diff --git a/frontend/dockerfile/dockerfile2llb/convert.go b/frontend/dockerfile/dockerfile2llb/convert.go
index e6a52d8c..fd0cd28c 100644
--- a/frontend/dockerfile/dockerfile2llb/convert.go
+++ b/frontend/dockerfile/dockerfile2llb/convert.go
@@ -35,7 +35,7 @@ const (
 	localNameContext = "context"
 	historyComment   = "buildkit.dockerfile.v0"
 
-	DefaultCopyImage = "tonistiigi/copy:v0.1.5@sha256:eab89b76ffbb3c807663a67a41e8be31b8a0e362d7fb074a55bddace563a28bb"
+	DefaultCopyImage = "tonistiigi/copy:v0.1.7@sha256:9aab7d9ab369c6daf4831bf0653f7592110ab4b7e8a33fee2b9dca546e9d3089"
 )
 
 type ConvertOpt struct {
diff --git a/frontend/dockerfile/dockerfile_test.go b/frontend/dockerfile/dockerfile_test.go
index 36a056a2..ae05db65 100644
--- a/frontend/dockerfile/dockerfile_test.go
+++ b/frontend/dockerfile/dockerfile_test.go
@@ -51,7 +51,7 @@ func init() {
 	opts = []integration.TestOpt{
 		integration.WithMirroredImages(integration.OfficialImages("busybox:latest")),
 		integration.WithMirroredImages(map[string]string{
-			"tonistiigi/copy:v0.1.5": "docker.io/" + dockerfile2llb.DefaultCopyImage,
+			"tonistiigi/copy:v0.1.7": "docker.io/" + dockerfile2llb.DefaultCopyImage,
 		}),
 		integration.WithMatrix("frontend", frontends),
 	}
diff --git a/util/contentutil/refs.go b/util/contentutil/refs.go
index b3a10d15..9df84063 100644
--- a/util/contentutil/refs.go
+++ b/util/contentutil/refs.go
@@ -3,11 +3,16 @@ package contentutil
 import (
 	"context"
 	"net/http"
+	"sync"
 
 	"github.com/containerd/containerd/content"
+	"github.com/containerd/containerd/errdefs"
 	"github.com/containerd/containerd/remotes"
 	"github.com/containerd/containerd/remotes/docker"
+	"github.com/docker/docker/pkg/locker"
+	digest "github.com/opencontainers/go-digest"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/pkg/errors"
 )
 
 func ProviderFromRef(ref string) (ocispec.Descriptor, content.Provider, error) {
@@ -38,11 +43,13 @@ func IngesterFromRef(ref string) (content.Ingester, error) {
 	}
 
 	return &ingester{
+		locker: locker.New(),
 		pusher: pusher,
 	}, nil
 }
 
 type ingester struct {
+	locker *locker.Locker
 	pusher remotes.Pusher
 }
 
@@ -53,5 +60,38 @@ func (w *ingester) Writer(ctx context.Context, opts ...content.WriterOpt) (conte
 			return nil, err
 		}
 	}
-	return w.pusher.Push(ctx, wo.Desc)
+	if wo.Ref == "" {
+		return nil, errors.Wrap(errdefs.ErrInvalidArgument, "ref must not be empty")
+	}
+	w.locker.Lock(wo.Ref)
+	var once sync.Once
+	unlock := func() {
+		once.Do(func() {
+			w.locker.Unlock(wo.Ref)
+		})
+	}
+	writer, err := w.pusher.Push(ctx, wo.Desc)
+	if err != nil {
+		return nil, err
+	}
+	return &lockedWriter{unlock: unlock, Writer: writer}, nil
+}
+
+type lockedWriter struct {
+	unlock func()
+	content.Writer
+}
+
+func (w *lockedWriter) Commit(ctx context.Context, size int64, expected digest.Digest, opts ...content.Opt) error {
+	err := w.Writer.Commit(ctx, size, expected, opts...)
+	if err == nil {
+		w.unlock()
+	}
+	return err
+}
+
+func (w *lockedWriter) Close() error {
+	err := w.Writer.Close()
+	w.unlock()
+	return err
 }
diff --git a/util/testutil/integration/run.go b/util/testutil/integration/run.go
index 14354ace..29a807da 100644
--- a/util/testutil/integration/run.go
+++ b/util/testutil/integration/run.go
@@ -217,7 +217,7 @@ mirrors=["%s"]
 	return tmpdir, nil
 }
 
-func runMirror(t *testing.T, mirroredImages map[string]string) (host string, cleanup func() error, err error) {
+func runMirror(t *testing.T, mirroredImages map[string]string) (host string, _ func() error, err error) {
 	mirrorDir := os.Getenv("BUILDKIT_REGISTRY_MIRROR_DIR")
 
 	var f *os.File