Nalin Dahyabhai

> > Labels are unordered in the image config, so I don't really have a problem with us running `sort.Strings()` on `options.Labels` before iterating through it to put them into...

Looks pretty reasonable. I don't understand why the new `cache` subpackage introduces an interface that we don't use anywhere, and which doesn't include the `PopulateLayer` method that the `StageExecutor` depends...

Layers don't get compressed on disk (their contents are stored in exploded form), and the manifest's description of the layer tends to reflect that. The problem appears to be that...

The reduction in the total number of allocations I see with this change, when it's used, is more or less equivalent to the number of entries in the archive we...

> Will this be necessary/useful in the future? [golang/go#46446](https://github.com/golang/go/issues/46446) should make at least the single-character case more efficient using the simple code. I would like for it to not be...

The `dockerclient` implementation needs to complain about features it doesn't support.

`dockerclient.ClientExecutor.Run()`. Places where we've neglected this before produced #187, which was a bad experience for users who run the `imagebuilder` binary.

I would also suggest dropping `--security`. It's a "labs" feature in BuildKit, and not enabled there by default (compared to the current version of this PR, which makes it available...

I would again suggest dropping `--security`.

What are the use case and argument for overriding the specified or default value of the `--network` CLI setting from inside of a Dockerfile? BuildKit at least requires that the...