Bump github.com/docker/docker from 25.0.5+incompatible to 26.0.0+inco…

…mpatible (#907)

Bumps [github.com/docker/docker](https://github.com/docker/docker) from 25.0.5+incompatible to 26.0.0+incompatible.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/docker/docker/releases">github.com/docker/docker's releases</a>.</em></p>
<blockquote>
<h2>v26.0.0</h2>
<h2>26.0.0</h2>
<p>For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:</p>
<ul>
<li><a href="https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A26.0.0">docker/cli, 26.0.0 milestone</a></li>
<li><a href="https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A26.0.0">moby/moby, 26.0.0 milestone</a></li>
<li>Deprecated and removed features, see <a href="https://github.com/docker/cli/blob/v26.0.0/docs/deprecated.md">Deprecated Features</a>.</li>
<li>Changes to the Engine API, see <a href="https://github.com/moby/moby/blob/v26.0.0/docs/api/version-history.md">API version history</a>.</li>
</ul>
<h3>Security</h3>
<p>This release contains a security fix for [CVE-2024-29018], a potential data exfiltration from 'internal' networks via authoritative DNS servers.</p>
<h3>New</h3>
<ul>
<li>Add <code>Subpath</code> field to the <code>VolumeOptions</code> making it possible to mount a subpath of a volume. <a href="https://redirect.github.com/moby/moby/pull/45687">moby/moby#45687</a></li>
<li>Add <code>volume-subpath</code> support to the mount flag (<code>--mount type=volume,...,volume-subpath=&lt;subpath&gt;</code>). <a href="https://redirect.github.com/docker/cli/pull/4331">docker/cli#4331</a></li>
<li>Accept <code>=</code> separators and <code>[ipv6]</code> in compose files for <code>docker stack deploy</code>. <a href="https://redirect.github.com/docker/cli/pull/4860">docker/cli#4860</a></li>
<li>rootless: Add support for enabling host loopback by setting the <code>DOCKERD_ROOTLESS_ROOTLESSKIT_DISABLE_HOST_LOOPBACK</code> environment variable to <code>false</code> (defaults to <code>true</code>). This lets containers connect to the host by using IP address <code>10.0.2.2</code>. <a href="https://redirect.github.com/moby/moby/pull/47352">moby/moby#47352</a></li>
<li>containerd image store: <code>docker image ls</code> no longer creates duplicates entries for multi-platform images. <a href="https://redirect.github.com/moby/moby/pull/45967">moby/moby#45967</a></li>
<li>containerd image store: Send Prometheus metrics. <a href="https://redirect.github.com/moby/moby/pull/47555">moby/moby#47555</a></li>
</ul>
<h3>Bug fixes and enhancements</h3>
<ul>
<li>[CVE-2024-29018]: Do not forward requests to external DNS servers for a container that is only connected to an 'internal' network. Previously, requests were forwarded if the host's DNS server was running on a loopback address, like systemd's 127.0.0.53. <a href="https://redirect.github.com/moby/moby/pull/47589">moby/moby#47589</a></li>
<li>Ensure that a generated MAC address is not restored when a container is restarted, but a configured MAC address is preserved. <a href="https://redirect.github.com/moby/moby/pull/47233">moby/moby#47233</a></li>
</ul>
<blockquote>
<p>[!WARNING]</p>
<p>Containers created using Docker Engine 25.0.0 may have duplicate MAC addresses, they must be re-created.
Containers created using version 25.0.0 or 25.0.1 with user-defined MAC addresses will get generated MAC addresses when they are started using 25.0.2. They must also be re-created.</p>
</blockquote>
<ul>
<li>Always attempt to enable IPv6 on a container's loopback interface, and only include IPv6 in <code>/etc/hosts</code> if successful. <a href="https://redirect.github.com/moby/moby/pull/47062">moby/moby#47062</a></li>
</ul>
<blockquote>
<p>[!NOTE]</p>
<p>By default, IPv6 will remain enabled on a container's loopback interface when the container is not connected to an IPv6-enabled network.
For example, containers that are only connected to an IPv4-only network now have the <code>::1</code> address on their loopback interface.</p>
<p>To disable IPv6 in a container,
use option <code>--sysctl net.ipv6.conf.all.disable_ipv6=1</code> in the <code>create</code> or <code>run</code> command,
or the equivalent <code>sysctls</code> option in the service configuration section of a Compose file.</p>
<p>If IPv6 is not available in a container because it has been explicitly disabled for the container,
or the host's networking stack does not have IPv6 enabled (or for any other reason)
the container's <code>/etc/hosts</code> file will not include IPv6 entries.</p>
</blockquote>
<ul>
<li>Fix <code>ADD</code> Dockerfile instruction failing with <code>lsetxattr &lt;file&gt;: operation not supported</code> when unpacking archive with xattrs onto a filesystem that doesn't support them. <a href="https://redirect.github.com/moby/moby/pull/47175">moby/moby#47175</a></li>
<li>Fix <code>docker container start</code> failing when used with <code>--checkpoint</code>. <a href="https://redirect.github.com/moby/moby/pull/47456">moby/moby#47456</a></li>
</ul>

</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/moby/moby/commit/8b79278316b532d396048bc8c2fa015a85d53a53"><code>8b79278</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/47599">#47599</a> from neersighted/short_id_aliases_removal</li>
<li><a href="https://github.com/moby/moby/commit/22726fb63b707a961800047d77810cb34cf45d65"><code>22726fb</code></a> api: document changed behavior of the <code>Aliases</code> field in v1.45</li>
<li><a href="https://github.com/moby/moby/commit/963e1f3eed52024629557c11503c56f28d578f55"><code>963e1f3</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/47597">#47597</a> from vvoland/c8d-list-fix-shared-size</li>
<li><a href="https://github.com/moby/moby/commit/3312b8251545f1179bdc2d481019216f32875119"><code>3312b82</code></a> c8d/list: Add a test case for images sharing a top layer</li>
<li><a href="https://github.com/moby/moby/commit/ad8a5a5732ee3e66100d92f70de8298bd7dfdb1e"><code>ad8a5a5</code></a> c8d/list: Fix diffIDs being outputted instead of chainIDs</li>
<li><a href="https://github.com/moby/moby/commit/0c2d83b5fb1d284897dbb2339ee74c7c56eedd0b"><code>0c2d83b</code></a> c8d/list: Handle unpacked layers when calculating shared size</li>
<li><a href="https://github.com/moby/moby/commit/330d777c53fbbf734178d6a35c9dc0a5070ba4ac"><code>330d777</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/47591">#47591</a> from vvoland/api-1.45</li>
<li><a href="https://github.com/moby/moby/commit/3d2a56e7cf3c73971032d5a9934ba86409ff2781"><code>3d2a56e</code></a> docs/api: add documentation for API v1.45</li>
<li><a href="https://github.com/moby/moby/commit/4531a371f222e6bacced0111b7140e4b4bfba18a"><code>4531a37</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/47580">#47580</a> from vvoland/c8d-list-slow</li>
<li><a href="https://github.com/moby/moby/commit/731a64069fac5738d56fe8752493e4f632b383bb"><code>731a640</code></a> c8d/list: Generate image summary concurrently</li>
<li>Additional commits viewable in <a href="https://github.com/docker/docker/compare/v25.0.5...v26.0.0">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/docker/docker&package-manager=go_modules&previous-version=25.0.5+incompatible&new-version=26.0.0+incompatible)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

buf.lock

@@ -4,4 +4,4 @@ deps:
   - remote: buf.build
     owner: googleapis
     repository: googleapis
-    commit: 7e6f6e774e29406da95bd61cdcdbc8bc
+    commit: ee48893a270147348e3edc6c1a03de0e

cmd/tink-worker/worker/registry.go

@@ -7,7 +7,7 @@ import (
 	"io"
 	"path"
 
-	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/image"
 	"github.com/docker/docker/api/types/registry"
 	"github.com/pkg/errors"
 )
@@ -31,7 +31,7 @@ type ImagePullStatus struct {
 }
 
 // PullImage outputs to stdout the contents of the requested image (relative to the registry).
-func (m *containerManager) PullImage(ctx context.Context, image string) error {
+func (m *containerManager) PullImage(ctx context.Context, img string) error {
 	l := m.getLogger(ctx)
 	authConfig := registry.AuthConfig{
 		Username:      m.registryDetails.Username,
@@ -44,7 +44,7 @@ func (m *containerManager) PullImage(ctx context.Context, image string) error {
 	}
 	authStr := base64.URLEncoding.EncodeToString(encodedJSON)
 
-	out, err := m.cli.ImagePull(ctx, path.Join(m.registryDetails.Registry, image), types.ImagePullOptions{RegistryAuth: authStr})
+	out, err := m.cli.ImagePull(ctx, path.Join(m.registryDetails.Registry, img), image.PullOptions{RegistryAuth: authStr})
 	if err != nil {
 		return errors.Wrap(err, "DOCKER PULL")
 	}

cmd/tink-worker/worker/registry_test.go

@@ -7,12 +7,12 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/image"
 	"github.com/go-logr/zapr"
 	"go.uber.org/zap"
 )
 
-func (c *fakeDockerClient) ImagePull(context.Context, string, types.ImagePullOptions) (io.ReadCloser, error) {
+func (c *fakeDockerClient) ImagePull(context.Context, string, image.PullOptions) (io.ReadCloser, error) {
 	if c.err != nil {
 		return nil, c.err
 	}

go.mod

@@ -7,7 +7,7 @@ toolchain go1.21.4
 require (
 	github.com/avast/retry-go v3.0.0+incompatible
 	github.com/distribution/reference v0.5.0
-	github.com/docker/docker v25.0.5+incompatible
+	github.com/docker/docker v26.0.0+incompatible
 	github.com/equinix-labs/otel-init-go v0.0.9
 	github.com/go-logr/logr v1.4.1
 	github.com/go-logr/zapr v1.3.0
@@ -75,6 +75,7 @@ require (
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.19 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect

go.sum

@@ -323,8 +323,8 @@ github.com/dgryski/go-lttb v0.0.0-20180810165845-318fcdf10a77/go.mod h1:Va5MyIzk
 github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
 github.com/distribution/reference v0.5.0 h1:/FUIFXtfc/x2gpa5/VGfiGLuOIdYa1t65IKK2OFGvA0=
 github.com/distribution/reference v0.5.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/docker v25.0.5+incompatible h1:UmQydMduGkrD5nQde1mecF/YnSbTOaPeFIeP5C4W+DE=
-github.com/docker/docker v25.0.5+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v26.0.0+incompatible h1:Ng2qi+gdKADUa/VM+6b6YaY2nlZhk/lVJiKR/2bMudU=
+github.com/docker/docker v26.0.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
 github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
@@ -635,6 +635,8 @@ github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:F
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
+github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/spdystream v0.2.0/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c=
 github.com/moby/term v0.0.0-20201216013528-df9cb8a40635/go.mod h1:FBS0z0QWA44HXygs7VXDUOGoN/1TV3RuWkLO04am3wc=
 github.com/moby/term v0.0.0-20221205130635-1aeaba878587 h1:HfkjXDfhgVaN5rmueG8cL8KKeFNecRCXFhaJ2qZ5SKA=

internal/agent/runtime/docker.go

@@ -7,8 +7,8 @@ import (
 	"regexp"
 
 	retry "github.com/avast/retry-go"
-	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/image"
 	"github.com/docker/docker/api/types/mount"
 	"github.com/docker/docker/client"
 	"github.com/go-logr/logr"
@@ -31,15 +31,15 @@ type Docker struct {
 func (d *Docker) Run(ctx context.Context, a workflow.Action) error {
 	pullImage := func() error {
 		// We need the image to be available before we can create a container.
-		image, err := d.client.ImagePull(ctx, a.Image, types.ImagePullOptions{})
+		img, err := d.client.ImagePull(ctx, a.Image, image.PullOptions{})
 		if err != nil {
 			return fmt.Errorf("docker: %w", err)
 		}
-		defer image.Close()
+		defer img.Close()
 
 		// Docker requires everything to be read from the images ReadCloser for the image to actually
 		// be pulled. We may want to log image pulls in a circular buffer somewhere for debugability.
-		if _, err = io.Copy(io.Discard, image); err != nil {
+		if _, err = io.Copy(io.Discard, img); err != nil {
 			return fmt.Errorf("docker: %w", err)
 		}
 

internal/agent/runtime/docker_test.go

@@ -16,8 +16,8 @@ import (
 	"github.com/tinkerbell/tink/internal/agent/workflow"
 	"go.uber.org/multierr"
 
-	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/filters"
+	"github.com/docker/docker/api/types/image"
 	"github.com/docker/docker/client"
 )
 
@@ -27,20 +27,20 @@ func TestDockerImageNotPresent(t *testing.T) {
 		t.Fatalf("Received unexpected error: %v", err)
 	}
 
-	image := "hello-world"
+	img := "hello-world"
 
-	images, err := clnt.ImageList(context.Background(), types.ImageListOptions{
-		Filters: filters.NewArgs(filters.Arg("reference", image)),
+	images, err := clnt.ImageList(context.Background(), image.ListOptions{
+		Filters: filters.NewArgs(filters.Arg("reference", img)),
 	})
 	if err != nil {
 		t.Fatalf("Unexpected error listing images: %v", err)
 	}
 
 	var errSum error
-	for _, image := range images {
-		_, err := clnt.ImageRemove(context.Background(), image.ID, types.ImageRemoveOptions{})
+	for _, img := range images {
+		_, err := clnt.ImageRemove(context.Background(), img.ID, image.RemoveOptions{})
 		if err != nil {
-			errSum = multierr.Append(errSum, fmt.Errorf("deleting image (%v): %v", image.ID, err))
+			errSum = multierr.Append(errSum, fmt.Errorf("deleting image (%v): %v", img.ID, err))
 		}
 	}
 	if errSum != nil {
@@ -55,7 +55,7 @@ func TestDockerImageNotPresent(t *testing.T) {
 
 	action := workflow.Action{
 		ID:    "foobar",
-		Image: image,
+		Image: img,
 	}
 
 	err = rt.Run(context.Background(), action)