stacklok / toolhive / 26878917294

push

github

Migrate container client to moby/moby modules (#5420)

github.com/docker/docker is deprecated as of Docker v29 (November
2025) and is frozen: it receives no further releases, including fixes
for the daemon-side advisories CVE-2026-33997 and CVE-2026-34040 that
govulncheck currently suppresses for this project. Upstream now ships
the maintained client and API types as the split modules
github.com/moby/moby/client and github.com/moby/moby/api, both of
which ToolHive already requires.

Migrate pkg/container/docker and pkg/container/images off
github.com/docker/docker/{client,api/types,pkg/stdcopy} and
github.com/docker/go-connections/nat onto github.com/moby/moby/client
and github.com/moby/moby/api. The new client exposes a redesigned
surface, so call sites are adapted to the per-operation
Options/Result structs, the client.Filters type, the network.Port
struct (replacing the nat.Port string), and netip.Addr host
addresses, while preserving existing behavior. After this change the
production build no longer imports github.com/docker/docker; it
remains only as an indirect test dependency via testcontainers-go.

Drop the now-dormant govulncheck ignore entries for GO-2026-4883 and
GO-2026-4887. These daemon-side Moby advisories are no longer in
govulncheck's called set once docker/docker is off the production
build, so the suppressions are no longer needed. Also drop the stale
GO-2026-4514 entry: buger/jsonparser is no longer in the module
graph, so that ignore is dead.

Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

68 of 102 new or added lines in 4 files covered. (66.67%)

66400 of 100827 relevant lines covered (65.86%)

61.62 hits per line