diff --git a/builder/builder-next/builder.go b/builder/builder-next/builder.go
index aa7ac50f6c..e4b1116415 100644
--- a/builder/builder-next/builder.go
+++ b/builder/builder-next/builder.go
@@ -124,6 +124,10 @@ func New(ctx context.Context, opt Opt) (*Builder, error) {
 	return b, nil
 }
 
+func (b *Builder) Close() error {
+	return b.controller.Close()
+}
+
 // RegisterGRPC registers controller to the grpc server.
 func (b *Builder) RegisterGRPC(s *grpc.Server) {
 	b.controller.Register(s)
diff --git a/builder/builder-next/controller.go b/builder/builder-next/controller.go
index 9f977e127f..cb7ed98875 100644
--- a/builder/builder-next/controller.go
+++ b/builder/builder-next/controller.go
@@ -136,6 +136,7 @@ func newSnapshotterController(ctx context.Context, rt http.RoundTripper, opt Opt
 		WorkerController: wc,
 		Frontends:        frontends,
 		CacheManager:     solver.NewCacheManager(ctx, "local", cacheStorage, worker.NewCacheResultStorage(wc)),
+		CacheStore:       cacheStorage,
 		ResolveCacheImporterFuncs: map[string]remotecache.ResolveCacheImporterFunc{
 			"gha":      gha.ResolveCacheImporterFunc(),
 			"local":    localremotecache.ResolveCacheImporterFunc(opt.SessionManager),
@@ -357,6 +358,7 @@ func newGraphDriverController(ctx context.Context, rt http.RoundTripper, opt Opt
 		WorkerController: wc,
 		Frontends:        frontends,
 		CacheManager:     solver.NewCacheManager(ctx, "local", cacheStorage, worker.NewCacheResultStorage(wc)),
+		CacheStore:       cacheStorage,
 		ResolveCacheImporterFuncs: map[string]remotecache.ResolveCacheImporterFunc{
 			"registry": localinlinecache.ResolveCacheImporterFunc(opt.SessionManager, opt.RegistryHosts, store, dist.ReferenceStore, dist.ImageStore),
 			"local":    localremotecache.ResolveCacheImporterFunc(opt.SessionManager),
diff --git a/cmd/dockerd/daemon.go b/cmd/dockerd/daemon.go
index 837ee7bba1..9c697ea821 100644
--- a/cmd/dockerd/daemon.go
+++ b/cmd/dockerd/daemon.go
@@ -345,6 +345,10 @@ func (cli *DaemonCli) start(opts *daemonOptions) (err error) {
 	notifyStopping()
 	shutdownDaemon(ctx, d)
 
+	if err := routerOptions.buildkit.Close(); err != nil {
+		log.G(ctx).WithError(err).Error("Failed to close buildkit")
+	}
+
 	// Stop notification processing and any background processes
 	cancel()
 
diff --git a/vendor.mod b/vendor.mod
index 69850c6e71..e391d0c6c2 100644
--- a/vendor.mod
+++ b/vendor.mod
@@ -62,7 +62,7 @@ require (
 	github.com/miekg/dns v1.1.43
 	github.com/mistifyio/go-zfs/v3 v3.0.1
 	github.com/mitchellh/copystructure v1.2.0
-	github.com/moby/buildkit v0.12.3-0.20231002214633-f94ed7cec313 // v0.12 branch
+	github.com/moby/buildkit v0.12.3-0.20231013201444-6560bb937e8c // v0.12 branch
 	github.com/moby/ipvs v1.1.0
 	github.com/moby/locker v1.0.1
 	github.com/moby/patternmatcher v0.6.0
diff --git a/vendor.sum b/vendor.sum
index ff599fb7a4..b00b02497c 100644
--- a/vendor.sum
+++ b/vendor.sum
@@ -909,8 +909,8 @@ github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zx
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/mndrix/tap-go v0.0.0-20171203230836-629fa407e90b/go.mod h1:pzzDgJWZ34fGzaAZGFW22KVZDfyrYW+QABMrWnJBnSs=
 github.com/moby/buildkit v0.8.1/go.mod h1:/kyU1hKy/aYCuP39GZA9MaKioovHku57N6cqlKZIaiQ=
-github.com/moby/buildkit v0.12.3-0.20231002214633-f94ed7cec313 h1:6obdxayNqgEFbed+9RL6NzejXtP9wuMa7ouqxYsEGXA=
-github.com/moby/buildkit v0.12.3-0.20231002214633-f94ed7cec313/go.mod h1:adB4y0SxxX8trnrY+oEulb48ODLqPO6pKMF0ppGcCoI=
+github.com/moby/buildkit v0.12.3-0.20231013201444-6560bb937e8c h1:aKDG7r9VXH2jCwvywUpLPurST4ZhjFVfJ3l8HNhCyrw=
+github.com/moby/buildkit v0.12.3-0.20231013201444-6560bb937e8c/go.mod h1:adB4y0SxxX8trnrY+oEulb48ODLqPO6pKMF0ppGcCoI=
 github.com/moby/ipvs v1.1.0 h1:ONN4pGaZQgAx+1Scz5RvWV4Q7Gb+mvfRh3NsPS+1XQQ=
 github.com/moby/ipvs v1.1.0/go.mod h1:4VJMWuf098bsUMmZEiD4Tjk/O7mOn3l1PTD3s4OoYAs=
 github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
diff --git a/vendor/github.com/moby/buildkit/client/client.go b/vendor/github.com/moby/buildkit/client/client.go
index 1d60a70683..71a72bf9f6 100644
--- a/vendor/github.com/moby/buildkit/client/client.go
+++ b/vendor/github.com/moby/buildkit/client/client.go
@@ -8,6 +8,7 @@ import (
 	"net/url"
 	"os"
 	"strings"
+	"time"
 
 	contentapi "github.com/containerd/containerd/api/services/content/v1"
 	"github.com/containerd/containerd/defaults"
@@ -186,16 +187,29 @@ func (c *Client) Dialer() session.Dialer {
 }
 
 func (c *Client) Wait(ctx context.Context) error {
-	opts := []grpc.CallOption{grpc.WaitForReady(true)}
-	_, err := c.ControlClient().Info(ctx, &controlapi.InfoRequest{}, opts...)
-	if err != nil {
-		if code := grpcerrors.Code(err); code == codes.Unimplemented {
+	for {
+		_, err := c.ControlClient().Info(ctx, &controlapi.InfoRequest{})
+		if err == nil {
+			return nil
+		}
+
+		switch code := grpcerrors.Code(err); code {
+		case codes.Unavailable:
+		case codes.Unimplemented:
 			// only buildkit v0.11+ supports the info api, but an unimplemented
 			// response error is still a response so we can ignore it
 			return nil
+		default:
+			return err
 		}
+
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case <-time.After(time.Second):
+		}
+		c.conn.ResetConnectBackoff()
 	}
-	return err
 }
 
 func (c *Client) Close() error {
diff --git a/vendor/github.com/moby/buildkit/client/llb/sourcemap.go b/vendor/github.com/moby/buildkit/client/llb/sourcemap.go
index 721db3cebe..4e3be2b499 100644
--- a/vendor/github.com/moby/buildkit/client/llb/sourcemap.go
+++ b/vendor/github.com/moby/buildkit/client/llb/sourcemap.go
@@ -1,6 +1,7 @@
 package llb
 
 import (
+	"bytes"
 	"context"
 
 	"github.com/moby/buildkit/solver/pb"
@@ -47,6 +48,33 @@ func (s *SourceMap) Location(r []*pb.Range) ConstraintsOpt {
 	})
 }
 
+func equalSourceMap(sm1, sm2 *SourceMap) (out bool) {
+	if sm1 == nil || sm2 == nil {
+		return false
+	}
+	if sm1.Filename != sm2.Filename {
+		return false
+	}
+	if sm1.Language != sm2.Language {
+		return false
+	}
+	if len(sm1.Data) != len(sm2.Data) {
+		return false
+	}
+	if !bytes.Equal(sm1.Data, sm2.Data) {
+		return false
+	}
+	if sm1.Definition != nil && sm2.Definition != nil {
+		if len(sm1.Definition.Def) != len(sm2.Definition.Def) && len(sm1.Definition.Def) != 0 {
+			return false
+		}
+		if !bytes.Equal(sm1.Definition.Def[len(sm1.Definition.Def)-1], sm2.Definition.Def[len(sm2.Definition.Def)-1]) {
+			return false
+		}
+	}
+	return true
+}
+
 type SourceLocation struct {
 	SourceMap *SourceMap
 	Ranges    []*pb.Range
@@ -69,8 +97,18 @@ func (smc *sourceMapCollector) Add(dgst digest.Digest, ls []*SourceLocation) {
 	for _, l := range ls {
 		idx, ok := smc.index[l.SourceMap]
 		if !ok {
-			idx = len(smc.maps)
-			smc.maps = append(smc.maps, l.SourceMap)
+			idx = -1
+			// slow equality check
+			for i, m := range smc.maps {
+				if equalSourceMap(m, l.SourceMap) {
+					idx = i
+					break
+				}
+			}
+			if idx == -1 {
+				idx = len(smc.maps)
+				smc.maps = append(smc.maps, l.SourceMap)
+			}
 		}
 		smc.index[l.SourceMap] = idx
 	}
diff --git a/vendor/github.com/moby/buildkit/control/control.go b/vendor/github.com/moby/buildkit/control/control.go
index 8a09b8ace3..1afd518a66 100644
--- a/vendor/github.com/moby/buildkit/control/control.go
+++ b/vendor/github.com/moby/buildkit/control/control.go
@@ -12,6 +12,7 @@ import (
 	"github.com/containerd/containerd/content"
 	"github.com/containerd/containerd/services/content/contentserver"
 	"github.com/docker/distribution/reference"
+	"github.com/hashicorp/go-multierror"
 	"github.com/mitchellh/hashstructure/v2"
 	controlapi "github.com/moby/buildkit/api/services/control"
 	apitypes "github.com/moby/buildkit/api/types"
@@ -29,6 +30,7 @@ import (
 	"github.com/moby/buildkit/session/grpchijack"
 	containerdsnapshot "github.com/moby/buildkit/snapshot/containerd"
 	"github.com/moby/buildkit/solver"
+	"github.com/moby/buildkit/solver/bboltcachestorage"
 	"github.com/moby/buildkit/solver/llbsolver"
 	"github.com/moby/buildkit/solver/llbsolver/proc"
 	"github.com/moby/buildkit/solver/pb"
@@ -61,6 +63,7 @@ type Opt struct {
 	Entitlements              []string
 	TraceCollector            sdktrace.SpanExporter
 	HistoryDB                 *bbolt.DB
+	CacheStore                *bboltcachestorage.Store
 	LeaseManager              *leaseutil.Manager
 	ContentStore              *containerdsnapshot.Store
 	HistoryConfig             *config.HistoryConfig
@@ -123,7 +126,16 @@ func NewController(opt Opt) (*Controller, error) {
 }
 
 func (c *Controller) Close() error {
-	return c.opt.WorkerController.Close()
+	rerr := c.opt.HistoryDB.Close()
+	if err := c.opt.WorkerController.Close(); err != nil {
+		rerr = multierror.Append(rerr, err)
+	}
+
+	if err := c.opt.CacheStore.Close(); err != nil {
+		rerr = multierror.Append(rerr, err)
+	}
+
+	return rerr
 }
 
 func (c *Controller) Register(server *grpc.Server) {
diff --git a/vendor/github.com/moby/buildkit/executor/oci/spec.go b/vendor/github.com/moby/buildkit/executor/oci/spec.go
index c6d665b081..5efb3ee955 100644
--- a/vendor/github.com/moby/buildkit/executor/oci/spec.go
+++ b/vendor/github.com/moby/buildkit/executor/oci/spec.go
@@ -137,7 +137,7 @@ func GenerateSpec(ctx context.Context, meta executor.Meta, mounts []executor.Mou
 		return nil, nil, err
 	}
 
-	if cgroupNamespaceSupported() {
+	if cgroupV2NamespaceSupported() {
 		s.Linux.Namespaces = append(s.Linux.Namespaces, specs.LinuxNamespace{
 			Type: specs.CgroupNamespace,
 		})
diff --git a/vendor/github.com/moby/buildkit/executor/oci/spec_unix.go b/vendor/github.com/moby/buildkit/executor/oci/spec_unix.go
index 97e95e9834..e38ef12caa 100644
--- a/vendor/github.com/moby/buildkit/executor/oci/spec_unix.go
+++ b/vendor/github.com/moby/buildkit/executor/oci/spec_unix.go
@@ -147,11 +147,19 @@ func getTracingSocket() string {
 	return fmt.Sprintf("unix://%s", tracingSocketPath)
 }
 
-func cgroupNamespaceSupported() bool {
+func cgroupV2NamespaceSupported() bool {
+	// Check if cgroups v2 namespaces are supported.  Trying to do cgroup
+	// namespaces with cgroups v1 results in EINVAL when we encounter a
+	// non-standard hierarchy.
+	// See https://github.com/moby/buildkit/issues/4108
 	cgroupNSOnce.Do(func() {
-		if _, err := os.Stat("/proc/self/ns/cgroup"); !os.IsNotExist(err) {
-			supportsCgroupNS = true
+		if _, err := os.Stat("/proc/self/ns/cgroup"); os.IsNotExist(err) {
+			return
 		}
+		if _, err := os.Stat("/sys/fs/cgroup/cgroup.subtree_control"); os.IsNotExist(err) {
+			return
+		}
+		supportsCgroupNS = true
 	})
 	return supportsCgroupNS
 }
diff --git a/vendor/github.com/moby/buildkit/executor/oci/spec_windows.go b/vendor/github.com/moby/buildkit/executor/oci/spec_windows.go
index 83ee278187..ef7c67363e 100644
--- a/vendor/github.com/moby/buildkit/executor/oci/spec_windows.go
+++ b/vendor/github.com/moby/buildkit/executor/oci/spec_windows.go
@@ -64,6 +64,6 @@ func getTracingSocket() string {
 	return fmt.Sprintf("npipe://%s", filepath.ToSlash(tracingSocketPath))
 }
 
-func cgroupNamespaceSupported() bool {
+func cgroupV2NamespaceSupported() bool {
 	return false
 }
diff --git a/vendor/github.com/moby/buildkit/solver/bboltcachestorage/storage.go b/vendor/github.com/moby/buildkit/solver/bboltcachestorage/storage.go
index 515feffbf0..37feb03a80 100644
--- a/vendor/github.com/moby/buildkit/solver/bboltcachestorage/storage.go
+++ b/vendor/github.com/moby/buildkit/solver/bboltcachestorage/storage.go
@@ -54,6 +54,10 @@ func (s *Store) Exists(id string) bool {
 	return exists
 }
 
+func (s *Store) Close() error {
+	return s.db.Close()
+}
+
 func (s *Store) Walk(fn func(id string) error) error {
 	ids := make([]string, 0)
 	if err := s.db.View(func(tx *bolt.Tx) error {
diff --git a/vendor/github.com/moby/buildkit/solver/llbsolver/provenance.go b/vendor/github.com/moby/buildkit/solver/llbsolver/provenance.go
index 9138d6d9f8..26abf78d1c 100644
--- a/vendor/github.com/moby/buildkit/solver/llbsolver/provenance.go
+++ b/vendor/github.com/moby/buildkit/solver/llbsolver/provenance.go
@@ -137,12 +137,14 @@ func (b *provenanceBridge) ResolveImageConfig(ctx context.Context, ref string, o
 		return "", "", nil, err
 	}
 
+	b.mu.Lock()
 	b.images = append(b.images, provenance.ImageSource{
 		Ref:      ref,
 		Platform: opt.Platform,
 		Digest:   dgst,
 		Local:    opt.ResolverType == llb.ResolverTypeOCILayout,
 	})
+	b.mu.Unlock()
 	return ref, dgst, config, nil
 }
 
diff --git a/vendor/github.com/moby/buildkit/source/http/httpsource.go b/vendor/github.com/moby/buildkit/source/http/httpsource.go
index 9fde3cdee7..8e233228f8 100644
--- a/vendor/github.com/moby/buildkit/source/http/httpsource.go
+++ b/vendor/github.com/moby/buildkit/source/http/httpsource.go
@@ -127,7 +127,7 @@ func (hs *httpSourceHandler) CacheKey(ctx context.Context, g session.Group, inde
 
 	uh, err := hs.urlHash()
 	if err != nil {
-		return "", "", nil, false, nil
+		return "", "", nil, false, err
 	}
 
 	// look up metadata(previously stored headers) for that URL
diff --git a/vendor/github.com/moby/buildkit/util/imageutil/config.go b/vendor/github.com/moby/buildkit/util/imageutil/config.go
index f183db5872..f7c4182efd 100644
--- a/vendor/github.com/moby/buildkit/util/imageutil/config.go
+++ b/vendor/github.com/moby/buildkit/util/imageutil/config.go
@@ -156,6 +156,7 @@ func Config(ctx context.Context, str string, resolver remotes.Resolver, cache Co
 	}
 
 	children := childrenConfigHandler(cache, platform)
+	children = images.LimitManifests(children, platform, 1)
 
 	dslHandler, err := docker.AppendDistributionSourceLabel(cache, ref.String())
 	if err != nil {
diff --git a/vendor/github.com/moby/buildkit/util/pull/pullprogress/progress.go b/vendor/github.com/moby/buildkit/util/pull/pullprogress/progress.go
index ee8fcadb20..5ae047dbf5 100644
--- a/vendor/github.com/moby/buildkit/util/pull/pullprogress/progress.go
+++ b/vendor/github.com/moby/buildkit/util/pull/pullprogress/progress.go
@@ -129,6 +129,10 @@ func trackProgress(ctx context.Context, desc ocispecs.Descriptor, manager PullMa
 
 		info, err := manager.Info(ctx, desc.Digest)
 		if err == nil {
+			// info.CreatedAt could be before started if parallel pull just completed
+			if info.CreatedAt.Before(started) {
+				started = info.CreatedAt
+			}
 			pw.Write(desc.Digest.String(), progress.Status{
 				Current:   int(info.Size),
 				Total:     int(info.Size),
diff --git a/vendor/github.com/moby/buildkit/worker/base/worker.go b/vendor/github.com/moby/buildkit/worker/base/worker.go
index 8d402ff2fb..dcea020cb1 100644
--- a/vendor/github.com/moby/buildkit/worker/base/worker.go
+++ b/vendor/github.com/moby/buildkit/worker/base/worker.go
@@ -211,6 +211,9 @@ func NewWorker(ctx context.Context, opt WorkerOpt) (*Worker, error) {
 
 func (w *Worker) Close() error {
 	var rerr error
+	if err := w.MetadataStore.Close(); err != nil {
+		rerr = multierror.Append(rerr, err)
+	}
 	for _, provider := range w.NetworkProviders {
 		if err := provider.Close(); err != nil {
 			rerr = multierror.Append(rerr, err)
diff --git a/vendor/modules.txt b/vendor/modules.txt
index d674a72eb5..7640e7ba6e 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -667,7 +667,7 @@ github.com/mitchellh/hashstructure/v2
 # github.com/mitchellh/reflectwalk v1.0.2
 ## explicit
 github.com/mitchellh/reflectwalk
-# github.com/moby/buildkit v0.12.3-0.20231002214633-f94ed7cec313
+# github.com/moby/buildkit v0.12.3-0.20231013201444-6560bb937e8c
 ## explicit; go 1.20
 github.com/moby/buildkit/api/services/control
 github.com/moby/buildkit/api/types