diff --git a/go.mod b/go.mod
index e31bc90e6..4420a82a0 100644
--- a/go.mod
+++ b/go.mod
@@ -8,7 +8,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/config v1.27.27
 	github.com/compose-spec/compose-go/v2 v2.8.1
 	github.com/containerd/console v1.0.5
-	github.com/containerd/containerd/v2 v2.1.3
+	github.com/containerd/containerd/v2 v2.1.4
 	github.com/containerd/continuity v0.4.5
 	github.com/containerd/errdefs v1.0.0
 	github.com/containerd/log v0.1.0
@@ -29,7 +29,7 @@ require (
 	github.com/hashicorp/hcl/v2 v2.23.0
 	github.com/in-toto/in-toto-golang v0.9.0
 	github.com/mitchellh/hashstructure/v2 v2.0.2
-	github.com/moby/buildkit v0.23.0-rc1.0.20250618182037-9b91d20367db // master
+	github.com/moby/buildkit v0.23.0-rc1.0.20250806140246-955c2b2f7d01 // master
 	github.com/moby/go-archive v0.1.0
 	github.com/moby/sys/atomicwriter v0.1.0
 	github.com/moby/sys/mountinfo v0.7.2
diff --git a/go.sum b/go.sum
index 69d1d2a4a..b6ab7e69b 100644
--- a/go.sum
+++ b/go.sum
@@ -70,8 +70,8 @@ github.com/containerd/console v1.0.5 h1:R0ymNeydRqH2DmakFNdmjR2k0t7UPuiOV/N/27/q
 github.com/containerd/console v1.0.5/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
 github.com/containerd/containerd/api v1.9.0 h1:HZ/licowTRazus+wt9fM6r/9BQO7S0vD5lMcWspGIg0=
 github.com/containerd/containerd/api v1.9.0/go.mod h1:GhghKFmTR3hNtyznBoQ0EMWr9ju5AqHjcZPsSpTKutI=
-github.com/containerd/containerd/v2 v2.1.3 h1:eMD2SLcIQPdMlnlNF6fatlrlRLAeDaiGPGwmRKLZKNs=
-github.com/containerd/containerd/v2 v2.1.3/go.mod h1:8C5QV9djwsYDNhxfTCFjWtTBZrqjditQ4/ghHSYjnHM=
+github.com/containerd/containerd/v2 v2.1.4 h1:/hXWjiSFd6ftrBOBGfAZ6T30LJcx1dBjdKEeI8xucKQ=
+github.com/containerd/containerd/v2 v2.1.4/go.mod h1:8C5QV9djwsYDNhxfTCFjWtTBZrqjditQ4/ghHSYjnHM=
 github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4=
 github.com/containerd/continuity v0.4.5/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
@@ -254,8 +254,8 @@ github.com/mitchellh/go-wordwrap v0.0.0-20150314170334-ad45545899c7/go.mod h1:ZX
 github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4NcD46KavDd4=
 github.com/mitchellh/hashstructure/v2 v2.0.2/go.mod h1:MG3aRVU/N29oo/V/IhBX8GR/zz4kQkprJgF2EVszyDE=
 github.com/mitchellh/mapstructure v0.0.0-20150613213606-2caf8efc9366/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/moby/buildkit v0.23.0-rc1.0.20250618182037-9b91d20367db h1:ZzrDuG9G1A/RwJvuogNplxCEKsIUQh1CqEnqbOGFgKE=
-github.com/moby/buildkit v0.23.0-rc1.0.20250618182037-9b91d20367db/go.mod h1:v5jMDvQgUyidk3wu3NvVAAd5JJo83nfet9Gf/o0+EAQ=
+github.com/moby/buildkit v0.23.0-rc1.0.20250806140246-955c2b2f7d01 h1:ua0f++eVvjBLs77tBmg5Ko2x6BTgjULihEu03ogLBC8=
+github.com/moby/buildkit v0.23.0-rc1.0.20250806140246-955c2b2f7d01/go.mod h1:8qy9VSHDZuin0BnQzxbRGSXFKQiT0cgeKLWiNRw4/5Q=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/go-archive v0.1.0 h1:Kk/5rdW/g+H8NHdJW2gsXyZ7UnzvJNOy6VKJqueWdcQ=
diff --git a/vendor/github.com/containerd/containerd/v2/core/remotes/docker/fetcher.go b/vendor/github.com/containerd/containerd/v2/core/remotes/docker/fetcher.go
index 3e74df8cc..90542e2e7 100644
--- a/vendor/github.com/containerd/containerd/v2/core/remotes/docker/fetcher.go
+++ b/vendor/github.com/containerd/containerd/v2/core/remotes/docker/fetcher.go
@@ -474,7 +474,18 @@ func (r dockerFetcher) open(ctx context.Context, req *request, mediatype string,
 		return nil, err
 	}
 
-	body := resp.Body
+	body := &fnOnClose{
+		BeforeClose: func() {
+			r.Release(1)
+		},
+		ReadCloser: resp.Body,
+	}
+	defer func() {
+		if retErr != nil {
+			body.Close()
+		}
+	}()
+
 	encoding := strings.FieldsFunc(resp.Header.Get("Content-Encoding"), func(r rune) bool {
 		return r == ' ' || r == '\t' || r == ','
 	})
@@ -505,29 +516,33 @@ func (r dockerFetcher) open(ctx context.Context, req *request, mediatype string,
 		for i := range numChunks {
 			readers[i], writers[i] = newPipeWriter(bufPool)
 		}
+		// keep reference of the initial body value to ensure it is closed
+		ibody := body
 		go func() {
 			for i := range numChunks {
 				select {
 				case queue <- i:
 				case <-done:
+					if i == 0 {
+						ibody.Close()
+					}
 					return // avoid leaking a goroutine if we exit early.
 				}
 			}
 			close(queue)
 		}()
-		r.Release(1)
 		for range parallelism {
 			go func() {
 				for i := range queue { // first in first out
 					copy := func() error {
-						if err := r.Acquire(ctx, 1); err != nil {
-							return err
-						}
-						defer r.Release(1)
 						var body io.ReadCloser
 						if i == 0 {
-							body = resp.Body
+							body = ibody
 						} else {
+							if err := r.Acquire(ctx, 1); err != nil {
+								return err
+							}
+							defer r.Release(1)
 							reqClone := req.clone()
 							reqClone.setOffset(offset + i*chunkSize)
 							nresp, err := reqClone.doWithRetries(ctx, lastHost, withErrorCheck)
@@ -564,32 +579,27 @@ func (r dockerFetcher) open(ctx context.Context, req *request, mediatype string,
 			},
 			ReadCloser: io.NopCloser(io.MultiReader(readers...)),
 		}
-	} else {
-		body = &fnOnClose{
-			BeforeClose: func() {
-				r.Release(1)
-			},
-			ReadCloser: body,
-		}
 	}
+
 	for i := len(encoding) - 1; i >= 0; i-- {
 		algorithm := strings.ToLower(encoding[i])
 		switch algorithm {
 		case "zstd":
-			r, err := zstd.NewReader(body,
+			r, err := zstd.NewReader(body.ReadCloser,
 				zstd.WithDecoderLowmem(false),
 			)
 			if err != nil {
 				return nil, err
 			}
-			body = r.IOReadCloser()
+			body.ReadCloser = r.IOReadCloser()
 		case "gzip":
-			body, err = gzip.NewReader(body)
+			r, err := gzip.NewReader(body.ReadCloser)
 			if err != nil {
 				return nil, err
 			}
+			body.ReadCloser = r
 		case "deflate":
-			body = flate.NewReader(body)
+			body.ReadCloser = flate.NewReader(body.ReadCloser)
 		case "identity", "":
 			// no content-encoding applied, use raw body
 		default:
diff --git a/vendor/github.com/containerd/containerd/v2/version/version.go b/vendor/github.com/containerd/containerd/v2/version/version.go
index 709cbe947..d6d0eb04e 100644
--- a/vendor/github.com/containerd/containerd/v2/version/version.go
+++ b/vendor/github.com/containerd/containerd/v2/version/version.go
@@ -24,7 +24,7 @@ var (
 	Package = "github.com/containerd/containerd/v2"
 
 	// Version holds the complete version number. Filled in at linking time.
-	Version = "2.1.3+unknown"
+	Version = "2.1.4+unknown"
 
 	// Revision is filled with the VCS (e.g. git) revision being used to build
 	// the program at linking time.
diff --git a/vendor/github.com/moby/buildkit/client/llb/state.go b/vendor/github.com/moby/buildkit/client/llb/state.go
index e63fb8667..7e5022c00 100644
--- a/vendor/github.com/moby/buildkit/client/llb/state.go
+++ b/vendor/github.com/moby/buildkit/client/llb/state.go
@@ -351,8 +351,7 @@ func (s State) GetEnv(ctx context.Context, key string, co ...ConstraintsOpt) (st
 	return v, ok, nil
 }
 
-// Env returns a new [State] with the provided environment variable set.
-// See [Env]
+// Env returns the current environment variables for the state.
 func (s State) Env(ctx context.Context, co ...ConstraintsOpt) (*EnvList, error) {
 	c := &Constraints{}
 	for _, f := range co {
diff --git a/vendor/github.com/moby/buildkit/client/solve.go b/vendor/github.com/moby/buildkit/client/solve.go
index 603211261..991a37418 100644
--- a/vendor/github.com/moby/buildkit/client/solve.go
+++ b/vendor/github.com/moby/buildkit/client/solve.go
@@ -55,10 +55,11 @@ type SolveOpt struct {
 }
 
 type ExportEntry struct {
-	Type      string
-	Attrs     map[string]string
-	Output    filesync.FileOutputFunc // for ExporterOCI and ExporterDocker
-	OutputDir string                  // for ExporterLocal
+	Type        string
+	Attrs       map[string]string
+	Output      filesync.FileOutputFunc // for ExporterOCI and ExporterDocker
+	OutputDir   string                  // for ExporterLocal
+	OutputStore content.Store
 }
 
 type CacheOptionsEntry struct {
@@ -154,26 +155,28 @@ func (c *Client) solve(ctx context.Context, def *llb.Definition, runGateway runG
 
 		var syncTargets []filesync.FSSyncTarget
 		for exID, ex := range opt.Exports {
-			var supportFile bool
-			var supportDir bool
+			var supportFile, supportDir, supportStore bool
 			switch ex.Type {
 			case ExporterLocal:
 				supportDir = true
 			case ExporterTar:
 				supportFile = true
 			case ExporterOCI, ExporterDocker:
-				supportDir = ex.OutputDir != ""
 				supportFile = ex.Output != nil
-			}
-			if supportFile && supportDir {
-				return nil, errors.Errorf("both file and directory output is not supported by %s exporter", ex.Type)
+				supportStore = ex.OutputStore != nil || ex.OutputDir != ""
+				if supportFile && supportStore {
+					return nil, errors.Errorf("both file and store output is not supported by %s exporter", ex.Type)
+				}
 			}
 			if !supportFile && ex.Output != nil {
 				return nil, errors.Errorf("output file writer is not supported by %s exporter", ex.Type)
 			}
-			if !supportDir && ex.OutputDir != "" {
+			if !supportDir && !supportStore && ex.OutputDir != "" {
 				return nil, errors.Errorf("output directory is not supported by %s exporter", ex.Type)
 			}
+			if !supportStore && ex.OutputStore != nil {
+				return nil, errors.Errorf("output store is not supported by %s exporter", ex.Type)
+			}
 			if supportFile {
 				if ex.Output == nil {
 					return nil, errors.Errorf("output file writer is required for %s exporter", ex.Type)
@@ -184,20 +187,27 @@ func (c *Client) solve(ctx context.Context, def *llb.Definition, runGateway runG
 				if ex.OutputDir == "" {
 					return nil, errors.Errorf("output directory is required for %s exporter", ex.Type)
 				}
-				switch ex.Type {
-				case ExporterOCI, ExporterDocker:
+				syncTargets = append(syncTargets, filesync.WithFSSyncDir(exID, ex.OutputDir))
+			}
+			if supportStore {
+				store := ex.OutputStore
+				if store == nil {
 					if err := os.MkdirAll(ex.OutputDir, 0755); err != nil {
 						return nil, err
 					}
-					cs, err := contentlocal.NewStore(ex.OutputDir)
+					store, err = contentlocal.NewStore(ex.OutputDir)
 					if err != nil {
 						return nil, err
 					}
-					contentStores["export"] = cs
 					storesToUpdate = append(storesToUpdate, ex.OutputDir)
-				default:
-					syncTargets = append(syncTargets, filesync.WithFSSyncDir(exID, ex.OutputDir))
 				}
+
+				// TODO: this should be dependent on the exporter id (to allow multiple oci exporters)
+				storeName := "export"
+				if _, ok := contentStores[storeName]; ok {
+					return nil, errors.Errorf("oci store key %q already exists", storeName)
+				}
+				contentStores[storeName] = store
 			}
 		}
 
diff --git a/vendor/github.com/moby/buildkit/cmd/buildkitd/config/config.go b/vendor/github.com/moby/buildkit/cmd/buildkitd/config/config.go
index 156f3f3b5..0c8557cfe 100644
--- a/vendor/github.com/moby/buildkit/cmd/buildkitd/config/config.go
+++ b/vendor/github.com/moby/buildkit/cmd/buildkitd/config/config.go
@@ -12,7 +12,7 @@ type Config struct {
 	// Root is the path to a directory where buildkit will store persistent data
 	Root string `toml:"root"`
 
-	// Entitlements e.g. security.insecure, network.host
+	// Entitlements e.g. security.insecure, network.host, device
 	Entitlements []string `toml:"insecure-entitlements"`
 
 	// LogFormat is the format of the logs. It can be "json" or "text".
diff --git a/vendor/github.com/moby/buildkit/session/auth/authprovider/authprovider.go b/vendor/github.com/moby/buildkit/session/auth/authprovider/authprovider.go
index 88fe7d02b..724f172e6 100644
--- a/vendor/github.com/moby/buildkit/session/auth/authprovider/authprovider.go
+++ b/vendor/github.com/moby/buildkit/session/auth/authprovider/authprovider.go
@@ -24,6 +24,7 @@ import (
 	cleanhttp "github.com/hashicorp/go-cleanhttp"
 	"github.com/moby/buildkit/session"
 	"github.com/moby/buildkit/session/auth"
+	"github.com/moby/buildkit/util/errutil"
 	"github.com/moby/buildkit/util/progress/progresswriter"
 	"github.com/moby/buildkit/util/tracing"
 	"github.com/pkg/errors"
@@ -136,7 +137,7 @@ func (ap *authProvider) FetchToken(ctx context.Context, req *auth.FetchTokenRequ
 			return err
 		}
 		defer func() {
-			err = errors.Wrap(err, "failed to fetch oauth token")
+			err = errors.Wrap(errutil.WithDetails(err), "failed to fetch oauth token")
 		}()
 		ap.mu.Lock()
 		name := fmt.Sprintf("[auth] %v token for %s", strings.Join(trimScopePrefix(req.Scopes), " "), req.Host)
diff --git a/vendor/github.com/moby/buildkit/util/errutil/errutil.go b/vendor/github.com/moby/buildkit/util/errutil/errutil.go
new file mode 100644
index 000000000..67a8eac7e
--- /dev/null
+++ b/vendor/github.com/moby/buildkit/util/errutil/errutil.go
@@ -0,0 +1,94 @@
+package errutil
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+
+	"github.com/containerd/containerd/v2/core/remotes/docker"
+	remoteserrors "github.com/containerd/containerd/v2/core/remotes/errors"
+)
+
+const (
+	maxPrintedBodySize = 256
+)
+
+func WithDetails(err error) error {
+	if err == nil {
+		return nil
+	}
+	var errStatus remoteserrors.ErrUnexpectedStatus
+	if errors.As(err, &errStatus) {
+		var dErr docker.Errors
+		if err1 := json.Unmarshal(errStatus.Body, &dErr); err1 == nil && len(dErr) > 0 {
+			return &formattedDockerError{dErr: dErr}
+		}
+
+		return verboseUnexpectedStatusError{ErrUnexpectedStatus: errStatus}
+	}
+	return err
+}
+
+type verboseUnexpectedStatusError struct {
+	remoteserrors.ErrUnexpectedStatus
+}
+
+func (e verboseUnexpectedStatusError) Unwrap() error {
+	return e.ErrUnexpectedStatus
+}
+
+func (e verboseUnexpectedStatusError) Error() string {
+	if len(e.Body) == 0 {
+		return e.ErrUnexpectedStatus.Error()
+	}
+	var details string
+
+	var errDetails struct {
+		Details string `json:"details"`
+	}
+
+	if err := json.Unmarshal(e.Body, &errDetails); err == nil && errDetails.Details != "" {
+		details = errDetails.Details
+	} else {
+		if len(e.Body) > maxPrintedBodySize {
+			details = string(e.Body[:maxPrintedBodySize]) + fmt.Sprintf("... (%d bytes truncated)", len(e.Body)-maxPrintedBodySize)
+		} else {
+			details = string(e.Body)
+		}
+	}
+
+	return fmt.Sprintf("%s: %s", e.ErrUnexpectedStatus.Error(), details)
+}
+
+type formattedDockerError struct {
+	dErr docker.Errors
+}
+
+func (e *formattedDockerError) Error() string {
+	format := func(err error) string {
+		out := err.Error()
+		var dErr docker.Error
+		if errors.As(err, &dErr) {
+			if v, ok := dErr.Detail.(string); ok && v != "" {
+				out += " - " + v
+			}
+		}
+		return out
+	}
+	switch len(e.dErr) {
+	case 0:
+		return "<nil>"
+	case 1:
+		return format(e.dErr[0])
+	default:
+		msg := "errors:\n"
+		for _, err := range e.dErr {
+			msg += format(err) + "\n"
+		}
+		return msg
+	}
+}
+
+func (e *formattedDockerError) Unwrap() error {
+	return e.dErr
+}
diff --git a/vendor/github.com/moby/buildkit/util/testutil/dockerd/config.go b/vendor/github.com/moby/buildkit/util/testutil/dockerd/config.go
index b3b86feff..abedf706f 100644
--- a/vendor/github.com/moby/buildkit/util/testutil/dockerd/config.go
+++ b/vendor/github.com/moby/buildkit/util/testutil/dockerd/config.go
@@ -9,6 +9,7 @@ type Config struct {
 type BuilderEntitlements struct {
 	NetworkHost      bool `json:"network-host,omitempty"`
 	SecurityInsecure bool `json:"security-insecure,omitempty"`
+	Device           bool `json:"device,omitempty"`
 }
 
 type BuilderConfig struct {
diff --git a/vendor/github.com/moby/buildkit/util/testutil/workers/dockerd.go b/vendor/github.com/moby/buildkit/util/testutil/workers/dockerd.go
index 2e84d4056..19ce191fa 100644
--- a/vendor/github.com/moby/buildkit/util/testutil/workers/dockerd.go
+++ b/vendor/github.com/moby/buildkit/util/testutil/workers/dockerd.go
@@ -124,6 +124,8 @@ func (c Moby) New(ctx context.Context, cfg *integration.BackendConfig) (b integr
 				dcfg.Builder.Entitlements.NetworkHost = true
 			case "security.insecure":
 				dcfg.Builder.Entitlements.SecurityInsecure = true
+			case "device":
+				dcfg.Builder.Entitlements.Device = true
 			}
 		}
 	}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index c90aebb18..072f9523a 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -144,7 +144,7 @@ github.com/containerd/console
 # github.com/containerd/containerd/api v1.9.0
 ## explicit; go 1.23.0
 github.com/containerd/containerd/api/services/content/v1
-# github.com/containerd/containerd/v2 v2.1.3
+# github.com/containerd/containerd/v2 v2.1.4
 ## explicit; go 1.23.0
 github.com/containerd/containerd/v2/core/content
 github.com/containerd/containerd/v2/core/content/proxy
@@ -450,7 +450,7 @@ github.com/mitchellh/go-wordwrap
 # github.com/mitchellh/hashstructure/v2 v2.0.2
 ## explicit; go 1.14
 github.com/mitchellh/hashstructure/v2
-# github.com/moby/buildkit v0.23.0-rc1.0.20250618182037-9b91d20367db
+# github.com/moby/buildkit v0.23.0-rc1.0.20250806140246-955c2b2f7d01
 ## explicit; go 1.23.0
 github.com/moby/buildkit/api/services/control
 github.com/moby/buildkit/api/types
@@ -509,6 +509,7 @@ github.com/moby/buildkit/util/bklog
 github.com/moby/buildkit/util/contentutil
 github.com/moby/buildkit/util/disk
 github.com/moby/buildkit/util/entitlements
+github.com/moby/buildkit/util/errutil
 github.com/moby/buildkit/util/flightcontrol
 github.com/moby/buildkit/util/gitutil
 github.com/moby/buildkit/util/gogo/proto