chore(deps): update Docker to v28.2.2 and fix compatibility issues #9037
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This commit updates the daemon package to be compatible with Docker v28 by addressing breaking changes introduced in Docker API v1.46. Changes made: - Replace deprecated ImageInspectWithRaw with ImageInspect API - Remove deprecated container configuration fields from image config - Update dependencies to Docker v28.2.2 - Update testdocker to v0.0.0-20250616060700-ba6845ac6d17 which includes Docker v28 compatibility fixes (aquasecurity/testdocker#26) - Simplify imageConfig function to use only OCI-compliant fields Breaking changes addressed: Docker API v1.46 removed the following fields from image inspection Config: - Hostname, Domainname, AttachStdin, AttachStdout, AttachStderr - Tty, OpenStdin, StdinOnce, Image, NetworkDisabled, MacAddress These fields were implementation details and not part of the OCI image specification. The removal aligns Docker with the OCI standard. Test updates: - Update test expectations to match new API behavior - Remove assertions for deprecated fields that are no longer returned Fixes: Docker v28 compatibility issues
knqyf263
changed the title
knqyf263
changed the title
- Add nolint comments for gocritic ruleguard warnings about using set instead of map - Update image tests to match Docker v28 API behavior where deprecated Image field is removed in OCI-compliant scenarios
- Change dockerimage back to dimage to minimize diff changes - Keep functionality unchanged
Add overrideDockerRemovedFields function to handle image config fields that were removed from Docker API. This affects only Docker Engine tests where images are loaded directly into Docker daemon. Fields cleared in Docker Engine tests only: - Container (removed in Docker API v1.45) - Image (removed in Docker API v1.50) - Hostname (removed in Docker API v1.50) Other integration tests (TestTar, etc.) continue to compare these fields as they don't use Docker Engine and retain the original image metadata. This preserves golden file compatibility while ensuring Docker Engine tests work with newer Docker versions.
- Update containerd.go to use dockerimage.InspectResponse instead of api.ImageInspect - Fix Config field to use dockerspec.DockerOCIImageConfig structure - Update image config handling for Docker API field removals - Maintain compatibility with new Docker v28.2.2 API changes
…aped field
Update TestContainerd_LocalImage test cases to expect ArgsEscaped: true
instead of false to match Docker v28 API behavior changes.
In Docker v28, the containerd integration now populates the Config field
with dockerspec.DockerOCIImageConfig{ImageConfig: imgConfig.Config},
which preserves the actual ArgsEscaped value from the OCI image manifest
instead of using the default false value.
This change affects:
- alpine 3.10 test case: Add ArgsEscaped: true to Config
- vulnimage test case: Add ArgsEscaped: true to Config
- TestContainerd_PullImage: Change ArgsEscaped from false to true
The change reflects more accurate image metadata representation
where the actual OCI image configuration is preserved rather than
being overridden with default values.
…dition Update testcontainers-go to commit 1720acdcb24ef79dd34188da22da05e6cf72773c which includes the fix from testcontainers/testcontainers-go#3194 Background: Docker API changes in moby/moby#50030 affected how errdefs.ErrConflict errors are handled, causing testcontainers-go's isCleanupSafe function to no longer properly detect "already in progress" container removal errors. This resulted in test failures with messages like: "terminate: Error response from daemon: removal of container X is already in progress" The fix in testcontainers-go PR aquasecurity#3194 addresses this issue by updating the error handling logic to properly catch these Docker API error changes. Since this fix is not yet released, we use the specific commit hash. This resolves container cleanup race conditions in integration tests, particularly affecting TestContainerd_LocalImage and TestClientServerWithRedis.
knqyf263
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR updates Docker dependencies from v28.1.1 to v28.2.2 and addresses API compatibility issues that emerged with recent Docker versions, including fixing container cleanup errors in integration tests.
Changes
1. Docker API Updates
ImageInspectWithRawwithImageInspectAPI2. Fix ArgsEscaped field expectations in containerd tests
pkg/fanal/test/integration/containerd_test.goArgsEscapedfield is populated in image configArgsEscaped: trueinstead offalse3. Update testcontainers-go to fix container cleanup error
go.mod,go.sumerrdefs.ErrConflicterrors are handled1720acdcb24ef79dd34188da22da05e6cf72773cwhich includes the fix from testcontainers/testcontainers-go#3194API Changes Addressed
Recent Docker versions have deprecated
ImageInspectWithRawin favor ofImageInspect. Additionally, certain fields in the image inspection response have been removed or moved to align with OCI specifications:Hostname,Domainname,AttachStdin,AttachStdout,AttachStderr,Tty,OpenStdin,StdinOnce,Image,NetworkDisabled,MacAddressTest Results
Before fixes:
After fixes: