From e757bbb4ea504156b930c5c30e2dd9434d560bc7 Mon Sep 17 00:00:00 2001
From: Rob Murray <rob.murray@docker.com>
Date: Fri, 14 Nov 2025 11:27:52 +0000
Subject: [PATCH] Move call to Daemon.registerLinks out of Daemon.setHostConfig

The call from Daemon.create -> Daemon.setHostConfig acquired
container.Lock, but didn't need to because the container is
newly created and solely owned by the caller. The call from
Daemon.restore did not acquire the lock.

Signed-off-by: Rob Murray <rob.murray@docker.com>
---
 daemon/container.go      | 5 -----
 daemon/create.go         | 4 +++-
 daemon/daemon.go         | 2 +-
 daemon/daemon_unix.go    | 8 ++++----
 daemon/daemon_windows.go | 2 +-
 5 files changed, 9 insertions(+), 12 deletions(-)

diff --git a/daemon/container.go b/daemon/container.go
index dd7f82dae1..e6018c771c 100644
--- a/daemon/container.go
+++ b/daemon/container.go
@@ -221,11 +221,6 @@ func (daemon *Daemon) setHostConfig(container *container.Container, hostConfig *
 	container.Lock()
 	defer container.Unlock()
 
-	// Register any links from the host config before starting the container
-	if err := daemon.registerLinks(container, hostConfig); err != nil {
-		return err
-	}
-
 	if hostConfig != nil && hostConfig.NetworkMode == "" {
 		hostConfig.NetworkMode = networktypes.NetworkDefault
 	}
diff --git a/daemon/create.go b/daemon/create.go
index f68dfff7b8..8ecabcc274 100644
--- a/daemon/create.go
+++ b/daemon/create.go
@@ -247,7 +247,9 @@ func (daemon *Daemon) create(ctx context.Context, daemonCfg *config.Config, opts
 	if err := daemon.setHostConfig(ctr, opts.params.HostConfig, opts.params.DefaultReadOnlyNonRecursive); err != nil {
 		return nil, err
 	}
-
+	if err := daemon.registerLinks(ctr); err != nil {
+		return nil, err
+	}
 	if err := daemon.createContainerOSSpecificSettings(ctx, ctr, opts.params.Config, opts.params.HostConfig); err != nil {
 		return nil, err
 	}
diff --git a/daemon/daemon.go b/daemon/daemon.go
index d639b6f0c1..2bb2d8c060 100644
--- a/daemon/daemon.go
+++ b/daemon/daemon.go
@@ -592,7 +592,7 @@ func (daemon *Daemon) restore(ctx context.Context, cfg *configStore, containers
 		go func(c *container.Container) {
 			_ = sem.Acquire(context.Background(), 1)
 
-			if err := daemon.registerLinks(c, c.HostConfig); err != nil {
+			if err := daemon.registerLinks(c); err != nil {
 				log.G(ctx).WithField("container", c.ID).WithError(err).Error("failed to register link for container")
 			}
 
diff --git a/daemon/daemon_unix.go b/daemon/daemon_unix.go
index 7b9b68d7d4..724d969d61 100644
--- a/daemon/daemon_unix.go
+++ b/daemon/daemon_unix.go
@@ -1504,12 +1504,12 @@ func getUnmountOnShutdownPath(config *config.Config) string {
 
 // registerLinks registers network links between container and other containers
 // with the daemon using the specification in hostConfig.
-func (daemon *Daemon) registerLinks(container *container.Container, hostConfig *containertypes.HostConfig) error {
-	if hostConfig == nil || hostConfig.NetworkMode.IsUserDefined() {
+func (daemon *Daemon) registerLinks(ctr *container.Container) error {
+	if ctr.HostConfig == nil || ctr.HostConfig.NetworkMode.IsUserDefined() {
 		return nil
 	}
 
-	for _, l := range hostConfig.Links {
+	for _, l := range ctr.HostConfig.Links {
 		name, alias, err := opts.ParseLink(l)
 		if err != nil {
 			return err
@@ -1542,7 +1542,7 @@ func (daemon *Daemon) registerLinks(container *container.Container, hostConfig *
 		if child.HostConfig.NetworkMode.IsHost() {
 			return cerrdefs.ErrInvalidArgument.WithMessage("conflicting options: host type networking can't be used with links. This would result in undefined behavior")
 		}
-		if err := daemon.registerLink(container, child, alias); err != nil {
+		if err := daemon.registerLink(ctr, child, alias); err != nil {
 			return err
 		}
 	}
diff --git a/daemon/daemon_windows.go b/daemon/daemon_windows.go
index 757043d079..5985708ec6 100644
--- a/daemon/daemon_windows.go
+++ b/daemon/daemon_windows.go
@@ -464,7 +464,7 @@ func initBridgeDriver(controller *libnetwork.Controller, config config.BridgeCon
 
 // registerLinks sets up links between containers and writes the
 // configuration out for persistence. As of Windows TP4, links are not supported.
-func (daemon *Daemon) registerLinks(container *container.Container, hostConfig *containertypes.HostConfig) error {
+func (daemon *Daemon) registerLinks(container *container.Container) error {
 	return nil
 }