vendor: docker/docker, moby/api, and moby/client master

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

vendor.mod

@@ -8,8 +8,8 @@ go 1.23.0
 
 replace (
 	// FIXME(thaJeztah): temporarily need to pin on commits, otherwise go modules won't resolve until these are tagged.
-	github.com/moby/moby/api => github.com/moby/moby/api v0.0.0-20250722205935-c55a16352354
-	github.com/moby/moby/client => github.com/moby/moby/client v0.0.0-20250722205935-c55a16352354
+	github.com/moby/moby/api => github.com/moby/moby/api v0.0.0-20250724140036-49306c607b72
+	github.com/moby/moby/client => github.com/moby/moby/client v0.0.0-20250724140036-49306c607b72
 )
 
 require (

vendor.sum

@@ -172,10 +172,10 @@ github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3N
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/go-archive v0.1.0 h1:Kk/5rdW/g+H8NHdJW2gsXyZ7UnzvJNOy6VKJqueWdcQ=
 github.com/moby/go-archive v0.1.0/go.mod h1:G9B+YoujNohJmrIYFBpSd54GTUB4lt9S+xVQvsJyFuo=
-github.com/moby/moby/api v0.0.0-20250722205935-c55a16352354 h1:8UG1BOTZZdvP/61oNDdltO1Yqnp9myrCNzcXvQypX8Y=
-github.com/moby/moby/api v0.0.0-20250722205935-c55a16352354/go.mod h1:VA4aMWurxqzKHCXKDSqoBx3hiJxnTStnqSG5zgc8XL0=
-github.com/moby/moby/client v0.0.0-20250722205935-c55a16352354 h1:1GTdy+QVgcP1MtaOlmHjpioCuEfZxMV0t/uyiG5e4EY=
-github.com/moby/moby/client v0.0.0-20250722205935-c55a16352354/go.mod h1:Ax3ccMnrUUuchkrGDgHpXDeoI0g3MCgZy0V0vDo0+qs=
+github.com/moby/moby/api v0.0.0-20250724140036-49306c607b72 h1:8x4LgU8gdkvRQ0YCAMhG8dxUVKW31hyVZ2F1iYQg7JI=
+github.com/moby/moby/api v0.0.0-20250724140036-49306c607b72/go.mod h1:VA4aMWurxqzKHCXKDSqoBx3hiJxnTStnqSG5zgc8XL0=
+github.com/moby/moby/client v0.0.0-20250724140036-49306c607b72 h1:9Qub35j+NS1FltWbEWj2cJuQTeL5hCswCTEFxbqovgI=
+github.com/moby/moby/client v0.0.0-20250724140036-49306c607b72/go.mod h1:Ax3ccMnrUUuchkrGDgHpXDeoI0g3MCgZy0V0vDo0+qs=
 github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
 github.com/moby/patternmatcher v0.6.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
 github.com/moby/swarmkit/v2 v2.0.0 h1:jkWQKQaJ4ltA61/mC9UdPe1McLma55RUcacTO+pPweY=

vendor/github.com/moby/moby/api/types/container/exec.go

@@ -44,10 +44,42 @@ type ExecStartOptions struct {
 type ExecAttachOptions = ExecStartOptions
 
 // ExecInspect holds information returned by exec inspect.
+//
+// It is used by the client to unmarshal a [ExecInspectResponse],
+// but currently only provides a subset of the information included
+// in that type.
+//
+// TODO(thaJeztah): merge [ExecInspect] and [ExecInspectResponse],
 type ExecInspect struct {
 	ExecID      string `json:"ID"`
-	ContainerID string
-	Running     bool
-	ExitCode    int
-	Pid         int
+	ContainerID string `json:"ContainerID"`
+	Running     bool   `json:"Running"`
+	ExitCode    int    `json:"ExitCode"`
+	Pid         int    `json:"Pid"`
+}
+
+// ExecInspectResponse is the API response for the "GET /exec/{id}/json"
+// endpoint and holds information about and exec.
+type ExecInspectResponse struct {
+	ID            string `json:"ID"`
+	Running       bool   `json:"Running"`
+	ExitCode      *int   `json:"ExitCode"`
+	ProcessConfig *ExecProcessConfig
+	OpenStdin     bool   `json:"OpenStdin"`
+	OpenStderr    bool   `json:"OpenStderr"`
+	OpenStdout    bool   `json:"OpenStdout"`
+	CanRemove     bool   `json:"CanRemove"`
+	ContainerID   string `json:"ContainerID"`
+	DetachKeys    []byte `json:"DetachKeys"`
+	Pid           int    `json:"Pid"`
+}
+
+// ExecProcessConfig holds information about the exec process
+// running on the host.
+type ExecProcessConfig struct {
+	Tty        bool     `json:"tty"`
+	Entrypoint string   `json:"entrypoint"`
+	Arguments  []string `json:"arguments"`
+	Privileged *bool    `json:"privileged,omitempty"`
+	User       string   `json:"user,omitempty"`
 }

vendor/github.com/moby/moby/api/types/container/stats.go

@@ -147,11 +147,6 @@ type PidsStats struct {
 	Limit uint64 `json:"limit,omitempty"`
 }
 
-// Stats is Ultimate struct aggregating all types of stats of one container
-//
-// Deprecated: use [StatsResponse] instead. This type will be removed in the next release.
-type Stats = StatsResponse
-
 // StatsResponse aggregates all types of stats of one container.
 type StatsResponse struct {
 	Name string `json:"name,omitempty"`

vendor/github.com/moby/moby/client/README.md

@@ -2,7 +2,7 @@
 
 The `docker` command uses this package to communicate with the daemon. It can
 also be used by your own Go applications to do anything the command-line
-interface does – running containers, pulling images, managing swarms, etc.
+interface does; running containers, pulling or pushing images, etc.
 
 For example, to list all containers (the equivalent of `docker ps --all`):
 
@@ -13,12 +13,12 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/docker/docker/api/types/container"
-	"github.com/docker/docker/client"
+	"github.com/moby/moby/api/types/container"
+	"github.com/moby/moby/client"
 )
 
 func main() {
-	apiClient, err := client.NewClientWithOpts(client.FromEnv)
+	apiClient, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())
 	if err != nil {
 		panic(err)
 	}
@@ -35,4 +35,4 @@ func main() {
 }
 ```
 
-[Full documentation is available on pkg.go.dev.](https://pkg.go.dev/github.com/docker/docker/client)
+[Full documentation is available on pkg.go.dev.](https://pkg.go.dev/github.com/moby/moby/client)

vendor/github.com/moby/moby/client/client_deprecated.go

@@ -1,27 +0,0 @@
-package client
-
-import "net/http"
-
-// NewClient initializes a new API client for the given host and API version.
-// It uses the given http client as transport.
-// It also initializes the custom http headers to add to each request.
-//
-// It won't send any version information if the version number is empty. It is
-// highly recommended that you set a version or your client may break if the
-// server is upgraded.
-//
-// Deprecated: use [NewClientWithOpts] passing the [WithHost], [WithVersion],
-// [WithHTTPClient] and [WithHTTPHeaders] options. We recommend enabling API
-// version negotiation by passing the [WithAPIVersionNegotiation] option instead
-// of WithVersion.
-func NewClient(host string, version string, client *http.Client, httpHeaders map[string]string) (*Client, error) {
-	return NewClientWithOpts(WithHost(host), WithVersion(version), WithHTTPClient(client), WithHTTPHeaders(httpHeaders))
-}
-
-// NewEnvClient initializes a new API client based on environment variables.
-// See FromEnv for a list of support environment variables.
-//
-// Deprecated: use [NewClientWithOpts] passing the [FromEnv] option.
-func NewEnvClient() (*Client, error) {
-	return NewClientWithOpts(FromEnv)
-}

vendor/github.com/moby/moby/client/client_interfaces.go

@@ -20,11 +20,6 @@ import (
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 )
 
-// CommonAPIClient is the common methods between stable and experimental versions of APIClient.
-//
-// Deprecated: use [APIClient] instead. This type will be an alias for [APIClient] in the next release, and removed after.
-type CommonAPIClient = stableAPIClient
-
 // APIClient is an interface that clients that talk with a docker server must implement.
 type APIClient interface {
 	stableAPIClient
@@ -128,16 +123,6 @@ type ImageAPIClient interface {
 	ImageHistory(ctx context.Context, image string, _ ...ImageHistoryOption) ([]image.HistoryResponseItem, error)
 	ImageLoad(ctx context.Context, input io.Reader, _ ...ImageLoadOption) (image.LoadResponse, error)
 	ImageSave(ctx context.Context, images []string, _ ...ImageSaveOption) (io.ReadCloser, error)
-
-	ImageAPIClientDeprecated
-}
-
-// ImageAPIClientDeprecated defines deprecated methods of the ImageAPIClient.
-type ImageAPIClientDeprecated interface {
-	// ImageInspectWithRaw returns the image information and its raw representation.
-	//
-	// Deprecated: Use [Client.ImageInspect] instead. Raw response can be obtained using the [ImageInspectWithRawResponse] option.
-	ImageInspectWithRaw(ctx context.Context, image string) (image.InspectResponse, []byte, error)
 }
 
 // NetworkAPIClient defines API client methods for the networks

vendor/github.com/moby/moby/client/container_create.go

@@ -79,8 +79,10 @@ func (cli *Client) ContainerCreate(ctx context.Context, config *container.Config
 	}
 
 	query := url.Values{}
-	if p := formatPlatform(platform); p != "" {
-		query.Set("platform", p)
+	if platform != nil {
+		if p := formatPlatform(*platform); p != "unknown" {
+			query.Set("platform", p)
+		}
 	}
 
 	if containerName != "" {
@@ -103,14 +105,16 @@ func (cli *Client) ContainerCreate(ctx context.Context, config *container.Config
 	return response, err
 }
 
-// formatPlatform returns a formatted string representing platform (e.g. linux/arm/v7).
+// formatPlatform returns a formatted string representing platform (e.g., "linux/arm/v7").
 //
-// Similar to containerd's platforms.Format(), but does allow components to be
-// omitted (e.g. pass "architecture" only, without "os":
-// https://github.com/containerd/containerd/blob/v1.5.2/platforms/platforms.go#L243-L263
-func formatPlatform(platform *ocispec.Platform) string {
-	if platform == nil {
-		return ""
+// It is a fork of [platforms.Format], and does not yet support "os.version",
+// as [[platforms.FormatAll] does.
+//
+// [platforms.Format]: https://github.com/containerd/platforms/blob/v1.0.0-rc.1/platforms.go#L309-L316
+// [platforms.FormatAll]: https://github.com/containerd/platforms/blob/v1.0.0-rc.1/platforms.go#L318-L330
+func formatPlatform(platform ocispec.Platform) string {
+	if platform.OS == "" {
+		return "unknown"
 	}
 	return path.Join(platform.OS, platform.Architecture, platform.Variant)
 }
@@ -134,8 +138,10 @@ const allCapabilities = "ALL"
 // normalizeCapabilities normalizes capabilities to their canonical form,
 // removes duplicates, and sorts the results.
 //
-// It is similar to [github.com/docker/docker/oci/caps.NormalizeLegacyCapabilities],
+// It is similar to [caps.NormalizeLegacyCapabilities],
 // but performs no validation based on supported capabilities.
+//
+// [caps.NormalizeLegacyCapabilities]: https://github.com/moby/moby/blob/v28.3.2/oci/caps/utils.go#L56
 func normalizeCapabilities(caps []string) []string {
 	var normalized []string
 

vendor/github.com/moby/moby/client/errors.go

@@ -30,13 +30,6 @@ func IsErrConnectionFailed(err error) bool {
 	return errors.As(err, &errConnectionFailed{})
 }
 
-// ErrorConnectionFailed returns an error with host in the error message when connection to docker daemon failed.
-//
-// Deprecated: this function was only used internally, and will be removed in the next release.
-func ErrorConnectionFailed(host string) error {
-	return connectionFailed(host)
-}
-
 // connectionFailed returns an error with host in the error message when connection
 // to docker daemon failed.
 func connectionFailed(host string) error {
@@ -49,14 +42,6 @@ func connectionFailed(host string) error {
 	return errConnectionFailed{error: err}
 }
 
-// IsErrNotFound returns true if the error is a NotFound error, which is returned
-// by the API when some object is not found. It is an alias for [cerrdefs.IsNotFound].
-//
-// Deprecated: use [cerrdefs.IsNotFound] instead.
-func IsErrNotFound(err error) bool {
-	return cerrdefs.IsNotFound(err)
-}
-
 type objectNotFoundError struct {
 	object string
 	id     string

vendor/github.com/moby/moby/client/image_inspect.go

@@ -62,15 +62,3 @@ func (cli *Client) ImageInspect(ctx context.Context, imageID string, inspectOpts
 	err = json.Unmarshal(buf.Bytes(), &response)
 	return response, err
 }
-
-// ImageInspectWithRaw returns the image information and its raw representation.
-//
-// Deprecated: Use [Client.ImageInspect] instead. Raw response can be obtained using the [ImageInspectWithRawResponse] option.
-func (cli *Client) ImageInspectWithRaw(ctx context.Context, imageID string) (image.InspectResponse, []byte, error) {
-	var buf bytes.Buffer
-	resp, err := cli.ImageInspect(ctx, imageID, ImageInspectWithRawResponse(&buf))
-	if err != nil {
-		return image.InspectResponse{}, nil, err
-	}
-	return resp, buf.Bytes(), err
-}

vendor/github.com/moby/moby/client/request.go

@@ -135,66 +135,72 @@ func (cli *Client) sendRequest(ctx context.Context, method, path string, query u
 
 func (cli *Client) doRequest(req *http.Request) (*http.Response, error) {
 	resp, err := cli.client.Do(req)
-	if err != nil {
-		if cli.scheme != "https" && strings.Contains(err.Error(), "malformed HTTP response") {
-			return nil, errConnectionFailed{fmt.Errorf("%v.\n* Are you trying to connect to a TLS-enabled daemon without TLS?", err)}
-		}
-
-		if cli.scheme == "https" && strings.Contains(err.Error(), "bad certificate") {
-			return nil, errConnectionFailed{errors.Wrap(err, "the server probably has client authentication (--tlsverify) enabled; check your TLS client certification settings")}
-		}
-
-		// Don't decorate context sentinel errors; users may be comparing to
-		// them directly.
-		if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
-			return nil, err
-		}
-
-		var uErr *url.Error
-		if errors.As(err, &uErr) {
-			var nErr *net.OpError
-			if errors.As(uErr.Err, &nErr) {
-				if os.IsPermission(nErr.Err) {
-					return nil, errConnectionFailed{errors.Wrapf(err, "permission denied while trying to connect to the Docker daemon socket at %v", cli.host)}
-				}
-			}
-		}
-
-		var nErr net.Error
-		if errors.As(err, &nErr) {
-			// FIXME(thaJeztah): any net.Error should be considered a connection error (but we should include the original error)?
-			if nErr.Timeout() {
-				return nil, connectionFailed(cli.host)
-			}
-			if strings.Contains(nErr.Error(), "connection refused") || strings.Contains(nErr.Error(), "dial unix") {
-				return nil, connectionFailed(cli.host)
-			}
-		}
-
-		// Although there's not a strongly typed error for this in go-winio,
-		// lots of people are using the default configuration for the docker
-		// daemon on Windows where the daemon is listening on a named pipe
-		// `//./pipe/docker_engine, and the client must be running elevated.
-		// Give users a clue rather than the not-overly useful message
-		// such as `error during connect: Get http://%2F%2F.%2Fpipe%2Fdocker_engine/v1.26/info:
-		// open //./pipe/docker_engine: The system cannot find the file specified.`.
-		// Note we can't string compare "The system cannot find the file specified" as
-		// this is localised - for example in French the error would be
-		// `open //./pipe/docker_engine: Le fichier spécifié est introuvable.`
-		if strings.Contains(err.Error(), `open //./pipe/docker_engine`) {
-			// Checks if client is running with elevated privileges
-			if f, elevatedErr := os.Open(`\\.\PHYSICALDRIVE0`); elevatedErr != nil {
-				err = errors.Wrap(err, "in the default daemon configuration on Windows, the docker client must be run with elevated privileges to connect")
-			} else {
-				_ = f.Close()
-				err = errors.Wrap(err, "this error may indicate that the docker daemon is not running")
-			}
-		}
-
-		return nil, errConnectionFailed{errors.Wrap(err, "error during connect")}
+	if err == nil {
+		return resp, nil
 	}
 
-	return resp, nil
+	if cli.scheme != "https" && strings.Contains(err.Error(), "malformed HTTP response") {
+		return nil, errConnectionFailed{fmt.Errorf("%w.\n* Are you trying to connect to a TLS-enabled daemon without TLS?", err)}
+	}
+
+	if cli.scheme == "https" && strings.Contains(err.Error(), "bad certificate") {
+		return nil, errConnectionFailed{errors.Wrap(err, "the server probably has client authentication (--tlsverify) enabled; check your TLS client certification settings")}
+	}
+
+	// Don't decorate context sentinel errors; users may be comparing to
+	// them directly.
+	if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
+		return nil, err
+	}
+
+	if errors.Is(err, os.ErrPermission) {
+		// Don't include request errors ("Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.51/version"),
+		// which are irrelevant if we weren't able to connect.
+		return nil, errConnectionFailed{fmt.Errorf("permission denied while trying to connect to the docker API at %v", cli.host)}
+	}
+	if errors.Is(err, os.ErrNotExist) {
+		// Unwrap the error to remove request errors ("Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.51/version"),
+		// which are irrelevant if we weren't able to connect.
+		err = errors.Unwrap(err)
+		return nil, errConnectionFailed{errors.Wrapf(err, "failed to connect to the docker API at %v; check if the path is correct and if the daemon is running", cli.host)}
+	}
+	var dnsErr *net.DNSError
+	if errors.As(err, &dnsErr) {
+		return nil, errConnectionFailed{errors.Wrapf(dnsErr, "failed to connect to the docker API at %v", cli.host)}
+	}
+
+	var nErr net.Error
+	if errors.As(err, &nErr) {
+		// FIXME(thaJeztah): any net.Error should be considered a connection error (but we should include the original error)?
+		if nErr.Timeout() {
+			return nil, connectionFailed(cli.host)
+		}
+		if strings.Contains(nErr.Error(), "connection refused") || strings.Contains(nErr.Error(), "dial unix") {
+			return nil, connectionFailed(cli.host)
+		}
+	}
+
+	// Although there's not a strongly typed error for this in go-winio,
+	// lots of people are using the default configuration for the docker
+	// daemon on Windows where the daemon is listening on a named pipe
+	// `//./pipe/docker_engine, and the client must be running elevated.
+	// Give users a clue rather than the not-overly useful message
+	// such as `error during connect: Get http://%2F%2F.%2Fpipe%2Fdocker_engine/v1.26/info:
+	// open //./pipe/docker_engine: The system cannot find the file specified.`.
+	// Note we can't string compare "The system cannot find the file specified" as
+	// this is localised - for example in French the error would be
+	// `open //./pipe/docker_engine: Le fichier spécifié est introuvable.`
+	if strings.Contains(err.Error(), `open //./pipe/docker_engine`) {
+		// Checks if client is running with elevated privileges
+		if f, elevatedErr := os.Open(`\\.\PHYSICALDRIVE0`); elevatedErr != nil {
+			err = errors.Wrap(err, "in the default daemon configuration on Windows, the docker client must be run with elevated privileges to connect")
+		} else {
+			_ = f.Close()
+			err = errors.Wrap(err, "this error may indicate that the docker daemon is not running")
+		}
+	}
+
+	return nil, errConnectionFailed{errors.Wrap(err, "error during connect")}
 }
 
 func (cli *Client) checkResponseErr(serverResp *http.Response) (retErr error) {

vendor/modules.txt

@@ -175,7 +175,7 @@ github.com/moby/docker-image-spec/specs-go/v1
 github.com/moby/go-archive
 github.com/moby/go-archive/compression
 github.com/moby/go-archive/tarheader
-# github.com/moby/moby/api v0.0.0 => github.com/moby/moby/api v0.0.0-20250722205935-c55a16352354
+# github.com/moby/moby/api v0.0.0 => github.com/moby/moby/api v0.0.0-20250724140036-49306c607b72
 ## explicit; go 1.23.0
 github.com/moby/moby/api/stdcopy
 github.com/moby/moby/api/types
@@ -199,7 +199,7 @@ github.com/moby/moby/api/types/system
 github.com/moby/moby/api/types/time
 github.com/moby/moby/api/types/versions
 github.com/moby/moby/api/types/volume
-# github.com/moby/moby/client v0.0.0 => github.com/moby/moby/client v0.0.0-20250722205935-c55a16352354
+# github.com/moby/moby/client v0.0.0 => github.com/moby/moby/client v0.0.0-20250724140036-49306c607b72
 ## explicit; go 1.23.0
 github.com/moby/moby/client
 # github.com/moby/patternmatcher v0.6.0
@@ -572,5 +572,5 @@ gotest.tools/v3/skip
 # tags.cncf.io/container-device-interface v0.8.0
 ## explicit; go 1.20
 tags.cncf.io/container-device-interface/pkg/parser
-# github.com/moby/moby/api => github.com/moby/moby/api v0.0.0-20250722205935-c55a16352354
-# github.com/moby/moby/client => github.com/moby/moby/client v0.0.0-20250722205935-c55a16352354
+# github.com/moby/moby/api => github.com/moby/moby/api v0.0.0-20250724140036-49306c607b72
+# github.com/moby/moby/client => github.com/moby/moby/client v0.0.0-20250724140036-49306c607b72