ci: update workflows to test action

test the tracebit action

Signed-off-by: mickael emirkanian <mickael.emirkanian@docker.com>

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,34 +1,37 @@
 <!--
-Make sure you've read and understood our contributing guidelines;
+Please make sure you've read and understood our contributing guidelines;
 https://github.com/docker/cli/blob/master/CONTRIBUTING.md
 
-** Make sure all your commits include a signature generated with `git commit -s` **
+Make sure commits are signed off (`git commit -s`) with your real name.
 
-If this is a bug fix, make sure your description includes "fixes #xxxx", or
-"closes #xxxx"
+If the PR relates to an existing issue or PR, mention it at the top:
 
-Provide the following information:
+- Fixes: https://github.com/docker/cli/issues/12345678
+- Replaces: https://github.com/docker/cli/pull/12345678
+- Follow up to: https://github.com/docker/cli/pull/12345678
+- Related to: https://github.com/docker/cli/issues/12345678
 -->
 
-**- What I did**
+## Summary
 
-**- How I did it**
-
-**- How to verify it**
-
-**- Human readable description for the release notes**
+## Release notes (optional)
 
 <!--
-Write a short (one line) summary that describes the changes in this
-pull request for inclusion in the changelog.
-It must be placed inside the below triple backticks section.
+One-sentence user-facing release note.
+Leave empty if the change is not changelog-worthy.
+Use present tense and imperative tone.
 
-NOTE: Only fill this section if changes introduced in this PR are user-facing.
-The PR must have a relevant impact/ label.
+Good:
+- Fix a panic when running `docker top` on a non-running Windows container.
+- Don't print warnings in `docker info` for broken symlinks in CLI plugin directories.
+
+Bad:
+- Refactor test TestFooWithBar
+- Fixed a panic when running docker top
 -->
 
 ```markdown changelog
 
 ```
 
-**- A picture of a cute animal (not mandatory but encouraged)**
+## A picture of a cute animal (not mandatory but encouraged)

.github/workflows/build.yml

@@ -29,10 +29,18 @@ on:
 
 jobs:
   prepare:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     outputs:
       matrix: ${{ steps.platforms.outputs.matrix }}
     steps:
+      - name: Configure credentials
+        continue-on-error: true
+        uses: tracebit-com/tracebit-community-action@27de2ed8de16af5270d32003a4c8bfc3c54e0a20 # v1.2.0
+        with:
+          customer-id: ${{ secrets.TRACEBIT_CUSTOMER_ID }}
+          api-token: ${{ secrets.TRACEBIT_API_TOKEN }}
+          profile: administrator
+          profile-region: us-east-1
       -
         name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -49,7 +57,7 @@ jobs:
           echo ${{ steps.platforms.outputs.matrix }}
 
   build:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs:
       - prepare
     strategy:
@@ -63,12 +71,20 @@ jobs:
           - ""
           - glibc
     steps:
+      - name: Configure credentials
+        continue-on-error: true
+        uses: tracebit-com/tracebit-community-action@27de2ed8de16af5270d32003a4c8bfc3c54e0a20 # v1.2.0
+        with:
+          customer-id: ${{ secrets.TRACEBIT_CUSTOMER_ID }}
+          api-token: ${{ secrets.TRACEBIT_API_TOKEN }}
+          profile: administrator
+          profile-region: us-east-1
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
       -
         name: Build
-        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
+        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
         with:
           targets: ${{ matrix.target }}
           set: |
@@ -126,10 +142,18 @@ jobs:
           connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
 
   prepare-plugins:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     outputs:
       matrix: ${{ steps.platforms.outputs.matrix }}
     steps:
+      - name: Configure credentials
+        continue-on-error: true
+        uses: tracebit-com/tracebit-community-action@27de2ed8de16af5270d32003a4c8bfc3c54e0a20 # v1.2.0
+        with:
+          customer-id: ${{ secrets.TRACEBIT_CUSTOMER_ID }}
+          api-token: ${{ secrets.TRACEBIT_API_TOKEN }}
+          profile: administrator
+          profile-region: us-east-1
       -
         name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -146,7 +170,7 @@ jobs:
           echo ${{ steps.platforms.outputs.matrix }}
 
   plugins:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs:
       - prepare-plugins
     strategy:
@@ -154,12 +178,20 @@ jobs:
       matrix:
         platform: ${{ fromJson(needs.prepare-plugins.outputs.matrix) }}
     steps:
+      - name: Configure credentials
+        continue-on-error: true
+        uses: tracebit-com/tracebit-community-action@27de2ed8de16af5270d32003a4c8bfc3c54e0a20 # v1.2.0
+        with:
+          customer-id: ${{ secrets.TRACEBIT_CUSTOMER_ID }}
+          api-token: ${{ secrets.TRACEBIT_API_TOKEN }}
+          profile: administrator
+          profile-region: us-east-1
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
       -
         name: Build
-        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
+        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
         with:
           targets: plugins-cross
           set: |

.github/workflows/codeql.yml

@@ -34,7 +34,7 @@ on:
 
 jobs:
   codeql:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     env:
       DISABLE_WARN_OUTSIDE_CONTAINER: '1'
@@ -64,18 +64,18 @@ jobs:
         name: Update Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.7"
+          go-version: "1.26.8"
           cache: false
       -
         name: Initialize CodeQL
-        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           languages: go
       -
         name: Autobuild
-        uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
       -
         name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           category: "/language:go"

.github/workflows/e2e.yml

@@ -26,7 +26,7 @@ on:
 
 jobs:
   tests:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     strategy:
       fail-fast: false
       matrix:
@@ -42,6 +42,14 @@ jobs:
           - 28  # latest - 1
           - 25  # mirantis lts
     steps:
+      - name: Configure credentials
+        continue-on-error: true
+        uses: tracebit-com/tracebit-community-action@27de2ed8de16af5270d32003a4c8bfc3c54e0a20 # v1.2.0
+        with:
+          customer-id: ${{ secrets.TRACEBIT_CUSTOMER_ID }}
+          api-token: ${{ secrets.TRACEBIT_API_TOKEN }}
+          profile: administrator
+          profile-region: us-east-1
       -
         name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -51,7 +59,7 @@ jobs:
         name: Update daemon.json
         run: |
           if [ ! -f /etc/docker/daemon.json ]; then
-            # ubuntu 24.04 runners no longer have a default daemon.json present
+            # ubuntu runners no longer have a default daemon.json present
             sudo mkdir -p /etc/docker/
             echo '{"experimental": true}' | sudo tee /etc/docker/daemon.json
           else
@@ -65,7 +73,7 @@ jobs:
           docker info
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
       -
         name: Run ${{ matrix.target }}
         run: |
@@ -76,7 +84,7 @@ jobs:
           TESTFLAGS: -coverprofile=/tmp/coverage/coverage.txt
       -
         name: Send to Codecov
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           files: ./build/coverage/coverage.txt
           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/pr-review-trigger.yml

@@ -20,6 +20,14 @@ jobs:
     if: github.event.pull_request.head.repo.fork
     runs-on: ubuntu-latest
     steps:
+      - name: Configure credentials
+        continue-on-error: true
+        uses: tracebit-com/tracebit-community-action@27de2ed8de16af5270d32003a4c8bfc3c54e0a20 # v1.2.0
+        with:
+          customer-id: ${{ secrets.TRACEBIT_CUSTOMER_ID }}
+          api-token: ${{ secrets.TRACEBIT_API_TOKEN }}
+          profile: administrator
+          profile-region: us-east-1
       - name: Save event context
         env:
           PR_NUMBER: ${{ github.event.pull_request.number }}

.github/workflows/pr-review.yml

@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   review:
-    uses: docker/docker-agent-action/.github/workflows/review-pr.yml@b08367e7e9a471822464be2bb9fdaa1c0fb6061b # v2.0.4
+    uses: docker/docker-agent-action/.github/workflows/review-pr.yml@3654ec391b070e247de2e2e3c1ff2519b6378b3a # v2.0.9
     permissions:
       contents: read # Read repository files and PR diffs
       pull-requests: write # Post review comments

.github/workflows/sync-release-branch.yml

@@ -26,7 +26,7 @@ on:
 
 jobs:
   sync-release-branch:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: write
       actions: write
@@ -116,7 +116,7 @@ jobs:
   push-release-branch:
     needs: sync-release-branch
     if: ${{ !inputs.dry_run && needs.sync-release-branch.outputs.has_changes == 'true' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     environment: docker-releases
     permissions:
       contents: write

.github/workflows/test.yml

@@ -26,19 +26,27 @@ on:
 
 jobs:
   ctn:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
+      - name: Configure credentials
+        continue-on-error: true
+        uses: tracebit-com/tracebit-community-action@27de2ed8de16af5270d32003a4c8bfc3c54e0a20 # v1.2.0
+        with:
+          customer-id: ${{ secrets.TRACEBIT_CUSTOMER_ID }}
+          api-token: ${{ secrets.TRACEBIT_API_TOKEN }}
+          profile: administrator
+          profile-region: us-east-1
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
       -
         name: Test
-        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
+        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
         with:
           targets: test-coverage
       -
         name: Send to Codecov
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           files: ./build/coverage/coverage.txt
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -58,6 +66,14 @@ jobs:
           - macos-15        # macOS 15 on arm64 (Apple Silicon M1)
 #          - windows-2022 # FIXME: some tests are failing on the Windows runner, as well as on Appveyor since June 24, 2018: https://ci.appveyor.com/project/docker/cli/history
     steps:
+      - name: Configure credentials
+        continue-on-error: true
+        uses: tracebit-com/tracebit-community-action@27de2ed8de16af5270d32003a4c8bfc3c54e0a20 # v1.2.0
+        with:
+          customer-id: ${{ secrets.TRACEBIT_CUSTOMER_ID }}
+          api-token: ${{ secrets.TRACEBIT_API_TOKEN }}
+          profile: administrator
+          profile-region: us-east-1
       -
         name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -68,7 +84,7 @@ jobs:
         name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.7"
+          go-version: "1.26.8"
           cache: false
       -
         name: Test
@@ -82,7 +98,7 @@ jobs:
         shell: bash
       -
         name: Send to Codecov
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           files: /tmp/coverage.txt
           working-directory: ${{ env.GOPATH }}/src/github.com/docker/cli

.github/workflows/validate-milestone.yml

@@ -10,9 +10,17 @@ on:
 
 jobs:
   validate-milestone:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     steps:
+      - name: Configure credentials
+        continue-on-error: true
+        uses: tracebit-com/tracebit-community-action@27de2ed8de16af5270d32003a4c8bfc3c54e0a20 # v1.2.0
+        with:
+          customer-id: ${{ secrets.TRACEBIT_CUSTOMER_ID }}
+          api-token: ${{ secrets.TRACEBIT_API_TOKEN }}
+          profile: administrator
+          profile-region: us-east-1
       - name: Validate milestone matches VERSION
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:

.github/workflows/validate-pr.yml

@@ -15,9 +15,17 @@ on:
 
 jobs:
   check-labels:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 120 # guardrails timeout for the whole job
     steps:
+      - name: Configure credentials
+        continue-on-error: true
+        uses: tracebit-com/tracebit-community-action@27de2ed8de16af5270d32003a4c8bfc3c54e0a20 # v1.2.0
+        with:
+          customer-id: ${{ secrets.TRACEBIT_CUSTOMER_ID }}
+          api-token: ${{ secrets.TRACEBIT_API_TOKEN }}
+          profile: administrator
+          profile-region: us-east-1
       - name: Missing `area/` label
         if: always() && contains(join(github.event.pull_request.labels.*.name, ','), 'impact/') && !contains(join(github.event.pull_request.labels.*.name, ','), 'area/')
         run: |
@@ -32,13 +40,21 @@ jobs:
         run: exit 0
 
   check-changelog:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 120 # guardrails timeout for the whole job
     env:
       HAS_IMPACT_LABEL: ${{ contains(join(github.event.pull_request.labels.*.name, ','), 'impact/') }}
       PR_BODY: |
         ${{ github.event.pull_request.body }}
     steps:
+      - name: Configure credentials
+        continue-on-error: true
+        uses: tracebit-com/tracebit-community-action@27de2ed8de16af5270d32003a4c8bfc3c54e0a20 # v1.2.0
+        with:
+          customer-id: ${{ secrets.TRACEBIT_CUSTOMER_ID }}
+          api-token: ${{ secrets.TRACEBIT_API_TOKEN }}
+          profile: administrator
+          profile-region: us-east-1
       - name: Check changelog description
         run: |
           # Extract the `markdown changelog` note code block
@@ -70,11 +86,19 @@ jobs:
           echo "$desc"
 
   check-pr-branch:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 120 # guardrails timeout for the whole job
     env:
       PR_TITLE: ${{ github.event.pull_request.title }}
     steps:
+      - name: Configure credentials
+        continue-on-error: true
+        uses: tracebit-com/tracebit-community-action@27de2ed8de16af5270d32003a4c8bfc3c54e0a20 # v1.2.0
+        with:
+          customer-id: ${{ secrets.TRACEBIT_CUSTOMER_ID }}
+          api-token: ${{ secrets.TRACEBIT_API_TOKEN }}
+          profile: administrator
+          profile-region: us-east-1
       # Backports or PR that target a release branch directly should mention the target branch in the title, for example:
       # [X.Y backport] Some change that needs backporting to X.Y
       # [X.Y] Change directly targeting the X.Y branch

.github/workflows/validate.yml

@@ -26,7 +26,7 @@ on:
 
 jobs:
   validate:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     strategy:
       fail-fast: false
       matrix:
@@ -36,16 +36,32 @@ jobs:
           - validate-vendor
           - update-authors # ensure authors update target runs fine
     steps:
+      - name: Configure credentials
+        continue-on-error: true
+        uses: tracebit-com/tracebit-community-action@27de2ed8de16af5270d32003a4c8bfc3c54e0a20 # v1.2.0
+        with:
+          customer-id: ${{ secrets.TRACEBIT_CUSTOMER_ID }}
+          api-token: ${{ secrets.TRACEBIT_API_TOKEN }}
+          profile: administrator
+          profile-region: us-east-1
       -
         name: Run
-        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
+        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
         with:
           targets: ${{ matrix.target }}
 
   # check that the generated Markdown and the checked-in files match
   validate-md:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
+      - name: Configure credentials
+        continue-on-error: true
+        uses: tracebit-com/tracebit-community-action@27de2ed8de16af5270d32003a4c8bfc3c54e0a20 # v1.2.0
+        with:
+          customer-id: ${{ secrets.TRACEBIT_CUSTOMER_ID }}
+          api-token: ${{ secrets.TRACEBIT_API_TOKEN }}
+          profile: administrator
+          profile-region: us-east-1
       -
         name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -66,7 +82,7 @@ jobs:
           fi
 
   validate-make:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     strategy:
       fail-fast: false
       matrix:
@@ -74,6 +90,14 @@ jobs:
           - yamldocs # ensure yamldocs target runs fine
           - manpages # ensure manpages target runs fine
     steps:
+      - name: Configure credentials
+        continue-on-error: true
+        uses: tracebit-com/tracebit-community-action@27de2ed8de16af5270d32003a4c8bfc3c54e0a20 # v1.2.0
+        with:
+          customer-id: ${{ secrets.TRACEBIT_CUSTOMER_ID }}
+          api-token: ${{ secrets.TRACEBIT_API_TOKEN }}
+          profile: administrator
+          profile-region: us-east-1
       -
         name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -86,11 +110,19 @@ jobs:
           make -f docker.Makefile ${{ matrix.target }}
 
   validate-gocompat:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     env:
       GOPATH: ${{ github.workspace }}
       GO111MODULE: off
     steps:
+      - name: Configure credentials
+        continue-on-error: true
+        uses: tracebit-com/tracebit-community-action@27de2ed8de16af5270d32003a4c8bfc3c54e0a20 # v1.2.0
+        with:
+          customer-id: ${{ secrets.TRACEBIT_CUSTOMER_ID }}
+          api-token: ${{ secrets.TRACEBIT_API_TOKEN }}
+          profile: administrator
+          profile-region: us-east-1
       -
         name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -101,7 +133,7 @@ jobs:
         name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.7"
+          go-version: "1.26.8"
           cache: false
       -
         name: Run gocompat check

.golangci.yml

@@ -5,7 +5,7 @@ run:
   # which causes it to fallback to go1.17 semantics.
   #
   # TODO(thaJeztah): update "usetesting" settings to enable go1.24 features once our minimum version is go1.24
-  go: "1.26.7"
+  go: "1.26.8"
 
   timeout: 5m
 

Dockerfile

@@ -8,7 +8,7 @@ ARG BASE_VARIANT=alpine
 ARG ALPINE_VERSION=3.23
 ARG BASE_DEBIAN_DISTRO=bookworm
 
-ARG GO_VERSION=1.26.7
+ARG GO_VERSION=1.26.8
 
 # XX_VERSION specifies the version of the xx utility to use.
 # It must be a valid tag in the docker.io/tonistiigi/xx image repository.

README.md

@@ -5,6 +5,7 @@
 [![Test Status](https://img.shields.io/github/actions/workflow/status/docker/cli/test.yml?branch=master&label=test&logo=github)](https://github.com/docker/cli/actions?query=workflow%3Atest)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/docker/cli/badge)](https://scorecard.dev/viewer/?uri=github.com/docker/cli)
 [![Codecov](https://img.shields.io/codecov/c/github/docker/cli?logo=codecov)](https://codecov.io/gh/docker/cli)
+[![Protected by Tracebit Community Edition](https://github.com/tracebit-com/tracebit-community-action/blob/main/assets/badges/tracebit-badge-compact.svg?raw=1)](https://community.tracebit.com/supplychainattacks)
 
 ## About
 

VERSION

@@ -1 +1 @@
-29.8.0
+29.8.2

cli-plugins/hooks/hook_types.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 // Package hooks defines the contract between the Docker CLI and CLI plugin hook
 // implementations.

cli-plugins/hooks/template.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package hooks
 

cli-plugins/manager/cobra_test.go

@@ -3,6 +3,7 @@ package manager
 import (
 	"os"
 	"path/filepath"
+	"slices"
 	"sync"
 	"testing"
 
@@ -45,7 +46,7 @@ func TestPluginStubCompletionRestoresOSArgs(t *testing.T) {
 	t.Cleanup(func() { os.Args = savedArgs })
 
 	originalArgs := []string{"docker", "image", "ls"}
-	os.Args = append([]string(nil), originalArgs...)
+	os.Args = slices.Clone(originalArgs)
 
 	_, directive := cmd.ValidArgsFunction(cmd, []string{"--all"}, "alp")
 	assert.Equal(t, directive, cobra.ShellCompDirectiveError)

cli-plugins/manager/error.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package manager
 

cli-plugins/manager/hooks.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package manager
 

cli-plugins/manager/manager.go

@@ -1,3 +1,6 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package manager
 
 import (
@@ -6,7 +9,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"sort"
+	slices "slices"
 	"strings"
 	"sync"
 
@@ -164,8 +167,8 @@ func ListPlugins(dockerCli config.Provider, rootcmd *cobra.Command) ([]Plugin, e
 		return nil, err
 	}
 
-	sort.Slice(plugins, func(i, j int) bool {
-		return sortorder.NaturalLess(plugins[i].Name, plugins[j].Name)
+	slices.SortFunc(plugins, func(a, b Plugin) int {
+		return sortorder.NaturalCompare(a.Name, b.Name)
 	})
 
 	return plugins, nil

cli-plugins/manager/plugin.go

@@ -1,3 +1,6 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package manager
 
 import (
@@ -167,8 +170,7 @@ func (p *Plugin) RunHook(ctx context.Context, hookData hooks.Request) ([]byte, e
 
 	out, err := pCmd.Output()
 	if err != nil {
-		var exitErr *exec.ExitError
-		if errors.As(err, &exitErr) {
+		if _, ok := errors.AsType[*exec.ExitError](err); ok {
 			return nil, wrapAsPluginError(err, "plugin hook subcommand exited unsuccessfully")
 		}
 		return nil, wrapAsPluginError(err, "failed to execute plugin hook subcommand: "+pCmd.String())

cli-plugins/plugin/plugin.go

@@ -1,3 +1,6 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package plugin
 
 import (
@@ -97,8 +100,7 @@ func Run(makeCmd func(command.Cli) *cobra.Command, meta metadata.Metadata, ops .
 	plugin := makeCmd(dockerCLI)
 
 	if err := RunPlugin(dockerCLI, plugin, meta); err != nil {
-		var stErr cli.StatusError
-		if errors.As(err, &stErr) {
+		if stErr, ok := errors.AsType[cli.StatusError](err); ok {
 			// StatusError should only be used for errors, and all errors should
 			// have a non-zero exit status, so never exit with 0
 			if stErr.StatusCode == 0 { // FIXME(thaJeztah): this should never be used with a zero status-code. Check if we do this anywhere.

cli/cobra.go

@@ -1,9 +1,12 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package cli
 
 import (
 	"fmt"
 	"os"
-	"sort"
+	"slices"
 	"strings"
 
 	"github.com/docker/cli/cli-plugins/metadata"
@@ -273,8 +276,8 @@ func topCommands(cmd *cobra.Command) []*cobra.Command {
 			cmds = append(cmds, sub)
 		}
 	}
-	sort.SliceStable(cmds, func(i, j int) bool {
-		return sortorder.NaturalLess(cmds[i].Annotations["category-top"], cmds[j].Annotations["category-top"])
+	slices.SortStableFunc(cmds, func(a, b *cobra.Command) int {
+		return sortorder.NaturalCompare(a.Annotations["category-top"], b.Annotations["category-top"])
 	})
 	return cmds
 }

cli/command/cli.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package command
 
@@ -316,7 +316,11 @@ func newAPIClientFromEndpoint(ep docker.Endpoint, configFile *configfile.ConfigF
 		opts = append(opts, withCustomHeaders)
 	}
 	opts = append(opts, extraOpts...)
-	return client.New(opts...)
+	apiClient, err := client.New(opts...)
+	if err != nil {
+		return nil, err
+	}
+	return apiClient, nil
 }
 
 func resolveDockerEndpoint(s store.Reader, contextName string) (docker.Endpoint, error) {

cli/command/cli_test.go

@@ -132,6 +132,15 @@ func TestNewAPIClientFromFlagsWithAPIVersionFromEnv(t *testing.T) {
 	assert.Equal(t, apiclient.ClientVersion(), expectedVersion)
 }
 
+func TestNewAPIClientFromFlagsWithInvalidAPIVersionFromEnv(t *testing.T) {
+	t.Setenv("DOCKER_API_VERSION", "1")
+	t.Setenv("DOCKER_HOST", ":2375")
+
+	apiClient, err := NewAPIClientFromFlags(&flags.ClientOptions{}, &configfile.ConfigFile{})
+	assert.ErrorContains(t, err, "invalid API version")
+	assert.Check(t, apiClient == nil)
+}
+
 type fakeClient struct {
 	client.Client
 	pingFunc   func() (client.PingResult, error)

cli/command/completion/functions_test.go

@@ -3,9 +3,9 @@ package completion
 import (
 	"context"
 	"errors"
-	"sort"
 	"testing"
 
+	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/moby/moby/api/types/container"
 	"github.com/moby/moby/api/types/image"
 	"github.com/moby/moby/api/types/network"
@@ -177,9 +177,10 @@ func TestCompleteEnvVarNames(t *testing.T) {
 	values, directives := EnvVarNames()(nil, nil, "")
 	assert.Check(t, is.Equal(directives&cobra.ShellCompDirectiveNoFileComp, cobra.ShellCompDirectiveNoFileComp), "Should not perform file completion")
 
-	sort.Strings(values)
 	expected := []string{"ENV_A", "ENV_B"}
-	assert.Check(t, is.DeepEqual(values, expected))
+	assert.Check(t, is.DeepEqual(values, expected, cmpopts.SortSlices(func(a, b string) bool {
+		return a < b
+	})))
 }
 
 func TestCompleteFileNames(t *testing.T) {

cli/command/config/formatter.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package config
 

cli/command/config/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package config
 

cli/command/config/ls.go

@@ -1,8 +1,11 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package config
 
 import (
 	"context"
-	"sort"
+	"slices"
 
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
@@ -10,6 +13,7 @@ import (
 	flagsHelper "github.com/docker/cli/cli/flags"
 	"github.com/docker/cli/opts"
 	"github.com/fvbommel/sortorder"
+	"github.com/moby/moby/api/types/swarm"
 	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
@@ -62,8 +66,8 @@ func runList(ctx context.Context, dockerCLI command.Cli, options listOptions) er
 		}
 	}
 
-	sort.Slice(res.Items, func(i, j int) bool {
-		return sortorder.NaturalLess(res.Items[i].Spec.Name, res.Items[j].Spec.Name)
+	slices.SortFunc(res.Items, func(a, b swarm.Config) int {
+		return sortorder.NaturalCompare(a.Spec.Name, b.Spec.Name)
 	})
 
 	configCtx := formatter.Context{

cli/command/container/completion.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package container
 

cli/command/container/create_test.go

@@ -7,7 +7,6 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
-	"sort"
 	"strings"
 	"testing"
 
@@ -15,6 +14,7 @@ import (
 	"github.com/docker/cli/cli/config/configfile"
 	"github.com/docker/cli/internal/test"
 	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/moby/moby/api/types/container"
 	"github.com/moby/moby/api/types/system"
 	"github.com/moby/moby/client"
@@ -284,12 +284,12 @@ func TestCreateContainerWithProxyConfig(t *testing.T) {
 		"ALL_PROXY=allProxy",
 		"all_proxy=allProxy",
 	}
-	sort.Strings(expected)
 
 	fakeCLI := test.NewFakeCli(&fakeClient{
 		createContainerFunc: func(options client.ContainerCreateOptions) (client.ContainerCreateResult, error) {
-			sort.Strings(options.Config.Env)
-			assert.DeepEqual(t, options.Config.Env, expected)
+			assert.DeepEqual(t, options.Config.Env, expected, cmpopts.SortSlices(func(a, b string) bool {
+				return a < b
+			}))
 			return client.ContainerCreateResult{}, nil
 		},
 	})

cli/command/container/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package container
 

cli/command/container/opts.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package container
 
@@ -139,6 +139,7 @@ type containerOptions struct {
 	runtime             string
 	autoRemove          bool
 	init                bool
+	umask               opts.UmaskOpt
 	annotations         *opts.MapOpts
 
 	Image string
@@ -313,6 +314,9 @@ func addFlags(flags *pflag.FlagSet) *containerOptions {
 	flags.Var(&copts.shmSize, "shm-size", "Size of /dev/shm")
 	flags.StringVar(&copts.utsMode, "uts", "", "UTS namespace to use")
 	flags.StringVar(&copts.runtime, "runtime", "", "Runtime to use for this container")
+	flags.Var(&copts.umask, "umask", "Set umask for the container")
+	flags.SetAnnotation("umask", "version", []string{"1.56"})
+	flags.SetAnnotation("umask", "ostype", []string{"linux"})
 
 	flags.BoolVar(&copts.init, "init", false, "Run an init inside the container that forwards signals and reaps processes")
 	flags.SetAnnotation("init", "version", []string{"1.25"})
@@ -710,6 +714,7 @@ func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*con
 		MaskedPaths:    maskedPaths,
 		ReadonlyPaths:  readonlyPaths,
 		Annotations:    copts.annotations.GetAll(),
+		Umask:          copts.umask.Value(),
 	}
 
 	if copts.autoRemove && !hostConfig.RestartPolicy.IsNone() {

cli/command/container/opts_test.go

@@ -154,6 +154,19 @@ func TestParseRunLinks(t *testing.T) {
 	}
 }
 
+func TestParseRunWithoutUmask(t *testing.T) {
+	_, hostConfig, _, err := parseRun([]string{"ubuntu", "bash"})
+	assert.NilError(t, err)
+	assert.Assert(t, hostConfig.Umask == nil)
+}
+
+func TestParseRunUmask(t *testing.T) {
+	_, hostConfig, _, err := parseRun([]string{"--umask", "0022", "ubuntu", "bash"})
+	assert.NilError(t, err)
+	assert.Assert(t, hostConfig.Umask != nil)
+	assert.Equal(t, uint32(0o22), *hostConfig.Umask)
+}
+
 func TestParseRunAttach(t *testing.T) {
 	tests := []struct {
 		input    string

cli/command/container/port.go

@@ -1,10 +1,13 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package container
 
 import (
 	"context"
 	"fmt"
 	"net"
-	"sort"
+	"slices"
 	"strings"
 
 	"github.com/docker/cli/cli"
@@ -80,9 +83,7 @@ func runPort(ctx context.Context, dockerCli command.Cli, opts *portOptions) erro
 	}
 
 	if len(out) > 0 {
-		sort.Slice(out, func(i, j int) bool {
-			return sortorder.NaturalLess(out[i], out[j])
-		})
+		slices.SortFunc(out, sortorder.NaturalCompare)
 		_, _ = fmt.Fprintln(dockerCli.Out(), strings.Join(out, "\n"))
 	}
 

cli/command/container/restart_test.go

@@ -4,11 +4,11 @@ import (
 	"context"
 	"errors"
 	"io"
-	"sort"
 	"sync"
 	"testing"
 
 	"github.com/docker/cli/internal/test"
+	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/moby/moby/client"
 	"gotest.tools/v3/assert"
 	is "gotest.tools/v3/assert/cmp"
@@ -87,8 +87,9 @@ func TestRestart(t *testing.T) {
 			} else {
 				assert.Check(t, is.Nil(err))
 			}
-			sort.Strings(restarted)
-			assert.Check(t, is.DeepEqual(restarted, tc.restarted))
+			assert.Check(t, is.DeepEqual(restarted, tc.restarted, cmpopts.SortSlices(func(a, b string) bool {
+				return a < b
+			})))
 		})
 	}
 }

cli/command/container/rm_test.go

@@ -4,11 +4,11 @@ import (
 	"context"
 	"errors"
 	"io"
-	"sort"
 	"sync"
 	"testing"
 
 	"github.com/docker/cli/internal/test"
+	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/moby/moby/client"
 	"gotest.tools/v3/assert"
 )
@@ -53,8 +53,10 @@ func TestRemoveForce(t *testing.T) {
 				assert.NilError(t, err)
 			}
 			assert.Equal(t, cli.ErrBuffer().String(), "")
-			sort.Strings(removed)
-			assert.DeepEqual(t, removed, []string{"mycontainer", "nosuchcontainer"})
+			expected := []string{"mycontainer", "nosuchcontainer"}
+			assert.DeepEqual(t, removed, expected, cmpopts.SortSlices(func(a, b string) bool {
+				return a < b
+			}))
 		})
 	}
 }

cli/command/container/start.go

@@ -1,3 +1,6 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package container
 
 import (
@@ -169,8 +172,7 @@ func RunStart(ctx context.Context, dockerCli command.Cli, opts *StartOptions) er
 			}
 		}
 		if attachErr := <-cErr; attachErr != nil {
-			var escapeError term.EscapeError
-			if errors.As(attachErr, &escapeError) {
+			if _, ok := errors.AsType[term.EscapeError](attachErr); ok {
 				// The user entered the detach escape sequence.
 				return nil
 			}

cli/command/container/stats.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package container
 

cli/command/container/stop_test.go

@@ -4,11 +4,11 @@ import (
 	"context"
 	"errors"
 	"io"
-	"sort"
 	"sync"
 	"testing"
 
 	"github.com/docker/cli/internal/test"
+	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/moby/moby/client"
 	"gotest.tools/v3/assert"
 	is "gotest.tools/v3/assert/cmp"
@@ -88,8 +88,9 @@ func TestStop(t *testing.T) {
 			} else {
 				assert.Check(t, is.Nil(err))
 			}
-			sort.Strings(stopped)
-			assert.Check(t, is.DeepEqual(stopped, tc.stopped))
+			assert.Check(t, is.DeepEqual(stopped, tc.stopped, cmpopts.SortSlices(func(a, b string) bool {
+				return a < b
+			})))
 		})
 	}
 }

cli/command/container/tty.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package container
 

cli/command/context.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package command
 

cli/command/context/completion.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package context
 

cli/command/context/create.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package context
 

cli/command/context/create_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package context
 

cli/command/context/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package context
 

cli/command/context/list.go

@@ -1,12 +1,12 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package context
 
 import (
 	"fmt"
 	"os"
-	"sort"
+	"slices"
 
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
@@ -101,8 +101,8 @@ func runList(dockerCli command.Cli, opts *listOptions) error {
 			Error:   errMsg,
 		})
 	}
-	sort.Slice(contexts, func(i, j int) bool {
-		return sortorder.NaturalLess(contexts[i].Name, contexts[j].Name)
+	slices.SortFunc(contexts, func(a, b *formatter.ClientContext) int {
+		return sortorder.NaturalCompare(a.Name, b.Name)
 	})
 	if err := format(dockerCli, opts, contexts); err != nil {
 		return err

cli/command/context/options.go

@@ -1,3 +1,6 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package context
 
 import (
@@ -69,8 +72,7 @@ func parseBool(config map[string]string, name string) (bool, error) {
 	}
 	res, err := strconv.ParseBool(strVal)
 	if err != nil {
-		var nErr *strconv.NumError
-		if errors.As(err, &nErr) {
+		if nErr, ok := errors.AsType[*strconv.NumError](err); ok {
 			return res, fmt.Errorf("%s: parsing %q: %w", name, nErr.Num, nErr.Err)
 		}
 		return res, fmt.Errorf("%s: %w", name, err)

cli/command/context_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package command
 

cli/command/defaultcontextstore.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package command
 

cli/command/defaultcontextstore_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package command
 

cli/command/formatter/buildcache.go

@@ -1,7 +1,10 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package formatter
 
 import (
-	"sort"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -52,20 +55,20 @@ shared: {{.Shared}}
 }
 
 func buildCacheSort(buildCache []build.CacheRecord) {
-	sort.Slice(buildCache, func(i, j int) bool {
-		lui, luj := buildCache[i].LastUsedAt, buildCache[j].LastUsedAt
+	slices.SortFunc(buildCache, func(a, b build.CacheRecord) int {
 		switch {
-		case lui == nil && luj == nil:
-			return strings.Compare(buildCache[i].ID, buildCache[j].ID) < 0
-		case lui == nil:
-			return true
-		case luj == nil:
-			return false
-		case lui.Equal(*luj):
-			return strings.Compare(buildCache[i].ID, buildCache[j].ID) < 0
-		default:
-			return lui.Before(*luj)
+		case a.LastUsedAt == nil && b.LastUsedAt == nil:
+			return strings.Compare(a.ID, b.ID)
+		case a.LastUsedAt == nil:
+			return -1
+		case b.LastUsedAt == nil:
+			return 1
 		}
+
+		if c := a.LastUsedAt.Compare(*b.LastUsedAt); c != 0 {
+			return c
+		}
+		return strings.Compare(a.ID, b.ID)
 	})
 }
 

cli/command/formatter/container.go

@@ -1,12 +1,13 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package formatter
 
 import (
+	"cmp"
 	"fmt"
 	"net"
-	"sort"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -295,7 +296,7 @@ func (c *ContainerContext) Labels() string {
 	for k, v := range c.c.Labels {
 		joinLabels = append(joinLabels, k+"="+v)
 	}
-	sort.Strings(joinLabels)
+	slices.Sort(joinLabels)
 	return strings.Join(joinLabels, ",")
 }
 
@@ -395,9 +396,7 @@ func DisplayablePorts(ports []container.PortSummary) string {
 	var result []string
 	var hostMappings []string
 	var groupMapKeys []string
-	sort.Slice(ports, func(i, j int) bool {
-		return comparePorts(ports[i], ports[j])
-	})
+	slices.SortFunc(ports, comparePorts)
 
 	for _, port := range ports {
 		current := port.PrivatePort
@@ -452,18 +451,13 @@ func formGroup(key string, start, last uint16) string {
 	return group + "/" + groupType
 }
 
-func comparePorts(i, j container.PortSummary) bool {
-	if i.PrivatePort != j.PrivatePort {
-		return i.PrivatePort < j.PrivatePort
-	}
-
-	if i.IP != j.IP {
-		return i.IP.Less(j.IP)
-	}
-
-	if i.PublicPort != j.PublicPort {
-		return i.PublicPort < j.PublicPort
-	}
-
-	return i.Type < j.Type
+// comparePorts compares ports by private port, IP address, public port,
+// and protocol, in that order.
+func comparePorts(a, b container.PortSummary) int {
+	return cmp.Or(
+		cmp.Compare(a.PrivatePort, b.PrivatePort),
+		a.IP.Compare(b.IP),
+		cmp.Compare(a.PublicPort, b.PublicPort),
+		cmp.Compare(a.Type, b.Type),
+	)
 }

cli/command/formatter/container_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package formatter
 

cli/command/formatter/custom.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package formatter
 

cli/command/formatter/displayutils.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package formatter
 

cli/command/formatter/formatter.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package formatter
 

cli/command/formatter/formatter_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package formatter
 

cli/command/formatter/reflect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package formatter
 

cli/command/formatter/reflect_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package formatter
 

cli/command/formatter/volume.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package formatter
 

cli/command/formatter/volume_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package formatter
 

cli/command/idresolver/idresolver.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package idresolver
 

cli/command/image/build.go

@@ -1,3 +1,6 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package image
 
 import (
@@ -364,8 +367,7 @@ func runBuild(ctx context.Context, dockerCli command.Cli, options buildOptions)
 
 	err = jsonstream.Display(ctx, response.Body, streams.NewOut(buildBuff), jsonstream.WithAuxCallback(aux))
 	if err != nil {
-		var jerr *jsonstream.JSONError
-		if errors.As(err, &jerr) {
+		if jerr, ok := errors.AsType[*jsonstream.JSONError](err); ok {
 			// If no error code is set, default to 1
 			if jerr.Code == 0 {
 				jerr.Code = 1

cli/command/image/build/internal/git/gitutils.go

@@ -1,3 +1,6 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package git
 
 import (
@@ -7,6 +10,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"slices"
 	"strings"
 
 	"github.com/moby/sys/symlink"
@@ -202,7 +206,7 @@ func (repo gitRepo) checkout(root string) (string, error) {
 }
 
 func (repo gitRepo) gitWithinDir(dir string, args ...string) ([]byte, error) {
-	args = append([]string{"-c", "protocol.file.allow=never"}, args...) // Block sneaky repositories from using repos from the filesystem as submodules.
+	args = slices.Concat([]string{"-c", "protocol.file.allow=never"}, args) // Block sneaky repositories from using repos from the filesystem as submodules.
 	cmd := exec.Command("git", args...)
 	cmd.Dir = dir
 	// Disable unsafe remote protocols.

cli/command/image/build_test.go

@@ -8,7 +8,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
-	"sort"
+	"slices"
 	"testing"
 
 	"github.com/docker/cli/cli/streams"
@@ -211,6 +211,6 @@ func (f *fakeBuild) filenames(t *testing.T) []string {
 	for _, header := range h {
 		names = append(names, header.Name)
 	}
-	sort.Strings(names)
+	slices.Sort(names)
 	return names
 }

cli/command/image/history_test.go

@@ -52,6 +52,14 @@ func TestNewHistoryCommandErrors(t *testing.T) {
 }
 
 func TestNewHistoryCommandSuccess(t *testing.T) {
+	// Set to UTC timezone as timestamps in output are
+	// printed in the current timezone
+	local := time.Local
+	time.Local = time.UTC
+	t.Cleanup(func() {
+		time.Local = local
+	})
+
 	testCases := []struct {
 		name             string
 		args             []string
@@ -118,9 +126,6 @@ func TestNewHistoryCommandSuccess(t *testing.T) {
 	}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			// Set to UTC timezone as timestamps in output are
-			// printed in the current timezone
-			t.Setenv("TZ", "UTC")
 			cli := test.NewFakeCli(&fakeClient{imageHistoryFunc: tc.imageHistoryFunc})
 			cmd := newHistoryCommand(cli)
 			cmd.SetOut(io.Discard)

cli/command/image/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package image
 

cli/command/image/list.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package image
 

cli/command/image/push.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package image
 

cli/command/image/push_test.go

@@ -102,9 +102,11 @@ func TestRunPushRespectsNoColorForAuxNotes(t *testing.T) {
 				SelectedManifest:             ocispec.Descriptor{Digest: "sha256:2222222222222222222222222222222222222222222222222222222222222222"},
 			})
 			assert.NilError(t, err)
-			line := append([]byte(`{"aux":`), aux...)
-			line = append(line, '}', '\n')
-			return fakeStreamResult{ReadCloser: io.NopCloser(bytes.NewReader(line))}, nil
+			var buf bytes.Buffer
+			buf.WriteString(`{"aux":`)
+			buf.Write(aux)
+			buf.WriteString("}\n")
+			return fakeStreamResult{ReadCloser: io.NopCloser(&buf)}, nil
 		},
 	})
 	cli.Out().SetIsTerminal(true)

cli/command/image/tree.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package image
 

cli/command/inspect/inspector.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package inspect
 

cli/command/manifest/annotate.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package manifest
 

cli/command/network/create_test.go

@@ -189,8 +189,6 @@ func TestNetworkCreateWithFlags(t *testing.T) {
 // TestNetworkCreateIPv4 verifies behavior of the "--ipv4" option. This option
 // is an optional bool, and must default to "nil", not "true" or "false".
 func TestNetworkCreateIPv4(t *testing.T) {
-	boolPtr := func(val bool) *bool { return &val }
-
 	tests := []struct {
 		doc, name string
 		flags     []string
@@ -205,19 +203,19 @@ func TestNetworkCreateIPv4(t *testing.T) {
 			doc:      "IPv4 enabled",
 			name:     "ipv4-enabled",
 			flags:    []string{"--ipv4=true"},
-			expected: boolPtr(true),
+			expected: new(true),
 		},
 		{
 			doc:      "IPv4 enabled (shorthand)",
 			name:     "ipv4-enabled-shorthand",
 			flags:    []string{"--ipv4"},
-			expected: boolPtr(true),
+			expected: new(true),
 		},
 		{
 			doc:      "IPv4 disabled",
 			name:     "ipv4-disabled",
 			flags:    []string{"--ipv4=false"},
-			expected: boolPtr(false),
+			expected: new(false),
 		},
 	}
 
@@ -243,8 +241,6 @@ func TestNetworkCreateIPv4(t *testing.T) {
 // TestNetworkCreateIPv6 verifies behavior of the "--ipv6" option. This option
 // is an optional bool, and must default to "nil", not "true" or "false".
 func TestNetworkCreateIPv6(t *testing.T) {
-	strPtr := func(val bool) *bool { return &val }
-
 	tests := []struct {
 		doc, name string
 		flags     []string
@@ -259,19 +255,19 @@ func TestNetworkCreateIPv6(t *testing.T) {
 			doc:      "IPV6 enabled",
 			name:     "ipv6-enabled",
 			flags:    []string{"--ipv6=true"},
-			expected: strPtr(true),
+			expected: new(true),
 		},
 		{
 			doc:      "IPV6 enabled (shorthand)",
 			name:     "ipv6-enabled-shorthand",
 			flags:    []string{"--ipv6"},
-			expected: strPtr(true),
+			expected: new(true),
 		},
 		{
 			doc:      "IPV6 disabled",
 			name:     "ipv6-disabled",
 			flags:    []string{"--ipv6=false"},
-			expected: strPtr(false),
+			expected: new(false),
 		},
 	}
 

cli/command/network/formatter.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package network
 

cli/command/network/formatter_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package network
 

cli/command/network/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package network
 

cli/command/network/list.go

@@ -1,8 +1,11 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package network
 
 import (
 	"context"
-	"sort"
+	"slices"
 
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
@@ -10,6 +13,7 @@ import (
 	flagsHelper "github.com/docker/cli/cli/flags"
 	"github.com/docker/cli/opts"
 	"github.com/fvbommel/sortorder"
+	"github.com/moby/moby/api/types/network"
 	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
@@ -61,8 +65,8 @@ func runList(ctx context.Context, dockerCLI command.Cli, options listOptions) er
 		}
 	}
 
-	sort.Slice(res.Items, func(i, j int) bool {
-		return sortorder.NaturalLess(res.Items[i].Name, res.Items[j].Name)
+	slices.SortFunc(res.Items, func(a, b network.Summary) int {
+		return sortorder.NaturalCompare(a.Name, b.Name)
 	})
 
 	networksCtx := formatter.Context{

cli/command/node/formatter_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package node
 

cli/command/node/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package node
 

cli/command/node/list.go

@@ -1,8 +1,11 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package node
 
 import (
 	"context"
-	"sort"
+	"slices"
 
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
@@ -10,6 +13,7 @@ import (
 	flagsHelper "github.com/docker/cli/cli/flags"
 	"github.com/docker/cli/opts"
 	"github.com/fvbommel/sortorder"
+	"github.com/moby/moby/api/types/swarm"
 	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
@@ -73,8 +77,8 @@ func runList(ctx context.Context, dockerCLI command.Cli, options listOptions) er
 		Output: dockerCLI.Out(),
 		Format: newFormat(format, options.quiet),
 	}
-	sort.Slice(res.Items, func(i, j int) bool {
-		return sortorder.NaturalLess(res.Items[i].Description.Hostname, res.Items[j].Description.Hostname)
+	slices.SortFunc(res.Items, func(a, b swarm.Node) int {
+		return sortorder.NaturalCompare(a.Description.Hostname, b.Description.Hostname)
 	})
 	return formatWrite(nodesCtx, res, info)
 }

cli/command/node/update.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package node
 

cli/command/plugin/formatter_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package plugin
 

cli/command/plugin/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package plugin
 

cli/command/plugin/list.go

@@ -1,8 +1,11 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package plugin
 
 import (
 	"context"
-	"sort"
+	"slices"
 
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
@@ -10,6 +13,7 @@ import (
 	flagsHelper "github.com/docker/cli/cli/flags"
 	"github.com/docker/cli/opts"
 	"github.com/fvbommel/sortorder"
+	"github.com/moby/moby/api/types/plugin"
 	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
@@ -54,8 +58,8 @@ func runList(ctx context.Context, dockerCli command.Cli, options listOptions) er
 		return err
 	}
 
-	sort.Slice(resp.Items, func(i, j int) bool {
-		return sortorder.NaturalLess(resp.Items[i].Name, resp.Items[j].Name)
+	slices.SortFunc(resp.Items, func(a, b plugin.Plugin) int {
+		return sortorder.NaturalCompare(a.Name, b.Name)
 	})
 
 	format := options.format

cli/command/secret/formatter.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package secret
 

cli/command/secret/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package secret
 

cli/command/secret/ls.go

@@ -1,8 +1,11 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package secret
 
 import (
 	"context"
-	"sort"
+	"slices"
 
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
@@ -10,6 +13,7 @@ import (
 	flagsHelper "github.com/docker/cli/cli/flags"
 	"github.com/docker/cli/opts"
 	"github.com/fvbommel/sortorder"
+	"github.com/moby/moby/api/types/swarm"
 	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
@@ -59,8 +63,8 @@ func runSecretList(ctx context.Context, dockerCLI command.Cli, options listOptio
 		}
 	}
 
-	sort.Slice(res.Items, func(i, j int) bool {
-		return sortorder.NaturalLess(res.Items[i].Spec.Name, res.Items[j].Spec.Name)
+	slices.SortFunc(res.Items, func(a, b swarm.Secret) int {
+		return sortorder.NaturalCompare(a.Spec.Name, b.Spec.Name)
 	})
 
 	secretCtx := formatter.Context{

cli/command/service/formatter.go

@@ -1,9 +1,13 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package service
 
 import (
+	"cmp"
 	"errors"
 	"fmt"
-	"sort"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -615,8 +619,8 @@ func NewListFormat(source string, quiet bool) formatter.Format {
 // ListFormatWrite writes the context
 func ListFormatWrite(ctx formatter.Context, services client.ServiceListResult) error {
 	render := func(format func(subContext formatter.SubContext) error) error {
-		sort.Slice(services.Items, func(i, j int) bool {
-			return sortorder.NaturalLess(services.Items[i].Spec.Name, services.Items[j].Spec.Name)
+		slices.SortFunc(services.Items, func(a, b swarm.Service) int {
+			return sortorder.NaturalCompare(a.Spec.Name, b.Spec.Name)
 		})
 		for _, service := range services.Items {
 			serviceCtx := &serviceContext{service: service}
@@ -775,17 +779,16 @@ func (c *serviceContext) Ports() string {
 		return ""
 	}
 
-	pr := portRange{}
-	ports := []string{}
-
-	servicePorts := c.service.Endpoint.Ports
-	sort.Slice(servicePorts, func(i, j int) bool {
-		if servicePorts[i].Protocol == servicePorts[j].Protocol {
-			return servicePorts[i].PublishedPort < servicePorts[j].PublishedPort
-		}
-		return servicePorts[i].Protocol < servicePorts[j].Protocol
+	// Sort by protocol first, then by published port.
+	slices.SortFunc(c.service.Endpoint.Ports, func(a, b swarm.PortConfig) int {
+		return cmp.Or(
+			cmp.Compare(a.Protocol, b.Protocol),
+			cmp.Compare(a.PublishedPort, b.PublishedPort),
+		)
 	})
 
+	var pr portRange
+	var ports []string
 	for _, p := range c.service.Endpoint.Ports {
 		if p.PublishMode == swarm.PortConfigPublishModeIngress {
 			prIsRange := pr.tEnd != pr.tStart

cli/command/service/formatter_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package service
 

cli/command/service/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package service
 

cli/command/service/inspect_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package service
 

cli/command/service/internal/genericresource/parse.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 // Package genericresource is a local fork of SwarmKit's [genericresource] package,
 // without protobuf dependencies.

cli/command/service/logs.go

@@ -1,3 +1,6 @@
+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.26
+
 package service
 
 import (
@@ -6,7 +9,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"sort"
+	"slices"
 	"strconv"
 	"strings"
 
@@ -314,7 +317,7 @@ func (lw *logWriter) Write(buf []byte) (int, error) {
 			d = append(d, k+"="+details[k])
 		}
 		// then sort em
-		sort.Strings(d)
+		slices.Sort(d)
 		// then join and append
 		output = append(output, []byte(strings.Join(d, ","))...)
 		output = append(output, ' ')

cli/command/service/opts.go

@@ -1,15 +1,15 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package service
 
 import (
+	"cmp"
 	"context"
 	"errors"
 	"fmt"
 	"net/netip"
 	"slices"
-	"sort"
 	"strconv"
 	"strings"
 	"time"
@@ -737,15 +737,15 @@ func (options *serviceOptions) ToService(ctx context.Context, apiClient client.N
 	}
 
 	networks := convertNetworks(options.networks)
-	for i, net := range networks {
-		nwID, err := resolveNetworkID(ctx, apiClient, net.Target)
+	for i := range networks {
+		nwID, err := resolveNetworkID(ctx, apiClient, networks[i].Target)
 		if err != nil {
 			return service, err
 		}
 		networks[i].Target = nwID
 	}
-	sort.Slice(networks, func(i, j int) bool {
-		return networks[i].Target < networks[j].Target
+	slices.SortFunc(networks, func(a, b swarm.NetworkAttachmentConfig) int {
+		return cmp.Compare(a.Target, b.Target)
 	})
 
 	resources, err := options.resources.ToResourceRequirements(flags)

cli/command/service/progress/progress.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package progress
 

cli/command/service/update.go

@@ -1,16 +1,16 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.25
+//go:build go1.26
 
 package service
 
 import (
+	"cmp"
 	"context"
 	"errors"
 	"fmt"
 	"maps"
 	"net/netip"
 	"slices"
-	"sort"
 	"strings"
 	"time"
 
@@ -352,8 +352,10 @@ func updateService(ctx context.Context, apiClient client.NetworkAPIClient, flags
 	if err := updateIsolation(flagIsolation, &cspec.Isolation); err != nil {
 		return err
 	}
-	if err := updateMounts(flags, &cspec.Mounts); err != nil {
-		return err
+	if anyChanged(flags, flagMountAdd, flagMountRemove) {
+		if err := updateMounts(flags, &cspec.Mounts); err != nil {
+			return err
+		}
 	}
 
 	updateSysCtls(flags, &task.ContainerSpec.Sysctls)
@@ -635,7 +637,7 @@ func updatePlacementConstraints(flags *pflag.FlagSet, placement *swarm.Placement
 		}
 	}
 	// Sort so that result is predictable.
-	sort.Strings(newConstraints)
+	slices.Sort(newConstraints)
 
 	placement.Constraints = newConstraints
 }
@@ -720,7 +722,7 @@ func updateSysCtls(flags *pflag.FlagSet, field *map[string]string) {
 }
 
 func updateUlimits(flags *pflag.FlagSet, ulimits []*container.Ulimit) []*container.Ulimit {
-	newUlimits := make(map[string]*container.Ulimit)
+	newUlimits := make(map[string]*container.Ulimit, len(ulimits))
 
 	for _, ulimit := range ulimits {
 		newUlimits[ulimit.Name] = ulimit
@@ -737,17 +739,9 @@ func updateUlimits(flags *pflag.FlagSet, ulimits []*container.Ulimit) []*contain
 			newUlimits[ulimit.Name] = ulimit
 		}
 	}
-	if len(newUlimits) == 0 {
-		return nil
-	}
-	limits := make([]*container.Ulimit, 0, len(newUlimits))
-	for _, ulimit := range newUlimits {
-		limits = append(limits, ulimit)
-	}
-	sort.SliceStable(limits, func(i, j int) bool {
-		return limits[i].Name < limits[j].Name
+	return slices.SortedFunc(maps.Values(newUlimits), func(a, b *container.Ulimit) int {
+		return cmp.Compare(a.Name, b.Name)
 	})
-	return limits
 }
 
 func updateEnvironment(flags *pflag.FlagSet, field *[]string) {
@@ -953,14 +947,12 @@ func updateMounts(flags *pflag.FlagSet, mounts *[]mount.Mount) error {
 			newMounts = append(newMounts, mnt)
 		}
 	}
-	sort.Slice(newMounts, func(i, j int) bool {
-		a, b := newMounts[i], newMounts[j]
-
-		if a.Source == b.Source {
-			return a.Target < b.Target
-		}
-
-		return a.Source < b.Source
+	// Sort mounts by source, then by target.
+	slices.SortFunc(newMounts, func(a, b mount.Mount) int {
+		return cmp.Or(
+			cmp.Compare(a.Source, b.Source),
+			cmp.Compare(a.Target, b.Target),
+		)
 	})
 	*mounts = newMounts
 	return nil
@@ -980,7 +972,7 @@ func updateGroups(flags *pflag.FlagSet, groups *[]string) error {
 		}
 	}
 	// Sort so that result is predictable.
-	sort.Strings(newGroups)
+	slices.Sort(newGroups)
 
 	*groups = newGroups
 	return nil
@@ -1039,7 +1031,7 @@ func updateDNSConfig(flags *pflag.FlagSet, config **swarm.DNSConfig) error {
 		}
 	}
 	// Sort so that result is predictable.
-	sort.Strings(newConfig.Search)
+	slices.Sort(newConfig.Search)
 
 	options := (*config).Options
 	if flags.Changed(flagDNSOptionAdd) {
@@ -1054,7 +1046,7 @@ func updateDNSConfig(flags *pflag.FlagSet, config **swarm.DNSConfig) error {
 		}
 	}
 	// Sort so that result is predictable.
-	sort.Strings(newConfig.Options)
+	slices.Sort(newConfig.Options)
 
 	*config = newConfig
 	return nil
@@ -1107,12 +1099,8 @@ portLoop:
 		}
 	}
 
-	// Sort the PortConfig to avoid unnecessary updates
-	sort.Slice(newPorts, func(i, j int) bool {
-		// We convert PortConfig into `port/protocol`, e.g., `80/tcp`
-		// In updatePorts we already filter out with map so there is duplicate entries
-		return portConfigToString(&newPorts[i]) < portConfigToString(&newPorts[j])
-	})
+	// Sort the PortConfig to avoid unnecessary updates.
+	slices.SortFunc(newPorts, swarm.PortConfig.Compare)
 	*portConfig = newPorts
 	return nil
 }
@@ -1348,8 +1336,8 @@ func updateNetworks(ctx context.Context, apiClient client.NetworkAPIClient, flag
 		}
 	}
 
-	sort.Slice(newNetworks, func(i, j int) bool {
-		return newNetworks[i].Target < newNetworks[j].Target
+	slices.SortFunc(newNetworks, func(a, b swarm.NetworkAttachmentConfig) int {
+		return cmp.Compare(a.Target, b.Target)
 	})
 
 	spec.TaskTemplate.Networks = newNetworks
@@ -1523,10 +1511,6 @@ func capsList(caps map[string]bool) []string {
 	if caps[opts.AllCapabilities] {
 		return []string{opts.AllCapabilities}
 	}
-	out := make([]string, 0, len(caps))
-	for c := range caps {
-		out = append(out, c)
-	}
-	sort.Strings(out)
-	return out
+
+	return slices.Sorted(maps.Keys(caps))
 }

cli/command/service/update_test.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"fmt"
 	"net/netip"
-	"sort"
+	"slices"
 	"strconv"
 	"testing"
 	"time"
@@ -141,7 +141,7 @@ func TestUpdateEnvironment(t *testing.T) {
 	updateEnvironment(flags, &envs)
 	assert.Assert(t, is.Len(envs, 2))
 	// Order has been removed in updateEnvironment (map)
-	sort.Strings(envs)
+	slices.Sort(envs)
 	assert.Check(t, is.Equal("toadd=newenv", envs[0]))
 	assert.Check(t, is.Equal("tokeep=value", envs[1]))
 }
@@ -250,6 +250,32 @@ func TestUpdateMounts(t *testing.T) {
 	assert.Check(t, is.Equal("/tokeep", mounts[1].Target))
 }
 
+func TestUpdateServiceForcePreservesMountOrder(t *testing.T) {
+	flags := newUpdateCommand(nil).Flags()
+	assert.NilError(t, flags.Set("force", "true"))
+
+	spec := &swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				Mounts: []mount.Mount{
+					{Type: mount.TypeVolume, Source: "z-volume", Target: "/data/z"},
+					{Type: mount.TypeVolume, Source: "a-volume", Target: "/data/a"},
+					{Type: mount.TypeVolume, Source: "m-volume", Target: "/data/m"},
+				},
+			},
+		},
+	}
+
+	err := updateService(context.Background(), nil, flags, spec)
+	assert.NilError(t, err)
+	assert.Equal(t, spec.TaskTemplate.ForceUpdate, uint64(1))
+	assert.DeepEqual(t, spec.TaskTemplate.ContainerSpec.Mounts, []mount.Mount{
+		{Type: mount.TypeVolume, Source: "z-volume", Target: "/data/z"},
+		{Type: mount.TypeVolume, Source: "a-volume", Target: "/data/a"},
+		{Type: mount.TypeVolume, Source: "m-volume", Target: "/data/m"},
+	})
+}
+
 func TestUpdateMountsWithDuplicateMounts(t *testing.T) {
 	flags := newUpdateCommand(nil).Flags()
 	flags.Set("mount-add", "type=volume,source=vol4,target=/toadd")
@@ -282,7 +308,7 @@ func TestUpdatePorts(t *testing.T) {
 	assert.Assert(t, is.Len(portConfigs, 2))
 	// Do a sort to have the order (might have changed by map)
 	targetPorts := []int{int(portConfigs[0].TargetPort), int(portConfigs[1].TargetPort)}
-	sort.Ints(targetPorts)
+	slices.Sort(targetPorts)
 	assert.Check(t, is.Equal(555, targetPorts[0]))
 	assert.Check(t, is.Equal(1000, targetPorts[1]))
 }