diff --git a/Dockerfile b/Dockerfile
index c6d9bf8429a5..5fa0999bea5e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,7 +2,7 @@
 
 ARG RUNC_VERSION=v1.1.14
 ARG CONTAINERD_VERSION=v1.7.22
-# containerd v1.6 for integration tests
+# CONTAINERD_ALT_VERSION_16 defines fallback containerd version for integration tests
 ARG CONTAINERD_ALT_VERSION_16=v1.6.36
 ARG REGISTRY_VERSION=v2.8.3
 ARG ROOTLESSKIT_VERSION=v2.0.2
@@ -29,22 +29,22 @@ FROM minio/mc:${MINIO_MC_VERSION} AS minio-mc
 # xx is a helper for cross-compilation
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
 
-# go base image
+# golatest is alias for Go base image
 FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS golatest
 
-# gobuild is base stage for compiling go/cgo
+# gobuild-base is base stage for compiling go/cgo
 FROM golatest AS gobuild-base
 RUN apk add --no-cache file bash clang lld musl-dev pkgconfig git make
 COPY --link --from=xx / /
 
-# delve for debug variant
+# dlv builds delve for debug variant images
 FROM gobuild-base AS dlv
 ARG DELVE_VERSION
 RUN --mount=target=/root/.cache,type=cache \
   --mount=target=/go/pkg/mod,type=cache \
   GOBIN=/usr/bin go install github.com/go-delve/delve/cmd/dlv@${DELVE_VERSION}
 
-# build runc binary
+# runc builds runc binary
 FROM gobuild-base AS runc
 WORKDIR $GOPATH/src/github.com/opencontainers/runc
 ARG RUNC_VERSION
@@ -65,7 +65,7 @@ FROM gobuild-base AS buildkit-base
 WORKDIR /src
 ENV GOFLAGS=-mod=vendor
 
-# scan the version/revision info
+# buildkit-version builds stage with version/revision info
 FROM buildkit-base AS buildkit-version
 # TODO: PKG should be inferred from go modules
 RUN --mount=target=. <<'EOT'
@@ -79,7 +79,7 @@ RUN --mount=target=. <<'EOT'
   echo -n "${VERSION}" > /tmp/.version;
 EOT
 
-# build buildctl binary
+# buildctl builds test cli binary
 FROM buildkit-base AS buildctl
 ENV CGO_ENABLED=0
 ARG TARGETPLATFORM
@@ -93,7 +93,7 @@ RUN --mount=target=. --mount=target=/root/.cache,type=cache \
   if [ "$(xx-info os)" = "linux" ]; then /usr/bin/buildctl --version; fi
 EOT
 
-# build buildkitd binary
+# buildkitd builds daemon binary
 FROM buildkit-base AS buildkitd
 # BUILDKITD_TAGS defines additional Go build tags for compiling buildkitd
 ARG BUILDKITD_TAGS
@@ -135,7 +135,7 @@ RUN --mount=target=. --mount=target=/root/.cache,type=cache \
   fi
 EOT
 
-# build dnsname CNI plugin for testing
+# dnsname builds dnsname CNI plugin for testing
 FROM gobuild-base AS dnsname
 WORKDIR /go/src/github.com/containers/dnsname
 ARG DNSNAME_VERSION
@@ -186,7 +186,7 @@ COPY --link --from=buildkitd /usr/bin/buildkitd /
 COPY --link --from=buildctl /usr/bin/buildctl /
 
 FROM binaries-$TARGETOS AS binaries
-# enable scanning for this stage
+# BUILDKIT_SBOM_SCAN_STAGE enables SBOM scanning for this stage
 ARG BUILDKIT_SBOM_SCAN_STAGE=true
 
 FROM --platform=$BUILDPLATFORM alpine:${ALPINE_VERSION} AS releaser
@@ -230,7 +230,7 @@ RUN --mount=target=/root/.cache,type=cache <<EOT
   fi
 EOT
 
-# containerd v1.6 for integration tests
+# containerd-alt-16 builds containerd v1.6 for integration tests
 FROM gobuild-base AS containerd-alt-16
 WORKDIR /go/src/github.com/containerd/containerd
 ARG CONTAINERD_ALT_VERSION_16
@@ -418,7 +418,7 @@ ENV BUILDKIT_RUN_NETWORK_INTEGRATION_TESTS=1 BUILDKIT_CNI_INIT_LOCK_PATH=/run/bu
 FROM integration-tests AS dev-env
 VOLUME /var/lib/buildkit
 
-# Rootless mode.
+# rootless builds a rootless variant of buildkitd image
 FROM alpine:${ALPINE_VERSION} AS rootless
 RUN apk add --no-cache fuse3 fuse-overlayfs git openssh pigz shadow-uidmap xz
 RUN adduser -D -u 1000 user \
diff --git a/hack/dockerfiles/generated-files.Dockerfile b/hack/dockerfiles/generated-files.Dockerfile
index 7cfcbfae80b3..45f8aecbf2c9 100644
--- a/hack/dockerfiles/generated-files.Dockerfile
+++ b/hack/dockerfiles/generated-files.Dockerfile
@@ -6,6 +6,8 @@ ARG PROTOC_VERSION=3.11.4
 ARG PROTOC_GOOGLEAPIS_VERSION=2af421884dd468d565137215c946ebe4e245ae26
 
 # protoc is dynamically linked to glibc so can't use alpine base
+
+# base defines common stage with Go tools
 FROM golang:${GO_VERSION}-${DEBIAN_VERSION} AS base
 RUN apt-get update && apt-get --no-install-recommends install -y git unzip
 
diff --git a/hack/dockerfiles/lint.Dockerfile b/hack/dockerfiles/lint.Dockerfile
index ae8734adbbe2..2ea06bc59f85 100644
--- a/hack/dockerfiles/lint.Dockerfile
+++ b/hack/dockerfiles/lint.Dockerfile
@@ -6,7 +6,7 @@ ARG XX_VERSION=1.4.0
 ARG PROTOLINT_VERSION=0.45.0
 ARG GOLANGCI_LINT_VERSION=1.61.0
 ARG GOPLS_VERSION=v0.20.0
-# disabled: deprecated unusedvariable simplifyrange
+# GOPLS_ANALYZERS defines gopls analyzers to be run. disabled by default: deprecated unusedvariable simplifyrange
 ARG GOPLS_ANALYZERS="embeddirective fillreturns infertypeargs nonewvars noresultvalues simplifycompositelit simplifyslice stubmethods undeclaredname unusedparams useany"
 
 FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS golang-base