Merge pull request #7109 from vvoland/update-docker

[29.x] Bump to 29.6.2

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,37 +1,34 @@
 <!--
-Please make sure you've read and understood our contributing guidelines;
+Make sure you've read and understood our contributing guidelines;
 https://github.com/docker/cli/blob/master/CONTRIBUTING.md
 
-Make sure commits are signed off (`git commit -s`) with your real name.
+** Make sure all your commits include a signature generated with `git commit -s` **
 
-If the PR relates to an existing issue or PR, mention it at the top:
+If this is a bug fix, make sure your description includes "fixes #xxxx", or
+"closes #xxxx"
 
-- Fixes: https://github.com/docker/cli/issues/12345678
-- Replaces: https://github.com/docker/cli/pull/12345678
-- Follow up to: https://github.com/docker/cli/pull/12345678
-- Related to: https://github.com/docker/cli/issues/12345678
+Provide the following information:
 -->
 
-## Summary
+**- What I did**
 
-## Release notes (optional)
+**- How I did it**
+
+**- How to verify it**
+
+**- Human readable description for the release notes**
 
 <!--
-One-sentence user-facing release note.
-Leave empty if the change is not changelog-worthy.
-Use present tense and imperative tone.
+Write a short (one line) summary that describes the changes in this
+pull request for inclusion in the changelog.
+It must be placed inside the below triple backticks section.
 
-Good:
-- Fix a panic when running `docker top` on a non-running Windows container.
-- Don't print warnings in `docker info` for broken symlinks in CLI plugin directories.
-
-Bad:
-- Refactor test TestFooWithBar
-- Fixed a panic when running docker top
+NOTE: Only fill this section if changes introduced in this PR are user-facing.
+The PR must have a relevant impact/ label.
 -->
 
 ```markdown changelog
 
 ```
 
-## A picture of a cute animal (not mandatory but encouraged)
+**- A picture of a cute animal (not mandatory but encouraged)**

.github/dependabot.yml

@@ -9,10 +9,3 @@ updates:
       - "status/2-code-review"
     cooldown:
       default-days: 7
-    groups:
-      codeql-actions:
-        patterns:
-          - "github/codeql-action/*"
-      docker-actions:
-        patterns:
-          - "docker/*"

.github/renovate.json5

@@ -1,59 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:recommended",
-    // https://docs.renovatebot.com/modules/manager/github-actions/
-    // https://docs.renovatebot.com/presets-helpers/
-    "helpers:pinGitHubActionDigestsToSemver",
-    ":gitSignOff"
-  ],
-  "gomod": {
-    "managerFilePatterns": ["/(^|/)vendor\\.mod$/"]
-  },
-  "postUpdateOptions": ["gomodTidy"],
-  "minimumReleaseAge": "3 days",
-  "internalChecksFilter": "strict",
-  "packageRules": [
-    {
-      "matchManagers": ["gomod"],
-      "matchFileNames": ["vendor.mod"],
-      "semanticCommits": "disabled",
-      "commitMessagePrefix": "vendor:"
-    },
-    {
-      "matchManagers": ["gomod"],
-      "matchFileNames": ["cmd/docker-trust/go.mod"],
-      // The trust module does not vendor dependencies; vendor/ belongs to the root module.
-      "postUpdateOptions": ["gomodSkipVendor"],
-      "semanticCommits": "disabled",
-      "commitMessagePrefix": "cmd/docker-trust:"
-    },
-    {
-      "matchManagers": ["gomod"],
-      "matchFileNames": ["vendor.mod"],
-      "groupName": "golang.org/x packages",
-      "groupSlug": "golang-x",
-      "matchDepNames": ["/^golang\\.org\\/x\\//"]
-    },
-    {
-      "matchManagers": ["github-actions"],
-      "minimumReleaseAge": "7 days",
-      "addLabels": ["area/ci", "status/2-code-review"]
-    },
-    {
-      "matchManagers": ["github-actions"],
-      "groupName": "docker GitHub Actions",
-      "groupSlug": "docker-actions",
-      "matchDepNames": ["/^docker\\//"]
-    },
-    {
-      // Keep all the google.golang.org/genproto modules at the same version.
-      "matchManagers": ["gomod"],
-      "matchFileNames": ["vendor.mod"],
-      "groupName": "google.golang.org/genproto packages",
-      "groupSlug": "google-genproto",
-      "matchDepNames": ["/^google\\.golang\\.org\\/genproto(\\/|$)/"],
-      "schedule": ["every month"]
-    }
-  ]
-}

.github/workflows/build.yml

@@ -29,13 +29,13 @@ on:
 
 jobs:
   prepare:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     outputs:
       matrix: ${{ steps.platforms.outputs.matrix }}
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       -
@@ -49,7 +49,7 @@ jobs:
           echo ${{ steps.platforms.outputs.matrix }}
 
   build:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     needs:
       - prepare
     strategy:
@@ -65,10 +65,10 @@ jobs:
     steps:
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
       -
         name: Build
-        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
+        uses: docker/bake-action@6614cfa25eff9a0b2b2697efb0b6159e7680d584 # v7.2.0
         with:
           targets: ${{ matrix.target }}
           set: |
@@ -91,48 +91,62 @@ jobs:
           PLATFORM: ${{ matrix.platform }}
       -
         name: Upload artifacts
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ env.ARTIFACT_NAME }}
           path: /tmp/out/*
           if-no-files-found: error
 
   bin-image:
+    runs-on: ubuntu-24.04
     if: ${{ github.event_name != 'pull_request' && github.repository == 'docker/cli' }}
-    uses: docker/github-builder/.github/workflows/bake.yml@58cb9f5b71b1836d6f690c1e95effdeb9b98cb8a # v1.17.0
-    permissions:
-      contents: read # same as global permission
-      id-token: write # for signing attestation(s) and authenticating to Docker Hub with GitHub OIDC Token
-    with:
-      setup-qemu: true
-      target: bin-image-cross
-      cache: true
-      cache-scope: bin-image
-      output: image
-      push: true
-      vars: |
-        VERSION=${{ github.ref }}
-      meta-images: |
-        dockereng/cli-bin
-      meta-tags: |
-        type=semver,pattern={{version}}
-        type=ref,event=branch
-        type=ref,event=pr
-        type=semver,pattern={{major}}
-        type=semver,pattern={{major}}.{{minor}}
-      registry-identities: |
-        - type: dockerhub
-          username: dockereng
-          connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
+    steps:
+      -
+        name: Login to DockerHub
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        with:
+          username: ${{ secrets.DOCKERHUB_CLIBIN_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_CLIBIN_TOKEN }}
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      -
+        name: Docker meta
+        id: meta
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        with:
+          images: dockereng/cli-bin
+          tags: |
+            type=semver,pattern={{version}}
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{major}}
+            type=semver,pattern={{major}}.{{minor}}
+      -
+        name: Build and push image
+        uses: docker/bake-action@6614cfa25eff9a0b2b2697efb0b6159e7680d584 # v7.2.0
+        with:
+          files: |
+            ./docker-bake.hcl
+            cwd://${{ steps.meta.outputs.bake-file }}
+          targets: bin-image-cross
+          push: ${{ github.event_name != 'pull_request' }}
+          set: |
+            *.cache-from=type=gha,scope=bin-image
+            *.cache-to=type=gha,scope=bin-image,mode=max
 
   prepare-plugins:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     outputs:
       matrix: ${{ steps.platforms.outputs.matrix }}
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       -
@@ -146,7 +160,7 @@ jobs:
           echo ${{ steps.platforms.outputs.matrix }}
 
   plugins:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     needs:
       - prepare-plugins
     strategy:
@@ -156,10 +170,10 @@ jobs:
     steps:
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
       -
         name: Build
-        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
+        uses: docker/bake-action@6614cfa25eff9a0b2b2697efb0b6159e7680d584 # v7.2.0
         with:
           targets: plugins-cross
           set: |

.github/workflows/codeql.yml

@@ -34,7 +34,7 @@ on:
 
 jobs:
   codeql:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     env:
       DISABLE_WARN_OUTSIDE_CONTAINER: '1'
@@ -46,7 +46,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 2
           persist-credentials: false
@@ -62,20 +62,20 @@ jobs:
           ln -s vendor.sum go.sum
       -
         name: Update Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
-          go-version: "1.26.10"
+          go-version: "1.26.4"
           cache: false
       -
         name: Initialize CodeQL
-        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           languages: go
       -
         name: Autobuild
-        uses: github/codeql-action/autobuild@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
       -
         name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           category: "/language:go"

.github/workflows/e2e.yml

@@ -26,7 +26,7 @@ on:
 
 jobs:
   tests:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:
@@ -37,7 +37,6 @@ jobs:
           - alpine
           - debian
         engine-version:
-          - master  # moby/moby-bin:master
           - rc  # latest rc
           - 29  # latest
           - 28  # latest - 1
@@ -45,14 +44,14 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       -
         name: Update daemon.json
         run: |
           if [ ! -f /etc/docker/daemon.json ]; then
-            # ubuntu runners no longer have a default daemon.json present
+            # ubuntu 24.04 runners no longer have a default daemon.json present
             sudo mkdir -p /etc/docker/
             echo '{"experimental": true}' | sudo tee /etc/docker/daemon.json
           else
@@ -66,7 +65,7 @@ jobs:
           docker info
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
       -
         name: Run ${{ matrix.target }}
         run: |
@@ -77,7 +76,7 @@ jobs:
           TESTFLAGS: -coverprofile=/tmp/coverage/coverage.txt
       -
         name: Send to Codecov
-        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
         with:
           files: ./build/coverage/coverage.txt
           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/pr-review-trigger.yml

@@ -7,17 +7,8 @@ on:
 
 permissions: {}
 
-# Deduplicate simultaneous pull_request events for the same fork PR.
-# When reviewers are requested at the same time, GitHub fires multiple
-# review_requested events. Without this group each event triggers a
-# separate review via workflow_run, producing duplicate reviews.
-concurrency:
-  group: pr-review-trigger-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
 jobs:
   save-context:
-    if: github.event.pull_request.head.repo.fork
     runs-on: ubuntu-latest
     steps:
       - name: Save event context
@@ -35,7 +26,7 @@ jobs:
           fi
 
       - name: Upload context
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: pr-review-context
           path: context/

.github/workflows/pr-review.yml

@@ -11,13 +11,13 @@ permissions:
 
 jobs:
   review:
-    uses: docker/docker-agent-action/.github/workflows/review-pr.yml@3654ec391b070e247de2e2e3c1ff2519b6378b3a # v2.0.9
+    uses: docker/docker-agent-action/.github/workflows/review-pr.yml@e96a4bb40cac114f64358621e1d08346c8eadc8c # v2.0.1
     permissions:
       contents: read # Read repository files and PR diffs
       pull-requests: write # Post review comments
       issues: write # Create security incident issues if secrets detected
       checks: write # (Optional) Show review progress as a check run
       id-token: write # Required for OIDC authentication to AWS Secrets Manager
-      actions: write # Required since v2.0.3 — review-lock cache cleanup and feedback artifacts
+      actions: read # Download artifacts from trigger workflow
     with:
       trigger-run-id: ${{ github.event_name == 'workflow_run' && format('{0}', github.event.workflow_run.id) || '' }}

.github/workflows/sync-release-branch.yml

@@ -1,7 +1,7 @@
 name: Sync Docker release branch
 
 concurrency:
-  group: ${{ github.workflow }}-${{ inputs.release_branch }}
+  group: ${{ github.workflow }}-${{ github.ref_name }}
   cancel-in-progress: false
 
 permissions:
@@ -10,10 +10,6 @@ permissions:
 on:
   workflow_dispatch:
     inputs:
-      release_branch:
-        description: Release branch to sync, for example 29.x
-        required: true
-        type: string
       tag:
         description: Tag to sync from, for example v29.6.0
         required: true
@@ -26,10 +22,9 @@ on:
 
 jobs:
   sync-release-branch:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     permissions:
       contents: write
-      actions: write
     outputs:
       base_sha: ${{ steps.sync.outputs.base_sha }}
       has_changes: ${{ steps.sync.outputs.has_changes }}
@@ -38,25 +33,16 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 0
 
       - name: Validate
         env:
           BRANCH: ${{ github.ref_name }}
-          RELEASE_BRANCH: ${{ inputs.release_branch }}
         run: |
-          if [ "$BRANCH" != "master" ]; then
-            echo "::error::This workflow is expected to be run on master, not $BRANCH"
-            exit 1
-          fi
-          if [ "$RELEASE_BRANCH" = "master" ]; then
-            echo "::error::The release branch must not be master"
-            exit 1
-          fi
-          if ! [[ "$RELEASE_BRANCH" =~ ^[0-9]+\.[x0-9]+$ ]]; then
-            echo "::error::Invalid release branch name: '$RELEASE_BRANCH'. Expected format: 29.x"
+          if [ "$BRANCH" = "master" ]; then
+            echo "::error::This workflow is expected to be run on a release branch, not master"
             exit 1
           fi
 
@@ -69,7 +55,7 @@ jobs:
         id: sync
         env:
           DRY_RUN: ${{ inputs.dry_run }}
-          RELEASE_BRANCH: ${{ inputs.release_branch }}
+          RELEASE_BRANCH: ${{ github.ref_name }}
           RUN_ATTEMPT: ${{ github.run_attempt }}
           RUN_ID: ${{ github.run_id }}
           TAG: ${{ inputs.tag }}
@@ -80,14 +66,9 @@ jobs:
           echo "base_sha=$base_sha" >> "$GITHUB_OUTPUT"
           echo "temporary_branch=$temporary_branch" >> "$GITHUB_OUTPUT"
 
-          # Keep the master checkout unchanged so scripts run from the dispatched revision.
-          release_worktree="$RUNNER_TEMP/release-branch"
-          git worktree add --detach "$release_worktree" "$base_sha"
-          cd "$release_worktree"
-
           tags_file=$(mktemp)
-          "$GITHUB_WORKSPACE/scripts/unmerged-tags" \
-            "origin/$RELEASE_BRANCH" \
+          scripts/unmerged-tags \
+            "$RELEASE_BRANCH" \
             "$TAG" \
             > "$tags_file"
 
@@ -96,7 +77,7 @@ jobs:
           echo >> "$GITHUB_STEP_SUMMARY"
           sed 's/^/- /' "$tags_file" >> "$GITHUB_STEP_SUMMARY"
 
-          xargs -r "$GITHUB_WORKSPACE/scripts/sync-branch" < "$tags_file" | tee -a "$GITHUB_STEP_SUMMARY"
+          xargs -r scripts/sync-branch < "$tags_file" | tee -a "$GITHUB_STEP_SUMMARY"
 
           if [[ "$DRY_RUN" == "true" ]]; then
             echo "has_changes=false" >> "$GITHUB_OUTPUT"
@@ -116,22 +97,21 @@ jobs:
   push-release-branch:
     needs: sync-release-branch
     if: ${{ !inputs.dry_run && needs.sync-release-branch.outputs.has_changes == 'true' }}
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     environment: docker-releases
     permissions:
       contents: write
-      actions: write
     timeout-minutes: 10
     steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - name: Checkout release
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 0
 
       - name: Push release branch
         env:
           BASE_SHA: ${{ needs.sync-release-branch.outputs.base_sha }}
-          RELEASE_BRANCH: ${{ inputs.release_branch }}
+          RELEASE_BRANCH: ${{ github.ref_name }}
           TEMPORARY_BRANCH: ${{ needs.sync-release-branch.outputs.temporary_branch }}
           TEMPORARY_SHA: ${{ needs.sync-release-branch.outputs.temporary_sha }}
         run: |

.github/workflows/test.yml

@@ -26,19 +26,19 @@ on:
 
 jobs:
   ctn:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     steps:
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
       -
         name: Test
-        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
+        uses: docker/bake-action@6614cfa25eff9a0b2b2697efb0b6159e7680d584 # v7.2.0
         with:
           targets: test-coverage
       -
         name: Send to Codecov
-        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
         with:
           files: ./build/coverage/coverage.txt
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -60,15 +60,15 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           path: ${{ env.GOPATH }}/src/github.com/docker/cli
           persist-credentials: false
       -
         name: Set up Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
-          go-version: "1.26.10"
+          go-version: "1.26.4"
           cache: false
       -
         name: Test
@@ -82,7 +82,7 @@ jobs:
         shell: bash
       -
         name: Send to Codecov
-        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
         with:
           files: /tmp/coverage.txt
           working-directory: ${{ env.GOPATH }}/src/github.com/docker/cli

.github/workflows/validate-milestone.yml

@@ -10,7 +10,7 @@ on:
 
 jobs:
   validate-milestone:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
       - name: Validate milestone matches VERSION

.github/workflows/validate-pr.yml

@@ -15,7 +15,7 @@ on:
 
 jobs:
   check-labels:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 120 # guardrails timeout for the whole job
     steps:
       - name: Missing `area/` label
@@ -32,7 +32,7 @@ jobs:
         run: exit 0
 
   check-changelog:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 120 # guardrails timeout for the whole job
     env:
       HAS_IMPACT_LABEL: ${{ contains(join(github.event.pull_request.labels.*.name, ','), 'impact/') }}
@@ -70,7 +70,7 @@ jobs:
           echo "$desc"
 
   check-pr-branch:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 120 # guardrails timeout for the whole job
     env:
       PR_TITLE: ${{ github.event.pull_request.title }}

.github/workflows/validate.yml

@@ -26,7 +26,7 @@ on:
 
 jobs:
   validate:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:
@@ -38,17 +38,17 @@ jobs:
     steps:
       -
         name: Run
-        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
+        uses: docker/bake-action@6614cfa25eff9a0b2b2697efb0b6159e7680d584 # v7.2.0
         with:
           targets: ${{ matrix.target }}
 
   # check that the generated Markdown and the checked-in files match
   validate-md:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       -
@@ -66,7 +66,7 @@ jobs:
           fi
 
   validate-make:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:
@@ -76,7 +76,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       -
@@ -86,22 +86,22 @@ jobs:
           make -f docker.Makefile ${{ matrix.target }}
 
   validate-gocompat:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
     env:
       GOPATH: ${{ github.workspace }}
       GO111MODULE: off
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           path: src/github.com/docker/cli
           persist-credentials: false
       -
         name: Set up Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
-          go-version: "1.26.10"
+          go-version: "1.26.4"
           cache: false
       -
         name: Run gocompat check

.github/workflows/zizmor.yml

@@ -21,7 +21,7 @@ on:
 
 jobs:
   run:
-    uses: crazy-max/.github/.github/workflows/zizmor.yml@f91220cba053bd54299ba645a599ee8ed436f222 # v1.11.0
+    uses: crazy-max/.github/.github/workflows/zizmor.yml@46267a6e61cd56aac2fc79943df180152f4c89d6 # v1.10.1
     permissions:
       contents: read
       security-events: write

.golangci.yml

@@ -5,7 +5,7 @@ run:
   # which causes it to fallback to go1.17 semantics.
   #
   # TODO(thaJeztah): update "usetesting" settings to enable go1.24 features once our minimum version is go1.24
-  go: "1.26.10"
+  go: "1.26.4"
 
   timeout: 5m
 

CONTRIBUTING.md

@@ -267,7 +267,7 @@ Then you just add a line to every git commit message:
 
     Signed-off-by: Joe Smith <joe.smith@email.com>
 
-Use a known identity (sorry, no anonymous contributions.)
+Use your real name (sorry, no pseudonyms or anonymous contributions.)
 
 If you set your `user.name` and `user.email` git configs, you can sign your
 commit automatically with `git commit -s`.

Dockerfile

@@ -8,11 +8,11 @@ ARG BASE_VARIANT=alpine
 ARG ALPINE_VERSION=3.23
 ARG BASE_DEBIAN_DISTRO=bookworm
 
-ARG GO_VERSION=1.26.10
+ARG GO_VERSION=1.26.4
 
 # XX_VERSION specifies the version of the xx utility to use.
 # It must be a valid tag in the docker.io/tonistiigi/xx image repository.
-ARG XX_VERSION=1.10.0
+ARG XX_VERSION=1.9.0
 
 # GOVERSIONINFO_VERSION is the version of GoVersionInfo to install.
 # It must be a valid tag from https://github.com/josephspurrier/goversioninfo
@@ -25,12 +25,12 @@ ARG GOTESTSUM_VERSION=v1.13.0
 # BUILDX_VERSION sets the version of buildx to use for the e2e tests.
 # It must be a tag in the docker.io/docker/buildx-bin image repository
 # on Docker Hub.
-ARG BUILDX_VERSION=0.38.0
+ARG BUILDX_VERSION=0.34.1
 
 # COMPOSE_VERSION is the version of compose to install in the dev container.
 # It must be a tag in the docker.io/docker/compose-bin image repository
 # on Docker Hub.
-ARG COMPOSE_VERSION=v5.6.0
+ARG COMPOSE_VERSION=v5.1.3
 
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
 

README.md

@@ -3,6 +3,7 @@
 [![PkgGoDev](https://pkg.go.dev/badge/github.com/docker/cli)](https://pkg.go.dev/github.com/docker/cli)
 [![Build Status](https://img.shields.io/github/actions/workflow/status/docker/cli/build.yml?branch=master&label=build&logo=github)](https://github.com/docker/cli/actions?query=workflow%3Abuild)
 [![Test Status](https://img.shields.io/github/actions/workflow/status/docker/cli/test.yml?branch=master&label=test&logo=github)](https://github.com/docker/cli/actions?query=workflow%3Atest)
+[![Go Report Card](https://goreportcard.com/badge/github.com/docker/cli)](https://goreportcard.com/report/github.com/docker/cli)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/docker/cli/badge)](https://scorecard.dev/viewer/?uri=github.com/docker/cli)
 [![Codecov](https://img.shields.io/codecov/c/github/docker/cli?logo=codecov)](https://codecov.io/gh/docker/cli)
 

VERSION

@@ -1 +1 @@
-29.10.0
+29.6.2

cli-plugins/hooks/hook_types.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 // Package hooks defines the contract between the Docker CLI and CLI plugin hook
 // implementations.
@@ -30,11 +30,7 @@ package hooks
 type ResponseType int
 
 const (
-	// NextSteps renders suggestions under a shared "What's next:" header.
 	NextSteps ResponseType = 0
-	// GenericMessage renders before NextSteps, without a header or indentation.
-	// CLI versions that do not recognize this type ignore the response.
-	GenericMessage ResponseType = 1
 )
 
 // Request is the type representing the information

cli-plugins/hooks/printer.go

@@ -7,42 +7,17 @@ const (
 	indent    = "    "
 )
 
-// PrintMessages groups messages by type and writes them to out. Generic messages
-// appear first, without a header or indentation, followed by next steps under a
-// shared "What's next:" header. Order within each type is preserved.
-// Messages with no lines or an unknown type produce no output.
-func PrintMessages(out io.Writer, messages []Response, evaluate func(Response) []string) {
-	grouped := make(map[ResponseType][]string)
-	for _, message := range messages {
-		lines := evaluate(message)
-		grouped[message.Type] = append(grouped[message.Type], lines...)
-	}
-	for _, responseType := range []ResponseType{GenericMessage, NextSteps} {
-		lines := grouped[responseType]
-		if len(lines) == 0 {
-			continue
-		}
-
-		header, prefix := "\n", ""
-		if responseType == NextSteps {
-			header, prefix = whatsNext, indent
-		}
-
-		_, _ = io.WriteString(out, header)
-		for _, line := range lines {
-			_, _ = io.WriteString(out, prefix)
-			_, _ = io.WriteString(out, line)
-			_, _ = io.WriteString(out, "\n")
-		}
-	}
-}
-
 // PrintNextSteps renders list of [NextSteps] messages and writes them
 // to out. It is a no-op if messages is empty.
-//
-// Deprecated: use [PrintMessages] instead.
 func PrintNextSteps(out io.Writer, messages []string) {
-	PrintMessages(out, []Response{{Type: NextSteps}}, func(Response) []string {
-		return messages
-	})
+	if len(messages) == 0 {
+		return
+	}
+
+	_, _ = io.WriteString(out, whatsNext)
+	for _, msg := range messages {
+		_, _ = io.WriteString(out, indent)
+		_, _ = io.WriteString(out, msg)
+		_, _ = io.WriteString(out, "\n")
+	}
 }

cli-plugins/hooks/printer_test.go

@@ -8,85 +8,7 @@ import (
 	"gotest.tools/v3/assert"
 )
 
-func TestPrintMessages(t *testing.T) {
-	const header = "\n\x1b[1mWhat's next:\x1b[0m\n"
-
-	for _, tc := range []struct {
-		doc      string
-		messages []hooks.Response
-		expected string
-	}{
-		{doc: "no messages"},
-		{
-			doc: "no lines",
-			messages: []hooks.Response{
-				{Type: hooks.GenericMessage},
-				{Type: hooks.NextSteps},
-			},
-		},
-		{
-			doc: "generic message",
-			messages: []hooks.Response{
-				{Type: hooks.GenericMessage, Template: "Session active"},
-			},
-			expected: "\nSession active\n",
-		},
-		{
-			doc: "preserve message formatting",
-			messages: []hooks.Response{
-				{Type: hooks.GenericMessage, Template: "Session active\n\n  Details"},
-			},
-			expected: "\nSession active\n\n  Details\n",
-		},
-		{
-			doc: "next steps",
-			messages: []hooks.Response{
-				{Type: hooks.NextSteps, Template: "Try another command"},
-			},
-			expected: header + "    Try another command\n",
-		},
-		{
-			doc: "group interleaved types and preserve order within each type",
-			messages: []hooks.Response{
-				{Type: hooks.NextSteps, Template: "First suggestion"},
-				{Type: hooks.GenericMessage, Template: "Session active"},
-				{Type: hooks.NextSteps, Template: "Second suggestion\nThird suggestion"},
-				{Type: hooks.GenericMessage, Template: "Another status"},
-			},
-			expected: "\nSession active\nAnother status\n" + header + "    First suggestion\n    Second suggestion\n    Third suggestion\n",
-		},
-		{
-			doc: "unknown type",
-			messages: []hooks.Response{
-				{Type: hooks.ResponseType(99), Template: "Ignored"},
-			},
-		},
-		{
-			doc: "unknown type does not affect known messages",
-			messages: []hooks.Response{
-				{Type: hooks.ResponseType(99), Template: "Ignored"},
-				{Type: hooks.GenericMessage, Template: "Session active"},
-				{Type: hooks.NextSteps, Template: "Try another command"},
-			},
-			expected: "\nSession active\n" + header + "    Try another command\n",
-		},
-	} {
-		t.Run(tc.doc, func(t *testing.T) {
-			var w strings.Builder
-			hooks.PrintMessages(&w, tc.messages, func(message hooks.Response) []string {
-				if message.Template == "" {
-					return nil
-				}
-				lines, err := hooks.ParseTemplate(message.Template, nil)
-				assert.NilError(t, err)
-				return lines
-			})
-			assert.Equal(t, w.String(), tc.expected)
-		})
-	}
-}
-
-func TestPrintNextSteps(t *testing.T) {
+func TestPrintHookMessages(t *testing.T) {
 	const header = "\n\x1b[1mWhat's next:\x1b[0m\n"
 
 	tests := []struct {
@@ -112,11 +34,6 @@ func TestPrintNextSteps(t *testing.T) {
 				"    Foo\n" +
 				"    bar\n",
 		},
-		{
-			doc:            "preserve empty and indented lines",
-			messages:       []string{"", "  Details", ""},
-			expectedOutput: header + "    \n      Details\n    \n",
-		},
 	}
 	for _, tc := range tests {
 		t.Run(tc.doc, func(t *testing.T) {

cli-plugins/hooks/template.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package hooks
 
@@ -7,7 +7,6 @@ import (
 	"bytes"
 	"errors"
 	"fmt"
-	"slices"
 	"strings"
 	"text/template"
 
@@ -44,16 +43,7 @@ func ParseTemplate(hookTemplate string, cmd *cobra.Command) ([]string, error) {
 	if n := strings.Count(out, "\n"); n > maxMessages {
 		return nil, fmt.Errorf("hook template contains too many messages (%d): maximum is %d", n, maxMessages)
 	}
-	lines := strings.SplitN(out, "\n", maxMessages)
-
-	// Skip messages containing only whitespace, but preserve empty lines
-	// in messages that have content (e.g., for paragraph spacing).
-	if !slices.ContainsFunc(lines, func(line string) bool {
-		return strings.TrimSpace(line) != ""
-	}) {
-		return nil, nil
-	}
-	return lines, nil
+	return strings.SplitN(out, "\n", maxMessages), nil
 }
 
 var ErrHookTemplateParse = errors.New("failed to parse hook template")

cli-plugins/hooks/template_test.go

@@ -33,17 +33,7 @@ func TestParseTemplate(t *testing.T) {
 		{
 			doc:            "empty template",
 			template:       "",
-			expectedOutput: nil,
-		},
-		{
-			doc:            "only empty lines",
-			template:       "\n\n",
-			expectedOutput: nil,
-		},
-		{
-			doc:            "whitespace-only lines",
-			template:       " \n\t\n  ",
-			expectedOutput: nil,
+			expectedOutput: []string{""},
 		},
 		{
 			doc:            "plain message",

cli-plugins/manager/cobra_test.go

@@ -3,7 +3,6 @@ package manager
 import (
 	"os"
 	"path/filepath"
-	"slices"
 	"sync"
 	"testing"
 
@@ -46,7 +45,7 @@ func TestPluginStubCompletionRestoresOSArgs(t *testing.T) {
 	t.Cleanup(func() { os.Args = savedArgs })
 
 	originalArgs := []string{"docker", "image", "ls"}
-	os.Args = slices.Clone(originalArgs)
+	os.Args = append([]string(nil), originalArgs...)
 
 	_, directive := cmd.ValidArgsFunction(cmd, []string{"--all"}, "alp")
 	assert.Equal(t, directive, cobra.ShellCompDirectiveError)

cli-plugins/manager/error.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package manager
 

cli-plugins/manager/hooks.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package manager
 
@@ -49,18 +49,11 @@ func RunPluginHooks(ctx context.Context, dockerCLI config.Provider, rootCmd, sub
 }
 
 func runHooks(ctx context.Context, cfg *configfile.ConfigFile, rootCmd, subCommand *cobra.Command, invokedCommand string, flags map[string]string, cmdErrorMessage string) {
-	messages := invokeAndCollectHooks(ctx, cfg, rootCmd, invokedCommand, flags, cmdErrorMessage)
-	hooks.PrintMessages(subCommand.ErrOrStderr(), messages, func(message hooks.Response) []string {
-		lines, err := hooks.ParseTemplate(message.Template, subCommand)
-		if err != nil {
-			logrus.WithError(err).Debug("Failed to evaluate hook template")
-			return nil
-		}
-		return lines
-	})
+	nextSteps := invokeAndCollectHooks(ctx, cfg, rootCmd, subCommand, invokedCommand, flags, cmdErrorMessage)
+	hooks.PrintNextSteps(subCommand.ErrOrStderr(), nextSteps)
 }
 
-func invokeAndCollectHooks(ctx context.Context, cfg *configfile.ConfigFile, rootCmd *cobra.Command, subCmdStr string, flags map[string]string, cmdErrorMessage string) []hooks.Response {
+func invokeAndCollectHooks(ctx context.Context, cfg *configfile.ConfigFile, rootCmd, subCmd *cobra.Command, subCmdStr string, flags map[string]string, cmdErrorMessage string) []string {
 	if ctx.Err() != nil {
 		return nil
 	}
@@ -71,17 +64,17 @@ func invokeAndCollectHooks(ctx context.Context, cfg *configfile.ConfigFile, root
 	}
 
 	pluginDirs := getPluginDirs(cfg)
-	var collected []hooks.Response
+	nextSteps := make([]string, 0, len(pluginsCfg))
 
-	tryInvokeHook := func(pluginName string, pluginCfg map[string]string) (hooks.Response, error) {
+	tryInvokeHook := func(pluginName string, pluginCfg map[string]string) (messages []string, ok bool, err error) {
 		match, matched := pluginMatch(pluginCfg, subCmdStr, cmdErrorMessage)
 		if !matched {
-			return hooks.Response{}, nil
+			return nil, false, nil
 		}
 
 		p, err := getPlugin(pluginName, pluginDirs, rootCmd)
 		if err != nil {
-			return hooks.Response{}, err
+			return nil, false, err
 		}
 
 		resp, err := p.RunHook(ctx, hooks.Request{
@@ -90,23 +83,29 @@ func invokeAndCollectHooks(ctx context.Context, cfg *configfile.ConfigFile, root
 			CommandError: cmdErrorMessage,
 		})
 		if err != nil {
-			return hooks.Response{}, err
+			return nil, false, err
 		}
 
 		var message hooks.Response
 		if err := json.Unmarshal(resp, &message); err != nil {
-			return hooks.Response{}, fmt.Errorf("failed to unmarshal hook response (%q): %w", string(resp), err)
+			return nil, false, fmt.Errorf("failed to unmarshal hook response (%q): %w", string(resp), err)
 		}
 
-		if message.Type != hooks.NextSteps && message.Type != hooks.GenericMessage {
-			return hooks.Response{}, errors.New("unexpected hook response type: " + strconv.Itoa(int(message.Type)))
+		// currently the only hook type
+		if message.Type != hooks.NextSteps {
+			return nil, false, errors.New("unexpected hook response type: " + strconv.Itoa(int(message.Type)))
 		}
 
-		return message, nil
+		messages, err = hooks.ParseTemplate(message.Template, subCmd)
+		if err != nil {
+			return nil, false, err
+		}
+
+		return messages, true, nil
 	}
 
 	for pluginName, pluginCfg := range pluginsCfg {
-		message, err := tryInvokeHook(pluginName, pluginCfg)
+		messages, ok, err := tryInvokeHook(pluginName, pluginCfg)
 		if err != nil {
 			// skip misbehaving plugins, but don't halt execution
 			logrus.WithFields(logrus.Fields{
@@ -115,13 +114,38 @@ func invokeAndCollectHooks(ctx context.Context, cfg *configfile.ConfigFile, root
 			}).Debug("Plugin hook invocation failed")
 			continue
 		}
-		if message.Template == "" {
+		if !ok {
 			continue
 		}
 
-		collected = append(collected, message)
+		var appended bool
+		nextSteps, appended = appendNextSteps(nextSteps, messages)
+		if !appended {
+			logrus.WithFields(logrus.Fields{
+				"plugin": pluginName,
+			}).Debug("Plugin responded with an empty hook message; ignoring")
+		}
 	}
-	return collected
+	return nextSteps
+}
+
+// appendNextSteps appends the processed hook output to the nextSteps slice.
+// If the processed hook output is empty, it is not appended.
+// Empty lines are not stripped if there's at least one non-empty line.
+func appendNextSteps(nextSteps []string, processed []string) ([]string, bool) {
+	empty := true
+	for _, l := range processed {
+		if strings.TrimSpace(l) != "" {
+			empty = false
+			break
+		}
+	}
+
+	if empty {
+		return nextSteps, false
+	}
+
+	return append(nextSteps, processed...), true
 }
 
 // pluginMatch takes a plugin configuration and a string representing the

cli-plugins/manager/hooks_test.go

@@ -2,11 +2,6 @@ package manager
 
 import (
 	"context"
-	"fmt"
-	"os"
-	"path/filepath"
-	"runtime"
-	"strings"
 	"testing"
 
 	"github.com/docker/cli/cli/config/configfile"
@@ -263,6 +258,38 @@ func TestMatchHookConfig(t *testing.T) {
 	}
 }
 
+func TestAppendNextSteps(t *testing.T) {
+	testCases := []struct {
+		processed   []string
+		expectedOut []string
+	}{
+		{
+			processed:   []string{},
+			expectedOut: []string{},
+		},
+		{
+			processed:   []string{"", ""},
+			expectedOut: []string{},
+		},
+		{
+			processed:   []string{"Some hint", "", "Some other hint"},
+			expectedOut: []string{"Some hint", "", "Some other hint"},
+		},
+		{
+			processed:   []string{"Hint 1", "Hint 2"},
+			expectedOut: []string{"Hint 1", "Hint 2"},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run("", func(t *testing.T) {
+			got, appended := appendNextSteps([]string{}, tc.processed)
+			assert.Check(t, is.DeepEqual(got, tc.expectedOut))
+			assert.Check(t, is.Equal(appended, len(got) > 0))
+		})
+	}
+}
+
 func TestRunPluginHooksPassesErrorMessage(t *testing.T) {
 	cfg := configfile.New("")
 	cfg.Plugins = map[string]map[string]string{
@@ -309,7 +336,7 @@ func TestInvokeAndCollectHooksErrorHooksSkippedOnSuccess(t *testing.T) {
 	// On success, error-hooks should not match, so the plugin
 	// binary is never looked up and no results are returned.
 	result := invokeAndCollectHooks(
-		context.Background(), cfg, root,
+		context.Background(), cfg, root, sub,
 		"build", map[string]string{}, "",
 	)
 	assert.Check(t, is.Len(result, 0))
@@ -322,7 +349,7 @@ func TestInvokeAndCollectHooksNoPlugins(t *testing.T) {
 	root.AddCommand(sub)
 
 	result := invokeAndCollectHooks(
-		context.Background(), cfg, root,
+		context.Background(), cfg, root, sub,
 		"build", map[string]string{}, "some error",
 	)
 	assert.Check(t, is.Len(result, 0))
@@ -341,108 +368,8 @@ func TestInvokeAndCollectHooksCancelledContext(t *testing.T) {
 	cancel() // cancel immediately
 
 	result := invokeAndCollectHooks(
-		ctx, cfg, root,
+		ctx, cfg, root, sub,
 		"build", map[string]string{}, "exit status 1",
 	)
 	assert.Check(t, is.Nil(result))
 }
-
-func TestRunHooksMessages(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("test plugins require a POSIX shell")
-	}
-
-	const header = "\n\x1b[1mWhat's next:\x1b[0m\n"
-	for _, tc := range []struct {
-		doc       string
-		responses map[string]string
-		expected  string
-	}{
-		{
-			doc: "generic message preserves formatting and expands templates",
-			responses: map[string]string{
-				"status": `{"Type":1,"Template":"Status for {{command}}\n\n  Details"}`,
-			},
-			expected: "\nStatus for build\n\n  Details\n",
-		},
-		{
-			doc: "omitted type defaults to next steps",
-			responses: map[string]string{
-				"suggestion": `{"Template":"Try another command"}`,
-			},
-			expected: header + "    Try another command\n",
-		},
-		{
-			doc: "generic messages precede shared next steps header",
-			responses: map[string]string{
-				"statusone":     `{"Type":1,"Template":"Session active"}`,
-				"statustwo":     `{"Type":1,"Template":"Session active"}`,
-				"suggestionone": `{"Type":0,"Template":"Try another command"}`,
-				"suggestiontwo": `{"Type":0,"Template":"Try another command"}`,
-			},
-			expected: "\nSession active\nSession active\n" + header + "    Try another command\n    Try another command\n",
-		},
-		{
-			doc: "empty responses produce no output",
-			responses: map[string]string{
-				"status":     `{"Type":1,"Template":" \n\t"}`,
-				"suggestion": `{"Type":0,"Template":""}`,
-			},
-		},
-		{
-			doc: "empty generic message does not affect next steps",
-			responses: map[string]string{
-				"status":     `{"Type":1,"Template":""}`,
-				"suggestion": `{"Type":0,"Template":"Try another command"}`,
-			},
-			expected: header + "    Try another command\n",
-		},
-		{
-			doc: "invalid responses do not affect other plugins",
-			responses: map[string]string{
-				"unknown":    `{"Type":99,"Template":"Ignored"}`,
-				"invalid":    `{"Type":1,"Template":"{{"}`,
-				"status":     `{"Type":1,"Template":"Session active"}`,
-				"suggestion": `{"Type":0,"Template":"Try another command"}`,
-			},
-			expected: "\nSession active\n" + header + "    Try another command\n",
-		},
-	} {
-		t.Run(tc.doc, func(t *testing.T) {
-			pluginDir := t.TempDir()
-			cfg := configfile.New("")
-			cfg.CLIPluginsExtraDirs = []string{pluginDir}
-			cfg.Plugins = make(map[string]map[string]string)
-			for name, response := range tc.responses {
-				plugin := fmt.Sprintf(`#!/bin/sh
-case "$1" in
-docker-cli-plugin-metadata)
-    printf '%%s\n' '{"SchemaVersion":"0.1.0","Vendor":"test"}'
-    ;;
-*)
-    test "$2" = docker-cli-plugin-hooks || exit 1
-    printf 'called\n' >> "$0.calls"
-    printf '%%s\n' '%s'
-    ;;
-esac
-`, response)
-				assert.NilError(t, os.WriteFile(filepath.Join(pluginDir, "docker-"+name), []byte(plugin), 0o755))
-				cfg.Plugins[name] = map[string]string{"hooks": "build"}
-			}
-
-			root := &cobra.Command{Use: "docker"}
-			sub := &cobra.Command{Use: "build"}
-			root.AddCommand(sub)
-			var output strings.Builder
-			sub.SetErr(&output)
-
-			runHooks(context.Background(), cfg, root, sub, "build", nil, "")
-			assert.Equal(t, output.String(), tc.expected)
-			for name := range tc.responses {
-				calls, err := os.ReadFile(filepath.Join(pluginDir, "docker-"+name+".calls"))
-				assert.NilError(t, err)
-				assert.Equal(t, string(calls), "called\n", "each plugin hook must run exactly once")
-			}
-		})
-	}
-}

cli-plugins/manager/manager.go

@@ -1,6 +1,3 @@
-// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
-
 package manager
 
 import (
@@ -9,7 +6,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	slices "slices"
+	"sort"
 	"strings"
 	"sync"
 
@@ -167,8 +164,8 @@ func ListPlugins(dockerCli config.Provider, rootcmd *cobra.Command) ([]Plugin, e
 		return nil, err
 	}
 
-	slices.SortFunc(plugins, func(a, b Plugin) int {
-		return sortorder.NaturalCompare(a.Name, b.Name)
+	sort.Slice(plugins, func(i, j int) bool {
+		return sortorder.NaturalLess(plugins[i].Name, plugins[j].Name)
 	})
 
 	return plugins, nil

cli-plugins/manager/plugin.go

@@ -1,6 +1,3 @@
-// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
-
 package manager
 
 import (
@@ -170,7 +167,8 @@ func (p *Plugin) RunHook(ctx context.Context, hookData hooks.Request) ([]byte, e
 
 	out, err := pCmd.Output()
 	if err != nil {
-		if _, ok := errors.AsType[*exec.ExitError](err); ok {
+		var exitErr *exec.ExitError
+		if errors.As(err, &exitErr) {
 			return nil, wrapAsPluginError(err, "plugin hook subcommand exited unsuccessfully")
 		}
 		return nil, wrapAsPluginError(err, "failed to execute plugin hook subcommand: "+pCmd.String())

cli-plugins/metadata/metadata.go

@@ -1,6 +1,3 @@
-// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
-
 package metadata
 
 const (
@@ -38,7 +35,4 @@ type Metadata struct {
 	URL string `json:",omitempty"`
 	// Hidden hides the plugin in completion and help message output.
 	Hidden bool `json:",omitempty"`
-	// Features declares optional contracts supported by the plugin, keyed by
-	// feature name.
-	Features map[string]any `json:",omitempty"`
 }

cli-plugins/plugin/plugin.go

@@ -1,6 +1,3 @@
-// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
-
 package plugin
 
 import (
@@ -100,7 +97,8 @@ func Run(makeCmd func(command.Cli) *cobra.Command, meta metadata.Metadata, ops .
 	plugin := makeCmd(dockerCLI)
 
 	if err := RunPlugin(dockerCLI, plugin, meta); err != nil {
-		if stErr, ok := errors.AsType[cli.StatusError](err); ok {
+		var stErr cli.StatusError
+		if errors.As(err, &stErr) {
 			// StatusError should only be used for errors, and all errors should
 			// have a non-zero exit status, so never exit with 0
 			if stErr.StatusCode == 0 { // FIXME(thaJeztah): this should never be used with a zero status-code. Check if we do this anywhere.

cli/cobra.go

@@ -1,12 +1,9 @@
-// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
-
 package cli
 
 import (
 	"fmt"
 	"os"
-	"slices"
+	"sort"
 	"strings"
 
 	"github.com/docker/cli/cli-plugins/metadata"
@@ -276,8 +273,8 @@ func topCommands(cmd *cobra.Command) []*cobra.Command {
 			cmds = append(cmds, sub)
 		}
 	}
-	slices.SortStableFunc(cmds, func(a, b *cobra.Command) int {
-		return sortorder.NaturalCompare(a.Annotations["category-top"], b.Annotations["category-top"])
+	sort.SliceStable(cmds, func(i, j int) bool {
+		return sortorder.NaturalLess(cmds[i].Annotations["category-top"], cmds[j].Annotations["category-top"])
 	})
 	return cmds
 }

cli/command/cli.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package command
 
@@ -16,7 +16,6 @@ import (
 
 	"github.com/docker/cli/cli/config"
 	"github.com/docker/cli/cli/config/configfile"
-	configtypes "github.com/docker/cli/cli/config/types"
 	dcontext "github.com/docker/cli/cli/context"
 	"github.com/docker/cli/cli/context/docker"
 	"github.com/docker/cli/cli/context/store"
@@ -24,7 +23,6 @@ import (
 	cliflags "github.com/docker/cli/cli/flags"
 	"github.com/docker/cli/cli/streams"
 	"github.com/docker/cli/cli/version"
-	"github.com/docker/cli/internal/secretsengine"
 	dopts "github.com/docker/cli/opts"
 	"github.com/moby/moby/api/types/build"
 	"github.com/moby/moby/client"
@@ -70,15 +68,12 @@ type DockerCli struct {
 	serverInfo         ServerInfo
 	contextStore       store.Store
 	currentContext     string
-	contextResolver    func(*DockerCli) (string, error)
 	init               sync.Once
 	initErr            error
 	dockerEndpoint     docker.Endpoint
 	contextStoreConfig *store.Config
 	initTimeout        time.Duration
 	res                telemetryResource
-	registryAuthOnce   sync.Once
-	registryAuth       secretsengine.AuthProvider
 
 	// baseCtx is the base context used for internal operations. In the future
 	// this may be replaced by explicitly passing a context to functions that
@@ -145,21 +140,6 @@ func (cli *DockerCli) ConfigFile() *configfile.ConfigFile {
 	return cli.configFile
 }
 
-func (cli *DockerCli) RegistryAuthProvider() secretsengine.AuthProvider {
-	cli.registryAuthOnce.Do(func() {
-		cli.registryAuth = secretsengine.NewDesktop(configFileAuth{cli})
-	})
-	return cli.registryAuth
-}
-
-type configFileAuth struct {
-	cli *DockerCli
-}
-
-func (c configFileAuth) GetAuthConfig(registryHostname string) (configtypes.AuthConfig, error) {
-	return c.cli.ConfigFile().GetAuthConfig(registryHostname)
-}
-
 // ServerInfo returns the server version details for the host this client is
 // connected to
 func (cli *DockerCli) ServerInfo() ServerInfo {
@@ -228,8 +208,6 @@ func (cli *DockerCli) HooksEnabled() bool {
 
 // Initialize the dockerCli runs initialization that must happen after command
 // line flags are parsed.
-//
-//nolint:gocyclo
 func (cli *DockerCli) Initialize(opts *cliflags.ClientOptions, ops ...CLIOption) error {
 	for _, o := range ops {
 		if err := o(cli); err != nil {
@@ -279,16 +257,6 @@ func (cli *DockerCli) Initialize(opts *cliflags.ClientOptions, ops ...CLIOption)
 		},
 	}
 
-	if cli.contextResolver != nil {
-		contextName, err := cli.contextResolver(cli)
-		if err != nil {
-			return err
-		}
-		if contextName != "" {
-			cli.currentContext = contextName
-		}
-	}
-
 	// TODO(krissetto): pass ctx to the funcs instead of using this
 	if cli.enableGlobalMeter {
 		cli.createGlobalMeterProvider(cli.baseCtx)
@@ -348,11 +316,7 @@ func newAPIClientFromEndpoint(ep docker.Endpoint, configFile *configfile.ConfigF
 		opts = append(opts, withCustomHeaders)
 	}
 	opts = append(opts, extraOpts...)
-	apiClient, err := client.New(opts...)
-	if err != nil {
-		return nil, err
-	}
-	return apiClient, nil
+	return client.New(opts...)
 }
 
 func resolveDockerEndpoint(s store.Reader, contextName string) (docker.Endpoint, error) {

cli/command/cli_options.go

@@ -84,19 +84,6 @@ func WithDefaultContextStoreConfig() CLIOption {
 	}
 }
 
-// WithContextResolver overrides context selection during [DockerCli.Initialize].
-// The resolver runs after configuration and the context store are loaded, but
-// before telemetry and endpoint initialization.
-// An empty result preserves normal context selection; an error aborts
-// initialization.
-// The resolver must not initialize the API client.
-func WithContextResolver(resolve func(*DockerCli) (string, error)) CLIOption {
-	return func(cli *DockerCli) error {
-		cli.contextResolver = resolve
-		return nil
-	}
-}
-
 // WithAPIClient configures the cli to use the given API client.
 func WithAPIClient(c client.APIClient) CLIOption {
 	return func(cli *DockerCli) error {

cli/command/cli_test.go

@@ -18,7 +18,6 @@ import (
 
 	"github.com/docker/cli/cli/config"
 	"github.com/docker/cli/cli/config/configfile"
-	configtypes "github.com/docker/cli/cli/config/types"
 	"github.com/docker/cli/cli/context/store"
 	"github.com/docker/cli/cli/flags"
 	"github.com/moby/moby/client"
@@ -133,15 +132,6 @@ func TestNewAPIClientFromFlagsWithAPIVersionFromEnv(t *testing.T) {
 	assert.Equal(t, apiclient.ClientVersion(), expectedVersion)
 }
 
-func TestNewAPIClientFromFlagsWithInvalidAPIVersionFromEnv(t *testing.T) {
-	t.Setenv("DOCKER_API_VERSION", "1")
-	t.Setenv("DOCKER_HOST", ":2375")
-
-	apiClient, err := NewAPIClientFromFlags(&flags.ClientOptions{}, &configfile.ConfigFile{})
-	assert.ErrorContains(t, err, "invalid API version")
-	assert.Check(t, apiClient == nil)
-}
-
 type fakeClient struct {
 	client.Client
 	pingFunc   func() (client.PingResult, error)
@@ -218,70 +208,52 @@ func TestInitializeFromClient(t *testing.T) {
 // Makes sure we don't hang forever on the initial connection.
 // https://github.com/docker/cli/issues/3652
 func TestInitializeFromClientHangs(t *testing.T) {
-	const (
-		// Sized against measured scheduler stalls:
-		// under CPU pressure this test sees 40-90ms stalls;
-		// this should give about 5x headroom.
-		// See https://github.com/docker/cli/issues/6003.
-		clientInitTimeout = 500 * time.Millisecond
-
-		// This is only a backstop against a genuine hang.
-		// It should never be reached on a healthy run.
-		// So, it should be fine to have a lenient timeout here.
-		waitTimeout = 10 * time.Second
-	)
-
 	tmpDir := t.TempDir()
 	socket := filepath.Join(tmpDir, "my.sock")
 	l, err := net.Listen("unix", socket)
 	assert.NilError(t, err)
 
-	// Buffered, so the handler can record
-	// that it was reached without a reader
-	// having to be ready at that instant.
-	receivedReqCh := make(chan struct{}, 1)
-	releaseHandlerCh := make(chan struct{})
+	receiveReqCh := make(chan bool)
+	timeoutCtx, cancel := context.WithTimeout(context.TODO(), time.Second)
+	defer cancel()
 
 	// Simulate a server that hangs on connections.
 	ts := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		select {
-		case receivedReqCh <- struct{}{}:
-		default:
+		case <-timeoutCtx.Done():
+		case receiveReqCh <- true: // Blocks until someone receives on the channel.
 		}
-		<-releaseHandlerCh
+		_, _ = w.Write([]byte("OK"))
 	}))
 	ts.Listener = l
 	ts.Start()
-	t.Cleanup(func() {
-		close(releaseHandlerCh)
-		ts.Close()
-	})
+	defer ts.Close()
 
 	opts := &flags.ClientOptions{Hosts: []string{"unix://" + socket}}
 	configFile := &configfile.ConfigFile{}
 	apiClient, err := NewAPIClientFromFlags(opts, configFile)
 	assert.NilError(t, err)
 
-	initErrCh := make(chan error, 1)
+	initializedCh := make(chan bool)
 
 	go func() {
-		cli := &DockerCli{client: apiClient, initTimeout: clientInitTimeout}
+		cli := &DockerCli{client: apiClient, initTimeout: time.Millisecond}
 		err := cli.Initialize(flags.NewClientOptions())
+		assert.Check(t, err)
 		cli.CurrentVersion()
-		initErrCh <- err
+		close(initializedCh)
 	}()
 
 	select {
-	case err := <-initErrCh:
-		assert.Check(t, err)
-	case <-time.After(waitTimeout):
+	case <-timeoutCtx.Done():
 		t.Fatal("timeout waiting for initialization to complete")
+	case <-initializedCh:
 	}
 
 	select {
-	case <-receivedReqCh:
-	case <-time.After(waitTimeout):
+	case <-timeoutCtx.Done():
 		t.Fatal("server never received an init request")
+	case <-receiveReqCh:
 	}
 }
 
@@ -326,64 +298,6 @@ func TestInitializeShouldAlwaysCreateTheContextStore(t *testing.T) {
 	assert.Check(t, cli.ContextStore() != nil)
 }
 
-func TestInitializeContextResolver(t *testing.T) {
-	resolverErr := errors.New("resolver failed")
-
-	for _, tc := range []struct {
-		name    string
-		context string
-		err     error
-	}{
-		{name: "resolved context", context: "resolved"},
-		{name: "normal selection"},
-		{name: "resolver failure", err: resolverErr},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			originalConfigDir := config.Dir()
-			t.Cleanup(func() { config.SetDir(originalConfigDir) })
-			config.SetDir(t.TempDir())
-
-			configDir := t.TempDir()
-			cfg := configfile.New(filepath.Join(configDir, config.ConfigFileName))
-			cfg.Features = map[string]string{"cloud": "foobar"}
-			assert.NilError(t, cfg.Save())
-
-			cli, err := NewDockerCli()
-			assert.NilError(t, err)
-
-			var loadedConfig *configfile.ConfigFile
-			calls := 0
-
-			err = cli.Initialize(&flags.ClientOptions{ConfigDir: configDir, Context: "original"},
-				WithContextResolver(func(cli *DockerCli) (string, error) {
-					calls++
-					assert.Equal(t, config.Dir(), configDir)
-					loadedConfig = cli.ConfigFile()
-					assert.Equal(t, loadedConfig.Features["cloud"], "foobar")
-					assert.Assert(t, cli.ContextStore() != nil)
-					assert.Assert(t, cli.client == nil)
-					return tc.context, tc.err
-				}),
-			)
-			assert.Equal(t, calls, 1)
-			assert.Assert(t, cli.ConfigFile() == loadedConfig)
-			assert.Assert(t, cli.client == nil)
-
-			if tc.err != nil {
-				assert.ErrorIs(t, err, tc.err)
-				return
-			}
-			assert.NilError(t, err)
-
-			wantContext := tc.context
-			if wantContext == "" {
-				wantContext = "original"
-			}
-			assert.Equal(t, cli.CurrentContext(), wantContext)
-		})
-	}
-}
-
 func TestHooksEnabled(t *testing.T) {
 	t.Run("disabled by default", func(t *testing.T) {
 		// Make sure we don't depend on any existing ~/.docker/config.json
@@ -502,17 +416,3 @@ func TestNewDockerCliWithAPIClientOptions(t *testing.T) {
 	assert.NilError(t, err)
 	assert.DeepEqual(t, received, "fake-agent/0.0.1")
 }
-
-func TestRegistryAuthProvider(t *testing.T) {
-	t.Parallel()
-	cli := &DockerCli{configFile: &configfile.ConfigFile{}}
-	p := cli.RegistryAuthProvider()
-	assert.Assert(t, p == cli.RegistryAuthProvider(), "the provider must be created once per DockerCli")
-
-	cli.configFile = &configfile.ConfigFile{AuthConfigs: map[string]configtypes.AuthConfig{
-		"ghcr.io": {Username: "user", Password: "pass"},
-	}}
-	got, err := p.GetAuthConfig("ghcr.io")
-	assert.NilError(t, err)
-	assert.DeepEqual(t, got, configtypes.AuthConfig{Username: "user", Password: "pass"})
-}

cli/command/completion/functions.go

@@ -172,28 +172,6 @@ func FromList(options ...string) cobra.CompletionFunc {
 	return Unique(cobra.FixedCompletions(options, cobra.ShellCompDirectiveNoFileComp))
 }
 
-// WithPrefix prefixes every element in the slice with the given prefix.
-// It is a helper for building "--filter" completions, where each candidate
-// value is offered as "key=value".
-func WithPrefix(prefix string, values []string) []string {
-	result := make([]string, len(values))
-	for i, v := range values {
-		result[i] = prefix + v
-	}
-	return result
-}
-
-// WithSuffix appends the given suffix to every element in the slice. It is a
-// helper for building "--filter" completions, where filter keys are offered
-// with a trailing "=" (combined with [cobra.ShellCompDirectiveNoSpace]).
-func WithSuffix(suffix string, values []string) []string {
-	result := make([]string, len(values))
-	for i, v := range values {
-		result[i] = v + suffix
-	}
-	return result
-}
-
 // FileNames is a convenience function to use [cobra.ShellCompDirectiveDefault],
 // which indicates to let the shell perform its default behavior after
 // completions have been provided.

cli/command/completion/functions_test.go

@@ -3,9 +3,9 @@ package completion
 import (
 	"context"
 	"errors"
+	"sort"
 	"testing"
 
-	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/moby/moby/api/types/container"
 	"github.com/moby/moby/api/types/image"
 	"github.com/moby/moby/api/types/network"
@@ -177,10 +177,9 @@ func TestCompleteEnvVarNames(t *testing.T) {
 	values, directives := EnvVarNames()(nil, nil, "")
 	assert.Check(t, is.Equal(directives&cobra.ShellCompDirectiveNoFileComp, cobra.ShellCompDirectiveNoFileComp), "Should not perform file completion")
 
+	sort.Strings(values)
 	expected := []string{"ENV_A", "ENV_B"}
-	assert.Check(t, is.DeepEqual(values, expected, cmpopts.SortSlices(func(a, b string) bool {
-		return a < b
-	})))
+	assert.Check(t, is.DeepEqual(values, expected))
 }
 
 func TestCompleteFileNames(t *testing.T) {
@@ -197,18 +196,6 @@ func TestCompleteFromList(t *testing.T) {
 	assert.Check(t, is.DeepEqual(values, expected))
 }
 
-func TestWithPrefix(t *testing.T) {
-	assert.Check(t, is.DeepEqual(WithPrefix("node=", []string{"n1", "n2"}), []string{"node=n1", "node=n2"}))
-	assert.Check(t, is.DeepEqual(WithPrefix("node=", []string{}), []string{}))
-	assert.Check(t, is.DeepEqual(WithPrefix("", []string{"n1"}), []string{"n1"}))
-}
-
-func TestWithSuffix(t *testing.T) {
-	assert.Check(t, is.DeepEqual(WithSuffix("=", []string{"id", "name"}), []string{"id=", "name="}))
-	assert.Check(t, is.DeepEqual(WithSuffix("=", []string{}), []string{}))
-	assert.Check(t, is.DeepEqual(WithSuffix("", []string{"id"}), []string{"id"}))
-}
-
 func TestCompleteImageNames(t *testing.T) {
 	tests := []struct {
 		doc          string

cli/command/config/formatter.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package config
 

cli/command/config/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package config
 

cli/command/config/ls.go

@@ -1,11 +1,8 @@
-// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
-
 package config
 
 import (
 	"context"
-	"slices"
+	"sort"
 
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
@@ -13,7 +10,6 @@ import (
 	flagsHelper "github.com/docker/cli/cli/flags"
 	"github.com/docker/cli/opts"
 	"github.com/fvbommel/sortorder"
-	"github.com/moby/moby/api/types/swarm"
 	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
@@ -66,8 +62,8 @@ func runList(ctx context.Context, dockerCLI command.Cli, options listOptions) er
 		}
 	}
 
-	slices.SortFunc(res.Items, func(a, b swarm.Config) int {
-		return sortorder.NaturalCompare(a.Spec.Name, b.Spec.Name)
+	sort.Slice(res.Items, func(i, j int) bool {
+		return sortorder.NaturalLess(res.Items[i].Spec.Name, res.Items[j].Spec.Name)
 	})
 
 	configCtx := formatter.Context{

cli/command/container/completion.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package container
 

cli/command/container/create.go

@@ -21,7 +21,6 @@ import (
 	"github.com/docker/cli/cli/config/types"
 	"github.com/docker/cli/cli/streams"
 	"github.com/docker/cli/internal/jsonstream"
-	"github.com/docker/cli/internal/registryauth"
 	"github.com/docker/cli/opts"
 	"github.com/moby/moby/api/types/mount"
 	"github.com/moby/moby/client"
@@ -72,7 +71,7 @@ func newCreateCommand(dockerCLI command.Cli) *cobra.Command {
 	flags.SetInterspersed(false)
 
 	flags.StringVar(&options.name, "name", "", "Assign a name to the container")
-	flags.StringVar(&options.pull, "pull", PullImageMissing, `Pull image before creating ("`+PullImageAlways+`", "`+PullImageMissing+`", "`+PullImageNever+`")`)
+	flags.StringVar(&options.pull, "pull", PullImageMissing, `Pull image before creating ("`+PullImageAlways+`", "|`+PullImageMissing+`", "`+PullImageNever+`")`)
 	flags.BoolVarP(&options.quiet, "quiet", "q", false, "Suppress the pull output")
 	flags.BoolVarP(&options.useAPISocket, "use-api-socket", "", false, "Bind mount Docker API socket and required auth")
 	_ = flags.SetAnnotation("use-api-socket", "experimentalCLI", nil) // Mark flag as experimental for now.
@@ -134,7 +133,7 @@ func runCreate(ctx context.Context, dockerCLI command.Cli, flags *pflag.FlagSet,
 }
 
 func pullImage(ctx context.Context, dockerCLI command.Cli, img string, options *createOptions) error {
-	encodedAuth, err := registryauth.EncodedAuth(dockerCLI, img)
+	encodedAuth, err := command.RetrieveAuthTokenFromImage(dockerCLI.ConfigFile(), img)
 	if err != nil {
 		return err
 	}

cli/command/container/create_test.go

@@ -7,6 +7,7 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
+	"sort"
 	"strings"
 	"testing"
 
@@ -14,7 +15,6 @@ import (
 	"github.com/docker/cli/cli/config/configfile"
 	"github.com/docker/cli/internal/test"
 	"github.com/google/go-cmp/cmp"
-	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/moby/moby/api/types/container"
 	"github.com/moby/moby/api/types/system"
 	"github.com/moby/moby/client"
@@ -284,12 +284,12 @@ func TestCreateContainerWithProxyConfig(t *testing.T) {
 		"ALL_PROXY=allProxy",
 		"all_proxy=allProxy",
 	}
+	sort.Strings(expected)
 
 	fakeCLI := test.NewFakeCli(&fakeClient{
 		createContainerFunc: func(options client.ContainerCreateOptions) (client.ContainerCreateResult, error) {
-			assert.DeepEqual(t, options.Config.Env, expected, cmpopts.SortSlices(func(a, b string) bool {
-				return a < b
-			}))
+			sort.Strings(options.Config.Env)
+			assert.DeepEqual(t, options.Config.Env, expected)
 			return client.ContainerCreateResult{}, nil
 		},
 	})

cli/command/container/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package container
 

cli/command/container/opts.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package container
 
@@ -139,7 +139,6 @@ type containerOptions struct {
 	runtime             string
 	autoRemove          bool
 	init                bool
-	umask               opts.UmaskOpt
 	annotations         *opts.MapOpts
 
 	Image string
@@ -314,9 +313,6 @@ func addFlags(flags *pflag.FlagSet) *containerOptions {
 	flags.Var(&copts.shmSize, "shm-size", "Size of /dev/shm")
 	flags.StringVar(&copts.utsMode, "uts", "", "UTS namespace to use")
 	flags.StringVar(&copts.runtime, "runtime", "", "Runtime to use for this container")
-	flags.Var(&copts.umask, "umask", "Set umask for the container")
-	flags.SetAnnotation("umask", "version", []string{"1.56"})
-	flags.SetAnnotation("umask", "ostype", []string{"linux"})
 
 	flags.BoolVar(&copts.init, "init", false, "Run an init inside the container that forwards signals and reaps processes")
 	flags.SetAnnotation("init", "version", []string{"1.25"})
@@ -714,7 +710,6 @@ func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*con
 		MaskedPaths:    maskedPaths,
 		ReadonlyPaths:  readonlyPaths,
 		Annotations:    copts.annotations.GetAll(),
-		Umask:          copts.umask.Value(),
 	}
 
 	if copts.autoRemove && !hostConfig.RestartPolicy.IsNone() {

cli/command/container/opts_test.go

@@ -154,19 +154,6 @@ func TestParseRunLinks(t *testing.T) {
 	}
 }
 
-func TestParseRunWithoutUmask(t *testing.T) {
-	_, hostConfig, _, err := parseRun([]string{"ubuntu", "bash"})
-	assert.NilError(t, err)
-	assert.Assert(t, hostConfig.Umask == nil)
-}
-
-func TestParseRunUmask(t *testing.T) {
-	_, hostConfig, _, err := parseRun([]string{"--umask", "0022", "ubuntu", "bash"})
-	assert.NilError(t, err)
-	assert.Assert(t, hostConfig.Umask != nil)
-	assert.Equal(t, uint32(0o22), *hostConfig.Umask)
-}
-
 func TestParseRunAttach(t *testing.T) {
 	tests := []struct {
 		input    string

cli/command/container/port.go

@@ -1,13 +1,10 @@
-// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
-
 package container
 
 import (
 	"context"
 	"fmt"
 	"net"
-	"slices"
+	"sort"
 	"strings"
 
 	"github.com/docker/cli/cli"
@@ -83,7 +80,9 @@ func runPort(ctx context.Context, dockerCli command.Cli, opts *portOptions) erro
 	}
 
 	if len(out) > 0 {
-		slices.SortFunc(out, sortorder.NaturalCompare)
+		sort.Slice(out, func(i, j int) bool {
+			return sortorder.NaturalLess(out[i], out[j])
+		})
 		_, _ = fmt.Fprintln(dockerCli.Out(), strings.Join(out, "\n"))
 	}
 

cli/command/container/restart_test.go

@@ -4,11 +4,11 @@ import (
 	"context"
 	"errors"
 	"io"
+	"sort"
 	"sync"
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/moby/moby/client"
 	"gotest.tools/v3/assert"
 	is "gotest.tools/v3/assert/cmp"
@@ -87,9 +87,8 @@ func TestRestart(t *testing.T) {
 			} else {
 				assert.Check(t, is.Nil(err))
 			}
-			assert.Check(t, is.DeepEqual(restarted, tc.restarted, cmpopts.SortSlices(func(a, b string) bool {
-				return a < b
-			})))
+			sort.Strings(restarted)
+			assert.Check(t, is.DeepEqual(restarted, tc.restarted))
 		})
 	}
 }

cli/command/container/rm.go

@@ -88,6 +88,7 @@ func runRm(ctx context.Context, dockerCLI command.Cli, opts *rmOptions) error {
 	for _, name := range opts.containers {
 		if err := <-errChan; err != nil {
 			if opts.force && errdefs.IsNotFound(err) {
+				_, _ = fmt.Fprintln(dockerCLI.Err(), err)
 				continue
 			}
 			errs = append(errs, err)

cli/command/container/rm_test.go

@@ -4,11 +4,11 @@ import (
 	"context"
 	"errors"
 	"io"
+	"sort"
 	"sync"
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/moby/moby/client"
 	"gotest.tools/v3/assert"
 )
@@ -52,11 +52,8 @@ func TestRemoveForce(t *testing.T) {
 			} else {
 				assert.NilError(t, err)
 			}
-			assert.Equal(t, cli.ErrBuffer().String(), "")
-			expected := []string{"mycontainer", "nosuchcontainer"}
-			assert.DeepEqual(t, removed, expected, cmpopts.SortSlices(func(a, b string) bool {
-				return a < b
-			}))
+			sort.Strings(removed)
+			assert.DeepEqual(t, removed, []string{"mycontainer", "nosuchcontainer"})
 		})
 	}
 }

cli/command/container/start.go

@@ -1,6 +1,3 @@
-// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
-
 package container
 
 import (
@@ -172,7 +169,8 @@ func RunStart(ctx context.Context, dockerCli command.Cli, opts *StartOptions) er
 			}
 		}
 		if attachErr := <-cErr; attachErr != nil {
-			if _, ok := errors.AsType[term.EscapeError](attachErr); ok {
+			var escapeError term.EscapeError
+			if errors.As(attachErr, &escapeError) {
 				// The user entered the detach escape sequence.
 				return nil
 			}

cli/command/container/stats.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package container
 

cli/command/container/stop_test.go

@@ -4,11 +4,11 @@ import (
 	"context"
 	"errors"
 	"io"
+	"sort"
 	"sync"
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/moby/moby/client"
 	"gotest.tools/v3/assert"
 	is "gotest.tools/v3/assert/cmp"
@@ -88,9 +88,8 @@ func TestStop(t *testing.T) {
 			} else {
 				assert.Check(t, is.Nil(err))
 			}
-			assert.Check(t, is.DeepEqual(stopped, tc.stopped, cmpopts.SortSlices(func(a, b string) bool {
-				return a < b
-			})))
+			sort.Strings(stopped)
+			assert.Check(t, is.DeepEqual(stopped, tc.stopped))
 		})
 	}
 }

cli/command/container/tty.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package container
 

cli/command/context.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package command
 

cli/command/context/completion.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package context
 

cli/command/context/create.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package context
 

cli/command/context/create_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package context
 

cli/command/context/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package context
 

cli/command/context/list.go

@@ -1,12 +1,12 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package context
 
 import (
 	"fmt"
 	"os"
-	"slices"
+	"sort"
 
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
@@ -101,8 +101,8 @@ func runList(dockerCli command.Cli, opts *listOptions) error {
 			Error:   errMsg,
 		})
 	}
-	slices.SortFunc(contexts, func(a, b *formatter.ClientContext) int {
-		return sortorder.NaturalCompare(a.Name, b.Name)
+	sort.Slice(contexts, func(i, j int) bool {
+		return sortorder.NaturalLess(contexts[i].Name, contexts[j].Name)
 	})
 	if err := format(dockerCli, opts, contexts); err != nil {
 		return err

cli/command/context/options.go

@@ -1,6 +1,3 @@
-// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
-
 package context
 
 import (
@@ -72,7 +69,8 @@ func parseBool(config map[string]string, name string) (bool, error) {
 	}
 	res, err := strconv.ParseBool(strVal)
 	if err != nil {
-		if nErr, ok := errors.AsType[*strconv.NumError](err); ok {
+		var nErr *strconv.NumError
+		if errors.As(err, &nErr) {
 			return res, fmt.Errorf("%s: parsing %q: %w", name, nErr.Num, nErr.Err)
 		}
 		return res, fmt.Errorf("%s: %w", name, err)

cli/command/context_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package command
 

cli/command/defaultcontextstore.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package command
 

cli/command/defaultcontextstore_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package command
 

cli/command/formatter/buildcache.go

@@ -1,10 +1,7 @@
-// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
-
 package formatter
 
 import (
-	"slices"
+	"sort"
 	"strconv"
 	"strings"
 	"time"
@@ -55,20 +52,20 @@ shared: {{.Shared}}
 }
 
 func buildCacheSort(buildCache []build.CacheRecord) {
-	slices.SortFunc(buildCache, func(a, b build.CacheRecord) int {
+	sort.Slice(buildCache, func(i, j int) bool {
+		lui, luj := buildCache[i].LastUsedAt, buildCache[j].LastUsedAt
 		switch {
-		case a.LastUsedAt == nil && b.LastUsedAt == nil:
-			return strings.Compare(a.ID, b.ID)
-		case a.LastUsedAt == nil:
-			return -1
-		case b.LastUsedAt == nil:
-			return 1
+		case lui == nil && luj == nil:
+			return strings.Compare(buildCache[i].ID, buildCache[j].ID) < 0
+		case lui == nil:
+			return true
+		case luj == nil:
+			return false
+		case lui.Equal(*luj):
+			return strings.Compare(buildCache[i].ID, buildCache[j].ID) < 0
+		default:
+			return lui.Before(*luj)
 		}
-
-		if c := a.LastUsedAt.Compare(*b.LastUsedAt); c != 0 {
-			return c
-		}
-		return strings.Compare(a.ID, b.ID)
 	})
 }
 

cli/command/formatter/container.go

@@ -1,13 +1,12 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package formatter
 
 import (
-	"cmp"
 	"fmt"
 	"net"
-	"slices"
+	"sort"
 	"strconv"
 	"strings"
 	"time"
@@ -296,7 +295,7 @@ func (c *ContainerContext) Labels() string {
 	for k, v := range c.c.Labels {
 		joinLabels = append(joinLabels, k+"="+v)
 	}
-	slices.Sort(joinLabels)
+	sort.Strings(joinLabels)
 	return strings.Join(joinLabels, ",")
 }
 
@@ -396,7 +395,9 @@ func DisplayablePorts(ports []container.PortSummary) string {
 	var result []string
 	var hostMappings []string
 	var groupMapKeys []string
-	slices.SortFunc(ports, comparePorts)
+	sort.Slice(ports, func(i, j int) bool {
+		return comparePorts(ports[i], ports[j])
+	})
 
 	for _, port := range ports {
 		current := port.PrivatePort
@@ -451,13 +452,18 @@ func formGroup(key string, start, last uint16) string {
 	return group + "/" + groupType
 }
 
-// comparePorts compares ports by private port, IP address, public port,
-// and protocol, in that order.
-func comparePorts(a, b container.PortSummary) int {
-	return cmp.Or(
-		cmp.Compare(a.PrivatePort, b.PrivatePort),
-		a.IP.Compare(b.IP),
-		cmp.Compare(a.PublicPort, b.PublicPort),
-		cmp.Compare(a.Type, b.Type),
-	)
+func comparePorts(i, j container.PortSummary) bool {
+	if i.PrivatePort != j.PrivatePort {
+		return i.PrivatePort < j.PrivatePort
+	}
+
+	if i.IP != j.IP {
+		return i.IP.String() < j.IP.String()
+	}
+
+	if i.PublicPort != j.PublicPort {
+		return i.PublicPort < j.PublicPort
+	}
+
+	return i.Type < j.Type
 }

cli/command/formatter/container_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package formatter
 
@@ -946,24 +946,6 @@ func TestDisplayablePorts(t *testing.T) {
 			},
 			expected: "80/tcp, 80/udp, 1024/tcp, 1024/udp, 12345/sctp, 1.1.1.1:1024->80/tcp, 1.1.1.1:1024->80/udp, 2.1.1.1:1024->80/tcp, 2.1.1.1:1024->80/udp, 1.1.1.1:80->1024/tcp, 1.1.1.1:80->1024/udp, 2.1.1.1:80->1024/tcp, 2.1.1.1:80->1024/udp", //nolint:revive // ignore line-length-limit (revive)
 		},
-		{
-			// host IPs are ordered numerically, not lexicographically:
-			// "10.0.0.2" sorts as a string before "9.0.0.1".
-			ports: []container.PortSummary{
-				{
-					IP:          netip.MustParseAddr("10.0.0.2"),
-					PublicPort:  8080,
-					PrivatePort: 80,
-					Type:        "tcp",
-				}, {
-					IP:          netip.MustParseAddr("9.0.0.1"),
-					PublicPort:  8081,
-					PrivatePort: 80,
-					Type:        "tcp",
-				},
-			},
-			expected: "9.0.0.1:8081->80/tcp, 10.0.0.2:8080->80/tcp",
-		},
 	}
 
 	for _, port := range cases {

cli/command/formatter/custom.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package formatter
 

cli/command/formatter/displayutils.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package formatter
 

cli/command/formatter/formatter.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package formatter
 

cli/command/formatter/formatter_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package formatter
 

cli/command/formatter/reflect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package formatter
 

cli/command/formatter/reflect_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package formatter
 

cli/command/formatter/volume.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package formatter
 

cli/command/formatter/volume_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package formatter
 

cli/command/idresolver/idresolver.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package idresolver
 

cli/command/image/build.go

@@ -1,6 +1,3 @@
-// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
-
 package image
 
 import (
@@ -260,11 +257,8 @@ func runBuild(ctx context.Context, dockerCli command.Cli, options buildOptions)
 		contextDir = tempDir
 	case build.ContextTypeRemote:
 		buildCtx, relDockerfile, err = build.GetContextFromURL(progBuff, options.context, options.dockerfileName)
-		if err != nil {
-			if options.quiet {
-				_, _ = fmt.Fprintln(dockerCli.Err(), progBuff)
-			}
-			return err
+		if err != nil && options.quiet {
+			_, _ = fmt.Fprintln(dockerCli.Err(), progBuff)
 		}
 	default:
 		return fmt.Errorf("unable to prepare context: path %q not found", options.context)
@@ -370,7 +364,8 @@ func runBuild(ctx context.Context, dockerCli command.Cli, options buildOptions)
 
 	err = jsonstream.Display(ctx, response.Body, streams.NewOut(buildBuff), jsonstream.WithAuxCallback(aux))
 	if err != nil {
-		if jerr, ok := errors.AsType[*jsonstream.JSONError](err); ok {
+		var jerr *jsonstream.JSONError
+		if errors.As(err, &jerr) {
 			// If no error code is set, default to 1
 			if jerr.Code == 0 {
 				jerr.Code = 1

cli/command/image/build/internal/git/gitutils.go

@@ -1,6 +1,3 @@
-// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
-
 package git
 
 import (
@@ -10,7 +7,6 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"slices"
 	"strings"
 
 	"github.com/moby/sys/symlink"
@@ -206,7 +202,7 @@ func (repo gitRepo) checkout(root string) (string, error) {
 }
 
 func (repo gitRepo) gitWithinDir(dir string, args ...string) ([]byte, error) {
-	args = slices.Concat([]string{"-c", "protocol.file.allow=never"}, args) // Block sneaky repositories from using repos from the filesystem as submodules.
+	args = append([]string{"-c", "protocol.file.allow=never"}, args...) // Block sneaky repositories from using repos from the filesystem as submodules.
 	cmd := exec.Command("git", args...)
 	cmd.Dir = dir
 	// Disable unsafe remote protocols.

cli/command/image/build_test.go

@@ -6,11 +6,9 @@ import (
 	"compress/gzip"
 	"context"
 	"io"
-	"net/http"
-	"net/http/httptest"
 	"os"
 	"path/filepath"
-	"slices"
+	"sort"
 	"testing"
 
 	"github.com/docker/cli/cli/streams"
@@ -174,35 +172,6 @@ RUN echo hello world
 	assert.DeepEqual(t, fakeBuild.filenames(t), []string{"Dockerfile"})
 }
 
-// TestRunBuildRemoteContextDownloadError verifies that remote context
-// download errors are propagated.
-//
-// regression test for https://github.com/docker/cli/issues/7372
-func TestRunBuildRemoteContextDownloadError(t *testing.T) {
-	t.Setenv("DOCKER_BUILDKIT", "0")
-
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		http.Error(w, "not found", http.StatusNotFound)
-	}))
-	defer server.Close()
-
-	imageBuildCalled := false
-	cli := test.NewFakeCli(&fakeClient{
-		imageBuildFunc: func(ctx context.Context, buildContext io.Reader, options client.ImageBuildOptions) (client.ImageBuildResult, error) {
-			imageBuildCalled = true
-			return client.ImageBuildResult{Body: io.NopCloser(bytes.NewReader(nil))}, nil
-		},
-	})
-
-	options := newBuildOptions()
-	options.context = server.URL
-
-	err := runBuild(context.Background(), cli, options)
-
-	assert.ErrorContains(t, err, "unable to download remote context")
-	assert.Assert(t, !imageBuildCalled, "ImageBuild should not be called when downloading the remote context fails")
-}
-
 type fakeBuild struct {
 	context *tar.Reader
 	options client.ImageBuildOptions
@@ -242,6 +211,6 @@ func (f *fakeBuild) filenames(t *testing.T) []string {
 	for _, header := range h {
 		names = append(names, header.Name)
 	}
-	slices.Sort(names)
+	sort.Strings(names)
 	return names
 }

cli/command/image/history_test.go

@@ -52,14 +52,6 @@ func TestNewHistoryCommandErrors(t *testing.T) {
 }
 
 func TestNewHistoryCommandSuccess(t *testing.T) {
-	// Set to UTC timezone as timestamps in output are
-	// printed in the current timezone
-	local := time.Local
-	time.Local = time.UTC
-	t.Cleanup(func() {
-		time.Local = local
-	})
-
 	testCases := []struct {
 		name             string
 		args             []string
@@ -126,6 +118,9 @@ func TestNewHistoryCommandSuccess(t *testing.T) {
 	}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
+			// Set to UTC timezone as timestamps in output are
+			// printed in the current timezone
+			t.Setenv("TZ", "UTC")
 			cli := test.NewFakeCli(&fakeClient{imageHistoryFunc: tc.imageHistoryFunc})
 			cmd := newHistoryCommand(cli)
 			cmd.SetOut(io.Discard)

cli/command/image/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package image
 

cli/command/image/list.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package image
 

cli/command/image/pull.go

@@ -14,7 +14,6 @@ import (
 	"github.com/docker/cli/cli/command/completion"
 	"github.com/docker/cli/cli/streams"
 	"github.com/docker/cli/internal/jsonstream"
-	"github.com/docker/cli/internal/registryauth"
 	"github.com/moby/moby/client"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/spf13/cobra"
@@ -91,7 +90,7 @@ func runPull(ctx context.Context, dockerCLI command.Cli, opts pullOptions) error
 		ociPlatforms = append(ociPlatforms, p)
 	}
 
-	encodedAuth, err := registryauth.EncodedAuth(dockerCLI, distributionRef.String())
+	encodedAuth, err := command.RetrieveAuthTokenFromImage(dockerCLI.ConfigFile(), distributionRef.String())
 	if err != nil {
 		return err
 	}

cli/command/image/push.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package image
 
@@ -17,7 +17,6 @@ import (
 	"github.com/docker/cli/cli/command/completion"
 	"github.com/docker/cli/cli/streams"
 	"github.com/docker/cli/internal/jsonstream"
-	"github.com/docker/cli/internal/registryauth"
 	"github.com/docker/cli/internal/tui"
 	"github.com/moby/moby/api/types/auxprogress"
 	"github.com/moby/moby/client"
@@ -109,7 +108,7 @@ To push the complete multi-platform image, remove the --platform flag.
 	}
 
 	// Resolve the Auth config relevant for this server
-	encodedAuth, err := registryauth.EncodedAuth(dockerCli, ref.String())
+	encodedAuth, err := command.RetrieveAuthTokenFromImage(dockerCli.ConfigFile(), ref.String())
 	if err != nil {
 		return err
 	}

cli/command/image/push_test.go

@@ -102,11 +102,9 @@ func TestRunPushRespectsNoColorForAuxNotes(t *testing.T) {
 				SelectedManifest:             ocispec.Descriptor{Digest: "sha256:2222222222222222222222222222222222222222222222222222222222222222"},
 			})
 			assert.NilError(t, err)
-			var buf bytes.Buffer
-			buf.WriteString(`{"aux":`)
-			buf.Write(aux)
-			buf.WriteString("}\n")
-			return fakeStreamResult{ReadCloser: io.NopCloser(&buf)}, nil
+			line := append([]byte(`{"aux":`), aux...)
+			line = append(line, '}', '\n')
+			return fakeStreamResult{ReadCloser: io.NopCloser(bytes.NewReader(line))}, nil
 		},
 	})
 	cli.Out().SetIsTerminal(true)

cli/command/image/tree.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package image
 

cli/command/inspect/inspector.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package inspect
 

cli/command/manifest/annotate.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package manifest
 
@@ -48,6 +48,27 @@ func newManifestStore(dockerCLI command.Cli) store.Store {
 	return store.NewStore(filepath.Join(config.Dir(), "manifests"))
 }
 
+// authConfigKey is the key used to store credentials for Docker Hub. It is
+// a copy of [registry.IndexServer].
+//
+// [registry.IndexServer]: https://pkg.go.dev/github.com/docker/docker@v28.3.3+incompatible/registry#IndexServer
+const authConfigKey = "https://index.docker.io/v1/"
+
+// getAuthConfigKey special-cases using the full index address of the official
+// index as the AuthConfig key, and uses the (host)name[:port] for private indexes.
+//
+// It is similar to [registry.GetAuthConfigKey], but does not require on
+// [registrytypes.IndexInfo] as intermediate.
+//
+// [registry.GetAuthConfigKey]: https://pkg.go.dev/github.com/docker/docker@v28.3.3+incompatible/registry#GetAuthConfigKey
+// [registrytypes.IndexInfo]: https://pkg.go.dev/github.com/docker/docker@v28.3.3+incompatible/api/types/registry#IndexInfo
+func getAuthConfigKey(domainName string) string {
+	if domainName == "docker.io" || domainName == "index.docker.io" {
+		return authConfigKey
+	}
+	return domainName
+}
+
 // newRegistryClient returns a client for communicating with a Docker distribution
 // registry
 func newRegistryClient(dockerCLI command.Cli, allowInsecure bool) registryclient.RegistryClient {
@@ -57,7 +78,8 @@ func newRegistryClient(dockerCLI command.Cli, allowInsecure bool) registryclient
 	}
 	cfg := dockerCLI.ConfigFile()
 	resolver := func(ctx context.Context, domainName string) registry.AuthConfig {
-		a, _ := cfg.GetAuthConfig(domainName)
+		configKey := getAuthConfigKey(domainName)
+		a, _ := cfg.GetAuthConfig(configKey)
 		return registry.AuthConfig{
 			Username:      a.Username,
 			Password:      a.Password,

cli/command/network/create_test.go

@@ -189,6 +189,8 @@ func TestNetworkCreateWithFlags(t *testing.T) {
 // TestNetworkCreateIPv4 verifies behavior of the "--ipv4" option. This option
 // is an optional bool, and must default to "nil", not "true" or "false".
 func TestNetworkCreateIPv4(t *testing.T) {
+	boolPtr := func(val bool) *bool { return &val }
+
 	tests := []struct {
 		doc, name string
 		flags     []string
@@ -203,19 +205,19 @@ func TestNetworkCreateIPv4(t *testing.T) {
 			doc:      "IPv4 enabled",
 			name:     "ipv4-enabled",
 			flags:    []string{"--ipv4=true"},
-			expected: new(true),
+			expected: boolPtr(true),
 		},
 		{
 			doc:      "IPv4 enabled (shorthand)",
 			name:     "ipv4-enabled-shorthand",
 			flags:    []string{"--ipv4"},
-			expected: new(true),
+			expected: boolPtr(true),
 		},
 		{
 			doc:      "IPv4 disabled",
 			name:     "ipv4-disabled",
 			flags:    []string{"--ipv4=false"},
-			expected: new(false),
+			expected: boolPtr(false),
 		},
 	}
 
@@ -241,6 +243,8 @@ func TestNetworkCreateIPv4(t *testing.T) {
 // TestNetworkCreateIPv6 verifies behavior of the "--ipv6" option. This option
 // is an optional bool, and must default to "nil", not "true" or "false".
 func TestNetworkCreateIPv6(t *testing.T) {
+	strPtr := func(val bool) *bool { return &val }
+
 	tests := []struct {
 		doc, name string
 		flags     []string
@@ -255,19 +259,19 @@ func TestNetworkCreateIPv6(t *testing.T) {
 			doc:      "IPV6 enabled",
 			name:     "ipv6-enabled",
 			flags:    []string{"--ipv6=true"},
-			expected: new(true),
+			expected: strPtr(true),
 		},
 		{
 			doc:      "IPV6 enabled (shorthand)",
 			name:     "ipv6-enabled-shorthand",
 			flags:    []string{"--ipv6"},
-			expected: new(true),
+			expected: strPtr(true),
 		},
 		{
 			doc:      "IPV6 disabled",
 			name:     "ipv6-disabled",
 			flags:    []string{"--ipv6=false"},
-			expected: new(false),
+			expected: strPtr(false),
 		},
 	}
 

cli/command/network/formatter.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package network
 

cli/command/network/formatter_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package network
 

cli/command/network/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package network
 

cli/command/network/list.go

@@ -1,11 +1,8 @@
-// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
-
 package network
 
 import (
 	"context"
-	"slices"
+	"sort"
 
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
@@ -13,7 +10,6 @@ import (
 	flagsHelper "github.com/docker/cli/cli/flags"
 	"github.com/docker/cli/opts"
 	"github.com/fvbommel/sortorder"
-	"github.com/moby/moby/api/types/network"
 	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
@@ -65,8 +61,8 @@ func runList(ctx context.Context, dockerCLI command.Cli, options listOptions) er
 		}
 	}
 
-	slices.SortFunc(res.Items, func(a, b network.Summary) int {
-		return sortorder.NaturalCompare(a.Name, b.Name)
+	sort.Slice(res.Items, func(i, j int) bool {
+		return sortorder.NaturalLess(res.Items[i].Name, res.Items[j].Name)
 	})
 
 	networksCtx := formatter.Context{

cli/command/node/completion.go

@@ -2,26 +2,12 @@ package node
 
 import (
 	"os"
-	"strings"
 
 	"github.com/docker/cli/cli/command/completion"
-	"github.com/moby/moby/api/types/swarm"
 	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
 
-var (
-	// nodePsFilters are the filters that can be used with "docker node ps --filter".
-	nodePsFilters = []string{"desired-state", "id", "label", "name"}
-
-	// taskDesiredStates are the valid values for the "desired-state" task filter.
-	taskDesiredStates = []string{
-		string(swarm.TaskStateRunning),
-		string(swarm.TaskStateShutdown),
-		string(swarm.TaskStateAccepted),
-	}
-)
-
 // completeNodeNames offers completion for swarm node (host)names and optional IDs.
 // By default, only names are returned.
 // Set DOCKER_COMPLETION_SHOW_NODE_IDS=yes to also complete IDs.
@@ -49,23 +35,3 @@ func completeNodeNames(dockerCLI completion.APIClientProvider) cobra.CompletionF
 		return names, cobra.ShellCompDirectiveNoFileComp
 	}
 }
-
-// completeNodePsFilters provides completion for the filters that can be used
-// with "docker node ps --filter".
-func completeNodePsFilters(_ completion.APIClientProvider) cobra.CompletionFunc {
-	return func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
-		key, _, ok := strings.Cut(toComplete, "=")
-		if !ok {
-			return completion.WithSuffix("=", nodePsFilters), cobra.ShellCompDirectiveNoSpace
-		}
-		switch key {
-		case "desired-state":
-			return completion.WithPrefix("desired-state=", taskDesiredStates), cobra.ShellCompDirectiveNoFileComp
-		case "id", "name", "label":
-			// Task IDs, names, and labels are not easily discoverable; only offer the key.
-			return nil, cobra.ShellCompDirectiveNoFileComp
-		default:
-			return completion.WithSuffix("=", nodePsFilters), cobra.ShellCompDirectiveNoSpace | cobra.ShellCompDirectiveNoFileComp
-		}
-	}
-}

cli/command/node/completion_test.go

@@ -1,52 +0,0 @@
-package node
-
-import (
-	"testing"
-
-	"github.com/docker/cli/internal/test"
-	"github.com/spf13/cobra"
-	"gotest.tools/v3/assert"
-)
-
-func TestCompleteNodePsFilters(t *testing.T) {
-	tests := []struct {
-		doc        string
-		toComplete string
-		expected   []string
-		directive  cobra.ShellCompDirective
-	}{
-		{
-			doc:        "no input offers the filter keys",
-			toComplete: "",
-			expected:   []string{"desired-state=", "id=", "label=", "name="},
-			directive:  cobra.ShellCompDirectiveNoSpace,
-		},
-		{
-			doc:        "desired-state values",
-			toComplete: "desired-state=",
-			expected:   []string{"desired-state=running", "desired-state=shutdown", "desired-state=accepted"},
-			directive:  cobra.ShellCompDirectiveNoFileComp,
-		},
-		{
-			doc:        "label offers no values",
-			toComplete: "label=",
-			expected:   nil,
-			directive:  cobra.ShellCompDirectiveNoFileComp,
-		},
-		{
-			doc:        "unknown key falls back to the filter keys",
-			toComplete: "bogus=",
-			expected:   []string{"desired-state=", "id=", "label=", "name="},
-			directive:  cobra.ShellCompDirectiveNoSpace | cobra.ShellCompDirectiveNoFileComp,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.doc, func(t *testing.T) {
-			cli := test.NewFakeCli(&fakeClient{})
-			completions, directive := completeNodePsFilters(cli)(newPsCommand(cli), nil, tc.toComplete)
-			assert.DeepEqual(t, completions, tc.expected)
-			assert.Equal(t, directive, tc.directive)
-		})
-	}
-}

cli/command/node/formatter_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package node
 

cli/command/node/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
+//go:build go1.25
 
 package node
 

cli/command/node/list.go

@@ -1,11 +1,8 @@
-// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.26
-
 package node
 
 import (
 	"context"
-	"slices"
+	"sort"
 
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
@@ -13,7 +10,6 @@ import (
 	flagsHelper "github.com/docker/cli/cli/flags"
 	"github.com/docker/cli/opts"
 	"github.com/fvbommel/sortorder"
-	"github.com/moby/moby/api/types/swarm"
 	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
@@ -77,8 +73,8 @@ func runList(ctx context.Context, dockerCLI command.Cli, options listOptions) er
 		Output: dockerCLI.Out(),
 		Format: newFormat(format, options.quiet),
 	}
-	slices.SortFunc(res.Items, func(a, b swarm.Node) int {
-		return sortorder.NaturalCompare(a.Description.Hostname, b.Description.Hostname)
+	sort.Slice(res.Items, func(i, j int) bool {
+		return sortorder.NaturalLess(res.Items[i].Description.Hostname, res.Items[j].Description.Hostname)
 	})
 	return formatWrite(nodesCtx, res, info)
 }

cli/command/node/ps.go

@@ -48,8 +48,6 @@ func newPsCommand(dockerCLI command.Cli) *cobra.Command {
 	flags.StringVar(&options.format, "format", "", "Pretty-print tasks using a Go template")
 	flags.BoolVarP(&options.quiet, "quiet", "q", false, "Only display task IDs")
 
-	_ = cmd.RegisterFlagCompletionFunc("filter", completeNodePsFilters(dockerCLI))
-
 	return cmd
 }