55463 Commits

Author SHA1 Message Date
Sebastiaan van Stijn
e09afad3cb api/types/network: remove use of "reflect" in test
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-23 11:26:32 +01:00
Rob Murray
800406d631 Merge pull request #51781 from thaJeztah/bump_wazero2
vendor: github.com/tetratelabs/wazero v1.11.0
2025-12-23 10:18:12 +00:00
Austin Vazquez
78c6b01902 api: add root doc.go to prevent fallback to github.com/moby/moby
Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>
2025-12-22 14:32:23 -06:00
Sebastiaan van Stijn
9176746aba vendor: github.com/tetratelabs/wazero v1.11.0
- Streamline build tags: remove tinygo, cgo
- Fix race condition in refCount initialization
- Simplify utimens. Use `syscall.UtimesNano` to avoid a macOS `go:linkname`.
- Change version policy to two versions.
- Update Wasm 2.0 spec tests.
- Use golang.org/x/sys

full diff: https://github.com/tetratelabs/wazero/compare/v1.10.1...v1.11.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-22 15:06:09 +01:00
Sebastiaan van Stijn
fba74ac758 Merge pull request #51776 from thaJeztah/bump_go_archive
vendor: github.com/moby/go-archive v0.2.0
2025-12-19 22:21:37 +01:00
Sebastiaan van Stijn
2a9eb66ddc vendor: github.com/moby/go-archive v0.2.0
- remove aliases for deprecated types and functions
- chrootarchive: remove redundant "init" mitigation for CVE-2019-14271
- xattr: Fix OS matching

full diff: https://github.com/moby/go-archive/compare/v0.1.0...v0.2.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-19 19:18:51 +01:00
Sebastiaan van Stijn
552580464d Merge pull request #51777 from thaJeztah/archive_rm_deprecated
remove uses of deprecated go-archive consts
2025-12-19 19:06:35 +01:00
Sebastiaan van Stijn
7239c72eca remove uses of deprecated go-archive consts
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-19 17:51:03 +01:00
Sebastiaan van Stijn
2142a4444c Merge pull request #51774 from thaJeztah/bump_x_deps
vendor: update golang.org/x/xxx dependencies
2025-12-19 17:12:51 +01:00
Sebastiaan van Stijn
356c3cffee Merge pull request #51772 from vvoland/work-build
hack: add nri_no_wasm build when building dockerd
2025-12-19 17:01:28 +01:00
Paweł Gronowski
3ccd05d817 Merge pull request #51682 from srstsavage/45297-allow-anonymous-read-only-volumes
Remove restriction on anonymous read-only volumes
2025-12-19 15:20:32 +00:00
Sebastiaan van Stijn
1a12717766 vendor: golang.org/x/oauth2 v0.34.0
x/oauth2: populate RetrieveError from DeviceAuth

Endpoints may return errors when attempting to request device
authorization. Currently, these error codes are ignored and an
otherwise empty RetrieveError returned. This change populates
the RetrieveError similar to the oauth2 token exchange.

full diff: https://github.com/golang/oauth2/compare/v0.30.0...v0.34.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-19 15:59:18 +01:00
Sebastiaan van Stijn
595d00cb49 vendor: golang.org/x/tools v0.40.0
full diff: https://github.com/golang/tools/compare/v0.39.0...v0.40.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-19 15:55:02 +01:00
Sebastiaan van Stijn
d9fa84260a vendor: golang.org/x/mod v0.31.0
full diff: https://github.com/golang/mod/compare/v0.30.0...v0.31.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-19 15:47:36 +01:00
Sebastiaan van Stijn
98ec249d2b vendor: golang.org/x/net v0.48.0
- trace: fix data race in RenderEvents
- http2, webdav, websocket: fix %q verb uses with wrong type
- http2: don't PING a responsive server when resetting a stream
- http2: support net/http.Transport.NewClientConn

full diff: https://github.com/golang/net/compare/v0.47.0...v0.48.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-19 15:46:10 +01:00
Sebastiaan van Stijn
e229e91247 vendor: golang.org/x/crypto v0.45.0
- x509roots/fallback: update bundle

full diff: https://github.com/golang/crypto/compare/v0.45.0...v0.46.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-19 15:42:52 +01:00
Sebastiaan van Stijn
1a4e4dafe9 vendor: golang.org/x/text v0.32.0
full diff: https://github.com/golang/text/compare/v0.31.0...v0.32.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-19 15:39:09 +01:00
Sebastiaan van Stijn
e0795ef3ab vendor: golang.org/x/tools v0.39.0
full diff: https://github.com/golang/tools/compare/v0.38.0...v0.39.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-19 15:36:54 +01:00
Sebastiaan van Stijn
48e96d4353 vendor: golang.org/x/sync v0.19.0
- errgroup: use consistent read for SetLimit panic

full diff: https://github.com/golang/sync/compare/v0.18.0...v0.19.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-19 15:33:45 +01:00
Sebastiaan van Stijn
dccdb1b618 vendor: golang.org/x/sys v0.39.0
- Revert "cpu: add HPDS, LOR, PAN detection for arm64"
- unix: add IOCTL_MEI_* constants
- unix: fix definition of Statvfs_t for netbsd-arm

full diff: https://github.com/golang/sys/compare/v0.38.0...v0.39.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-19 15:31:38 +01:00
Paweł Gronowski
fdb7b56814 Merge pull request #51769 from thaJeztah/bump_protobuf
vendor: google.golang.org/protobuf v1.36.11
2025-12-19 13:41:48 +00:00
Paweł Gronowski
7ddc5f609a hack: add nri_no_wasm build tag to static builds
Add the nri_no_wasm build tag to the BUILDFLAGS for static builds to
disable WASM plugins support in the NRI (Node Resource Interface)
component.

See: 1078130fa0/README.md (webassembly-support)

The NRI support is still minimal and disabling WASM plugins shaves off a
couple of MiB of the binary size.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-12-19 14:36:15 +01:00
Austin Vazquez
4a72e05714 Merge pull request #51770 from vvoland/update-gha
gha: Bump actions/download-artifact to v7
2025-12-19 07:31:16 -06:00
Paweł Gronowski
1175dd348e daemon/volume/mounts: Fix tests on Windows
The test was failing on Windows because it used Unix-style paths and
relied on platform-specific filesystem behavior.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-12-19 12:42:43 +01:00
Paweł Gronowski
6cbabb04b9 gha: Bump actions/download-artifact to v7
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-12-19 12:11:07 +01:00
Sebastiaan van Stijn
fae334b4c0 vendor: google.golang.org/protobuf v1.36.11
full diff: https://github.com/protocolbuffers/protobuf-go/compare/v1.36.10...v1.36.11

User-visible changes:
CL/726780: encoding/prototext: Support URL chars in type URLs in text-format.

Bug fixes:
CL/728680: internal/impl: check recursion limit in lazy decoding validation
CL/711015: reflect/protodesc: fix handling of import options in dynamic builds

Maintenance:
CL/728681: reflect/protodesc: add support for edition unstable
CL/727960: all: add EDITION_UNSTABLE support
CL/727940: types: regenerate using latest protobuf v33.2 release
CL/727140: internal/testprotos/lazy: convert .proto files to editions
CL/723440: cmd/protoc-gen-go: add missing annotations for few generated protobuf symbols.
CL/720980: internal/filedesc: remove duplicative Message.unmarshalOptions
CL/716360: internal/encoding/tag: use proto3 defaults if proto3
CL/716520: proto: un-flake TestHasExtensionNoAlloc
CL/713342: compiler/protogen: properly filter option dependencies in go-protobuf plugin.
CL/711200: proto: add test for oneofs containing messages with required fields
CL/710855: proto: add explicit test for a non-nil but empty byte slice

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-19 10:11:42 +01:00
Shane St Savage
beeacde4b2 Remove restriction on anonymous read-only volumes
Restriction on anonymouse read-only volumes is currently preventing
the use of pre-populated volumes that should be accessed in a read-only manner in a container
(e.g. an NFS volume containing data to be processed or served).

According to @neersighted the restriction may have originally been put
in place with the assumption that pre-populated volumes would be
exposed as a named volume by the volume driver.

In practice, NFS volumes are mounted using the docker `local` driver
by supplying driver opts. Example that fails when `readonly` is specified but works without:

```
docker run --rm -it \
 --mount 'readonly,type=volume,dst=/data/dest,volume-driver=local,volume-opt=type=nfs,volume-opt=device=:/export/some-share,"volume-opt=o=nfsvers=4,addr=some.server"' \
  debian
```

Fixes #45297

Signed-off-by: Shane St Savage <shane@axds.co>
2025-12-18 16:08:31 -08:00
Paweł Gronowski
ebf1c0d405 Merge pull request #51765 from vvoland/update-containerd-nowindows
Dockerfile: update containerd binary to v2.2.1 (static binaries and CI, on Linux)
2025-12-18 21:17:35 +00:00
Paweł Gronowski
91da4a7e8a Merge pull request #51763 from thaJeztah/client_linting
client: fix linting issues
2025-12-18 20:45:58 +00:00
Sebastiaan van Stijn
168e8418b7 Merge pull request #51599 from thaJeztah/bump_cgroups
vendor: github.com/containerd/containerd/v2 v2.2.1, github.com/opencontainers/runtime-spec v1.3.0
2025-12-18 21:10:51 +01:00
Paweł Gronowski
05bbf3768b Merge pull request #51750 from vvoland/fix-validate-module-replace2
validate/module-replace: Also allow changing ref of the api module
2025-12-18 20:08:14 +00:00
Paweł Gronowski
1145b1def1 Merge pull request #51747 from vvoland/hack-dropreplace-ref
hack/vendor/dropreplace: Make more reliable
2025-12-18 20:07:59 +00:00
Paweł Gronowski
8452b64f32 Dockerfile: update containerd binary to v2.2.1 (static binaries and CI only)
Update the containerd binary that's used in CI and static binaries

- full diff: https://github.com/containerd/containerd/compare/v2.2.0...v2.2.1
- release notes: https://github.com/containerd/containerd/releases/tag/v2.2.1

```markdown changelog
Update containerd (static binaries only) to [v2.2.1](https://github.com/containerd/containerd/releases/tag/v2.2.1)
```

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-12-18 21:04:49 +01:00
Austin Vazquez
0f0d197d78 Merge pull request #51760 from thaJeztah/fix_godoc
api/types/jsonstream: Message: fix godoc
2025-12-18 13:07:27 -06:00
Sebastiaan van Stijn
b293e73bdb vendor: github.com/containerd/containerd/v2 v2.2.1
adds compatibility with runtime-spec v1.3.0

full diff: https://github.com/containerd/containerd/compare/v2.2.0...v2.2.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-18 19:59:07 +01:00
Sebastiaan van Stijn
01440122f2 vendor: github.com/containerd/nri v0.11.0
- adds compatibility with runtime-spec v1.3.0
- adds `nri_no_wasm` build-tag to compile without wasm support
- adds `ErrWasmDisabled` error

full diff: https://github.com/containerd/nri/compare/v0.10.0...v0.11.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-18 19:55:59 +01:00
Sebastiaan van Stijn
32d4f64a65 vendor: github.com/opencontainers/runtime-tools v0.9.1-0.20251114084447-edf4cb3d2116
adds compatibility with runtime-spec v1.3.0

full diff: e5b4542027...edf4cb3d21

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-18 19:55:59 +01:00
Sebastiaan van Stijn
6766ce7be2 vendor: tags.cncf.io/container-device-interface v1.1.0
adds compatibility with runtime-spec v1.3.0

full diff: https://github.com/cncf-tags/container-device-interface/compare/v1.0.1...v1.1.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-18 19:55:59 +01:00
Sebastiaan van Stijn
2c533f9327 vendor: github.com/containerd/cgroup/v3 v3.1.2
- hugetlb: correctly parse hugetlb.<size>.events files
- go.mod: github.com/opencontainers/runtime-spec v1.3.0

full diff: https://github.com/containerd/cgroups/compare/v3.1.0...v3.1.2

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-18 19:55:58 +01:00
Sebastiaan van Stijn
4b4223a8d4 vendor: github.com/opencontainers/runtime-spec v1.3.0
This includes a breaking change in pids.Limit changing to a pointer.

full diff: https://github.com/opencontainers/runtime-spec/compare/v1.2.1...v1.3.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-18 19:55:56 +01:00
Paweł Gronowski
587d96c934 Merge pull request #51762 from thaJeztah/json_tag
api/types/swarm: ResourceRequirements.MemorySwappiness: fix json tag
2025-12-18 18:46:26 +00:00
Sebastiaan van Stijn
9ae239e654 golangci-lint: iface: ignore identical interfaces in client module
These interfaces in the client module are identical by design to allow
future expansion.

    client/container_export.go:15:6: identical: interface 'ContainerExportResult' contains identical methods or type constraints with another interface, causing redundancy (see: ContainerLogsResult, ImageImportResult, ImageLoadResult, ImageSaveResult, ServiceLogsResult, TaskLogsResult) (iface)
    type ContainerExportResult interface {
         ^
    client/container_logs.go:26:6: identical: interface 'ContainerLogsResult' contains identical methods or type constraints with another interface, causing redundancy (see: ContainerExportResult, ImageImportResult, ImageLoadResult, ImageSaveResult, ServiceLogsResult, TaskLogsResult) (iface)
    type ContainerLogsResult interface {
         ^
    client/image_import.go:12:6: identical: interface 'ImageImportResult' contains identical methods or type constraints with another interface, causing redundancy (see: ContainerExportResult, ContainerLogsResult, ImageLoadResult, ImageSaveResult, ServiceLogsResult, TaskLogsResult) (iface)
    type ImageImportResult interface {
         ^
    client/image_load.go:12:6: identical: interface 'ImageLoadResult' contains identical methods or type constraints with another interface, causing redundancy (see: ContainerExportResult, ContainerLogsResult, ImageImportResult, ImageSaveResult, ServiceLogsResult, TaskLogsResult) (iface)
    type ImageLoadResult interface {
         ^
    client/image_pull.go:17:6: identical: interface 'ImagePullResponse' contains identical methods or type constraints with another interface, causing redundancy (see: ImagePushResponse) (iface)
    type ImagePullResponse interface {
         ^
    client/image_push.go:20:6: identical: interface 'ImagePushResponse' contains identical methods or type constraints with another interface, causing redundancy (see: ImagePullResponse) (iface)
    type ImagePushResponse interface {
         ^
    client/image_save.go:9:6: identical: interface 'ImageSaveResult' contains identical methods or type constraints with another interface, causing redundancy (see: ContainerExportResult, ContainerLogsResult, ImageImportResult, ImageLoadResult, ServiceLogsResult, TaskLogsResult) (iface)
    type ImageSaveResult interface {
         ^
    client/service_logs.go:28:6: identical: interface 'ServiceLogsResult' contains identical methods or type constraints with another interface, causing redundancy (see: ContainerExportResult, ContainerLogsResult, ImageImportResult, ImageLoadResult, ImageSaveResult, TaskLogsResult) (iface)
    type ServiceLogsResult interface {
         ^
    client/task_logs.go:26:6: identical: interface 'TaskLogsResult' contains identical methods or type constraints with another interface, causing redundancy (see: ContainerExportResult, ContainerLogsResult, ImageImportResult, ImageLoadResult, ImageSaveResult, ServiceLogsResult) (iface)
    type TaskLogsResult interface {
         ^

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-18 17:11:24 +01:00
Sebastiaan van Stijn
7b74376ff1 client: testRoundTripper: remove unused skipConfigureTransport method
This was added in a315437e1c, likely because
I tried to do some interface matching, but currently it doesn't look to
be implementing one, so we can remove it.

    client/client_options.go:136:25: func testRoundTripper.skipConfigureTransport is unused (unused)
    func (testRoundTripper) skipConfigureTransport() bool { return true }
                            ^

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-18 17:11:23 +01:00
Sebastiaan van Stijn
34ee29ceaa client: use errors.New (revive)
client/container_exec_test.go:152:19: use-errors-new: replace fmt.Errorf by errors.New (revive)
                            return nil, fmt.Errorf("should not have made API request")
                                        ^

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-18 17:11:23 +01:00
Sebastiaan van Stijn
e254a9f0f1 client: containerDiskUsageFromLegacyAPI: make switch exhaustive
client/system_disk_usage.go:275:3: missing cases in switch of type container.ContainerState: container.StateCreated, container.StateRemoving, container.StateExited, container.StateDead (exhaustive)
            switch c.State {
            ^

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-18 17:11:23 +01:00
Sebastiaan van Stijn
f39912a30e client: fix some missing error checks in tests (ineffassign)
client/client_test.go:367:5: ineffectual assignment to err (ineffassign)
        _, err = client.Ping(t.Context(), PingOptions{
           ^
    client/client_test.go:381:5: ineffectual assignment to err (ineffassign)
        _, err = client.Ping(t.Context(), PingOptions{
           ^
    client/client_test.go:425:5: ineffectual assignment to err (ineffassign)
        _, err = client.Ping(t.Context(), PingOptions{
           ^

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-18 17:11:15 +01:00
Sebastiaan van Stijn
8f3bfa3f34 client: fix missing import aliases (importas)
client/container_exec.go:8:2: import "github.com/containerd/errdefs" imported without alias but must be with alias "cerrdefs" according to config (importas)
        "github.com/containerd/errdefs"
        ^
    client/container_exec_test.go:9:2: import "github.com/containerd/errdefs" imported without alias but must be with alias "cerrdefs" according to config (importas)
        "github.com/containerd/errdefs"
        ^
    client/container_rename.go:8:2: import "github.com/containerd/errdefs" imported without alias but must be with alias "cerrdefs" according to config (importas)
        "github.com/containerd/errdefs"
        ^
    client/pkg/security/security_opts_test.go:8:2: import "gotest.tools/v3/assert/cmp" imported without alias but must be with alias "is" according to config (importas)
        "gotest.tools/v3/assert/cmp"
        ^
    client/volume_prune.go:9:2: import "github.com/containerd/errdefs" imported without alias but must be with alias "cerrdefs" according to config (importas)
        "github.com/containerd/errdefs"
        ^
    client/volume_prune_test.go:8:2: import "github.com/containerd/errdefs" imported without alias but must be with alias "cerrdefs" according to config (importas)
        "github.com/containerd/errdefs"
        ^
    client/container_exec_test.go:10:2: ST1019(related information): other import of "github.com/containerd/errdefs" (staticcheck)
        cerrdefs "github.com/containerd/errdefs"
        ^

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-18 15:27:34 +01:00
Sebastiaan van Stijn
0fd5cc134b api/types/jsonstream: Message: fix godoc
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-18 15:04:27 +01:00
Sebastiaan van Stijn
6c845ded18 api/types/swarm: ResourceRequirements.MemorySwappiness: fix json tag
types/swarm/task.go:151:2: structtag: struct field tag `json:MemorySwappiness,omitzero"` not compatible with reflect.StructTag.Get: bad syntax for struct tag value (govet)
        MemorySwappiness *int64 `json:MemorySwappiness,omitzero"`
        ^

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-12-18 15:03:13 +01:00
Sebastiaan van Stijn
faf002f421 Merge pull request #51751 from vvoland/replace-vendor
Re-add replace rules
2025-12-18 15:02:49 +01:00