cli/command: Avoid panics after client initialization errors

When client.New rejects an invalid Docker host or other client option,
it returns a nil concrete client with an error.

Returning that pointer directly as client.APIClient stores a typed-nil
interface, so lazy version checks dereference it.

Return an error instead.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>

cli/command/cli.go

@@ -316,7 +316,11 @@ func newAPIClientFromEndpoint(ep docker.Endpoint, configFile *configfile.ConfigF
 		opts = append(opts, withCustomHeaders)
 	}
 	opts = append(opts, extraOpts...)
-	return client.New(opts...)
+	apiClient, err := client.New(opts...)
+	if err != nil {
+		return nil, err
+	}
+	return apiClient, nil
 }
 
 func resolveDockerEndpoint(s store.Reader, contextName string) (docker.Endpoint, error) {

cli/command/cli_test.go

@@ -132,6 +132,15 @@ func TestNewAPIClientFromFlagsWithAPIVersionFromEnv(t *testing.T) {
 	assert.Equal(t, apiclient.ClientVersion(), expectedVersion)
 }
 
+func TestNewAPIClientFromFlagsWithInvalidAPIVersionFromEnv(t *testing.T) {
+	t.Setenv("DOCKER_API_VERSION", "1")
+	t.Setenv("DOCKER_HOST", ":2375")
+
+	apiClient, err := NewAPIClientFromFlags(&flags.ClientOptions{}, &configfile.ConfigFile{})
+	assert.ErrorContains(t, err, "invalid API version")
+	assert.Check(t, apiClient == nil)
+}
+
 type fakeClient struct {
 	client.Client
 	pingFunc   func() (client.PingResult, error)