019: strings.Title is deprecated", as for our use we don't need full unicode support
 }
 
 var localImageCache map[string]map[string]struct{}
@@ -295,7 +294,7 @@ mirrors=["%s"]
 }
 
 func writeConfig(updaters []ConfigUpdater) (string, error) {
-	tmpdir, err := ioutil.TempDir("", "bktest_config")
+	tmpdir, err := os.MkdirTemp("", "bktest_config")
 	if err != nil {
 		return "", err
 	}
@@ -308,7 +307,7 @@ func writeConfig(updaters []ConfigUpdater) (string, error) {
 		s = upt.UpdateConfigFile(s)
 	}
 
-	if err := ioutil.WriteFile(filepath.Join(tmpdir, buildkitdConfigFile), []byte(s), 0644); err != nil {
+	if err := os.WriteFile(filepath.Join(tmpdir, buildkitdConfigFile), []byte(s), 0644); err != nil {
 		return "", err
 	}
 	return tmpdir, nil
@@ -428,7 +427,7 @@ func runStargzSnapshotter(cfg *BackendConfig) (address string, cl func() error,
 		}
 	}()
 
-	tmpStargzDir, err := ioutil.TempDir("", "bktest_containerd_stargz_grpc")
+	tmpStargzDir, err := os.MkdirTemp("", "bktest_containerd_stargz_grpc")
 	if err != nil {
 		return "", nil, err
 	}
diff --git a/util/testutil/integration/sandbox.go b/util/testutil/integration/sandbox.go
index 51936c7d299a..a72efddb8137 100644
--- a/util/testutil/integration/sandbox.go
+++ b/util/testutil/integration/sandbox.go
@@ -5,7 +5,6 @@ import (
 	"bytes"
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -168,7 +167,7 @@ func runBuildkitd(ctx context.Context, conf *BackendConfig, args []string, logs
 		args = append(args, "--config="+conf.ConfigFile)
 	}
 
-	tmpdir, err := ioutil.TempDir("", "bktest_buildkitd")
+	tmpdir, err := os.MkdirTemp("", "bktest_buildkitd")
 	if err != nil {
 		return "", nil, err
 	}
diff --git a/util/testutil/tar.go b/util/testutil/tar.go
index e7a9b41fa3b8..a519026b6a45 100644
--- a/util/testutil/tar.go
+++ b/util/testutil/tar.go
@@ -5,7 +5,6 @@ import (
 	"bytes"
 	"compress/gzip"
 	"io"
-	"io/ioutil"
 
 	"github.com/pkg/errors"
 )
@@ -41,7 +40,7 @@ func ReadTarToMap(dt []byte, compressed bool) (map[string]*TarItem, error) {
 
 		var dt []byte
 		if h.Typeflag == tar.TypeReg {
-			dt, err = ioutil.ReadAll(tr)
+			dt, err = io.ReadAll(tr)
 			if err != nil {
 				return nil, errors.Wrapf(err, "error reading file")
 			}
diff --git a/util/winlayers/applier.go b/util/winlayers/applier.go
index c9c76b27dfb9..a5de66df224d 100644
--- a/util/winlayers/applier.go
+++ b/util/winlayers/applier.go
@@ -4,7 +4,6 @@ import (
 	"archive/tar"
 	"context"
 	"io"
-	"io/ioutil"
 	"runtime"
 	"strings"
 	"sync"
@@ -87,7 +86,7 @@ func (s *winApplier) Apply(ctx context.Context, desc ocispecs.Descriptor, mounts
 		}
 
 		// Read any trailing data
-		if _, err := io.Copy(ioutil.Discard, rc); err != nil {
+		if _, err := io.Copy(io.Discard, rc); err != nil {
 			discard(err)
 			return err
 		}
@@ -144,7 +143,7 @@ func filter(in io.Reader, f func(*tar.Header) bool) (io.Reader, func(error)) {
 					}
 				} else {
 					if h.Size > 0 {
-						if _, err := io.Copy(ioutil.Discard, tarReader); err != nil {
+						if _, err := io.Copy(io.Discard, tarReader); err != nil {
 							return err
 						}
 					}
diff --git a/worker/base/worker.go b/worker/base/worker.go
index fa8b7692d9fd..7db6dc29a622 100644
--- a/worker/base/worker.go
+++ b/worker/base/worker.go
@@ -3,7 +3,6 @@ package base
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"time"
@@ -468,11 +467,11 @@ func (w *Worker) FromRemote(ctx context.Context, remote *solver.Remote) (ref cac
 // If not exist, it creates a random one,
 func ID(root string) (string, error) {
 	f := filepath.Join(root, "workerid")
-	b, err := ioutil.ReadFile(f)
+	b, err := os.ReadFile(f)
 	if err != nil {
 		if errors.Is(err, os.ErrNotExist) {
 			id := identity.NewID()
-			err := ioutil.WriteFile(f, []byte(id), 0400)
+			err := os.WriteFile(f, []byte(id), 0400)
 			return id, err
 		}
 		return "", err
diff --git a/worker/base/worker_test.go b/worker/base/worker_test.go
index a80372baaaf0..a903c2b90314 100644
--- a/worker/base/worker_test.go
+++ b/worker/base/worker_test.go
@@ -1,7 +1,6 @@
 package base
 
 import (
-	"io/ioutil"
 	"os"
 	"testing"
 
@@ -10,7 +9,7 @@ import (
 
 func TestID(t *testing.T) {
 	t.Parallel()
-	tmpdir, err := ioutil.TempDir("", "worker-base-test-id")
+	tmpdir, err := os.MkdirTemp("", "worker-base-test-id")
 	require.NoError(t, err)
 
 	id0, err := ID(tmpdir)
diff --git a/worker/containerd/containerd_test.go b/worker/containerd/containerd_test.go
index c3c5286b027d..bf2fc2561e86 100644
--- a/worker/containerd/containerd_test.go
+++ b/worker/containerd/containerd_test.go
@@ -5,7 +5,6 @@ package containerd
 
 import (
 	"context"
-	"io/ioutil"
 	"os"
 	"testing"
 
@@ -29,7 +28,7 @@ func TestContainerdWorkerIntegration(t *testing.T) {
 }
 
 func newWorkerOpt(t *testing.T, addr string) (base.WorkerOpt, func()) {
-	tmpdir, err := ioutil.TempDir("", "workertest")
+	tmpdir, err := os.MkdirTemp("", "workertest")
 	require.NoError(t, err)
 	cleanup := func() { os.RemoveAll(tmpdir) }
 	rootless := false
diff --git a/worker/runc/runc_test.go b/worker/runc/runc_test.go
index bcaaf812df6d..0bb9c0334ac8 100644
--- a/worker/runc/runc_test.go
+++ b/worker/runc/runc_test.go
@@ -8,7 +8,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -30,7 +29,7 @@ import (
 )
 
 func newWorkerOpt(t *testing.T, processMode oci.ProcessMode) (base.WorkerOpt, func()) {
-	tmpdir, err := ioutil.TempDir("", "workertest")
+	tmpdir, err := os.MkdirTemp("", "workertest")
 	require.NoError(t, err)
 	cleanup := func() { os.RemoveAll(tmpdir) }
 
@@ -143,7 +142,7 @@ func TestRuncWorker(t *testing.T) {
 	require.NoError(t, err)
 
 	//Verifies fix for issue https://github.com/moby/buildkit/issues/429
-	dt, err := ioutil.ReadFile(filepath.Join(target, "run", "bar"))
+	dt, err := os.ReadFile(filepath.Join(target, "run", "bar"))
 
 	require.NoError(t, err)
 	require.Equal(t, string(dt), "foo\n")
@@ -199,7 +198,7 @@ func TestRuncWorkerNoProcessSandbox(t *testing.T) {
 
 	// ensure the procfs is shared
 	selfPID := os.Getpid()
-	selfCmdline, err := ioutil.ReadFile(fmt.Sprintf("/proc/%d/cmdline", selfPID))
+	selfCmdline, err := os.ReadFile(fmt.Sprintf("/proc/%d/cmdline", selfPID))
 	require.NoError(t, err)
 	meta := executor.Meta{
 		Args: []string{"/bin/cat", fmt.Sprintf("/proc/%d/cmdline", selfPID)},
diff --git a/worker/tests/common.go b/worker/tests/common.go
index 67e362283c61..46c99561d989 100644
--- a/worker/tests/common.go
+++ b/worker/tests/common.go
@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"context"
 	"io"
-	"io/ioutil"
 	"testing"
 	"time"
 
@@ -126,7 +125,7 @@ func TestWorkerExec(t *testing.T, w *base.Worker) {
 		Meta: executor.Meta{
 			Args: []string{"sh", "-c", "cat > /tmp/msg"},
 		},
-		Stdin:  ioutil.NopCloser(stdin),
+		Stdin:  io.NopCloser(stdin),
 		Stdout: &nopCloser{stdout},
 		Stderr: &nopCloser{stderr},
 	})