From 4a548e223b7b0583c0db6a189d47c4dfffc7f769 Mon Sep 17 00:00:00 2001
From: Nell Jerram <nell@tigera.io>
Date: Fri, 30 Jan 2026 10:50:11 +0000
Subject: [PATCH 1/3] Cherry pick #11743 for v3.31 branch

On the v3.31 branch, "UT/FV tests on new kernel" CI is failing and the artifacts show the same
problem as in #11743, i.e.:
```
docker buildx build --load --platform=linux/amd64 --pull --build-arg UBI_IMAGE=registry.access.redhat.com/ubi9/ubi-minimal:latest --build-arg GIT_VERSION=v3.31.3-44-gd4da4610c064-dirty --build-arg CALICO_BASE=calico/base:ubi9-1764972441 --build-arg BPFTOOL_IMAGE=calico/bpftool:v7.5.0 -t typha:latest-amd64 -f docker-image/Dockerfile docker-image
ERROR: failed to build: Error response from daemon: client version 1.52 is too new. Maximum supported API version is 1.41: driver not connecting
make[2]: *** [Makefile:118: .calico_typha.created-amd64] Error 1
make[2]: Leaving directory '/home/ubuntu/calico/typha'
make[1]: *** [Makefile:302: build-typha] Error 2
make[1]: Leaving directory '/home/ubuntu/calico/felix'
make: Leaving directory '/home/ubuntu/calico/felix'
make: *** [Makefile:384: fv-bpf] Error 2
```

It's not identical to the master branch because I think v3.31 is still using Focal, not Jammy.  But
trying the same fix, adapted for Focal.
---
 .semaphore/vms/create-test-vm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.semaphore/vms/create-test-vm b/.semaphore/vms/create-test-vm
index 3a5bab9f66a..c8a5a633682 100755
--- a/.semaphore/vms/create-test-vm
+++ b/.semaphore/vms/create-test-vm
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Copyright (c) 2023 Tigera, Inc. All rights reserved.
+# Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -43,7 +43,7 @@ function create-vm() {
   ${ssh_cmd} -- "curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --yes --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg" && \
   ${ssh_cmd} -- "echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu focal stable' | sudo tee /etc/apt/sources.list.d/docker.list" && \
   ${ssh_cmd} -- sudo apt update -y && \
-  ${ssh_cmd} -- sudo apt install -y --no-install-recommends git docker-ce=5:28.1.1-1~ubuntu.20.04~focal docker-ce-cli=5:28.1.1-1~ubuntu.20.04~focal docker-buildx-plugin containerd.io make iproute2 wireguard && \
+  ${ssh_cmd} -- sudo apt install -y --no-install-recommends git docker-ce=5:28.1.1-1~ubuntu.20.04~focal docker-ce-cli=5:28.1.1-1~ubuntu.20.04~focal docker-buildx-plugin=0.29.0-0~ubuntu.20.04~focal containerd.io make iproute2 wireguard && \
   ${ssh_cmd} -- sudo usermod -a -G docker ubuntu && \
   ${ssh_cmd} -- sudo modprobe ipip && \
   ${ssh_cmd} -- 'if [ -s /etc/docker/daemon.json ] ; then cat /etc/docker/daemon.json | sed "\$d" | sed "\$s/\$/,/" > /tmp/daemon.json ; else echo -en {\\n > /tmp/daemon.json ; fi' && \

From d2de876db82cfb3145785ad2e8b717b2f4dcf8d5 Mon Sep 17 00:00:00 2001
From: Nell Jerram <nell@tigera.io>
Date: Fri, 30 Jan 2026 11:52:55 +0000
Subject: [PATCH 2/3] Oh, on this branch there's a whole different set of VM
 coding under `felix/.semaphore`

---
 .semaphore/semaphore-scheduled-builds.yml      | 1 +
 .semaphore/semaphore.yml                       | 1 +
 .semaphore/semaphore.yml.d/blocks/20-felix.yml | 1 +
 .semaphore/vms/create-test-vm                  | 4 ++--
 felix/.semaphore/create-test-vm                | 3 ++-
 5 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.semaphore/semaphore-scheduled-builds.yml b/.semaphore/semaphore-scheduled-builds.yml
index a6516d821e1..5981ea21894 100644
--- a/.semaphore/semaphore-scheduled-builds.yml
+++ b/.semaphore/semaphore-scheduled-builds.yml
@@ -629,6 +629,7 @@ blocks:
           - export IMAGE=ubuntu-2404-noble-amd64-v20250502a
           - export UBUNTU_VERSION=noble
           - export DOCKER_VERSION=5:27.5.1-1~ubuntu.24.04~noble
+          - export BUILDX_VERSION=" "
           - mkdir artifacts
           - ./.semaphore/create-test-vms ${VM_PREFIX}
       jobs:
diff --git a/.semaphore/semaphore.yml b/.semaphore/semaphore.yml
index 1f41907c7d3..41bf037fc37 100644
--- a/.semaphore/semaphore.yml
+++ b/.semaphore/semaphore.yml
@@ -629,6 +629,7 @@ blocks:
           - export IMAGE=ubuntu-2404-noble-amd64-v20250502a
           - export UBUNTU_VERSION=noble
           - export DOCKER_VERSION=5:27.5.1-1~ubuntu.24.04~noble
+          - export BUILDX_VERSION=" "
           - mkdir artifacts
           - ./.semaphore/create-test-vms ${VM_PREFIX}
       jobs:
diff --git a/.semaphore/semaphore.yml.d/blocks/20-felix.yml b/.semaphore/semaphore.yml.d/blocks/20-felix.yml
index ff994b34bc2..afeb7b4fd15 100644
--- a/.semaphore/semaphore.yml.d/blocks/20-felix.yml
+++ b/.semaphore/semaphore.yml.d/blocks/20-felix.yml
@@ -210,6 +210,7 @@
         - export IMAGE=ubuntu-2404-noble-amd64-v20250502a
         - export UBUNTU_VERSION=noble
         - export DOCKER_VERSION=5:27.5.1-1~ubuntu.24.04~noble
+        - export BUILDX_VERSION=" "
         - mkdir artifacts
         - ./.semaphore/create-test-vms ${VM_PREFIX}
     jobs:
diff --git a/.semaphore/vms/create-test-vm b/.semaphore/vms/create-test-vm
index c8a5a633682..3a5bab9f66a 100755
--- a/.semaphore/vms/create-test-vm
+++ b/.semaphore/vms/create-test-vm
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Copyright (c) 2023-2026 Tigera, Inc. All rights reserved.
+# Copyright (c) 2023 Tigera, Inc. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -43,7 +43,7 @@ function create-vm() {
   ${ssh_cmd} -- "curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --yes --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg" && \
   ${ssh_cmd} -- "echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu focal stable' | sudo tee /etc/apt/sources.list.d/docker.list" && \
   ${ssh_cmd} -- sudo apt update -y && \
-  ${ssh_cmd} -- sudo apt install -y --no-install-recommends git docker-ce=5:28.1.1-1~ubuntu.20.04~focal docker-ce-cli=5:28.1.1-1~ubuntu.20.04~focal docker-buildx-plugin=0.29.0-0~ubuntu.20.04~focal containerd.io make iproute2 wireguard && \
+  ${ssh_cmd} -- sudo apt install -y --no-install-recommends git docker-ce=5:28.1.1-1~ubuntu.20.04~focal docker-ce-cli=5:28.1.1-1~ubuntu.20.04~focal docker-buildx-plugin containerd.io make iproute2 wireguard && \
   ${ssh_cmd} -- sudo usermod -a -G docker ubuntu && \
   ${ssh_cmd} -- sudo modprobe ipip && \
   ${ssh_cmd} -- 'if [ -s /etc/docker/daemon.json ] ; then cat /etc/docker/daemon.json | sed "\$d" | sed "\$s/\$/,/" > /tmp/daemon.json ; else echo -en {\\n > /tmp/daemon.json ; fi' && \
diff --git a/felix/.semaphore/create-test-vm b/felix/.semaphore/create-test-vm
index 851349ca57f..ecd395d40ea 100755
--- a/felix/.semaphore/create-test-vm
+++ b/felix/.semaphore/create-test-vm
@@ -23,6 +23,7 @@ zone=europe-west3-c
 
 : ${IMAGE:=ubuntu-2204-jammy-v20250312}
 : ${DOCKER_VERSION=5:20.10.14~3-0~ubuntu-jammy}
+: ${BUILDX_VERSION="=0.29.0-0~ubuntu.22.04~jammy"}
 : ${UBUNTU_VERSION=jammy}
 
 gcloud config set project $project
@@ -45,7 +46,7 @@ function create-vm() {
   gcloud --quiet compute ssh --zone=${zone} "ubuntu@${vm_name}" -- "curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --yes --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg" && \
   gcloud --quiet compute ssh --zone=${zone} "ubuntu@${vm_name}" -- "echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu ${UBUNTU_VERSION} stable' | sudo tee /etc/apt/sources.list.d/docker.list" && \
   gcloud --quiet compute ssh --zone=${zone} "ubuntu@${vm_name}" -- sudo apt update -y && \
-  gcloud --quiet compute ssh --zone=${zone} "ubuntu@${vm_name}" -- sudo apt install -y --no-install-recommends git docker-ce=${DOCKER_VERSION} docker-ce-cli=${DOCKER_VERSION} docker-buildx-plugin containerd.io make iproute2 wireguard && \
+  gcloud --quiet compute ssh --zone=${zone} "ubuntu@${vm_name}" -- sudo apt install -y --no-install-recommends git docker-ce=${DOCKER_VERSION} docker-ce-cli=${DOCKER_VERSION} docker-buildx-plugin${BUILDX_VERSION} containerd.io make iproute2 wireguard && \
   gcloud --quiet compute ssh --zone=${zone} "ubuntu@${vm_name}" -- sudo usermod -a -G docker ubuntu && \
   gcloud --quiet compute ssh --zone=${zone} "ubuntu@${vm_name}" -- sudo modprobe ipip && \
   gcloud --quiet compute ssh --zone=${zone} "ubuntu@${vm_name}" -- 'if [ -s /etc/docker/daemon.json ] ; then cat /etc/docker/daemon.json | sed "\$d" | sed "\$s/\$/,/" > /tmp/daemon.json ; else echo -en {\\n > /tmp/daemon.json ; fi' && \

From 36f1c346faa2bccd785403954f7cad8f14ae61ba Mon Sep 17 00:00:00 2001
From: Nell Jerram <nell@tigera.io>
Date: Fri, 30 Jan 2026 14:33:26 +0000
Subject: [PATCH 3/3] Pin for 24.04 also, and tidy up so BUILDX_VERSION is more
 similar to DOCKER_VERSION

---
 .semaphore/semaphore-scheduled-builds.yml      | 2 +-
 .semaphore/semaphore.yml                       | 2 +-
 .semaphore/semaphore.yml.d/blocks/20-felix.yml | 2 +-
 felix/.semaphore/create-test-vm                | 4 ++--
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.semaphore/semaphore-scheduled-builds.yml b/.semaphore/semaphore-scheduled-builds.yml
index 5981ea21894..7b5c167fe51 100644
--- a/.semaphore/semaphore-scheduled-builds.yml
+++ b/.semaphore/semaphore-scheduled-builds.yml
@@ -629,7 +629,7 @@ blocks:
           - export IMAGE=ubuntu-2404-noble-amd64-v20250502a
           - export UBUNTU_VERSION=noble
           - export DOCKER_VERSION=5:27.5.1-1~ubuntu.24.04~noble
-          - export BUILDX_VERSION=" "
+          - export BUILDX_VERSION=0.31.1-1~ubuntu.24.04~noble
           - mkdir artifacts
           - ./.semaphore/create-test-vms ${VM_PREFIX}
       jobs:
diff --git a/.semaphore/semaphore.yml b/.semaphore/semaphore.yml
index 41bf037fc37..4af6be90fb6 100644
--- a/.semaphore/semaphore.yml
+++ b/.semaphore/semaphore.yml
@@ -629,7 +629,7 @@ blocks:
           - export IMAGE=ubuntu-2404-noble-amd64-v20250502a
           - export UBUNTU_VERSION=noble
           - export DOCKER_VERSION=5:27.5.1-1~ubuntu.24.04~noble
-          - export BUILDX_VERSION=" "
+          - export BUILDX_VERSION=0.31.1-1~ubuntu.24.04~noble
           - mkdir artifacts
           - ./.semaphore/create-test-vms ${VM_PREFIX}
       jobs:
diff --git a/.semaphore/semaphore.yml.d/blocks/20-felix.yml b/.semaphore/semaphore.yml.d/blocks/20-felix.yml
index afeb7b4fd15..2369374e441 100644
--- a/.semaphore/semaphore.yml.d/blocks/20-felix.yml
+++ b/.semaphore/semaphore.yml.d/blocks/20-felix.yml
@@ -210,7 +210,7 @@
         - export IMAGE=ubuntu-2404-noble-amd64-v20250502a
         - export UBUNTU_VERSION=noble
         - export DOCKER_VERSION=5:27.5.1-1~ubuntu.24.04~noble
-        - export BUILDX_VERSION=" "
+        - export BUILDX_VERSION=0.31.1-1~ubuntu.24.04~noble
         - mkdir artifacts
         - ./.semaphore/create-test-vms ${VM_PREFIX}
     jobs:
diff --git a/felix/.semaphore/create-test-vm b/felix/.semaphore/create-test-vm
index ecd395d40ea..7474b7fb55e 100755
--- a/felix/.semaphore/create-test-vm
+++ b/felix/.semaphore/create-test-vm
@@ -23,7 +23,7 @@ zone=europe-west3-c
 
 : ${IMAGE:=ubuntu-2204-jammy-v20250312}
 : ${DOCKER_VERSION=5:20.10.14~3-0~ubuntu-jammy}
-: ${BUILDX_VERSION="=0.29.0-0~ubuntu.22.04~jammy"}
+: ${BUILDX_VERSION=0.29.0-0~ubuntu.22.04~jammy}
 : ${UBUNTU_VERSION=jammy}
 
 gcloud config set project $project
@@ -46,7 +46,7 @@ function create-vm() {
   gcloud --quiet compute ssh --zone=${zone} "ubuntu@${vm_name}" -- "curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --yes --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg" && \
   gcloud --quiet compute ssh --zone=${zone} "ubuntu@${vm_name}" -- "echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu ${UBUNTU_VERSION} stable' | sudo tee /etc/apt/sources.list.d/docker.list" && \
   gcloud --quiet compute ssh --zone=${zone} "ubuntu@${vm_name}" -- sudo apt update -y && \
-  gcloud --quiet compute ssh --zone=${zone} "ubuntu@${vm_name}" -- sudo apt install -y --no-install-recommends git docker-ce=${DOCKER_VERSION} docker-ce-cli=${DOCKER_VERSION} docker-buildx-plugin${BUILDX_VERSION} containerd.io make iproute2 wireguard && \
+  gcloud --quiet compute ssh --zone=${zone} "ubuntu@${vm_name}" -- sudo apt install -y --no-install-recommends git docker-ce=${DOCKER_VERSION} docker-ce-cli=${DOCKER_VERSION} docker-buildx-plugin=${BUILDX_VERSION} containerd.io make iproute2 wireguard && \
   gcloud --quiet compute ssh --zone=${zone} "ubuntu@${vm_name}" -- sudo usermod -a -G docker ubuntu && \
   gcloud --quiet compute ssh --zone=${zone} "ubuntu@${vm_name}" -- sudo modprobe ipip && \
   gcloud --quiet compute ssh --zone=${zone} "ubuntu@${vm_name}" -- 'if [ -s /etc/docker/daemon.json ] ; then cat /etc/docker/daemon.json | sed "\$d" | sed "\$s/\$/,/" > /tmp/daemon.json ; else echo -en {\\n > /tmp/daemon.json ; fi' && \