diff --git a/cache/contenthash/checksum.go b/cache/contenthash/checksum.go
index 8962b28b2d118..cd36e9d53f360 100644
--- a/cache/contenthash/checksum.go
+++ b/cache/contenthash/checksum.go
@@ -372,8 +372,12 @@ func (cc *cacheContext) HandleChange(kind fsutil.ChangeKind, p string, fi os.Fil
 		ln := path.Join("/", filepath.ToSlash(stat.Linkname))
 		v, ok := cc.txn.Get(convertPathToKey([]byte(ln)))
 		if ok {
-			cp := *v.(*CacheRecord)
-			cr = &cp
+			cp := v.(*CacheRecord)
+			cr = &CacheRecord{
+				Digest:   cp.Digest,
+				Type:     cp.Type,
+				Linkname: cp.Linkname,
+			}
 		}
 		cc.linkMap[ln] = append(cc.linkMap[ln], k)
 	}
diff --git a/client/llb/definition.go b/client/llb/definition.go
index 9982ccf89a520..d7a8cf287bb6d 100644
--- a/client/llb/definition.go
+++ b/client/llb/definition.go
@@ -21,7 +21,7 @@ type DefinitionOp struct {
 	mu         sync.Mutex
 	ops        map[digest.Digest]*pb.Op
 	defs       map[digest.Digest][]byte
-	metas      map[digest.Digest]pb.OpMetadata
+	metas      map[digest.Digest]*pb.OpMetadata
 	sources    map[digest.Digest][]*SourceLocation
 	platforms  map[digest.Digest]*ocispecs.Platform
 	dgst       digest.Digest
@@ -101,7 +101,7 @@ func NewDefinitionOp(def *pb.Definition) (*DefinitionOp, error) {
 	return &DefinitionOp{
 		ops:        ops,
 		defs:       defs,
-		metas:      util.FromPointerMap[digest.Digest](def.Metadata),
+		metas:      util.FromStringMap[digest.Digest](def.Metadata),
 		sources:    srcs,
 		platforms:  platforms,
 		dgst:       dgst,
@@ -168,7 +168,7 @@ func (d *DefinitionOp) Marshal(ctx context.Context, c *Constraints) (digest.Dige
 	defer d.mu.Unlock()
 
 	meta := d.metas[d.dgst]
-	return d.dgst, d.defs[d.dgst], &meta, d.sources[d.dgst], nil
+	return d.dgst, d.defs[d.dgst], meta, d.sources[d.dgst], nil
 }
 
 func (d *DefinitionOp) Output() Output {
diff --git a/client/llb/fileop_test.go b/client/llb/fileop_test.go
index 7cbaf8e9186b2..bd6233ed9da0f 100644
--- a/client/llb/fileop_test.go
+++ b/client/llb/fileop_test.go
@@ -693,24 +693,24 @@ func TestFileCreatedTime(t *testing.T) {
 	require.Equal(t, dt3.UnixNano(), copy.Timestamp)
 }
 
-func parseDef(t *testing.T, def [][]byte) (map[digest.Digest]pb.Op, []pb.Op) {
-	m := map[digest.Digest]pb.Op{}
-	arr := make([]pb.Op, 0, len(def))
+func parseDef(t *testing.T, def [][]byte) (map[digest.Digest]*pb.Op, []*pb.Op) {
+	m := map[digest.Digest]*pb.Op{}
+	arr := make([]*pb.Op, 0, len(def))
 
 	for _, dt := range def {
 		var op pb.Op
 		err := proto.Unmarshal(dt, &op)
 		require.NoError(t, err)
 		dgst := digest.FromBytes(dt)
-		m[dgst] = op
-		arr = append(arr, op)
+		m[dgst] = &op
+		arr = append(arr, &op)
 		// fmt.Printf(":: %T %+v\n", op.Op, op)
 	}
 
 	return m, arr
 }
 
-func last(t *testing.T, arr []pb.Op) (digest.Digest, int) {
+func last(t *testing.T, arr []*pb.Op) (digest.Digest, int) {
 	require.True(t, len(arr) > 1)
 
 	op := arr[len(arr)-1]
diff --git a/client/llb/llbbuild/llbbuild.go b/client/llb/llbbuild/llbbuild.go
index f8c3993e27b6e..4fd84425798aa 100644
--- a/client/llb/llbbuild/llbbuild.go
+++ b/client/llb/llbbuild/llbbuild.go
@@ -62,6 +62,9 @@ func (b *build) Marshal(ctx context.Context, c *llb.Constraints) (digest.Digest,
 		pbo.Attrs[pb.AttrLLBDefinitionFilename] = b.info.DefinitionFilename
 	}
 
+	if b.constraints.Metadata == nil {
+		b.constraints.Metadata = &pb.OpMetadata{}
+	}
 	if b.constraints.Metadata.Caps == nil {
 		b.constraints.Metadata.Caps = make(map[string]bool)
 	}
diff --git a/client/llb/llbtest/platform_test.go b/client/llb/llbtest/platform_test.go
index 3df22f4a98467..4d4def7ecfd41 100644
--- a/client/llb/llbtest/platform_test.go
+++ b/client/llb/llbtest/platform_test.go
@@ -186,7 +186,7 @@ func toOp(e solver.Edge) *pb.Op {
 
 func platform(e solver.Edge) ocispecs.Platform {
 	op := toOp(e)
-	p := *op.Platform
+	p := op.Platform
 	return ocispecs.Platform{
 		OS:           p.OS,
 		Architecture: p.Architecture,
diff --git a/client/llb/marshal.go b/client/llb/marshal.go
index 06b9141b462e5..7fdac4cfea521 100644
--- a/client/llb/marshal.go
+++ b/client/llb/marshal.go
@@ -89,8 +89,8 @@ func MarshalConstraints(base, override *Constraints) (*pb.Op, *pb.OpMetadata) {
 	}
 
 	c.WorkerConstraints = append(c.WorkerConstraints, override.WorkerConstraints...)
-	md := mergeMetadata(&c.Metadata, &override.Metadata)
-	c.Metadata = *md
+	md := mergeMetadata(c.Metadata, override.Metadata)
+	c.Metadata = md
 
 	if c.Platform == nil {
 		defaultPlatform := platforms.Normalize(platforms.DefaultSpec())
@@ -112,7 +112,7 @@ func MarshalConstraints(base, override *Constraints) (*pb.Op, *pb.OpMetadata) {
 		Constraints: &pb.WorkerConstraints{
 			Filter: c.WorkerConstraints,
 		},
-	}, &c.Metadata
+	}, c.Metadata
 }
 
 type MarshalCache struct {
diff --git a/client/llb/meta.go b/client/llb/meta.go
index ab1021bd65f24..71b20aac710e8 100644
--- a/client/llb/meta.go
+++ b/client/llb/meta.go
@@ -261,7 +261,7 @@ func ulimit(name UlimitName, soft int64, hard int64) StateOption {
 			if err != nil {
 				return nil, err
 			}
-			return append(v, pb.Ulimit{
+			return append(v, &pb.Ulimit{
 				Name: string(name),
 				Soft: soft,
 				Hard: hard,
@@ -270,14 +270,14 @@ func ulimit(name UlimitName, soft int64, hard int64) StateOption {
 	}
 }
 
-func getUlimit(s State) func(context.Context, *Constraints) ([]pb.Ulimit, error) {
-	return func(ctx context.Context, c *Constraints) ([]pb.Ulimit, error) {
+func getUlimit(s State) func(context.Context, *Constraints) ([]*pb.Ulimit, error) {
+	return func(ctx context.Context, c *Constraints) ([]*pb.Ulimit, error) {
 		v, err := s.getValue(keyUlimit)(ctx, c)
 		if err != nil {
 			return nil, err
 		}
 		if v != nil {
-			return v.([]pb.Ulimit), nil
+			return v.([]*pb.Ulimit), nil
 		}
 		return nil, nil
 	}
diff --git a/client/llb/source.go b/client/llb/source.go
index c8108b15898fb..5deea8dff73d2 100644
--- a/client/llb/source.go
+++ b/client/llb/source.go
@@ -640,6 +640,9 @@ func platformSpecificSource(id string) bool {
 }
 
 func addCap(c *Constraints, id apicaps.CapID) {
+	if c.Metadata == nil {
+		c.Metadata = &pb.OpMetadata{}
+	}
 	if c.Metadata.Caps == nil {
 		c.Metadata.Caps = make(map[string]bool)
 	}
diff --git a/client/llb/state.go b/client/llb/state.go
index b7a0727985838..e1b656ab04737 100644
--- a/client/llb/state.go
+++ b/client/llb/state.go
@@ -567,6 +567,12 @@ func (fn constraintsOptFunc) SetGitOption(gi *GitInfo) {
 }
 
 func mergeMetadata(m1, m2 *pb.OpMetadata) *pb.OpMetadata {
+	if m1 == nil {
+		m1 = &pb.OpMetadata{}
+	}
+	if m2 == nil {
+		m2 = &pb.OpMetadata{}
+	}
 	if m2.IgnoreCache {
 		m1.IgnoreCache = true
 	}
@@ -597,11 +603,17 @@ func mergeMetadata(m1, m2 *pb.OpMetadata) *pb.OpMetadata {
 }
 
 var IgnoreCache = constraintsOptFunc(func(c *Constraints) {
+	if c.Metadata == nil {
+		c.Metadata = &pb.OpMetadata{}
+	}
 	c.Metadata.IgnoreCache = true
 })
 
 func WithDescription(m map[string]string) ConstraintsOpt {
 	return constraintsOptFunc(func(c *Constraints) {
+		if c.Metadata == nil {
+			c.Metadata = &pb.OpMetadata{}
+		}
 		if c.Metadata.Description == nil {
 			c.Metadata.Description = map[string]string{}
 		}
@@ -624,6 +636,9 @@ func WithCustomNamef(name string, a ...interface{}) ConstraintsOpt {
 // WithExportCache forces results for this vertex to be exported with the cache
 func WithExportCache() ConstraintsOpt {
 	return constraintsOptFunc(func(c *Constraints) {
+		if c.Metadata == nil {
+			c.Metadata = &pb.OpMetadata{}
+		}
 		c.Metadata.ExportCache = &pb.ExportCache{Value: true}
 	})
 }
@@ -632,6 +647,9 @@ func WithExportCache() ConstraintsOpt {
 // the cache
 func WithoutExportCache() ConstraintsOpt {
 	return constraintsOptFunc(func(c *Constraints) {
+		if c.Metadata == nil {
+			c.Metadata = &pb.OpMetadata{}
+		}
 		// ExportCache with value false means to disable exporting
 		c.Metadata.ExportCache = &pb.ExportCache{Value: false}
 	})
@@ -641,6 +659,9 @@ func WithoutExportCache() ConstraintsOpt {
 // the default defined by the build configuration.
 func WithoutDefaultExportCache() ConstraintsOpt {
 	return constraintsOptFunc(func(c *Constraints) {
+		if c.Metadata == nil {
+			c.Metadata = &pb.OpMetadata{}
+		}
 		// nil means no vertex based config has been set
 		c.Metadata.ExportCache = nil
 	})
@@ -664,7 +685,7 @@ func (cw *constraintsWrapper) applyConstraints(f func(c *Constraints)) {
 type Constraints struct {
 	Platform          *ocispecs.Platform
 	WorkerConstraints []string
-	Metadata          pb.OpMetadata
+	Metadata          *pb.OpMetadata
 	LocalUniqueID     string
 	Caps              *apicaps.CapSet
 	SourceLocations   []*SourceLocation
@@ -684,6 +705,9 @@ func LocalUniqueID(v string) ConstraintsOpt {
 
 func ProgressGroup(id, name string, weak bool) ConstraintsOpt {
 	return constraintsOptFunc(func(c *Constraints) {
+		if c.Metadata == nil {
+			c.Metadata = &pb.OpMetadata{}
+		}
 		c.Metadata.ProgressGroup = &pb.ProgressGroup{Id: id, Name: name, Weak: weak}
 	})
 }
diff --git a/client/workers.go b/client/workers.go
index 9057cb2cfceb5..b7f6f6725d901 100644
--- a/client/workers.go
+++ b/client/workers.go
@@ -7,7 +7,6 @@ import (
 	controlapi "github.com/moby/buildkit/api/services/control"
 	apitypes "github.com/moby/buildkit/api/types"
 	"github.com/moby/buildkit/solver/pb"
-	"github.com/moby/buildkit/util"
 	ocispecs "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/pkg/errors"
 )
@@ -40,7 +39,7 @@ func (c *Client) ListWorkers(ctx context.Context, opts ...ListWorkersOption) ([]
 		wi = append(wi, &WorkerInfo{
 			ID:              w.ID,
 			Labels:          w.Labels,
-			Platforms:       pb.ToSpecPlatforms(util.FromPointerSlice(w.Platforms)),
+			Platforms:       pb.ToSpecPlatforms(w.Platforms),
 			GCPolicy:        fromAPIGCPolicy(w.GCPolicy),
 			BuildkitVersion: fromAPIBuildkitVersion(w.BuildkitVersion),
 		})
diff --git a/cmd/buildctl/build.go b/cmd/buildctl/build.go
index 84ad33fb46490..3550b5b481d2a 100644
--- a/cmd/buildctl/build.go
+++ b/cmd/buildctl/build.go
@@ -134,9 +134,9 @@ func read(r io.Reader, clicontext *cli.Context) (*llb.Definition, error) {
 			if !ok {
 				opMetadata = &pb.OpMetadata{}
 			}
-			c := llb.Constraints{Metadata: *opMetadata}
+			c := llb.Constraints{Metadata: opMetadata}
 			llb.IgnoreCache(&c)
-			def.Metadata[dgst] = &c.Metadata
+			def.Metadata[dgst] = c.Metadata
 		}
 	}
 	return def, nil
diff --git a/cmd/buildctl/debug/dumpllb.go b/cmd/buildctl/debug/dumpllb.go
index 2d339c15b3c03..5b97cb79314ff 100644
--- a/cmd/buildctl/debug/dumpllb.go
+++ b/cmd/buildctl/debug/dumpllb.go
@@ -58,9 +58,9 @@ func dumpLLB(clicontext *cli.Context) error {
 }
 
 type llbOp struct {
-	Op         pb.Op
+	Op         *pb.Op
 	Digest     digest.Digest
-	OpMetadata pb.OpMetadata
+	OpMetadata *pb.OpMetadata
 }
 
 func loadLLB(r io.Reader) ([]llbOp, error) {
@@ -75,7 +75,7 @@ func loadLLB(r io.Reader) ([]llbOp, error) {
 			return nil, errors.Wrap(err, "failed to parse op")
 		}
 		dgst := digest.FromBytes(dt)
-		ent := llbOp{Op: op, Digest: dgst, OpMetadata: *def.Metadata[dgst]}
+		ent := llbOp{Op: &op, Digest: dgst, OpMetadata: def.Metadata[dgst]}
 		ops = append(ops, ent)
 	}
 	return ops, nil
@@ -104,7 +104,7 @@ func writeDot(ops []llbOp, w io.Writer) {
 	}
 }
 
-func attr(dgst digest.Digest, op pb.Op) (string, string) {
+func attr(dgst digest.Digest, op *pb.Op) (string, string) {
 	switch op := op.Op.(type) {
 	case *pb.Op_Source:
 		return op.Source.Identifier, "ellipse"
diff --git a/control/control.go b/control/control.go
index 3d59f4c5317ac..f031159dc8d87 100644
--- a/control/control.go
+++ b/control/control.go
@@ -542,7 +542,7 @@ func (c *Controller) ListWorkers(ctx context.Context, r *controlapi.ListWorkersR
 		resp.Record = append(resp.Record, &apitypes.WorkerRecord{
 			ID:              w.ID(),
 			Labels:          w.Labels(),
-			Platforms:       util.PointerSlice(pb.PlatformsFromSpec(w.Platforms(true))),
+			Platforms:       pb.PlatformsFromSpec(w.Platforms(true)),
 			GCPolicy:        toPBGCPolicy(w.GCPolicy()),
 			BuildkitVersion: toPBBuildkitVersion(w.BuildkitVersion()),
 		})
@@ -646,7 +646,7 @@ func findDuplicateCacheOptions(cacheOpts []*controlapi.CacheOptionsEntry) ([]*co
 	seen := map[string]*controlapi.CacheOptionsEntry{}
 	duplicate := map[string]struct{}{}
 	for _, opt := range cacheOpts {
-		k, err := cacheOptKey(*opt)
+		k, err := cacheOptKey(opt)
 		if err != nil {
 			return nil, err
 		}
@@ -663,7 +663,7 @@ func findDuplicateCacheOptions(cacheOpts []*controlapi.CacheOptionsEntry) ([]*co
 	return duplicates, nil
 }
 
-func cacheOptKey(opt controlapi.CacheOptionsEntry) (string, error) {
+func cacheOptKey(opt *controlapi.CacheOptionsEntry) (string, error) {
 	if opt.Type == "registry" && opt.Attrs["ref"] != "" {
 		return opt.Attrs["ref"], nil
 	}
diff --git a/exporter/local/fs.go b/exporter/local/fs.go
index b24d6aacda7a7..d3466ffb001a7 100644
--- a/exporter/local/fs.go
+++ b/exporter/local/fs.go
@@ -196,7 +196,7 @@ func CreateFS(ctx context.Context, sessionID string, k string, ref cache.Immutab
 			}
 			names[name] = struct{}{}
 
-			st := fstypes.Stat{
+			st := &fstypes.Stat{
 				Mode:    0600,
 				Path:    name,
 				ModTime: defaultTime.UnixNano(),
diff --git a/frontend/dockerfile/builder/build.go b/frontend/dockerfile/builder/build.go
index 7f8b8e4851dc9..80d3ba5600d1d 100644
--- a/frontend/dockerfile/builder/build.go
+++ b/frontend/dockerfile/builder/build.go
@@ -275,5 +275,5 @@ func wrapSource(err error, sm *llb.SourceMap, ranges []parser.Range) error {
 			},
 		})
 	}
-	return errdefs.WithSource(err, s)
+	return errdefs.WithSource(err, &s)
 }
diff --git a/frontend/dockerfile/dockerfile2llb/convert.go b/frontend/dockerfile/dockerfile2llb/convert.go
index 63a8a14a39a94..844a43c424a09 100644
--- a/frontend/dockerfile/dockerfile2llb/convert.go
+++ b/frontend/dockerfile/dockerfile2llb/convert.go
@@ -682,7 +682,7 @@ type dispatchOpt struct {
 	buildPlatforms    []ocispecs.Platform
 	extraHosts        []llb.HostIP
 	shmSize           int64
-	ulimit            []pb.Ulimit
+	ulimit            []*pb.Ulimit
 	cgroupParent      string
 	llbCaps           *apicaps.CapSet
 	sourceMap         *llb.SourceMap
diff --git a/frontend/dockerui/attr.go b/frontend/dockerui/attr.go
index 52ec012243ec4..326e7182b7616 100644
--- a/frontend/dockerui/attr.go
+++ b/frontend/dockerui/attr.go
@@ -75,11 +75,11 @@ func parseShmSize(v string) (int64, error) {
 	return kb, nil
 }
 
-func parseUlimits(v string) ([]pb.Ulimit, error) {
+func parseUlimits(v string) ([]*pb.Ulimit, error) {
 	if v == "" {
 		return nil, nil
 	}
-	out := make([]pb.Ulimit, 0)
+	out := make([]*pb.Ulimit, 0)
 	csvReader := csv.NewReader(strings.NewReader(v))
 	fields, err := csvReader.Read()
 	if err != nil {
@@ -90,7 +90,7 @@ func parseUlimits(v string) ([]pb.Ulimit, error) {
 		if err != nil {
 			return nil, err
 		}
-		out = append(out, pb.Ulimit{
+		out = append(out, &pb.Ulimit{
 			Name: ulimit.Name,
 			Soft: ulimit.Soft,
 			Hard: ulimit.Hard,
diff --git a/frontend/dockerui/config.go b/frontend/dockerui/config.go
index 1346679f30cc8..3c97a83e856fb 100644
--- a/frontend/dockerui/config.go
+++ b/frontend/dockerui/config.go
@@ -63,7 +63,7 @@ type Config struct {
 	NetworkMode      pb.NetMode
 	ShmSize          int64
 	Target           string
-	Ulimits          []pb.Ulimit
+	Ulimits          []*pb.Ulimit
 
 	CacheImports           []client.CacheOptionsEntry
 	TargetPlatforms        []ocispecs.Platform // nil means default
@@ -218,7 +218,7 @@ func (bc *Client) init() error {
 	var cacheImports []client.CacheOptionsEntry
 	// new API
 	if cacheImportsStr := opts[keyCacheImports]; cacheImportsStr != "" {
-		var cacheImportsUM []controlapi.CacheOptionsEntry
+		var cacheImportsUM []*controlapi.CacheOptionsEntry
 		if err := json.Unmarshal([]byte(cacheImportsStr), &cacheImportsUM); err != nil {
 			return errors.Wrapf(err, "failed to unmarshal %s (%q)", keyCacheImports, cacheImportsStr)
 		}
diff --git a/frontend/gateway/container/container.go b/frontend/gateway/container/container.go
index 77e47a2be1ee7..632a4b781b73d 100644
--- a/frontend/gateway/container/container.go
+++ b/frontend/gateway/container/container.go
@@ -50,12 +50,12 @@ type Mount struct {
 func NewContainer(ctx context.Context, w worker.Worker, sm *session.Manager, g session.Group, req NewContainerRequest) (client.Container, error) {
 	ctx, cancel := context.WithCancelCause(ctx)
 	eg, ctx := errgroup.WithContext(ctx)
-	platform := opspb.Platform{
+	platform := &opspb.Platform{
 		OS:           runtime.GOOS,
 		Architecture: runtime.GOARCH,
 	}
 	if req.Platform != nil {
-		platform = *req.Platform
+		platform = req.Platform
 	}
 	ctr := &gatewayContainer{
 		id:         req.ContainerID,
@@ -289,7 +289,7 @@ type gatewayContainer struct {
 	netMode    opspb.NetMode
 	hostname   string
 	extraHosts []executor.HostIP
-	platform   opspb.Platform
+	platform   *opspb.Platform
 	rootFS     executor.Mount
 	mounts     []executor.Mount
 	executor   executor.Executor
diff --git a/frontend/gateway/gateway.go b/frontend/gateway/gateway.go
index 04726ef762cfd..9a3d004384d05 100644
--- a/frontend/gateway/gateway.go
+++ b/frontend/gateway/gateway.go
@@ -38,7 +38,6 @@ import (
 	"github.com/moby/buildkit/solver/errdefs"
 	llberrdefs "github.com/moby/buildkit/solver/llbsolver/errdefs"
 	opspb "github.com/moby/buildkit/solver/pb"
-	"github.com/moby/buildkit/util"
 	"github.com/moby/buildkit/util/apicaps"
 	"github.com/moby/buildkit/util/bklog"
 	"github.com/moby/buildkit/util/grpcerrors"
@@ -901,7 +900,7 @@ func (lbf *llbBridgeForwarder) Ping(context.Context, *pb.PingRequest) (*pb.PongR
 		pbWorkers = append(pbWorkers, &apitypes.WorkerRecord{
 			ID:        w.ID,
 			Labels:    w.Labels,
-			Platforms: util.PointerSlice(opspb.PlatformsFromSpec(w.Platforms)),
+			Platforms: opspb.PlatformsFromSpec(w.Platforms),
 		})
 	}
 
diff --git a/solver/errdefs/fronetendcap.go b/solver/errdefs/fronetendcap.go
index aed3045bf17e1..72ee63682b658 100644
--- a/solver/errdefs/fronetendcap.go
+++ b/solver/errdefs/fronetendcap.go
@@ -12,7 +12,7 @@ func init() {
 }
 
 type UnsupportedFrontendCapError struct {
-	FrontendCap
+	*FrontendCap
 	error
 }
 
@@ -29,13 +29,13 @@ func (e *UnsupportedFrontendCapError) Unwrap() error {
 }
 
 func (e *UnsupportedFrontendCapError) ToProto() grpcerrors.TypedErrorProto {
-	return &e.FrontendCap
+	return e.FrontendCap
 }
 
 func NewUnsupportedFrontendCapError(name string) error {
-	return &UnsupportedFrontendCapError{FrontendCap: FrontendCap{Name: name}}
+	return &UnsupportedFrontendCapError{FrontendCap: &FrontendCap{Name: name}}
 }
 
 func (v *FrontendCap) WrapError(err error) error {
-	return &UnsupportedFrontendCapError{error: err, FrontendCap: *v}
+	return &UnsupportedFrontendCapError{error: err, FrontendCap: v}
 }
diff --git a/solver/errdefs/solve.go b/solver/errdefs/solve.go
index d7b9e7799aa83..46e64e26282a3 100644
--- a/solver/errdefs/solve.go
+++ b/solver/errdefs/solve.go
@@ -20,7 +20,7 @@ type IsSolve_Subject isSolve_Subject
 // SolveError will be returned when an error is encountered during a solve that
 // has an exec op.
 type SolveError struct {
-	Solve
+	*Solve
 	Err error
 }
 
@@ -33,7 +33,7 @@ func (e *SolveError) Unwrap() error {
 }
 
 func (e *SolveError) ToProto() grpcerrors.TypedErrorProto {
-	return &e.Solve
+	return e.Solve
 }
 
 func WithSolveError(err error, subject IsSolve_Subject, inputIDs, mountIDs []string) error {
@@ -49,7 +49,7 @@ func WithSolveError(err error, subject IsSolve_Subject, inputIDs, mountIDs []str
 	}
 	return &SolveError{
 		Err: err,
-		Solve: Solve{
+		Solve: &Solve{
 			InputIDs: inputIDs,
 			MountIDs: mountIDs,
 			Op:       op,
@@ -59,7 +59,7 @@ func WithSolveError(err error, subject IsSolve_Subject, inputIDs, mountIDs []str
 }
 
 func (v *Solve) WrapError(err error) error {
-	return &SolveError{Err: err, Solve: *v}
+	return &SolveError{Err: err, Solve: v}
 }
 
 func (v *Solve) MarshalJSON() ([]byte, error) {
diff --git a/solver/errdefs/source.go b/solver/errdefs/source.go
index 6c1f364957321..3ee6337f8c849 100644
--- a/solver/errdefs/source.go
+++ b/solver/errdefs/source.go
@@ -10,7 +10,7 @@ import (
 	"github.com/pkg/errors"
 )
 
-func WithSource(err error, src Source) error {
+func WithSource(err error, src *Source) error {
 	if err == nil {
 		return nil
 	}
@@ -18,7 +18,7 @@ func WithSource(err error, src Source) error {
 }
 
 type ErrorSource struct {
-	Source
+	*Source
 	error
 }
 
@@ -27,7 +27,7 @@ func (e *ErrorSource) Unwrap() error {
 }
 
 func (e *ErrorSource) ToProto() grpcerrors.TypedErrorProto {
-	return &e.Source
+	return e.Source
 }
 
 func Sources(err error) []*Source {
@@ -35,13 +35,13 @@ func Sources(err error) []*Source {
 	var es *ErrorSource
 	if errors.As(err, &es) {
 		out = Sources(es.Unwrap())
-		out = append(out, &es.Source)
+		out = append(out, es.Source)
 	}
 	return out
 }
 
 func (s *Source) WrapError(err error) error {
-	return &ErrorSource{error: err, Source: *s}
+	return &ErrorSource{error: err, Source: s}
 }
 
 func (s *Source) Print(w io.Writer) error {
diff --git a/solver/errdefs/subrequest.go b/solver/errdefs/subrequest.go
index 8527f2a791fd2..0fba51d3c2cb7 100644
--- a/solver/errdefs/subrequest.go
+++ b/solver/errdefs/subrequest.go
@@ -12,7 +12,7 @@ func init() {
 }
 
 type UnsupportedSubrequestError struct {
-	Subrequest
+	*Subrequest
 	error
 }
 
@@ -29,13 +29,13 @@ func (e *UnsupportedSubrequestError) Unwrap() error {
 }
 
 func (e *UnsupportedSubrequestError) ToProto() grpcerrors.TypedErrorProto {
-	return &e.Subrequest
+	return e.Subrequest
 }
 
 func NewUnsupportedSubrequestError(name string) error {
-	return &UnsupportedSubrequestError{Subrequest: Subrequest{Name: name}}
+	return &UnsupportedSubrequestError{Subrequest: &Subrequest{Name: name}}
 }
 
 func (v *Subrequest) WrapError(err error) error {
-	return &UnsupportedSubrequestError{error: err, Subrequest: *v}
+	return &UnsupportedSubrequestError{error: err, Subrequest: v}
 }
diff --git a/solver/errdefs/vertex.go b/solver/errdefs/vertex.go
index 5c2e03d13343a..41df15a6dce50 100644
--- a/solver/errdefs/vertex.go
+++ b/solver/errdefs/vertex.go
@@ -12,7 +12,7 @@ func init() {
 }
 
 type VertexError struct {
-	Vertex
+	*Vertex
 	error
 }
 
@@ -21,16 +21,16 @@ func (e *VertexError) Unwrap() error {
 }
 
 func (e *VertexError) ToProto() grpcerrors.TypedErrorProto {
-	return &e.Vertex
+	return e.Vertex
 }
 
 func WrapVertex(err error, dgst digest.Digest) error {
 	if err == nil {
 		return nil
 	}
-	return &VertexError{Vertex: Vertex{Digest: dgst.String()}, error: err}
+	return &VertexError{Vertex: &Vertex{Digest: dgst.String()}, error: err}
 }
 
 func (v *Vertex) WrapError(err error) error {
-	return &VertexError{error: err, Vertex: *v}
+	return &VertexError{error: err, Vertex: v}
 }
diff --git a/solver/llbsolver/bridge.go b/solver/llbsolver/bridge.go
index 27dc133620f3b..8281e492c522c 100644
--- a/solver/llbsolver/bridge.go
+++ b/solver/llbsolver/bridge.go
@@ -215,7 +215,7 @@ func (rp *resultProxy) wrapError(err error) error {
 			locs, ok := rp.req.Definition.Source.Locations[string(ve.Digest)]
 			if ok {
 				for _, loc := range locs.Locations {
-					err = errdefs.WithSource(err, errdefs.Source{
+					err = errdefs.WithSource(err, &errdefs.Source{
 						Info:   rp.req.Definition.Source.Infos[loc.SourceIndex],
 						Ranges: loc.Ranges,
 					})
diff --git a/solver/llbsolver/file/backend.go b/solver/llbsolver/file/backend.go
index 311fc5043d356..3877ad5927002 100644
--- a/solver/llbsolver/file/backend.go
+++ b/solver/llbsolver/file/backend.go
@@ -27,7 +27,7 @@ func timestampToTime(ts int64) *time.Time {
 	return &tm
 }
 
-func mkdir(ctx context.Context, d string, action pb.FileActionMkDir, user *copy.User, idmap *idtools.IdentityMapping) error {
+func mkdir(ctx context.Context, d string, action *pb.FileActionMkDir, user *copy.User, idmap *idtools.IdentityMapping) error {
 	p, err := fs.RootPath(d, action.Path)
 	if err != nil {
 		return err
@@ -60,7 +60,7 @@ func mkdir(ctx context.Context, d string, action pb.FileActionMkDir, user *copy.
 	return nil
 }
 
-func mkfile(ctx context.Context, d string, action pb.FileActionMkFile, user *copy.User, idmap *idtools.IdentityMapping) error {
+func mkfile(ctx context.Context, d string, action *pb.FileActionMkFile, user *copy.User, idmap *idtools.IdentityMapping) error {
 	p, err := fs.RootPath(d, filepath.Join("/", action.Path))
 	if err != nil {
 		return err
@@ -86,7 +86,7 @@ func mkfile(ctx context.Context, d string, action pb.FileActionMkFile, user *cop
 	return nil
 }
 
-func rm(ctx context.Context, d string, action pb.FileActionRm) error {
+func rm(ctx context.Context, d string, action *pb.FileActionRm) error {
 	if action.AllowWildcard {
 		src, err := cleanPath(action.Path)
 		if err != nil {
@@ -132,7 +132,7 @@ func rmPath(root, src string, allowNotFound bool) error {
 	return os.RemoveAll(p)
 }
 
-func docopy(ctx context.Context, src, dest string, action pb.FileActionCopy, u *copy.User, idmap *idtools.IdentityMapping) error {
+func docopy(ctx context.Context, src, dest string, action *pb.FileActionCopy, u *copy.User, idmap *idtools.IdentityMapping) error {
 	srcPath, err := cleanPath(action.Src)
 	if err != nil {
 		return errors.Wrap(err, "cleaning source path")
@@ -227,7 +227,7 @@ type Backend struct {
 	readUser ReadUserCallback
 }
 
-func (fb *Backend) Mkdir(ctx context.Context, m, user, group fileoptypes.Mount, action pb.FileActionMkDir) error {
+func (fb *Backend) Mkdir(ctx context.Context, m, user, group fileoptypes.Mount, action *pb.FileActionMkDir) error {
 	mnt, ok := m.(*Mount)
 	if !ok {
 		return errors.Errorf("invalid mount type %T", m)
@@ -248,7 +248,7 @@ func (fb *Backend) Mkdir(ctx context.Context, m, user, group fileoptypes.Mount,
 	return mkdir(ctx, dir, action, u, mnt.m.IdentityMapping())
 }
 
-func (fb *Backend) Mkfile(ctx context.Context, m, user, group fileoptypes.Mount, action pb.FileActionMkFile) error {
+func (fb *Backend) Mkfile(ctx context.Context, m, user, group fileoptypes.Mount, action *pb.FileActionMkFile) error {
 	mnt, ok := m.(*Mount)
 	if !ok {
 		return errors.Errorf("invalid mount type %T", m)
@@ -269,7 +269,7 @@ func (fb *Backend) Mkfile(ctx context.Context, m, user, group fileoptypes.Mount,
 	return mkfile(ctx, dir, action, u, mnt.m.IdentityMapping())
 }
 
-func (fb *Backend) Rm(ctx context.Context, m fileoptypes.Mount, action pb.FileActionRm) error {
+func (fb *Backend) Rm(ctx context.Context, m fileoptypes.Mount, action *pb.FileActionRm) error {
 	mnt, ok := m.(*Mount)
 	if !ok {
 		return errors.Errorf("invalid mount type %T", m)
@@ -285,7 +285,7 @@ func (fb *Backend) Rm(ctx context.Context, m fileoptypes.Mount, action pb.FileAc
 	return rm(ctx, dir, action)
 }
 
-func (fb *Backend) Copy(ctx context.Context, m1, m2, user, group fileoptypes.Mount, action pb.FileActionCopy) error {
+func (fb *Backend) Copy(ctx context.Context, m1, m2, user, group fileoptypes.Mount, action *pb.FileActionCopy) error {
 	mnt1, ok := m1.(*Mount)
 	if !ok {
 		return errors.Errorf("invalid mount type %T", m1)
diff --git a/solver/llbsolver/history.go b/solver/llbsolver/history.go
index 73b4fef3e91b8..a89d68509294b 100644
--- a/solver/llbsolver/history.go
+++ b/solver/llbsolver/history.go
@@ -418,7 +418,7 @@ func (h *HistoryQueue) UpdateRef(ctx context.Context, ref string, upt func(r *co
 		return errors.Errorf("invalid ref change")
 	}
 
-	if err := h.update(ctx, br); err != nil {
+	if err := h.update(ctx, &br); err != nil {
 		return err
 	}
 	h.ps.Send(&controlapi.BuildHistoryEvent{
@@ -493,13 +493,13 @@ func (h *HistoryQueue) Status(ctx context.Context, ref string, st chan<- *client
 	return nil
 }
 
-func (h *HistoryQueue) update(ctx context.Context, rec controlapi.BuildHistoryRecord) error {
+func (h *HistoryQueue) update(ctx context.Context, rec *controlapi.BuildHistoryRecord) error {
 	return h.opt.DB.Update(func(tx *bolt.Tx) (err error) {
 		b := tx.Bucket([]byte(recordsBucket))
 		if b == nil {
 			return nil
 		}
-		dt, err := proto.Marshal(&rec)
+		dt, err := proto.Marshal(rec)
 		if err != nil {
 			return err
 		}
@@ -573,7 +573,7 @@ func (h *HistoryQueue) Update(ctx context.Context, e *controlapi.BuildHistoryEve
 
 	if e.Type == controlapi.BuildHistoryEventType_COMPLETE {
 		delete(h.active, e.Record.Ref)
-		if err := h.update(ctx, *e.Record); err != nil {
+		if err := h.update(ctx, e.Record); err != nil {
 			return err
 		}
 		h.ps.Send(e)
diff --git a/solver/llbsolver/mounts/mount.go b/solver/llbsolver/mounts/mount.go
index ffd92ab7f62f4..4056a6ed9f0ac 100644
--- a/solver/llbsolver/mounts/mount.go
+++ b/solver/llbsolver/mounts/mount.go
@@ -251,7 +251,7 @@ func (mm *MountManager) getSecretMountable(ctx context.Context, m *pb.Mount, g s
 	if m.SecretOpt == nil {
 		return nil, errors.Errorf("invalid secret mount options")
 	}
-	sopt := *m.SecretOpt
+	sopt := m.SecretOpt
 
 	id := sopt.ID
 	if id == "" {
diff --git a/solver/llbsolver/ops/exec.go b/solver/llbsolver/ops/exec.go
index 123e443abfc1a..189dc946fdaeb 100644
--- a/solver/llbsolver/ops/exec.go
+++ b/solver/llbsolver/ops/exec.go
@@ -31,6 +31,7 @@ import (
 	"github.com/pkg/errors"
 	"go.opentelemetry.io/otel/trace"
 	"golang.org/x/sync/semaphore"
+	"google.golang.org/protobuf/proto"
 )
 
 const execCacheType = "buildkit.exec.v0"
@@ -78,20 +79,8 @@ func (e *ExecOp) Proto() *pb.ExecOp {
 	return e.op
 }
 
-func cloneExecOp(old *pb.ExecOp) pb.ExecOp {
-	n := *old
-	meta := *n.Meta
-	meta.ExtraHosts = nil
-	for i := range n.Meta.ExtraHosts {
-		h := *n.Meta.ExtraHosts[i]
-		meta.ExtraHosts = append(meta.ExtraHosts, &h)
-	}
-	n.Meta = &meta
-	n.Mounts = nil
-	for i := range old.Mounts {
-		m := *old.Mounts[i]
-		n.Mounts = append(n.Mounts, &m)
-	}
+func cloneExecOp(old *pb.ExecOp) *pb.ExecOp {
+	n, _ := proto.Clone(old).(*pb.ExecOp)
 	return n
 }
 
@@ -144,7 +133,7 @@ func (e *ExecOp) CacheMap(ctx context.Context, g session.Group, index int) (*sol
 		OSFeatures []string `json:",omitempty"`
 	}{
 		Type:       execCacheType,
-		Exec:       &op,
+		Exec:       op,
 		OS:         p.OS,
 		Arch:       p.Architecture,
 		Variant:    p.Variant,
diff --git a/solver/llbsolver/ops/file.go b/solver/llbsolver/ops/file.go
index 46572461e143d..9771c5601eb7c 100644
--- a/solver/llbsolver/ops/file.go
+++ b/solver/llbsolver/ops/file.go
@@ -24,6 +24,7 @@ import (
 	"github.com/pkg/errors"
 	"golang.org/x/sync/errgroup"
 	"golang.org/x/sync/semaphore"
+	"google.golang.org/protobuf/proto"
 )
 
 const fileCacheType = "buildkit.file.v0"
@@ -69,7 +70,7 @@ func (f *fileOp) CacheMap(ctx context.Context, g session.Group, index int) (*sol
 		var err error
 		switch a := action.Action.(type) {
 		case *pb.FileAction_Mkdir:
-			p := *a.Mkdir
+			p := a.Mkdir
 			markInvalid(pb.InputIndex(action.Input))
 			processOwner(p.Owner, selectors)
 			dt, err = json.Marshal(p)
@@ -77,7 +78,7 @@ func (f *fileOp) CacheMap(ctx context.Context, g session.Group, index int) (*sol
 				return nil, false, err
 			}
 		case *pb.FileAction_Mkfile:
-			p := *a.Mkfile
+			p := a.Mkfile
 			markInvalid(pb.InputIndex(action.Input))
 			processOwner(p.Owner, selectors)
 			dt, err = json.Marshal(p)
@@ -85,19 +86,18 @@ func (f *fileOp) CacheMap(ctx context.Context, g session.Group, index int) (*sol
 				return nil, false, err
 			}
 		case *pb.FileAction_Rm:
-			p := *a.Rm
 			markInvalid(pb.InputIndex(action.Input))
-			dt, err = json.Marshal(p)
+			dt, err = json.Marshal(a.Rm)
 			if err != nil {
 				return nil, false, err
 			}
 		case *pb.FileAction_Copy:
-			p := *a.Copy
+			p := proto.Clone(a.Copy).(*pb.FileActionCopy)
 			markInvalid(pb.InputIndex(action.Input))
 			processOwner(p.Owner, selectors)
 			if action.SecondaryInput != -1 && int(action.SecondaryInput) < f.numInputs {
 				addSelector(selectors, int(action.SecondaryInput), p.Src, p.AllowWildcard, p.FollowSymlink, p.IncludePatterns, p.ExcludePatterns)
-				p.Src = path.Base(p.Src)
+				p.Src = path.Base(p.Src) // p must be copied because of this
 			}
 			dt, err = json.Marshal(p)
 			if err != nil {
@@ -260,6 +260,7 @@ func dedupeSelectors(m []opsutils.Selector) []opsutils.Selector {
 	return selectors
 }
 
+// processOwner processes the ChownOpt to update selectors.
 func processOwner(chopt *pb.ChownOpt, selectors map[int][]opsutils.Selector) error {
 	if chopt == nil {
 		return nil
@@ -581,7 +582,7 @@ func (s *FileOpSolver) getInput(ctx context.Context, idx int, inputs []fileoptyp
 			if err != nil {
 				return input{}, err
 			}
-			if err := s.b.Mkdir(ctx, inpMount, user, group, *a.Mkdir); err != nil {
+			if err := s.b.Mkdir(ctx, inpMount, user, group, a.Mkdir); err != nil {
 				return input{}, err
 			}
 		case *pb.FileAction_Mkfile:
@@ -589,11 +590,11 @@ func (s *FileOpSolver) getInput(ctx context.Context, idx int, inputs []fileoptyp
 			if err != nil {
 				return input{}, err
 			}
-			if err := s.b.Mkfile(ctx, inpMount, user, group, *a.Mkfile); err != nil {
+			if err := s.b.Mkfile(ctx, inpMount, user, group, a.Mkfile); err != nil {
 				return input{}, err
 			}
 		case *pb.FileAction_Rm:
-			if err := s.b.Rm(ctx, inpMount, *a.Rm); err != nil {
+			if err := s.b.Rm(ctx, inpMount, a.Rm); err != nil {
 				return input{}, err
 			}
 		case *pb.FileAction_Copy:
@@ -608,7 +609,7 @@ func (s *FileOpSolver) getInput(ctx context.Context, idx int, inputs []fileoptyp
 			if err != nil {
 				return input{}, err
 			}
-			if err := s.b.Copy(ctx, inpMountSecondary, inpMount, user, group, *a.Copy); err != nil {
+			if err := s.b.Copy(ctx, inpMountSecondary, inpMount, user, group, a.Copy); err != nil {
 				return input{}, err
 			}
 		default:
diff --git a/solver/llbsolver/ops/file_test.go b/solver/llbsolver/ops/file_test.go
index 7ddec3d436acb..9bc3b24ae02ac 100644
--- a/solver/llbsolver/ops/file_test.go
+++ b/solver/llbsolver/ops/file_test.go
@@ -625,36 +625,36 @@ func (tm *testMount) Readonly() bool {
 type testFileBackend struct {
 }
 
-func (b *testFileBackend) Mkdir(_ context.Context, m, user, group fileoptypes.Mount, a pb.FileActionMkDir) error {
+func (b *testFileBackend) Mkdir(_ context.Context, m, user, group fileoptypes.Mount, a *pb.FileActionMkDir) error {
 	mm := m.(*testMount)
 	if mm.callback != nil {
 		mm.callback()
 	}
 	mm.id += "-mkdir"
 	mm.addUser(user, group)
-	mm.chain = append(mm.chain, mod{mkdir: &a})
+	mm.chain = append(mm.chain, mod{mkdir: a})
 	return nil
 }
 
-func (b *testFileBackend) Mkfile(_ context.Context, m, user, group fileoptypes.Mount, a pb.FileActionMkFile) error {
+func (b *testFileBackend) Mkfile(_ context.Context, m, user, group fileoptypes.Mount, a *pb.FileActionMkFile) error {
 	mm := m.(*testMount)
 	mm.id += "-mkfile"
 	mm.addUser(user, group)
-	mm.chain = append(mm.chain, mod{mkfile: &a})
+	mm.chain = append(mm.chain, mod{mkfile: a})
 	return nil
 }
-func (b *testFileBackend) Rm(_ context.Context, m fileoptypes.Mount, a pb.FileActionRm) error {
+func (b *testFileBackend) Rm(_ context.Context, m fileoptypes.Mount, a *pb.FileActionRm) error {
 	mm := m.(*testMount)
 	mm.id += "-rm"
-	mm.chain = append(mm.chain, mod{rm: &a})
+	mm.chain = append(mm.chain, mod{rm: a})
 	return nil
 }
-func (b *testFileBackend) Copy(_ context.Context, m1, m, user, group fileoptypes.Mount, a pb.FileActionCopy) error {
+func (b *testFileBackend) Copy(_ context.Context, m1, m, user, group fileoptypes.Mount, a *pb.FileActionCopy) error {
 	mm := m.(*testMount)
 	mm1 := m1.(*testMount)
 	mm.id += "-copy(" + mm1.id + ")"
 	mm.addUser(user, group)
-	mm.chain = append(mm.chain, mod{copy: &a, copySrc: mm1.chain})
+	mm.chain = append(mm.chain, mod{copy: a, copySrc: mm1.chain})
 	return nil
 }
 
diff --git a/solver/llbsolver/ops/fileoptypes/types.go b/solver/llbsolver/ops/fileoptypes/types.go
index 3ceaaf35a9382..bc35a07d97e4b 100644
--- a/solver/llbsolver/ops/fileoptypes/types.go
+++ b/solver/llbsolver/ops/fileoptypes/types.go
@@ -18,10 +18,10 @@ type Mount interface {
 }
 
 type Backend interface {
-	Mkdir(context.Context, Mount, Mount, Mount, pb.FileActionMkDir) error
-	Mkfile(context.Context, Mount, Mount, Mount, pb.FileActionMkFile) error
-	Rm(context.Context, Mount, pb.FileActionRm) error
-	Copy(context.Context, Mount, Mount, Mount, Mount, pb.FileActionCopy) error
+	Mkdir(context.Context, Mount, Mount, Mount, *pb.FileActionMkDir) error
+	Mkfile(context.Context, Mount, Mount, Mount, *pb.FileActionMkFile) error
+	Rm(context.Context, Mount, *pb.FileActionRm) error
+	Copy(context.Context, Mount, Mount, Mount, Mount, *pb.FileActionCopy) error
 }
 
 type RefManager interface {
diff --git a/solver/llbsolver/provenance.go b/solver/llbsolver/provenance.go
index b692866e16b49..fe6f902efad13 100644
--- a/solver/llbsolver/provenance.go
+++ b/solver/llbsolver/provenance.go
@@ -659,7 +659,7 @@ func toBuildSteps(def *pb.Definition, c *provenance.Capture, withUsage bool) ([]
 
 	out := make([]provenance.BuildStep, 0, len(dgsts))
 	for i, dgst := range dgsts {
-		op := *ops[dgst]
+		op := ops[dgst]
 		inputs := make([]string, len(op.Inputs))
 		for i, inp := range op.Inputs {
 			inputs[i] = fmt.Sprintf("step%d:%d", indexes[digest.Digest(inp.Digest)], inp.Index)
diff --git a/solver/llbsolver/provenance/buildconfig.go b/solver/llbsolver/provenance/buildconfig.go
index 362273029832b..27aec4933217f 100644
--- a/solver/llbsolver/provenance/buildconfig.go
+++ b/solver/llbsolver/provenance/buildconfig.go
@@ -13,7 +13,7 @@ type BuildConfig struct {
 
 type BuildStep struct {
 	ID            string                  `json:"id,omitempty"`
-	Op            pb.Op                   `json:"op,omitempty"`
+	Op            *pb.Op                  `json:"op,omitempty"`
 	Inputs        []string                `json:"inputs,omitempty"`
 	ResourceUsage *resourcestypes.Samples `json:"resourceUsage,omitempty"`
 }
diff --git a/solver/llbsolver/solver.go b/solver/llbsolver/solver.go
index fe4eee2ffa3d6..66935b817908a 100644
--- a/solver/llbsolver/solver.go
+++ b/solver/llbsolver/solver.go
@@ -44,6 +44,7 @@ import (
 	"golang.org/x/sync/errgroup"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
@@ -470,7 +471,7 @@ func (s *Solver) Solve(ctx context.Context, id string, sessionID string, req fro
 	j.SetValue(keyEntitlements, set)
 
 	if srcPol != nil {
-		j.SetValue(keySourcePolicy, *srcPol)
+		j.SetValue(keySourcePolicy, srcPol)
 	}
 
 	j.SessionID = sessionID
@@ -1026,13 +1027,13 @@ func loadEntitlements(b solver.Builder) (entitlements.Set, error) {
 func loadSourcePolicy(b solver.Builder) (*spb.Policy, error) {
 	var srcPol spb.Policy
 	err := b.EachValue(context.TODO(), keySourcePolicy, func(v interface{}) error {
-		x, ok := v.(spb.Policy)
+		x, ok := v.(*spb.Policy)
 		if !ok {
 			return errors.Errorf("invalid source policy %T", v)
 		}
 		for _, f := range x.Rules {
-			r := *f
-			srcPol.Rules = append(srcPol.Rules, &r)
+			r := proto.Clone(f).(*spb.Rule)
+			srcPol.Rules = append(srcPol.Rules, r)
 		}
 		srcPol.Version = x.Version
 		return nil
diff --git a/solver/pb/platform.go b/solver/pb/platform.go
index 00473a5b324bf..81c999c8fe92a 100644
--- a/solver/pb/platform.go
+++ b/solver/pb/platform.go
@@ -17,7 +17,7 @@ func (p *Platform) Spec() ocispecs.Platform {
 	return result
 }
 
-func PlatformFromSpec(p ocispecs.Platform) Platform {
+func PlatformFromSpec(p ocispecs.Platform) *Platform {
 	result := Platform{
 		OS:           p.OS,
 		Architecture: p.Architecture,
@@ -27,10 +27,10 @@ func PlatformFromSpec(p ocispecs.Platform) Platform {
 	if p.OSFeatures != nil {
 		result.OSFeatures = append([]string{}, p.OSFeatures...)
 	}
-	return result
+	return &result
 }
 
-func ToSpecPlatforms(p []Platform) []ocispecs.Platform {
+func ToSpecPlatforms(p []*Platform) []ocispecs.Platform {
 	out := make([]ocispecs.Platform, 0, len(p))
 	for _, pp := range p {
 		out = append(out, pp.Spec())
@@ -38,8 +38,8 @@ func ToSpecPlatforms(p []Platform) []ocispecs.Platform {
 	return out
 }
 
-func PlatformsFromSpec(p []ocispecs.Platform) []Platform {
-	out := make([]Platform, 0, len(p))
+func PlatformsFromSpec(p []ocispecs.Platform) []*Platform {
+	out := make([]*Platform, 0, len(p))
 	for _, pp := range p {
 		out = append(out, PlatformFromSpec(pp))
 	}
diff --git a/sourcepolicy/engine.go b/sourcepolicy/engine.go
index 8515b276a416c..f0cff4bdc8a84 100644
--- a/sourcepolicy/engine.go
+++ b/sourcepolicy/engine.go
@@ -79,7 +79,7 @@ func (e *Engine) Evaluate(ctx context.Context, op *pb.Op) (bool, error) {
 			return false, nil
 		}
 		if i == 0 {
-			ctx = bklog.WithLogger(ctx, bklog.G(ctx).WithField("orig", *srcOp).WithField("updated", op.GetSource()))
+			ctx = bklog.WithLogger(ctx, bklog.G(ctx).WithField("orig", srcOp).WithField("updated", op.GetSource()))
 		}
 
 		mut, err := e.evaluatePolicies(ctx, srcOp)
diff --git a/sourcepolicy/matcher_test.go b/sourcepolicy/matcher_test.go
index 442ecd5090068..c2591d44af3a6 100644
--- a/sourcepolicy/matcher_test.go
+++ b/sourcepolicy/matcher_test.go
@@ -11,7 +11,7 @@ import (
 func TestMatch(t *testing.T) {
 	type testCase struct {
 		name    string
-		src     spb.Selector
+		src     *spb.Selector
 		ref     string
 		attrs   map[string]string
 		matches bool
@@ -21,43 +21,43 @@ func TestMatch(t *testing.T) {
 	cases := []testCase{
 		{
 			name:    "basic exact match",
-			src:     spb.Selector{Identifier: "docker-image://docker.io/library/busybox:1.34.1-uclibc"},
+			src:     &spb.Selector{Identifier: "docker-image://docker.io/library/busybox:1.34.1-uclibc"},
 			ref:     "docker-image://docker.io/library/busybox:1.34.1-uclibc",
 			matches: true,
 		},
 		{
 			name:    "docker-image scheme matches with only wildcard",
-			src:     spb.Selector{Identifier: "*"},
+			src:     &spb.Selector{Identifier: "*"},
 			ref:     "docker-image://docker.io/library/busybox:latest",
 			matches: true,
 		},
 		{
 			name:    "docker-image scheme matches with wildcard",
-			src:     spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*"},
+			src:     &spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*"},
 			ref:     "docker-image://docker.io/library/busybox:latest",
 			matches: true,
 		},
 		{
 			name:    "mis-matching scheme does not match",
-			src:     spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*"},
+			src:     &spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*"},
 			ref:     "http://docker.io/library/busybox:latest",
 			matches: false,
 		},
 		{
 			name:    "http scheme matches with wildcard",
-			src:     spb.Selector{Identifier: "http://docker.io/library/busybox:*"},
+			src:     &spb.Selector{Identifier: "http://docker.io/library/busybox:*"},
 			ref:     "http://docker.io/library/busybox:latest",
 			matches: true,
 		},
 		{
 			name:    "http scheme matches https URL",
-			src:     spb.Selector{Identifier: "https://docker.io/library/busybox:*"},
+			src:     &spb.Selector{Identifier: "https://docker.io/library/busybox:*"},
 			ref:     "https://docker.io/library/busybox:latest",
 			matches: true,
 		},
 		{
 			name: "attr match with default constraint (equals) matches",
-			src: spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
+			src: &spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
 				Constraints: []*spb.AttrConstraint{
 					{
 						Key:   "foo",
@@ -72,7 +72,7 @@ func TestMatch(t *testing.T) {
 		},
 		{
 			name: "attr match with default constraint (equals) does not match",
-			src: spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
+			src: &spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
 				Constraints: []*spb.AttrConstraint{
 					{
 						Key:   "foo",
@@ -87,7 +87,7 @@ func TestMatch(t *testing.T) {
 		},
 		{
 			name: "attr match with explicit equals matches",
-			src: spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
+			src: &spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
 				Constraints: []*spb.AttrConstraint{
 					{
 						Key:       "foo",
@@ -102,7 +102,7 @@ func TestMatch(t *testing.T) {
 		},
 		{
 			name: "attr match with explicit equals does not match",
-			src: spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
+			src: &spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
 				Constraints: []*spb.AttrConstraint{
 					{
 						Key:       "foo",
@@ -117,7 +117,7 @@ func TestMatch(t *testing.T) {
 		},
 		{
 			name: "attr match not equal does not match",
-			src: spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
+			src: &spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
 				Constraints: []*spb.AttrConstraint{
 					{
 						Key:       "foo",
@@ -132,7 +132,7 @@ func TestMatch(t *testing.T) {
 		},
 		{
 			name: "attr match not equal does match",
-			src: spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
+			src: &spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
 				Constraints: []*spb.AttrConstraint{
 					{
 						Key:       "foo",
@@ -147,7 +147,7 @@ func TestMatch(t *testing.T) {
 		},
 		{
 			name: "matching attach match with simple strings",
-			src: spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
+			src: &spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
 				Constraints: []*spb.AttrConstraint{
 					{
 						Key:       "foo",
@@ -162,7 +162,7 @@ func TestMatch(t *testing.T) {
 		},
 		{
 			name: "non-matching attr match constraint simple strings",
-			src: spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
+			src: &spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
 				Constraints: []*spb.AttrConstraint{
 					{
 						Key:       "foo",
@@ -177,7 +177,7 @@ func TestMatch(t *testing.T) {
 		},
 		{
 			name: "complex regex attr match",
-			src: spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
+			src: &spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
 				Constraints: []*spb.AttrConstraint{
 					{
 						Key:       "foo",
@@ -192,7 +192,7 @@ func TestMatch(t *testing.T) {
 		},
 		{
 			name: "attr constraint with non-matching regex",
-			src: spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
+			src: &spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
 				Constraints: []*spb.AttrConstraint{
 					{
 						Key:       "foo",
@@ -207,7 +207,7 @@ func TestMatch(t *testing.T) {
 		},
 		{
 			name: "attr constraint with regex match",
-			src: spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
+			src: &spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
 				Constraints: []*spb.AttrConstraint{
 					{
 						Key:       "foo",
@@ -222,7 +222,7 @@ func TestMatch(t *testing.T) {
 		},
 		{
 			name: "unknown attr match condition type",
-			src: spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
+			src: &spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
 				Constraints: []*spb.AttrConstraint{
 					{
 						Key:       "foo",
@@ -238,7 +238,7 @@ func TestMatch(t *testing.T) {
 		},
 		{
 			name: "matching constraint with extra attrs",
-			src: spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
+			src: &spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
 				Constraints: []*spb.AttrConstraint{
 					{
 						Key:       "foo",
@@ -253,7 +253,7 @@ func TestMatch(t *testing.T) {
 		},
 		{
 			name: "multiple attrs with failed constraint",
-			src: spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
+			src: &spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
 				Constraints: []*spb.AttrConstraint{
 					{
 						Key:       "foo",
@@ -273,7 +273,7 @@ func TestMatch(t *testing.T) {
 		},
 		{
 			name: "non-existent constraint key",
-			src: spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
+			src: &spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
 				Constraints: []*spb.AttrConstraint{
 					{
 						Key:       "foo",
@@ -287,7 +287,7 @@ func TestMatch(t *testing.T) {
 		},
 		{
 			name: "non-existent constraint key w/ non-nill attr",
-			src: spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
+			src: &spb.Selector{Identifier: "docker-image://docker.io/library/busybox:*",
 				Constraints: []*spb.AttrConstraint{
 					{
 						Key:       "foo",
@@ -305,7 +305,7 @@ func TestMatch(t *testing.T) {
 	for _, tc := range cases {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
-			matches, err := match(context.Background(), &selectorCache{Selector: &tc.src}, tc.ref, tc.attrs)
+			matches, err := match(context.Background(), &selectorCache{Selector: tc.src}, tc.ref, tc.attrs)
 			if !tc.xErr {
 				require.NoError(t, err)
 			} else {
diff --git a/util/proto.go b/util/proto.go
index a4f6d73b57df0..226768a3f7ecb 100644
--- a/util/proto.go
+++ b/util/proto.go
@@ -61,6 +61,14 @@ func FromPointerMap[K ~string, V any](from map[string]*V) map[K]V {
 	return result
 }
 
+func FromStringMap[K ~string, V any](from map[string]V) map[K]V {
+	result := make(map[K]V)
+	for k, v := range from {
+		result[K(k)] = v
+	}
+	return result
+}
+
 func ToPointerMap[K ~string, V any](from map[K]V) map[string]*V {
 	result := make(map[string]*V)
 	for k, v := range from {
diff --git a/util/staticfs/merge_test.go b/util/staticfs/merge_test.go
index 26f665b593629..20bb8e4e5000b 100644
--- a/util/staticfs/merge_test.go
+++ b/util/staticfs/merge_test.go
@@ -13,12 +13,12 @@ import (
 
 func TestMerge(t *testing.T) {
 	fs1 := NewFS()
-	fs1.Add("foo", types.Stat{Mode: 0644}, []byte("foofoo"))
-	fs1.Add("bar", types.Stat{Mode: 0444}, []byte("barbarbar"))
+	fs1.Add("foo", &types.Stat{Mode: 0644}, []byte("foofoo"))
+	fs1.Add("bar", &types.Stat{Mode: 0444}, []byte("barbarbar"))
 
 	fs2 := NewFS()
-	fs2.Add("abc", types.Stat{Mode: 0400}, []byte("abcabc"))
-	fs2.Add("foo", types.Stat{Mode: 0440}, []byte("foofoofoofoo"))
+	fs2.Add("abc", &types.Stat{Mode: 0400}, []byte("abcabc"))
+	fs2.Add("foo", &types.Stat{Mode: 0440}, []byte("foofoofoofoo"))
 
 	fs := NewMergeFS(fs1, fs2)
 
@@ -64,7 +64,7 @@ func TestMerge(t *testing.T) {
 
 	// extra level
 	fs3 := NewFS()
-	fs3.Add("bax", types.Stat{Mode: 0600}, []byte("bax"))
+	fs3.Add("bax", &types.Stat{Mode: 0600}, []byte("bax"))
 
 	fs = NewMergeFS(fs, fs3)
 
diff --git a/util/staticfs/static.go b/util/staticfs/static.go
index 35586ce56d113..9b224879ced25 100644
--- a/util/staticfs/static.go
+++ b/util/staticfs/static.go
@@ -14,7 +14,7 @@ import (
 )
 
 type File struct {
-	Stat types.Stat
+	Stat *types.Stat
 	Data []byte
 }
 
@@ -30,7 +30,7 @@ func NewFS() *FS {
 	}
 }
 
-func (fs *FS) Add(p string, stat types.Stat, data []byte) {
+func (fs *FS) Add(p string, stat *types.Stat, data []byte) {
 	p = strings.TrimPrefix(p, "/")
 	stat.Size = int64(len(data))
 	if stat.Mode == 0 {
@@ -56,7 +56,7 @@ func (fs *FS) Walk(ctx context.Context, target string, fn fs.WalkDirFunc) error
 	for _, k := range keys {
 		p := convertKeyToPath(k)
 		st := fs.files[p].Stat
-		if err := fn(p, &fsutil.DirEntryInfo{Stat: &st}, nil); err != nil {
+		if err := fn(p, &fsutil.DirEntryInfo{Stat: st}, nil); err != nil {
 			return err
 		}
 	}
diff --git a/util/staticfs/static_test.go b/util/staticfs/static_test.go
index 808c862eff7d9..962430b845201 100644
--- a/util/staticfs/static_test.go
+++ b/util/staticfs/static_test.go
@@ -13,8 +13,8 @@ import (
 
 func TestStatic(t *testing.T) {
 	fs := NewFS()
-	fs.Add("foo", types.Stat{Mode: 0644}, []byte("foofoo"))
-	fs.Add("bar", types.Stat{Mode: 0444}, []byte("barbarbar"))
+	fs.Add("foo", &types.Stat{Mode: 0644}, []byte("foofoo"))
+	fs.Add("bar", &types.Stat{Mode: 0444}, []byte("barbarbar"))
 
 	rc, err := fs.Open("bar")
 	require.NoError(t, err)
@@ -50,7 +50,7 @@ func TestStatic(t *testing.T) {
 
 	require.Equal(t, []string{"bar", "foo"}, files)
 
-	fs.Add("abc", types.Stat{Mode: 0444}, []byte("abcabcabc"))
+	fs.Add("abc", &types.Stat{Mode: 0444}, []byte("abcabcabc"))
 
 	rc, err = fs.Open("abc")
 	require.NoError(t, err)