chore: vendor

vendor/github.com/docker/cli/opts/capabilities.go

@@ -0,0 +1,89 @@
+package opts
+
+import (
+	"sort"
+	"strings"
+)
+
+const (
+	// AllCapabilities is a special value to add or drop all capabilities
+	AllCapabilities = "ALL"
+
+	// ResetCapabilities is a special value to reset capabilities when updating.
+	// This value should only be used when updating, not used on "create".
+	ResetCapabilities = "RESET"
+)
+
+// NormalizeCapability normalizes a capability by upper-casing, trimming white space
+// and adding a CAP_ prefix (if not yet present). This function also accepts the
+// "ALL" magic-value, as used by CapAdd/CapDrop.
+//
+// This function only handles rudimentary formatting; no validation is performed,
+// as the list of available capabilities can be updated over time, thus should be
+// handled by the daemon.
+func NormalizeCapability(capability string) string {
+	capability = strings.ToUpper(strings.TrimSpace(capability))
+	if capability == AllCapabilities || capability == ResetCapabilities {
+		return capability
+	}
+	if !strings.HasPrefix(capability, "CAP_") {
+		capability = "CAP_" + capability
+	}
+	return capability
+}
+
+// CapabilitiesMap normalizes the given capabilities and converts them to a map.
+func CapabilitiesMap(caps []string) map[string]bool {
+	normalized := make(map[string]bool)
+	for _, c := range caps {
+		normalized[NormalizeCapability(c)] = true
+	}
+	return normalized
+}
+
+// EffectiveCapAddCapDrop normalizes and sorts capabilities to "add" and "drop",
+// and returns the effective capabilities to include in both.
+//
+// "CapAdd" takes precedence over "CapDrop", so capabilities included in both
+// lists are removed from the list of capabilities to drop. The special "ALL"
+// capability is also taken into account.
+//
+// Note that the special "RESET" value is only used when updating an existing
+// service, and will be ignored.
+//
+// Duplicates are removed, and the resulting lists are sorted.
+func EffectiveCapAddCapDrop(add, drop []string) (capAdd, capDrop []string) {
+	var (
+		addCaps  = CapabilitiesMap(add)
+		dropCaps = CapabilitiesMap(drop)
+	)
+
+	if addCaps[AllCapabilities] {
+		// Special case: "ALL capabilities" trumps any other capability added.
+		addCaps = map[string]bool{AllCapabilities: true}
+	}
+	if dropCaps[AllCapabilities] {
+		// Special case: "ALL capabilities" trumps any other capability added.
+		dropCaps = map[string]bool{AllCapabilities: true}
+	}
+	for c := range dropCaps {
+		if addCaps[c] {
+			// Adding a capability takes precedence, so skip dropping
+			continue
+		}
+		if c != ResetCapabilities {
+			capDrop = append(capDrop, c)
+		}
+	}
+
+	for c := range addCaps {
+		if c != ResetCapabilities {
+			capAdd = append(capAdd, c)
+		}
+	}
+
+	sort.Strings(capAdd)
+	sort.Strings(capDrop)
+
+	return capAdd, capDrop
+}

vendor/github.com/docker/cli/opts/config.go

@@ -0,0 +1,100 @@
+package opts
+
+import (
+	"encoding/csv"
+	"errors"
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+
+	swarmtypes "github.com/docker/docker/api/types/swarm"
+)
+
+// ConfigOpt is a Value type for parsing configs
+type ConfigOpt struct {
+	values []*swarmtypes.ConfigReference
+}
+
+// Set a new config value
+func (o *ConfigOpt) Set(value string) error {
+	csvReader := csv.NewReader(strings.NewReader(value))
+	fields, err := csvReader.Read()
+	if err != nil {
+		return err
+	}
+
+	options := &swarmtypes.ConfigReference{
+		File: &swarmtypes.ConfigReferenceFileTarget{
+			UID:  "0",
+			GID:  "0",
+			Mode: 0o444,
+		},
+	}
+
+	// support a simple syntax of --config foo
+	if len(fields) == 1 && !strings.Contains(fields[0], "=") {
+		options.File.Name = fields[0]
+		options.ConfigName = fields[0]
+		o.values = append(o.values, options)
+		return nil
+	}
+
+	for _, field := range fields {
+		key, val, ok := strings.Cut(field, "=")
+		if !ok || key == "" {
+			return fmt.Errorf("invalid field '%s' must be a key=value pair", field)
+		}
+
+		// TODO(thaJeztah): these options should not be case-insensitive.
+		switch strings.ToLower(key) {
+		case "source", "src":
+			options.ConfigName = val
+		case "target":
+			options.File.Name = val
+		case "uid":
+			options.File.UID = val
+		case "gid":
+			options.File.GID = val
+		case "mode":
+			m, err := strconv.ParseUint(val, 0, 32)
+			if err != nil {
+				return fmt.Errorf("invalid mode specified: %v", err)
+			}
+
+			options.File.Mode = os.FileMode(m)
+		default:
+			return fmt.Errorf("invalid field in config request: %s", key)
+		}
+	}
+
+	if options.ConfigName == "" {
+		return errors.New("source is required")
+	}
+	if options.File.Name == "" {
+		options.File.Name = options.ConfigName
+	}
+
+	o.values = append(o.values, options)
+	return nil
+}
+
+// Type returns the type of this option
+func (o *ConfigOpt) Type() string {
+	return "config"
+}
+
+// String returns a string repr of this option
+func (o *ConfigOpt) String() string {
+	configs := []string{}
+	for _, config := range o.values {
+		repr := fmt.Sprintf("%s -> %s", config.ConfigName, config.File.Name)
+		configs = append(configs, repr)
+	}
+	return strings.Join(configs, ", ")
+}
+
+// Value returns the config requests
+func (o *ConfigOpt) Value() []*swarmtypes.ConfigReference {
+	return o.values
+}

vendor/github.com/docker/cli/opts/duration.go

@@ -0,0 +1,64 @@
+package opts
+
+import (
+	"time"
+
+	"github.com/pkg/errors"
+)
+
+// PositiveDurationOpt is an option type for time.Duration that uses a pointer.
+// It behave similarly to DurationOpt but only allows positive duration values.
+type PositiveDurationOpt struct {
+	DurationOpt
+}
+
+// Set a new value on the option. Setting a negative duration value will cause
+// an error to be returned.
+func (d *PositiveDurationOpt) Set(s string) error {
+	err := d.DurationOpt.Set(s)
+	if err != nil {
+		return err
+	}
+	if *d.DurationOpt.value < 0 {
+		return errors.Errorf("duration cannot be negative")
+	}
+	return nil
+}
+
+// DurationOpt is an option type for time.Duration that uses a pointer. This
+// allows us to get nil values outside, instead of defaulting to 0
+type DurationOpt struct {
+	value *time.Duration
+}
+
+// NewDurationOpt creates a DurationOpt with the specified duration
+func NewDurationOpt(value *time.Duration) *DurationOpt {
+	return &DurationOpt{
+		value: value,
+	}
+}
+
+// Set a new value on the option
+func (d *DurationOpt) Set(s string) error {
+	v, err := time.ParseDuration(s)
+	d.value = &v
+	return err
+}
+
+// Type returns the type of this option, which will be displayed in `--help` output
+func (d *DurationOpt) Type() string {
+	return "duration"
+}
+
+// String returns a string repr of this option
+func (d *DurationOpt) String() string {
+	if d.value != nil {
+		return d.value.String()
+	}
+	return ""
+}
+
+// Value returns the time.Duration
+func (d *DurationOpt) Value() *time.Duration {
+	return d.value
+}

vendor/github.com/docker/cli/opts/env.go

@@ -0,0 +1,31 @@
+package opts
+
+import (
+	"os"
+	"strings"
+
+	"github.com/pkg/errors"
+)
+
+// ValidateEnv validates an environment variable and returns it.
+// If no value is specified, it obtains its value from the current environment
+//
+// As on ParseEnvFile and related to #16585, environment variable names
+// are not validated, and it's up to the application inside the container
+// to validate them or not.
+//
+// The only validation here is to check if name is empty, per #25099
+func ValidateEnv(val string) (string, error) {
+	k, _, hasValue := strings.Cut(val, "=")
+	if k == "" {
+		return "", errors.New("invalid environment variable: " + val)
+	}
+	if hasValue {
+		// val contains a "=" (but value may be an empty string)
+		return val, nil
+	}
+	if envVal, ok := os.LookupEnv(k); ok {
+		return k + "=" + envVal, nil
+	}
+	return val, nil
+}

vendor/github.com/docker/cli/opts/envfile.go

@@ -0,0 +1,22 @@
+package opts
+
+import (
+	"os"
+)
+
+// ParseEnvFile reads a file with environment variables enumerated by lines
+//
+// “Environment variable names used by the utilities in the Shell and
+// Utilities volume of IEEE Std 1003.1-2001 consist solely of uppercase
+// letters, digits, and the '_' (underscore) from the characters defined in
+// Portable Character Set and do not begin with a digit. *But*, other
+// characters may be permitted by an implementation; applications shall
+// tolerate the presence of such names.”
+// -- http://pubs.opengroup.org/onlinepubs/009695399/basedefs/xbd_chap08.html
+//
+// As of #16585, it's up to application inside docker to validate or not
+// environment variables, that's why we just strip leading whitespace and
+// nothing more.
+func ParseEnvFile(filename string) ([]string, error) {
+	return parseKeyValueFile(filename, os.LookupEnv)
+}

vendor/github.com/docker/cli/opts/file.go

@@ -0,0 +1,76 @@
+package opts
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"os"
+	"strings"
+	"unicode"
+	"unicode/utf8"
+)
+
+const whiteSpaces = " \t"
+
+// ErrBadKey typed error for bad environment variable
+type ErrBadKey struct {
+	msg string
+}
+
+func (e ErrBadKey) Error() string {
+	return "poorly formatted environment: " + e.msg
+}
+
+func parseKeyValueFile(filename string, emptyFn func(string) (string, bool)) ([]string, error) {
+	fh, err := os.Open(filename)
+	if err != nil {
+		return []string{}, err
+	}
+	defer fh.Close()
+
+	lines := []string{}
+	scanner := bufio.NewScanner(fh)
+	currentLine := 0
+	utf8bom := []byte{0xEF, 0xBB, 0xBF}
+	for scanner.Scan() {
+		scannedBytes := scanner.Bytes()
+		if !utf8.Valid(scannedBytes) {
+			return []string{}, fmt.Errorf("env file %s contains invalid utf8 bytes at line %d: %v", filename, currentLine+1, scannedBytes)
+		}
+		// We trim UTF8 BOM
+		if currentLine == 0 {
+			scannedBytes = bytes.TrimPrefix(scannedBytes, utf8bom)
+		}
+		// trim the line from all leading whitespace first
+		line := strings.TrimLeftFunc(string(scannedBytes), unicode.IsSpace)
+		currentLine++
+		// line is not empty, and not starting with '#'
+		if len(line) > 0 && !strings.HasPrefix(line, "#") {
+			variable, value, hasValue := strings.Cut(line, "=")
+
+			// trim the front of a variable, but nothing else
+			variable = strings.TrimLeft(variable, whiteSpaces)
+			if strings.ContainsAny(variable, whiteSpaces) {
+				return []string{}, ErrBadKey{fmt.Sprintf("variable '%s' contains whitespaces", variable)}
+			}
+			if len(variable) == 0 {
+				return []string{}, ErrBadKey{fmt.Sprintf("no variable name on line '%s'", line)}
+			}
+
+			if hasValue {
+				// pass the value through, no trimming
+				lines = append(lines, variable+"="+value)
+			} else {
+				var present bool
+				if emptyFn != nil {
+					value, present = emptyFn(line)
+				}
+				if present {
+					// if only a pass-through variable is given, clean it up.
+					lines = append(lines, strings.TrimSpace(variable)+"="+value)
+				}
+			}
+		}
+	}
+	return lines, scanner.Err()
+}

vendor/github.com/docker/cli/opts/gpus.go

@@ -0,0 +1,111 @@
+package opts
+
+import (
+	"encoding/csv"
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/docker/docker/api/types/container"
+	"github.com/pkg/errors"
+)
+
+// GpuOpts is a Value type for parsing mounts
+type GpuOpts struct {
+	values []container.DeviceRequest
+}
+
+func parseCount(s string) (int, error) {
+	if s == "all" {
+		return -1, nil
+	}
+	i, err := strconv.Atoi(s)
+	return i, errors.Wrap(err, "count must be an integer")
+}
+
+// Set a new mount value
+//
+//nolint:gocyclo
+func (o *GpuOpts) Set(value string) error {
+	csvReader := csv.NewReader(strings.NewReader(value))
+	fields, err := csvReader.Read()
+	if err != nil {
+		return err
+	}
+
+	req := container.DeviceRequest{}
+
+	seen := map[string]struct{}{}
+	// Set writable as the default
+	for _, field := range fields {
+		key, val, withValue := strings.Cut(field, "=")
+		if _, ok := seen[key]; ok {
+			return fmt.Errorf("gpu request key '%s' can be specified only once", key)
+		}
+		seen[key] = struct{}{}
+
+		if !withValue {
+			seen["count"] = struct{}{}
+			req.Count, err = parseCount(key)
+			if err != nil {
+				return err
+			}
+			continue
+		}
+
+		switch key {
+		case "driver":
+			req.Driver = val
+		case "count":
+			req.Count, err = parseCount(val)
+			if err != nil {
+				return err
+			}
+		case "device":
+			req.DeviceIDs = strings.Split(val, ",")
+		case "capabilities":
+			req.Capabilities = [][]string{append(strings.Split(val, ","), "gpu")}
+		case "options":
+			r := csv.NewReader(strings.NewReader(val))
+			optFields, err := r.Read()
+			if err != nil {
+				return errors.Wrap(err, "failed to read gpu options")
+			}
+			req.Options = ConvertKVStringsToMap(optFields)
+		default:
+			return fmt.Errorf("unexpected key '%s' in '%s'", key, field)
+		}
+	}
+
+	if _, ok := seen["count"]; !ok && req.DeviceIDs == nil {
+		req.Count = 1
+	}
+	if req.Options == nil {
+		req.Options = make(map[string]string)
+	}
+	if req.Capabilities == nil {
+		req.Capabilities = [][]string{{"gpu"}}
+	}
+
+	o.values = append(o.values, req)
+	return nil
+}
+
+// Type returns the type of this option
+func (o *GpuOpts) Type() string {
+	return "gpu-request"
+}
+
+// String returns a string repr of this option
+func (o *GpuOpts) String() string {
+	gpus := []string{}
+	for _, gpu := range o.values {
+		gpus = append(gpus, fmt.Sprintf("%v", gpu))
+	}
+	return strings.Join(gpus, ", ")
+}
+
+// Value returns the mounts
+func (o *GpuOpts) Value() []container.DeviceRequest {
+	return o.values
+}

vendor/github.com/docker/cli/opts/hosts.go

@@ -0,0 +1,213 @@
+package opts
+
+import (
+	"fmt"
+	"net"
+	"net/url"
+	"strconv"
+	"strings"
+)
+
+const (
+	// defaultHTTPPort Default HTTP Port used if only the protocol is provided to -H flag e.g. dockerd -H tcp://
+	// These are the IANA registered port numbers for use with Docker
+	// see http://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=docker
+	defaultHTTPPort = "2375" // Default HTTP Port
+	// defaultTLSHTTPPort Default HTTP Port used when TLS enabled
+	defaultTLSHTTPPort = "2376" // Default TLS encrypted HTTP Port
+	// defaultUnixSocket Path for the unix socket.
+	// Docker daemon by default always listens on the default unix socket
+	defaultUnixSocket = "/var/run/docker.sock"
+	// defaultTCPHost constant defines the default host string used by docker on Windows
+	defaultTCPHost = "tcp://" + defaultHTTPHost + ":" + defaultHTTPPort
+	// DefaultTLSHost constant defines the default host string used by docker for TLS sockets
+	defaultTLSHost = "tcp://" + defaultHTTPHost + ":" + defaultTLSHTTPPort
+	// DefaultNamedPipe defines the default named pipe used by docker on Windows
+	defaultNamedPipe = `//./pipe/docker_engine`
+	// hostGatewayName defines a special string which users can append to --add-host
+	// to add an extra entry in /etc/hosts that maps host.docker.internal to the host IP
+	// TODO Consider moving the hostGatewayName constant defined in docker at
+	// github.com/docker/docker/daemon/network/constants.go outside of the "daemon"
+	// package, so that the CLI can consume it.
+	hostGatewayName = "host-gateway"
+)
+
+// ValidateHost validates that the specified string is a valid host and returns it.
+//
+// TODO(thaJeztah): ValidateHost appears to be unused; deprecate it.
+func ValidateHost(val string) (string, error) {
+	host := strings.TrimSpace(val)
+	// The empty string means default and is not handled by parseDockerDaemonHost
+	if host != "" {
+		_, err := parseDockerDaemonHost(host)
+		if err != nil {
+			return val, err
+		}
+	}
+	// Note: unlike most flag validators, we don't return the mutated value here
+	//       we need to know what the user entered later (using ParseHost) to adjust for TLS
+	return val, nil
+}
+
+// ParseHost and set defaults for a Daemon host string
+func ParseHost(defaultToTLS bool, val string) (string, error) {
+	host := strings.TrimSpace(val)
+	if host == "" {
+		if defaultToTLS {
+			host = defaultTLSHost
+		} else {
+			host = defaultHost
+		}
+	} else {
+		var err error
+		host, err = parseDockerDaemonHost(host)
+		if err != nil {
+			return val, err
+		}
+	}
+	return host, nil
+}
+
+// parseDockerDaemonHost parses the specified address and returns an address that will be used as the host.
+// Depending of the address specified, this may return one of the global Default* strings defined in hosts.go.
+func parseDockerDaemonHost(addr string) (string, error) {
+	proto, host, hasProto := strings.Cut(addr, "://")
+	if !hasProto && proto != "" {
+		host = proto
+		proto = "tcp"
+	}
+
+	switch proto {
+	case "tcp":
+		return ParseTCPAddr(host, defaultTCPHost)
+	case "unix":
+		return parseSimpleProtoAddr(proto, host, defaultUnixSocket)
+	case "npipe":
+		return parseSimpleProtoAddr(proto, host, defaultNamedPipe)
+	case "fd":
+		return addr, nil
+	case "ssh":
+		return addr, nil
+	default:
+		return "", fmt.Errorf("invalid bind address format: %s", addr)
+	}
+}
+
+// parseSimpleProtoAddr parses and validates that the specified address is a valid
+// socket address for simple protocols like unix and npipe. It returns a formatted
+// socket address, either using the address parsed from addr, or the contents of
+// defaultAddr if addr is a blank string.
+func parseSimpleProtoAddr(proto, addr, defaultAddr string) (string, error) {
+	addr = strings.TrimPrefix(addr, proto+"://")
+	if strings.Contains(addr, "://") {
+		return "", fmt.Errorf("invalid proto, expected %s: %s", proto, addr)
+	}
+	if addr == "" {
+		addr = defaultAddr
+	}
+	return fmt.Sprintf("%s://%s", proto, addr), nil
+}
+
+// ParseTCPAddr parses and validates that the specified address is a valid TCP
+// address. It returns a formatted TCP address, either using the address parsed
+// from tryAddr, or the contents of defaultAddr if tryAddr is a blank string.
+// tryAddr is expected to have already been Trim()'d
+// defaultAddr must be in the full `tcp://host:port` form
+func ParseTCPAddr(tryAddr string, defaultAddr string) (string, error) {
+	if tryAddr == "" || tryAddr == "tcp://" {
+		return defaultAddr, nil
+	}
+	addr := strings.TrimPrefix(tryAddr, "tcp://")
+	if strings.Contains(addr, "://") || addr == "" {
+		return "", fmt.Errorf("invalid proto, expected tcp: %s", tryAddr)
+	}
+
+	defaultAddr = strings.TrimPrefix(defaultAddr, "tcp://")
+	defaultHost, defaultPort, err := net.SplitHostPort(defaultAddr)
+	if err != nil {
+		return "", err
+	}
+	// url.Parse fails for trailing colon on IPv6 brackets on Go 1.5, but
+	// not 1.4. See https://github.com/golang/go/issues/12200 and
+	// https://github.com/golang/go/issues/6530.
+	if strings.HasSuffix(addr, "]:") {
+		addr += defaultPort
+	}
+
+	u, err := url.Parse("tcp://" + addr)
+	if err != nil {
+		return "", err
+	}
+	host, port, err := net.SplitHostPort(u.Host)
+	if err != nil {
+		// try port addition once
+		host, port, err = net.SplitHostPort(net.JoinHostPort(u.Host, defaultPort))
+	}
+	if err != nil {
+		return "", fmt.Errorf("invalid bind address format: %s", tryAddr)
+	}
+
+	if host == "" {
+		host = defaultHost
+	}
+	if port == "" {
+		port = defaultPort
+	}
+	p, err := strconv.Atoi(port)
+	if err != nil && p == 0 {
+		return "", fmt.Errorf("invalid bind address format: %s", tryAddr)
+	}
+
+	return fmt.Sprintf("tcp://%s%s", net.JoinHostPort(host, port), u.Path), nil
+}
+
+// ValidateExtraHost validates that the specified string is a valid extrahost and
+// returns it. ExtraHost is in the form of name:ip or name=ip, where the ip has
+// to be a valid ip (IPv4 or IPv6). The address may be enclosed in square
+// brackets.
+//
+// For example:
+//
+//	my-hostname:127.0.0.1
+//	my-hostname:::1
+//	my-hostname=::1
+//	my-hostname:[::1]
+//
+// For compatibility with the API server, this function normalises the given
+// argument to use the ':' separator and strip square brackets enclosing the
+// address.
+func ValidateExtraHost(val string) (string, error) {
+	k, v, ok := strings.Cut(val, "=")
+	if !ok {
+		// allow for IPv6 addresses in extra hosts by only splitting on first ":"
+		k, v, ok = strings.Cut(val, ":")
+	}
+	// Check that a hostname was given, and that it doesn't contain a ":". (Colon
+	// isn't allowed in a hostname, along with many other characters. It's
+	// special-cased here because the API server doesn't know about '=' separators in
+	// '--add-host'. So, it'll split at the first colon and generate a strange error
+	// message.)
+	if !ok || k == "" || strings.Contains(k, ":") {
+		return "", fmt.Errorf("bad format for add-host: %q", val)
+	}
+	// Skip IPaddr validation for "host-gateway" string
+	if v != hostGatewayName {
+		// If the address is enclosed in square brackets, extract it (for IPv6, but
+		// permit it for IPv4 as well; we don't know the address family here, but it's
+		// unambiguous).
+		if len(v) > 2 && v[0] == '[' && v[len(v)-1] == ']' {
+			v = v[1 : len(v)-1]
+		}
+		// ValidateIPAddress returns the address in canonical form (for example,
+		// 0:0:0:0:0:0:0:1 -> ::1). But, stick with the original form, to avoid
+		// surprising a user who's expecting to see the address they supplied in the
+		// output of 'docker inspect' or '/etc/hosts'.
+		if _, err := ValidateIPAddress(v); err != nil {
+			return "", fmt.Errorf("invalid IP address in add-host: %q", v)
+		}
+	}
+	// This result is passed directly to the API, the daemon doesn't accept the '='
+	// separator or an address enclosed in brackets. So, construct something it can
+	// understand.
+	return k + ":" + v, nil
+}

vendor/github.com/docker/cli/opts/hosts_unix.go

@@ -0,0 +1,9 @@
+//go:build !windows
+
+package opts
+
+// defaultHost constant defines the default host string used by docker on other hosts than Windows
+const defaultHost = "unix://" + defaultUnixSocket
+
+// defaultHTTPHost Default HTTP Host used if only port is provided to -H flag e.g. dockerd -H tcp://:8080
+const defaultHTTPHost = "localhost"

vendor/github.com/docker/cli/opts/hosts_windows.go

@@ -0,0 +1,59 @@
+package opts
+
+// defaultHost constant defines the default host string used by docker on Windows
+const defaultHost = "npipe://" + defaultNamedPipe
+
+// TODO Windows. Identify bug in GOLang 1.5.1+ and/or Windows Server 2016 TP5.
+// @jhowardmsft, @swernli.
+//
+// On Windows, this mitigates a problem with the default options of running
+// a docker client against a local docker daemon on TP5.
+//
+// What was found that if the default host is "localhost", even if the client
+// (and daemon as this is local) is not physically on a network, and the DNS
+// cache is flushed (ipconfig /flushdns), then the client will pause for
+// exactly one second when connecting to the daemon for calls. For example
+// using docker run windowsservercore cmd, the CLI will send a create followed
+// by an attach. You see the delay between the attach finishing and the attach
+// being seen by the daemon.
+//
+// Here's some daemon debug logs with additional debug spew put in. The
+// AfterWriteJSON log is the very last thing the daemon does as part of the
+// create call. The POST /attach is the second CLI call. Notice the second
+// time gap.
+//
+// time="2015-11-06T13:38:37.259627400-08:00" level=debug msg="After createRootfs"
+// time="2015-11-06T13:38:37.263626300-08:00" level=debug msg="After setHostConfig"
+// time="2015-11-06T13:38:37.267631200-08:00" level=debug msg="before createContainerPl...."
+// time="2015-11-06T13:38:37.271629500-08:00" level=debug msg=ToDiskLocking....
+// time="2015-11-06T13:38:37.275643200-08:00" level=debug msg="loggin event...."
+// time="2015-11-06T13:38:37.277627600-08:00" level=debug msg="logged event...."
+// time="2015-11-06T13:38:37.279631800-08:00" level=debug msg="In defer func"
+// time="2015-11-06T13:38:37.282628100-08:00" level=debug msg="After daemon.create"
+// time="2015-11-06T13:38:37.286651700-08:00" level=debug msg="return 2"
+// time="2015-11-06T13:38:37.289629500-08:00" level=debug msg="Returned from daemon.ContainerCreate"
+// time="2015-11-06T13:38:37.311629100-08:00" level=debug msg="After WriteJSON"
+// ... 1 second gap here....
+// time="2015-11-06T13:38:38.317866200-08:00" level=debug msg="Calling POST /v1.22/containers/984758282b842f779e805664b2c95d563adc9a979c8a3973e68c807843ee4757/attach"
+// time="2015-11-06T13:38:38.326882500-08:00" level=info msg="POST /v1.22/containers/984758282b842f779e805664b2c95d563adc9a979c8a3973e68c807843ee4757/attach?stderr=1&stdin=1&stdout=1&stream=1"
+//
+// We suspect this is either a bug introduced in GOLang 1.5.1, or that a change
+// in GOLang 1.5.1 (from 1.4.3) is exposing a bug in Windows. In theory,
+// the Windows networking stack is supposed to resolve "localhost" internally,
+// without hitting DNS, or even reading the hosts file (which is why localhost
+// is commented out in the hosts file on Windows).
+//
+// We have validated that working around this using the actual IPv4 localhost
+// address does not cause the delay.
+//
+// This does not occur with the docker client built with 1.4.3 on the same
+// Windows build, regardless of whether the daemon is built using 1.5.1
+// or 1.4.3. It does not occur on Linux. We also verified we see the same thing
+// on a cross-compiled Windows binary (from Linux).
+//
+// Final note: This is a mitigation, not a 'real' fix. It is still susceptible
+// to the delay if a user were to do 'docker run -H=tcp://localhost:2375...'
+// explicitly.
+
+// defaultHTTPHost Default HTTP Host used if only port is provided to -H flag e.g. dockerd -H tcp://:8080
+const defaultHTTPHost = "127.0.0.1"

vendor/github.com/docker/cli/opts/mount.go

@@ -0,0 +1,223 @@
+package opts
+
+import (
+	"encoding/csv"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	mounttypes "github.com/docker/docker/api/types/mount"
+	"github.com/docker/go-units"
+	"github.com/sirupsen/logrus"
+)
+
+// MountOpt is a Value type for parsing mounts
+type MountOpt struct {
+	values []mounttypes.Mount
+}
+
+// Set a new mount value
+//
+//nolint:gocyclo
+func (m *MountOpt) Set(value string) error {
+	csvReader := csv.NewReader(strings.NewReader(value))
+	fields, err := csvReader.Read()
+	if err != nil {
+		return err
+	}
+
+	mount := mounttypes.Mount{}
+
+	volumeOptions := func() *mounttypes.VolumeOptions {
+		if mount.VolumeOptions == nil {
+			mount.VolumeOptions = &mounttypes.VolumeOptions{
+				Labels: make(map[string]string),
+			}
+		}
+		if mount.VolumeOptions.DriverConfig == nil {
+			mount.VolumeOptions.DriverConfig = &mounttypes.Driver{}
+		}
+		return mount.VolumeOptions
+	}
+
+	bindOptions := func() *mounttypes.BindOptions {
+		if mount.BindOptions == nil {
+			mount.BindOptions = new(mounttypes.BindOptions)
+		}
+		return mount.BindOptions
+	}
+
+	tmpfsOptions := func() *mounttypes.TmpfsOptions {
+		if mount.TmpfsOptions == nil {
+			mount.TmpfsOptions = new(mounttypes.TmpfsOptions)
+		}
+		return mount.TmpfsOptions
+	}
+
+	setValueOnMap := func(target map[string]string, value string) {
+		k, v, _ := strings.Cut(value, "=")
+		if k != "" {
+			target[k] = v
+		}
+	}
+
+	mount.Type = mounttypes.TypeVolume // default to volume mounts
+	// Set writable as the default
+	for _, field := range fields {
+		key, val, ok := strings.Cut(field, "=")
+
+		// TODO(thaJeztah): these options should not be case-insensitive.
+		key = strings.ToLower(key)
+
+		if !ok {
+			switch key {
+			case "readonly", "ro":
+				mount.ReadOnly = true
+				continue
+			case "volume-nocopy":
+				volumeOptions().NoCopy = true
+				continue
+			case "bind-nonrecursive":
+				bindOptions().NonRecursive = true
+				continue
+			default:
+				return fmt.Errorf("invalid field '%s' must be a key=value pair", field)
+			}
+		}
+
+		switch key {
+		case "type":
+			mount.Type = mounttypes.Type(strings.ToLower(val))
+		case "source", "src":
+			mount.Source = val
+			if strings.HasPrefix(val, "."+string(filepath.Separator)) || val == "." {
+				if abs, err := filepath.Abs(val); err == nil {
+					mount.Source = abs
+				}
+			}
+		case "target", "dst", "destination":
+			mount.Target = val
+		case "readonly", "ro":
+			mount.ReadOnly, err = strconv.ParseBool(val)
+			if err != nil {
+				return fmt.Errorf("invalid value for %s: %s", key, val)
+			}
+		case "consistency":
+			mount.Consistency = mounttypes.Consistency(strings.ToLower(val))
+		case "bind-propagation":
+			bindOptions().Propagation = mounttypes.Propagation(strings.ToLower(val))
+		case "bind-nonrecursive":
+			bindOptions().NonRecursive, err = strconv.ParseBool(val)
+			if err != nil {
+				return fmt.Errorf("invalid value for %s: %s", key, val)
+			}
+			logrus.Warn("bind-nonrecursive is deprecated, use bind-recursive=disabled instead")
+		case "bind-recursive":
+			switch val {
+			case "enabled": // read-only mounts are recursively read-only if Engine >= v25 && kernel >= v5.12, otherwise writable
+				// NOP
+			case "disabled": // alias of bind-nonrecursive=true
+				bindOptions().NonRecursive = true
+			case "writable": // conforms to the default read-only bind-mount of Docker v24; read-only mounts are recursively mounted but not recursively read-only
+				bindOptions().ReadOnlyNonRecursive = true
+			case "readonly": // force recursively read-only, or raise an error
+				bindOptions().ReadOnlyForceRecursive = true
+				// TODO: implicitly set propagation and error if the user specifies a propagation in a future refactor/UX polish pass
+				// https://github.com/docker/cli/pull/4316#discussion_r1341974730
+			default:
+				return fmt.Errorf("invalid value for %s: %s (must be \"enabled\", \"disabled\", \"writable\", or \"readonly\")",
+					key, val)
+			}
+		case "volume-subpath":
+			volumeOptions().Subpath = val
+		case "volume-nocopy":
+			volumeOptions().NoCopy, err = strconv.ParseBool(val)
+			if err != nil {
+				return fmt.Errorf("invalid value for volume-nocopy: %s", val)
+			}
+		case "volume-label":
+			setValueOnMap(volumeOptions().Labels, val)
+		case "volume-driver":
+			volumeOptions().DriverConfig.Name = val
+		case "volume-opt":
+			if volumeOptions().DriverConfig.Options == nil {
+				volumeOptions().DriverConfig.Options = make(map[string]string)
+			}
+			setValueOnMap(volumeOptions().DriverConfig.Options, val)
+		case "tmpfs-size":
+			sizeBytes, err := units.RAMInBytes(val)
+			if err != nil {
+				return fmt.Errorf("invalid value for %s: %s", key, val)
+			}
+			tmpfsOptions().SizeBytes = sizeBytes
+		case "tmpfs-mode":
+			ui64, err := strconv.ParseUint(val, 8, 32)
+			if err != nil {
+				return fmt.Errorf("invalid value for %s: %s", key, val)
+			}
+			tmpfsOptions().Mode = os.FileMode(ui64)
+		default:
+			return fmt.Errorf("unexpected key '%s' in '%s'", key, field)
+		}
+	}
+
+	if mount.Type == "" {
+		return errors.New("type is required")
+	}
+
+	if mount.Target == "" {
+		return errors.New("target is required")
+	}
+
+	if mount.VolumeOptions != nil && mount.Type != mounttypes.TypeVolume {
+		return fmt.Errorf("cannot mix 'volume-*' options with mount type '%s'", mount.Type)
+	}
+	if mount.BindOptions != nil && mount.Type != mounttypes.TypeBind {
+		return fmt.Errorf("cannot mix 'bind-*' options with mount type '%s'", mount.Type)
+	}
+	if mount.TmpfsOptions != nil && mount.Type != mounttypes.TypeTmpfs {
+		return fmt.Errorf("cannot mix 'tmpfs-*' options with mount type '%s'", mount.Type)
+	}
+
+	if mount.BindOptions != nil {
+		if mount.BindOptions.ReadOnlyNonRecursive {
+			if !mount.ReadOnly {
+				return errors.New("option 'bind-recursive=writable' requires 'readonly' to be specified in conjunction")
+			}
+		}
+		if mount.BindOptions.ReadOnlyForceRecursive {
+			if !mount.ReadOnly {
+				return errors.New("option 'bind-recursive=readonly' requires 'readonly' to be specified in conjunction")
+			}
+			if mount.BindOptions.Propagation != mounttypes.PropagationRPrivate {
+				return errors.New("option 'bind-recursive=readonly' requires 'bind-propagation=rprivate' to be specified in conjunction")
+			}
+		}
+	}
+
+	m.values = append(m.values, mount)
+	return nil
+}
+
+// Type returns the type of this option
+func (m *MountOpt) Type() string {
+	return "mount"
+}
+
+// String returns a string repr of this option
+func (m *MountOpt) String() string {
+	mounts := []string{}
+	for _, mount := range m.values {
+		repr := fmt.Sprintf("%s %s %s", mount.Type, mount.Source, mount.Target)
+		mounts = append(mounts, repr)
+	}
+	return strings.Join(mounts, ", ")
+}
+
+// Value returns the mounts
+func (m *MountOpt) Value() []mounttypes.Mount {
+	return m.values
+}

vendor/github.com/docker/cli/opts/network.go

@@ -0,0 +1,135 @@
+package opts
+
+import (
+	"encoding/csv"
+	"errors"
+	"fmt"
+	"regexp"
+	"strings"
+)
+
+const (
+	networkOptName        = "name"
+	networkOptAlias       = "alias"
+	networkOptIPv4Address = "ip"
+	networkOptIPv6Address = "ip6"
+	networkOptMacAddress  = "mac-address"
+	networkOptLinkLocalIP = "link-local-ip"
+	driverOpt             = "driver-opt"
+)
+
+// NetworkAttachmentOpts represents the network options for endpoint creation
+type NetworkAttachmentOpts struct {
+	Target       string
+	Aliases      []string
+	DriverOpts   map[string]string
+	Links        []string // TODO add support for links in the csv notation of `--network`
+	IPv4Address  string
+	IPv6Address  string
+	LinkLocalIPs []string
+	MacAddress   string
+}
+
+// NetworkOpt represents a network config in swarm mode.
+type NetworkOpt struct {
+	options []NetworkAttachmentOpts
+}
+
+// Set networkopts value
+func (n *NetworkOpt) Set(value string) error { //nolint:gocyclo
+	longSyntax, err := regexp.MatchString(`\w+=\w+(,\w+=\w+)*`, value)
+	if err != nil {
+		return err
+	}
+
+	var netOpt NetworkAttachmentOpts
+	if longSyntax {
+		csvReader := csv.NewReader(strings.NewReader(value))
+		fields, err := csvReader.Read()
+		if err != nil {
+			return err
+		}
+
+		netOpt.Aliases = []string{}
+		for _, field := range fields {
+			// TODO(thaJeztah): these options should not be case-insensitive.
+			key, val, ok := strings.Cut(strings.ToLower(field), "=")
+			if !ok || key == "" {
+				return fmt.Errorf("invalid field %s", field)
+			}
+
+			key = strings.TrimSpace(key)
+			val = strings.TrimSpace(val)
+
+			switch key {
+			case networkOptName:
+				netOpt.Target = val
+			case networkOptAlias:
+				netOpt.Aliases = append(netOpt.Aliases, val)
+			case networkOptIPv4Address:
+				netOpt.IPv4Address = val
+			case networkOptIPv6Address:
+				netOpt.IPv6Address = val
+			case networkOptMacAddress:
+				netOpt.MacAddress = val
+			case networkOptLinkLocalIP:
+				netOpt.LinkLocalIPs = append(netOpt.LinkLocalIPs, val)
+			case driverOpt:
+				key, val, err = parseDriverOpt(val)
+				if err != nil {
+					return err
+				}
+				if netOpt.DriverOpts == nil {
+					netOpt.DriverOpts = make(map[string]string)
+				}
+				netOpt.DriverOpts[key] = val
+			default:
+				return errors.New("invalid field key " + key)
+			}
+		}
+		if len(netOpt.Target) == 0 {
+			return errors.New("network name/id is not specified")
+		}
+	} else {
+		netOpt.Target = value
+	}
+	n.options = append(n.options, netOpt)
+	return nil
+}
+
+// Type returns the type of this option
+func (n *NetworkOpt) Type() string {
+	return "network"
+}
+
+// Value returns the networkopts
+func (n *NetworkOpt) Value() []NetworkAttachmentOpts {
+	return n.options
+}
+
+// String returns the network opts as a string
+func (n *NetworkOpt) String() string {
+	return ""
+}
+
+// NetworkMode return the network mode for the network option
+func (n *NetworkOpt) NetworkMode() string {
+	networkIDOrName := "default"
+	netOptVal := n.Value()
+	if len(netOptVal) > 0 {
+		networkIDOrName = netOptVal[0].Target
+	}
+	return networkIDOrName
+}
+
+func parseDriverOpt(driverOpt string) (string, string, error) {
+	// TODO(thaJeztah): these options should not be case-insensitive.
+	// TODO(thaJeztah): should value be converted to lowercase as well, or only the key?
+	key, value, ok := strings.Cut(strings.ToLower(driverOpt), "=")
+	if !ok || key == "" {
+		return "", "", errors.New("invalid key value pair format in driver options")
+	}
+	key = strings.TrimSpace(key)
+	value = strings.TrimSpace(value)
+	return key, value, nil
+}

vendor/github.com/docker/cli/opts/opts.go

@@ -0,0 +1,517 @@
+package opts
+
+import (
+	"fmt"
+	"math/big"
+	"net"
+	"path"
+	"regexp"
+	"strings"
+
+	"github.com/docker/docker/api/types/filters"
+	units "github.com/docker/go-units"
+	"github.com/pkg/errors"
+)
+
+var (
+	alphaRegexp  = regexp.MustCompile(`[a-zA-Z]`)
+	domainRegexp = regexp.MustCompile(`^(:?(:?[a-zA-Z0-9]|(:?[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9]))(:?\.(:?[a-zA-Z0-9]|(:?[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])))*)\.?\s*$`)
+)
+
+// ListOpts holds a list of values and a validation function.
+type ListOpts struct {
+	values    *[]string
+	validator ValidatorFctType
+}
+
+// NewListOpts creates a new ListOpts with the specified validator.
+func NewListOpts(validator ValidatorFctType) ListOpts {
+	var values []string
+	return *NewListOptsRef(&values, validator)
+}
+
+// NewListOptsRef creates a new ListOpts with the specified values and validator.
+func NewListOptsRef(values *[]string, validator ValidatorFctType) *ListOpts {
+	return &ListOpts{
+		values:    values,
+		validator: validator,
+	}
+}
+
+func (opts *ListOpts) String() string {
+	if len(*opts.values) == 0 {
+		return ""
+	}
+	return fmt.Sprintf("%v", *opts.values)
+}
+
+// Set validates if needed the input value and adds it to the
+// internal slice.
+func (opts *ListOpts) Set(value string) error {
+	if opts.validator != nil {
+		v, err := opts.validator(value)
+		if err != nil {
+			return err
+		}
+		value = v
+	}
+	*opts.values = append(*opts.values, value)
+	return nil
+}
+
+// Delete removes the specified element from the slice.
+func (opts *ListOpts) Delete(key string) {
+	for i, k := range *opts.values {
+		if k == key {
+			*opts.values = append((*opts.values)[:i], (*opts.values)[i+1:]...)
+			return
+		}
+	}
+}
+
+// GetMap returns the content of values in a map in order to avoid
+// duplicates.
+func (opts *ListOpts) GetMap() map[string]struct{} {
+	ret := make(map[string]struct{})
+	for _, k := range *opts.values {
+		ret[k] = struct{}{}
+	}
+	return ret
+}
+
+// GetAll returns the values of slice.
+func (opts *ListOpts) GetAll() []string {
+	return *opts.values
+}
+
+// GetAllOrEmpty returns the values of the slice
+// or an empty slice when there are no values.
+func (opts *ListOpts) GetAllOrEmpty() []string {
+	v := *opts.values
+	if v == nil {
+		return make([]string, 0)
+	}
+	return v
+}
+
+// Get checks the existence of the specified key.
+func (opts *ListOpts) Get(key string) bool {
+	for _, k := range *opts.values {
+		if k == key {
+			return true
+		}
+	}
+	return false
+}
+
+// Len returns the amount of element in the slice.
+func (opts *ListOpts) Len() int {
+	return len(*opts.values)
+}
+
+// Type returns a string name for this Option type
+func (opts *ListOpts) Type() string {
+	return "list"
+}
+
+// WithValidator returns the ListOpts with validator set.
+func (opts *ListOpts) WithValidator(validator ValidatorFctType) *ListOpts {
+	opts.validator = validator
+	return opts
+}
+
+// NamedOption is an interface that list and map options
+// with names implement.
+type NamedOption interface {
+	Name() string
+}
+
+// NamedListOpts is a ListOpts with a configuration name.
+// This struct is useful to keep reference to the assigned
+// field name in the internal configuration struct.
+type NamedListOpts struct {
+	name string
+	ListOpts
+}
+
+var _ NamedOption = &NamedListOpts{}
+
+// NewNamedListOptsRef creates a reference to a new NamedListOpts struct.
+func NewNamedListOptsRef(name string, values *[]string, validator ValidatorFctType) *NamedListOpts {
+	return &NamedListOpts{
+		name:     name,
+		ListOpts: *NewListOptsRef(values, validator),
+	}
+}
+
+// Name returns the name of the NamedListOpts in the configuration.
+func (o *NamedListOpts) Name() string {
+	return o.name
+}
+
+// MapOpts holds a map of values and a validation function.
+type MapOpts struct {
+	values    map[string]string
+	validator ValidatorFctType
+}
+
+// Set validates if needed the input value and add it to the
+// internal map, by splitting on '='.
+func (opts *MapOpts) Set(value string) error {
+	if opts.validator != nil {
+		v, err := opts.validator(value)
+		if err != nil {
+			return err
+		}
+		value = v
+	}
+	k, v, _ := strings.Cut(value, "=")
+	opts.values[k] = v
+	return nil
+}
+
+// GetAll returns the values of MapOpts as a map.
+func (opts *MapOpts) GetAll() map[string]string {
+	return opts.values
+}
+
+func (opts *MapOpts) String() string {
+	return fmt.Sprintf("%v", opts.values)
+}
+
+// Type returns a string name for this Option type
+func (opts *MapOpts) Type() string {
+	return "map"
+}
+
+// NewMapOpts creates a new MapOpts with the specified map of values and a validator.
+func NewMapOpts(values map[string]string, validator ValidatorFctType) *MapOpts {
+	if values == nil {
+		values = make(map[string]string)
+	}
+	return &MapOpts{
+		values:    values,
+		validator: validator,
+	}
+}
+
+// NamedMapOpts is a MapOpts struct with a configuration name.
+// This struct is useful to keep reference to the assigned
+// field name in the internal configuration struct.
+type NamedMapOpts struct {
+	name string
+	MapOpts
+}
+
+var _ NamedOption = &NamedMapOpts{}
+
+// NewNamedMapOpts creates a reference to a new NamedMapOpts struct.
+func NewNamedMapOpts(name string, values map[string]string, validator ValidatorFctType) *NamedMapOpts {
+	return &NamedMapOpts{
+		name:    name,
+		MapOpts: *NewMapOpts(values, validator),
+	}
+}
+
+// Name returns the name of the NamedMapOpts in the configuration.
+func (o *NamedMapOpts) Name() string {
+	return o.name
+}
+
+// ValidatorFctType defines a validator function that returns a validated string and/or an error.
+type ValidatorFctType func(val string) (string, error)
+
+// ValidatorFctListType defines a validator function that returns a validated list of string and/or an error
+type ValidatorFctListType func(val string) ([]string, error)
+
+// ValidateIPAddress validates if the given value is a correctly formatted
+// IP address, and returns the value in normalized form. Leading and trailing
+// whitespace is allowed, but it does not allow IPv6 addresses surrounded by
+// square brackets ("[::1]").
+//
+// Refer to [net.ParseIP] for accepted formats.
+func ValidateIPAddress(val string) (string, error) {
+	if ip := net.ParseIP(strings.TrimSpace(val)); ip != nil {
+		return ip.String(), nil
+	}
+	return "", fmt.Errorf("IP address is not correctly formatted: %s", val)
+}
+
+// ValidateMACAddress validates a MAC address.
+func ValidateMACAddress(val string) (string, error) {
+	_, err := net.ParseMAC(strings.TrimSpace(val))
+	if err != nil {
+		return "", err
+	}
+	return val, nil
+}
+
+// ValidateDNSSearch validates domain for resolvconf search configuration.
+// A zero length domain is represented by a dot (.).
+func ValidateDNSSearch(val string) (string, error) {
+	if val = strings.Trim(val, " "); val == "." {
+		return val, nil
+	}
+	return validateDomain(val)
+}
+
+func validateDomain(val string) (string, error) {
+	if alphaRegexp.FindString(val) == "" {
+		return "", fmt.Errorf("%s is not a valid domain", val)
+	}
+	ns := domainRegexp.FindSubmatch([]byte(val))
+	if len(ns) > 0 && len(ns[1]) < 255 {
+		return string(ns[1]), nil
+	}
+	return "", fmt.Errorf("%s is not a valid domain", val)
+}
+
+// ValidateLabel validates that the specified string is a valid label, and returns it.
+//
+// Labels are in the form of key=value; key must be a non-empty string, and not
+// contain whitespaces. A value is optional (defaults to an empty string if omitted).
+//
+// Leading whitespace is removed during validation but values are kept as-is
+// otherwise, so any string value is accepted for both, which includes whitespace
+// (for values) and quotes (surrounding, or embedded in key or value).
+//
+// TODO discuss if quotes (and other special characters) should be valid or invalid for keys
+// TODO discuss if leading/trailing whitespace in keys should be preserved (and valid)
+func ValidateLabel(value string) (string, error) {
+	key, _, _ := strings.Cut(value, "=")
+	key = strings.TrimLeft(key, whiteSpaces)
+	if key == "" {
+		return "", fmt.Errorf("invalid label '%s': empty name", value)
+	}
+	if strings.ContainsAny(key, whiteSpaces) {
+		return "", fmt.Errorf("label '%s' contains whitespaces", key)
+	}
+	return value, nil
+}
+
+// ValidateSysctl validates a sysctl and returns it.
+func ValidateSysctl(val string) (string, error) {
+	validSysctlMap := map[string]bool{
+		"kernel.msgmax":          true,
+		"kernel.msgmnb":          true,
+		"kernel.msgmni":          true,
+		"kernel.sem":             true,
+		"kernel.shmall":          true,
+		"kernel.shmmax":          true,
+		"kernel.shmmni":          true,
+		"kernel.shm_rmid_forced": true,
+	}
+	validSysctlPrefixes := []string{
+		"net.",
+		"fs.mqueue.",
+	}
+	k, _, ok := strings.Cut(val, "=")
+	if !ok || k == "" {
+		return "", fmt.Errorf("sysctl '%s' is not allowed", val)
+	}
+	if validSysctlMap[k] {
+		return val, nil
+	}
+	for _, vp := range validSysctlPrefixes {
+		if strings.HasPrefix(k, vp) {
+			return val, nil
+		}
+	}
+	return "", fmt.Errorf("sysctl '%s' is not allowed", val)
+}
+
+// FilterOpt is a flag type for validating filters
+type FilterOpt struct {
+	filter filters.Args
+}
+
+// NewFilterOpt returns a new FilterOpt
+func NewFilterOpt() FilterOpt {
+	return FilterOpt{filter: filters.NewArgs()}
+}
+
+func (o *FilterOpt) String() string {
+	repr, err := filters.ToJSON(o.filter)
+	if err != nil {
+		return "invalid filters"
+	}
+	return repr
+}
+
+// Set sets the value of the opt by parsing the command line value
+func (o *FilterOpt) Set(value string) error {
+	if value == "" {
+		return nil
+	}
+	if !strings.Contains(value, "=") {
+		return errors.New("bad format of filter (expected name=value)")
+	}
+	name, val, _ := strings.Cut(value, "=")
+
+	// TODO(thaJeztah): these options should not be case-insensitive.
+	name = strings.ToLower(strings.TrimSpace(name))
+	val = strings.TrimSpace(val)
+	o.filter.Add(name, val)
+	return nil
+}
+
+// Type returns the option type
+func (o *FilterOpt) Type() string {
+	return "filter"
+}
+
+// Value returns the value of this option
+func (o *FilterOpt) Value() filters.Args {
+	return o.filter
+}
+
+// NanoCPUs is a type for fixed point fractional number.
+type NanoCPUs int64
+
+// String returns the string format of the number
+func (c *NanoCPUs) String() string {
+	if *c == 0 {
+		return ""
+	}
+	return big.NewRat(c.Value(), 1e9).FloatString(3)
+}
+
+// Set sets the value of the NanoCPU by passing a string
+func (c *NanoCPUs) Set(value string) error {
+	cpus, err := ParseCPUs(value)
+	*c = NanoCPUs(cpus)
+	return err
+}
+
+// Type returns the type
+func (c *NanoCPUs) Type() string {
+	return "decimal"
+}
+
+// Value returns the value in int64
+func (c *NanoCPUs) Value() int64 {
+	return int64(*c)
+}
+
+// ParseCPUs takes a string ratio and returns an integer value of nano cpus
+func ParseCPUs(value string) (int64, error) {
+	cpu, ok := new(big.Rat).SetString(value)
+	if !ok {
+		return 0, fmt.Errorf("failed to parse %v as a rational number", value)
+	}
+	nano := cpu.Mul(cpu, big.NewRat(1e9, 1))
+	if !nano.IsInt() {
+		return 0, errors.New("value is too precise")
+	}
+	return nano.Num().Int64(), nil
+}
+
+// ParseLink parses and validates the specified string as a link format (name:alias)
+func ParseLink(val string) (string, string, error) {
+	if val == "" {
+		return "", "", errors.New("empty string specified for links")
+	}
+	// We expect two parts, but restrict to three to allow detecting invalid formats.
+	arr := strings.SplitN(val, ":", 3)
+
+	// TODO(thaJeztah): clean up this logic!!
+	if len(arr) > 2 {
+		return "", "", errors.New("bad format for links: " + val)
+	}
+	// TODO(thaJeztah): this should trim the "/" prefix as well??
+	if len(arr) == 1 {
+		return val, val, nil
+	}
+	// This is kept because we can actually get a HostConfig with links
+	// from an already created container and the format is not `foo:bar`
+	// but `/foo:/c1/bar`
+	if strings.HasPrefix(arr[0], "/") {
+		// TODO(thaJeztah): clean up this logic!!
+		_, alias := path.Split(arr[1])
+		return arr[0][1:], alias, nil
+	}
+	return arr[0], arr[1], nil
+}
+
+// ValidateLink validates that the specified string has a valid link format (containerName:alias).
+func ValidateLink(val string) (string, error) {
+	_, _, err := ParseLink(val)
+	return val, err
+}
+
+// MemBytes is a type for human readable memory bytes (like 128M, 2g, etc)
+type MemBytes int64
+
+// String returns the string format of the human readable memory bytes
+func (m *MemBytes) String() string {
+	// NOTE: In spf13/pflag/flag.go, "0" is considered as "zero value" while "0 B" is not.
+	// We return "0" in case value is 0 here so that the default value is hidden.
+	// (Sometimes "default 0 B" is actually misleading)
+	if m.Value() != 0 {
+		return units.BytesSize(float64(m.Value()))
+	}
+	return "0"
+}
+
+// Set sets the value of the MemBytes by passing a string
+func (m *MemBytes) Set(value string) error {
+	val, err := units.RAMInBytes(value)
+	*m = MemBytes(val)
+	return err
+}
+
+// Type returns the type
+func (m *MemBytes) Type() string {
+	return "bytes"
+}
+
+// Value returns the value in int64
+func (m *MemBytes) Value() int64 {
+	return int64(*m)
+}
+
+// UnmarshalJSON is the customized unmarshaler for MemBytes
+func (m *MemBytes) UnmarshalJSON(s []byte) error {
+	if len(s) <= 2 || s[0] != '"' || s[len(s)-1] != '"' {
+		return fmt.Errorf("invalid size: %q", s)
+	}
+	val, err := units.RAMInBytes(string(s[1 : len(s)-1]))
+	*m = MemBytes(val)
+	return err
+}
+
+// MemSwapBytes is a type for human readable memory bytes (like 128M, 2g, etc).
+// It differs from MemBytes in that -1 is valid and the default.
+type MemSwapBytes int64
+
+// Set sets the value of the MemSwapBytes by passing a string
+func (m *MemSwapBytes) Set(value string) error {
+	if value == "-1" {
+		*m = MemSwapBytes(-1)
+		return nil
+	}
+	val, err := units.RAMInBytes(value)
+	*m = MemSwapBytes(val)
+	return err
+}
+
+// Type returns the type
+func (m *MemSwapBytes) Type() string {
+	return "bytes"
+}
+
+// Value returns the value in int64
+func (m *MemSwapBytes) Value() int64 {
+	return int64(*m)
+}
+
+func (m *MemSwapBytes) String() string {
+	b := MemBytes(*m)
+	return b.String()
+}
+
+// UnmarshalJSON is the customized unmarshaler for MemSwapBytes
+func (m *MemSwapBytes) UnmarshalJSON(s []byte) error {
+	b := MemBytes(*m)
+	return b.UnmarshalJSON(s)
+}

vendor/github.com/docker/cli/opts/parse.go

@@ -0,0 +1,96 @@
+package opts
+
+import (
+	"errors"
+	"os"
+	"strconv"
+	"strings"
+
+	"github.com/docker/docker/api/types/container"
+)
+
+// ReadKVStrings reads a file of line terminated key=value pairs, and overrides any keys
+// present in the file with additional pairs specified in the override parameter
+func ReadKVStrings(files []string, override []string) ([]string, error) {
+	return readKVStrings(files, override, nil)
+}
+
+// ReadKVEnvStrings reads a file of line terminated key=value pairs, and overrides any keys
+// present in the file with additional pairs specified in the override parameter.
+// If a key has no value, it will get the value from the environment.
+func ReadKVEnvStrings(files []string, override []string) ([]string, error) {
+	return readKVStrings(files, override, os.LookupEnv)
+}
+
+func readKVStrings(files []string, override []string, emptyFn func(string) (string, bool)) ([]string, error) {
+	var variables []string
+	for _, ef := range files {
+		parsedVars, err := parseKeyValueFile(ef, emptyFn)
+		if err != nil {
+			return nil, err
+		}
+		variables = append(variables, parsedVars...)
+	}
+	// parse the '-e' and '--env' after, to allow override
+	variables = append(variables, override...)
+
+	return variables, nil
+}
+
+// ConvertKVStringsToMap converts ["key=value"] to {"key":"value"}
+func ConvertKVStringsToMap(values []string) map[string]string {
+	result := make(map[string]string, len(values))
+	for _, value := range values {
+		k, v, _ := strings.Cut(value, "=")
+		result[k] = v
+	}
+
+	return result
+}
+
+// ConvertKVStringsToMapWithNil converts ["key=value"] to {"key":"value"}
+// but set unset keys to nil - meaning the ones with no "=" in them.
+// We use this in cases where we need to distinguish between
+//
+//	FOO=  and FOO
+//
+// where the latter case just means FOO was mentioned but not given a value
+func ConvertKVStringsToMapWithNil(values []string) map[string]*string {
+	result := make(map[string]*string, len(values))
+	for _, value := range values {
+		k, v, ok := strings.Cut(value, "=")
+		if !ok {
+			result[k] = nil
+		} else {
+			result[k] = &v
+		}
+	}
+
+	return result
+}
+
+// ParseRestartPolicy returns the parsed policy or an error indicating what is incorrect
+func ParseRestartPolicy(policy string) (container.RestartPolicy, error) {
+	if policy == "" {
+		// for backward-compatibility, we don't set the default ("no")
+		// policy here, because older versions of the engine may not
+		// support it.
+		return container.RestartPolicy{}, nil
+	}
+
+	p := container.RestartPolicy{}
+	k, v, ok := strings.Cut(policy, ":")
+	if ok && k == "" {
+		return container.RestartPolicy{}, errors.New("invalid restart policy format: no policy provided before colon")
+	}
+	if v != "" {
+		count, err := strconv.Atoi(v)
+		if err != nil {
+			return container.RestartPolicy{}, errors.New("invalid restart policy format: maximum retry count must be an integer")
+		}
+		p.MaximumRetryCount = count
+	}
+
+	p.Name = container.RestartPolicyMode(k)
+	return p, nil
+}

vendor/github.com/docker/cli/opts/port.go

@@ -0,0 +1,172 @@
+package opts
+
+import (
+	"encoding/csv"
+	"errors"
+	"fmt"
+	"net"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"github.com/docker/docker/api/types/swarm"
+	"github.com/docker/go-connections/nat"
+	"github.com/sirupsen/logrus"
+)
+
+const (
+	portOptTargetPort    = "target"
+	portOptPublishedPort = "published"
+	portOptProtocol      = "protocol"
+	portOptMode          = "mode"
+)
+
+// PortOpt represents a port config in swarm mode.
+type PortOpt struct {
+	ports []swarm.PortConfig
+}
+
+// Set a new port value
+//
+//nolint:gocyclo
+func (p *PortOpt) Set(value string) error {
+	longSyntax, err := regexp.MatchString(`\w+=\w+(,\w+=\w+)*`, value)
+	if err != nil {
+		return err
+	}
+	if longSyntax {
+		csvReader := csv.NewReader(strings.NewReader(value))
+		fields, err := csvReader.Read()
+		if err != nil {
+			return err
+		}
+
+		pConfig := swarm.PortConfig{}
+		for _, field := range fields {
+			// TODO(thaJeztah): these options should not be case-insensitive.
+			key, val, ok := strings.Cut(strings.ToLower(field), "=")
+			if !ok || key == "" {
+				return fmt.Errorf("invalid field %s", field)
+			}
+			switch key {
+			case portOptProtocol:
+				if val != string(swarm.PortConfigProtocolTCP) && val != string(swarm.PortConfigProtocolUDP) && val != string(swarm.PortConfigProtocolSCTP) {
+					return fmt.Errorf("invalid protocol value %s", val)
+				}
+
+				pConfig.Protocol = swarm.PortConfigProtocol(val)
+			case portOptMode:
+				if val != string(swarm.PortConfigPublishModeIngress) && val != string(swarm.PortConfigPublishModeHost) {
+					return fmt.Errorf("invalid publish mode value %s", val)
+				}
+
+				pConfig.PublishMode = swarm.PortConfigPublishMode(val)
+			case portOptTargetPort:
+				tPort, err := strconv.ParseUint(val, 10, 16)
+				if err != nil {
+					return err
+				}
+
+				pConfig.TargetPort = uint32(tPort)
+			case portOptPublishedPort:
+				pPort, err := strconv.ParseUint(val, 10, 16)
+				if err != nil {
+					return err
+				}
+
+				pConfig.PublishedPort = uint32(pPort)
+			default:
+				return fmt.Errorf("invalid field key %s", key)
+			}
+		}
+
+		if pConfig.TargetPort == 0 {
+			return fmt.Errorf("missing mandatory field %q", portOptTargetPort)
+		}
+
+		if pConfig.PublishMode == "" {
+			pConfig.PublishMode = swarm.PortConfigPublishModeIngress
+		}
+
+		if pConfig.Protocol == "" {
+			pConfig.Protocol = swarm.PortConfigProtocolTCP
+		}
+
+		p.ports = append(p.ports, pConfig)
+	} else {
+		// short syntax
+		portConfigs := []swarm.PortConfig{}
+		ports, portBindingMap, err := nat.ParsePortSpecs([]string{value})
+		if err != nil {
+			return err
+		}
+		for _, portBindings := range portBindingMap {
+			for _, portBinding := range portBindings {
+				if portBinding.HostIP != "" {
+					return errors.New("hostip is not supported")
+				}
+			}
+		}
+
+		for port := range ports {
+			portConfig, err := ConvertPortToPortConfig(port, portBindingMap)
+			if err != nil {
+				return err
+			}
+			portConfigs = append(portConfigs, portConfig...)
+		}
+		p.ports = append(p.ports, portConfigs...)
+	}
+	return nil
+}
+
+// Type returns the type of this option
+func (p *PortOpt) Type() string {
+	return "port"
+}
+
+// String returns a string repr of this option
+func (p *PortOpt) String() string {
+	ports := []string{}
+	for _, port := range p.ports {
+		repr := fmt.Sprintf("%v:%v/%s/%s", port.PublishedPort, port.TargetPort, port.Protocol, port.PublishMode)
+		ports = append(ports, repr)
+	}
+	return strings.Join(ports, ", ")
+}
+
+// Value returns the ports
+func (p *PortOpt) Value() []swarm.PortConfig {
+	return p.ports
+}
+
+// ConvertPortToPortConfig converts ports to the swarm type
+func ConvertPortToPortConfig(
+	port nat.Port,
+	portBindings map[nat.Port][]nat.PortBinding,
+) ([]swarm.PortConfig, error) {
+	ports := []swarm.PortConfig{}
+
+	for _, binding := range portBindings[port] {
+		if p := net.ParseIP(binding.HostIP); p != nil && !p.IsUnspecified() {
+			logrus.Warnf("ignoring IP-address (%s:%s) service will listen on '0.0.0.0'", net.JoinHostPort(binding.HostIP, binding.HostPort), port)
+		}
+
+		startHostPort, endHostPort, err := nat.ParsePortRange(binding.HostPort)
+
+		if err != nil && binding.HostPort != "" {
+			return nil, fmt.Errorf("invalid hostport binding (%s) for port (%s)", binding.HostPort, port.Port())
+		}
+
+		for i := startHostPort; i <= endHostPort; i++ {
+			ports = append(ports, swarm.PortConfig{
+				// TODO Name: ?
+				Protocol:      swarm.PortConfigProtocol(strings.ToLower(port.Proto())),
+				TargetPort:    uint32(port.Int()),
+				PublishedPort: uint32(i),
+				PublishMode:   swarm.PortConfigPublishModeIngress,
+			})
+		}
+	}
+	return ports, nil
+}

vendor/github.com/docker/cli/opts/quotedstring.go

@@ -0,0 +1,40 @@
+package opts
+
+// QuotedString is a string that may have extra quotes around the value. The
+// quotes are stripped from the value.
+type QuotedString struct {
+	value *string
+}
+
+// Set sets a new value
+func (s *QuotedString) Set(val string) error {
+	*s.value = trimQuotes(val)
+	return nil
+}
+
+// Type returns the type of the value
+func (s *QuotedString) Type() string {
+	return "string"
+}
+
+func (s *QuotedString) String() string {
+	return *s.value
+}
+
+func trimQuotes(value string) string {
+	if len(value) < 2 {
+		return value
+	}
+	lastIndex := len(value) - 1
+	for _, char := range []byte{'\'', '"'} {
+		if value[0] == char && value[lastIndex] == char {
+			return value[1:lastIndex]
+		}
+	}
+	return value
+}
+
+// NewQuotedString returns a new quoted string option
+func NewQuotedString(value *string) *QuotedString {
+	return &QuotedString{value: value}
+}

vendor/github.com/docker/cli/opts/secret.go

@@ -0,0 +1,99 @@
+package opts
+
+import (
+	"encoding/csv"
+	"errors"
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+
+	swarmtypes "github.com/docker/docker/api/types/swarm"
+)
+
+// SecretOpt is a Value type for parsing secrets
+type SecretOpt struct {
+	values []*swarmtypes.SecretReference
+}
+
+// Set a new secret value
+func (o *SecretOpt) Set(value string) error {
+	csvReader := csv.NewReader(strings.NewReader(value))
+	fields, err := csvReader.Read()
+	if err != nil {
+		return err
+	}
+
+	options := &swarmtypes.SecretReference{
+		File: &swarmtypes.SecretReferenceFileTarget{
+			UID:  "0",
+			GID:  "0",
+			Mode: 0o444,
+		},
+	}
+
+	// support a simple syntax of --secret foo
+	if len(fields) == 1 && !strings.Contains(fields[0], "=") {
+		options.File.Name = fields[0]
+		options.SecretName = fields[0]
+		o.values = append(o.values, options)
+		return nil
+	}
+
+	for _, field := range fields {
+		key, val, ok := strings.Cut(field, "=")
+		if !ok || key == "" {
+			return fmt.Errorf("invalid field '%s' must be a key=value pair", field)
+		}
+		// TODO(thaJeztah): these options should not be case-insensitive.
+		switch strings.ToLower(key) {
+		case "source", "src":
+			options.SecretName = val
+		case "target":
+			options.File.Name = val
+		case "uid":
+			options.File.UID = val
+		case "gid":
+			options.File.GID = val
+		case "mode":
+			m, err := strconv.ParseUint(val, 0, 32)
+			if err != nil {
+				return fmt.Errorf("invalid mode specified: %v", err)
+			}
+
+			options.File.Mode = os.FileMode(m)
+		default:
+			return errors.New("invalid field in secret request: " + key)
+		}
+	}
+
+	if options.SecretName == "" {
+		return errors.New("source is required")
+	}
+	if options.File.Name == "" {
+		options.File.Name = options.SecretName
+	}
+
+	o.values = append(o.values, options)
+	return nil
+}
+
+// Type returns the type of this option
+func (o *SecretOpt) Type() string {
+	return "secret"
+}
+
+// String returns a string repr of this option
+func (o *SecretOpt) String() string {
+	secrets := []string{}
+	for _, secret := range o.values {
+		repr := fmt.Sprintf("%s -> %s", secret.SecretName, secret.File.Name)
+		secrets = append(secrets, repr)
+	}
+	return strings.Join(secrets, ", ")
+}
+
+// Value returns the secret requests
+func (o *SecretOpt) Value() []*swarmtypes.SecretReference {
+	return o.values
+}

vendor/github.com/docker/cli/opts/throttledevice.go

@@ -0,0 +1,105 @@
+package opts
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/docker/docker/api/types/blkiodev"
+	"github.com/docker/go-units"
+)
+
+// ValidatorThrottleFctType defines a validator function that returns a validated struct and/or an error.
+type ValidatorThrottleFctType func(val string) (*blkiodev.ThrottleDevice, error)
+
+// ValidateThrottleBpsDevice validates that the specified string has a valid device-rate format.
+func ValidateThrottleBpsDevice(val string) (*blkiodev.ThrottleDevice, error) {
+	k, v, ok := strings.Cut(val, ":")
+	if !ok || k == "" {
+		return nil, fmt.Errorf("bad format: %s", val)
+	}
+	// TODO(thaJeztah): should we really validate this on the client?
+	if !strings.HasPrefix(k, "/dev/") {
+		return nil, fmt.Errorf("bad format for device path: %s", val)
+	}
+	rate, err := units.RAMInBytes(v)
+	if err != nil {
+		return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>[<unit>]. Number must be a positive integer. Unit is optional and can be kb, mb, or gb", val)
+	}
+	if rate < 0 {
+		return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>[<unit>]. Number must be a positive integer. Unit is optional and can be kb, mb, or gb", val)
+	}
+
+	return &blkiodev.ThrottleDevice{
+		Path: k,
+		Rate: uint64(rate),
+	}, nil
+}
+
+// ValidateThrottleIOpsDevice validates that the specified string has a valid device-rate format.
+func ValidateThrottleIOpsDevice(val string) (*blkiodev.ThrottleDevice, error) {
+	k, v, ok := strings.Cut(val, ":")
+	if !ok || k == "" {
+		return nil, fmt.Errorf("bad format: %s", val)
+	}
+	// TODO(thaJeztah): should we really validate this on the client?
+	if !strings.HasPrefix(k, "/dev/") {
+		return nil, fmt.Errorf("bad format for device path: %s", val)
+	}
+	rate, err := strconv.ParseUint(v, 10, 64)
+	if err != nil {
+		return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>. Number must be a positive integer", val)
+	}
+
+	return &blkiodev.ThrottleDevice{Path: k, Rate: rate}, nil
+}
+
+// ThrottledeviceOpt defines a map of ThrottleDevices
+type ThrottledeviceOpt struct {
+	values    []*blkiodev.ThrottleDevice
+	validator ValidatorThrottleFctType
+}
+
+// NewThrottledeviceOpt creates a new ThrottledeviceOpt
+func NewThrottledeviceOpt(validator ValidatorThrottleFctType) ThrottledeviceOpt {
+	return ThrottledeviceOpt{
+		values:    []*blkiodev.ThrottleDevice{},
+		validator: validator,
+	}
+}
+
+// Set validates a ThrottleDevice and sets its name as a key in ThrottledeviceOpt
+func (opt *ThrottledeviceOpt) Set(val string) error {
+	var value *blkiodev.ThrottleDevice
+	if opt.validator != nil {
+		v, err := opt.validator(val)
+		if err != nil {
+			return err
+		}
+		value = v
+	}
+	opt.values = append(opt.values, value)
+	return nil
+}
+
+// String returns ThrottledeviceOpt values as a string.
+func (opt *ThrottledeviceOpt) String() string {
+	out := make([]string, 0, len(opt.values))
+	for _, v := range opt.values {
+		out = append(out, v.String())
+	}
+
+	return fmt.Sprintf("%v", out)
+}
+
+// GetList returns a slice of pointers to ThrottleDevices.
+func (opt *ThrottledeviceOpt) GetList() []*blkiodev.ThrottleDevice {
+	out := make([]*blkiodev.ThrottleDevice, 0, len(opt.values))
+	copy(out, opt.values)
+	return out
+}
+
+// Type returns the option type
+func (opt *ThrottledeviceOpt) Type() string {
+	return "list"
+}

vendor/github.com/docker/cli/opts/ulimit.go

@@ -0,0 +1,63 @@
+package opts
+
+import (
+	"fmt"
+	"sort"
+
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/go-units"
+)
+
+// UlimitOpt defines a map of Ulimits
+type UlimitOpt struct {
+	values *map[string]*container.Ulimit
+}
+
+// NewUlimitOpt creates a new UlimitOpt. Ulimits are not validated.
+func NewUlimitOpt(ref *map[string]*container.Ulimit) *UlimitOpt {
+	// TODO(thaJeztah): why do we need a map with pointers here?
+	if ref == nil {
+		ref = &map[string]*container.Ulimit{}
+	}
+	return &UlimitOpt{ref}
+}
+
+// Set validates a Ulimit and sets its name as a key in UlimitOpt
+func (o *UlimitOpt) Set(val string) error {
+	// FIXME(thaJeztah): these functions also need to be moved over from go-units.
+	l, err := units.ParseUlimit(val)
+	if err != nil {
+		return err
+	}
+
+	(*o.values)[l.Name] = l
+
+	return nil
+}
+
+// String returns Ulimit values as a string. Values are sorted by name.
+func (o *UlimitOpt) String() string {
+	out := make([]string, 0, len(*o.values))
+	for _, v := range *o.values {
+		out = append(out, v.String())
+	}
+	sort.Strings(out)
+	return fmt.Sprintf("%v", out)
+}
+
+// GetList returns a slice of pointers to Ulimits. Values are sorted by name.
+func (o *UlimitOpt) GetList() []*container.Ulimit {
+	ulimits := make([]*container.Ulimit, 0, len(*o.values))
+	for _, v := range *o.values {
+		ulimits = append(ulimits, v)
+	}
+	sort.SliceStable(ulimits, func(i, j int) bool {
+		return ulimits[i].Name < ulimits[j].Name
+	})
+	return ulimits
+}
+
+// Type returns the option type
+func (o *UlimitOpt) Type() string {
+	return "ulimit"
+}

vendor/github.com/docker/cli/opts/weightdevice.go

@@ -0,0 +1,84 @@
+package opts
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/docker/docker/api/types/blkiodev"
+)
+
+// ValidatorWeightFctType defines a validator function that returns a validated struct and/or an error.
+type ValidatorWeightFctType func(val string) (*blkiodev.WeightDevice, error)
+
+// ValidateWeightDevice validates that the specified string has a valid device-weight format.
+func ValidateWeightDevice(val string) (*blkiodev.WeightDevice, error) {
+	k, v, ok := strings.Cut(val, ":")
+	if !ok || k == "" {
+		return nil, fmt.Errorf("bad format: %s", val)
+	}
+	// TODO(thaJeztah): should we really validate this on the client?
+	if !strings.HasPrefix(k, "/dev/") {
+		return nil, fmt.Errorf("bad format for device path: %s", val)
+	}
+	weight, err := strconv.ParseUint(v, 10, 16)
+	if err != nil {
+		return nil, fmt.Errorf("invalid weight for device: %s", val)
+	}
+	if weight > 0 && (weight < 10 || weight > 1000) {
+		return nil, fmt.Errorf("invalid weight for device: %s", val)
+	}
+
+	return &blkiodev.WeightDevice{
+		Path:   k,
+		Weight: uint16(weight),
+	}, nil
+}
+
+// WeightdeviceOpt defines a map of WeightDevices
+type WeightdeviceOpt struct {
+	values    []*blkiodev.WeightDevice
+	validator ValidatorWeightFctType
+}
+
+// NewWeightdeviceOpt creates a new WeightdeviceOpt
+func NewWeightdeviceOpt(validator ValidatorWeightFctType) WeightdeviceOpt {
+	return WeightdeviceOpt{
+		values:    []*blkiodev.WeightDevice{},
+		validator: validator,
+	}
+}
+
+// Set validates a WeightDevice and sets its name as a key in WeightdeviceOpt
+func (opt *WeightdeviceOpt) Set(val string) error {
+	var value *blkiodev.WeightDevice
+	if opt.validator != nil {
+		v, err := opt.validator(val)
+		if err != nil {
+			return err
+		}
+		value = v
+	}
+	opt.values = append(opt.values, value)
+	return nil
+}
+
+// String returns WeightdeviceOpt values as a string.
+func (opt *WeightdeviceOpt) String() string {
+	out := make([]string, 0, len(opt.values))
+	for _, v := range opt.values {
+		out = append(out, v.String())
+	}
+
+	return fmt.Sprintf("%v", out)
+}
+
+// GetList returns a slice of pointers to WeightDevices.
+func (opt *WeightdeviceOpt) GetList() []*blkiodev.WeightDevice {
+	return opt.values
+}
+
+// Type returns the option type
+func (opt *WeightdeviceOpt) Type() string {
+	return "list"
+}