diff --git a/.golangci.yml b/.golangci.yml
index bad084a5e..56984f645 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -5,9 +5,6 @@ run:
 
   modules-download-mode: vendor
 
-  build-tags:
-    - dfrunsecurity
-
 linters:
   enable:
     - depguard
diff --git a/docker-bake.hcl b/docker-bake.hcl
index f6fc3bba8..cae21cca3 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -79,9 +79,22 @@ group "validate" {
 }
 
 target "lint" {
+  name = "lint-${buildtags.name}"
   inherits = ["_common"]
   dockerfile = "./hack/dockerfiles/lint.Dockerfile"
   output = ["type=cacheonly"]
+  target = buildtags.target
+  args = {
+    BUILDTAGS = buildtags.tags
+  }
+  matrix = {
+    buildtags = [
+      { name = "default", tags = "", target = "golangci-lint" },
+      { name = "labs", tags = "dfrunsecurity", target = "golangci-lint" },
+      { name = "nydus", tags = "nydus", target = "golangci-lint" },
+      { name = "yaml", tags = "", target = "yamllint" },
+    ]
+  }
 }
 
 target "validate-vendor" {
diff --git a/hack/dockerfiles/lint.Dockerfile b/hack/dockerfiles/lint.Dockerfile
index 177a4ffd4..cfc819544 100644
--- a/hack/dockerfiles/lint.Dockerfile
+++ b/hack/dockerfiles/lint.Dockerfile
@@ -2,13 +2,24 @@
 
 ARG GO_VERSION=1.20
 
-FROM golang:${GO_VERSION}-alpine
+FROM golang:${GO_VERSION}-alpine AS base
 ENV GOFLAGS="-buildvcs=false"
 RUN apk add --no-cache gcc musl-dev yamllint
 RUN wget -O- -nv https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s v1.52.2
 WORKDIR /go/src/github.com/moby/buildkit
+
+FROM base as golangci-lint
+ARG BUILDTAGS
+RUN --mount=target=/go/src/github.com/moby/buildkit --mount=target=/root/.cache,type=cache,sharing=locked \
+  GOARCH=amd64 golangci-lint run --build-tags "${BUILDTAGS}" && \
+  GOARCH=arm64 golangci-lint run --build-tags "${BUILDTAGS}" && \
+  touch /golangci-lint.done
+
+FROM base as yamllint
 RUN --mount=target=/go/src/github.com/moby/buildkit --mount=target=/root/.cache,type=cache \
-  GOARCH=amd64 golangci-lint run && \
-  GOARCH=arm64 golangci-lint run
-RUN --mount=target=/go/src/github.com/moby/buildkit --mount=target=/root/.cache,type=cache \
-  yamllint -c .yamllint.yml --strict .
+  yamllint -c .yamllint.yml --strict . && \
+  touch /yamllint.done
+
+FROM scratch
+COPY --link --from=golangci-lint /golangci-lint.done /
+COPY --link --from=yamllint /yamllint.done /