Merge pull request #6116 from vvoland/vendor-docker

vendor: github.com/docker/docker v28.2.2-dev (45873be4ae3f)

Dockerfile

@@ -12,8 +12,8 @@ ARG GOTESTSUM_VERSION=v1.12.0
 # BUILDX_VERSION sets the version of buildx to use for the e2e tests.
 # It must be a tag in the docker.io/docker/buildx-bin image repository
 # on Docker Hub.
-ARG BUILDX_VERSION=0.23.0
-ARG COMPOSE_VERSION=v2.35.1
+ARG BUILDX_VERSION=0.24.0
+ARG COMPOSE_VERSION=v2.36.2
 
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
 

cli/command/image/remove.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 
 	cerrdefs "github.com/containerd/errdefs"
+	"github.com/containerd/platforms"
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/cli/command/completion"
@@ -14,22 +15,23 @@ import (
 )
 
 type removeOptions struct {
-	force   bool
-	noPrune bool
+	force     bool
+	noPrune   bool
+	platforms []string
 }
 
 // NewRemoveCommand creates a new `docker remove` command
-func NewRemoveCommand(dockerCli command.Cli) *cobra.Command {
-	var opts removeOptions
+func NewRemoveCommand(dockerCLI command.Cli) *cobra.Command {
+	var options removeOptions
 
 	cmd := &cobra.Command{
 		Use:   "rmi [OPTIONS] IMAGE [IMAGE...]",
 		Short: "Remove one or more images",
 		Args:  cli.RequiresMinArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
-			return runRemove(cmd.Context(), dockerCli, opts, args)
+			return runRemove(cmd.Context(), dockerCLI, options, args)
 		},
-		ValidArgsFunction: completion.ImageNames(dockerCli, -1),
+		ValidArgsFunction: completion.ImageNames(dockerCLI, -1),
 		Annotations: map[string]string{
 			"aliases": "docker image rm, docker image remove, docker rmi",
 		},
@@ -37,9 +39,14 @@ func NewRemoveCommand(dockerCli command.Cli) *cobra.Command {
 
 	flags := cmd.Flags()
 
-	flags.BoolVarP(&opts.force, "force", "f", false, "Force removal of the image")
-	flags.BoolVar(&opts.noPrune, "no-prune", false, "Do not delete untagged parents")
+	flags.BoolVarP(&options.force, "force", "f", false, "Force removal of the image")
+	flags.BoolVar(&options.noPrune, "no-prune", false, "Do not delete untagged parents")
 
+	// TODO(thaJeztah): create a "platforms" option for this (including validation / parsing).
+	flags.StringSliceVar(&options.platforms, "platform", nil, `Remove only the given platform variant. Formatted as "os[/arch[/variant]]" (e.g., "linux/amd64")`)
+	_ = flags.SetAnnotation("platform", "version", []string{"1.50"})
+
+	_ = cmd.RegisterFlagCompletionFunc("platform", completion.Platforms)
 	return cmd
 }
 
@@ -58,6 +65,14 @@ func runRemove(ctx context.Context, dockerCLI command.Cli, opts removeOptions, i
 		PruneChildren: !opts.noPrune,
 	}
 
+	for _, v := range opts.platforms {
+		p, err := platforms.Parse(v)
+		if err != nil {
+			return err
+		}
+		options.Platforms = append(options.Platforms, p)
+	}
+
 	// TODO(thaJeztah): this logic can likely be simplified: do we want to print "not found" errors at all when using "force"?
 	fatalErr := false
 	var errs []error

cli/config/configfile/file.go

@@ -152,7 +152,8 @@ func (configFile *ConfigFile) Save() (retErr error) {
 		return err
 	}
 	defer func() {
-		temp.Close()
+		// ignore error as the file may already be closed when we reach this.
+		_ = temp.Close()
 		if retErr != nil {
 			if err := os.Remove(temp.Name()); err != nil {
 				logrus.WithError(err).WithField("file", temp.Name()).Debug("Error cleaning up temp file")

dockerfiles/Dockerfile.dev

@@ -6,7 +6,7 @@ ARG ALPINE_VERSION=3.21
 # BUILDX_VERSION sets the version of buildx to install in the dev container.
 # It must be a valid tag in the docker.io/docker/buildx-bin image repository
 # on Docker Hub.
-ARG BUILDX_VERSION=0.23.0
+ARG BUILDX_VERSION=0.24.0
 FROM docker/buildx-bin:${BUILDX_VERSION} AS buildx
 
 FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS golang

docs/deprecated.md

@@ -55,7 +55,7 @@ The following table provides an overview of the current status of deprecated fea
 |------------|------------------------------------------------------------------------------------------------------------------------------------|------------|--------|
 | Deprecated | [Configuration for pushing  non-distributable artifacts](#configuration-for-pushing-non-distributable-artifacts)                   | v28.0      | v29.0  |
 | Deprecated | [`--time` option on `docker stop` and `docker restart`](#--time-option-on-docker-stop-and-docker-restart)                          | v28.0      | -      |
-| Deprecated | [Non-standard fields in image inspect](#non-standard-fields-in-image-inspect)                                                      | v27.0      | v28.0  |
+| Removed    | [Non-standard fields in image inspect](#non-standard-fields-in-image-inspect)                                                      | v27.0      | v28.2  |
 | Removed    | [API CORS headers](#api-cors-headers)                                                                                              | v27.0      | v28.0  |
 | Removed    | [Graphdriver plugins (experimental)](#graphdriver-plugins-experimental)                                                            | v27.0      | v28.0  |
 | Deprecated | [Unauthenticated TCP connections](#unauthenticated-tcp-connections)                                                                | v26.0      | v28.0  |
@@ -71,7 +71,7 @@ The following table provides an overview of the current status of deprecated fea
 | Removed    | [Btrfs storage driver on CentOS 7 and RHEL 7](#btrfs-storage-driver-on-centos-7-and-rhel-7)                                        | v20.10     | v23.0  |
 | Removed    | [Support for encrypted TLS private keys](#support-for-encrypted-tls-private-keys)                                                  | v20.10     | v23.0  |
 | Removed    | [Kubernetes stack and context support](#kubernetes-stack-and-context-support)                                                      | v20.10     | v23.0  |
-| Deprecated | [Pulling images from non-compliant image registries](#pulling-images-from-non-compliant-image-registries)                          | v20.10     | -      |
+| Removed    | [Pulling images from non-compliant image registries](#pulling-images-from-non-compliant-image-registries)                          | v20.10     | v28.2  |
 | Removed    | [Linux containers on Windows (LCOW)](#linux-containers-on-windows-lcow-experimental)                                               | v20.10     | v23.0  |
 | Deprecated | [BLKIO weight options with cgroups v1](#blkio-weight-options-with-cgroups-v1)                                                      | v20.10     | -      |
 | Removed    | [Kernel memory limit](#kernel-memory-limit)                                                                                        | v20.10     | v23.0  |
@@ -172,7 +172,7 @@ Users are encouraged to migrate to using the `--timeout` option instead.
 ### Non-standard fields in image inspect
 
 **Deprecated in Release: v27.0**
-**Target For Removal In Release: v28.0**
+**Removed In Release: v28.2**
 
 The `Config` field returned shown in `docker image inspect` (and as returned by
 the `GET /images/{name}/json` API endpoint) returns additional fields that are
@@ -184,8 +184,9 @@ but are not omitted in the response when left empty. As these fields were not
 intended to be part of the image configuration response, they are deprecated,
 and will be removed from the API in thee next release.
 
-The following fields are currently included in the API response, but are not
-part of the underlying image's `Config` field, and deprecated:
+The following fields are not part of the underlying image's `Config` field, and
+removed in the API response for API v1.50 and newer, corresponding with v28.2.
+They continue to be included when using clients that use an older API version:
 
 - `Hostname`
 - `Domainname`
@@ -196,9 +197,9 @@ part of the underlying image's `Config` field, and deprecated:
 - `OpenStdin`
 - `StdinOnce`
 - `Image`
-- `NetworkDisabled` (already omitted unless set)
-- `MacAddress` (already omitted unless set)
-- `StopTimeout` (already omitted unless set)
+- `NetworkDisabled` (omitted unless set on older API versions)
+- `MacAddress` (omitted unless set on older API versions)
+- `StopTimeout` (omitted unless set on older API versions)
 
 [Docker image specification]: https://github.com/moby/docker-image-spec/blob/v1.3.1/specs-go/v1/image.go#L19-L32
 [OCI image specification]: https://github.com/opencontainers/image-spec/blob/v1.1.0/specs-go/v1/config.go#L24-L62
@@ -546,6 +547,7 @@ CLI configuration file are no longer used, and ignored.
 ### Pulling images from non-compliant image registries
 
 **Deprecated in Release: v20.10**
+**Removed in Release: v28.2**
 
 Docker Engine v20.10 and up includes optimizations to verify if images in the
 local image cache need updating before pulling, preventing the Docker Engine
@@ -555,7 +557,7 @@ image registry to conform to the [Open Container Initiative Distribution Specifi
 While most registries conform to the specification, we encountered some registries
 to be non-compliant, resulting in `docker pull` to fail.
 
-As a temporary solution, Docker Engine v20.10 includes a fallback mechanism to
+As a temporary solution, Docker Engine v20.10 added a fallback mechanism to
 allow `docker pull` to be functional when using a non-compliant registry. A
 warning message is printed in this situation:
 
@@ -564,16 +566,13 @@ warning message is printed in this situation:
             pull by tag. This fallback is DEPRECATED, and will be removed in a future
             release.
 
-The fallback is added to allow users to either migrate their images to a compliant
-registry, or for these registries to become compliant.
+The fallback was added to allow users to either migrate their images to a
+compliant registry, or for these registries to become compliant.
 
-Note that this fallback only addresses failures on `docker pull`. Other commands,
-such as `docker stack deploy`, or pulling images with `containerd` will continue
-to fail.
-
-Given that other functionality is still broken with these registries, we consider
-this fallback a _temporary_ solution, and will remove the fallback in an upcoming
-major release.
+GitHub deprecated the legacy `docker.pkg.github.com` registry, and it was
+[sunset on Feb 24th, 2025](https://github.blog/changelog/2025-01-23-legacy-docker-registry-closing-down/)
+in favor of GitHub Container Registry (GHCR, ghcr.io), making this fallback
+no longer needed.
 
 ### Linux containers on Windows (LCOW) (experimental)
 

docs/reference/commandline/image_rm.md

@@ -9,10 +9,11 @@ Remove one or more images
 
 ### Options
 
-| Name            | Type   | Default | Description                    |
-|:----------------|:-------|:--------|:-------------------------------|
-| `-f`, `--force` | `bool` |         | Force removal of the image     |
-| `--no-prune`    | `bool` |         | Do not delete untagged parents |
+| Name                      | Type          | Default | Description                                                                                      |
+|:--------------------------|:--------------|:--------|:-------------------------------------------------------------------------------------------------|
+| `-f`, `--force`           | `bool`        |         | Force removal of the image                                                                       |
+| `--no-prune`              | `bool`        |         | Do not delete untagged parents                                                                   |
+| [`--platform`](#platform) | `stringSlice` |         | Remove only the given platform variant. Formatted as `os[/arch[/variant]]` (e.g., `linux/amd64`) |
 
 
 <!---MARKER_GEN_END-->
@@ -105,3 +106,73 @@ Deleted: 4986bf8c15363d1c5d15512d5266f8777bfba4974ac56e3270e7760f6f0a8125
 Deleted: ea13149945cb6b1e746bf28032f02e9b5a793523481a0a18645fc77ad53c4ea2
 Deleted: df7546f9f060a2268024c8a230d8639878585defcc1bc6f79d2728a13957871b
 ```
+
+### <a name="platform"></a> Remove specific platforms (`--platform`)
+
+The `--platform` option allows you to specify which platform variants of the
+image to remove. By default, `docker image remove` removes all platform variants
+that are present. Use the `--platform` option to specify which platform variant
+of the image to remove.
+
+Removing a specific platform removes the image from all images that reference
+the same content, and requires the `--force` option to be used. Omitting the
+`--force` option produces a warning, and the remove is canceled:
+
+```console
+$ docker image rm --platform=linux/amd64 alpine
+Error response from daemon: Content will be removed from all images referencing this variant. Use —-force to force delete.
+```
+
+The platform option takes the `os[/arch[/variant]]` format; for example,
+`linux/amd64` or `linux/arm64/v8`. Architecture and variant are optional,
+and default to the daemon's native architecture if omitted.
+
+You can pass multiple platforms either by passing the `--platform` flag
+multiple times, or by passing a comma-separated list of platforms to remove.
+The following uses of this option are equivalent;
+
+```console
+$ docker image rm --plaform linux/amd64 --platform linux/ppc64le myimage
+$ docker image rm --plaform linux/amd64,linux/ppc64le myimage
+```
+
+The following example removes the `linux/amd64` and `linux/ppc64le` variants
+of an `alpine` image that contains multiple platform variants in the image
+cache:
+
+```console
+$ docker image ls --tree
+
+IMAGE                   ID             DISK USAGE   CONTENT SIZE   EXTRA
+alpine:latest           a8560b36e8b8       37.8MB         11.2MB    U
+├─ linux/amd64          1c4eef651f65       12.1MB         3.64MB    U
+├─ linux/arm/v6         903bfe2ae994           0B             0B
+├─ linux/arm/v7         9c2d245b3c01           0B             0B
+├─ linux/arm64/v8       757d680068d7       12.8MB         3.99MB
+├─ linux/386            2436f2b3b7d2           0B             0B
+├─ linux/ppc64le        9ed53fd3b831       12.8MB         3.58MB
+├─ linux/riscv64        1de5eb4a9a67           0B             0B
+└─ linux/s390x          fe0dcdd1f783           0B             0B
+ 
+$ docker image --platform=linux/amd64,linux/ppc64le --force alpine
+Deleted: sha256:1c4eef651f65e2f7daee7ee785882ac164b02b78fb74503052a26dc061c90474
+Deleted: sha256:9ed53fd3b83120f78b33685d930ce9bf5aa481f6e2d165c42cbbddbeaa196f6f
+```
+
+After the command completes, the given variants of the `alpine` image are removed
+from the image cache:
+
+```console
+$ docker image ls --tree
+
+IMAGE                   ID             DISK USAGE   CONTENT SIZE   EXTRA
+alpine:latest           a8560b36e8b8       12.8MB         3.99MB
+├─ linux/amd64          1c4eef651f65           0B             0B
+├─ linux/arm/v6         903bfe2ae994           0B             0B
+├─ linux/arm/v7         9c2d245b3c01           0B             0B
+├─ linux/arm64/v8       757d680068d7       12.8MB         3.99MB
+├─ linux/386            2436f2b3b7d2           0B             0B
+├─ linux/ppc64le        9ed53fd3b831           0B             0B
+├─ linux/riscv64        1de5eb4a9a67           0B             0B
+└─ linux/s390x          fe0dcdd1f783           0B             0B
+```

docs/reference/commandline/rmi.md

@@ -9,10 +9,11 @@ Remove one or more images
 
 ### Options
 
-| Name            | Type   | Default | Description                    |
-|:----------------|:-------|:--------|:-------------------------------|
-| `-f`, `--force` | `bool` |         | Force removal of the image     |
-| `--no-prune`    | `bool` |         | Do not delete untagged parents |
+| Name            | Type          | Default | Description                                                                                      |
+|:----------------|:--------------|:--------|:-------------------------------------------------------------------------------------------------|
+| `-f`, `--force` | `bool`        |         | Force removal of the image                                                                       |
+| `--no-prune`    | `bool`        |         | Do not delete untagged parents                                                                   |
+| `--platform`    | `stringSlice` |         | Remove only the given platform variant. Formatted as `os[/arch[/variant]]` (e.g., `linux/amd64`) |
 
 
 <!---MARKER_GEN_END-->

vendor.mod

@@ -15,7 +15,7 @@ require (
 	github.com/distribution/reference v0.6.0
 	github.com/docker/cli-docs-tool v0.10.0
 	github.com/docker/distribution v2.8.3+incompatible
-	github.com/docker/docker v28.2.0-rc.1.0.20250522084122-f4ffeb8c38b3+incompatible // master, v28.2-dev
+	github.com/docker/docker v28.2.2-0.20250530085359-45873be4ae3f+incompatible // v28.2-dev
 	github.com/docker/docker-credential-helpers v0.9.3
 	github.com/docker/go-connections v0.5.0
 	github.com/docker/go-units v0.5.0

vendor.sum

@@ -57,8 +57,8 @@ github.com/docker/cli-docs-tool v0.10.0/go.mod h1:5EM5zPnT2E7yCLERZmrDA234Vwn09f
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v28.2.0-rc.1.0.20250522084122-f4ffeb8c38b3+incompatible h1:nwwWQZnH9eqJhXVmvhy49BcOAE2NVEXgwnkUTy/Px/0=
-github.com/docker/docker v28.2.0-rc.1.0.20250522084122-f4ffeb8c38b3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v28.2.2-0.20250530085359-45873be4ae3f+incompatible h1:Pv7Z5UMmGkOzACssMUwY4HlxQ9sd5lyLnoaLDbj3Mec=
+github.com/docker/docker v28.2.2-0.20250530085359-45873be4ae3f+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
 github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
 github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c h1:lzqkGL9b3znc+ZUgi7FlLnqjQhcXxkNM/quxIjBVMD0=

vendor/github.com/docker/docker/api/swagger.yaml

@@ -1428,63 +1428,10 @@ definitions:
       when starting a container from the image.
     type: "object"
     properties:
-      Hostname:
-        description: |
-          The hostname to use for the container, as a valid RFC 1123 hostname.
-
-          <p><br /></p>
-
-          > **Deprecated**: this field is not part of the image specification and is
-          > always empty. It must not be used, and will be removed in API v1.48.
-        type: "string"
-        example: ""
-      Domainname:
-        description: |
-          The domain name to use for the container.
-
-          <p><br /></p>
-
-          > **Deprecated**: this field is not part of the image specification and is
-          > always empty. It must not be used, and will be removed in API v1.48.
-        type: "string"
-        example: ""
       User:
         description: "The user that commands are run as inside the container."
         type: "string"
         example: "web:web"
-      AttachStdin:
-        description: |
-          Whether to attach to `stdin`.
-
-          <p><br /></p>
-
-          > **Deprecated**: this field is not part of the image specification and is
-          > always false. It must not be used, and will be removed in API v1.48.
-        type: "boolean"
-        default: false
-        example: false
-      AttachStdout:
-        description: |
-          Whether to attach to `stdout`.
-
-          <p><br /></p>
-
-          > **Deprecated**: this field is not part of the image specification and is
-          > always false. It must not be used, and will be removed in API v1.48.
-        type: "boolean"
-        default: false
-        example: false
-      AttachStderr:
-        description: |
-          Whether to attach to `stderr`.
-
-          <p><br /></p>
-
-          > **Deprecated**: this field is not part of the image specification and is
-          > always false. It must not be used, and will be removed in API v1.48.
-        type: "boolean"
-        default: false
-        example: false
       ExposedPorts:
         description: |
           An object mapping ports to an empty object in the form:
@@ -1501,39 +1448,6 @@ definitions:
           "80/tcp": {},
           "443/tcp": {}
         }
-      Tty:
-        description: |
-          Attach standard streams to a TTY, including `stdin` if it is not closed.
-
-          <p><br /></p>
-
-          > **Deprecated**: this field is not part of the image specification and is
-          > always false. It must not be used, and will be removed in API v1.48.
-        type: "boolean"
-        default: false
-        example: false
-      OpenStdin:
-        description: |
-          Open `stdin`
-
-          <p><br /></p>
-
-          > **Deprecated**: this field is not part of the image specification and is
-          > always false. It must not be used, and will be removed in API v1.48.
-        type: "boolean"
-        default: false
-        example: false
-      StdinOnce:
-        description: |
-          Close `stdin` after one attached client disconnects.
-
-          <p><br /></p>
-
-          > **Deprecated**: this field is not part of the image specification and is
-          > always false. It must not be used, and will be removed in API v1.48.
-        type: "boolean"
-        default: false
-        example: false
       Env:
         description: |
           A list of environment variables to set inside the container in the
@@ -1559,18 +1473,6 @@ definitions:
         default: false
         example: false
         x-nullable: true
-      Image:
-        description: |
-          The name (or reference) of the image to use when creating the container,
-          or which was used when the container was created.
-
-          <p><br /></p>
-
-          > **Deprecated**: this field is not part of the image specification and is
-          > always empty. It must not be used, and will be removed in API v1.48.
-        type: "string"
-        default: ""
-        example: ""
       Volumes:
         description: |
           An object mapping mount point paths inside the container to empty
@@ -1599,30 +1501,6 @@ definitions:
         items:
           type: "string"
         example: []
-      NetworkDisabled:
-        description: |
-          Disable networking for the container.
-
-          <p><br /></p>
-
-          > **Deprecated**: this field is not part of the image specification and is
-          > always omitted. It must not be used, and will be removed in API v1.48.
-        type: "boolean"
-        default: false
-        example: false
-        x-nullable: true
-      MacAddress:
-        description: |
-          MAC address of the container.
-
-          <p><br /></p>
-
-          > **Deprecated**: this field is not part of the image specification and is
-          > always omitted. It must not be used, and will be removed in API v1.48.
-        type: "string"
-        default: ""
-        example: ""
-        x-nullable: true
       OnBuild:
         description: |
           `ONBUILD` metadata that were defined in the image's `Dockerfile`.
@@ -1645,17 +1523,6 @@ definitions:
         type: "string"
         example: "SIGTERM"
         x-nullable: true
-      StopTimeout:
-        description: |
-          Timeout to stop a container in seconds.
-
-          <p><br /></p>
-
-          > **Deprecated**: this field is not part of the image specification and is
-          > always omitted. It must not be used, and will be removed in API v1.48.
-        type: "integer"
-        default: 10
-        x-nullable: true
       Shell:
         description: |
           Shell for when `RUN`, `CMD`, and `ENTRYPOINT` uses a shell.
@@ -1666,19 +1533,11 @@ definitions:
         example: ["/bin/sh", "-c"]
     # FIXME(thaJeztah): temporarily using a full example to remove some "omitempty" fields. Remove once the fields are removed.
     example:
-      "Hostname": ""
-      "Domainname": ""
       "User": "web:web"
-      "AttachStdin": false
-      "AttachStdout": false
-      "AttachStderr": false
       "ExposedPorts": {
         "80/tcp": {},
         "443/tcp": {}
       }
-      "Tty": false
-      "OpenStdin": false
-      "StdinOnce": false
       "Env": ["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"]
       "Cmd": ["/bin/sh"]
       "Healthcheck": {
@@ -1690,7 +1549,6 @@ definitions:
         "StartInterval": 0
       }
       "ArgsEscaped": true
-      "Image": ""
       "Volumes": {
         "/app/data": {},
         "/app/config": {}
@@ -9960,6 +9818,18 @@ paths:
           description: "Do not delete untagged parent images"
           type: "boolean"
           default: false
+        - name: "platforms"
+          in: "query"
+          description: |
+            Select platform-specific content to delete.
+            Multiple values are accepted.
+            Each platform is a OCI platform encoded as a JSON string.
+          type: "array"
+          items:
+            # This should be OCIPlatform
+            # but $ref is not supported for array in query in Swagger 2.0
+            # $ref: "#/definitions/OCIPlatform"
+            type: "string"
       tags: ["Image"]
   /images/search:
     get:

vendor/github.com/docker/docker/api/types/image/image_inspect.go

@@ -3,6 +3,7 @@ package image
 import (
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/storage"
+	dockerspec "github.com/moby/docker-image-spec/specs-go/v1"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 )
 
@@ -84,7 +85,7 @@ type InspectResponse struct {
 	// Author is the name of the author that was specified when committing the
 	// image, or as specified through MAINTAINER (deprecated) in the Dockerfile.
 	Author string
-	Config *container.Config
+	Config *dockerspec.DockerOCIImageConfig
 
 	// Architecture is the hardware CPU architecture that the image runs on.
 	Architecture string

vendor/github.com/docker/docker/api/types/image/opts.go

@@ -83,6 +83,7 @@ type ListOptions struct {
 
 // RemoveOptions holds parameters to remove images.
 type RemoveOptions struct {
+	Platforms     []ocispec.Platform
 	Force         bool
 	PruneChildren bool
 }

vendor/github.com/docker/docker/client/image_remove.go

@@ -19,6 +19,14 @@ func (cli *Client) ImageRemove(ctx context.Context, imageID string, options imag
 		query.Set("noprune", "1")
 	}
 
+	if len(options.Platforms) > 0 {
+		p, err := encodePlatforms(options.Platforms...)
+		if err != nil {
+			return nil, err
+		}
+		query["platforms"] = p
+	}
+
 	resp, err := cli.delete(ctx, "/images/"+imageID, query, nil)
 	defer ensureReaderClosed(resp)
 	if err != nil {

vendor/github.com/docker/docker/errdefs/defs.go

@@ -1,69 +0,0 @@
-package errdefs
-
-// ErrNotFound signals that the requested object doesn't exist
-type ErrNotFound interface {
-	NotFound()
-}
-
-// ErrInvalidParameter signals that the user input is invalid
-type ErrInvalidParameter interface {
-	InvalidParameter()
-}
-
-// ErrConflict signals that some internal state conflicts with the requested action and can't be performed.
-// A change in state should be able to clear this error.
-type ErrConflict interface {
-	Conflict()
-}
-
-// ErrUnauthorized is used to signify that the user is not authorized to perform a specific action
-type ErrUnauthorized interface {
-	Unauthorized()
-}
-
-// ErrUnavailable signals that the requested action/subsystem is not available.
-type ErrUnavailable interface {
-	Unavailable()
-}
-
-// ErrForbidden signals that the requested action cannot be performed under any circumstances.
-// When a ErrForbidden is returned, the caller should never retry the action.
-type ErrForbidden interface {
-	Forbidden()
-}
-
-// ErrSystem signals that some internal error occurred.
-// An example of this would be a failed mount request.
-type ErrSystem interface {
-	System()
-}
-
-// ErrNotModified signals that an action can't be performed because it's already in the desired state
-type ErrNotModified interface {
-	NotModified()
-}
-
-// ErrNotImplemented signals that the requested action/feature is not implemented on the system as configured.
-type ErrNotImplemented interface {
-	NotImplemented()
-}
-
-// ErrUnknown signals that the kind of error that occurred is not known.
-type ErrUnknown interface {
-	Unknown()
-}
-
-// ErrCancelled signals that the action was cancelled.
-type ErrCancelled interface {
-	Cancelled()
-}
-
-// ErrDeadline signals that the deadline was reached before the action completed.
-type ErrDeadline interface {
-	DeadlineExceeded()
-}
-
-// ErrDataLoss indicates that data was lost or there is data corruption.
-type ErrDataLoss interface {
-	DataLoss()
-}

vendor/github.com/docker/docker/errdefs/doc.go

@@ -1,8 +0,0 @@
-// Package errdefs defines a set of error interfaces that packages should use for communicating classes of errors.
-// Errors that cross the package boundary should implement one (and only one) of these interfaces.
-//
-// Packages should not reference these interfaces directly, only implement them.
-// To check if a particular error implements one of these interfaces, there are helper
-// functions provided (e.g. `Is<SomeError>`) which can be used rather than asserting the interfaces directly.
-// If you must assert on these interfaces, be sure to check the causal chain (`err.Unwrap()`).
-package errdefs // import "github.com/docker/docker/errdefs"

vendor/github.com/docker/docker/errdefs/helpers.go

@@ -1,305 +0,0 @@
-package errdefs
-
-import "context"
-
-type errNotFound struct{ error }
-
-func (errNotFound) NotFound() {}
-
-func (e errNotFound) Cause() error {
-	return e.error
-}
-
-func (e errNotFound) Unwrap() error {
-	return e.error
-}
-
-// NotFound creates an [ErrNotFound] error from the given error.
-// It returns the error as-is if it is either nil (no error) or already implements
-// [ErrNotFound],
-func NotFound(err error) error {
-	if err == nil || IsNotFound(err) {
-		return err
-	}
-	return errNotFound{err}
-}
-
-type errInvalidParameter struct{ error }
-
-func (errInvalidParameter) InvalidParameter() {}
-
-func (e errInvalidParameter) Cause() error {
-	return e.error
-}
-
-func (e errInvalidParameter) Unwrap() error {
-	return e.error
-}
-
-// InvalidParameter creates an [ErrInvalidParameter] error from the given error.
-// It returns the error as-is if it is either nil (no error) or already implements
-// [ErrInvalidParameter],
-func InvalidParameter(err error) error {
-	if err == nil || IsInvalidParameter(err) {
-		return err
-	}
-	return errInvalidParameter{err}
-}
-
-type errConflict struct{ error }
-
-func (errConflict) Conflict() {}
-
-func (e errConflict) Cause() error {
-	return e.error
-}
-
-func (e errConflict) Unwrap() error {
-	return e.error
-}
-
-// Conflict creates an [ErrConflict] error from the given error.
-// It returns the error as-is if it is either nil (no error) or already implements
-// [ErrConflict],
-func Conflict(err error) error {
-	if err == nil || IsConflict(err) {
-		return err
-	}
-	return errConflict{err}
-}
-
-type errUnauthorized struct{ error }
-
-func (errUnauthorized) Unauthorized() {}
-
-func (e errUnauthorized) Cause() error {
-	return e.error
-}
-
-func (e errUnauthorized) Unwrap() error {
-	return e.error
-}
-
-// Unauthorized creates an [ErrUnauthorized] error from the given error.
-// It returns the error as-is if it is either nil (no error) or already implements
-// [ErrUnauthorized],
-func Unauthorized(err error) error {
-	if err == nil || IsUnauthorized(err) {
-		return err
-	}
-	return errUnauthorized{err}
-}
-
-type errUnavailable struct{ error }
-
-func (errUnavailable) Unavailable() {}
-
-func (e errUnavailable) Cause() error {
-	return e.error
-}
-
-func (e errUnavailable) Unwrap() error {
-	return e.error
-}
-
-// Unavailable creates an [ErrUnavailable] error from the given error.
-// It returns the error as-is if it is either nil (no error) or already implements
-// [ErrUnavailable],
-func Unavailable(err error) error {
-	if err == nil || IsUnavailable(err) {
-		return err
-	}
-	return errUnavailable{err}
-}
-
-type errForbidden struct{ error }
-
-func (errForbidden) Forbidden() {}
-
-func (e errForbidden) Cause() error {
-	return e.error
-}
-
-func (e errForbidden) Unwrap() error {
-	return e.error
-}
-
-// Forbidden creates an [ErrForbidden] error from the given error.
-// It returns the error as-is if it is either nil (no error) or already implements
-// [ErrForbidden],
-func Forbidden(err error) error {
-	if err == nil || IsForbidden(err) {
-		return err
-	}
-	return errForbidden{err}
-}
-
-type errSystem struct{ error }
-
-func (errSystem) System() {}
-
-func (e errSystem) Cause() error {
-	return e.error
-}
-
-func (e errSystem) Unwrap() error {
-	return e.error
-}
-
-// System creates an [ErrSystem] error from the given error.
-// It returns the error as-is if it is either nil (no error) or already implements
-// [ErrSystem],
-func System(err error) error {
-	if err == nil || IsSystem(err) {
-		return err
-	}
-	return errSystem{err}
-}
-
-type errNotModified struct{ error }
-
-func (errNotModified) NotModified() {}
-
-func (e errNotModified) Cause() error {
-	return e.error
-}
-
-func (e errNotModified) Unwrap() error {
-	return e.error
-}
-
-// NotModified creates an [ErrNotModified] error from the given error.
-// It returns the error as-is if it is either nil (no error) or already implements
-// [NotModified],
-func NotModified(err error) error {
-	if err == nil || IsNotModified(err) {
-		return err
-	}
-	return errNotModified{err}
-}
-
-type errNotImplemented struct{ error }
-
-func (errNotImplemented) NotImplemented() {}
-
-func (e errNotImplemented) Cause() error {
-	return e.error
-}
-
-func (e errNotImplemented) Unwrap() error {
-	return e.error
-}
-
-// NotImplemented creates an [ErrNotImplemented] error from the given error.
-// It returns the error as-is if it is either nil (no error) or already implements
-// [ErrNotImplemented],
-func NotImplemented(err error) error {
-	if err == nil || IsNotImplemented(err) {
-		return err
-	}
-	return errNotImplemented{err}
-}
-
-type errUnknown struct{ error }
-
-func (errUnknown) Unknown() {}
-
-func (e errUnknown) Cause() error {
-	return e.error
-}
-
-func (e errUnknown) Unwrap() error {
-	return e.error
-}
-
-// Unknown creates an [ErrUnknown] error from the given error.
-// It returns the error as-is if it is either nil (no error) or already implements
-// [ErrUnknown],
-func Unknown(err error) error {
-	if err == nil || IsUnknown(err) {
-		return err
-	}
-	return errUnknown{err}
-}
-
-type errCancelled struct{ error }
-
-func (errCancelled) Cancelled() {}
-
-func (e errCancelled) Cause() error {
-	return e.error
-}
-
-func (e errCancelled) Unwrap() error {
-	return e.error
-}
-
-// Cancelled creates an [ErrCancelled] error from the given error.
-// It returns the error as-is if it is either nil (no error) or already implements
-// [ErrCancelled],
-func Cancelled(err error) error {
-	if err == nil || IsCancelled(err) {
-		return err
-	}
-	return errCancelled{err}
-}
-
-type errDeadline struct{ error }
-
-func (errDeadline) DeadlineExceeded() {}
-
-func (e errDeadline) Cause() error {
-	return e.error
-}
-
-func (e errDeadline) Unwrap() error {
-	return e.error
-}
-
-// Deadline creates an [ErrDeadline] error from the given error.
-// It returns the error as-is if it is either nil (no error) or already implements
-// [ErrDeadline],
-func Deadline(err error) error {
-	if err == nil || IsDeadline(err) {
-		return err
-	}
-	return errDeadline{err}
-}
-
-type errDataLoss struct{ error }
-
-func (errDataLoss) DataLoss() {}
-
-func (e errDataLoss) Cause() error {
-	return e.error
-}
-
-func (e errDataLoss) Unwrap() error {
-	return e.error
-}
-
-// DataLoss creates an [ErrDataLoss] error from the given error.
-// It returns the error as-is if it is either nil (no error) or already implements
-// [ErrDataLoss],
-func DataLoss(err error) error {
-	if err == nil || IsDataLoss(err) {
-		return err
-	}
-	return errDataLoss{err}
-}
-
-// FromContext returns the error class from the passed in context
-func FromContext(ctx context.Context) error {
-	e := ctx.Err()
-	if e == nil {
-		return nil
-	}
-
-	if e == context.Canceled {
-		return Cancelled(e)
-	}
-	if e == context.DeadlineExceeded {
-		return Deadline(e)
-	}
-	return Unknown(e)
-}

vendor/github.com/docker/docker/errdefs/http_helpers.go

@@ -1,49 +0,0 @@
-package errdefs
-
-import (
-	"net/http"
-)
-
-// FromStatusCode creates an errdef error, based on the provided HTTP status-code
-//
-// Deprecated: Use [cerrdefs.ToNative] instead
-func FromStatusCode(err error, statusCode int) error {
-	if err == nil {
-		return nil
-	}
-	switch statusCode {
-	case http.StatusNotFound:
-		return NotFound(err)
-	case http.StatusBadRequest:
-		return InvalidParameter(err)
-	case http.StatusConflict:
-		return Conflict(err)
-	case http.StatusUnauthorized:
-		return Unauthorized(err)
-	case http.StatusServiceUnavailable:
-		return Unavailable(err)
-	case http.StatusForbidden:
-		return Forbidden(err)
-	case http.StatusNotModified:
-		return NotModified(err)
-	case http.StatusNotImplemented:
-		return NotImplemented(err)
-	case http.StatusInternalServerError:
-		if IsCancelled(err) || IsSystem(err) || IsUnknown(err) || IsDataLoss(err) || IsDeadline(err) {
-			return err
-		}
-		return System(err)
-	default:
-		switch {
-		case statusCode >= http.StatusOK && statusCode < http.StatusBadRequest:
-			// it's a client error
-			return err
-		case statusCode >= http.StatusBadRequest && statusCode < http.StatusInternalServerError:
-			return InvalidParameter(err)
-		case statusCode >= http.StatusInternalServerError && statusCode < 600:
-			return System(err)
-		default:
-			return Unknown(err)
-		}
-	}
-}

vendor/github.com/docker/docker/errdefs/is.go

@@ -1,78 +0,0 @@
-package errdefs
-
-import (
-	"context"
-	"errors"
-
-	cerrdefs "github.com/containerd/errdefs"
-)
-
-// IsNotFound returns if the passed in error is an [ErrNotFound],
-//
-// Deprecated: use containerd [cerrdefs.IsNotFound]
-var IsNotFound = cerrdefs.IsNotFound
-
-// IsInvalidParameter returns if the passed in error is an [ErrInvalidParameter].
-//
-// Deprecated: use containerd [cerrdefs.IsInvalidArgument]
-var IsInvalidParameter = cerrdefs.IsInvalidArgument
-
-// IsConflict returns if the passed in error is an [ErrConflict].
-//
-// Deprecated: use containerd [cerrdefs.IsConflict]
-var IsConflict = cerrdefs.IsConflict
-
-// IsUnauthorized returns if the passed in error is an [ErrUnauthorized].
-//
-// Deprecated: use containerd [cerrdefs.IsUnauthorized]
-var IsUnauthorized = cerrdefs.IsUnauthorized
-
-// IsUnavailable returns if the passed in error is an [ErrUnavailable].
-//
-// Deprecated: use containerd [cerrdefs.IsUnavailable]
-var IsUnavailable = cerrdefs.IsUnavailable
-
-// IsForbidden returns if the passed in error is an [ErrForbidden].
-//
-// Deprecated: use containerd [cerrdefs.IsPermissionDenied]
-var IsForbidden = cerrdefs.IsPermissionDenied
-
-// IsSystem returns if the passed in error is an [ErrSystem].
-//
-// Deprecated: use containerd [cerrdefs.IsInternal]
-var IsSystem = cerrdefs.IsInternal
-
-// IsNotModified returns if the passed in error is an [ErrNotModified].
-//
-// Deprecated: use containerd [cerrdefs.IsNotModified]
-var IsNotModified = cerrdefs.IsNotModified
-
-// IsNotImplemented returns if the passed in error is an [ErrNotImplemented].
-//
-// Deprecated: use containerd [cerrdefs.IsNotImplemented]
-var IsNotImplemented = cerrdefs.IsNotImplemented
-
-// IsUnknown returns if the passed in error is an [ErrUnknown].
-//
-// Deprecated: use containerd [cerrdefs.IsUnknown]
-var IsUnknown = cerrdefs.IsUnknown
-
-// IsCancelled returns if the passed in error is an [ErrCancelled].
-//
-// Deprecated: use containerd [cerrdefs.IsCanceled]
-var IsCancelled = cerrdefs.IsCanceled
-
-// IsDeadline returns if the passed in error is an [ErrDeadline].
-//
-// Deprecated: use containerd [cerrdefs.IsDeadlineExceeded]
-var IsDeadline = cerrdefs.IsDeadlineExceeded
-
-// IsDataLoss returns if the passed in error is an [ErrDataLoss].
-//
-// Deprecated: use containerd [cerrdefs.IsDataLoss]
-var IsDataLoss = cerrdefs.IsDataLoss
-
-// IsContext returns if the passed in error is due to context cancellation or deadline exceeded.
-func IsContext(err error) bool {
-	return errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded)
-}

vendor/github.com/docker/docker/registry/errors.go

@@ -4,7 +4,6 @@ import (
 	"net/url"
 
 	"github.com/docker/distribution/registry/api/errcode"
-	"github.com/docker/docker/errdefs"
 	"github.com/pkg/errors"
 )
 
@@ -15,7 +14,7 @@ func translateV2AuthError(err error) error {
 		case errcode.Error:
 			switch e2.Code {
 			case errcode.ErrorCodeUnauthorized:
-				return errdefs.Unauthorized(err)
+				return unauthorizedErr{err}
 			}
 		}
 	}
@@ -24,13 +23,49 @@ func translateV2AuthError(err error) error {
 }
 
 func invalidParam(err error) error {
-	return errdefs.InvalidParameter(err)
+	return invalidParameterErr{err}
 }
 
 func invalidParamf(format string, args ...interface{}) error {
-	return errdefs.InvalidParameter(errors.Errorf(format, args...))
+	return invalidParameterErr{errors.Errorf(format, args...)}
 }
 
 func invalidParamWrapf(err error, format string, args ...interface{}) error {
-	return errdefs.InvalidParameter(errors.Wrapf(err, format, args...))
+	return invalidParameterErr{errors.Wrapf(err, format, args...)}
+}
+
+type unauthorizedErr struct{ error }
+
+func (unauthorizedErr) Unauthorized() {}
+
+func (e unauthorizedErr) Cause() error {
+	return e.error
+}
+
+func (e unauthorizedErr) Unwrap() error {
+	return e.error
+}
+
+type invalidParameterErr struct{ error }
+
+func (invalidParameterErr) InvalidParameter() {}
+
+func (e invalidParameterErr) Unwrap() error {
+	return e.error
+}
+
+type systemErr struct{ error }
+
+func (systemErr) System() {}
+
+func (e systemErr) Unwrap() error {
+	return e.error
+}
+
+type errUnknown struct{ error }
+
+func (errUnknown) Unknown() {}
+
+func (e errUnknown) Unwrap() error {
+	return e.error
 }

vendor/github.com/docker/docker/registry/search.go

@@ -10,7 +10,6 @@ import (
 	"github.com/docker/distribution/registry/client/auth"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/docker/docker/api/types/registry"
-	"github.com/docker/docker/errdefs"
 	"github.com/pkg/errors"
 )
 
@@ -48,7 +47,7 @@ func (s *Service) Search(ctx context.Context, searchFilters filters.Args, term s
 		for _, hasStar := range hasStars {
 			iHasStar, err := strconv.Atoi(hasStar)
 			if err != nil {
-				return nil, errdefs.InvalidParameter(errors.Wrapf(err, "invalid filter 'stars=%s'", hasStar))
+				return nil, invalidParameterErr{errors.Wrapf(err, "invalid filter 'stars=%s'", hasStar)}
 			}
 			if iHasStar > hasStarFilter {
 				hasStarFilter = iHasStar

vendor/github.com/docker/docker/registry/search_session.go

@@ -15,7 +15,6 @@ import (
 
 	"github.com/containerd/log"
 	"github.com/docker/docker/api/types/registry"
-	"github.com/docker/docker/errdefs"
 	"github.com/pkg/errors"
 )
 
@@ -195,7 +194,7 @@ func authorizeClient(ctx context.Context, client *http.Client, authConfig *regis
 
 	jar, err := cookiejar.New(nil)
 	if err != nil {
-		return errdefs.System(errors.New("cookiejar.New is not supposed to return an error"))
+		return systemErr{errors.New("cookiejar.New is not supposed to return an error")}
 	}
 	client.Jar = jar
 
@@ -231,17 +230,18 @@ func (r *session) searchRepositories(ctx context.Context, term string, limit int
 	req.Header.Set("X-Docker-Token", "true")
 	res, err := r.client.Do(req)
 	if err != nil {
-		return nil, errdefs.System(err)
+		return nil, systemErr{err}
 	}
 	defer res.Body.Close()
 	if res.StatusCode != http.StatusOK {
 		// TODO(thaJeztah): return upstream response body for errors (see https://github.com/moby/moby/issues/27286).
-		return nil, errdefs.Unknown(fmt.Errorf("Unexpected status code %d", res.StatusCode))
+		// TODO(thaJeztah): handle other status-codes to return correct error-type
+		return nil, errUnknown{fmt.Errorf("Unexpected status code %d", res.StatusCode)}
 	}
 	result := &registry.SearchResults{}
 	err = json.NewDecoder(res.Body).Decode(result)
 	if err != nil {
-		return nil, errdefs.System(errors.Wrap(err, "error decoding registry search results"))
+		return nil, systemErr{errors.Wrap(err, "error decoding registry search results")}
 	}
 	return result, nil
 }

vendor/github.com/docker/docker/registry/service.go

@@ -3,14 +3,15 @@ package registry // import "github.com/docker/docker/registry"
 import (
 	"context"
 	"crypto/tls"
+	"errors"
 	"net/url"
 	"strings"
 	"sync"
 
+	cerrdefs "github.com/containerd/errdefs"
 	"github.com/containerd/log"
 	"github.com/distribution/reference"
 	"github.com/docker/docker/api/types/registry"
-	"github.com/docker/docker/errdefs"
 )
 
 // Service is a registry service. It tracks configuration data such as a list
@@ -77,7 +78,7 @@ func (s *Service) Auth(ctx context.Context, authConfig *registry.AuthConfig, use
 	endpoints, err := s.lookupV2Endpoints(ctx, registryHostName, false)
 	s.mu.RUnlock()
 	if err != nil {
-		if errdefs.IsContext(err) {
+		if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
 			return "", "", err
 		}
 		return "", "", invalidParam(err)
@@ -87,7 +88,7 @@ func (s *Service) Auth(ctx context.Context, authConfig *registry.AuthConfig, use
 	for _, endpoint := range endpoints {
 		authToken, err := loginV2(ctx, authConfig, endpoint, userAgent)
 		if err != nil {
-			if errdefs.IsContext(err) || errdefs.IsUnauthorized(err) {
+			if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) || cerrdefs.IsUnauthorized(err) {
 				// Failed to authenticate; don't continue with (non-TLS) endpoints.
 				return "", "", err
 			}

vendor/modules.txt

@@ -65,7 +65,7 @@ github.com/docker/distribution/registry/client/transport
 github.com/docker/distribution/registry/storage/cache
 github.com/docker/distribution/registry/storage/cache/memory
 github.com/docker/distribution/uuid
-# github.com/docker/docker v28.2.0-rc.1.0.20250522084122-f4ffeb8c38b3+incompatible
+# github.com/docker/docker v28.2.2-0.20250530085359-45873be4ae3f+incompatible
 ## explicit
 github.com/docker/docker/api
 github.com/docker/docker/api/types
@@ -92,7 +92,6 @@ github.com/docker/docker/api/types/volume
 github.com/docker/docker/builder/remotecontext/git
 github.com/docker/docker/builder/remotecontext/urlutil
 github.com/docker/docker/client
-github.com/docker/docker/errdefs
 github.com/docker/docker/internal/lazyregexp
 github.com/docker/docker/internal/multierror
 github.com/docker/docker/pkg/homedir