RUN-4538: Fix buildah vendoring

This PR reflects the upstream change of moving the buildah module from
github.com/containers/buildah to go.podman.io/buildah.

Signed-off-by: Brent Baude <bbaude@redhat.com>

cmd/podman/artifact/pull.go

@@ -4,12 +4,12 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/containers/buildah/pkg/cli"
 	"github.com/containers/podman/v6/cmd/podman/common"
 	"github.com/containers/podman/v6/cmd/podman/registry"
 	"github.com/containers/podman/v6/pkg/domain/entities"
 	"github.com/containers/podman/v6/pkg/util"
 	"github.com/spf13/cobra"
+	"go.podman.io/buildah/pkg/cli"
 	"go.podman.io/common/pkg/auth"
 	"go.podman.io/common/pkg/completion"
 	"go.podman.io/image/v5/types"

cmd/podman/artifact/push.go

@@ -4,12 +4,12 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/containers/buildah/pkg/cli"
 	"github.com/containers/podman/v6/cmd/podman/common"
 	"github.com/containers/podman/v6/cmd/podman/registry"
 	"github.com/containers/podman/v6/pkg/domain/entities"
 	"github.com/containers/podman/v6/pkg/util"
 	"github.com/spf13/cobra"
+	"go.podman.io/buildah/pkg/cli"
 	"go.podman.io/common/pkg/auth"
 	"go.podman.io/common/pkg/completion"
 	"go.podman.io/image/v5/types"

cmd/podman/common/build.go

@@ -13,10 +13,6 @@ import (
 	"syscall"
 	"time"
 
-	buildahDefine "github.com/containers/buildah/define"
-	buildahCLI "github.com/containers/buildah/pkg/cli"
-	"github.com/containers/buildah/pkg/parse"
-	buildahUtil "github.com/containers/buildah/pkg/util"
 	encconfig "github.com/containers/ocicrypt/config"
 	enchelpers "github.com/containers/ocicrypt/helpers"
 	"github.com/containers/podman/v6/cmd/podman/registry"
@@ -26,6 +22,10 @@ import (
 	"github.com/openshift/imagebuilder"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
+	buildahDefine "go.podman.io/buildah/define"
+	buildahCLI "go.podman.io/buildah/pkg/cli"
+	"go.podman.io/buildah/pkg/parse"
+	buildahUtil "go.podman.io/buildah/pkg/util"
 	"go.podman.io/common/pkg/auth"
 	"go.podman.io/common/pkg/completion"
 	"go.podman.io/common/pkg/config"

cmd/podman/containers/cp.go

@@ -11,7 +11,6 @@ import (
 	"strconv"
 	"strings"
 
-	buildahCopiah "github.com/containers/buildah/copier"
 	"github.com/containers/podman/v6/cmd/podman/common"
 	"github.com/containers/podman/v6/cmd/podman/registry"
 	"github.com/containers/podman/v6/pkg/copy"
@@ -19,6 +18,7 @@ import (
 	"github.com/containers/podman/v6/pkg/errorhandling"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
+	buildahCopiah "go.podman.io/buildah/copier"
 	"go.podman.io/storage/pkg/archive"
 	"go.podman.io/storage/pkg/idtools"
 )

cmd/podman/containers/create.go

@@ -9,7 +9,6 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/containers/buildah/pkg/cli"
 	"github.com/containers/podman/v6/cmd/podman/common"
 	"github.com/containers/podman/v6/cmd/podman/registry"
 	"github.com/containers/podman/v6/cmd/podman/utils"
@@ -20,6 +19,7 @@ import (
 	"github.com/containers/podman/v6/pkg/util"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
+	"go.podman.io/buildah/pkg/cli"
 	"go.podman.io/common/pkg/auth"
 	"go.podman.io/common/pkg/config"
 	"go.podman.io/image/v5/transports/alltransports"

cmd/podman/images/build.go

@@ -5,12 +5,12 @@ import (
 	"os"
 	"os/exec"
 
-	buildahCLI "github.com/containers/buildah/pkg/cli"
 	"github.com/containers/podman/v6/cmd/podman/common"
 	"github.com/containers/podman/v6/cmd/podman/registry"
 	"github.com/containers/podman/v6/cmd/podman/utils"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
+	buildahCLI "go.podman.io/buildah/pkg/cli"
 )
 
 var (

cmd/podman/images/pull.go

@@ -6,13 +6,13 @@ import (
 	"os"
 	"strings"
 
-	"github.com/containers/buildah/pkg/cli"
 	"github.com/containers/podman/v6/cmd/podman/common"
 	"github.com/containers/podman/v6/cmd/podman/registry"
 	"github.com/containers/podman/v6/cmd/podman/utils"
 	"github.com/containers/podman/v6/pkg/domain/entities"
 	"github.com/containers/podman/v6/pkg/util"
 	"github.com/spf13/cobra"
+	"go.podman.io/buildah/pkg/cli"
 	"go.podman.io/common/pkg/auth"
 	"go.podman.io/common/pkg/completion"
 	"go.podman.io/common/pkg/config"

cmd/podman/images/push.go

@@ -4,12 +4,12 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/containers/buildah/pkg/cli"
 	"github.com/containers/podman/v6/cmd/podman/common"
 	"github.com/containers/podman/v6/cmd/podman/registry"
 	"github.com/containers/podman/v6/pkg/domain/entities"
 	"github.com/containers/podman/v6/pkg/util"
 	"github.com/spf13/cobra"
+	"go.podman.io/buildah/pkg/cli"
 	"go.podman.io/common/pkg/auth"
 	"go.podman.io/common/pkg/completion"
 	"go.podman.io/image/v5/types"

cmd/podman/images/version.go

@@ -3,10 +3,10 @@ package images
 import (
 	"fmt"
 
-	"github.com/containers/buildah/define"
 	"github.com/containers/podman/v6/cmd/podman/registry"
 	"github.com/containers/podman/v6/cmd/podman/validate"
 	"github.com/spf13/cobra"
+	"go.podman.io/buildah/define"
 	"go.podman.io/common/pkg/completion"
 )
 

cmd/podman/kube/play.go

@@ -12,7 +12,6 @@ import (
 	"strings"
 	"syscall"
 
-	buildahParse "github.com/containers/buildah/pkg/parse"
 	"github.com/containers/podman/v6/cmd/podman/common"
 	"github.com/containers/podman/v6/cmd/podman/parse"
 	"github.com/containers/podman/v6/cmd/podman/registry"
@@ -24,6 +23,7 @@ import (
 	"github.com/containers/podman/v6/pkg/errorhandling"
 	"github.com/containers/podman/v6/pkg/util"
 	"github.com/spf13/cobra"
+	buildahParse "go.podman.io/buildah/pkg/parse"
 	"go.podman.io/common/pkg/auth"
 	"go.podman.io/common/pkg/completion"
 	"go.podman.io/image/v5/types"

cmd/podman/system/reset.go

@@ -8,11 +8,11 @@ import (
 	"os"
 	"strings"
 
-	"github.com/containers/buildah/pkg/volumes"
 	"github.com/containers/podman/v6/cmd/podman/registry"
 	"github.com/containers/podman/v6/cmd/podman/validate"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
+	"go.podman.io/buildah/pkg/volumes"
 	"go.podman.io/common/pkg/completion"
 )
 

cmd/podman/utils/error.go

@@ -8,8 +8,8 @@ import (
 	"strconv"
 	"strings"
 
-	buildahCLI "github.com/containers/buildah/pkg/cli"
 	"github.com/containers/podman/v6/cmd/podman/registry"
+	buildahCLI "go.podman.io/buildah/pkg/cli"
 )
 
 type OutputErrors []error

go.mod

@@ -10,7 +10,6 @@ require (
 	github.com/blang/semver/v4 v4.0.0
 	github.com/checkpoint-restore/checkpointctl v1.5.0
 	github.com/checkpoint-restore/go-criu/v7 v7.2.0
-	github.com/containers/buildah v1.42.1-0.20260417103105-4e43fa8d9e07
 	github.com/containers/gvisor-tap-vsock v0.8.8
 	github.com/containers/libhvee v0.11.0
 	github.com/containers/ocicrypt v1.3.0
@@ -42,7 +41,7 @@ require (
 	github.com/mdlayher/vsock v1.2.1
 	github.com/moby/docker-image-spec v1.3.1
 	github.com/moby/moby/api v1.54.2
-	github.com/moby/moby/client v0.4.0
+	github.com/moby/moby/client v0.4.1
 	github.com/moby/sys/capability v0.4.0
 	github.com/moby/sys/user v0.4.0
 	github.com/moby/term v0.5.2
@@ -64,6 +63,7 @@ require (
 	github.com/stretchr/testify v1.11.1
 	github.com/vbauerster/mpb/v8 v8.12.0
 	github.com/vishvananda/netlink v1.3.1
+	go.podman.io/buildah v1.42.1-0.20260421143840-0acb6b8cca85
 	go.podman.io/common v0.67.2-0.20260420103546-618304d6f83d
 	go.podman.io/image/v5 v5.39.3-0.20260420103546-618304d6f83d
 	go.podman.io/storage v1.62.1-0.20260420103546-618304d6f83d

go.sum

@@ -55,8 +55,6 @@ github.com/containernetworking/cni v1.3.0 h1:v6EpN8RznAZj9765HhXQrtXgX+ECGebEYEm
 github.com/containernetworking/cni v1.3.0/go.mod h1:Bs8glZjjFfGPHMw6hQu82RUgEPNGEaBb9KS5KtNMnJ4=
 github.com/containernetworking/plugins v1.9.1 h1:8oU6WsIsU3bpnNZuvHp74a6cE1MJwbj2P7s4/yTUNlA=
 github.com/containernetworking/plugins v1.9.1/go.mod h1:fj7kS55qg3o/RgS+WGsF3+ZxwIImMPusQZKzBpcSr4c=
-github.com/containers/buildah v1.42.1-0.20260417103105-4e43fa8d9e07 h1:0N0sTooGSQwgmEC9sBtmSjy0uEiIBnZ6EE9K2gHqzvE=
-github.com/containers/buildah v1.42.1-0.20260417103105-4e43fa8d9e07/go.mod h1:v6yB1iltuFJ55H36HFWb7+TjqyoW4nq3X6sjpvgP6qI=
 github.com/containers/common v0.64.2 h1:1xepE7QwQggUXxmyQ1Dbh6Cn0yd7ktk14sN3McSWf5I=
 github.com/containers/common v0.64.2/go.mod h1:o29GfYy4tefUuShm8mOn2AiL5Mpzdio+viHI7n24KJ4=
 github.com/containers/gvisor-tap-vsock v0.8.8 h1:5FznbOYMIuaCv8B6zQ7M6wjqP63Lasy0A6GpViEnjTg=
@@ -257,8 +255,8 @@ github.com/moby/go-archive v0.2.0 h1:zg5QDUM2mi0JIM9fdQZWC7U8+2ZfixfTYoHL7rWUcP8
 github.com/moby/go-archive v0.2.0/go.mod h1:mNeivT14o8xU+5q1YnNrkQVpK+dnNe/K6fHqnTg4qPU=
 github.com/moby/moby/api v1.54.2 h1:wiat9QAhnDQjA7wk1kh/TqHz2I1uUA7M7t9SAl/JNXg=
 github.com/moby/moby/api v1.54.2/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
-github.com/moby/moby/client v0.4.0 h1:S+2XegzHQrrvTCvF6s5HFzcrywWQmuVnhOXe2kiWjIw=
-github.com/moby/moby/client v0.4.0/go.mod h1:QWPbvWchQbxBNdaLSpoKpCdf5E+WxFAgNHogCWDoa7g=
+github.com/moby/moby/client v0.4.1 h1:DMQgisVoMkmMs7fp3ROSdiBnoAu8+vo3GggFl06M/wY=
+github.com/moby/moby/client v0.4.1/go.mod h1:z52C9O2POPOsnxZAy//WtKcQ32P+jT/NGeXu/7nfjGQ=
 github.com/moby/patternmatcher v0.6.1 h1:qlhtafmr6kgMIJjKJMDmMWq7WLkKIo23hsrpR3x084U=
 github.com/moby/patternmatcher v0.6.1/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
 github.com/moby/sys/capability v0.4.0 h1:4D4mI6KlNtWMCM1Z/K0i7RV1FkX+DBDHKVJpCndZoHk=
@@ -429,6 +427,8 @@ go.opentelemetry.io/otel/sdk/metric v1.42.0 h1:D/1QR46Clz6ajyZ3G8SgNlTJKBdGp84q9
 go.opentelemetry.io/otel/sdk/metric v1.42.0/go.mod h1:Ua6AAlDKdZ7tdvaQKfSmnFTdHx37+J4ba8MwVCYM5hc=
 go.opentelemetry.io/otel/trace v1.42.0 h1:OUCgIPt+mzOnaUTpOQcBiM/PLQ/Op7oq6g4LenLmOYY=
 go.opentelemetry.io/otel/trace v1.42.0/go.mod h1:f3K9S+IFqnumBkKhRJMeaZeNk9epyhnCmQh/EysQCdc=
+go.podman.io/buildah v1.42.1-0.20260421143840-0acb6b8cca85 h1:rVKRagobPO6kGHOg2NhGNs6xWVgZctiOn4tmxa3cytA=
+go.podman.io/buildah v1.42.1-0.20260421143840-0acb6b8cca85/go.mod h1:JjFirF1zlILz55ZkVYYhLRnted7mPlmoS2w2ihYw8iw=
 go.podman.io/common v0.67.2-0.20260420103546-618304d6f83d h1:zryioAYWqUu1BUPraJJ6q5mLiclNZ3kTuQyyBO/5vYs=
 go.podman.io/common v0.67.2-0.20260420103546-618304d6f83d/go.mod h1:Pom4Io+8C+CCZzr3CRUkr6A5inTMY8nVaFS3X1Y5NbI=
 go.podman.io/image/v5 v5.39.3-0.20260420103546-618304d6f83d h1:NeMM89Fwaw19guPj/hXEjBtoCeH/mGgbAWoBnpnRiIo=

hack/buildah-vendor-treadmill

@@ -30,7 +30,7 @@ our $Docs_URL =
     'https://github.com/containers/podman/wiki/Buildah-Vendor-Treadmill';
 
 # github path to buildah
-our $Buildah = 'github.com/containers/buildah';
+our $Buildah = 'go.podman.io/buildah';
 
 # FIXME FIXME FIXME: add 'main'? I hope we never need this script for branches.
 our $Treadmill_PR_Title = 'DO NOT MERGE: buildah vendor treadmill';

libpod/container_commit.go

@@ -9,10 +9,10 @@ import (
 	"slices"
 	"strings"
 
-	"github.com/containers/buildah"
 	"github.com/containers/podman/v6/libpod/define"
 	"github.com/containers/podman/v6/libpod/events"
 	"github.com/sirupsen/logrus"
+	"go.podman.io/buildah"
 	"go.podman.io/common/libimage"
 	is "go.podman.io/image/v5/storage"
 	"go.podman.io/image/v5/types"

libpod/container_copy_common.go

@@ -10,14 +10,14 @@ import (
 	"path/filepath"
 	"strings"
 
-	buildahCopiah "github.com/containers/buildah/copier"
-	"github.com/containers/buildah/pkg/chrootuser"
-	"github.com/containers/buildah/util"
 	"github.com/containers/podman/v6/libpod/define"
 	"github.com/containers/podman/v6/libpod/shutdown"
 	"github.com/containers/podman/v6/pkg/rootless"
 	"github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/sirupsen/logrus"
+	buildahCopiah "go.podman.io/buildah/copier"
+	"go.podman.io/buildah/pkg/chrootuser"
+	"go.podman.io/buildah/util"
 	"go.podman.io/storage/pkg/archive"
 	"go.podman.io/storage/pkg/idtools"
 	"go.podman.io/storage/pkg/stringid"

libpod/container_internal.go

@@ -20,9 +20,6 @@ import (
 	"time"
 
 	metadata "github.com/checkpoint-restore/checkpointctl/lib"
-	"github.com/containers/buildah/copier"
-	"github.com/containers/buildah/pkg/overlay"
-	butil "github.com/containers/buildah/util"
 	"github.com/containers/podman/v6/libpod/define"
 	"github.com/containers/podman/v6/libpod/events"
 	"github.com/containers/podman/v6/libpod/shutdown"
@@ -40,6 +37,9 @@ import (
 	"github.com/opencontainers/runtime-tools/generate"
 	"github.com/opencontainers/selinux/go-selinux/label"
 	"github.com/sirupsen/logrus"
+	"go.podman.io/buildah/copier"
+	"go.podman.io/buildah/pkg/overlay"
+	butil "go.podman.io/buildah/util"
 	"go.podman.io/common/libnetwork/etchosts"
 	"go.podman.io/common/pkg/chown"
 	"go.podman.io/common/pkg/config"

libpod/container_internal_common.go

@@ -23,10 +23,6 @@ import (
 
 	metadata "github.com/checkpoint-restore/checkpointctl/lib"
 	"github.com/checkpoint-restore/go-criu/v7/stats"
-	"github.com/containers/buildah"
-	"github.com/containers/buildah/pkg/chrootuser"
-	"github.com/containers/buildah/pkg/overlay"
-	butil "github.com/containers/buildah/util"
 	"github.com/containers/podman/v6/libpod/define"
 	"github.com/containers/podman/v6/libpod/events"
 	"github.com/containers/podman/v6/pkg/annotations"
@@ -43,6 +39,10 @@ import (
 	"github.com/opencontainers/selinux/go-selinux"
 	"github.com/opencontainers/selinux/go-selinux/label"
 	"github.com/sirupsen/logrus"
+	"go.podman.io/buildah"
+	"go.podman.io/buildah/pkg/chrootuser"
+	"go.podman.io/buildah/pkg/overlay"
+	butil "go.podman.io/buildah/util"
 	"go.podman.io/common/libnetwork/etchosts"
 	"go.podman.io/common/libnetwork/resolvconf"
 	"go.podman.io/common/libnetwork/types"

libpod/container_stat_common.go

@@ -9,9 +9,9 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/containers/buildah/copier"
 	"github.com/containers/podman/v6/libpod/define"
 	"github.com/containers/podman/v6/pkg/copy"
+	"go.podman.io/buildah/copier"
 )
 
 // statOnHost stats the specified path *on the host*.  It returns the file info

libpod/container_stat_freebsd.go

@@ -3,7 +3,7 @@
 package libpod
 
 import (
-	"github.com/containers/buildah/copier"
+	"go.podman.io/buildah/copier"
 )
 
 // On FreeBSD, jails use the global mount namespace, filtered to only

libpod/container_stat_linux.go

@@ -3,8 +3,8 @@
 package libpod
 
 import (
-	"github.com/containers/buildah/copier"
 	"github.com/containers/podman/v6/libpod/define"
+	"go.podman.io/buildah/copier"
 )
 
 // statInsideMount stats the specified path *inside* the container's mount and PID

libpod/info.go

@@ -14,12 +14,12 @@ import (
 	"syscall"
 	"time"
 
-	"github.com/containers/buildah"
-	"github.com/containers/buildah/pkg/parse"
-	"github.com/containers/buildah/pkg/util"
 	"github.com/containers/podman/v6/libpod/define"
 	"github.com/containers/podman/v6/libpod/linkmode"
 	"github.com/sirupsen/logrus"
+	"go.podman.io/buildah"
+	"go.podman.io/buildah/pkg/parse"
+	"go.podman.io/buildah/pkg/util"
 	"go.podman.io/common/pkg/version"
 	"go.podman.io/image/v5/pkg/sysregistriesv2"
 	"go.podman.io/storage/pkg/system"

libpod/networking_freebsd.go

@@ -9,9 +9,9 @@ import (
 	"fmt"
 	"os/exec"
 
-	"github.com/containers/buildah/pkg/jail"
 	"github.com/containers/podman/v6/libpod/define"
 	"github.com/sirupsen/logrus"
+	"go.podman.io/buildah/pkg/jail"
 	"go.podman.io/common/libnetwork/types"
 )
 

libpod/runtime.go

@@ -15,7 +15,6 @@ import (
 	"syscall"
 	"time"
 
-	"github.com/containers/buildah/pkg/parse"
 	"github.com/containers/podman/v6/libpod/define"
 	"github.com/containers/podman/v6/libpod/events"
 	"github.com/containers/podman/v6/libpod/lock"
@@ -31,6 +30,7 @@ import (
 	jsoniter "github.com/json-iterator/go"
 	spec "github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/sirupsen/logrus"
+	"go.podman.io/buildah/pkg/parse"
 	"go.podman.io/common/libimage"
 	"go.podman.io/common/libnetwork/network"
 	nettypes "go.podman.io/common/libnetwork/types"

libpod/runtime_ctr.go

@@ -15,7 +15,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/containers/buildah"
 	"github.com/containers/podman/v6/libpod/define"
 	"github.com/containers/podman/v6/libpod/events"
 	"github.com/containers/podman/v6/libpod/shutdown"
@@ -27,6 +26,7 @@ import (
 	spec "github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/opencontainers/runtime-tools/generate"
 	"github.com/sirupsen/logrus"
+	"go.podman.io/buildah"
 	"go.podman.io/common/libnetwork/types"
 	"go.podman.io/common/pkg/config"
 	"go.podman.io/storage"

libpod/runtime_img.go

@@ -7,11 +7,11 @@ import (
 	"errors"
 	"fmt"
 
-	buildahDefine "github.com/containers/buildah/define"
-	"github.com/containers/buildah/imagebuildah"
 	"github.com/containers/podman/v6/libpod/define"
 	"github.com/containers/podman/v6/libpod/events"
 	"github.com/sirupsen/logrus"
+	buildahDefine "go.podman.io/buildah/define"
+	"go.podman.io/buildah/imagebuildah"
 	"go.podman.io/common/libimage"
 	"go.podman.io/image/v5/docker/reference"
 )

pkg/api/handlers/compat/containers_create.go

@@ -13,7 +13,6 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/containers/buildah/pkg/parse"
 	"github.com/containers/podman/v6/libpod"
 	"github.com/containers/podman/v6/libpod/define"
 	"github.com/containers/podman/v6/pkg/api/handlers"
@@ -25,6 +24,7 @@ import (
 	"github.com/containers/podman/v6/pkg/specgen"
 	"github.com/containers/podman/v6/pkg/specgenutil"
 	"github.com/moby/moby/api/types/mount"
+	"go.podman.io/buildah/pkg/parse"
 	"go.podman.io/common/libimage"
 	"go.podman.io/common/libnetwork/types"
 	"go.podman.io/common/pkg/config"

pkg/api/handlers/compat/images.go

@@ -11,7 +11,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/containers/buildah"
 	"github.com/containers/podman/v6/libpod"
 	"github.com/containers/podman/v6/pkg/api/handlers"
 	"github.com/containers/podman/v6/pkg/api/handlers/utils"
@@ -28,6 +27,7 @@ import (
 	"github.com/opencontainers/go-digest"
 	imageSpec "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/sirupsen/logrus"
+	"go.podman.io/buildah"
 	"go.podman.io/common/libimage"
 	"go.podman.io/common/pkg/config"
 	"go.podman.io/common/pkg/filters"

pkg/api/handlers/compat/images_build.go

@@ -18,9 +18,6 @@ import (
 	"syscall"
 	"time"
 
-	"github.com/containers/buildah"
-	buildahDefine "github.com/containers/buildah/define"
-	"github.com/containers/buildah/pkg/parse"
 	"github.com/containers/podman/v6/internal/localapi"
 	"github.com/containers/podman/v6/libpod"
 	"github.com/containers/podman/v6/pkg/api/handlers/utils"
@@ -31,6 +28,9 @@ import (
 	"github.com/containers/podman/v6/pkg/util"
 	"github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/sirupsen/logrus"
+	"go.podman.io/buildah"
+	buildahDefine "go.podman.io/buildah/define"
+	"go.podman.io/buildah/pkg/parse"
 	"go.podman.io/common/pkg/config"
 	"go.podman.io/image/v5/docker/reference"
 	"go.podman.io/image/v5/types"

pkg/api/handlers/compat/ping.go

@@ -7,7 +7,7 @@ import (
 	"net/http"
 	"runtime"
 
-	"github.com/containers/buildah"
+	"go.podman.io/buildah"
 )
 
 // Ping returns headers to client about the service

pkg/api/handlers/libpod/images.go

@@ -15,7 +15,6 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/containers/buildah"
 	"github.com/containers/podman/v6/internal/localapi"
 	"github.com/containers/podman/v6/libpod"
 	"github.com/containers/podman/v6/libpod/define"
@@ -34,6 +33,7 @@ import (
 	"github.com/gorilla/schema"
 	"github.com/moby/moby/api/types/jsonstream"
 	"github.com/sirupsen/logrus"
+	"go.podman.io/buildah"
 	"go.podman.io/common/libimage"
 	"go.podman.io/common/pkg/ssh"
 	"go.podman.io/image/v5/manifest"

pkg/bindings/images/build.go

@@ -19,8 +19,6 @@ import (
 	"strings"
 
 	"github.com/blang/semver/v4"
-	"github.com/containers/buildah/define"
-	"github.com/containers/buildah/pkg/parse"
 	"github.com/containers/podman/v6/internal/remote_build_helpers"
 	ldefine "github.com/containers/podman/v6/libpod/define"
 	"github.com/containers/podman/v6/pkg/auth"
@@ -34,6 +32,8 @@ import (
 	gzip "github.com/klauspost/pgzip"
 	"github.com/moby/moby/api/types/jsonstream"
 	"github.com/sirupsen/logrus"
+	"go.podman.io/buildah/define"
+	"go.podman.io/buildah/pkg/parse"
 	imageTypes "go.podman.io/image/v5/types"
 	"go.podman.io/storage/pkg/archive"
 	"go.podman.io/storage/pkg/fileutils"

pkg/bindings/images/build_test.go

@@ -3,8 +3,8 @@ package images
 import (
 	"testing"
 
-	"github.com/containers/buildah/define"
 	"github.com/stretchr/testify/assert"
+	"go.podman.io/buildah/define"
 )
 
 func TestBuildMatchIID(t *testing.T) {

pkg/domain/entities/types/types.go

@@ -4,7 +4,7 @@ package types
 import (
 	"os"
 
-	buildahDefine "github.com/containers/buildah/define"
+	buildahDefine "go.podman.io/buildah/define"
 )
 
 // ComponentVersion describes the version information for a specific component.

pkg/domain/infra/abi/containers.go

@@ -14,7 +14,6 @@ import (
 	"sync"
 	"time"
 
-	"github.com/containers/buildah"
 	"github.com/containers/podman/v6/libpod"
 	"github.com/containers/podman/v6/libpod/define"
 	"github.com/containers/podman/v6/libpod/logs"
@@ -34,6 +33,7 @@ import (
 	"github.com/containers/podman/v6/pkg/util"
 	"github.com/hashicorp/go-multierror"
 	"github.com/sirupsen/logrus"
+	"go.podman.io/buildah"
 	"go.podman.io/common/pkg/config"
 	"go.podman.io/image/v5/manifest"
 	"go.podman.io/storage"

pkg/domain/infra/abi/farm.go

@@ -7,9 +7,9 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/containers/buildah/pkg/parse"
 	"github.com/containers/podman/v6/pkg/domain/entities"
 	"github.com/containers/podman/v6/pkg/emulation"
+	"go.podman.io/buildah/pkg/parse"
 	lplatform "go.podman.io/common/libimage/platform"
 )
 

pkg/domain/infra/abi/images.go

@@ -19,8 +19,6 @@ import (
 	"syscall"
 	"time"
 
-	bdefine "github.com/containers/buildah/define"
-	"github.com/containers/buildah/pkg/volumes"
 	"github.com/containers/podman/v6/libpod/define"
 	"github.com/containers/podman/v6/pkg/domain/entities"
 	"github.com/containers/podman/v6/pkg/domain/entities/reports"
@@ -30,6 +28,8 @@ import (
 	"github.com/opencontainers/go-digest"
 	imgspecv1 "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/sirupsen/logrus"
+	bdefine "go.podman.io/buildah/define"
+	"go.podman.io/buildah/pkg/volumes"
 	"go.podman.io/common/libimage"
 	"go.podman.io/common/libimage/filter"
 	"go.podman.io/common/pkg/config"

pkg/domain/infra/abi/play.go

@@ -15,8 +15,6 @@ import (
 	"strings"
 	"sync"
 
-	buildahDefine "github.com/containers/buildah/define"
-	bparse "github.com/containers/buildah/pkg/parse"
 	"github.com/containers/podman/v6/cmd/podman/parse"
 	"github.com/containers/podman/v6/libpod"
 	"github.com/containers/podman/v6/libpod/define"
@@ -37,6 +35,8 @@ import (
 	"github.com/opencontainers/go-digest"
 	"github.com/opencontainers/selinux/go-selinux"
 	"github.com/sirupsen/logrus"
+	buildahDefine "go.podman.io/buildah/define"
+	bparse "go.podman.io/buildah/pkg/parse"
 	"go.podman.io/common/libimage"
 	nettypes "go.podman.io/common/libnetwork/types"
 	"go.podman.io/common/pkg/config"

pkg/domain/infra/tunnel/images.go

@@ -10,7 +10,6 @@ import (
 	"strings"
 	"time"
 
-	bdefine "github.com/containers/buildah/define"
 	"github.com/containers/podman/v6/internal/localapi"
 	"github.com/containers/podman/v6/libpod/define"
 	"github.com/containers/podman/v6/pkg/bindings/images"
@@ -19,6 +18,7 @@ import (
 	"github.com/containers/podman/v6/pkg/domain/utils"
 	"github.com/containers/podman/v6/pkg/errorhandling"
 	"github.com/sirupsen/logrus"
+	bdefine "go.podman.io/buildah/define"
 	"go.podman.io/common/libimage/filter"
 	"go.podman.io/common/pkg/config"
 	"go.podman.io/image/v5/docker/reference"

pkg/farm/farm.go

@@ -11,11 +11,11 @@ import (
 	"strings"
 	"sync"
 
-	"github.com/containers/buildah/define"
 	"github.com/containers/podman/v6/pkg/domain/entities"
 	"github.com/containers/podman/v6/pkg/domain/infra"
 	"github.com/hashicorp/go-multierror"
 	"github.com/sirupsen/logrus"
+	"go.podman.io/buildah/define"
 	lplatform "go.podman.io/common/libimage/platform"
 	"go.podman.io/common/pkg/config"
 )

pkg/machine/ocipull/pull.go

@@ -6,9 +6,9 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/containers/buildah/pkg/parse"
 	"github.com/containers/podman/v6/pkg/machine/define"
 	"github.com/sirupsen/logrus"
+	"go.podman.io/buildah/pkg/parse"
 	"go.podman.io/image/v5/copy"
 	"go.podman.io/image/v5/oci/layout"
 	"go.podman.io/image/v5/signature"

pkg/specgen/generate/namespaces_freebsd.go

@@ -6,11 +6,11 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/containers/buildah/pkg/jail"
 	"github.com/containers/podman/v6/libpod"
 	"github.com/containers/podman/v6/pkg/specgen"
 	"github.com/opencontainers/runtime-tools/generate"
 	"github.com/sirupsen/logrus"
+	"go.podman.io/buildah/pkg/jail"
 )
 
 func specConfigureNamespaces(s *specgen.SpecGenerator, g *generate.Generator, rt *libpod.Runtime, pod *libpod.Pod) error {

test/buildah-bud/run-buildah-bud-tests

@@ -7,6 +7,7 @@ ME=$(basename $0)
 
 # Buildah main repository; unlikely to change often
 BUILDAH_REPO=github.com/containers/buildah
+BUILDAH_MODULE=go.podman.io/buildah
 
 # Tag name used to identify the base checkout
 BASE_TAG=buildah-bud-in-podman
@@ -91,12 +92,12 @@ trap 'if [[ $? != 0 ]]; then if [[ -n $failhint ]]; then echo;echo "************
 
 # Find the version of buildah we've vendored in, so we can run the right tests.
 # Note first check if buildah is being replaced with a different version in which case we need to use that one.
-buildah_replace=$(go list -m -f '{{if .Replace}}{{.Replace}}{{end}}' $BUILDAH_REPO)
+buildah_replace=$(go list -m -f '{{if .Replace}}{{.Replace}}{{end}}' $BUILDAH_MODULE)
 buildah_checkout_repo="$BUILDAH_REPO"
 
 if [[ -z "$buildah_replace" ]]; then
     # No replace this is fine, check the main version
-    buildah_version=$(go list -m -f '{{.Version}}' $BUILDAH_REPO)
+    buildah_version=$(go list -m -f '{{.Version}}' $BUILDAH_MODULE)
 else
     # replace string is "REPO VERSION" so split this into our two vars
     buildah_checkout_repo="${buildah_replace% *}"
@@ -134,7 +135,7 @@ if [[ -n $CIRRUS_CHANGE_IN_REPO ]]; then
         base=$(set -x;git merge-base ${DEST_BRANCH} $head)
         changes=$(set -x;git diff --name-status $base $head)
         if [[ -n $changes ]]; then
-            if [[ $changes =~ vendor/$BUILDAH_REPO ]]; then
+            if [[ $changes =~ vendor/$BUILDAH_MODULE ]]; then
                 is_revendor=y
             fi
         fi

test/e2e/build_test.go

@@ -11,11 +11,11 @@ import (
 	"runtime"
 	"strings"
 
-	"github.com/containers/buildah/define"
 	. "github.com/containers/podman/v6/test/utils"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	. "github.com/onsi/gomega/gexec"
+	"go.podman.io/buildah/define"
 )
 
 var _ = Describe("Podman build", func() {

vendor/github.com/moby/moby/client/internal/json-stream.go

@@ -12,8 +12,9 @@ const rs = 0x1E
 
 type DecoderFn func(v any) error
 
-// NewJSONStreamDecoder builds adequate DecoderFn to read json records formatted with specified content-type
-func NewJSONStreamDecoder(r io.Reader, contentType string) DecoderFn {
+// NewJSONStreamDecoder builds a DecoderFn to read a stream of JSON records
+// formatted with the specified content-type.
+func NewJSONStreamDecoder(r io.Reader, contentType types.MediaType) DecoderFn {
 	switch contentType {
 	case types.MediaTypeJSONSequence:
 		return json.NewDecoder(NewRSFilterReader(r)).Decode
@@ -24,27 +25,38 @@ func NewJSONStreamDecoder(r io.Reader, contentType string) DecoderFn {
 	}
 }
 
-// RSFilterReader wraps an io.Reader and filters out ASCII RS characters
-type RSFilterReader struct {
+type rsFilterReader struct {
 	reader io.Reader
-	buffer []byte
 }
 
-// NewRSFilterReader creates a new RSFilterReader that filters out RS characters
-func NewRSFilterReader(r io.Reader) *RSFilterReader {
-	return &RSFilterReader{
-		reader: r,
-		buffer: make([]byte, 4096), // Internal buffer for reading chunks
-	}
+// NewRSFilterReader creates an [io.Reader] that filters out ASCII Record Separators (RS).
+func NewRSFilterReader(r io.Reader) io.Reader {
+	return &rsFilterReader{reader: r}
 }
 
-// Read implements the io.Reader interface, filtering out RS characters
-func (r *RSFilterReader) Read(p []byte) (n int, err error) {
+func (r *rsFilterReader) Read(p []byte) (int, error) {
 	if len(p) == 0 {
 		return 0, nil
 	}
 
-	n, err = r.reader.Read(p)
-	filtered := slices.DeleteFunc(p[:n], func(b byte) bool { return b == rs })
-	return len(filtered), err
+	for {
+		n, err := r.reader.Read(p)
+		if n == 0 {
+			return 0, err
+		}
+
+		filtered := slices.DeleteFunc(p[:n], func(b byte) bool { return b == rs })
+		n = len(filtered)
+		if err != nil {
+			if err == io.EOF && n > 0 {
+				return n, nil
+			}
+			return n, err
+		}
+		if n == 0 {
+			// Avoid returning (0, nil) after consuming input; keep reading until data or an error (e.g., EOF).
+			continue
+		}
+		return n, nil
+	}
 }

vendor/github.com/moby/moby/client/internal/jsonmessages.go

@@ -8,6 +8,8 @@ import (
 	"iter"
 	"sync"
 
+	"github.com/containerd/errdefs/pkg/errhttp"
+
 	"github.com/moby/moby/api/types/jsonstream"
 )
 
@@ -44,41 +46,90 @@ func (r Stream) Close() error {
 
 var _ io.ReadCloser = Stream{}
 
-// JSONMessages decodes the response stream as a sequence of JSONMessages.
-// if stream ends or context is cancelled, the underlying [io.Reader] is closed.
+// JSONMessages decodes the response stream as a sequence of [jsonstream.Message].
+// The underlying [io.Reader] is closed when the stream ends or if the context
+// is cancelled.
 func (r Stream) JSONMessages(ctx context.Context) iter.Seq2[jsonstream.Message, error] {
 	stop := context.AfterFunc(ctx, func() {
 		_ = r.Close()
 	})
-	dec := json.NewDecoder(r)
 	return func(yield func(jsonstream.Message, error) bool) {
 		defer func() {
 			stop() // unregister AfterFunc
-			r.Close()
+			_ = r.Close()
 		}()
+
+		dec := json.NewDecoder(r)
 		for {
 			var jm jsonstream.Message
-			err := dec.Decode(&jm)
-			if errors.Is(err, io.EOF) {
-				break
-			}
-			if ctx.Err() != nil {
-				yield(jm, ctx.Err())
+			if err := dec.Decode(&jm); err != nil {
+				if errors.Is(err, io.EOF) {
+					return
+				}
+				if err := ctx.Err(); err != nil {
+					// Do not return decoding errors if the context was
+					// cancelled, because the decoding errors may be due
+					// to the context being cancelled.
+					yield(jsonstream.Message{}, err)
+					return
+				}
+				yield(jsonstream.Message{}, err)
 				return
 			}
-			if !yield(jm, err) {
+			if !yield(jm, nil) {
 				return
 			}
 		}
 	}
 }
 
-// Wait waits for operation to complete and detects errors reported as JSONMessage
+// Wait consumes the stream until completion.
+//
+// It returns nil if the operation completes successfully. Errors are
+// returned if the context is canceled, a decoding/transport failure
+// occurs, or a JSON message reports an error ([jsonstream.Message.Error]).
 func (r Stream) Wait(ctx context.Context) error {
-	for _, err := range r.JSONMessages(ctx) {
+	for jm, err := range r.JSONMessages(ctx) {
 		if err != nil {
+			// decode, transport and context cancellation errors.
 			return err
 		}
+		if jm.Error != nil {
+			// push/pull failures.
+			return httpErrorFromStatusCode(jm.Error, jm.Error.Code)
+		}
 	}
 	return nil
 }
+
+type httpError struct {
+	err    error
+	errdef error
+}
+
+func (e *httpError) Error() string {
+	return e.err.Error()
+}
+
+func (e *httpError) Unwrap() error {
+	return e.err
+}
+
+func (e *httpError) Is(target error) bool {
+	return errors.Is(e.errdef, target)
+}
+
+// httpErrorFromStatusCode creates an errdef error, based on the provided HTTP status-code
+//
+// TODO(thaJeztah): unify with the implementation in client and move to an internal package
+// see https://github.com/moby/moby/blob/client/v0.4.0/client/errors.go#L76-L114
+func httpErrorFromStatusCode(err error, statusCode int) error {
+	if err == nil {
+		return nil
+	}
+
+	return &httpError{
+		err:    err,
+		errdef: errhttp.ToNative(statusCode),
+	}
+}

vendor/github.com/moby/moby/client/system_disk_usage.go

@@ -244,12 +244,15 @@ func imageDiskUsageFromLegacyAPI(du *legacyDiskUsage) ImagesDiskUsage {
 		Items:      du.Images,
 	}
 
-	for _, i := range idu.Items {
-		if i.Containers > 0 {
+	for _, img := range idu.Items {
+		switch {
+		case img.Containers < 0:
+			// No container-count information available; skip (assume it's in use).
+		case img.Containers > 0:
 			idu.ActiveCount++
-		} else if i.Size != -1 && i.SharedSize != -1 {
-			// Only count reclaimable size if we have size information
-			idu.Reclaimable += (i.Size - i.SharedSize)
+		case img.Containers == 0 && img.Size != -1 && img.SharedSize != -1:
+			reclaimable := img.Size - img.SharedSize
+			idu.Reclaimable += reclaimable
 		}
 	}
 

vendor/go.podman.io/buildah/add.go

@@ -19,10 +19,6 @@ import (
 	"syscall"
 	"time"
 
-	"github.com/containers/buildah/copier"
-	"github.com/containers/buildah/define"
-	"github.com/containers/buildah/internal/tmpdir"
-	"github.com/containers/buildah/pkg/chrootuser"
 	"github.com/docker/go-connections/tlsconfig"
 	"github.com/hashicorp/go-multierror"
 	"github.com/moby/sys/userns"
@@ -30,6 +26,10 @@ import (
 	v1 "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/sirupsen/logrus"
+	"go.podman.io/buildah/copier"
+	"go.podman.io/buildah/define"
+	"go.podman.io/buildah/internal/tmpdir"
+	"go.podman.io/buildah/pkg/chrootuser"
 	"go.podman.io/common/pkg/retry"
 	"go.podman.io/image/v5/pkg/tlsclientconfig"
 	"go.podman.io/image/v5/types"

vendor/go.podman.io/buildah/bind/mount.go

@@ -10,9 +10,9 @@ import (
 	"slices"
 	"syscall"
 
-	"github.com/containers/buildah/util"
 	"github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/sirupsen/logrus"
+	"go.podman.io/buildah/util"
 	"go.podman.io/storage/pkg/idtools"
 	"go.podman.io/storage/pkg/mount"
 	"golang.org/x/sys/unix"

vendor/go.podman.io/buildah/buildah.go

@@ -11,11 +11,11 @@ import (
 	"sort"
 	"time"
 
-	"github.com/containers/buildah/define"
-	"github.com/containers/buildah/docker"
 	encconfig "github.com/containers/ocicrypt/config"
 	v1 "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/sirupsen/logrus"
+	"go.podman.io/buildah/define"
+	"go.podman.io/buildah/docker"
 	nettypes "go.podman.io/common/libnetwork/types"
 	"go.podman.io/image/v5/types"
 	"go.podman.io/storage"

vendor/go.podman.io/buildah/chroot/run_common.go

@@ -18,11 +18,11 @@ import (
 	"sync"
 	"syscall"
 
-	"github.com/containers/buildah/bind"
-	"github.com/containers/buildah/internal/pty"
-	"github.com/containers/buildah/util"
 	"github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/sirupsen/logrus"
+	"go.podman.io/buildah/bind"
+	"go.podman.io/buildah/internal/pty"
+	"go.podman.io/buildah/util"
 	"go.podman.io/storage/pkg/ioutils"
 	"go.podman.io/storage/pkg/reexec"
 	"go.podman.io/storage/pkg/unshare"

vendor/go.podman.io/buildah/chroot/run_freebsd.go

@@ -13,9 +13,9 @@ import (
 	"strings"
 	"syscall"
 
-	"github.com/containers/buildah/pkg/jail"
 	"github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/sirupsen/logrus"
+	"go.podman.io/buildah/pkg/jail"
 	"go.podman.io/storage/pkg/fileutils"
 	"go.podman.io/storage/pkg/mount"
 	"go.podman.io/storage/pkg/unshare"

vendor/go.podman.io/buildah/chroot/run_linux.go

@@ -13,11 +13,11 @@ import (
 	"syscall"
 	"time"
 
-	"github.com/containers/buildah/copier"
 	"github.com/moby/sys/capability"
 	"github.com/opencontainers/runc/libcontainer/apparmor"
 	"github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/sirupsen/logrus"
+	"go.podman.io/buildah/copier"
 	"go.podman.io/storage/pkg/mount"
 	"go.podman.io/storage/pkg/unshare"
 	"golang.org/x/sys/unix"

vendor/go.podman.io/buildah/commit.go

@@ -10,13 +10,13 @@ import (
 	"strings"
 	"time"
 
-	"github.com/containers/buildah/internal/metadata"
-	"github.com/containers/buildah/pkg/blobcache"
-	"github.com/containers/buildah/util"
 	encconfig "github.com/containers/ocicrypt/config"
 	digest "github.com/opencontainers/go-digest"
 	v1 "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/sirupsen/logrus"
+	"go.podman.io/buildah/internal/metadata"
+	"go.podman.io/buildah/pkg/blobcache"
+	"go.podman.io/buildah/util"
 	"go.podman.io/common/libimage"
 	"go.podman.io/common/libimage/manifests"
 	"go.podman.io/image/v5/docker"

vendor/go.podman.io/buildah/common.go

@@ -7,8 +7,8 @@ import (
 	"path/filepath"
 	"time"
 
-	"github.com/containers/buildah/define"
 	encconfig "github.com/containers/ocicrypt/config"
+	"go.podman.io/buildah/define"
 	"go.podman.io/common/pkg/retry"
 	cp "go.podman.io/image/v5/copy"
 	"go.podman.io/image/v5/docker"

vendor/go.podman.io/buildah/config.go

@@ -11,11 +11,11 @@ import (
 	"time"
 
 	"github.com/containerd/platforms"
-	"github.com/containers/buildah/define"
-	"github.com/containers/buildah/docker"
-	internalUtil "github.com/containers/buildah/internal/util"
 	ociv1 "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/sirupsen/logrus"
+	"go.podman.io/buildah/define"
+	"go.podman.io/buildah/docker"
+	internalUtil "go.podman.io/buildah/internal/util"
 	"go.podman.io/image/v5/manifest"
 	"go.podman.io/image/v5/pkg/compression"
 	"go.podman.io/image/v5/transports"

vendor/go.podman.io/buildah/convertcw.go

@@ -6,11 +6,11 @@ import (
 	"io"
 	"time"
 
-	"github.com/containers/buildah/define"
-	"github.com/containers/buildah/internal/mkcw"
 	encconfig "github.com/containers/ocicrypt/config"
 	"github.com/opencontainers/go-digest"
 	"github.com/sirupsen/logrus"
+	"go.podman.io/buildah/define"
+	"go.podman.io/buildah/internal/mkcw"
 	"go.podman.io/image/v5/docker/reference"
 	"go.podman.io/image/v5/types"
 	"go.podman.io/storage"

vendor/go.podman.io/buildah/copier/copier.go

@@ -1375,7 +1375,12 @@ func copierHandlerGet(bulkWriter io.Writer, req request, pm *fileutils.PatternMa
 				}
 				addedParents[parentName] = struct{}{}
 
-				if err := copierHandlerGetOne(parentInfo, "", parentName, parent, req.GetOptions, tw, hardlinkChecker, idMappings); err != nil {
+				parentSymlinkTarget, err := getTargetIfSymlink(parent, parentInfo)
+				if err != nil {
+					return fmt.Errorf("copier: get: %w", err)
+				}
+
+				if err := copierHandlerGetOne(parentInfo, parentSymlinkTarget, parentName, parent, req.GetOptions, tw, hardlinkChecker, idMappings); err != nil {
 					if req.GetOptions.IgnoreUnreadable && errorIsPermission(err) {
 						continue
 					} else if errors.Is(err, os.ErrNotExist) {
@@ -1535,7 +1540,12 @@ func copierHandlerGet(bulkWriter io.Writer, req request, pm *fileutils.PatternMa
 					}
 				}
 
-				if err := copierHandlerGetOne(info, "", name, item, req.GetOptions, tw, hardlinkChecker, idMappings); err != nil {
+				symlinkTarget, err := getTargetIfSymlink(item, info)
+				if err != nil {
+					return fmt.Errorf("copier: get: %w", err)
+				}
+
+				if err := copierHandlerGetOne(info, symlinkTarget, name, item, req.GetOptions, tw, hardlinkChecker, idMappings); err != nil {
 					if req.GetOptions.IgnoreUnreadable && errorIsPermission(err) {
 						continue
 					}
@@ -1598,6 +1608,14 @@ func mapWithPrefixedKeysWithoutKeyPrefix[K any](m map[string]K, p string) map[st
 	return cloned
 }
 
+func getTargetIfSymlink(path string, info os.FileInfo) (string, error) {
+	if info.Mode()&os.ModeType == os.ModeSymlink {
+		return os.Readlink(path)
+	}
+
+	return "", nil
+}
+
 func copierHandlerGetOne(srcfi os.FileInfo, symlinkTarget, name, contentPath string, options GetOptions, tw *tar.Writer, hardlinkChecker *hardlinkChecker, idMappings *idtools.IDMappings) error {
 	// build the header using the name provided
 	hdr, err := tar.FileInfoHeader(srcfi, symlinkTarget)