fix(loader): Allows multiple protocols on one port

update to go1.25.5

.github/workflows/build.yml

@@ -35,7 +35,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       -
         name: Create matrix
         id: platforms
@@ -88,7 +88,7 @@ jobs:
           fi
       -
         name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: ${{ env.ARTIFACT_NAME }}
           path: /tmp/out/*
@@ -143,7 +143,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       -
         name: Create matrix
         id: platforms

.github/workflows/codeql.yml

@@ -46,7 +46,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-depth: 2
       # CodeQL 2.16.4's auto-build added support for multi-module repositories,
@@ -63,7 +63,7 @@ jobs:
         name: Update Go
         uses: actions/setup-go@v6
         with:
-          go-version: "1.25.3"
+          go-version: "1.25.5"
       -
         name: Initialize CodeQL
         uses: github/codeql-action/init@v4

.github/workflows/e2e.yml

@@ -37,13 +37,14 @@ jobs:
           - alpine
           - debian
         engine-version:
-          - 28  # latest
-          - 27  # latest - 1
+          - rc  # latest rc
+          - 29  # latest
+          - 28  # latest - 1
           - 25  # mirantis lts
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       -
         name: Update daemon.json
         run: |

.github/workflows/test.yml

@@ -60,18 +60,18 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           path: ${{ env.GOPATH }}/src/github.com/docker/cli
       -
         name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: "1.25.3"
+          go-version: "1.25.5"
       -
         name: Test
         run: |
-          go test -coverprofile=/tmp/coverage.txt $(go list ./... | grep -vE '/vendor/|/e2e/')
+          go test -coverprofile=/tmp/coverage.txt $(go list ./... | grep -vE '/vendor/|/e2e/|/cmd/docker-trust')
           go tool cover -func=/tmp/coverage.txt
         working-directory: ${{ env.GOPATH }}/src/github.com/docker/cli
         shell: bash

.github/workflows/validate.yml

@@ -48,7 +48,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       -
         name: Generate
         shell: 'script --return --quiet --command "bash {0}"'
@@ -74,7 +74,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       -
         name: Run
         shell: 'script --return --quiet --command "bash {0}"'

.golangci.yml

@@ -5,7 +5,7 @@ run:
   # which causes it to fallback to go1.17 semantics.
   #
   # TODO(thaJeztah): update "usetesting" settings to enable go1.24 features once our minimum version is go1.24
-  go: "1.25.3"
+  go: "1.25.5"
 
   timeout: 5m
 

Dockerfile

@@ -8,7 +8,7 @@ ARG BASE_VARIANT=alpine
 ARG ALPINE_VERSION=3.22
 ARG BASE_DEBIAN_DISTRO=bookworm
 
-ARG GO_VERSION=1.25.3
+ARG GO_VERSION=1.25.5
 
 # XX_VERSION specifies the version of the xx utility to use.
 # It must be a valid tag in the docker.io/tonistiigi/xx image repository.
@@ -97,7 +97,7 @@ ENV GO111MODULE=auto
 RUN --mount=type=bind,target=.,rw \
     --mount=type=cache,target=/root/.cache \
     --mount=type=cache,target=/go/pkg/mod \
-    gotestsum -- -coverprofile=/tmp/coverage.txt $(go list ./... | grep -vE '/vendor/|/e2e/')
+    gotestsum -- -coverprofile=/tmp/coverage.txt $(go list ./... | grep -vE '/vendor/|/e2e/|/cmd/docker-trust')
 
 FROM scratch AS test-coverage
 COPY --from=test /tmp/coverage.txt /coverage.txt
@@ -122,10 +122,6 @@ FROM docker/buildx-bin:${BUILDX_VERSION}   AS buildx
 FROM docker/compose-bin:${COMPOSE_VERSION} AS compose
 
 FROM e2e-base-${BASE_VARIANT} AS e2e
-ARG NOTARY_VERSION=v0.6.1
-ADD --chmod=0755 https://github.com/theupdateframework/notary/releases/download/${NOTARY_VERSION}/notary-Linux-amd64 /usr/local/bin/notary
-COPY --link e2e/testdata/notary/root-ca.cert /usr/share/ca-certificates/notary.cert
-RUN echo 'notary.cert' >> /etc/ca-certificates.conf && update-ca-certificates
 COPY --link --from=gotestsum /out/gotestsum /usr/bin/gotestsum
 COPY --link --from=build /out ./build/
 COPY --link --from=build-plugins /out ./build/

Makefile

@@ -34,12 +34,12 @@ test: test-unit ## run tests
 
 .PHONY: test-unit
 test-unit: ## run unit tests, to change the output format use: GOTESTSUM_FORMAT=(dots|short|standard-quiet|short-verbose|standard-verbose) make test-unit
-	gotestsum -- $${TESTDIRS:-$(shell go list ./... | grep -vE '/vendor/|/e2e/')} $(TESTFLAGS)
+	gotestsum -- $${TESTDIRS:-$(shell go list ./... | grep -vE '/vendor/|/e2e/|/cmd/docker-trust')} $(TESTFLAGS)
 
 .PHONY: test-coverage
 test-coverage: ## run test coverage
 	mkdir -p $(CURDIR)/build/coverage
-	gotestsum -- $(shell go list ./... | grep -vE '/vendor/|/e2e/') -coverprofile=$(CURDIR)/build/coverage/coverage.txt
+	gotestsum -- $(shell go list ./... | grep -vE '/vendor/|/e2e/|/cmd/docker-trust') -coverprofile=$(CURDIR)/build/coverage/coverage.txt
 
 .PHONY: lint
 lint: ## run all the lint tools
@@ -52,7 +52,7 @@ shellcheck: ## run shellcheck validation
 .PHONY: fmt
 fmt: ## run gofumpt (if present) or gofmt
 	@if command -v gofumpt > /dev/null; then \
-		gofumpt -w -d -lang=1.23 . ; \
+		gofumpt -w -d -lang=1.24 . ; \
 	else \
 		go list -f {{.Dir}} ./... | xargs gofmt -w -s -d ; \
 	fi
@@ -69,6 +69,15 @@ dynbinary: ## build dynamically linked binary
 plugins: ## build example CLI plugins
 	scripts/build/plugins
 
+.PHONY: trust-plugin
+trust-plugin: ## build docker-trust CLI plugins
+	scripts/build/trust-plugin
+
+.PHONY: install-trust-plugin
+install-trust-plugin: trust-plugin
+install-trust-plugin: ## install docker-trust CLI plugins
+	install -D -m 0755 "$$(readlink -f build/docker-trust)" /usr/libexec/docker/cli-plugins/docker-trust
+
 .PHONY: vendor
 vendor: ## update vendor with go modules
 	rm -rf vendor

cli-plugins/examples/helloworld/main.go

@@ -8,6 +8,7 @@ import (
 	"github.com/docker/cli/cli-plugins/metadata"
 	"github.com/docker/cli/cli-plugins/plugin"
 	"github.com/docker/cli/cli/command"
+	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
 
@@ -25,7 +26,7 @@ func main() {
 			Short: "Print the API version of the server",
 			RunE: func(_ *cobra.Command, _ []string) error {
 				apiClient := dockerCLI.Client()
-				ping, err := apiClient.Ping(context.Background())
+				ping, err := apiClient.Ping(context.Background(), client.PingOptions{})
 				if err != nil {
 					return err
 				}

cli-plugins/manager/cobra.go

@@ -38,6 +38,7 @@ func AddPluginCommandStubs(dockerCLI config.Provider, rootCmd *cobra.Command) (e
 			rootCmd.AddCommand(&cobra.Command{
 				Use:                p.Name,
 				Short:              p.ShortDescription,
+				Hidden:             p.Hidden,
 				Run:                func(_ *cobra.Command, _ []string) {},
 				Annotations:        annotations,
 				DisableFlagParsing: true,

cli-plugins/manager/error.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.23
+//go:build go1.24
 
 package manager
 

cli-plugins/metadata/metadata.go

@@ -33,4 +33,6 @@ type Metadata struct {
 	ShortDescription string `json:",omitempty"`
 	// URL is a pointer to the plugin's homepage.
 	URL string `json:",omitempty"`
+	// Hidden hides the plugin in completion and help message output.
+	Hidden bool `json:",omitempty"`
 }

cli-plugins/plugin/plugin.go

@@ -139,7 +139,7 @@ func withPluginClientConn(name string) command.CLIOption {
 		if err != nil {
 			return err
 		}
-		apiClient, err := client.NewClientWithOpts(client.WithDialContext(helper.Dialer))
+		apiClient, err := client.New(client.WithDialContext(helper.Dialer))
 		if err != nil {
 			return err
 		}

cli/cobra.go

@@ -250,11 +250,12 @@ func commandAliases(cmd *cobra.Command) string {
 	if cmd.HasParent() {
 		parentPath = cmd.Parent().CommandPath() + " "
 	}
-	aliases := cmd.CommandPath()
+	var aliases strings.Builder
+	aliases.WriteString(cmd.CommandPath())
 	for _, alias := range cmd.Aliases {
-		aliases += ", " + parentPath + alias
+		aliases.WriteString(", " + parentPath + alias)
 	}
-	return aliases
+	return aliases.String()
 }
 
 func topCommands(cmd *cobra.Command) []*cobra.Command {
@@ -350,13 +351,10 @@ func orchestratorSubCommands(cmd *cobra.Command) []*cobra.Command {
 func allManagementSubCommands(cmd *cobra.Command) []*cobra.Command {
 	cmds := []*cobra.Command{}
 	for _, sub := range cmd.Commands() {
-		if isPlugin(sub) {
-			if invalidPluginReason(sub) == "" {
-				cmds = append(cmds, sub)
-			}
+		if invalidPluginReason(sub) != "" {
 			continue
 		}
-		if sub.IsAvailableCommand() && sub.HasSubCommands() {
+		if sub.IsAvailableCommand() && (isPlugin(sub) || sub.HasSubCommands()) {
 			cmds = append(cmds, sub)
 		}
 	}

cli/cobra_test.go

@@ -56,6 +56,33 @@ func TestInvalidPlugin(t *testing.T) {
 	assert.DeepEqual(t, invalidPlugins(root), []*cobra.Command{sub1}, cmpopts.IgnoreUnexported(cobra.Command{}))
 }
 
+func TestHiddenPlugin(t *testing.T) {
+	root := &cobra.Command{Use: "root"}
+	sub1 := &cobra.Command{
+		Use:    "sub1",
+		Hidden: true,
+		Annotations: map[string]string{
+			metadata.CommandAnnotationPlugin: "true",
+		},
+		Run: func(cmd *cobra.Command, args []string) {},
+	}
+
+	sub1sub1 := &cobra.Command{Use: "sub1sub1"}
+	sub1sub2 := &cobra.Command{Use: "sub1sub2"}
+	sub2 := &cobra.Command{
+		Use: "sub2",
+		Annotations: map[string]string{
+			metadata.CommandAnnotationPlugin: "true",
+		},
+		Run: func(cmd *cobra.Command, args []string) {},
+	}
+
+	root.AddCommand(sub1, sub2)
+	sub1.AddCommand(sub1sub1, sub1sub2)
+
+	assert.DeepEqual(t, allManagementSubCommands(root), []*cobra.Command{sub2}, cmpopts.IgnoreFields(cobra.Command{}, "Run"), cmpopts.IgnoreUnexported(cobra.Command{}))
+}
+
 func TestCommandAliases(t *testing.T) {
 	root := &cobra.Command{Use: "root"}
 	sub := &cobra.Command{Use: "subcommand", Aliases: []string{"alias1", "alias2"}}

cli/command/checkpoint/client_test.go

@@ -8,23 +8,23 @@ import (
 
 type fakeClient struct {
 	client.Client
-	checkpointCreateFunc func(container string, options client.CheckpointCreateOptions) error
-	checkpointDeleteFunc func(container string, options client.CheckpointDeleteOptions) error
+	checkpointCreateFunc func(container string, options client.CheckpointCreateOptions) (client.CheckpointCreateResult, error)
+	checkpointDeleteFunc func(container string, options client.CheckpointRemoveOptions) (client.CheckpointRemoveResult, error)
 	checkpointListFunc   func(container string, options client.CheckpointListOptions) (client.CheckpointListResult, error)
 }
 
-func (cli *fakeClient) CheckpointCreate(_ context.Context, container string, options client.CheckpointCreateOptions) error {
+func (cli *fakeClient) CheckpointCreate(_ context.Context, container string, options client.CheckpointCreateOptions) (client.CheckpointCreateResult, error) {
 	if cli.checkpointCreateFunc != nil {
 		return cli.checkpointCreateFunc(container, options)
 	}
-	return nil
+	return client.CheckpointCreateResult{}, nil
 }
 
-func (cli *fakeClient) CheckpointDelete(_ context.Context, container string, options client.CheckpointDeleteOptions) error {
+func (cli *fakeClient) CheckpointRemove(_ context.Context, container string, options client.CheckpointRemoveOptions) (client.CheckpointRemoveResult, error) {
 	if cli.checkpointDeleteFunc != nil {
 		return cli.checkpointDeleteFunc(container, options)
 	}
-	return nil
+	return client.CheckpointRemoveResult{}, nil
 }
 
 func (cli *fakeClient) CheckpointList(_ context.Context, container string, options client.CheckpointListOptions) (client.CheckpointListResult, error) {

cli/command/checkpoint/create.go

@@ -41,7 +41,7 @@ func newCreateCommand(dockerCLI command.Cli) *cobra.Command {
 }
 
 func runCreate(ctx context.Context, dockerCLI command.Cli, opts createOptions) error {
-	err := dockerCLI.Client().CheckpointCreate(ctx, opts.container, client.CheckpointCreateOptions{
+	_, err := dockerCLI.Client().CheckpointCreate(ctx, opts.container, client.CheckpointCreateOptions{
 		CheckpointID:  opts.checkpoint,
 		CheckpointDir: opts.checkpointDir,
 		Exit:          !opts.leaveRunning,

cli/command/checkpoint/create_test.go

@@ -16,7 +16,7 @@ import (
 func TestCheckpointCreateErrors(t *testing.T) {
 	testCases := []struct {
 		args                 []string
-		checkpointCreateFunc func(container string, options client.CheckpointCreateOptions) error
+		checkpointCreateFunc func(container string, options client.CheckpointCreateOptions) (client.CheckpointCreateResult, error)
 		expectedError        string
 	}{
 		{
@@ -29,8 +29,8 @@ func TestCheckpointCreateErrors(t *testing.T) {
 		},
 		{
 			args: []string{"foo", "bar"},
-			checkpointCreateFunc: func(container string, options client.CheckpointCreateOptions) error {
-				return errors.New("error creating checkpoint for container foo")
+			checkpointCreateFunc: func(container string, options client.CheckpointCreateOptions) (client.CheckpointCreateResult, error) {
+				return client.CheckpointCreateResult{}, errors.New("error creating checkpoint for container foo")
 			},
 			expectedError: "error creating checkpoint for container foo",
 		},
@@ -61,10 +61,10 @@ func TestCheckpointCreateWithOptions(t *testing.T) {
 			var actualContainerName string
 			var actualOptions client.CheckpointCreateOptions
 			cli := test.NewFakeCli(&fakeClient{
-				checkpointCreateFunc: func(container string, options client.CheckpointCreateOptions) error {
+				checkpointCreateFunc: func(container string, options client.CheckpointCreateOptions) (client.CheckpointCreateResult, error) {
 					actualContainerName = container
 					actualOptions = options
-					return nil
+					return client.CheckpointCreateResult{}, nil
 				},
 			})
 			cmd := newCreateCommand(cli)

cli/command/checkpoint/list.go

@@ -48,5 +48,5 @@ func runList(ctx context.Context, dockerCLI command.Cli, container string, opts
 		Output: dockerCLI.Out(),
 		Format: newFormat(formatter.TableFormatKey),
 	}
-	return formatWrite(cpCtx, checkpoints.Checkpoints)
+	return formatWrite(cpCtx, checkpoints.Items)
 }

cli/command/checkpoint/list_test.go

@@ -55,7 +55,7 @@ func TestCheckpointListWithOptions(t *testing.T) {
 			containerID = container
 			checkpointDir = options.CheckpointDir
 			return client.CheckpointListResult{
-				Checkpoints: []checkpoint.Summary{
+				Items: []checkpoint.Summary{
 					{Name: "checkpoint-foo"},
 				},
 			}, nil
@@ -63,7 +63,7 @@ func TestCheckpointListWithOptions(t *testing.T) {
 	})
 	cmd := newListCommand(cli)
 	cmd.SetArgs([]string{"container-foo"})
-	cmd.Flags().Set("checkpoint-dir", "/dir/foo")
+	assert.Check(t, cmd.Flags().Set("checkpoint-dir", "/dir/foo"))
 	assert.NilError(t, cmd.Execute())
 	assert.Check(t, is.Equal("container-foo", containerID))
 	assert.Check(t, is.Equal("/dir/foo", checkpointDir))

cli/command/checkpoint/remove.go

@@ -1,8 +1,6 @@
 package checkpoint
 
 import (
-	"context"
-
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
 	"github.com/moby/moby/client"
@@ -22,7 +20,12 @@ func newRemoveCommand(dockerCLI command.Cli) *cobra.Command {
 		Short:   "Remove a checkpoint",
 		Args:    cli.ExactArgs(2),
 		RunE: func(cmd *cobra.Command, args []string) error {
-			return runRemove(cmd.Context(), dockerCLI, args[0], args[1], opts)
+			containerID, checkpointID := args[0], args[1]
+			_, err := dockerCLI.Client().CheckpointRemove(cmd.Context(), containerID, client.CheckpointRemoveOptions{
+				CheckpointID:  checkpointID,
+				CheckpointDir: opts.checkpointDir,
+			})
+			return err
 		},
 		DisableFlagsInUseLine: true,
 	}
@@ -32,10 +35,3 @@ func newRemoveCommand(dockerCLI command.Cli) *cobra.Command {
 
 	return cmd
 }
-
-func runRemove(ctx context.Context, dockerCli command.Cli, container string, checkpointID string, opts removeOptions) error {
-	return dockerCli.Client().CheckpointDelete(ctx, container, client.CheckpointDeleteOptions{
-		CheckpointID:  checkpointID,
-		CheckpointDir: opts.checkpointDir,
-	})
-}

cli/command/checkpoint/remove_test.go

@@ -14,7 +14,7 @@ import (
 func TestCheckpointRemoveErrors(t *testing.T) {
 	testCases := []struct {
 		args                 []string
-		checkpointDeleteFunc func(container string, options client.CheckpointDeleteOptions) error
+		checkpointDeleteFunc func(container string, options client.CheckpointRemoveOptions) (client.CheckpointRemoveResult, error)
 		expectedError        string
 	}{
 		{
@@ -27,8 +27,8 @@ func TestCheckpointRemoveErrors(t *testing.T) {
 		},
 		{
 			args: []string{"foo", "bar"},
-			checkpointDeleteFunc: func(container string, options client.CheckpointDeleteOptions) error {
-				return errors.New("error deleting checkpoint")
+			checkpointDeleteFunc: func(container string, options client.CheckpointRemoveOptions) (client.CheckpointRemoveResult, error) {
+				return client.CheckpointRemoveResult{}, errors.New("error deleting checkpoint")
 			},
 			expectedError: "error deleting checkpoint",
 		},
@@ -49,16 +49,16 @@ func TestCheckpointRemoveErrors(t *testing.T) {
 func TestCheckpointRemoveWithOptions(t *testing.T) {
 	var containerID, checkpointID, checkpointDir string
 	cli := test.NewFakeCli(&fakeClient{
-		checkpointDeleteFunc: func(container string, options client.CheckpointDeleteOptions) error {
+		checkpointDeleteFunc: func(container string, options client.CheckpointRemoveOptions) (client.CheckpointRemoveResult, error) {
 			containerID = container
 			checkpointID = options.CheckpointID
 			checkpointDir = options.CheckpointDir
-			return nil
+			return client.CheckpointRemoveResult{}, nil
 		},
 	})
 	cmd := newRemoveCommand(cli)
 	cmd.SetArgs([]string{"container-foo", "checkpoint-bar"})
-	cmd.Flags().Set("checkpoint-dir", "/dir/foo")
+	assert.Check(t, cmd.Flags().Set("checkpoint-dir", "/dir/foo"))
 	assert.NilError(t, cmd.Execute())
 	assert.Check(t, is.Equal("container-foo", containerID))
 	assert.Check(t, is.Equal("checkpoint-bar", checkpointID))

cli/command/cli.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.23
+//go:build go1.24
 
 package command
 
@@ -25,7 +25,6 @@ import (
 	"github.com/docker/cli/cli/version"
 	dopts "github.com/docker/cli/opts"
 	"github.com/moby/moby/api/types/build"
-	"github.com/moby/moby/api/types/swarm"
 	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
@@ -317,7 +316,7 @@ func newAPIClientFromEndpoint(ep docker.Endpoint, configFile *configfile.ConfigF
 		opts = append(opts, withCustomHeaders)
 	}
 	opts = append(opts, extraOpts...)
-	return client.NewClientWithOpts(opts...)
+	return client.New(opts...)
 }
 
 func resolveDockerEndpoint(s store.Reader, contextName string) (docker.Endpoint, error) {
@@ -378,24 +377,21 @@ func (cli *DockerCli) initializeFromClient() {
 	ctx, cancel := context.WithTimeout(cli.baseCtx, cli.getInitTimeout())
 	defer cancel()
 
-	ping, err := cli.client.Ping(ctx)
+	ping, err := cli.client.Ping(ctx, client.PingOptions{
+		NegotiateAPIVersion: true,
+		ForceNegotiate:      true,
+	})
 	if err != nil {
 		// Default to true if we fail to connect to daemon
 		cli.serverInfo = ServerInfo{HasExperimental: true}
-
-		if ping.APIVersion != "" {
-			cli.client.NegotiateAPIVersionPing(ping)
-		}
 		return
 	}
-
 	cli.serverInfo = ServerInfo{
 		HasExperimental: ping.Experimental,
 		OSType:          ping.OSType,
 		BuildkitVersion: ping.BuilderVersion,
 		SwarmStatus:     ping.SwarmStatus,
 	}
-	cli.client.NegotiateAPIVersionPing(ping)
 }
 
 // ContextStore returns the ContextStore
@@ -564,7 +560,7 @@ type ServerInfo struct {
 	// in the ping response, or if an error occurred, in which case the client
 	// should use other ways to get the current swarm status, such as the /swarm
 	// endpoint.
-	SwarmStatus *swarm.Status
+	SwarmStatus *client.SwarmStatus
 }
 
 // NewDockerCli returns a DockerCli instance with all operators applied on it.

cli/command/cli_test.go

@@ -20,7 +20,6 @@ import (
 	"github.com/docker/cli/cli/config/configfile"
 	"github.com/docker/cli/cli/context/store"
 	"github.com/docker/cli/cli/flags"
-	"github.com/moby/moby/api/types"
 	"github.com/moby/moby/client"
 	"gotest.tools/v3/assert"
 )
@@ -80,7 +79,7 @@ func TestNewAPIClientFromFlagsWithCustomHeaders(t *testing.T) {
 		"My-Header":  "Custom-Value",
 		"User-Agent": UserAgent(),
 	}
-	_, err = apiClient.Ping(context.Background())
+	_, err = apiClient.Ping(context.TODO(), client.PingOptions{})
 	assert.NilError(t, err)
 	assert.DeepEqual(t, received, expectedHeaders)
 }
@@ -115,14 +114,14 @@ func TestNewAPIClientFromFlagsWithCustomHeadersFromEnv(t *testing.T) {
 		"Four":       []string{"four-value-override"},
 		"User-Agent": []string{UserAgent()},
 	}
-	_, err = apiClient.Ping(context.Background())
+	_, err = apiClient.Ping(context.TODO(), client.PingOptions{})
 	assert.NilError(t, err)
 	assert.DeepEqual(t, received, expectedHeaders)
 }
 
 func TestNewAPIClientFromFlagsWithAPIVersionFromEnv(t *testing.T) {
-	const customVersion = "v3.3.3"
-	const expectedVersion = "3.3.3"
+	const customVersion = "v3.3"
+	const expectedVersion = "3.3"
 	t.Setenv("DOCKER_API_VERSION", customVersion)
 	t.Setenv("DOCKER_HOST", ":2375")
 
@@ -135,51 +134,55 @@ func TestNewAPIClientFromFlagsWithAPIVersionFromEnv(t *testing.T) {
 
 type fakeClient struct {
 	client.Client
-	pingFunc   func() (types.Ping, error)
+	pingFunc   func() (client.PingResult, error)
 	version    string
 	negotiated bool
 }
 
-func (c *fakeClient) Ping(_ context.Context) (types.Ping, error) {
-	return c.pingFunc()
+func (c *fakeClient) Ping(_ context.Context, options client.PingOptions) (client.PingResult, error) {
+	res, err := c.pingFunc()
+	if options.NegotiateAPIVersion {
+		if res.APIVersion != "" {
+			if c.negotiated || options.ForceNegotiate {
+				c.negotiated = true
+			}
+		}
+	}
+	return res, err
 }
 
 func (c *fakeClient) ClientVersion() string {
 	return c.version
 }
 
-func (c *fakeClient) NegotiateAPIVersionPing(types.Ping) {
-	c.negotiated = true
-}
-
 func TestInitializeFromClient(t *testing.T) {
 	const defaultVersion = "v1.55"
 
 	testcases := []struct {
 		doc            string
-		pingFunc       func() (types.Ping, error)
+		pingFunc       func() (client.PingResult, error)
 		expectedServer ServerInfo
 		negotiated     bool
 	}{
 		{
 			doc: "successful ping",
-			pingFunc: func() (types.Ping, error) {
-				return types.Ping{Experimental: true, OSType: "linux", APIVersion: "v1.44"}, nil
+			pingFunc: func() (client.PingResult, error) {
+				return client.PingResult{Experimental: true, OSType: "linux", APIVersion: "v1.44"}, nil
 			},
 			expectedServer: ServerInfo{HasExperimental: true, OSType: "linux"},
 			negotiated:     true,
 		},
 		{
 			doc: "failed ping, no API version",
-			pingFunc: func() (types.Ping, error) {
-				return types.Ping{}, errors.New("failed")
+			pingFunc: func() (client.PingResult, error) {
+				return client.PingResult{}, errors.New("failed")
 			},
 			expectedServer: ServerInfo{HasExperimental: true},
 		},
 		{
 			doc: "failed ping, with API version",
-			pingFunc: func() (types.Ping, error) {
-				return types.Ping{APIVersion: "v1.44"}, errors.New("failed")
+			pingFunc: func() (client.PingResult, error) {
+				return client.PingResult{APIVersion: "v1.44"}, errors.New("failed")
 			},
 			expectedServer: ServerInfo{HasExperimental: true},
 			negotiated:     true,
@@ -211,7 +214,7 @@ func TestInitializeFromClientHangs(t *testing.T) {
 	assert.NilError(t, err)
 
 	receiveReqCh := make(chan bool)
-	timeoutCtx, cancel := context.WithTimeout(context.Background(), time.Second)
+	timeoutCtx, cancel := context.WithTimeout(context.TODO(), time.Second)
 	defer cancel()
 
 	// Simulate a server that hangs on connections.
@@ -289,7 +292,7 @@ func TestNewDockerCliAndOperators(t *testing.T) {
 func TestInitializeShouldAlwaysCreateTheContextStore(t *testing.T) {
 	cli, err := NewDockerCli()
 	assert.NilError(t, err)
-	apiClient, err := client.NewClientWithOpts()
+	apiClient, err := client.New()
 	assert.NilError(t, err)
 	assert.NilError(t, cli.Initialize(flags.NewClientOptions(), WithAPIClient(apiClient)))
 	assert.Check(t, cli.ContextStore() != nil)
@@ -385,7 +388,7 @@ func TestNewDockerCliWithCustomUserAgent(t *testing.T) {
 	cli.options = opts
 	cli.configFile = &configfile.ConfigFile{}
 
-	_, err = cli.Client().Ping(context.Background())
+	_, err = cli.Client().Ping(context.TODO(), client.PingOptions{})
 	assert.NilError(t, err)
 	assert.DeepEqual(t, received, "fake-agent/0.0.1")
 }

cli/command/commands/commands.go

@@ -18,7 +18,6 @@ import (
 	_ "github.com/docker/cli/cli/command/stack"
 	_ "github.com/docker/cli/cli/command/swarm"
 	_ "github.com/docker/cli/cli/command/system"
-	_ "github.com/docker/cli/cli/command/trust"
 	_ "github.com/docker/cli/cli/command/volume"
 	"github.com/docker/cli/internal/commands"
 	"github.com/spf13/cobra"

cli/command/completion/functions.go

@@ -27,12 +27,12 @@ func ImageNames(dockerCLI APIClientProvider, limit int) cobra.CompletionFunc {
 		if limit > 0 && len(args) >= limit {
 			return nil, cobra.ShellCompDirectiveNoFileComp
 		}
-		list, err := dockerCLI.Client().ImageList(cmd.Context(), client.ImageListOptions{})
+		res, err := dockerCLI.Client().ImageList(cmd.Context(), client.ImageListOptions{})
 		if err != nil {
 			return nil, cobra.ShellCompDirectiveError
 		}
 		var names []string
-		for _, img := range list {
+		for _, img := range res.Items {
 			names = append(names, img.RepoTags...)
 		}
 		return names, cobra.ShellCompDirectiveNoFileComp
@@ -47,13 +47,13 @@ func ImageNamesWithBase(dockerCLI APIClientProvider, limit int) cobra.Completion
 		if limit > 0 && len(args) >= limit {
 			return nil, cobra.ShellCompDirectiveNoFileComp
 		}
-		list, err := dockerCLI.Client().ImageList(cmd.Context(), client.ImageListOptions{})
+		res, err := dockerCLI.Client().ImageList(cmd.Context(), client.ImageListOptions{})
 		if err != nil {
 			return nil, cobra.ShellCompDirectiveError
 		}
 		var names []string
 		baseNameCounts := make(map[string]int)
-		for _, img := range list {
+		for _, img := range res.Items {
 			names = append(names, img.RepoTags...)
 			for _, tag := range img.RepoTags {
 				ref, err := reference.ParseNormalizedNamed(tag)
@@ -77,7 +77,7 @@ func ImageNamesWithBase(dockerCLI APIClientProvider, limit int) cobra.Completion
 // Set DOCKER_COMPLETION_SHOW_CONTAINER_IDS=yes to also complete IDs.
 func ContainerNames(dockerCLI APIClientProvider, all bool, filters ...func(container.Summary) bool) cobra.CompletionFunc {
 	return func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
-		list, err := dockerCLI.Client().ContainerList(cmd.Context(), client.ContainerListOptions{
+		res, err := dockerCLI.Client().ContainerList(cmd.Context(), client.ContainerListOptions{
 			All: all,
 		})
 		if err != nil {
@@ -87,7 +87,7 @@ func ContainerNames(dockerCLI APIClientProvider, all bool, filters ...func(conta
 		showContainerIDs := os.Getenv("DOCKER_COMPLETION_SHOW_CONTAINER_IDS") == "yes"
 
 		var names []string
-		for _, ctr := range list {
+		for _, ctr := range res.Items {
 			skip := false
 			for _, fn := range filters {
 				if fn != nil && !fn(ctr) {
@@ -110,12 +110,12 @@ func ContainerNames(dockerCLI APIClientProvider, all bool, filters ...func(conta
 // VolumeNames offers completion for volumes
 func VolumeNames(dockerCLI APIClientProvider) cobra.CompletionFunc {
 	return func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
-		list, err := dockerCLI.Client().VolumeList(cmd.Context(), client.VolumeListOptions{})
+		res, err := dockerCLI.Client().VolumeList(cmd.Context(), client.VolumeListOptions{})
 		if err != nil {
 			return nil, cobra.ShellCompDirectiveError
 		}
 		var names []string
-		for _, vol := range list.Volumes {
+		for _, vol := range res.Items {
 			names = append(names, vol.Name)
 		}
 		return names, cobra.ShellCompDirectiveNoFileComp
@@ -125,12 +125,12 @@ func VolumeNames(dockerCLI APIClientProvider) cobra.CompletionFunc {
 // NetworkNames offers completion for networks
 func NetworkNames(dockerCLI APIClientProvider) cobra.CompletionFunc {
 	return func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
-		list, err := dockerCLI.Client().NetworkList(cmd.Context(), client.NetworkListOptions{})
+		res, err := dockerCLI.Client().NetworkList(cmd.Context(), client.NetworkListOptions{})
 		if err != nil {
 			return nil, cobra.ShellCompDirectiveError
 		}
 		var names []string
-		for _, nw := range list {
+		for _, nw := range res.Items {
 			names = append(names, nw.Name)
 		}
 		return names, cobra.ShellCompDirectiveNoFileComp

cli/command/completion/functions_test.go

@@ -28,38 +28,38 @@ func (c fakeCLI) Client() client.APIClient {
 
 type fakeClient struct {
 	client.Client
-	containerListFunc func(options client.ContainerListOptions) ([]container.Summary, error)
-	imageListFunc     func(options client.ImageListOptions) ([]image.Summary, error)
-	networkListFunc   func(ctx context.Context, options client.NetworkListOptions) ([]network.Summary, error)
-	volumeListFunc    func(filter client.Filters) (volume.ListResponse, error)
+	containerListFunc func(context.Context, client.ContainerListOptions) (client.ContainerListResult, error)
+	imageListFunc     func(context.Context, client.ImageListOptions) (client.ImageListResult, error)
+	networkListFunc   func(context.Context, client.NetworkListOptions) (client.NetworkListResult, error)
+	volumeListFunc    func(context.Context, client.VolumeListOptions) (client.VolumeListResult, error)
 }
 
-func (c *fakeClient) ContainerList(_ context.Context, options client.ContainerListOptions) ([]container.Summary, error) {
+func (c *fakeClient) ContainerList(ctx context.Context, options client.ContainerListOptions) (client.ContainerListResult, error) {
 	if c.containerListFunc != nil {
-		return c.containerListFunc(options)
+		return c.containerListFunc(ctx, options)
 	}
-	return []container.Summary{}, nil
+	return client.ContainerListResult{}, nil
 }
 
-func (c *fakeClient) ImageList(_ context.Context, options client.ImageListOptions) ([]image.Summary, error) {
+func (c *fakeClient) ImageList(ctx context.Context, options client.ImageListOptions) (client.ImageListResult, error) {
 	if c.imageListFunc != nil {
-		return c.imageListFunc(options)
+		return c.imageListFunc(ctx, options)
 	}
-	return []image.Summary{}, nil
+	return client.ImageListResult{}, nil
 }
 
-func (c *fakeClient) NetworkList(ctx context.Context, options client.NetworkListOptions) ([]network.Summary, error) {
+func (c *fakeClient) NetworkList(ctx context.Context, options client.NetworkListOptions) (client.NetworkListResult, error) {
 	if c.networkListFunc != nil {
 		return c.networkListFunc(ctx, options)
 	}
-	return []network.Summary{}, nil
+	return client.NetworkListResult{}, nil
 }
 
-func (c *fakeClient) VolumeList(_ context.Context, options client.VolumeListOptions) (volume.ListResponse, error) {
+func (c *fakeClient) VolumeList(ctx context.Context, options client.VolumeListOptions) (client.VolumeListResult, error) {
 	if c.volumeListFunc != nil {
-		return c.volumeListFunc(options.Filters)
+		return c.volumeListFunc(ctx, options)
 	}
-	return volume.ListResponse{}, nil
+	return client.VolumeListResult{}, nil
 }
 
 func TestCompleteContainerNames(t *testing.T) {
@@ -153,12 +153,12 @@ func TestCompleteContainerNames(t *testing.T) {
 				t.Setenv("DOCKER_COMPLETION_SHOW_CONTAINER_IDS", "yes")
 			}
 			comp := ContainerNames(fakeCLI{&fakeClient{
-				containerListFunc: func(opts client.ContainerListOptions) ([]container.Summary, error) {
+				containerListFunc: func(_ context.Context, opts client.ContainerListOptions) (client.ContainerListResult, error) {
 					assert.Check(t, is.DeepEqual(opts, tc.expOpts))
 					if tc.expDirective == cobra.ShellCompDirectiveError {
-						return nil, errors.New("some error occurred")
+						return client.ContainerListResult{}, errors.New("some error occurred")
 					}
-					return tc.containers, nil
+					return client.ContainerListResult{Items: tc.containers}, nil
 				},
 			}}, tc.showAll, tc.filters...)
 
@@ -226,11 +226,11 @@ func TestCompleteImageNames(t *testing.T) {
 	for _, tc := range tests {
 		t.Run(tc.doc, func(t *testing.T) {
 			comp := ImageNames(fakeCLI{&fakeClient{
-				imageListFunc: func(options client.ImageListOptions) ([]image.Summary, error) {
+				imageListFunc: func(context.Context, client.ImageListOptions) (client.ImageListResult, error) {
 					if tc.expDirective == cobra.ShellCompDirectiveError {
-						return nil, errors.New("some error occurred")
+						return client.ImageListResult{}, errors.New("some error occurred")
 					}
-					return tc.images, nil
+					return client.ImageListResult{Items: tc.images}, nil
 				},
 			}}, -1)
 
@@ -286,11 +286,11 @@ func TestCompleteNetworkNames(t *testing.T) {
 	for _, tc := range tests {
 		t.Run(tc.doc, func(t *testing.T) {
 			comp := NetworkNames(fakeCLI{&fakeClient{
-				networkListFunc: func(ctx context.Context, options client.NetworkListOptions) ([]network.Summary, error) {
+				networkListFunc: func(context.Context, client.NetworkListOptions) (client.NetworkListResult, error) {
 					if tc.expDirective == cobra.ShellCompDirectiveError {
-						return nil, errors.New("some error occurred")
+						return client.NetworkListResult{}, errors.New("some error occurred")
 					}
-					return tc.networks, nil
+					return client.NetworkListResult{Items: tc.networks}, nil
 				},
 			}})
 
@@ -310,7 +310,7 @@ func TestCompletePlatforms(t *testing.T) {
 func TestCompleteVolumeNames(t *testing.T) {
 	tests := []struct {
 		doc          string
-		volumes      []*volume.Volume
+		volumes      []volume.Volume
 		expOut       []string
 		expDirective cobra.ShellCompDirective
 	}{
@@ -320,7 +320,7 @@ func TestCompleteVolumeNames(t *testing.T) {
 		},
 		{
 			doc: "with results",
-			volumes: []*volume.Volume{
+			volumes: []volume.Volume{
 				{Name: "volume-c"},
 				{Name: "volume-b"},
 				{Name: "volume-a"},
@@ -337,11 +337,11 @@ func TestCompleteVolumeNames(t *testing.T) {
 	for _, tc := range tests {
 		t.Run(tc.doc, func(t *testing.T) {
 			comp := VolumeNames(fakeCLI{&fakeClient{
-				volumeListFunc: func(filter client.Filters) (volume.ListResponse, error) {
+				volumeListFunc: func(context.Context, client.VolumeListOptions) (client.VolumeListResult, error) {
 					if tc.expDirective == cobra.ShellCompDirectiveError {
-						return volume.ListResponse{}, errors.New("some error occurred")
+						return client.VolumeListResult{}, errors.New("some error occurred")
 					}
-					return volume.ListResponse{Volumes: tc.volumes}, nil
+					return client.VolumeListResult{Items: tc.volumes}, nil
 				},
 			}})
 

cli/command/config/client_test.go

@@ -3,42 +3,41 @@ package config
 import (
 	"context"
 
-	"github.com/moby/moby/api/types/swarm"
 	"github.com/moby/moby/client"
 )
 
 type fakeClient struct {
 	client.Client
-	configCreateFunc  func(context.Context, swarm.ConfigSpec) (swarm.ConfigCreateResponse, error)
-	configInspectFunc func(context.Context, string) (swarm.Config, []byte, error)
-	configListFunc    func(context.Context, client.ConfigListOptions) ([]swarm.Config, error)
-	configRemoveFunc  func(string) error
+	configCreateFunc  func(context.Context, client.ConfigCreateOptions) (client.ConfigCreateResult, error)
+	configInspectFunc func(context.Context, string, client.ConfigInspectOptions) (client.ConfigInspectResult, error)
+	configListFunc    func(context.Context, client.ConfigListOptions) (client.ConfigListResult, error)
+	configRemoveFunc  func(context.Context, string, client.ConfigRemoveOptions) (client.ConfigRemoveResult, error)
 }
 
-func (c *fakeClient) ConfigCreate(ctx context.Context, spec swarm.ConfigSpec) (swarm.ConfigCreateResponse, error) {
+func (c *fakeClient) ConfigCreate(ctx context.Context, options client.ConfigCreateOptions) (client.ConfigCreateResult, error) {
 	if c.configCreateFunc != nil {
-		return c.configCreateFunc(ctx, spec)
+		return c.configCreateFunc(ctx, options)
 	}
-	return swarm.ConfigCreateResponse{}, nil
+	return client.ConfigCreateResult{}, nil
 }
 
-func (c *fakeClient) ConfigInspectWithRaw(ctx context.Context, id string) (swarm.Config, []byte, error) {
+func (c *fakeClient) ConfigInspect(ctx context.Context, id string, options client.ConfigInspectOptions) (client.ConfigInspectResult, error) {
 	if c.configInspectFunc != nil {
-		return c.configInspectFunc(ctx, id)
+		return c.configInspectFunc(ctx, id, options)
 	}
-	return swarm.Config{}, nil, nil
+	return client.ConfigInspectResult{}, nil
 }
 
-func (c *fakeClient) ConfigList(ctx context.Context, options client.ConfigListOptions) ([]swarm.Config, error) {
+func (c *fakeClient) ConfigList(ctx context.Context, options client.ConfigListOptions) (client.ConfigListResult, error) {
 	if c.configListFunc != nil {
 		return c.configListFunc(ctx, options)
 	}
-	return []swarm.Config{}, nil
+	return client.ConfigListResult{}, nil
 }
 
-func (c *fakeClient) ConfigRemove(_ context.Context, name string) error {
+func (c *fakeClient) ConfigRemove(ctx context.Context, name string, options client.ConfigRemoveOptions) (client.ConfigRemoveResult, error) {
 	if c.configRemoveFunc != nil {
-		return c.configRemoveFunc(name)
+		return c.configRemoveFunc(ctx, name, options)
 	}
-	return nil
+	return client.ConfigRemoveResult{}, nil
 }

cli/command/config/cmd.go

@@ -38,12 +38,12 @@ func newConfigCommand(dockerCLI command.Cli) *cobra.Command {
 // completeNames offers completion for swarm configs
 func completeNames(dockerCLI completion.APIClientProvider) cobra.CompletionFunc {
 	return func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
-		list, err := dockerCLI.Client().ConfigList(cmd.Context(), client.ConfigListOptions{})
+		res, err := dockerCLI.Client().ConfigList(cmd.Context(), client.ConfigListOptions{})
 		if err != nil {
 			return nil, cobra.ShellCompDirectiveError
 		}
 		var names []string
-		for _, config := range list {
+		for _, config := range res.Items {
 			names = append(names, config.ID)
 		}
 		return names, cobra.ShellCompDirectiveNoFileComp

cli/command/config/create.go

@@ -10,6 +10,7 @@ import (
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/opts"
 	"github.com/moby/moby/api/types/swarm"
+	"github.com/moby/moby/client"
 	"github.com/moby/sys/sequential"
 	"github.com/spf13/cobra"
 )
@@ -84,7 +85,9 @@ func runCreate(ctx context.Context, dockerCLI command.Cli, options createOptions
 			Name: options.templateDriver,
 		}
 	}
-	r, err := apiClient.ConfigCreate(ctx, spec)
+	r, err := apiClient.ConfigCreate(ctx, client.ConfigCreateOptions{
+		Spec: spec,
+	})
 	if err != nil {
 		return err
 	}

cli/command/config/create_test.go

@@ -13,6 +13,7 @@ import (
 
 	"github.com/docker/cli/internal/test"
 	"github.com/moby/moby/api/types/swarm"
+	"github.com/moby/moby/client"
 	"gotest.tools/v3/assert"
 	is "gotest.tools/v3/assert/cmp"
 	"gotest.tools/v3/golden"
@@ -23,7 +24,7 @@ const configDataFile = "config-create-with-name.golden"
 func TestConfigCreateErrors(t *testing.T) {
 	testCases := []struct {
 		args             []string
-		configCreateFunc func(context.Context, swarm.ConfigSpec) (swarm.ConfigCreateResponse, error)
+		configCreateFunc func(context.Context, client.ConfigCreateOptions) (client.ConfigCreateResult, error)
 		expectedError    string
 	}{
 		{
@@ -36,8 +37,8 @@ func TestConfigCreateErrors(t *testing.T) {
 		},
 		{
 			args: []string{"name", filepath.Join("testdata", configDataFile)},
-			configCreateFunc: func(_ context.Context, configSpec swarm.ConfigSpec) (swarm.ConfigCreateResponse, error) {
-				return swarm.ConfigCreateResponse{}, errors.New("error creating config")
+			configCreateFunc: func(_ context.Context, options client.ConfigCreateOptions) (client.ConfigCreateResult, error) {
+				return client.ConfigCreateResult{}, errors.New("error creating config")
 			},
 			expectedError: "error creating config",
 		},
@@ -61,15 +62,15 @@ func TestConfigCreateWithName(t *testing.T) {
 	const name = "config-with-name"
 	var actual []byte
 	cli := test.NewFakeCli(&fakeClient{
-		configCreateFunc: func(_ context.Context, spec swarm.ConfigSpec) (swarm.ConfigCreateResponse, error) {
-			if spec.Name != name {
-				return swarm.ConfigCreateResponse{}, fmt.Errorf("expected name %q, got %q", name, spec.Name)
+		configCreateFunc: func(_ context.Context, options client.ConfigCreateOptions) (client.ConfigCreateResult, error) {
+			if options.Spec.Name != name {
+				return client.ConfigCreateResult{}, fmt.Errorf("expected name %q, got %q", name, options.Spec.Name)
 			}
 
-			actual = spec.Data
+			actual = options.Spec.Data
 
-			return swarm.ConfigCreateResponse{
-				ID: "ID-" + spec.Name,
+			return client.ConfigCreateResult{
+				ID: "ID-" + options.Spec.Name,
 			}, nil
 		},
 	})
@@ -100,13 +101,13 @@ func TestConfigCreateWithLabels(t *testing.T) {
 	}
 
 	cli := test.NewFakeCli(&fakeClient{
-		configCreateFunc: func(_ context.Context, spec swarm.ConfigSpec) (swarm.ConfigCreateResponse, error) {
-			if !reflect.DeepEqual(spec, expected) {
-				return swarm.ConfigCreateResponse{}, fmt.Errorf("expected %+v, got %+v", expected, spec)
+		configCreateFunc: func(_ context.Context, options client.ConfigCreateOptions) (client.ConfigCreateResult, error) {
+			if !reflect.DeepEqual(options.Spec, expected) {
+				return client.ConfigCreateResult{}, fmt.Errorf("expected %+v, got %+v", expected, options.Spec)
 			}
 
-			return swarm.ConfigCreateResponse{
-				ID: "ID-" + spec.Name,
+			return client.ConfigCreateResult{
+				ID: "ID-" + options.Spec.Name,
 			}, nil
 		},
 	})
@@ -126,17 +127,17 @@ func TestConfigCreateWithTemplatingDriver(t *testing.T) {
 	const name = "config-with-template-driver"
 
 	cli := test.NewFakeCli(&fakeClient{
-		configCreateFunc: func(_ context.Context, spec swarm.ConfigSpec) (swarm.ConfigCreateResponse, error) {
-			if spec.Name != name {
-				return swarm.ConfigCreateResponse{}, fmt.Errorf("expected name %q, got %q", name, spec.Name)
+		configCreateFunc: func(_ context.Context, options client.ConfigCreateOptions) (client.ConfigCreateResult, error) {
+			if options.Spec.Name != name {
+				return client.ConfigCreateResult{}, fmt.Errorf("expected name %q, got %q", name, options.Spec.Name)
 			}
 
-			if spec.Templating.Name != expectedDriver.Name {
-				return swarm.ConfigCreateResponse{}, fmt.Errorf("expected driver %v, got %v", expectedDriver, spec.Labels)
+			if options.Spec.Templating.Name != expectedDriver.Name {
+				return client.ConfigCreateResult{}, fmt.Errorf("expected driver %v, got %v", expectedDriver, options.Spec.Labels)
 			}
 
-			return swarm.ConfigCreateResponse{
-				ID: "ID-" + spec.Name,
+			return client.ConfigCreateResult{
+				ID: "ID-" + options.Spec.Name,
 			}, nil
 		},
 	})

cli/command/config/formatter.go

@@ -9,6 +9,7 @@ import (
 	"github.com/docker/cli/cli/command/inspect"
 	"github.com/docker/go-units"
 	"github.com/moby/moby/api/types/swarm"
+	"github.com/moby/moby/client"
 )
 
 const (
@@ -44,7 +45,7 @@ func newFormat(source string, quiet bool) formatter.Format {
 }
 
 // formatWrite writes the context
-func formatWrite(fmtCtx formatter.Context, configs []swarm.Config) error {
+func formatWrite(fmtCtx formatter.Context, configs client.ConfigListResult) error {
 	cCtx := &configContext{
 		HeaderContext: formatter.HeaderContext{
 			Header: formatter.SubHeaderContext{
@@ -57,7 +58,7 @@ func formatWrite(fmtCtx formatter.Context, configs []swarm.Config) error {
 		},
 	}
 	return fmtCtx.Write(cCtx, func(format func(subContext formatter.SubContext) error) error {
-		for _, config := range configs {
+		for _, config := range configs.Items {
 			configCtx := &configContext{c: config}
 			if err := format(configCtx); err != nil {
 				return err

cli/command/config/formatter_test.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/docker/cli/cli/command/formatter"
 	"github.com/moby/moby/api/types/swarm"
+	"github.com/moby/moby/client"
 	"gotest.tools/v3/assert"
 )
 
@@ -48,23 +49,25 @@ id_rsa
 		},
 	}
 
-	configs := []swarm.Config{
-		{
-			ID:   "1",
-			Meta: swarm.Meta{CreatedAt: time.Now(), UpdatedAt: time.Now()},
-			Spec: swarm.ConfigSpec{Annotations: swarm.Annotations{Name: "passwords"}},
-		},
-		{
-			ID:   "2",
-			Meta: swarm.Meta{CreatedAt: time.Now(), UpdatedAt: time.Now()},
-			Spec: swarm.ConfigSpec{Annotations: swarm.Annotations{Name: "id_rsa"}},
+	res := client.ConfigListResult{
+		Items: []swarm.Config{
+			{
+				ID:   "1",
+				Meta: swarm.Meta{CreatedAt: time.Now(), UpdatedAt: time.Now()},
+				Spec: swarm.ConfigSpec{Annotations: swarm.Annotations{Name: "passwords"}},
+			},
+			{
+				ID:   "2",
+				Meta: swarm.Meta{CreatedAt: time.Now(), UpdatedAt: time.Now()},
+				Spec: swarm.ConfigSpec{Annotations: swarm.Annotations{Name: "id_rsa"}},
+			},
 		},
 	}
 	for _, tc := range cases {
 		t.Run(string(tc.context.Format), func(t *testing.T) {
 			var out bytes.Buffer
 			tc.context.Output = &out
-			if err := formatWrite(tc.context, configs); err != nil {
+			if err := formatWrite(tc.context, res); err != nil {
 				assert.ErrorContains(t, err, tc.expected)
 			} else {
 				assert.Equal(t, out.String(), tc.expected)

cli/command/config/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.23
+//go:build go1.24
 
 package config
 
@@ -12,6 +12,7 @@ import (
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/cli/command/formatter"
 	flagsHelper "github.com/docker/cli/cli/flags"
+	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
 
@@ -50,7 +51,8 @@ func runInspect(ctx context.Context, dockerCLI command.Cli, opts inspectOptions)
 	}
 
 	getRef := func(id string) (any, []byte, error) {
-		return apiClient.ConfigInspectWithRaw(ctx, id)
+		res, err := apiClient.ConfigInspect(ctx, id, client.ConfigInspectOptions{})
+		return res.Config, res.Raw, err
 	}
 
 	// check if the user is trying to apply a template to the pretty format, which

cli/command/config/inspect_test.go

@@ -10,7 +10,7 @@ import (
 
 	"github.com/docker/cli/internal/test"
 	"github.com/docker/cli/internal/test/builders"
-	"github.com/moby/moby/api/types/swarm"
+	"github.com/moby/moby/client"
 	"gotest.tools/v3/assert"
 	"gotest.tools/v3/golden"
 )
@@ -19,7 +19,7 @@ func TestConfigInspectErrors(t *testing.T) {
 	testCases := []struct {
 		args              []string
 		flags             map[string]string
-		configInspectFunc func(_ context.Context, configID string) (swarm.Config, []byte, error)
+		configInspectFunc func(_ context.Context, configID string, _ client.ConfigInspectOptions) (client.ConfigInspectResult, error)
 		expectedError     string
 	}{
 		{
@@ -27,8 +27,8 @@ func TestConfigInspectErrors(t *testing.T) {
 		},
 		{
 			args: []string{"foo"},
-			configInspectFunc: func(_ context.Context, configID string) (swarm.Config, []byte, error) {
-				return swarm.Config{}, nil, errors.New("error while inspecting the config")
+			configInspectFunc: func(context.Context, string, client.ConfigInspectOptions) (client.ConfigInspectResult, error) {
+				return client.ConfigInspectResult{}, errors.New("error while inspecting the config")
 			},
 			expectedError: "error while inspecting the config",
 		},
@@ -41,11 +41,13 @@ func TestConfigInspectErrors(t *testing.T) {
 		},
 		{
 			args: []string{"foo", "bar"},
-			configInspectFunc: func(_ context.Context, configID string) (swarm.Config, []byte, error) {
+			configInspectFunc: func(_ context.Context, configID string, _ client.ConfigInspectOptions) (client.ConfigInspectResult, error) {
 				if configID == "foo" {
-					return *builders.Config(builders.ConfigName("foo")), nil, nil
+					return client.ConfigInspectResult{
+						Config: *builders.Config(builders.ConfigName("foo")),
+					}, nil
 				}
-				return swarm.Config{}, nil, errors.New("error while inspecting the config")
+				return client.ConfigInspectResult{}, errors.New("error while inspecting the config")
 			},
 			expectedError: "error while inspecting the config",
 		},
@@ -70,25 +72,34 @@ func TestConfigInspectWithoutFormat(t *testing.T) {
 	testCases := []struct {
 		name              string
 		args              []string
-		configInspectFunc func(_ context.Context, configID string) (swarm.Config, []byte, error)
+		configInspectFunc func(_ context.Context, configID string, _ client.ConfigInspectOptions) (client.ConfigInspectResult, error)
 	}{
 		{
 			name: "single-config",
 			args: []string{"foo"},
-			configInspectFunc: func(_ context.Context, name string) (swarm.Config, []byte, error) {
+			configInspectFunc: func(_ context.Context, name string, _ client.ConfigInspectOptions) (client.ConfigInspectResult, error) {
 				if name != "foo" {
-					return swarm.Config{}, nil, fmt.Errorf("invalid name, expected %s, got %s", "foo", name)
+					return client.ConfigInspectResult{}, fmt.Errorf("invalid name, expected %s, got %s", "foo", name)
 				}
-				return *builders.Config(builders.ConfigID("ID-foo"), builders.ConfigName("foo")), nil, nil
+				return client.ConfigInspectResult{
+					Config: *builders.Config(
+						builders.ConfigID("ID-foo"),
+						builders.ConfigName("foo"),
+					),
+				}, nil
 			},
 		},
 		{
 			name: "multiple-configs-with-labels",
 			args: []string{"foo", "bar"},
-			configInspectFunc: func(_ context.Context, name string) (swarm.Config, []byte, error) {
-				return *builders.Config(builders.ConfigID("ID-"+name), builders.ConfigName(name), builders.ConfigLabels(map[string]string{
-					"label1": "label-foo",
-				})), nil, nil
+			configInspectFunc: func(_ context.Context, name string, _ client.ConfigInspectOptions) (client.ConfigInspectResult, error) {
+				return client.ConfigInspectResult{
+					Config: *builders.Config(
+						builders.ConfigID("ID-"+name),
+						builders.ConfigName(name),
+						builders.ConfigLabels(map[string]string{"label1": "label-foo"}),
+					),
+				}, nil
 			},
 		},
 	}
@@ -102,16 +113,19 @@ func TestConfigInspectWithoutFormat(t *testing.T) {
 }
 
 func TestConfigInspectWithFormat(t *testing.T) {
-	configInspectFunc := func(_ context.Context, name string) (swarm.Config, []byte, error) {
-		return *builders.Config(builders.ConfigName("foo"), builders.ConfigLabels(map[string]string{
-			"label1": "label-foo",
-		})), nil, nil
+	configInspectFunc := func(_ context.Context, name string, _ client.ConfigInspectOptions) (client.ConfigInspectResult, error) {
+		return client.ConfigInspectResult{
+			Config: *builders.Config(
+				builders.ConfigName("foo"),
+				builders.ConfigLabels(map[string]string{"label1": "label-foo"}),
+			),
+		}, nil
 	}
 	testCases := []struct {
 		name              string
 		format            string
 		args              []string
-		configInspectFunc func(_ context.Context, name string) (swarm.Config, []byte, error)
+		configInspectFunc func(_ context.Context, name string, _ client.ConfigInspectOptions) (client.ConfigInspectResult, error)
 	}{
 		{
 			name:              "simple-template",
@@ -141,21 +155,23 @@ func TestConfigInspectWithFormat(t *testing.T) {
 func TestConfigInspectPretty(t *testing.T) {
 	testCases := []struct {
 		name              string
-		configInspectFunc func(context.Context, string) (swarm.Config, []byte, error)
+		configInspectFunc func(context.Context, string, client.ConfigInspectOptions) (client.ConfigInspectResult, error)
 	}{
 		{
 			name: "simple",
-			configInspectFunc: func(_ context.Context, id string) (swarm.Config, []byte, error) {
-				return *builders.Config(
-					builders.ConfigLabels(map[string]string{
-						"lbl1": "value1",
-					}),
-					builders.ConfigID("configID"),
-					builders.ConfigName("configName"),
-					builders.ConfigCreatedAt(time.Time{}),
-					builders.ConfigUpdatedAt(time.Time{}),
-					builders.ConfigData([]byte("payload here")),
-				), []byte{}, nil
+			configInspectFunc: func(_ context.Context, id string, _ client.ConfigInspectOptions) (client.ConfigInspectResult, error) {
+				return client.ConfigInspectResult{
+					Config: *builders.Config(
+						builders.ConfigLabels(map[string]string{
+							"lbl1": "value1",
+						}),
+						builders.ConfigID("configID"),
+						builders.ConfigName("configName"),
+						builders.ConfigCreatedAt(time.Time{}),
+						builders.ConfigUpdatedAt(time.Time{}),
+						builders.ConfigData([]byte("payload here")),
+					),
+				}, nil
 			},
 		},
 	}

cli/command/config/ls.go

@@ -48,7 +48,7 @@ func newConfigListCommand(dockerCLI command.Cli) *cobra.Command {
 func runList(ctx context.Context, dockerCLI command.Cli, options listOptions) error {
 	apiClient := dockerCLI.Client()
 
-	configs, err := apiClient.ConfigList(ctx, client.ConfigListOptions{Filters: options.filter.Value()})
+	res, err := apiClient.ConfigList(ctx, client.ConfigListOptions{Filters: options.filter.Value()})
 	if err != nil {
 		return err
 	}
@@ -62,13 +62,13 @@ func runList(ctx context.Context, dockerCLI command.Cli, options listOptions) er
 		}
 	}
 
-	sort.Slice(configs, func(i, j int) bool {
-		return sortorder.NaturalLess(configs[i].Spec.Name, configs[j].Spec.Name)
+	sort.Slice(res.Items, func(i, j int) bool {
+		return sortorder.NaturalLess(res.Items[i].Spec.Name, res.Items[j].Spec.Name)
 	})
 
 	configCtx := formatter.Context{
 		Output: dockerCLI.Out(),
 		Format: newFormat(format, options.quiet),
 	}
-	return formatWrite(configCtx, configs)
+	return formatWrite(configCtx, res)
 }

cli/command/config/ls_test.go

@@ -19,7 +19,7 @@ import (
 func TestConfigListErrors(t *testing.T) {
 	testCases := []struct {
 		args           []string
-		configListFunc func(context.Context, client.ConfigListOptions) ([]swarm.Config, error)
+		configListFunc func(context.Context, client.ConfigListOptions) (client.ConfigListResult, error)
 		expectedError  string
 	}{
 		{
@@ -27,8 +27,8 @@ func TestConfigListErrors(t *testing.T) {
 			expectedError: "accepts no argument",
 		},
 		{
-			configListFunc: func(_ context.Context, options client.ConfigListOptions) ([]swarm.Config, error) {
-				return []swarm.Config{}, errors.New("error listing configs")
+			configListFunc: func(_ context.Context, options client.ConfigListOptions) (client.ConfigListResult, error) {
+				return client.ConfigListResult{}, errors.New("error listing configs")
 			},
 			expectedError: "error listing configs",
 		},
@@ -48,26 +48,28 @@ func TestConfigListErrors(t *testing.T) {
 
 func TestConfigList(t *testing.T) {
 	cli := test.NewFakeCli(&fakeClient{
-		configListFunc: func(_ context.Context, options client.ConfigListOptions) ([]swarm.Config, error) {
-			return []swarm.Config{
-				*builders.Config(builders.ConfigID("ID-1-foo"),
-					builders.ConfigName("1-foo"),
-					builders.ConfigVersion(swarm.Version{Index: 10}),
-					builders.ConfigCreatedAt(time.Now().Add(-2*time.Hour)),
-					builders.ConfigUpdatedAt(time.Now().Add(-1*time.Hour)),
-				),
-				*builders.Config(builders.ConfigID("ID-10-foo"),
-					builders.ConfigName("10-foo"),
-					builders.ConfigVersion(swarm.Version{Index: 11}),
-					builders.ConfigCreatedAt(time.Now().Add(-2*time.Hour)),
-					builders.ConfigUpdatedAt(time.Now().Add(-1*time.Hour)),
-				),
-				*builders.Config(builders.ConfigID("ID-2-foo"),
-					builders.ConfigName("2-foo"),
-					builders.ConfigVersion(swarm.Version{Index: 11}),
-					builders.ConfigCreatedAt(time.Now().Add(-2*time.Hour)),
-					builders.ConfigUpdatedAt(time.Now().Add(-1*time.Hour)),
-				),
+		configListFunc: func(_ context.Context, options client.ConfigListOptions) (client.ConfigListResult, error) {
+			return client.ConfigListResult{
+				Items: []swarm.Config{
+					*builders.Config(builders.ConfigID("ID-1-foo"),
+						builders.ConfigName("1-foo"),
+						builders.ConfigVersion(swarm.Version{Index: 10}),
+						builders.ConfigCreatedAt(time.Now().Add(-2*time.Hour)),
+						builders.ConfigUpdatedAt(time.Now().Add(-1*time.Hour)),
+					),
+					*builders.Config(builders.ConfigID("ID-10-foo"),
+						builders.ConfigName("10-foo"),
+						builders.ConfigVersion(swarm.Version{Index: 11}),
+						builders.ConfigCreatedAt(time.Now().Add(-2*time.Hour)),
+						builders.ConfigUpdatedAt(time.Now().Add(-1*time.Hour)),
+					),
+					*builders.Config(builders.ConfigID("ID-2-foo"),
+						builders.ConfigName("2-foo"),
+						builders.ConfigVersion(swarm.Version{Index: 11}),
+						builders.ConfigCreatedAt(time.Now().Add(-2*time.Hour)),
+						builders.ConfigUpdatedAt(time.Now().Add(-1*time.Hour)),
+					),
+				},
 			}, nil
 		},
 	})
@@ -78,12 +80,14 @@ func TestConfigList(t *testing.T) {
 
 func TestConfigListWithQuietOption(t *testing.T) {
 	cli := test.NewFakeCli(&fakeClient{
-		configListFunc: func(_ context.Context, options client.ConfigListOptions) ([]swarm.Config, error) {
-			return []swarm.Config{
-				*builders.Config(builders.ConfigID("ID-foo"), builders.ConfigName("foo")),
-				*builders.Config(builders.ConfigID("ID-bar"), builders.ConfigName("bar"), builders.ConfigLabels(map[string]string{
-					"label": "label-bar",
-				})),
+		configListFunc: func(_ context.Context, options client.ConfigListOptions) (client.ConfigListResult, error) {
+			return client.ConfigListResult{
+				Items: []swarm.Config{
+					*builders.Config(builders.ConfigID("ID-foo"), builders.ConfigName("foo")),
+					*builders.Config(builders.ConfigID("ID-bar"), builders.ConfigName("bar"), builders.ConfigLabels(map[string]string{
+						"label": "label-bar",
+					})),
+				},
 			}, nil
 		},
 	})
@@ -95,12 +99,14 @@ func TestConfigListWithQuietOption(t *testing.T) {
 
 func TestConfigListWithConfigFormat(t *testing.T) {
 	cli := test.NewFakeCli(&fakeClient{
-		configListFunc: func(_ context.Context, options client.ConfigListOptions) ([]swarm.Config, error) {
-			return []swarm.Config{
-				*builders.Config(builders.ConfigID("ID-foo"), builders.ConfigName("foo")),
-				*builders.Config(builders.ConfigID("ID-bar"), builders.ConfigName("bar"), builders.ConfigLabels(map[string]string{
-					"label": "label-bar",
-				})),
+		configListFunc: func(_ context.Context, options client.ConfigListOptions) (client.ConfigListResult, error) {
+			return client.ConfigListResult{
+				Items: []swarm.Config{
+					*builders.Config(builders.ConfigID("ID-foo"), builders.ConfigName("foo")),
+					*builders.Config(builders.ConfigID("ID-bar"), builders.ConfigName("bar"), builders.ConfigLabels(map[string]string{
+						"label": "label-bar",
+					})),
+				},
 			}, nil
 		},
 	})
@@ -114,12 +120,14 @@ func TestConfigListWithConfigFormat(t *testing.T) {
 
 func TestConfigListWithFormat(t *testing.T) {
 	cli := test.NewFakeCli(&fakeClient{
-		configListFunc: func(_ context.Context, options client.ConfigListOptions) ([]swarm.Config, error) {
-			return []swarm.Config{
-				*builders.Config(builders.ConfigID("ID-foo"), builders.ConfigName("foo")),
-				*builders.Config(builders.ConfigID("ID-bar"), builders.ConfigName("bar"), builders.ConfigLabels(map[string]string{
-					"label": "label-bar",
-				})),
+		configListFunc: func(_ context.Context, options client.ConfigListOptions) (client.ConfigListResult, error) {
+			return client.ConfigListResult{
+				Items: []swarm.Config{
+					*builders.Config(builders.ConfigID("ID-foo"), builders.ConfigName("foo")),
+					*builders.Config(builders.ConfigID("ID-bar"), builders.ConfigName("bar"), builders.ConfigLabels(map[string]string{
+						"label": "label-bar",
+					})),
+				},
 			}, nil
 		},
 	})
@@ -131,22 +139,24 @@ func TestConfigListWithFormat(t *testing.T) {
 
 func TestConfigListWithFilter(t *testing.T) {
 	cli := test.NewFakeCli(&fakeClient{
-		configListFunc: func(_ context.Context, options client.ConfigListOptions) ([]swarm.Config, error) {
+		configListFunc: func(_ context.Context, options client.ConfigListOptions) (client.ConfigListResult, error) {
 			assert.Check(t, options.Filters["name"]["foo"])
 			assert.Check(t, options.Filters["label"]["lbl1=Label-bar"])
-			return []swarm.Config{
-				*builders.Config(builders.ConfigID("ID-foo"),
-					builders.ConfigName("foo"),
-					builders.ConfigVersion(swarm.Version{Index: 10}),
-					builders.ConfigCreatedAt(time.Now().Add(-2*time.Hour)),
-					builders.ConfigUpdatedAt(time.Now().Add(-1*time.Hour)),
-				),
-				*builders.Config(builders.ConfigID("ID-bar"),
-					builders.ConfigName("bar"),
-					builders.ConfigVersion(swarm.Version{Index: 11}),
-					builders.ConfigCreatedAt(time.Now().Add(-2*time.Hour)),
-					builders.ConfigUpdatedAt(time.Now().Add(-1*time.Hour)),
-				),
+			return client.ConfigListResult{
+				Items: []swarm.Config{
+					*builders.Config(builders.ConfigID("ID-foo"),
+						builders.ConfigName("foo"),
+						builders.ConfigVersion(swarm.Version{Index: 10}),
+						builders.ConfigCreatedAt(time.Now().Add(-2*time.Hour)),
+						builders.ConfigUpdatedAt(time.Now().Add(-1*time.Hour)),
+					),
+					*builders.Config(builders.ConfigID("ID-bar"),
+						builders.ConfigName("bar"),
+						builders.ConfigVersion(swarm.Version{Index: 11}),
+						builders.ConfigCreatedAt(time.Now().Add(-2*time.Hour)),
+						builders.ConfigUpdatedAt(time.Now().Add(-1*time.Hour)),
+					),
+				},
 			}, nil
 		},
 	})

cli/command/config/remove.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
+	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
 
@@ -30,7 +31,7 @@ func runRemove(ctx context.Context, dockerCLI command.Cli, names []string) error
 
 	var errs []error
 	for _, name := range names {
-		if err := apiClient.ConfigRemove(ctx, name); err != nil {
+		if _, err := apiClient.ConfigRemove(ctx, name, client.ConfigRemoveOptions{}); err != nil {
 			errs = append(errs, err)
 			continue
 		}

cli/command/config/remove_test.go

@@ -1,12 +1,14 @@
 package config
 
 import (
+	"context"
 	"errors"
 	"io"
 	"strings"
 	"testing"
 
 	"github.com/docker/cli/internal/test"
+	"github.com/moby/moby/client"
 	"gotest.tools/v3/assert"
 	is "gotest.tools/v3/assert/cmp"
 )
@@ -14,7 +16,7 @@ import (
 func TestConfigRemoveErrors(t *testing.T) {
 	testCases := []struct {
 		args             []string
-		configRemoveFunc func(string) error
+		configRemoveFunc func(context.Context, string, client.ConfigRemoveOptions) (client.ConfigRemoveResult, error)
 		expectedError    string
 	}{
 		{
@@ -23,8 +25,8 @@ func TestConfigRemoveErrors(t *testing.T) {
 		},
 		{
 			args: []string{"foo"},
-			configRemoveFunc: func(name string) error {
-				return errors.New("error removing config")
+			configRemoveFunc: func(ctx context.Context, name string, options client.ConfigRemoveOptions) (client.ConfigRemoveResult, error) {
+				return client.ConfigRemoveResult{}, errors.New("error removing config")
 			},
 			expectedError: "error removing config",
 		},
@@ -46,9 +48,9 @@ func TestConfigRemoveWithName(t *testing.T) {
 	names := []string{"foo", "bar"}
 	var removedConfigs []string
 	cli := test.NewFakeCli(&fakeClient{
-		configRemoveFunc: func(name string) error {
+		configRemoveFunc: func(_ context.Context, name string, _ client.ConfigRemoveOptions) (client.ConfigRemoveResult, error) {
 			removedConfigs = append(removedConfigs, name)
-			return nil
+			return client.ConfigRemoveResult{}, nil
 		},
 	})
 	cmd := newConfigRemoveCommand(cli)
@@ -63,12 +65,12 @@ func TestConfigRemoveContinueAfterError(t *testing.T) {
 	var removedConfigs []string
 
 	cli := test.NewFakeCli(&fakeClient{
-		configRemoveFunc: func(name string) error {
+		configRemoveFunc: func(_ context.Context, name string, _ client.ConfigRemoveOptions) (client.ConfigRemoveResult, error) {
 			removedConfigs = append(removedConfigs, name)
 			if name == "foo" {
-				return errors.New("error removing config: " + name)
+				return client.ConfigRemoveResult{}, errors.New("error removing config: " + name)
 			}
-			return nil
+			return client.ConfigRemoveResult{}, nil
 		},
 	})
 

cli/command/container/attach.go

@@ -23,21 +23,21 @@ type AttachOptions struct {
 }
 
 func inspectContainerAndCheckState(ctx context.Context, apiClient client.APIClient, args string) (*container.InspectResponse, error) {
-	c, err := apiClient.ContainerInspect(ctx, args)
+	c, err := apiClient.ContainerInspect(ctx, args, client.ContainerInspectOptions{})
 	if err != nil {
 		return nil, err
 	}
-	if !c.State.Running {
+	if !c.Container.State.Running {
 		return nil, errors.New("cannot attach to a stopped container, start it first")
 	}
-	if c.State.Paused {
+	if c.Container.State.Paused {
 		return nil, errors.New("cannot attach to a paused container, unpause it first")
 	}
-	if c.State.Restarting {
+	if c.Container.State.Restarting {
 		return nil, errors.New("cannot attach to a restarting container, wait until it is running")
 	}
 
-	return &c, nil
+	return &c.Container, nil
 }
 
 // newAttachCommand creates a new cobra.Command for `docker attach`
@@ -74,7 +74,7 @@ func RunAttach(ctx context.Context, dockerCLI command.Cli, containerID string, o
 
 	// request channel to wait for client
 	waitCtx := context.WithoutCancel(ctx)
-	resultC, errC := apiClient.ContainerWait(waitCtx, containerID, "")
+	waitRes := apiClient.ContainerWait(waitCtx, containerID, client.ContainerWaitOptions{})
 
 	c, err := inspectContainerAndCheckState(ctx, apiClient, containerID)
 	if err != nil {
@@ -114,11 +114,11 @@ func RunAttach(ctx context.Context, dockerCLI command.Cli, containerID string, o
 		defer signal.StopCatch(sigc)
 	}
 
-	resp, errAttach := apiClient.ContainerAttach(ctx, containerID, options)
-	if errAttach != nil {
-		return errAttach
+	res, err := apiClient.ContainerAttach(ctx, containerID, options)
+	if err != nil {
+		return err
 	}
-	defer resp.Close()
+	defer res.HijackedResponse.Close()
 
 	// If use docker attach command to attach to a stop container, it will return
 	// "You cannot attach to a stopped container" error, it's ok, but when
@@ -142,7 +142,7 @@ func RunAttach(ctx context.Context, dockerCLI command.Cli, containerID string, o
 		inputStream:  in,
 		outputStream: dockerCLI.Out(),
 		errorStream:  dockerCLI.Err(),
-		resp:         resp,
+		resp:         res.HijackedResponse,
 		tty:          c.Config.Tty,
 		detachKeys:   options.DetachKeys,
 	}
@@ -152,19 +152,19 @@ func RunAttach(ctx context.Context, dockerCLI command.Cli, containerID string, o
 		return err
 	}
 
-	return getExitStatus(errC, resultC)
+	return getExitStatus(waitRes)
 }
 
-func getExitStatus(errC <-chan error, resultC <-chan container.WaitResponse) error {
+func getExitStatus(waitRes client.ContainerWaitResult) error {
 	select {
-	case result := <-resultC:
+	case result := <-waitRes.Result:
 		if result.Error != nil {
 			return errors.New(result.Error.Message)
 		}
 		if result.StatusCode != 0 {
 			return cli.StatusError{StatusCode: int(result.StatusCode)}
 		}
-	case err := <-errC:
+	case err := <-waitRes.Error:
 		return err
 	}
 
@@ -177,7 +177,7 @@ func resizeTTY(ctx context.Context, dockerCli command.Cli, containerID string) {
 	// terminal, the only way to get the shell prompt to display for attaches 2+ is to artificially
 	// resize it, then go back to normal. Without this, every attach after the first will
 	// require the user to manually resize or hit enter.
-	resizeTtyTo(ctx, dockerCli.Client(), containerID, height+1, width+1, false)
+	resizeTTYTo(ctx, dockerCli.Client(), containerID, height+1, width+1, false)
 
 	// After the above resizing occurs, the call to MonitorTtySize below will handle resetting back
 	// to the actual size.

cli/command/container/attach_test.go

@@ -8,6 +8,7 @@ import (
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/internal/test"
 	"github.com/moby/moby/api/types/container"
+	"github.com/moby/moby/client"
 	"gotest.tools/v3/assert"
 )
 
@@ -16,24 +17,26 @@ func TestNewAttachCommandErrors(t *testing.T) {
 		name                 string
 		args                 []string
 		expectedError        string
-		containerInspectFunc func(img string) (container.InspectResponse, error)
+		containerInspectFunc func(img string) (client.ContainerInspectResult, error)
 	}{
 		{
 			name:          "client-error",
 			args:          []string{"5cb5bb5e4a3b"},
 			expectedError: "something went wrong",
-			containerInspectFunc: func(containerID string) (container.InspectResponse, error) {
-				return container.InspectResponse{}, errors.New("something went wrong")
+			containerInspectFunc: func(containerID string) (client.ContainerInspectResult, error) {
+				return client.ContainerInspectResult{}, errors.New("something went wrong")
 			},
 		},
 		{
 			name:          "client-stopped",
 			args:          []string{"5cb5bb5e4a3b"},
 			expectedError: "cannot attach to a stopped container",
-			containerInspectFunc: func(containerID string) (container.InspectResponse, error) {
-				return container.InspectResponse{
-					State: &container.State{
-						Running: false,
+			containerInspectFunc: func(containerID string) (client.ContainerInspectResult, error) {
+				return client.ContainerInspectResult{
+					Container: container.InspectResponse{
+						State: &container.State{
+							Running: false,
+						},
 					},
 				}, nil
 			},
@@ -42,11 +45,13 @@ func TestNewAttachCommandErrors(t *testing.T) {
 			name:          "client-paused",
 			args:          []string{"5cb5bb5e4a3b"},
 			expectedError: "cannot attach to a paused container",
-			containerInspectFunc: func(containerID string) (container.InspectResponse, error) {
-				return container.InspectResponse{
-					State: &container.State{
-						Running: true,
-						Paused:  true,
+			containerInspectFunc: func(containerID string) (client.ContainerInspectResult, error) {
+				return client.ContainerInspectResult{
+					Container: container.InspectResponse{
+						State: &container.State{
+							Running: true,
+							Paused:  true,
+						},
 					},
 				}, nil
 			},
@@ -55,12 +60,14 @@ func TestNewAttachCommandErrors(t *testing.T) {
 			name:          "client-restarting",
 			args:          []string{"5cb5bb5e4a3b"},
 			expectedError: "cannot attach to a restarting container",
-			containerInspectFunc: func(containerID string) (container.InspectResponse, error) {
-				return container.InspectResponse{
-					State: &container.State{
-						Running:    true,
-						Paused:     false,
-						Restarting: true,
+			containerInspectFunc: func(containerID string) (client.ContainerInspectResult, error) {
+				return client.ContainerInspectResult{
+					Container: container.InspectResponse{
+						State: &container.State{
+							Running:    true,
+							Paused:     false,
+							Restarting: true,
+						},
 					},
 				}, nil
 			},
@@ -118,7 +125,10 @@ func TestGetExitStatus(t *testing.T) {
 			resultC <- *testcase.result
 		}
 
-		err := getExitStatus(errC, resultC)
+		err := getExitStatus(client.ContainerWaitResult{
+			Result: resultC,
+			Error:  errC,
+		})
 
 		if testcase.expectedError == nil {
 			assert.NilError(t, err)

cli/command/container/client_test.go

@@ -3,229 +3,232 @@ package container
 import (
 	"context"
 	"io"
+	"net/http"
+	"strings"
 
-	"github.com/moby/moby/api/types/container"
-	"github.com/moby/moby/api/types/network"
-	"github.com/moby/moby/api/types/system"
 	"github.com/moby/moby/client"
-	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 )
 
+func mockContainerExportResult(content string) client.ContainerExportResult {
+	return io.NopCloser(strings.NewReader(content))
+}
+
+func mockContainerLogsResult(content string) client.ContainerLogsResult {
+	return io.NopCloser(strings.NewReader(content))
+}
+
+type fakeStreamResult struct {
+	io.ReadCloser
+	client.ImagePushResponse // same interface as [client.ImagePushResponse]
+}
+
+func (e fakeStreamResult) Read(p []byte) (int, error) { return e.ReadCloser.Read(p) }
+func (e fakeStreamResult) Close() error               { return e.ReadCloser.Close() }
+
 type fakeClient struct {
 	client.Client
-	inspectFunc         func(string) (container.InspectResponse, error)
-	execInspectFunc     func(execID string) (client.ExecInspect, error)
-	execCreateFunc      func(containerID string, options client.ExecCreateOptions) (container.ExecCreateResponse, error)
-	createContainerFunc func(config *container.Config,
-		hostConfig *container.HostConfig,
-		networkingConfig *network.NetworkingConfig,
-		platform *ocispec.Platform,
-		containerName string) (container.CreateResponse, error)
-	containerStartFunc      func(containerID string, options client.ContainerStartOptions) error
-	imageCreateFunc         func(ctx context.Context, parentReference string, options client.ImageCreateOptions) (io.ReadCloser, error)
-	infoFunc                func() (system.Info, error)
-	containerStatPathFunc   func(containerID, path string) (container.PathStat, error)
-	containerCopyFromFunc   func(containerID, srcPath string) (io.ReadCloser, container.PathStat, error)
-	logFunc                 func(string, client.ContainerLogsOptions) (io.ReadCloser, error)
-	waitFunc                func(string) (<-chan container.WaitResponse, <-chan error)
-	containerListFunc       func(client.ContainerListOptions) ([]container.Summary, error)
-	containerExportFunc     func(string) (io.ReadCloser, error)
-	containerExecResizeFunc func(id string, options client.ContainerResizeOptions) error
-	containerRemoveFunc     func(ctx context.Context, containerID string, options client.ContainerRemoveOptions) error
-	containerRestartFunc    func(ctx context.Context, containerID string, options client.ContainerStopOptions) error
-	containerStopFunc       func(ctx context.Context, containerID string, options client.ContainerStopOptions) error
-	containerKillFunc       func(ctx context.Context, containerID, signal string) error
-	containerPruneFunc      func(ctx context.Context, pruneFilters client.Filters) (container.PruneReport, error)
-	containerAttachFunc     func(ctx context.Context, containerID string, options client.ContainerAttachOptions) (client.HijackedResponse, error)
-	containerDiffFunc       func(ctx context.Context, containerID string) ([]container.FilesystemChange, error)
+	inspectFunc             func(string) (client.ContainerInspectResult, error)
+	execInspectFunc         func(execID string) (client.ExecInspectResult, error)
+	execCreateFunc          func(containerID string, options client.ExecCreateOptions) (client.ExecCreateResult, error)
+	createContainerFunc     func(options client.ContainerCreateOptions) (client.ContainerCreateResult, error)
+	containerStartFunc      func(containerID string, options client.ContainerStartOptions) (client.ContainerStartResult, error)
+	imagePullFunc           func(ctx context.Context, parentReference string, options client.ImagePullOptions) (client.ImagePullResponse, error)
+	infoFunc                func() (client.SystemInfoResult, error)
+	containerStatPathFunc   func(containerID, path string) (client.ContainerStatPathResult, error)
+	containerCopyFromFunc   func(containerID, srcPath string) (client.CopyFromContainerResult, error)
+	logFunc                 func(string, client.ContainerLogsOptions) (client.ContainerLogsResult, error)
+	waitFunc                func(string) client.ContainerWaitResult
+	containerListFunc       func(client.ContainerListOptions) (client.ContainerListResult, error)
+	containerExportFunc     func(string) (client.ContainerExportResult, error)
+	containerExecResizeFunc func(id string, options client.ExecResizeOptions) (client.ExecResizeResult, error)
+	containerRemoveFunc     func(ctx context.Context, containerID string, options client.ContainerRemoveOptions) (client.ContainerRemoveResult, error)
+	containerRestartFunc    func(ctx context.Context, containerID string, options client.ContainerRestartOptions) (client.ContainerRestartResult, error)
+	containerStopFunc       func(ctx context.Context, containerID string, options client.ContainerStopOptions) (client.ContainerStopResult, error)
+	containerKillFunc       func(ctx context.Context, containerID string, options client.ContainerKillOptions) (client.ContainerKillResult, error)
+	containerPruneFunc      func(ctx context.Context, options client.ContainerPruneOptions) (client.ContainerPruneResult, error)
+	containerAttachFunc     func(ctx context.Context, containerID string, options client.ContainerAttachOptions) (client.ContainerAttachResult, error)
+	containerDiffFunc       func(ctx context.Context, containerID string) (client.ContainerDiffResult, error)
 	containerRenameFunc     func(ctx context.Context, oldName, newName string) error
-	containerCommitFunc     func(ctx context.Context, container string, options client.ContainerCommitOptions) (container.CommitResponse, error)
-	containerPauseFunc      func(ctx context.Context, container string) error
+	containerCommitFunc     func(ctx context.Context, container string, options client.ContainerCommitOptions) (client.ContainerCommitResult, error)
+	containerPauseFunc      func(ctx context.Context, container string, options client.ContainerPauseOptions) (client.ContainerPauseResult, error)
 	Version                 string
 }
 
-func (f *fakeClient) ContainerList(_ context.Context, options client.ContainerListOptions) ([]container.Summary, error) {
+func (f *fakeClient) ContainerList(_ context.Context, options client.ContainerListOptions) (client.ContainerListResult, error) {
 	if f.containerListFunc != nil {
 		return f.containerListFunc(options)
 	}
-	return []container.Summary{}, nil
+	return client.ContainerListResult{}, nil
 }
 
-func (f *fakeClient) ContainerInspect(_ context.Context, containerID string) (container.InspectResponse, error) {
+func (f *fakeClient) ContainerInspect(_ context.Context, containerID string, _ client.ContainerInspectOptions) (client.ContainerInspectResult, error) {
 	if f.inspectFunc != nil {
 		return f.inspectFunc(containerID)
 	}
-	return container.InspectResponse{}, nil
+	return client.ContainerInspectResult{}, nil
 }
 
-func (f *fakeClient) ContainerExecCreate(_ context.Context, containerID string, config client.ExecCreateOptions) (container.ExecCreateResponse, error) {
+func (f *fakeClient) ExecCreate(_ context.Context, containerID string, config client.ExecCreateOptions) (client.ExecCreateResult, error) {
 	if f.execCreateFunc != nil {
 		return f.execCreateFunc(containerID, config)
 	}
-	return container.ExecCreateResponse{}, nil
+	return client.ExecCreateResult{}, nil
 }
 
-func (f *fakeClient) ContainerExecInspect(_ context.Context, execID string) (client.ExecInspect, error) {
+func (f *fakeClient) ExecInspect(_ context.Context, execID string, _ client.ExecInspectOptions) (client.ExecInspectResult, error) {
 	if f.execInspectFunc != nil {
 		return f.execInspectFunc(execID)
 	}
-	return client.ExecInspect{}, nil
+	return client.ExecInspectResult{}, nil
 }
 
-func (*fakeClient) ContainerExecStart(context.Context, string, client.ExecStartOptions) error {
-	return nil
+func (*fakeClient) ExecStart(context.Context, string, client.ExecStartOptions) (client.ExecStartResult, error) {
+	return client.ExecStartResult{}, nil
 }
 
-func (f *fakeClient) ContainerCreate(
-	_ context.Context,
-	config *container.Config,
-	hostConfig *container.HostConfig,
-	networkingConfig *network.NetworkingConfig,
-	platform *ocispec.Platform,
-	containerName string,
-) (container.CreateResponse, error) {
+func (f *fakeClient) ContainerCreate(_ context.Context, options client.ContainerCreateOptions) (client.ContainerCreateResult, error) {
 	if f.createContainerFunc != nil {
-		return f.createContainerFunc(config, hostConfig, networkingConfig, platform, containerName)
+		return f.createContainerFunc(options)
 	}
-	return container.CreateResponse{}, nil
+	return client.ContainerCreateResult{}, nil
 }
 
-func (f *fakeClient) ContainerRemove(ctx context.Context, containerID string, options client.ContainerRemoveOptions) error {
+func (f *fakeClient) ContainerRemove(ctx context.Context, containerID string, options client.ContainerRemoveOptions) (client.ContainerRemoveResult, error) {
 	if f.containerRemoveFunc != nil {
 		return f.containerRemoveFunc(ctx, containerID, options)
 	}
-	return nil
+	return client.ContainerRemoveResult{}, nil
 }
 
-func (f *fakeClient) ImageCreate(ctx context.Context, parentReference string, options client.ImageCreateOptions) (io.ReadCloser, error) {
-	if f.imageCreateFunc != nil {
-		return f.imageCreateFunc(ctx, parentReference, options)
+func (f *fakeClient) ImagePull(ctx context.Context, parentReference string, options client.ImagePullOptions) (client.ImagePullResponse, error) {
+	if f.imagePullFunc != nil {
+		return f.imagePullFunc(ctx, parentReference, options)
 	}
-	return nil, nil
+	return fakeStreamResult{}, nil
 }
 
-func (f *fakeClient) Info(_ context.Context) (system.Info, error) {
+func (f *fakeClient) Info(context.Context, client.InfoOptions) (client.SystemInfoResult, error) {
 	if f.infoFunc != nil {
 		return f.infoFunc()
 	}
-	return system.Info{}, nil
+	return client.SystemInfoResult{}, nil
 }
 
-func (f *fakeClient) ContainerStatPath(_ context.Context, containerID, path string) (container.PathStat, error) {
+func (f *fakeClient) ContainerStatPath(_ context.Context, containerID string, options client.ContainerStatPathOptions) (client.ContainerStatPathResult, error) {
 	if f.containerStatPathFunc != nil {
-		return f.containerStatPathFunc(containerID, path)
+		return f.containerStatPathFunc(containerID, options.Path)
 	}
-	return container.PathStat{}, nil
+	return client.ContainerStatPathResult{}, nil
 }
 
-func (f *fakeClient) CopyFromContainer(_ context.Context, containerID, srcPath string) (io.ReadCloser, container.PathStat, error) {
+func (f *fakeClient) CopyFromContainer(_ context.Context, containerID string, options client.CopyFromContainerOptions) (client.CopyFromContainerResult, error) {
 	if f.containerCopyFromFunc != nil {
-		return f.containerCopyFromFunc(containerID, srcPath)
+		return f.containerCopyFromFunc(containerID, options.SourcePath)
 	}
-	return nil, container.PathStat{}, nil
+	return client.CopyFromContainerResult{}, nil
 }
 
-func (f *fakeClient) ContainerLogs(_ context.Context, containerID string, options client.ContainerLogsOptions) (io.ReadCloser, error) {
+func (f *fakeClient) ContainerLogs(_ context.Context, containerID string, options client.ContainerLogsOptions) (client.ContainerLogsResult, error) {
 	if f.logFunc != nil {
 		return f.logFunc(containerID, options)
 	}
-	return nil, nil
+	return http.NoBody, nil
 }
 
 func (f *fakeClient) ClientVersion() string {
 	return f.Version
 }
 
-func (f *fakeClient) ContainerWait(_ context.Context, containerID string, _ container.WaitCondition) (<-chan container.WaitResponse, <-chan error) {
+func (f *fakeClient) ContainerWait(_ context.Context, containerID string, _ client.ContainerWaitOptions) client.ContainerWaitResult {
 	if f.waitFunc != nil {
 		return f.waitFunc(containerID)
 	}
-	return nil, nil
+	return client.ContainerWaitResult{}
 }
 
-func (f *fakeClient) ContainerStart(_ context.Context, containerID string, options client.ContainerStartOptions) error {
+func (f *fakeClient) ContainerStart(_ context.Context, containerID string, options client.ContainerStartOptions) (client.ContainerStartResult, error) {
 	if f.containerStartFunc != nil {
 		return f.containerStartFunc(containerID, options)
 	}
-	return nil
+	return client.ContainerStartResult{}, nil
 }
 
-func (f *fakeClient) ContainerExport(_ context.Context, containerID string) (io.ReadCloser, error) {
+func (f *fakeClient) ContainerExport(_ context.Context, containerID string, _ client.ContainerExportOptions) (client.ContainerExportResult, error) {
 	if f.containerExportFunc != nil {
 		return f.containerExportFunc(containerID)
 	}
-	return nil, nil
+	return http.NoBody, nil
 }
 
-func (f *fakeClient) ContainerExecResize(_ context.Context, id string, options client.ContainerResizeOptions) error {
+func (f *fakeClient) ExecResize(_ context.Context, id string, options client.ExecResizeOptions) (client.ExecResizeResult, error) {
 	if f.containerExecResizeFunc != nil {
 		return f.containerExecResizeFunc(id, options)
 	}
-	return nil
+	return client.ExecResizeResult{}, nil
 }
 
-func (f *fakeClient) ContainerKill(ctx context.Context, containerID, signal string) error {
+func (f *fakeClient) ContainerKill(ctx context.Context, containerID string, options client.ContainerKillOptions) (client.ContainerKillResult, error) {
 	if f.containerKillFunc != nil {
-		return f.containerKillFunc(ctx, containerID, signal)
+		return f.containerKillFunc(ctx, containerID, options)
 	}
-	return nil
+	return client.ContainerKillResult{}, nil
 }
 
-func (f *fakeClient) ContainersPrune(ctx context.Context, pruneFilters client.Filters) (container.PruneReport, error) {
+func (f *fakeClient) ContainerPrune(ctx context.Context, options client.ContainerPruneOptions) (client.ContainerPruneResult, error) {
 	if f.containerPruneFunc != nil {
-		return f.containerPruneFunc(ctx, pruneFilters)
+		return f.containerPruneFunc(ctx, options)
 	}
-	return container.PruneReport{}, nil
+	return client.ContainerPruneResult{}, nil
 }
 
-func (f *fakeClient) ContainerRestart(ctx context.Context, containerID string, options client.ContainerStopOptions) error {
+func (f *fakeClient) ContainerRestart(ctx context.Context, containerID string, options client.ContainerRestartOptions) (client.ContainerRestartResult, error) {
 	if f.containerRestartFunc != nil {
 		return f.containerRestartFunc(ctx, containerID, options)
 	}
-	return nil
+	return client.ContainerRestartResult{}, nil
 }
 
-func (f *fakeClient) ContainerStop(ctx context.Context, containerID string, options client.ContainerStopOptions) error {
+func (f *fakeClient) ContainerStop(ctx context.Context, containerID string, options client.ContainerStopOptions) (client.ContainerStopResult, error) {
 	if f.containerStopFunc != nil {
 		return f.containerStopFunc(ctx, containerID, options)
 	}
-	return nil
+	return client.ContainerStopResult{}, nil
 }
 
-func (f *fakeClient) ContainerAttach(ctx context.Context, containerID string, options client.ContainerAttachOptions) (client.HijackedResponse, error) {
+func (f *fakeClient) ContainerAttach(ctx context.Context, containerID string, options client.ContainerAttachOptions) (client.ContainerAttachResult, error) {
 	if f.containerAttachFunc != nil {
 		return f.containerAttachFunc(ctx, containerID, options)
 	}
-	return client.HijackedResponse{}, nil
+	return client.ContainerAttachResult{}, nil
 }
 
-func (f *fakeClient) ContainerDiff(ctx context.Context, containerID string) ([]container.FilesystemChange, error) {
+func (f *fakeClient) ContainerDiff(ctx context.Context, containerID string, _ client.ContainerDiffOptions) (client.ContainerDiffResult, error) {
 	if f.containerDiffFunc != nil {
 		return f.containerDiffFunc(ctx, containerID)
 	}
 
-	return []container.FilesystemChange{}, nil
+	return client.ContainerDiffResult{}, nil
 }
 
-func (f *fakeClient) ContainerRename(ctx context.Context, oldName, newName string) error {
+func (f *fakeClient) ContainerRename(ctx context.Context, oldName string, options client.ContainerRenameOptions) (client.ContainerRenameResult, error) {
 	if f.containerRenameFunc != nil {
-		return f.containerRenameFunc(ctx, oldName, newName)
+		return client.ContainerRenameResult{}, f.containerRenameFunc(ctx, oldName, options.NewName)
 	}
 
-	return nil
+	return client.ContainerRenameResult{}, nil
 }
 
-func (f *fakeClient) ContainerCommit(ctx context.Context, containerID string, options client.ContainerCommitOptions) (container.CommitResponse, error) {
+func (f *fakeClient) ContainerCommit(ctx context.Context, containerID string, options client.ContainerCommitOptions) (client.ContainerCommitResult, error) {
 	if f.containerCommitFunc != nil {
 		return f.containerCommitFunc(ctx, containerID, options)
 	}
-	return container.CommitResponse{}, nil
+	return client.ContainerCommitResult{}, nil
 }
 
-func (f *fakeClient) ContainerPause(ctx context.Context, containerID string) error {
+func (f *fakeClient) ContainerPause(ctx context.Context, containerID string, options client.ContainerPauseOptions) (client.ContainerPauseResult, error) {
 	if f.containerPauseFunc != nil {
-		return f.containerPauseFunc(ctx, containerID)
+		return f.containerPauseFunc(ctx, containerID, options)
 	}
 
-	return nil
+	return client.ContainerPauseResult{}, nil
 }

cli/command/container/commit_test.go

@@ -7,7 +7,6 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/moby/moby/api/types/container"
 	"github.com/moby/moby/client"
 	"gotest.tools/v3/assert"
 	is "gotest.tools/v3/assert/cmp"
@@ -15,18 +14,14 @@ import (
 
 func TestRunCommit(t *testing.T) {
 	cli := test.NewFakeCli(&fakeClient{
-		containerCommitFunc: func(
-			ctx context.Context,
-			ctr string,
-			options client.ContainerCommitOptions,
-		) (container.CommitResponse, error) {
+		containerCommitFunc: func(ctx context.Context, ctr string, options client.ContainerCommitOptions) (client.ContainerCommitResult, error) {
 			assert.Check(t, is.Equal(options.Author, "Author Name <author@name.com>"))
 			assert.Check(t, is.DeepEqual(options.Changes, []string{"EXPOSE 80"}))
 			assert.Check(t, is.Equal(options.Comment, "commit message"))
 			assert.Check(t, is.Equal(options.NoPause, true))
 			assert.Check(t, is.Equal(ctr, "container-id"))
 
-			return container.CommitResponse{ID: "image-id"}, nil
+			return client.ContainerCommitResult{ID: "image-id"}, nil
 		},
 	})
 
@@ -52,12 +47,8 @@ func TestRunCommitClientError(t *testing.T) {
 	clientError := errors.New("client error")
 
 	cli := test.NewFakeCli(&fakeClient{
-		containerCommitFunc: func(
-			ctx context.Context,
-			ctr string,
-			options client.ContainerCommitOptions,
-		) (container.CommitResponse, error) {
-			return container.CommitResponse{}, clientError
+		containerCommitFunc: func(ctx context.Context, ctr string, options client.ContainerCommitOptions) (client.ContainerCommitResult, error) {
+			return client.ContainerCommitResult{}, clientError
 		},
 	})
 

cli/command/container/completion.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.23
+//go:build go1.24
 
 package container
 
@@ -9,6 +9,7 @@ import (
 
 	"github.com/docker/cli/cli/command/completion"
 	"github.com/moby/moby/api/types/container"
+	"github.com/moby/moby/client"
 	"github.com/moby/sys/capability"
 	"github.com/moby/sys/signal"
 	"github.com/spf13/cobra"
@@ -186,11 +187,11 @@ func completeLink(dockerCLI completion.APIClientProvider) cobra.CompletionFunc {
 // of the build-in log drivers.
 func completeLogDriver(dockerCLI completion.APIClientProvider) cobra.CompletionFunc {
 	return func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
-		info, err := dockerCLI.Client().Info(cmd.Context())
+		res, err := dockerCLI.Client().Info(cmd.Context(), client.InfoOptions{})
 		if err != nil {
 			return builtInLogDrivers(), cobra.ShellCompDirectiveNoFileComp
 		}
-		drivers := info.Plugins.Log
+		drivers := res.Info.Plugins.Log
 		return drivers, cobra.ShellCompDirectiveNoFileComp
 	}
 }
@@ -279,12 +280,12 @@ func completeUlimit(_ *cobra.Command, _ []string, _ string) ([]string, cobra.She
 // completeVolumeDriver contacts the API to get the built-in and installed volume drivers.
 func completeVolumeDriver(dockerCLI completion.APIClientProvider) cobra.CompletionFunc {
 	return func(cmd *cobra.Command, _ []string, _ string) ([]string, cobra.ShellCompDirective) {
-		info, err := dockerCLI.Client().Info(cmd.Context())
+		res, err := dockerCLI.Client().Info(cmd.Context(), client.InfoOptions{})
 		if err != nil {
 			// fallback: the built-in drivers
 			return []string{"local"}, cobra.ShellCompDirectiveNoFileComp
 		}
-		drivers := info.Plugins.Volume
+		drivers := res.Info.Plugins.Volume
 		return drivers, cobra.ShellCompDirectiveNoFileComp
 	}
 }

cli/command/container/completion_test.go

@@ -27,7 +27,7 @@ func TestCompleteLinuxCapabilityNames(t *testing.T) {
 
 func TestCompletePid(t *testing.T) {
 	tests := []struct {
-		containerListFunc   func(client.ContainerListOptions) ([]container.Summary, error)
+		containerListFunc   func(client.ContainerListOptions) (client.ContainerListResult, error)
 		toComplete          string
 		expectedCompletions []string
 		expectedDirective   cobra.ShellCompDirective
@@ -43,10 +43,12 @@ func TestCompletePid(t *testing.T) {
 			expectedDirective:   cobra.ShellCompDirectiveNoSpace,
 		},
 		{
-			containerListFunc: func(client.ContainerListOptions) ([]container.Summary, error) {
-				return []container.Summary{
-					*builders.Container("c1"),
-					*builders.Container("c2"),
+			containerListFunc: func(client.ContainerListOptions) (client.ContainerListResult, error) {
+				return client.ContainerListResult{
+					Items: []container.Summary{
+						*builders.Container("c1"),
+						*builders.Container("c2"),
+					},
 				}, nil
 			},
 			toComplete:          "container:",

cli/command/container/cp.go

@@ -230,11 +230,13 @@ func copyFromContainer(ctx context.Context, dockerCLI command.Cli, copyConfig cp
 	// if client requests to follow symbol link, then must decide target file to be copied
 	var rebaseName string
 	if copyConfig.followLink {
-		srcStat, err := apiClient.ContainerStatPath(ctx, copyConfig.container, srcPath)
+		src, err := apiClient.ContainerStatPath(ctx, copyConfig.container, client.ContainerStatPathOptions{
+			Path: srcPath,
+		})
 
 		// If the destination is a symbolic link, we should follow it.
-		if err == nil && srcStat.Mode&os.ModeSymlink != 0 {
-			linkTarget := srcStat.LinkTarget
+		if err == nil && src.Stat.Mode&os.ModeSymlink != 0 {
+			linkTarget := src.Stat.LinkTarget
 			if !isAbs(linkTarget) {
 				// Join with the parent directory.
 				srcParent, _ := archive.SplitPathDirEntry(srcPath)
@@ -249,11 +251,14 @@ func copyFromContainer(ctx context.Context, dockerCLI command.Cli, copyConfig cp
 	ctx, cancel := signal.NotifyContext(ctx, os.Interrupt)
 	defer cancel()
 
-	content, stat, err := apiClient.CopyFromContainer(ctx, copyConfig.container, srcPath)
+	cpRes, err := apiClient.CopyFromContainer(ctx, copyConfig.container, client.CopyFromContainerOptions{
+		SourcePath: srcPath,
+	})
 	if err != nil {
 		return err
 	}
-	defer content.Close()
+	content := cpRes.Content
+	defer func() { _ = content.Close() }()
 
 	if dstPath == "-" {
 		_, err = io.Copy(dockerCLI.Out(), content)
@@ -263,7 +268,7 @@ func copyFromContainer(ctx context.Context, dockerCLI command.Cli, copyConfig cp
 	srcInfo := archive.CopyInfo{
 		Path:       srcPath,
 		Exists:     true,
-		IsDir:      stat.Mode.IsDir(),
+		IsDir:      cpRes.Stat.Mode.IsDir(),
 		RebaseName: rebaseName,
 	}
 
@@ -315,10 +320,10 @@ func copyToContainer(ctx context.Context, dockerCLI command.Cli, copyConfig cpCo
 	apiClient := dockerCLI.Client()
 	// Prepare destination copy info by stat-ing the container path.
 	dstInfo := archive.CopyInfo{Path: dstPath}
-	if dstStat, err := apiClient.ContainerStatPath(ctx, copyConfig.container, dstPath); err == nil {
+	if dst, err := apiClient.ContainerStatPath(ctx, copyConfig.container, client.ContainerStatPathOptions{Path: dstPath}); err == nil {
 		// If the destination is a symbolic link, we should evaluate it.
-		if dstStat.Mode&os.ModeSymlink != 0 {
-			linkTarget := dstStat.LinkTarget
+		if dst.Stat.Mode&os.ModeSymlink != 0 {
+			linkTarget := dst.Stat.LinkTarget
 			if !isAbs(linkTarget) {
 				// Join with the parent directory.
 				dstParent, _ := archive.SplitPathDirEntry(dstPath)
@@ -326,14 +331,14 @@ func copyToContainer(ctx context.Context, dockerCLI command.Cli, copyConfig cpCo
 			}
 
 			dstInfo.Path = linkTarget
-			dstStat, err = apiClient.ContainerStatPath(ctx, copyConfig.container, linkTarget)
+			dst, err = apiClient.ContainerStatPath(ctx, copyConfig.container, client.ContainerStatPathOptions{Path: linkTarget})
 		}
 		// Validate the destination path
 		if err == nil {
-			if err := command.ValidateOutputPathFileMode(dstStat.Mode); err != nil {
+			if err := command.ValidateOutputPathFileMode(dst.Stat.Mode); err != nil {
 				return fmt.Errorf(`destination "%s:%s" must be a directory or a regular file: %w`, copyConfig.container, dstPath, err)
 			}
-			dstInfo.Exists, dstInfo.IsDir = true, dstStat.Mode.IsDir()
+			dstInfo.Exists, dstInfo.IsDir = true, dst.Stat.Mode.IsDir()
 		}
 
 		// Ignore any error and assume that the parent directory of the destination
@@ -399,22 +404,26 @@ func copyToContainer(ctx context.Context, dockerCLI command.Cli, copyConfig cpCo
 	}
 
 	options := client.CopyToContainerOptions{
-		CopyUIDGID: copyConfig.copyUIDGID,
+		DestinationPath: resolvedDstPath,
+		Content:         content,
+		CopyUIDGID:      copyConfig.copyUIDGID,
 	}
 
 	if copyConfig.quiet {
-		return apiClient.CopyToContainer(ctx, copyConfig.container, resolvedDstPath, content, options)
+		_, err := apiClient.CopyToContainer(ctx, copyConfig.container, options)
+		return err
 	}
 
 	ctx, cancel := signal.NotifyContext(ctx, os.Interrupt)
 	restore, done := copyProgress(ctx, dockerCLI.Err(), copyToContainerHeader, &copiedSize)
-	res := apiClient.CopyToContainer(ctx, copyConfig.container, resolvedDstPath, content, options)
+	// TODO(thaJeztah): error-handling looks odd here; should it be handled differently?
+	_, err := apiClient.CopyToContainer(ctx, copyConfig.container, options)
 	cancel()
 	<-done
 	restore()
 	_, _ = fmt.Fprintln(dockerCLI.Err(), "Successfully copied", progressHumanSize(copiedSize), "to", copyConfig.container+":"+dstInfo.Path)
 
-	return res
+	return err
 }
 
 // We use `:` as a delimiter between CONTAINER and PATH, but `:` could also be

cli/command/container/cp_test.go

@@ -11,7 +11,7 @@ import (
 	"github.com/docker/cli/internal/test"
 	"github.com/moby/go-archive"
 	"github.com/moby/go-archive/compression"
-	"github.com/moby/moby/api/types/container"
+	"github.com/moby/moby/client"
 	"gotest.tools/v3/assert"
 	is "gotest.tools/v3/assert/cmp"
 	"gotest.tools/v3/fs"
@@ -52,9 +52,11 @@ func TestRunCopyFromContainerToStdout(t *testing.T) {
 	tarContent := "the tar content"
 
 	cli := test.NewFakeCli(&fakeClient{
-		containerCopyFromFunc: func(ctr, srcPath string) (io.ReadCloser, container.PathStat, error) {
+		containerCopyFromFunc: func(ctr, srcPath string) (client.CopyFromContainerResult, error) {
 			assert.Check(t, is.Equal("container", ctr))
-			return io.NopCloser(strings.NewReader(tarContent)), container.PathStat{}, nil
+			return client.CopyFromContainerResult{
+				Content: io.NopCloser(strings.NewReader(tarContent)),
+			}, nil
 		},
 	})
 	err := runCopy(context.TODO(), cli, copyOptions{
@@ -73,10 +75,12 @@ func TestRunCopyFromContainerToFilesystem(t *testing.T) {
 	destDir := fs.NewDir(t, "cp-test")
 
 	cli := test.NewFakeCli(&fakeClient{
-		containerCopyFromFunc: func(ctr, srcPath string) (io.ReadCloser, container.PathStat, error) {
+		containerCopyFromFunc: func(ctr, srcPath string) (client.CopyFromContainerResult, error) {
 			assert.Check(t, is.Equal("container", ctr))
 			readCloser, err := archive.Tar(srcDir.Path(), compression.None)
-			return readCloser, container.PathStat{}, err
+			return client.CopyFromContainerResult{
+				Content: readCloser,
+			}, err
 		},
 	})
 	err := runCopy(context.TODO(), cli, copyOptions{
@@ -99,10 +103,12 @@ func TestRunCopyFromContainerToFilesystemMissingDestinationDirectory(t *testing.
 	defer destDir.Remove()
 
 	cli := test.NewFakeCli(&fakeClient{
-		containerCopyFromFunc: func(ctr, srcPath string) (io.ReadCloser, container.PathStat, error) {
+		containerCopyFromFunc: func(ctr, srcPath string) (client.CopyFromContainerResult, error) {
 			assert.Check(t, is.Equal("container", ctr))
 			readCloser, err := archive.TarWithOptions(destDir.Path(), &archive.TarOptions{})
-			return readCloser, container.PathStat{}, err
+			return client.CopyFromContainerResult{
+				Content: readCloser,
+			}, err
 		},
 	})
 	err := runCopy(context.TODO(), cli, copyOptions{

cli/command/container/create.go

@@ -17,11 +17,9 @@ import (
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/cli/command/completion"
-	"github.com/docker/cli/cli/command/image"
 	"github.com/docker/cli/cli/config/configfile"
 	"github.com/docker/cli/cli/config/types"
 	"github.com/docker/cli/cli/streams"
-	"github.com/docker/cli/cli/trust"
 	"github.com/docker/cli/internal/jsonstream"
 	"github.com/docker/cli/opts"
 	"github.com/moby/moby/api/types/mount"
@@ -41,7 +39,6 @@ const (
 type createOptions struct {
 	name         string
 	platform     string
-	untrusted    bool
 	pull         string // always, missing, never
 	quiet        bool
 	useAPISocket bool
@@ -88,7 +85,9 @@ func newCreateCommand(dockerCLI command.Cli) *cobra.Command {
 	_ = flags.SetAnnotation("platform", "version", []string{"1.32"})
 	_ = cmd.RegisterFlagCompletionFunc("platform", completion.Platforms())
 
-	flags.BoolVar(&options.untrusted, "disable-content-trust", !trust.Enabled(), "Skip image verification")
+	// TODO(thaJeztah): DEPRECATED: remove in v29.1 or v30
+	flags.Bool("disable-content-trust", true, "Skip image verification (deprecated)")
+	_ = flags.MarkDeprecated("disable-content-trust", "support for docker content trust was removed")
 	copts = addFlags(flags)
 
 	addCompletions(cmd, dockerCLI)
@@ -135,22 +134,27 @@ func pullImage(ctx context.Context, dockerCli command.Cli, img string, options *
 		return err
 	}
 
-	responseBody, err := dockerCli.Client().ImageCreate(ctx, img, client.ImageCreateOptions{
+	var ociPlatforms []ocispec.Platform
+	if options.platform != "" {
+		// Already validated.
+		ociPlatforms = append(ociPlatforms, platforms.MustParse(options.platform))
+	}
+	resp, err := dockerCli.Client().ImagePull(ctx, img, client.ImagePullOptions{
 		RegistryAuth: encodedAuth,
-		Platform:     options.platform,
+		Platforms:    ociPlatforms,
 	})
 	if err != nil {
 		return err
 	}
 	defer func() {
-		_ = responseBody.Close()
+		_ = resp.Close()
 	}()
 
 	out := dockerCli.Err()
 	if options.quiet {
 		out = streams.NewOut(io.Discard)
 	}
-	return jsonstream.Display(ctx, responseBody, out)
+	return jsonstream.Display(ctx, resp, out)
 }
 
 type cidFile struct {
@@ -208,10 +212,15 @@ func createContainer(ctx context.Context, dockerCli command.Cli, containerCfg *c
 	hostConfig := containerCfg.HostConfig
 	networkingConfig := containerCfg.NetworkingConfig
 
-	var (
-		trustedRef reference.Canonical
-		namedRef   reference.Named
-	)
+	var namedRef reference.Named
+
+	// TODO(thaJeztah): add a platform option-type / flag-type.
+	if options.platform != "" {
+		_, err = platforms.Parse(options.platform)
+		if err != nil {
+			return "", err
+		}
+	}
 
 	containerIDFile, err := newCIDFile(hostConfig.ContainerIDFile)
 	if err != nil {
@@ -227,15 +236,6 @@ func createContainer(ctx context.Context, dockerCli command.Cli, containerCfg *c
 	}
 	if named, ok := ref.(reference.Named); ok {
 		namedRef = reference.TagNameOnly(named)
-
-		if taggedRef, ok := namedRef.(reference.NamedTagged); ok && !options.untrusted {
-			var err error
-			trustedRef, err = image.TrustedReference(ctx, dockerCli, taggedRef)
-			if err != nil {
-				return "", err
-			}
-			config.Image = reference.FamiliarString(trustedRef)
-		}
 	}
 
 	const dockerConfigPathInContainer = "/run/secrets/docker/config.json"
@@ -318,9 +318,6 @@ func createContainer(ctx context.Context, dockerCli command.Cli, containerCfg *c
 		if err := pullImage(ctx, dockerCli, config.Image, options); err != nil {
 			return err
 		}
-		if taggedRef, ok := namedRef.(reference.NamedTagged); ok && trustedRef != nil {
-			return trust.TagTrusted(ctx, dockerCli.Client(), dockerCli.Err(), trustedRef, taggedRef)
-		}
 		return nil
 	}
 
@@ -332,7 +329,14 @@ func createContainer(ctx context.Context, dockerCli command.Cli, containerCfg *c
 
 	hostConfig.ConsoleSize[0], hostConfig.ConsoleSize[1] = dockerCli.Out().GetTtySize()
 
-	response, err := dockerCli.Client().ContainerCreate(ctx, config, hostConfig, networkingConfig, platform, options.name)
+	response, err := dockerCli.Client().ContainerCreate(ctx, client.ContainerCreateOptions{
+		Name: options.name,
+		// Image:            config.Image, // TODO(thaJeztah): pass image-ref separate
+		Platform:         platform,
+		Config:           config,
+		HostConfig:       hostConfig,
+		NetworkingConfig: networkingConfig,
+	})
 	if err != nil {
 		// Pull image if it does not exist locally and we have the PullImageMissing option. Default behavior.
 		if errdefs.IsNotFound(err) && namedRef != nil && options.pull == PullImageMissing {
@@ -346,7 +350,14 @@ func createContainer(ctx context.Context, dockerCli command.Cli, containerCfg *c
 			}
 
 			var retryErr error
-			response, retryErr = dockerCli.Client().ContainerCreate(ctx, config, hostConfig, networkingConfig, platform, options.name)
+			response, retryErr = dockerCli.Client().ContainerCreate(ctx, client.ContainerCreateOptions{
+				Name: options.name,
+				// Image:            config.Image, // TODO(thaJeztah): pass image-ref separate
+				Platform:         platform,
+				Config:           config,
+				HostConfig:       hostConfig,
+				NetworkingConfig: networkingConfig,
+			})
 			if retryErr != nil {
 				return "", retryErr
 			}
@@ -396,7 +407,7 @@ func validatePullOpt(val string) error {
 //
 // The path should be an absolute path in the container, commonly
 // /root/.docker/config.json.
-func copyDockerConfigIntoContainer(ctx context.Context, dockerAPI client.APIClient, containerID string, configPath string, config *configfile.ConfigFile) error {
+func copyDockerConfigIntoContainer(ctx context.Context, apiClient client.APIClient, containerID string, configPath string, config *configfile.ConfigFile) error {
 	var configBuf bytes.Buffer
 	if err := config.SaveToWriter(&configBuf); err != nil {
 		return fmt.Errorf("saving creds: %w", err)
@@ -419,8 +430,11 @@ func copyDockerConfigIntoContainer(ctx context.Context, dockerAPI client.APIClie
 		return fmt.Errorf("closing tar for config copy failed: %w", err)
 	}
 
-	if err := dockerAPI.CopyToContainer(ctx, containerID, "/",
-		&tarBuf, client.CopyToContainerOptions{}); err != nil {
+	_, err := apiClient.CopyToContainer(ctx, containerID, client.CopyToContainerOptions{
+		DestinationPath: "/",
+		Content:         &tarBuf,
+	})
+	if err != nil {
 		return fmt.Errorf("copying config.json into container failed: %w", err)
 	}
 

cli/command/container/create_test.go

@@ -13,13 +13,10 @@ import (
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/config/configfile"
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/notary"
 	"github.com/google/go-cmp/cmp"
 	"github.com/moby/moby/api/types/container"
-	"github.com/moby/moby/api/types/network"
 	"github.com/moby/moby/api/types/system"
 	"github.com/moby/moby/client"
-	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/spf13/pflag"
 	"gotest.tools/v3/assert"
 	is "gotest.tools/v3/assert/cmp"
@@ -117,35 +114,30 @@ func TestCreateContainerImagePullPolicy(t *testing.T) {
 			pullCounter := 0
 
 			apiClient := &fakeClient{
-				createContainerFunc: func(
-					config *container.Config,
-					hostConfig *container.HostConfig,
-					networkingConfig *network.NetworkingConfig,
-					platform *ocispec.Platform,
-					containerName string,
-				) (container.CreateResponse, error) {
+				createContainerFunc: func(options client.ContainerCreateOptions) (client.ContainerCreateResult, error) {
 					defer func() { tc.ResponseCounter++ }()
 					switch tc.ResponseCounter {
 					case 0:
-						return container.CreateResponse{}, fakeNotFound{}
+						return client.ContainerCreateResult{}, fakeNotFound{}
 					default:
-						return container.CreateResponse{ID: containerID}, nil
+						return client.ContainerCreateResult{ID: containerID}, nil
 					}
 				},
-				imageCreateFunc: func(ctx context.Context, parentReference string, options client.ImageCreateOptions) (io.ReadCloser, error) {
+				imagePullFunc: func(ctx context.Context, parentReference string, options client.ImagePullOptions) (client.ImagePullResponse, error) {
 					defer func() { pullCounter++ }()
-					return io.NopCloser(strings.NewReader("")), nil
+					return fakeStreamResult{ReadCloser: io.NopCloser(strings.NewReader(""))}, nil
 				},
-				infoFunc: func() (system.Info, error) {
-					return system.Info{IndexServerAddress: "https://indexserver.example.com"}, nil
+				infoFunc: func() (client.SystemInfoResult, error) {
+					return client.SystemInfoResult{
+						Info: system.Info{IndexServerAddress: "https://indexserver.example.com"},
+					}, nil
 				},
 			}
 			fakeCLI := test.NewFakeCli(apiClient)
 			id, err := createContainer(context.Background(), fakeCLI, config, &createOptions{
-				name:      "name",
-				platform:  runtime.GOOS,
-				untrusted: true,
-				pull:      tc.PullPolicy,
+				name:     "name",
+				platform: runtime.GOOS,
+				pull:     tc.PullPolicy,
 			})
 
 			if tc.ExpectedErrMsg != "" {
@@ -221,56 +213,6 @@ func TestCreateContainerValidateFlags(t *testing.T) {
 	}
 }
 
-func TestNewCreateCommandWithContentTrustErrors(t *testing.T) {
-	testCases := []struct {
-		name          string
-		args          []string
-		expectedError string
-		notaryFunc    test.NotaryClientFuncType
-	}{
-		{
-			name:          "offline-notary-server",
-			notaryFunc:    notary.GetOfflineNotaryRepository,
-			expectedError: "client is offline",
-			args:          []string{"image:tag"},
-		},
-		{
-			name:          "uninitialized-notary-server",
-			notaryFunc:    notary.GetUninitializedNotaryRepository,
-			expectedError: "remote trust data does not exist",
-			args:          []string{"image:tag"},
-		},
-		{
-			name:          "empty-notary-server",
-			notaryFunc:    notary.GetEmptyTargetsNotaryRepository,
-			expectedError: "No valid trust data for tag",
-			args:          []string{"image:tag"},
-		},
-	}
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Setenv("DOCKER_CONTENT_TRUST", "true")
-			fakeCLI := test.NewFakeCli(&fakeClient{
-				createContainerFunc: func(config *container.Config,
-					hostConfig *container.HostConfig,
-					networkingConfig *network.NetworkingConfig,
-					platform *ocispec.Platform,
-					containerName string,
-				) (container.CreateResponse, error) {
-					return container.CreateResponse{}, errors.New("shouldn't try to pull image")
-				},
-			})
-			fakeCLI.SetNotaryClient(tc.notaryFunc)
-			cmd := newCreateCommand(fakeCLI)
-			cmd.SetOut(io.Discard)
-			cmd.SetErr(io.Discard)
-			cmd.SetArgs(tc.args)
-			err := cmd.Execute()
-			assert.ErrorContains(t, err, tc.expectedError)
-		})
-	}
-}
-
 func TestNewCreateCommandWithWarnings(t *testing.T) {
 	testCases := []struct {
 		name     string
@@ -296,13 +238,8 @@ func TestNewCreateCommandWithWarnings(t *testing.T) {
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
 			fakeCLI := test.NewFakeCli(&fakeClient{
-				createContainerFunc: func(config *container.Config,
-					hostConfig *container.HostConfig,
-					networkingConfig *network.NetworkingConfig,
-					platform *ocispec.Platform,
-					containerName string,
-				) (container.CreateResponse, error) {
-					return container.CreateResponse{Warnings: tc.warnings}, nil
+				createContainerFunc: func(options client.ContainerCreateOptions) (client.ContainerCreateResult, error) {
+					return client.ContainerCreateResult{Warnings: tc.warnings}, nil
 				},
 			})
 			cmd := newCreateCommand(fakeCLI)
@@ -335,15 +272,10 @@ func TestCreateContainerWithProxyConfig(t *testing.T) {
 	sort.Strings(expected)
 
 	fakeCLI := test.NewFakeCli(&fakeClient{
-		createContainerFunc: func(config *container.Config,
-			hostConfig *container.HostConfig,
-			networkingConfig *network.NetworkingConfig,
-			platform *ocispec.Platform,
-			containerName string,
-		) (container.CreateResponse, error) {
-			sort.Strings(config.Env)
-			assert.DeepEqual(t, config.Env, expected)
-			return container.CreateResponse{}, nil
+		createContainerFunc: func(options client.ContainerCreateOptions) (client.ContainerCreateResult, error) {
+			sort.Strings(options.Config.Env)
+			assert.DeepEqual(t, options.Config.Env, expected)
+			return client.ContainerCreateResult{}, nil
 		},
 	})
 	fakeCLI.SetConfigFile(&configfile.ConfigFile{

cli/command/container/diff.go

@@ -7,6 +7,7 @@ import (
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/cli/command/completion"
 	"github.com/docker/cli/cli/command/formatter"
+	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
 
@@ -28,7 +29,7 @@ func newDiffCommand(dockerCLI command.Cli) *cobra.Command {
 }
 
 func runDiff(ctx context.Context, dockerCLI command.Cli, containerID string) error {
-	changes, err := dockerCLI.Client().ContainerDiff(ctx, containerID)
+	res, err := dockerCLI.Client().ContainerDiff(ctx, containerID, client.ContainerDiffOptions{})
 	if err != nil {
 		return err
 	}
@@ -36,5 +37,5 @@ func runDiff(ctx context.Context, dockerCLI command.Cli, containerID string) err
 		Output: dockerCLI.Out(),
 		Format: newDiffFormat("{{.Type}} {{.Path}}"),
 	}
-	return diffFormatWrite(diffCtx, changes)
+	return diffFormatWrite(diffCtx, res)
 }

cli/command/container/diff_test.go

@@ -9,28 +9,28 @@ import (
 
 	"github.com/docker/cli/internal/test"
 	"github.com/moby/moby/api/types/container"
+	"github.com/moby/moby/client"
 	"gotest.tools/v3/assert"
 	is "gotest.tools/v3/assert/cmp"
 )
 
 func TestRunDiff(t *testing.T) {
 	cli := test.NewFakeCli(&fakeClient{
-		containerDiffFunc: func(
-			ctx context.Context,
-			containerID string,
-		) ([]container.FilesystemChange, error) {
-			return []container.FilesystemChange{
-				{
-					Kind: container.ChangeModify,
-					Path: "/path/to/file0",
-				},
-				{
-					Kind: container.ChangeAdd,
-					Path: "/path/to/file1",
-				},
-				{
-					Kind: container.ChangeDelete,
-					Path: "/path/to/file2",
+		containerDiffFunc: func(ctx context.Context, containerID string) (client.ContainerDiffResult, error) {
+			return client.ContainerDiffResult{
+				Changes: []container.FilesystemChange{
+					{
+						Kind: container.ChangeModify,
+						Path: "/path/to/file0",
+					},
+					{
+						Kind: container.ChangeAdd,
+						Path: "/path/to/file1",
+					},
+					{
+						Kind: container.ChangeDelete,
+						Path: "/path/to/file2",
+					},
 				},
 			}, nil
 		},
@@ -60,11 +60,8 @@ func TestRunDiffClientError(t *testing.T) {
 	clientError := errors.New("client error")
 
 	cli := test.NewFakeCli(&fakeClient{
-		containerDiffFunc: func(
-			ctx context.Context,
-			containerID string,
-		) ([]container.FilesystemChange, error) {
-			return nil, clientError
+		containerDiffFunc: func(ctx context.Context, containerID string) (client.ContainerDiffResult, error) {
+			return client.ContainerDiffResult{}, clientError
 		},
 	})
 

cli/command/container/exec.go

@@ -72,11 +72,11 @@ func newExecCommand(dockerCLI command.Cli) *cobra.Command {
 	flags.StringVarP(&options.User, "user", "u", "", `Username or UID (format: "<name|uid>[:<group|gid>]")`)
 	flags.BoolVar(&options.Privileged, "privileged", false, "Give extended privileges to the command")
 	flags.VarP(&options.Env, "env", "e", "Set environment variables")
-	flags.SetAnnotation("env", "version", []string{"1.25"})
+	_ = flags.SetAnnotation("env", "version", []string{"1.25"})
 	flags.Var(&options.EnvFile, "env-file", "Read in a file of environment variables")
-	flags.SetAnnotation("env-file", "version", []string{"1.25"})
+	_ = flags.SetAnnotation("env-file", "version", []string{"1.25"})
 	flags.StringVarP(&options.Workdir, "workdir", "w", "", "Working directory inside the container")
-	flags.SetAnnotation("workdir", "version", []string{"1.35"})
+	_ = flags.SetAnnotation("workdir", "version", []string{"1.35"})
 
 	_ = cmd.RegisterFlagCompletionFunc("env", completion.EnvVarNames())
 	_ = cmd.RegisterFlagCompletionFunc("env-file", completion.FileNames())
@@ -97,18 +97,18 @@ func RunExec(ctx context.Context, dockerCLI command.Cli, containerIDorName strin
 	// otherwise if we error out we will leak execIDs on the server (and
 	// there's no easy way to clean those up). But also in order to make "not
 	// exist" errors take precedence we do a dummy inspect first.
-	if _, err := apiClient.ContainerInspect(ctx, containerIDorName); err != nil {
+	if _, err := apiClient.ContainerInspect(ctx, containerIDorName, client.ContainerInspectOptions{}); err != nil {
 		return err
 	}
 	if !options.Detach {
-		if err := dockerCLI.In().CheckTty(execOptions.AttachStdin, execOptions.Tty); err != nil {
+		if err := dockerCLI.In().CheckTty(execOptions.AttachStdin, execOptions.TTY); err != nil {
 			return err
 		}
 	}
 
 	fillConsoleSize(execOptions, dockerCLI)
 
-	response, err := apiClient.ContainerExecCreate(ctx, containerIDorName, *execOptions)
+	response, err := apiClient.ExecCreate(ctx, containerIDorName, *execOptions)
 	if err != nil {
 		return err
 	}
@@ -119,19 +119,20 @@ func RunExec(ctx context.Context, dockerCLI command.Cli, containerIDorName strin
 	}
 
 	if options.Detach {
-		return apiClient.ContainerExecStart(ctx, execID, client.ExecStartOptions{
+		_, err := apiClient.ExecStart(ctx, execID, client.ExecStartOptions{
 			Detach:      options.Detach,
-			Tty:         execOptions.Tty,
-			ConsoleSize: execOptions.ConsoleSize,
+			TTY:         execOptions.TTY,
+			ConsoleSize: client.ConsoleSize{Height: execOptions.ConsoleSize.Height, Width: execOptions.ConsoleSize.Width},
 		})
+		return err
 	}
 	return interactiveExec(ctx, dockerCLI, execOptions, execID)
 }
 
 func fillConsoleSize(execOptions *client.ExecCreateOptions, dockerCli command.Cli) {
-	if execOptions.Tty {
+	if execOptions.TTY {
 		height, width := dockerCli.Out().GetTtySize()
-		execOptions.ConsoleSize = &[2]uint{height, width}
+		execOptions.ConsoleSize = client.ConsoleSize{Height: height, Width: width}
 	}
 }
 
@@ -149,7 +150,7 @@ func interactiveExec(ctx context.Context, dockerCli command.Cli, execOptions *cl
 		out = dockerCli.Out()
 	}
 	if execOptions.AttachStderr {
-		if execOptions.Tty {
+		if execOptions.TTY {
 			stderr = dockerCli.Out()
 		} else {
 			stderr = dockerCli.Err()
@@ -158,9 +159,9 @@ func interactiveExec(ctx context.Context, dockerCli command.Cli, execOptions *cl
 	fillConsoleSize(execOptions, dockerCli)
 
 	apiClient := dockerCli.Client()
-	resp, err := apiClient.ContainerExecAttach(ctx, execID, client.ExecAttachOptions{
-		Tty:         execOptions.Tty,
-		ConsoleSize: execOptions.ConsoleSize,
+	resp, err := apiClient.ExecAttach(ctx, execID, client.ExecAttachOptions{
+		TTY:         execOptions.TTY,
+		ConsoleSize: client.ConsoleSize{Height: execOptions.ConsoleSize.Height, Width: execOptions.ConsoleSize.Width},
 	})
 	if err != nil {
 		return err
@@ -177,8 +178,8 @@ func interactiveExec(ctx context.Context, dockerCli command.Cli, execOptions *cl
 				inputStream:  in,
 				outputStream: out,
 				errorStream:  stderr,
-				resp:         resp,
-				tty:          execOptions.Tty,
+				resp:         resp.HijackedResponse,
+				tty:          execOptions.TTY,
 				detachKeys:   execOptions.DetachKeys,
 			}
 
@@ -186,7 +187,7 @@ func interactiveExec(ctx context.Context, dockerCli command.Cli, execOptions *cl
 		}()
 	}()
 
-	if execOptions.Tty && dockerCli.In().IsTerminal() {
+	if execOptions.TTY && dockerCli.In().IsTerminal() {
 		if err := MonitorTtySize(ctx, dockerCli, execID, true); err != nil {
 			_, _ = fmt.Fprintln(dockerCli.Err(), "Error monitoring TTY size:", err)
 		}
@@ -200,8 +201,8 @@ func interactiveExec(ctx context.Context, dockerCli command.Cli, execOptions *cl
 	return getExecExitStatus(ctx, apiClient, execID)
 }
 
-func getExecExitStatus(ctx context.Context, apiClient client.ContainerAPIClient, execID string) error {
-	resp, err := apiClient.ContainerExecInspect(ctx, execID)
+func getExecExitStatus(ctx context.Context, apiClient client.ExecAPIClient, execID string) error {
+	resp, err := apiClient.ExecInspect(ctx, execID, client.ExecInspectOptions{})
 	if err != nil {
 		// If we can't connect, then the daemon probably died.
 		if !client.IsErrConnectionFailed(err) {
@@ -222,7 +223,7 @@ func parseExec(execOpts ExecOptions, configFile *configfile.ConfigFile) (*client
 	execOptions := &client.ExecCreateOptions{
 		User:       execOpts.User,
 		Privileged: execOpts.Privileged,
-		Tty:        execOpts.TTY,
+		TTY:        execOpts.TTY,
 		Cmd:        execOpts.Command,
 		WorkingDir: execOpts.Workdir,
 	}

cli/command/container/exec_test.go

@@ -12,7 +12,6 @@ import (
 	"github.com/docker/cli/cli/config/configfile"
 	"github.com/docker/cli/internal/test"
 	"github.com/docker/cli/opts"
-	"github.com/moby/moby/api/types/container"
 	"github.com/moby/moby/client"
 	"gotest.tools/v3/assert"
 	is "gotest.tools/v3/assert/cmp"
@@ -70,7 +69,7 @@ TWO=2
 				AttachStdin:  true,
 				AttachStdout: true,
 				AttachStderr: true,
-				Tty:          true,
+				TTY:          true,
 				Cmd:          []string{"command"},
 			},
 		},
@@ -87,7 +86,7 @@ TWO=2
 				Detach:      true,
 			}),
 			expected: client.ExecCreateOptions{
-				Tty: true,
+				TTY: true,
 				Cmd: []string{"command"},
 			},
 		},
@@ -119,7 +118,7 @@ TWO=2
 			},
 			options: func() ExecOptions {
 				o := withDefaultOpts(ExecOptions{})
-				o.EnvFile.Set(tmpFile.Path())
+				_ = o.EnvFile.Set(tmpFile.Path())
 				return o
 			}(),
 		},
@@ -132,8 +131,8 @@ TWO=2
 			},
 			options: func() ExecOptions {
 				o := withDefaultOpts(ExecOptions{})
-				o.EnvFile.Set(tmpFile.Path())
-				o.Env.Set("ONE=override")
+				_ = o.EnvFile.Set(tmpFile.Path())
+				_ = o.Env.Set("ONE=override")
 				return o
 			}(),
 		},
@@ -150,7 +149,7 @@ TWO=2
 
 func TestParseExecNoSuchFile(t *testing.T) {
 	execOpts := withDefaultOpts(ExecOptions{})
-	execOpts.EnvFile.Set("no-such-env-file")
+	assert.Check(t, execOpts.EnvFile.Set("no-such-env-file"))
 	execConfig, err := parseExec(execOpts, &configfile.ConfigFile{})
 	assert.ErrorContains(t, err, "no-such-env-file")
 	assert.Check(t, os.IsNotExist(err))
@@ -177,8 +176,8 @@ func TestRunExec(t *testing.T) {
 			doc:     "inspect error",
 			options: NewExecOptions(),
 			client: &fakeClient{
-				inspectFunc: func(string) (container.InspectResponse, error) {
-					return container.InspectResponse{}, errors.New("failed inspect")
+				inspectFunc: func(string) (client.ContainerInspectResult, error) {
+					return client.ContainerInspectResult{}, errors.New("failed inspect")
 				},
 			},
 			expectedError: "failed inspect",
@@ -195,7 +194,7 @@ func TestRunExec(t *testing.T) {
 		t.Run(testcase.doc, func(t *testing.T) {
 			fakeCLI := test.NewFakeCli(testcase.client)
 
-			err := RunExec(context.TODO(), fakeCLI, "thecontainer", testcase.options)
+			err := RunExec(context.TODO(), fakeCLI, "the-container", testcase.options)
 			if testcase.expectedError != "" {
 				assert.ErrorContains(t, err, testcase.expectedError)
 			} else if !assert.Check(t, err) {
@@ -207,8 +206,8 @@ func TestRunExec(t *testing.T) {
 	}
 }
 
-func execCreateWithID(_ string, _ client.ExecCreateOptions) (container.ExecCreateResponse, error) {
-	return container.ExecCreateResponse{ID: "execid"}, nil
+func execCreateWithID(_ string, _ client.ExecCreateOptions) (client.ExecCreateResult, error) {
+	return client.ExecCreateResult{ID: "exec-id"}, nil
 }
 
 func TestGetExecExitStatus(t *testing.T) {
@@ -236,9 +235,9 @@ func TestGetExecExitStatus(t *testing.T) {
 
 	for _, testcase := range testcases {
 		apiClient := &fakeClient{
-			execInspectFunc: func(id string) (client.ExecInspect, error) {
+			execInspectFunc: func(id string) (client.ExecInspectResult, error) {
 				assert.Check(t, is.Equal(execID, id))
-				return client.ExecInspect{ExitCode: testcase.exitCode}, testcase.inspectError
+				return client.ExecInspectResult{ExitCode: testcase.exitCode}, testcase.inspectError
 			},
 		}
 		err := getExecExitStatus(context.Background(), apiClient, execID)
@@ -251,14 +250,14 @@ func TestNewExecCommandErrors(t *testing.T) {
 		name                 string
 		args                 []string
 		expectedError        string
-		containerInspectFunc func(img string) (container.InspectResponse, error)
+		containerInspectFunc func(img string) (client.ContainerInspectResult, error)
 	}{
 		{
 			name:          "client-error",
 			args:          []string{"5cb5bb5e4a3b", "-t", "-i", "bash"},
 			expectedError: "something went wrong",
-			containerInspectFunc: func(containerID string) (container.InspectResponse, error) {
-				return container.InspectResponse{}, errors.New("something went wrong")
+			containerInspectFunc: func(containerID string) (client.ContainerInspectResult, error) {
+				return client.ContainerInspectResult{}, errors.New("something went wrong")
 			},
 		},
 	}

cli/command/container/export.go

@@ -9,6 +9,7 @@ import (
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/cli/command/completion"
+	"github.com/moby/moby/client"
 	"github.com/moby/sys/atomicwriter"
 	"github.com/spf13/cobra"
 )
@@ -60,7 +61,7 @@ func runExport(ctx context.Context, dockerCLI command.Cli, opts exportOptions) e
 		output = writer
 	}
 
-	responseBody, err := dockerCLI.Client().ContainerExport(ctx, opts.container)
+	responseBody, err := dockerCLI.Client().ContainerExport(ctx, opts.container, client.ContainerExportOptions{})
 	if err != nil {
 		return err
 	}

cli/command/container/export_test.go

@@ -2,10 +2,10 @@ package container
 
 import (
 	"io"
-	"strings"
 	"testing"
 
 	"github.com/docker/cli/internal/test"
+	"github.com/moby/moby/client"
 	"gotest.tools/v3/assert"
 	"gotest.tools/v3/fs"
 )
@@ -15,8 +15,9 @@ func TestContainerExportOutputToFile(t *testing.T) {
 	defer dir.Remove()
 
 	cli := test.NewFakeCli(&fakeClient{
-		containerExportFunc: func(container string) (io.ReadCloser, error) {
-			return io.NopCloser(strings.NewReader("bar")), nil
+		containerExportFunc: func(container string) (client.ContainerExportResult, error) {
+			// FIXME(thaJeztah): how to mock this?
+			return mockContainerExportResult("bar"), nil
 		},
 	})
 	cmd := newExportCommand(cli)
@@ -33,8 +34,9 @@ func TestContainerExportOutputToFile(t *testing.T) {
 
 func TestContainerExportOutputToIrregularFile(t *testing.T) {
 	cli := test.NewFakeCli(&fakeClient{
-		containerExportFunc: func(container string) (io.ReadCloser, error) {
-			return io.NopCloser(strings.NewReader("foo")), nil
+		containerExportFunc: func(container string) (client.ContainerExportResult, error) {
+			// FIXME(thaJeztah): how to mock this?
+			return mockContainerExportResult("foo"), nil
 		},
 	})
 	cmd := newExportCommand(cli)

cli/command/container/formatter_diff.go

@@ -3,6 +3,7 @@ package container
 import (
 	"github.com/docker/cli/cli/command/formatter"
 	"github.com/moby/moby/api/types/container"
+	"github.com/moby/moby/client"
 )
 
 const (
@@ -21,9 +22,9 @@ func newDiffFormat(source string) formatter.Format {
 }
 
 // diffFormatWrite writes formatted diff using the [formatter.Context].
-func diffFormatWrite(fmtCtx formatter.Context, changes []container.FilesystemChange) error {
+func diffFormatWrite(fmtCtx formatter.Context, changes client.ContainerDiffResult) error {
 	return fmtCtx.Write(newDiffContext(), func(format func(subContext formatter.SubContext) error) error {
-		for _, change := range changes {
+		for _, change := range changes.Changes {
 			if err := format(&diffContext{c: change}); err != nil {
 				return err
 			}

cli/command/container/formatter_diff_test.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/docker/cli/cli/command/formatter"
 	"github.com/moby/moby/api/types/container"
+	"github.com/moby/moby/client"
 	"gotest.tools/v3/assert"
 )
 
@@ -40,10 +41,12 @@ D: /usr/app/old_app.js
 		},
 	}
 
-	diffs := []container.FilesystemChange{
-		{Kind: container.ChangeModify, Path: "/var/log/app.log"},
-		{Kind: container.ChangeAdd, Path: "/usr/app/app.js"},
-		{Kind: container.ChangeDelete, Path: "/usr/app/old_app.js"},
+	diffs := client.ContainerDiffResult{
+		Changes: []container.FilesystemChange{
+			{Kind: container.ChangeModify, Path: "/var/log/app.log"},
+			{Kind: container.ChangeAdd, Path: "/usr/app/app.js"},
+			{Kind: container.ChangeDelete, Path: "/usr/app/old_app.js"},
+		},
 	}
 
 	for _, tc := range cases {

cli/command/container/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.23
+//go:build go1.24
 
 package container
 
@@ -11,6 +11,7 @@ import (
 	"github.com/docker/cli/cli/command/completion"
 	"github.com/docker/cli/cli/command/inspect"
 	flagsHelper "github.com/docker/cli/cli/flags"
+	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
 
@@ -46,6 +47,10 @@ func newInspectCommand(dockerCLI command.Cli) *cobra.Command {
 func runInspect(ctx context.Context, dockerCLI command.Cli, opts inspectOptions) error {
 	apiClient := dockerCLI.Client()
 	return inspect.Inspect(dockerCLI.Out(), opts.refs, opts.format, func(ref string) (any, []byte, error) {
-		return apiClient.ContainerInspectWithRaw(ctx, ref, opts.size)
+		res, err := apiClient.ContainerInspect(ctx, ref, client.ContainerInspectOptions{Size: opts.size})
+		if err != nil {
+			return nil, nil, err
+		}
+		return &res.Container, res.Raw, nil
 	})
 }

cli/command/container/kill.go

@@ -8,6 +8,7 @@ import (
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/cli/command/completion"
+	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
 
@@ -47,7 +48,10 @@ func newKillCommand(dockerCLI command.Cli) *cobra.Command {
 func runKill(ctx context.Context, dockerCLI command.Cli, opts *killOptions) error {
 	apiClient := dockerCLI.Client()
 	errChan := parallelOperation(ctx, opts.containers, func(ctx context.Context, container string) error {
-		return apiClient.ContainerKill(ctx, container, opts.signal)
+		_, err := apiClient.ContainerKill(ctx, container, client.ContainerKillOptions{
+			Signal: opts.signal,
+		})
+		return err
 	})
 
 	var errs []error

cli/command/container/kill_test.go

@@ -8,19 +8,16 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
+	"github.com/moby/moby/client"
 	"gotest.tools/v3/assert"
 	is "gotest.tools/v3/assert/cmp"
 )
 
 func TestRunKill(t *testing.T) {
 	cli := test.NewFakeCli(&fakeClient{
-		containerKillFunc: func(
-			ctx context.Context,
-			container string,
-			signal string,
-		) error {
-			assert.Assert(t, is.Equal(signal, "STOP"))
-			return nil
+		containerKillFunc: func(ctx context.Context, container string, options client.ContainerKillOptions) (client.ContainerKillResult, error) {
+			assert.Assert(t, is.Equal(options.Signal, "STOP"))
+			return client.ContainerKillResult{}, nil
 		},
 	})
 
@@ -47,12 +44,8 @@ func TestRunKill(t *testing.T) {
 
 func TestRunKillClientError(t *testing.T) {
 	cli := test.NewFakeCli(&fakeClient{
-		containerKillFunc: func(
-			ctx context.Context,
-			container string,
-			signal string,
-		) error {
-			return fmt.Errorf("client error for container %s", container)
+		containerKillFunc: func(ctx context.Context, container string, options client.ContainerKillOptions) (client.ContainerKillResult, error) {
+			return client.ContainerKillResult{}, fmt.Errorf("client error for container %s", container)
 		},
 	})
 

cli/command/container/list.go

@@ -68,8 +68,8 @@ func newListCommand(dockerCLI command.Cli) *cobra.Command {
 	return &cmd
 }
 
-func buildContainerListOptions(options *psOptions) (*client.ContainerListOptions, error) {
-	listOptions := &client.ContainerListOptions{
+func buildContainerListOptions(options *psOptions) (client.ContainerListOptions, error) {
+	listOptions := client.ContainerListOptions{
 		All:     options.all,
 		Limit:   options.last,
 		Size:    options.size,
@@ -84,7 +84,7 @@ func buildContainerListOptions(options *psOptions) (*client.ContainerListOptions
 	if len(options.format) > 0 {
 		tmpl, err := templates.Parse(options.format)
 		if err != nil {
-			return nil, fmt.Errorf("failed to parse template: %w", err)
+			return client.ContainerListOptions{}, fmt.Errorf("failed to parse template: %w", err)
 		}
 
 		optionsProcessor := formatter.NewContainerContext()
@@ -92,7 +92,7 @@ func buildContainerListOptions(options *psOptions) (*client.ContainerListOptions
 		// This shouldn't error out but swallowing the error makes it harder
 		// to track down if preProcessor issues come up.
 		if err := tmpl.Execute(io.Discard, optionsProcessor); err != nil {
-			return nil, fmt.Errorf("failed to execute template: %w", err)
+			return client.ContainerListOptions{}, fmt.Errorf("failed to execute template: %w", err)
 		}
 
 		// if `size` was not explicitly set to false (with `--size=false`)
@@ -127,7 +127,7 @@ func runPs(ctx context.Context, dockerCLI command.Cli, options *psOptions) error
 		return err
 	}
 
-	containers, err := dockerCLI.Client().ContainerList(ctx, *listOptions)
+	res, err := dockerCLI.Client().ContainerList(ctx, listOptions)
 	if err != nil {
 		return err
 	}
@@ -137,5 +137,5 @@ func runPs(ctx context.Context, dockerCLI command.Cli, options *psOptions) error
 		Format: formatter.NewContainerFormat(options.format, options.quiet, listOptions.Size),
 		Trunc:  !options.noTrunc,
 	}
-	return formatter.ContainerWrite(containerCtx, containers)
+	return formatter.ContainerWrite(containerCtx, res.Items)
 }

cli/command/container/list_test.go

@@ -109,7 +109,7 @@ func TestContainerListBuildContainerListOptions(t *testing.T) {
 func TestContainerListErrors(t *testing.T) {
 	testCases := []struct {
 		flags             map[string]string
-		containerListFunc func(client.ContainerListOptions) ([]container.Summary, error)
+		containerListFunc func(client.ContainerListOptions) (client.ContainerListResult, error)
 		expectedError     string
 	}{
 		{
@@ -125,8 +125,8 @@ func TestContainerListErrors(t *testing.T) {
 			expectedError: `wrong number of args for join`,
 		},
 		{
-			containerListFunc: func(_ client.ContainerListOptions) ([]container.Summary, error) {
-				return nil, errors.New("error listing containers")
+			containerListFunc: func(_ client.ContainerListOptions) (client.ContainerListResult, error) {
+				return client.ContainerListResult{}, errors.New("error listing containers")
 			},
 			expectedError: "error listing containers",
 		},
@@ -149,13 +149,15 @@ func TestContainerListErrors(t *testing.T) {
 
 func TestContainerListWithoutFormat(t *testing.T) {
 	cli := test.NewFakeCli(&fakeClient{
-		containerListFunc: func(_ client.ContainerListOptions) ([]container.Summary, error) {
-			return []container.Summary{
-				*builders.Container("c1"),
-				*builders.Container("c2", builders.WithName("foo")),
-				*builders.Container("c3", builders.WithPort(80, 80, builders.TCP), builders.WithPort(81, 81, builders.TCP), builders.WithPort(82, 82, builders.TCP)),
-				*builders.Container("c4", builders.WithPort(81, 81, builders.UDP)),
-				*builders.Container("c5", builders.WithPort(82, 82, builders.IP("8.8.8.8"), builders.TCP)),
+		containerListFunc: func(_ client.ContainerListOptions) (client.ContainerListResult, error) {
+			return client.ContainerListResult{
+				Items: []container.Summary{
+					*builders.Container("c1"),
+					*builders.Container("c2", builders.WithName("foo")),
+					*builders.Container("c3", builders.WithPort(80, 80, builders.TCP), builders.WithPort(81, 81, builders.TCP), builders.WithPort(82, 82, builders.TCP)),
+					*builders.Container("c4", builders.WithPort(81, 81, builders.UDP)),
+					*builders.Container("c5", builders.WithPort(82, 82, builders.IP("8.8.8.8"), builders.TCP)),
+				},
 			}, nil
 		},
 	})
@@ -169,10 +171,12 @@ func TestContainerListWithoutFormat(t *testing.T) {
 
 func TestContainerListNoTrunc(t *testing.T) {
 	cli := test.NewFakeCli(&fakeClient{
-		containerListFunc: func(_ client.ContainerListOptions) ([]container.Summary, error) {
-			return []container.Summary{
-				*builders.Container("c1"),
-				*builders.Container("c2", builders.WithName("foo/bar")),
+		containerListFunc: func(_ client.ContainerListOptions) (client.ContainerListResult, error) {
+			return client.ContainerListResult{
+				Items: []container.Summary{
+					*builders.Container("c1"),
+					*builders.Container("c2", builders.WithName("foo/bar")),
+				},
 			}, nil
 		},
 	})
@@ -188,10 +192,12 @@ func TestContainerListNoTrunc(t *testing.T) {
 // Test for GitHub issue docker/docker#21772
 func TestContainerListNamesMultipleTime(t *testing.T) {
 	cli := test.NewFakeCli(&fakeClient{
-		containerListFunc: func(_ client.ContainerListOptions) ([]container.Summary, error) {
-			return []container.Summary{
-				*builders.Container("c1"),
-				*builders.Container("c2", builders.WithName("foo/bar")),
+		containerListFunc: func(_ client.ContainerListOptions) (client.ContainerListResult, error) {
+			return client.ContainerListResult{
+				Items: []container.Summary{
+					*builders.Container("c1"),
+					*builders.Container("c2", builders.WithName("foo/bar")),
+				},
 			}, nil
 		},
 	})
@@ -207,10 +213,12 @@ func TestContainerListNamesMultipleTime(t *testing.T) {
 // Test for GitHub issue docker/docker#30291
 func TestContainerListFormatTemplateWithArg(t *testing.T) {
 	cli := test.NewFakeCli(&fakeClient{
-		containerListFunc: func(_ client.ContainerListOptions) ([]container.Summary, error) {
-			return []container.Summary{
-				*builders.Container("c1", builders.WithLabel("some.label", "value")),
-				*builders.Container("c2", builders.WithName("foo/bar"), builders.WithLabel("foo", "bar")),
+		containerListFunc: func(_ client.ContainerListOptions) (client.ContainerListResult, error) {
+			return client.ContainerListResult{
+				Items: []container.Summary{
+					*builders.Container("c1", builders.WithLabel("some.label", "value")),
+					*builders.Container("c2", builders.WithName("foo/bar"), builders.WithLabel("foo", "bar")),
+				},
 			}, nil
 		},
 	})
@@ -260,9 +268,9 @@ func TestContainerListFormatSizeSetsOption(t *testing.T) {
 	for _, tc := range tests {
 		t.Run(tc.doc, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{
-				containerListFunc: func(options client.ContainerListOptions) ([]container.Summary, error) {
+				containerListFunc: func(options client.ContainerListOptions) (client.ContainerListResult, error) {
 					assert.Check(t, is.Equal(options.Size, tc.sizeExpected))
-					return []container.Summary{}, nil
+					return client.ContainerListResult{}, nil
 				},
 			})
 			cmd := newListCommand(cli)
@@ -280,10 +288,12 @@ func TestContainerListFormatSizeSetsOption(t *testing.T) {
 
 func TestContainerListWithConfigFormat(t *testing.T) {
 	cli := test.NewFakeCli(&fakeClient{
-		containerListFunc: func(_ client.ContainerListOptions) ([]container.Summary, error) {
-			return []container.Summary{
-				*builders.Container("c1", builders.WithLabel("some.label", "value"), builders.WithSize(10700000)),
-				*builders.Container("c2", builders.WithName("foo/bar"), builders.WithLabel("foo", "bar"), builders.WithSize(3200000)),
+		containerListFunc: func(_ client.ContainerListOptions) (client.ContainerListResult, error) {
+			return client.ContainerListResult{
+				Items: []container.Summary{
+					*builders.Container("c1", builders.WithLabel("some.label", "value"), builders.WithSize(10700000)),
+					*builders.Container("c2", builders.WithName("foo/bar"), builders.WithLabel("foo", "bar"), builders.WithSize(3200000)),
+				},
 			}, nil
 		},
 	})
@@ -300,10 +310,12 @@ func TestContainerListWithConfigFormat(t *testing.T) {
 
 func TestContainerListWithFormat(t *testing.T) {
 	cli := test.NewFakeCli(&fakeClient{
-		containerListFunc: func(_ client.ContainerListOptions) ([]container.Summary, error) {
-			return []container.Summary{
-				*builders.Container("c1", builders.WithLabel("some.label", "value")),
-				*builders.Container("c2", builders.WithName("foo/bar"), builders.WithLabel("foo", "bar")),
+		containerListFunc: func(_ client.ContainerListOptions) (client.ContainerListResult, error) {
+			return client.ContainerListResult{
+				Items: []container.Summary{
+					*builders.Container("c1", builders.WithLabel("some.label", "value")),
+					*builders.Container("c2", builders.WithName("foo/bar"), builders.WithLabel("foo", "bar")),
+				},
 			}, nil
 		},
 	})

cli/command/container/logs.go

@@ -54,12 +54,12 @@ func newLogsCommand(dockerCLI command.Cli) *cobra.Command {
 }
 
 func runLogs(ctx context.Context, dockerCli command.Cli, opts *logsOptions) error {
-	c, err := dockerCli.Client().ContainerInspect(ctx, opts.container)
+	c, err := dockerCli.Client().ContainerInspect(ctx, opts.container, client.ContainerInspectOptions{})
 	if err != nil {
 		return err
 	}
 
-	responseBody, err := dockerCli.Client().ContainerLogs(ctx, c.ID, client.ContainerLogsOptions{
+	resp, err := dockerCli.Client().ContainerLogs(ctx, c.Container.ID, client.ContainerLogsOptions{
 		ShowStdout: true,
 		ShowStderr: true,
 		Since:      opts.since,
@@ -72,12 +72,12 @@ func runLogs(ctx context.Context, dockerCli command.Cli, opts *logsOptions) erro
 	if err != nil {
 		return err
 	}
-	defer responseBody.Close()
+	defer func() { _ = resp.Close() }()
 
-	if c.Config.Tty {
-		_, err = io.Copy(dockerCli.Out(), responseBody)
+	if c.Container.Config.Tty {
+		_, err = io.Copy(dockerCli.Out(), resp)
 	} else {
-		_, err = stdcopy.StdCopy(dockerCli.Out(), dockerCli.Err(), responseBody)
+		_, err = stdcopy.StdCopy(dockerCli.Out(), dockerCli.Err(), resp)
 	}
 	return err
 }

cli/command/container/logs_test.go

@@ -2,8 +2,6 @@ package container
 
 import (
 	"context"
-	"io"
-	"strings"
 	"testing"
 
 	"github.com/docker/cli/internal/test"
@@ -13,17 +11,13 @@ import (
 	is "gotest.tools/v3/assert/cmp"
 )
 
-var logFn = func(expectedOut string) func(string, client.ContainerLogsOptions) (io.ReadCloser, error) {
-	return func(container string, opts client.ContainerLogsOptions) (io.ReadCloser, error) {
-		return io.NopCloser(strings.NewReader(expectedOut)), nil
-	}
-}
-
 func TestRunLogs(t *testing.T) {
-	inspectFn := func(containerID string) (container.InspectResponse, error) {
-		return container.InspectResponse{
-			Config: &container.Config{Tty: true},
-			State:  &container.State{Running: false},
+	inspectFn := func(containerID string) (client.ContainerInspectResult, error) {
+		return client.ContainerInspectResult{
+			Container: container.InspectResponse{
+				Config: &container.Config{Tty: true},
+				State:  &container.State{Running: false},
+			},
 		}, nil
 	}
 
@@ -39,7 +33,13 @@ func TestRunLogs(t *testing.T) {
 			doc:         "successful logs",
 			expectedOut: "foo",
 			options:     &logsOptions{},
-			client:      &fakeClient{logFunc: logFn("foo"), inspectFunc: inspectFn},
+			client: &fakeClient{
+				logFunc: func(container string, opts client.ContainerLogsOptions) (client.ContainerLogsResult, error) {
+					// FIXME(thaJeztah): how to mock this?
+					return mockContainerLogsResult("foo"), nil
+				},
+				inspectFunc: inspectFn,
+			},
 		},
 	}
 

cli/command/container/opts.go

@@ -1,3 +1,6 @@
+// FIXME(vvoland): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
+//go:build go1.24
+
 package container
 
 import (
@@ -11,6 +14,7 @@ import (
 	"path"
 	"path/filepath"
 	"reflect"
+	"slices"
 	"strings"
 	"time"
 
@@ -881,10 +885,11 @@ func parseNetworkAttachmentOpt(ep opts.NetworkAttachmentOpts) (*network.Endpoint
 		}
 	}
 	if ep.MacAddress != "" {
-		if _, err := net.ParseMAC(strings.TrimSpace(ep.MacAddress)); err != nil {
+		ma, err := net.ParseMAC(strings.TrimSpace(ep.MacAddress))
+		if err != nil {
 			return nil, fmt.Errorf("%s is not a valid mac address", ep.MacAddress)
 		}
-		epConfig.MacAddress = ep.MacAddress
+		epConfig.MacAddress = network.HardwareAddr(ma)
 	}
 	return epConfig, nil
 }
@@ -1130,10 +1135,8 @@ func validateLinuxPath(val string, validator func(string) bool) (string, error)
 // validateAttach validates that the specified string is a valid attach option.
 func validateAttach(val string) (string, error) {
 	s := strings.ToLower(val)
-	for _, str := range []string{"stdin", "stdout", "stderr"} {
-		if s == str {
-			return s, nil
-		}
+	if slices.Contains([]string{"stdin", "stdout", "stderr"}, s) {
+		return s, nil
 	}
 	return val, errors.New("valid streams are STDIN, STDOUT and STDERR")
 }

cli/command/container/opts_test.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"net"
 	"net/netip"
 	"os"
 	"runtime"
@@ -20,6 +21,14 @@ import (
 	"gotest.tools/v3/skip"
 )
 
+func mustParseMAC(s string) networktypes.HardwareAddr {
+	mac, err := net.ParseMAC(s)
+	if err != nil {
+		panic(err)
+	}
+	return networktypes.HardwareAddr(mac)
+}
+
 func TestValidateAttach(t *testing.T) {
 	valid := []string{
 		"stdin",
@@ -353,7 +362,7 @@ func TestParseWithMacAddress(t *testing.T) {
 	}
 	_, hostConfig, nwConfig := mustParse(t, validMacAddress)
 	defaultNw := hostConfig.NetworkMode.NetworkName()
-	if nwConfig.EndpointsConfig[defaultNw].MacAddress != "92:d0:c6:0a:29:33" {
+	if nwConfig.EndpointsConfig[defaultNw].MacAddress.String() != "92:d0:c6:0a:29:33" {
 		t.Fatalf("Expected the default endpoint to have the MacAddress '92:d0:c6:0a:29:33' set, got '%v'", nwConfig.EndpointsConfig[defaultNw].MacAddress)
 	}
 }
@@ -650,7 +659,7 @@ func TestParseNetworkConfig(t *testing.T) {
 					Aliases: []string{"web3"},
 				},
 				"net4": {
-					MacAddress: "02:32:1c:23:00:04",
+					MacAddress: mustParseMAC("02:32:1c:23:00:04"),
 					IPAMConfig: &networktypes.EndpointIPAMConfig{
 						LinkLocalIPs: []netip.Addr{netip.MustParseAddr("169.254.169.254")},
 					},
@@ -672,7 +681,7 @@ func TestParseNetworkConfig(t *testing.T) {
 						IPv6Address: netip.MustParseAddr("2001:db8::8822"),
 					},
 					Aliases:    []string{"web1", "web2"},
-					MacAddress: "02:32:1c:23:00:04",
+					MacAddress: mustParseMAC("02:32:1c:23:00:04"),
 				},
 			},
 			expectedHostCfg: container.HostConfig{NetworkMode: "net1"},
@@ -689,7 +698,7 @@ func TestParseNetworkConfig(t *testing.T) {
 			expected: map[string]*networktypes.EndpointSettings{
 				"net1": {
 					Aliases:    []string{"foobar"},
-					MacAddress: "52:0f:f3:dc:50:10",
+					MacAddress: mustParseMAC("52:0f:f3:dc:50:10"),
 				},
 			},
 			expectedHostCfg: container.HostConfig{NetworkMode: "net1"},

cli/command/container/pause.go

@@ -9,6 +9,7 @@ import (
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/cli/command/completion"
 	"github.com/moby/moby/api/types/container"
+	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
 
@@ -40,7 +41,10 @@ func newPauseCommand(dockerCLI command.Cli) *cobra.Command {
 
 func runPause(ctx context.Context, dockerCLI command.Cli, opts *pauseOptions) error {
 	apiClient := dockerCLI.Client()
-	errChan := parallelOperation(ctx, opts.containers, apiClient.ContainerPause)
+	errChan := parallelOperation(ctx, opts.containers, func(ctx context.Context, container string) error {
+		_, err := apiClient.ContainerPause(ctx, container, client.ContainerPauseOptions{})
+		return err
+	})
 
 	var errs []error
 	for _, ctr := range opts.containers {

cli/command/container/pause_test.go

@@ -8,18 +8,13 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
+	"github.com/moby/moby/client"
 	"gotest.tools/v3/assert"
 	is "gotest.tools/v3/assert/cmp"
 )
 
 func TestRunPause(t *testing.T) {
-	cli := test.NewFakeCli(
-		&fakeClient{
-			containerPauseFunc: func(ctx context.Context, container string) error {
-				return nil
-			},
-		},
-	)
+	cli := test.NewFakeCli(&fakeClient{})
 
 	cmd := newPauseCommand(cli)
 	cmd.SetOut(io.Discard)
@@ -41,8 +36,8 @@ func TestRunPause(t *testing.T) {
 func TestRunPauseClientError(t *testing.T) {
 	cli := test.NewFakeCli(
 		&fakeClient{
-			containerPauseFunc: func(ctx context.Context, container string) error {
-				return fmt.Errorf("client error for container %s", container)
+			containerPauseFunc: func(ctx context.Context, container string, options client.ContainerPauseOptions) (client.ContainerPauseResult, error) {
+				return client.ContainerPauseResult{}, fmt.Errorf("client error for container %s", container)
 			},
 		},
 	)

cli/command/container/port.go

@@ -12,6 +12,7 @@ import (
 	"github.com/docker/cli/cli/command/completion"
 	"github.com/fvbommel/sortorder"
 	"github.com/moby/moby/api/types/network"
+	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
 
@@ -52,7 +53,7 @@ func newPortCommand(dockerCLI command.Cli) *cobra.Command {
 // proto is specified. We should consider changing this to "any" protocol
 // for the given private port.
 func runPort(ctx context.Context, dockerCli command.Cli, opts *portOptions) error {
-	c, err := dockerCli.Client().ContainerInspect(ctx, opts.container)
+	c, err := dockerCli.Client().ContainerInspect(ctx, opts.container, client.ContainerInspectOptions{})
 	if err != nil {
 		return err
 	}
@@ -63,7 +64,7 @@ func runPort(ctx context.Context, dockerCli command.Cli, opts *portOptions) erro
 		if err != nil {
 			return err
 		}
-		frontends, exists := c.NetworkSettings.Ports[port]
+		frontends, exists := c.Container.NetworkSettings.Ports[port]
 		if !exists || len(frontends) == 0 {
 			return fmt.Errorf("no public port '%s' published for %s", opts.port, opts.container)
 		}
@@ -71,7 +72,7 @@ func runPort(ctx context.Context, dockerCli command.Cli, opts *portOptions) erro
 			out = append(out, net.JoinHostPort(frontend.HostIP.String(), frontend.HostPort))
 		}
 	} else {
-		for from, frontends := range c.NetworkSettings.Ports {
+		for from, frontends := range c.Container.NetworkSettings.Ports {
 			for _, frontend := range frontends {
 				out = append(out, fmt.Sprintf("%s -> %s", from, net.JoinHostPort(frontend.HostIP.String(), frontend.HostPort)))
 			}

cli/command/container/port_test.go

@@ -8,6 +8,7 @@ import (
 	"github.com/docker/cli/internal/test"
 	"github.com/moby/moby/api/types/container"
 	"github.com/moby/moby/api/types/network"
+	"github.com/moby/moby/client"
 	"gotest.tools/v3/assert"
 	"gotest.tools/v3/golden"
 )
@@ -46,7 +47,7 @@ func TestNewPortCommandOutput(t *testing.T) {
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{
-				inspectFunc: func(string) (container.InspectResponse, error) {
+				inspectFunc: func(string) (client.ContainerInspectResult, error) {
 					ci := container.InspectResponse{NetworkSettings: &container.NetworkSettings{}}
 					ci.NetworkSettings.Ports = network.PortMap{
 						network.MustParsePort("80/tcp"):  make([]network.PortBinding, len(tc.ips)),
@@ -64,7 +65,7 @@ func TestNewPortCommandOutput(t *testing.T) {
 							HostIP: ip, HostPort: "5678",
 						}
 					}
-					return ci, nil
+					return client.ContainerInspectResult{Container: ci}, nil
 				},
 			})
 			cmd := newPortCommand(cli)

cli/command/container/prune.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"strings"
 
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
@@ -11,6 +12,7 @@ import (
 	"github.com/docker/cli/internal/prompt"
 	"github.com/docker/cli/opts"
 	"github.com/docker/go-units"
+	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
 
@@ -60,7 +62,7 @@ func newPruneCommand(dockerCLI command.Cli) *cobra.Command {
 const warning = `WARNING! This will remove all stopped containers.
 Are you sure you want to continue?`
 
-func runPrune(ctx context.Context, dockerCli command.Cli, options pruneOptions) (spaceReclaimed uint64, output string, err error) {
+func runPrune(ctx context.Context, dockerCli command.Cli, options pruneOptions) (spaceReclaimed uint64, output string, _ error) {
 	pruneFilters := command.PruneFilters(dockerCli, options.filter.Value())
 
 	if !options.force {
@@ -73,20 +75,23 @@ func runPrune(ctx context.Context, dockerCli command.Cli, options pruneOptions)
 		}
 	}
 
-	report, err := dockerCli.Client().ContainersPrune(ctx, pruneFilters)
+	res, err := dockerCli.Client().ContainerPrune(ctx, client.ContainerPruneOptions{
+		Filters: pruneFilters,
+	})
 	if err != nil {
 		return 0, "", err
 	}
 
-	if len(report.ContainersDeleted) > 0 {
-		output = "Deleted Containers:\n"
-		for _, id := range report.ContainersDeleted {
-			output += id + "\n"
+	var out strings.Builder
+	if len(res.Report.ContainersDeleted) > 0 {
+		out.WriteString("Deleted Containers:\n")
+		for _, id := range res.Report.ContainersDeleted {
+			out.WriteString(id + "\n")
 		}
-		spaceReclaimed = report.SpaceReclaimed
+		spaceReclaimed = res.Report.SpaceReclaimed
 	}
 
-	return spaceReclaimed, output, nil
+	return spaceReclaimed, out.String(), nil
 }
 
 type cancelledErr struct{ error }

cli/command/container/prune_test.go

@@ -7,7 +7,6 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/moby/moby/api/types/container"
 	"github.com/moby/moby/client"
 )
 
@@ -16,8 +15,8 @@ func TestContainerPrunePromptTermination(t *testing.T) {
 	t.Cleanup(cancel)
 
 	cli := test.NewFakeCli(&fakeClient{
-		containerPruneFunc: func(ctx context.Context, pruneFilters client.Filters) (container.PruneReport, error) {
-			return container.PruneReport{}, errors.New("fakeClient containerPruneFunc should not be called")
+		containerPruneFunc: func(ctx context.Context, opts client.ContainerPruneOptions) (client.ContainerPruneResult, error) {
+			return client.ContainerPruneResult{}, errors.New("fakeClient containerPruneFunc should not be called")
 		},
 	})
 	cmd := newPruneCommand(cli)

cli/command/container/rename.go

@@ -1,14 +1,12 @@
 package container
 
 import (
-	"context"
-	"errors"
 	"fmt"
-	"strings"
 
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/cli/command/completion"
+	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
 
@@ -19,7 +17,14 @@ func newRenameCommand(dockerCLI command.Cli) *cobra.Command {
 		Short: "Rename a container",
 		Args:  cli.ExactArgs(2),
 		RunE: func(cmd *cobra.Command, args []string) error {
-			return runRename(cmd.Context(), dockerCLI, args[0], args[1])
+			oldName, newName := args[0], args[1]
+			_, err := dockerCLI.Client().ContainerRename(cmd.Context(), oldName, client.ContainerRenameOptions{
+				NewName: newName,
+			})
+			if err != nil {
+				return fmt.Errorf("failed to rename container: %w", err)
+			}
+			return nil
 		},
 		Annotations: map[string]string{
 			"aliases": "docker container rename, docker rename",
@@ -29,16 +34,3 @@ func newRenameCommand(dockerCLI command.Cli) *cobra.Command {
 	}
 	return cmd
 }
-
-func runRename(ctx context.Context, dockerCLI command.Cli, oldName, newName string) error {
-	newName = strings.TrimSpace(newName)
-	if newName == "" {
-		// TODO(thaJeztah): improve validation in ContainerRename and daemon; the daemon returns an obscure error when providing whitespace-only new-name:
-		// 	Error response from daemon: Error when allocating new name: Invalid container name (/ ), only [a-zA-Z0-9][a-zA-Z0-9_.-] are allowed
-		return errors.New("new name cannot be blank")
-	}
-	if err := dockerCLI.Client().ContainerRename(ctx, oldName, newName); err != nil {
-		return fmt.Errorf("failed to rename container: %w", err)
-	}
-	return nil
-}

cli/command/container/rename_test.go

@@ -1,62 +0,0 @@
-package container
-
-import (
-	"context"
-	"errors"
-	"io"
-	"testing"
-
-	"github.com/docker/cli/internal/test"
-	"gotest.tools/v3/assert"
-)
-
-func TestRunRename(t *testing.T) {
-	testcases := []struct {
-		doc, oldName, newName, expectedErr string
-	}{
-		{
-			doc:         "success",
-			oldName:     "oldName",
-			newName:     "newName",
-			expectedErr: "",
-		},
-		{
-			doc:         "empty old name",
-			oldName:     "",
-			newName:     "newName",
-			expectedErr: "invalid container name or ID: value is empty",
-		},
-		{
-			doc:         "empty new name",
-			oldName:     "oldName",
-			newName:     "",
-			expectedErr: "new name cannot be blank",
-		},
-	}
-
-	for _, tc := range testcases {
-		t.Run(tc.doc, func(t *testing.T) {
-			cli := test.NewFakeCli(&fakeClient{
-				containerRenameFunc: func(ctx context.Context, oldName, newName string) error {
-					if oldName == "" {
-						return errors.New("invalid container name or ID: value is empty")
-					}
-					return nil
-				},
-			})
-
-			cmd := newRenameCommand(cli)
-			cmd.SetOut(io.Discard)
-			cmd.SetErr(io.Discard)
-			cmd.SetArgs([]string{tc.oldName, tc.newName})
-
-			err := cmd.Execute()
-
-			if tc.expectedErr != "" {
-				assert.ErrorContains(t, err, tc.expectedErr)
-			} else {
-				assert.NilError(t, err)
-			}
-		})
-	}
-}

cli/command/container/restart.go

@@ -66,7 +66,7 @@ func runRestart(ctx context.Context, dockerCLI command.Cli, opts *restartOptions
 	var errs []error
 	// TODO(thaJeztah): consider using parallelOperation for restart, similar to "stop" and "remove"
 	for _, name := range opts.containers {
-		err := apiClient.ContainerRestart(ctx, name, client.ContainerStopOptions{
+		_, err := apiClient.ContainerRestart(ctx, name, client.ContainerRestartOptions{
 			Signal:  opts.signal,
 			Timeout: timeout,
 		})

cli/command/container/restart_test.go

@@ -19,7 +19,7 @@ func TestRestart(t *testing.T) {
 		name         string
 		args         []string
 		restarted    []string
-		expectedOpts client.ContainerStopOptions
+		expectedOpts client.ContainerRestartOptions
 		expectedErr  string
 	}{
 		{
@@ -36,19 +36,19 @@ func TestRestart(t *testing.T) {
 		{
 			name:         "with -t",
 			args:         []string{"-t", "2", "container-1"},
-			expectedOpts: client.ContainerStopOptions{Timeout: func(to int) *int { return &to }(2)},
+			expectedOpts: client.ContainerRestartOptions{Timeout: func(to int) *int { return &to }(2)},
 			restarted:    []string{"container-1"},
 		},
 		{
 			name:         "with --timeout",
 			args:         []string{"--timeout", "2", "container-1"},
-			expectedOpts: client.ContainerStopOptions{Timeout: func(to int) *int { return &to }(2)},
+			expectedOpts: client.ContainerRestartOptions{Timeout: func(to int) *int { return &to }(2)},
 			restarted:    []string{"container-1"},
 		},
 		{
 			name:         "with --time",
 			args:         []string{"--time", "2", "container-1"},
-			expectedOpts: client.ContainerStopOptions{Timeout: func(to int) *int { return &to }(2)},
+			expectedOpts: client.ContainerRestartOptions{Timeout: func(to int) *int { return &to }(2)},
 			restarted:    []string{"container-1"},
 		},
 		{
@@ -62,17 +62,17 @@ func TestRestart(t *testing.T) {
 			mutex := new(sync.Mutex)
 
 			cli := test.NewFakeCli(&fakeClient{
-				containerRestartFunc: func(ctx context.Context, containerID string, options client.ContainerStopOptions) error {
+				containerRestartFunc: func(ctx context.Context, containerID string, options client.ContainerRestartOptions) (client.ContainerRestartResult, error) {
 					assert.Check(t, is.DeepEqual(options, tc.expectedOpts))
 					if containerID == "nosuchcontainer" {
-						return notFound(errors.New("Error: no such container: " + containerID))
+						return client.ContainerRestartResult{}, notFound(errors.New("Error: no such container: " + containerID))
 					}
 
 					// TODO(thaJeztah): consider using parallelOperation for restart, similar to "stop" and "remove"
 					mutex.Lock()
 					restarted = append(restarted, containerID)
 					mutex.Unlock()
-					return nil
+					return client.ContainerRestartResult{}, nil
 				},
 				Version: "1.36",
 			})

cli/command/container/rm.go

@@ -67,11 +67,12 @@ func runRm(ctx context.Context, dockerCLI command.Cli, opts *rmOptions) error {
 		if ctrID == "" {
 			return errors.New("container name cannot be empty")
 		}
-		return apiClient.ContainerRemove(ctx, ctrID, client.ContainerRemoveOptions{
+		_, err := apiClient.ContainerRemove(ctx, ctrID, client.ContainerRemoveOptions{
 			RemoveVolumes: opts.rmVolumes,
 			RemoveLinks:   opts.rmLink,
 			Force:         opts.force,
 		})
+		return err
 	})
 
 	var errs []error

cli/command/container/rm_test.go

@@ -27,7 +27,7 @@ func TestRemoveForce(t *testing.T) {
 			mutex := new(sync.Mutex)
 
 			cli := test.NewFakeCli(&fakeClient{
-				containerRemoveFunc: func(ctx context.Context, container string, options client.ContainerRemoveOptions) error {
+				containerRemoveFunc: func(ctx context.Context, container string, options client.ContainerRemoveOptions) (client.ContainerRemoveResult, error) {
 					// containerRemoveFunc is called in parallel for each container
 					// by the remove command so append must be synchronized.
 					mutex.Lock()
@@ -35,9 +35,9 @@ func TestRemoveForce(t *testing.T) {
 					mutex.Unlock()
 
 					if container == "nosuchcontainer" {
-						return notFound(errors.New("Error: no such container: " + container))
+						return client.ContainerRemoveResult{}, notFound(errors.New("Error: no such container: " + container))
 					}
-					return nil
+					return client.ContainerRemoveResult{}, nil
 				},
 				Version: "1.36",
 			})

cli/command/container/run.go

@@ -12,7 +12,6 @@ import (
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/cli/command/completion"
-	"github.com/docker/cli/cli/trust"
 	"github.com/docker/cli/opts"
 	"github.com/moby/moby/api/types/container"
 	"github.com/moby/moby/client"
@@ -73,7 +72,10 @@ func newRunCommand(dockerCLI command.Cli) *cobra.Command {
 	// TODO(thaJeztah): consider adding platform as "image create option" on containerOptions
 	flags.StringVar(&options.platform, "platform", os.Getenv("DOCKER_DEFAULT_PLATFORM"), "Set platform if server is multi-platform capable")
 	_ = flags.SetAnnotation("platform", "version", []string{"1.32"})
-	flags.BoolVar(&options.untrusted, "disable-content-trust", !trust.Enabled(), "Skip image verification")
+
+	// TODO(thaJeztah): DEPRECATED: remove in v29.1 or v30
+	flags.Bool("disable-content-trust", true, "Skip image verification (deprecated)")
+	_ = flags.MarkDeprecated("disable-content-trust", "support for docker content trust was removed")
 	copts = addFlags(flags)
 
 	_ = cmd.RegisterFlagCompletionFunc("detach-keys", completeDetachKeys)
@@ -193,7 +195,7 @@ func runContainer(ctx context.Context, dockerCli command.Cli, runOpts *runOption
 	statusChan := waitExitOrRemoved(statusCtx, apiClient, containerID, copts.autoRemove)
 
 	// start the container
-	if err := apiClient.ContainerStart(ctx, containerID, client.ContainerStartOptions{}); err != nil {
+	if _, err := apiClient.ContainerStart(ctx, containerID, client.ContainerStartOptions{}); err != nil {
 		// If we have hijackedIOStreamer, we should notify
 		// hijackedIOStreamer we are going to exit and wait
 		// to avoid the terminal are not restored.
@@ -290,7 +292,7 @@ func attachContainer(ctx context.Context, dockerCli command.Cli, containerID str
 				inputStream:  in,
 				outputStream: out,
 				errorStream:  cerr,
-				resp:         resp,
+				resp:         resp.HijackedResponse,
 				tty:          config.Tty,
 				detachKeys:   options.DetachKeys,
 			}
@@ -301,7 +303,7 @@ func attachContainer(ctx context.Context, dockerCli command.Cli, containerID str
 			return errAttach
 		}()
 	}()
-	return resp.Close, nil
+	return resp.HijackedResponse.Close, nil
 }
 
 // withHelp decorates the error with a suggestion to use "--help".

cli/command/container/run_test.go

@@ -13,14 +13,11 @@ import (
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/streams"
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/notary"
-	"github.com/moby/moby/api/pkg/progress"
-	"github.com/moby/moby/api/pkg/streamformatter"
 	"github.com/moby/moby/api/types"
 	"github.com/moby/moby/api/types/container"
-	"github.com/moby/moby/api/types/network"
 	"github.com/moby/moby/client"
-	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/moby/moby/client/pkg/progress"
+	"github.com/moby/moby/client/pkg/streamformatter"
 	"github.com/spf13/pflag"
 	"gotest.tools/v3/assert"
 	is "gotest.tools/v3/assert/cmp"
@@ -56,10 +53,8 @@ func TestRunValidateFlags(t *testing.T) {
 
 func TestRunLabel(t *testing.T) {
 	fakeCLI := test.NewFakeCli(&fakeClient{
-		createContainerFunc: func(_ *container.Config, _ *container.HostConfig, _ *network.NetworkingConfig, _ *ocispec.Platform, _ string) (container.CreateResponse, error) {
-			return container.CreateResponse{
-				ID: "id",
-			}, nil
+		createContainerFunc: func(options client.ContainerCreateOptions) (client.ContainerCreateResult, error) {
+			return client.ContainerCreateResult{ID: "id"}, nil
 		},
 		Version: client.MaxAPIVersion,
 	})
@@ -79,28 +74,31 @@ func TestRunAttach(t *testing.T) {
 	var conn net.Conn
 	attachCh := make(chan struct{})
 	fakeCLI := test.NewFakeCli(&fakeClient{
-		createContainerFunc: func(_ *container.Config, _ *container.HostConfig, _ *network.NetworkingConfig, _ *ocispec.Platform, _ string) (container.CreateResponse, error) {
-			return container.CreateResponse{
-				ID: "id",
-			}, nil
+		createContainerFunc: func(options client.ContainerCreateOptions) (client.ContainerCreateResult, error) {
+			return client.ContainerCreateResult{ID: "id"}, nil
 		},
-		containerAttachFunc: func(ctx context.Context, containerID string, options client.ContainerAttachOptions) (client.HijackedResponse, error) {
+		containerAttachFunc: func(ctx context.Context, containerID string, options client.ContainerAttachOptions) (client.ContainerAttachResult, error) {
 			server, clientConn := net.Pipe()
 			conn = server
 			t.Cleanup(func() {
 				_ = server.Close()
 			})
 			attachCh <- struct{}{}
-			return client.NewHijackedResponse(clientConn, types.MediaTypeRawStream), nil
+			return client.ContainerAttachResult{
+				HijackedResponse: client.NewHijackedResponse(clientConn, types.MediaTypeRawStream),
+			}, nil
 		},
-		waitFunc: func(_ string) (<-chan container.WaitResponse, <-chan error) {
+		waitFunc: func(_ string) client.ContainerWaitResult {
 			responseChan := make(chan container.WaitResponse, 1)
 			errChan := make(chan error)
 
 			responseChan <- container.WaitResponse{
 				StatusCode: 33,
 			}
-			return responseChan, errChan
+			return client.ContainerWaitResult{
+				Result: responseChan,
+				Error:  errChan,
+			}
 		},
 		// use new (non-legacy) wait API
 		// see: https://github.com/docker/cli/commit/38591f20d07795aaef45d400df89ca12f29c603b
@@ -150,34 +148,37 @@ func TestRunAttachTermination(t *testing.T) {
 	killCh := make(chan struct{})
 	attachCh := make(chan struct{})
 	fakeCLI := test.NewFakeCli(&fakeClient{
-		createContainerFunc: func(_ *container.Config, _ *container.HostConfig, _ *network.NetworkingConfig, _ *ocispec.Platform, _ string) (container.CreateResponse, error) {
-			return container.CreateResponse{
-				ID: "id",
-			}, nil
+		createContainerFunc: func(options client.ContainerCreateOptions) (client.ContainerCreateResult, error) {
+			return client.ContainerCreateResult{ID: "id"}, nil
 		},
-		containerKillFunc: func(ctx context.Context, containerID, sig string) error {
-			if sig == "TERM" {
+		containerKillFunc: func(ctx context.Context, container string, options client.ContainerKillOptions) (client.ContainerKillResult, error) {
+			if options.Signal == "TERM" {
 				close(killCh)
 			}
-			return nil
+			return client.ContainerKillResult{}, nil
 		},
-		containerAttachFunc: func(ctx context.Context, containerID string, options client.ContainerAttachOptions) (client.HijackedResponse, error) {
+		containerAttachFunc: func(ctx context.Context, containerID string, options client.ContainerAttachOptions) (client.ContainerAttachResult, error) {
 			server, clientConn := net.Pipe()
 			conn = server
 			t.Cleanup(func() {
 				_ = server.Close()
 			})
 			attachCh <- struct{}{}
-			return client.NewHijackedResponse(clientConn, types.MediaTypeRawStream), nil
+			return client.ContainerAttachResult{
+				HijackedResponse: client.NewHijackedResponse(clientConn, types.MediaTypeRawStream),
+			}, nil
 		},
-		waitFunc: func(_ string) (<-chan container.WaitResponse, <-chan error) {
+		waitFunc: func(_ string) client.ContainerWaitResult {
 			responseChan := make(chan container.WaitResponse, 1)
 			errChan := make(chan error)
 			<-killCh
 			responseChan <- container.WaitResponse{
 				StatusCode: 130,
 			}
-			return responseChan, errChan
+			return client.ContainerWaitResult{
+				Result: responseChan,
+				Error:  errChan,
+			}
 		},
 		// use new (non-legacy) wait API
 		// see: https://github.com/docker/cli/commit/38591f20d07795aaef45d400df89ca12f29c603b
@@ -227,15 +228,13 @@ func TestRunPullTermination(t *testing.T) {
 
 	attachCh := make(chan struct{})
 	fakeCLI := test.NewFakeCli(&fakeClient{
-		createContainerFunc: func(config *container.Config, hostConfig *container.HostConfig, networkingConfig *network.NetworkingConfig,
-			platform *ocispec.Platform, containerName string,
-		) (container.CreateResponse, error) {
-			return container.CreateResponse{}, errors.New("shouldn't try to create a container")
+		createContainerFunc: func(options client.ContainerCreateOptions) (client.ContainerCreateResult, error) {
+			return client.ContainerCreateResult{}, errors.New("shouldn't try to create a container")
 		},
-		containerAttachFunc: func(ctx context.Context, containerID string, options client.ContainerAttachOptions) (client.HijackedResponse, error) {
-			return client.HijackedResponse{}, errors.New("shouldn't try to attach to a container")
+		containerAttachFunc: func(ctx context.Context, containerID string, options client.ContainerAttachOptions) (client.ContainerAttachResult, error) {
+			return client.ContainerAttachResult{}, errors.New("shouldn't try to attach to a container")
 		},
-		imageCreateFunc: func(ctx context.Context, parentReference string, options client.ImageCreateOptions) (io.ReadCloser, error) {
+		imagePullFunc: func(ctx context.Context, parentReference string, options client.ImagePullOptions) (client.ImagePullResponse, error) {
 			server, respReader := net.Pipe()
 			t.Cleanup(func() {
 				_ = server.Close()
@@ -260,7 +259,7 @@ func TestRunPullTermination(t *testing.T) {
 				}
 			}()
 			attachCh <- struct{}{}
-			return respReader, nil
+			return fakeStreamResult{ReadCloser: respReader}, nil
 		},
 		Version: client.MaxAPIVersion,
 	})
@@ -295,59 +294,6 @@ func TestRunPullTermination(t *testing.T) {
 	}
 }
 
-func TestRunCommandWithContentTrustErrors(t *testing.T) {
-	testCases := []struct {
-		name          string
-		args          []string
-		expectedError string
-		notaryFunc    test.NotaryClientFuncType
-	}{
-		{
-			name:          "offline-notary-server",
-			notaryFunc:    notary.GetOfflineNotaryRepository,
-			expectedError: "client is offline",
-			args:          []string{"image:tag"},
-		},
-		{
-			name:          "uninitialized-notary-server",
-			notaryFunc:    notary.GetUninitializedNotaryRepository,
-			expectedError: "remote trust data does not exist",
-			args:          []string{"image:tag"},
-		},
-		{
-			name:          "empty-notary-server",
-			notaryFunc:    notary.GetEmptyTargetsNotaryRepository,
-			expectedError: "No valid trust data for tag",
-			args:          []string{"image:tag"},
-		},
-	}
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Setenv("DOCKER_CONTENT_TRUST", "true")
-			fakeCLI := test.NewFakeCli(&fakeClient{
-				createContainerFunc: func(config *container.Config,
-					hostConfig *container.HostConfig,
-					networkingConfig *network.NetworkingConfig,
-					platform *ocispec.Platform,
-					containerName string,
-				) (container.CreateResponse, error) {
-					return container.CreateResponse{}, errors.New("shouldn't try to pull image")
-				},
-			})
-			fakeCLI.SetNotaryClient(tc.notaryFunc)
-			cmd := newRunCommand(fakeCLI)
-			cmd.SetArgs(tc.args)
-			cmd.SetOut(io.Discard)
-			cmd.SetErr(io.Discard)
-			err := cmd.Execute()
-			statusErr := cli.StatusError{}
-			assert.Check(t, errors.As(err, &statusErr))
-			assert.Check(t, is.Equal(statusErr.StatusCode, 125))
-			assert.Check(t, is.ErrorContains(err, tc.expectedError))
-		})
-	}
-}
-
 func TestRunContainerImagePullPolicyInvalid(t *testing.T) {
 	cases := []struct {
 		PullPolicy     string

cli/command/container/signals.go

@@ -48,7 +48,10 @@ func ForwardAllSignals(ctx context.Context, apiClient client.ContainerAPIClient,
 			continue
 		}
 
-		if err := apiClient.ContainerKill(ctx, cid, sig); err != nil {
+		_, err := apiClient.ContainerKill(ctx, cid, client.ContainerKillOptions{
+			Signal: sig,
+		})
+		if err != nil {
 			logrus.Debugf("Error sending signal: %s", err)
 		}
 	}

cli/command/container/signals_test.go

@@ -6,6 +6,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/moby/moby/client"
 	"github.com/moby/sys/signal"
 )
 
@@ -14,9 +15,9 @@ func TestForwardSignals(t *testing.T) {
 	defer cancel()
 
 	called := make(chan struct{})
-	apiClient := &fakeClient{containerKillFunc: func(ctx context.Context, container, signal string) error {
+	apiClient := &fakeClient{containerKillFunc: func(ctx context.Context, container string, options client.ContainerKillOptions) (client.ContainerKillResult, error) {
 		close(called)
-		return nil
+		return client.ContainerKillResult{}, nil
 	}}
 
 	sigc := make(chan os.Signal)

cli/command/container/signals_unix_test.go

@@ -9,6 +9,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/moby/moby/client"
 	"golang.org/x/sys/unix"
 	"gotest.tools/v3/assert"
 )
@@ -22,9 +23,9 @@ func TestIgnoredSignals(t *testing.T) {
 			defer cancel()
 
 			var called bool
-			apiClient := &fakeClient{containerKillFunc: func(ctx context.Context, container, signal string) error {
+			apiClient := &fakeClient{containerKillFunc: func(ctx context.Context, container string, options client.ContainerKillOptions) (client.ContainerKillResult, error) {
 				called = true
-				return nil
+				return client.ContainerKillResult{}, nil
 			}}
 
 			sigc := make(chan os.Signal)

cli/command/container/start.go

@@ -80,16 +80,16 @@ func RunStart(ctx context.Context, dockerCli command.Cli, opts *StartOptions) er
 
 		// 2. Attach to the container.
 		ctr := opts.Containers[0]
-		c, err := dockerCli.Client().ContainerInspect(ctx, ctr)
+		c, err := dockerCli.Client().ContainerInspect(ctx, ctr, client.ContainerInspectOptions{})
 		if err != nil {
 			return err
 		}
 
 		// We always use c.ID instead of container to maintain consistency during `docker start`
-		if !c.Config.Tty {
+		if !c.Container.Config.Tty {
 			sigc := notifyAllSignals()
 			bgCtx := context.WithoutCancel(ctx)
-			go ForwardAllSignals(bgCtx, dockerCli.Client(), c.ID, sigc)
+			go ForwardAllSignals(bgCtx, dockerCli.Client(), c.Container.ID, sigc)
 			defer signal.StopCatch(sigc)
 		}
 
@@ -100,7 +100,7 @@ func RunStart(ctx context.Context, dockerCli command.Cli, opts *StartOptions) er
 
 		options := client.ContainerAttachOptions{
 			Stream:     true,
-			Stdin:      opts.OpenStdin && c.Config.OpenStdin,
+			Stdin:      opts.OpenStdin && c.Container.Config.OpenStdin,
 			Stdout:     true,
 			Stderr:     true,
 			DetachKeys: detachKeys,
@@ -112,11 +112,11 @@ func RunStart(ctx context.Context, dockerCli command.Cli, opts *StartOptions) er
 			in = dockerCli.In()
 		}
 
-		resp, errAttach := dockerCli.Client().ContainerAttach(ctx, c.ID, options)
+		resp, errAttach := dockerCli.Client().ContainerAttach(ctx, c.Container.ID, options)
 		if errAttach != nil {
 			return errAttach
 		}
-		defer resp.Close()
+		defer resp.HijackedResponse.Close()
 
 		cErr := make(chan error, 1)
 
@@ -127,8 +127,8 @@ func RunStart(ctx context.Context, dockerCli command.Cli, opts *StartOptions) er
 					inputStream:  in,
 					outputStream: dockerCli.Out(),
 					errorStream:  dockerCli.Err(),
-					resp:         resp,
-					tty:          c.Config.Tty,
+					resp:         resp.HijackedResponse,
+					tty:          c.Container.Config.Tty,
 					detachKeys:   options.DetachKeys,
 				}
 
@@ -142,17 +142,17 @@ func RunStart(ctx context.Context, dockerCli command.Cli, opts *StartOptions) er
 
 		// 3. We should open a channel for receiving status code of the container
 		// no matter it's detached, removed on daemon side(--rm) or exit normally.
-		statusChan := waitExitOrRemoved(ctx, dockerCli.Client(), c.ID, c.HostConfig.AutoRemove)
+		statusChan := waitExitOrRemoved(ctx, dockerCli.Client(), c.Container.ID, c.Container.HostConfig.AutoRemove)
 
 		// 4. Start the container.
-		err = dockerCli.Client().ContainerStart(ctx, c.ID, client.ContainerStartOptions{
+		_, err = dockerCli.Client().ContainerStart(ctx, c.Container.ID, client.ContainerStartOptions{
 			CheckpointID:  opts.Checkpoint,
 			CheckpointDir: opts.CheckpointDir,
 		})
 		if err != nil {
 			cancelFun()
 			<-cErr
-			if c.HostConfig.AutoRemove {
+			if c.Container.HostConfig.AutoRemove {
 				// wait container to be removed
 				<-statusChan
 			}
@@ -160,13 +160,14 @@ func RunStart(ctx context.Context, dockerCli command.Cli, opts *StartOptions) er
 		}
 
 		// 5. Wait for attachment to break.
-		if c.Config.Tty && dockerCli.Out().IsTerminal() {
-			if err := MonitorTtySize(ctx, dockerCli, c.ID, false); err != nil {
+		if c.Container.Config.Tty && dockerCli.Out().IsTerminal() {
+			if err := MonitorTtySize(ctx, dockerCli, c.Container.ID, false); err != nil {
 				_, _ = fmt.Fprintln(dockerCli.Err(), "Error monitoring TTY size:", err)
 			}
 		}
 		if attachErr := <-cErr; attachErr != nil {
-			if _, ok := attachErr.(term.EscapeError); ok {
+			var escapeError term.EscapeError
+			if errors.As(attachErr, &escapeError) {
 				// The user entered the detach escape sequence.
 				return nil
 			}
@@ -182,10 +183,11 @@ func RunStart(ctx context.Context, dockerCli command.Cli, opts *StartOptions) er
 			return errors.New("you cannot restore multiple containers at once")
 		}
 		ctr := opts.Containers[0]
-		return dockerCli.Client().ContainerStart(ctx, ctr, client.ContainerStartOptions{
+		_, err := dockerCli.Client().ContainerStart(ctx, ctr, client.ContainerStartOptions{
 			CheckpointID:  opts.Checkpoint,
 			CheckpointDir: opts.CheckpointDir,
 		})
+		return err
 	default:
 		// We're not going to attach to anything.
 		// Start as many containers as we want.
@@ -196,7 +198,7 @@ func RunStart(ctx context.Context, dockerCli command.Cli, opts *StartOptions) er
 func startContainersWithoutAttachments(ctx context.Context, dockerCli command.Cli, containers []string) error {
 	var failedContainers []string
 	for _, ctr := range containers {
-		if err := dockerCli.Client().ContainerStart(ctx, ctr, client.ContainerStartOptions{}); err != nil {
+		if _, err := dockerCli.Client().ContainerStart(ctx, ctr, client.ContainerStartOptions{}); err != nil {
 			_, _ = fmt.Fprintln(dockerCli.Err(), err)
 			failedContainers = append(failedContainers, ctr)
 			continue

cli/command/container/stats.go

@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"github.com/containerd/errdefs"
+	"github.com/containerd/log"
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/cli/command/completion"
@@ -18,7 +19,6 @@ import (
 	flagsHelper "github.com/docker/cli/cli/flags"
 	"github.com/moby/moby/api/types/events"
 	"github.com/moby/moby/client"
-	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 )
 
@@ -108,10 +108,17 @@ var acceptedStatsFilters = map[string]bool{
 func RunStats(ctx context.Context, dockerCLI command.Cli, options *StatsOptions) error {
 	apiClient := dockerCLI.Client()
 
+	// Get the daemonOSType to handle platform-specific stats fields.
+	// This value is used as a fallback for docker < v29, which did not
+	// include the OSType field per stats.
+	daemonOSType = dockerCLI.ServerInfo().OSType
+
 	// waitFirst is a WaitGroup to wait first stat data's reach for each container
 	waitFirst := &sync.WaitGroup{}
-	// closeChan is a non-buffered channel used to collect errors from goroutines.
-	closeChan := make(chan error)
+	// closeChan is used to collect errors from goroutines. It uses a small buffer
+	// to avoid blocking sends when sends occur after closeChan is set to nil or
+	// after the reader has exited, preventing deadlocks.
+	closeChan := make(chan error, 4)
 	cStats := stats{}
 
 	showAll := len(options.Containers) == 0
@@ -136,24 +143,34 @@ func RunStats(ctx context.Context, dockerCLI command.Cli, options *StatsOptions)
 		eh := newEventHandler()
 		if options.All {
 			eh.setHandler(events.ActionCreate, func(e events.Message) {
-				s := NewStats(e.Actor.ID)
-				if cStats.add(s) {
+				if s := NewStats(e.Actor.ID); cStats.add(s) {
 					waitFirst.Add(1)
+					log.G(ctx).WithFields(log.Fields{
+						"event":     e.Action,
+						"container": e.Actor.ID,
+					}).Debug("collecting stats for container")
 					go collect(ctx, s, apiClient, !options.NoStream, waitFirst)
 				}
 			})
 		}
 
 		eh.setHandler(events.ActionStart, func(e events.Message) {
-			s := NewStats(e.Actor.ID)
-			if cStats.add(s) {
+			if s := NewStats(e.Actor.ID); cStats.add(s) {
 				waitFirst.Add(1)
+				log.G(ctx).WithFields(log.Fields{
+					"event":     e.Action,
+					"container": e.Actor.ID,
+				}).Debug("collecting stats for container")
 				go collect(ctx, s, apiClient, !options.NoStream, waitFirst)
 			}
 		})
 
 		if !options.All {
 			eh.setHandler(events.ActionDie, func(e events.Message) {
+				log.G(ctx).WithFields(log.Fields{
+					"event":     e.Action,
+					"container": e.Actor.ID,
+				}).Debug("stop collecting stats for container")
 				cStats.remove(e.Actor.ID)
 			})
 		}
@@ -166,7 +183,7 @@ func RunStats(ctx context.Context, dockerCLI command.Cli, options *StatsOptions)
 			// to list containers and to filter events, but the "type" filter
 			// is not valid for filtering containers.
 			f := options.Filters.Clone().Add("type", string(events.ContainerEventType))
-			eventChan, errChan := apiClient.Events(ctx, client.EventsListOptions{
+			res := apiClient.Events(ctx, client.EventsListOptions{
 				Filters: f,
 			})
 
@@ -179,10 +196,17 @@ func RunStats(ctx context.Context, dockerCLI command.Cli, options *StatsOptions)
 				select {
 				case <-stopped:
 					return
-				case event := <-eventChan:
+				case <-ctx.Done():
+					return
+				case event := <-res.Messages:
 					c <- event
-				case err := <-errChan:
-					closeChan <- err
+				case err := <-res.Err:
+					// Prevent blocking if closeChan is full or unread
+					select {
+					case closeChan <- err:
+					default:
+						// drop if not read; avoids deadlock
+					}
 					return
 				}
 			}
@@ -205,10 +229,12 @@ func RunStats(ctx context.Context, dockerCLI command.Cli, options *StatsOptions)
 		if err != nil {
 			return err
 		}
-		for _, ctr := range cs {
-			s := NewStats(ctr.ID)
-			if cStats.add(s) {
+		for _, ctr := range cs.Items {
+			if s := NewStats(ctr.ID); cStats.add(s) {
 				waitFirst.Add(1)
+				log.G(ctx).WithFields(log.Fields{
+					"container": ctr.ID,
+				}).Debug("collecting stats for container")
 				go collect(ctx, s, apiClient, !options.NoStream, waitFirst)
 			}
 		}
@@ -227,15 +253,18 @@ func RunStats(ctx context.Context, dockerCLI command.Cli, options *StatsOptions)
 		// Create the list of containers, and start collecting stats for all
 		// containers passed.
 		for _, ctr := range options.Containers {
-			s := NewStats(ctr)
-			if cStats.add(s) {
+			if s := NewStats(ctr); cStats.add(s) {
 				waitFirst.Add(1)
+				log.G(ctx).WithFields(log.Fields{
+					"container": ctr,
+				}).Debug("collecting stats for container")
 				go collect(ctx, s, apiClient, !options.NoStream, waitFirst)
 			}
 		}
 
-		// We don't expect any asynchronous errors: closeChan can be closed.
+		// We don't expect any asynchronous errors: closeChan can be closed and disabled.
 		close(closeChan)
+		closeChan = nil
 
 		// make sure each container get at least one valid stat data
 		waitFirst.Wait()
@@ -254,19 +283,13 @@ func RunStats(ctx context.Context, dockerCLI command.Cli, options *StatsOptions)
 	}
 
 	format := options.Format
-	if len(format) == 0 {
+	if format == "" {
 		if len(dockerCLI.ConfigFile().StatsFormat) > 0 {
 			format = dockerCLI.ConfigFile().StatsFormat
 		} else {
 			format = formatter.TableFormatKey
 		}
 	}
-	if daemonOSType == "" {
-		// Get the daemonOSType if not set already. The daemonOSType variable
-		// should already be set when collecting stats as part of "collect()",
-		// so we unlikely hit this code in practice.
-		daemonOSType = dockerCLI.ServerInfo().OSType
-	}
 
 	// Buffer to store formatted stats text.
 	// Once formatted, it will be printed in one write to avoid screen flickering.
@@ -277,63 +300,68 @@ func RunStats(ctx context.Context, dockerCLI command.Cli, options *StatsOptions)
 		Format: NewStatsFormat(format, daemonOSType),
 	}
 
-	var err error
-	ticker := time.NewTicker(500 * time.Millisecond)
-	defer ticker.Stop()
-	for range ticker.C {
-		var ccStats []StatsEntry
+	if options.NoStream {
 		cStats.mu.RLock()
+		ccStats := make([]StatsEntry, 0, len(cStats.cs))
 		for _, c := range cStats.cs {
 			ccStats = append(ccStats, c.GetStatistics())
 		}
 		cStats.mu.RUnlock()
 
-		if !options.NoStream {
+		if len(ccStats) == 0 {
+			return nil
+		}
+		if err := statsFormatWrite(statsCtx, ccStats, daemonOSType, !options.NoTrunc); err != nil {
+			return err
+		}
+		_, _ = fmt.Fprint(dockerCLI.Out(), statsTextBuffer.String())
+		return nil
+	}
+
+	ticker := time.NewTicker(500 * time.Millisecond)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ticker.C:
+			cStats.mu.RLock()
+			ccStats := make([]StatsEntry, 0, len(cStats.cs))
+			for _, c := range cStats.cs {
+				ccStats = append(ccStats, c.GetStatistics())
+			}
+			cStats.mu.RUnlock()
+
 			// Start by moving the cursor to the top-left
 			_, _ = fmt.Fprint(&statsTextBuffer, "\033[H")
-		}
 
-		if err = statsFormatWrite(statsCtx, ccStats, daemonOSType, !options.NoTrunc); err != nil {
-			break
-		}
+			if err := statsFormatWrite(statsCtx, ccStats, daemonOSType, !options.NoTrunc); err != nil {
+				return err
+			}
 
-		if !options.NoStream {
 			for _, line := range strings.Split(statsTextBuffer.String(), "\n") {
 				// In case the new text is shorter than the one we are writing over,
 				// we'll append the "erase line" escape sequence to clear the remaining text.
 				_, _ = fmt.Fprintln(&statsTextBuffer, line, "\033[K")
 			}
-
 			// We might have fewer containers than before, so let's clear the remaining text
 			_, _ = fmt.Fprint(&statsTextBuffer, "\033[J")
-		}
 
-		_, _ = fmt.Fprint(dockerCLI.Out(), statsTextBuffer.String())
-		statsTextBuffer.Reset()
+			_, _ = fmt.Fprint(dockerCLI.Out(), statsTextBuffer.String())
+			statsTextBuffer.Reset()
 
-		if len(cStats.cs) == 0 && !showAll {
-			break
-		}
-		if options.NoStream {
-			break
-		}
-		select {
-		case err, ok := <-closeChan:
-			if ok {
-				if err != nil {
-					// Suppress "unexpected EOF" errors in the CLI so that
-					// it shuts down cleanly when the daemon restarts.
-					if errors.Is(err, io.ErrUnexpectedEOF) {
-						return nil
-					}
-					return err
-				}
+			if len(ccStats) == 0 && !showAll {
+				return nil
 			}
-		default:
-			// just skip
+		case err, ok := <-closeChan:
+			if !ok || err == nil || errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF) {
+				// Suppress "unexpected EOF" errors in the CLI so that
+				// it shuts down cleanly when the daemon restarts.
+				return nil
+			}
+			return err
+		case <-ctx.Done():
+			return ctx.Err()
 		}
 	}
-	return err
 }
 
 // newEventHandler initializes and returns an eventHandler
@@ -360,11 +388,11 @@ func (eh *eventHandler) watch(c <-chan events.Message) {
 			continue
 		}
 		if e.Actor.ID == "" {
-			logrus.WithField("event", e).Errorf("event handler: received %s event with empty ID", e.Action)
+			log.G(context.TODO()).WithField("event", e).Errorf("event handler: received %s event with empty ID", e.Action)
 			continue
 		}
 
-		logrus.WithField("event", e).Debugf("event handler: received %s event for: %s", e.Action, e.Actor.ID)
+		log.G(context.TODO()).WithField("event", e).Debugf("event handler: received %s event for: %s", e.Action, e.Actor.ID)
 		go h(e)
 	}
 }

cli/command/container/stats_helpers.go

@@ -10,7 +10,6 @@ import (
 
 	"github.com/moby/moby/api/types/container"
 	"github.com/moby/moby/client"
-	"github.com/sirupsen/logrus"
 )
 
 type stats struct {
@@ -50,41 +49,35 @@ func (s *stats) isKnownContainer(cid string) (int, bool) {
 	return -1, false
 }
 
-func collect(ctx context.Context, s *Stats, cli client.ContainerAPIClient, streamStats bool, waitFirst *sync.WaitGroup) {
-	logrus.Debugf("collecting stats for %s", s.Container)
-	var (
-		getFirst       bool
-		previousCPU    uint64
-		previousSystem uint64
-		u              = make(chan error, 1)
-	)
+func collect(ctx context.Context, s *Stats, cli client.ContainerAPIClient, streamStats bool, waitFirst *sync.WaitGroup) { //nolint:gocyclo
+	var getFirst bool
 
 	defer func() {
-		// if error happens and we get nothing of stats, release wait group whatever
+		// if error happens, and we get nothing of stats, release wait group whatever
 		if !getFirst {
 			getFirst = true
 			waitFirst.Done()
 		}
 	}()
 
-	response, err := cli.ContainerStats(ctx, s.Container, streamStats)
+	response, err := cli.ContainerStats(ctx, s.Container, client.ContainerStatsOptions{
+		Stream:                streamStats,
+		IncludePreviousSample: !streamStats, // collect previous CPU value for the first result when not streaming.
+	})
 	if err != nil {
 		s.SetError(err)
 		return
 	}
-	defer response.Body.Close()
 
-	dec := json.NewDecoder(response.Body)
+	u := make(chan error, 1)
 	go func() {
+		defer response.Body.Close()
+		dec := json.NewDecoder(response.Body)
 		for {
-			var (
-				v                      *container.StatsResponse
-				memPercent, cpuPercent float64
-				blkRead, blkWrite      uint64 // Only used on Linux
-				mem, memLimit          float64
-				pidsStatsCurrent       uint64
-			)
-
+			if ctx.Err() != nil {
+				return
+			}
+			var v container.StatsResponse
 			if err := dec.Decode(&v); err != nil {
 				dec = json.NewDecoder(io.MultiReader(dec.Buffered(), response.Body))
 				u <- err
@@ -95,37 +88,42 @@ func collect(ctx context.Context, s *Stats, cli client.ContainerAPIClient, strea
 				continue
 			}
 
-			daemonOSType = response.OSType
+			// Daemon versions before v29 did not return per-stats OSType;
+			// fall back to using the daemon's OSType.
+			if v.OSType == "" {
+				v.OSType = daemonOSType
+			}
 
-			if daemonOSType != "windows" {
-				previousCPU = v.PreCPUStats.CPUUsage.TotalUsage
-				previousSystem = v.PreCPUStats.SystemUsage
-				cpuPercent = calculateCPUPercentUnix(previousCPU, previousSystem, v)
-				blkRead, blkWrite = calculateBlockIO(v.BlkioStats)
-				mem = calculateMemUsageUnixNoCache(v.MemoryStats)
-				memLimit = float64(v.MemoryStats.Limit)
-				memPercent = calculateMemPercentUnixNoCache(memLimit, mem)
-				pidsStatsCurrent = v.PidsStats.Current
+			if daemonOSType == "windows" {
+				netRx, netTx := calculateNetwork(v.Networks)
+				s.SetStatistics(StatsEntry{
+					Name:          v.Name,
+					ID:            v.ID,
+					CPUPercentage: calculateCPUPercentWindows(&v),
+					Memory:        float64(v.MemoryStats.PrivateWorkingSet),
+					NetworkRx:     netRx,
+					NetworkTx:     netTx,
+					BlockRead:     float64(v.StorageStats.ReadSizeBytes),
+					BlockWrite:    float64(v.StorageStats.WriteSizeBytes),
+				})
 			} else {
-				cpuPercent = calculateCPUPercentWindows(v)
-				blkRead = v.StorageStats.ReadSizeBytes
-				blkWrite = v.StorageStats.WriteSizeBytes
-				mem = float64(v.MemoryStats.PrivateWorkingSet)
+				memUsage := calculateMemUsageUnixNoCache(v.MemoryStats)
+				netRx, netTx := calculateNetwork(v.Networks)
+				blkRead, blkWrite := calculateBlockIO(v.BlkioStats)
+				s.SetStatistics(StatsEntry{
+					Name:             v.Name,
+					ID:               v.ID,
+					CPUPercentage:    calculateCPUPercentUnix(v.PreCPUStats, v.CPUStats),
+					Memory:           memUsage,
+					MemoryPercentage: calculateMemPercentUnixNoCache(float64(v.MemoryStats.Limit), memUsage),
+					MemoryLimit:      float64(v.MemoryStats.Limit),
+					NetworkRx:        netRx,
+					NetworkTx:        netTx,
+					BlockRead:        float64(blkRead),
+					BlockWrite:       float64(blkWrite),
+					PidsCurrent:      v.PidsStats.Current,
+				})
 			}
-			netRx, netTx := calculateNetwork(v.Networks)
-			s.SetStatistics(StatsEntry{
-				Name:             v.Name,
-				ID:               v.ID,
-				CPUPercentage:    cpuPercent,
-				Memory:           mem,
-				MemoryPercentage: memPercent,
-				MemoryLimit:      memLimit,
-				NetworkRx:        netRx,
-				NetworkTx:        netTx,
-				BlockRead:        float64(blkRead),
-				BlockWrite:       float64(blkWrite),
-				PidsCurrent:      pidsStatsCurrent,
-			})
 			u <- nil
 			if !streamStats {
 				return
@@ -145,8 +143,8 @@ func collect(ctx context.Context, s *Stats, cli client.ContainerAPIClient, strea
 			}
 		case err := <-u:
 			s.SetError(err)
-			if err == io.EOF {
-				break
+			if errors.Is(err, io.EOF) {
+				return
 			}
 			if err != nil {
 				continue
@@ -156,6 +154,9 @@ func collect(ctx context.Context, s *Stats, cli client.ContainerAPIClient, strea
 				getFirst = true
 				waitFirst.Done()
 			}
+		case <-ctx.Done():
+			s.SetError(ctx.Err())
+			return
 		}
 		if !streamStats {
 			return
@@ -163,18 +164,18 @@ func collect(ctx context.Context, s *Stats, cli client.ContainerAPIClient, strea
 	}
 }
 
-func calculateCPUPercentUnix(previousCPU, previousSystem uint64, v *container.StatsResponse) float64 {
+func calculateCPUPercentUnix(previousCPU container.CPUStats, curCPUStats container.CPUStats) float64 {
 	var (
 		cpuPercent = 0.0
 		// calculate the change for the cpu usage of the container in between readings
-		cpuDelta = float64(v.CPUStats.CPUUsage.TotalUsage) - float64(previousCPU)
+		cpuDelta = float64(curCPUStats.CPUUsage.TotalUsage) - float64(previousCPU.CPUUsage.TotalUsage)
 		// calculate the change for the entire system between readings
-		systemDelta = float64(v.CPUStats.SystemUsage) - float64(previousSystem)
-		onlineCPUs  = float64(v.CPUStats.OnlineCPUs)
+		systemDelta = float64(curCPUStats.SystemUsage) - float64(previousCPU.SystemUsage)
+		onlineCPUs  = float64(curCPUStats.OnlineCPUs)
 	)
 
 	if onlineCPUs == 0.0 {
-		onlineCPUs = float64(len(v.CPUStats.CPUUsage.PercpuUsage))
+		onlineCPUs = float64(len(curCPUStats.CPUUsage.PercpuUsage))
 	}
 	if systemDelta > 0.0 && cpuDelta > 0.0 {
 		cpuPercent = (cpuDelta / systemDelta) * onlineCPUs * 100.0
@@ -186,13 +187,11 @@ func calculateCPUPercentWindows(v *container.StatsResponse) float64 {
 	// Max number of 100ns intervals between the previous time read and now
 	possIntervals := uint64(v.Read.Sub(v.PreRead).Nanoseconds()) // Start with number of ns intervals
 	possIntervals /= 100                                         // Convert to number of 100ns intervals
-	possIntervals *= uint64(v.NumProcs)                          // Multiple by the number of processors
-
-	// Intervals used
-	intervalsUsed := v.CPUStats.CPUUsage.TotalUsage - v.PreCPUStats.CPUUsage.TotalUsage
+	possIntervals *= uint64(v.NumProcs)                          // Multiply by the number of processors
 
 	// Percentage avoiding divide-by-zero
 	if possIntervals > 0 {
+		intervalsUsed := v.CPUStats.CPUUsage.TotalUsage - v.PreCPUStats.CPUUsage.TotalUsage
 		return float64(intervalsUsed) / float64(possIntervals) * 100.0
 	}
 	return 0.00

cli/command/container/stop.go

@@ -64,10 +64,11 @@ func runStop(ctx context.Context, dockerCLI command.Cli, opts *stopOptions) erro
 
 	apiClient := dockerCLI.Client()
 	errChan := parallelOperation(ctx, opts.containers, func(ctx context.Context, id string) error {
-		return apiClient.ContainerStop(ctx, id, client.ContainerStopOptions{
+		_, err := apiClient.ContainerStop(ctx, id, client.ContainerStopOptions{
 			Signal:  opts.signal,
 			Timeout: timeout,
 		})
+		return err
 	})
 	var errs []error
 	for _, ctr := range opts.containers {

cli/command/container/stop_test.go

@@ -62,10 +62,10 @@ func TestStop(t *testing.T) {
 			mutex := new(sync.Mutex)
 
 			cli := test.NewFakeCli(&fakeClient{
-				containerStopFunc: func(ctx context.Context, containerID string, options client.ContainerStopOptions) error {
+				containerStopFunc: func(ctx context.Context, containerID string, options client.ContainerStopOptions) (client.ContainerStopResult, error) {
 					assert.Check(t, is.DeepEqual(options, tc.expectedOpts))
 					if containerID == "nosuchcontainer" {
-						return notFound(errors.New("Error: no such container: " + containerID))
+						return client.ContainerStopResult{}, notFound(errors.New("Error: no such container: " + containerID))
 					}
 
 					// containerStopFunc is called in parallel for each container
@@ -73,7 +73,7 @@ func TestStop(t *testing.T) {
 					mutex.Lock()
 					stopped = append(stopped, containerID)
 					mutex.Unlock()
-					return nil
+					return client.ContainerStopResult{}, nil
 				},
 				Version: "1.36",
 			})

cli/command/container/top.go

@@ -9,6 +9,7 @@ import (
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/cli/command/completion"
 	"github.com/docker/cli/cli/command/formatter/tabwriter"
+	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
 
@@ -45,17 +46,19 @@ func newTopCommand(dockerCLI command.Cli) *cobra.Command {
 }
 
 func runTop(ctx context.Context, dockerCli command.Cli, opts *topOptions) error {
-	procList, err := dockerCli.Client().ContainerTop(ctx, opts.container, opts.args)
+	procList, err := dockerCli.Client().ContainerTop(ctx, opts.container, client.ContainerTopOptions{
+		Arguments: opts.args,
+	})
 	if err != nil {
 		return err
 	}
 
 	w := tabwriter.NewWriter(dockerCli.Out(), 20, 1, 3, ' ', 0)
-	fmt.Fprintln(w, strings.Join(procList.Titles, "\t"))
+	_, _ = fmt.Fprintln(w, strings.Join(procList.Titles, "\t"))
 
 	for _, proc := range procList.Processes {
-		fmt.Fprintln(w, strings.Join(proc, "\t"))
+		_, _ = fmt.Fprintln(w, strings.Join(proc, "\t"))
 	}
-	w.Flush()
+	_ = w.Flush()
 	return nil
 }

cli/command/container/tty.go

@@ -14,22 +14,29 @@ import (
 	"github.com/sirupsen/logrus"
 )
 
-// resizeTtyTo resizes tty to specific height and width
-func resizeTtyTo(ctx context.Context, apiClient client.ContainerAPIClient, id string, height, width uint, isExec bool) error {
+// TODO(thaJeztah): split resizeTTYTo
+type resizeClient interface {
+	client.ExecAPIClient
+	client.ContainerAPIClient
+}
+
+// resizeTTYTo resizes TTY to specific height and width.
+func resizeTTYTo(ctx context.Context, apiClient resizeClient, id string, height, width uint, isExec bool) error {
 	if height == 0 && width == 0 {
 		return nil
 	}
 
-	options := client.ContainerResizeOptions{
-		Height: height,
-		Width:  width,
-	}
-
 	var err error
 	if isExec {
-		err = apiClient.ContainerExecResize(ctx, id, options)
+		_, err = apiClient.ExecResize(ctx, id, client.ExecResizeOptions{
+			Height: height,
+			Width:  width,
+		})
 	} else {
-		err = apiClient.ContainerResize(ctx, id, options)
+		_, err = apiClient.ContainerResize(ctx, id, client.ContainerResizeOptions{
+			Height: height,
+			Width:  width,
+		})
 	}
 
 	if err != nil {
@@ -41,26 +48,26 @@ func resizeTtyTo(ctx context.Context, apiClient client.ContainerAPIClient, id st
 // resizeTty is to resize the tty with cli out's tty size
 func resizeTty(ctx context.Context, cli command.Cli, id string, isExec bool) error {
 	height, width := cli.Out().GetTtySize()
-	return resizeTtyTo(ctx, cli.Client(), id, height, width, isExec)
+	return resizeTTYTo(ctx, cli.Client(), id, height, width, isExec)
 }
 
-// initTtySize is to init the tty's size to the same as the window, if there is an error, it will retry 10 times.
+// initTtySize is to init the TTYs size to the same as the window, if there is an error, it will retry 10 times.
 func initTtySize(ctx context.Context, cli command.Cli, id string, isExec bool, resizeTtyFunc func(ctx context.Context, cli command.Cli, id string, isExec bool) error) {
-	rttyFunc := resizeTtyFunc
-	if rttyFunc == nil {
-		rttyFunc = resizeTty
+	rTTYfunc := resizeTtyFunc
+	if rTTYfunc == nil {
+		rTTYfunc = resizeTty
 	}
-	if err := rttyFunc(ctx, cli, id, isExec); err != nil {
+	if err := rTTYfunc(ctx, cli, id, isExec); err != nil {
 		go func() {
 			var err error
 			for retry := 0; retry < 10; retry++ {
 				time.Sleep(time.Duration(retry+1) * 10 * time.Millisecond)
-				if err = rttyFunc(ctx, cli, id, isExec); err == nil {
+				if err = rTTYfunc(ctx, cli, id, isExec); err == nil {
 					break
 				}
 			}
 			if err != nil {
-				fmt.Fprintln(cli.Err(), "failed to resize tty, using default size")
+				_, _ = fmt.Fprintln(cli.Err(), "failed to resize tty, using default size")
 			}
 		}()
 	}
@@ -77,7 +84,7 @@ func MonitorTtySize(ctx context.Context, cli command.Cli, id string, isExec bool
 				h, w := cli.Out().GetTtySize()
 
 				if prevW != w || prevH != h {
-					resizeTty(ctx, cli, id, isExec)
+					_ = resizeTty(ctx, cli, id, isExec)
 				}
 				prevH = h
 				prevW = w
@@ -88,7 +95,7 @@ func MonitorTtySize(ctx context.Context, cli command.Cli, id string, isExec bool
 		gosignal.Notify(sigchan, signal.SIGWINCH)
 		go func() {
 			for range sigchan {
-				resizeTty(ctx, cli, id, isExec)
+				_ = resizeTty(ctx, cli, id, isExec)
 			}
 		}()
 	}

cli/command/container/tty_test.go

@@ -15,12 +15,12 @@ import (
 
 func TestInitTtySizeErrors(t *testing.T) {
 	expectedError := "failed to resize tty, using default size\n"
-	fakeContainerExecResizeFunc := func(id string, options client.ContainerResizeOptions) error {
-		return errors.New("Error response from daemon: no such exec")
+	fakeContainerExecResizeFunc := func(id string, options client.ExecResizeOptions) (client.ExecResizeResult, error) {
+		return client.ExecResizeResult{}, errors.New("error response from daemon: no such exec")
 	}
 	fakeResizeTtyFunc := func(ctx context.Context, cli command.Cli, id string, isExec bool) error {
 		height, width := uint(1024), uint(768)
-		return resizeTtyTo(ctx, cli.Client(), id, height, width, isExec)
+		return resizeTTYTo(ctx, cli.Client(), id, height, width, isExec)
 	}
 	ctx := context.Background()
 	cli := test.NewFakeCli(&fakeClient{containerExecResizeFunc: fakeContainerExecResizeFunc})

cli/command/container/unpause.go

@@ -9,6 +9,7 @@ import (
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/cli/command/completion"
 	"github.com/moby/moby/api/types/container"
+	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
 
@@ -41,7 +42,10 @@ func newUnpauseCommand(dockerCLI command.Cli) *cobra.Command {
 
 func runUnpause(ctx context.Context, dockerCLI command.Cli, opts *unpauseOptions) error {
 	apiClient := dockerCLI.Client()
-	errChan := parallelOperation(ctx, opts.containers, apiClient.ContainerUnpause)
+	errChan := parallelOperation(ctx, opts.containers, func(ctx context.Context, container string) error {
+		_, err := apiClient.ContainerUnpause(ctx, container, client.ContainerUnpauseOptions{})
+		return err
+	})
 	var errs []error
 	for _, ctr := range opts.containers {
 		if err := <-errChan; err != nil {

cli/command/container/update.go

@@ -11,6 +11,7 @@ import (
 	"github.com/docker/cli/cli/command/completion"
 	"github.com/docker/cli/opts"
 	containertypes "github.com/moby/moby/api/types/container"
+	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
 
@@ -60,9 +61,9 @@ func newUpdateCommand(dockerCLI command.Cli) *cobra.Command {
 	flags.Int64Var(&options.cpuPeriod, "cpu-period", 0, "Limit CPU CFS (Completely Fair Scheduler) period")
 	flags.Int64Var(&options.cpuQuota, "cpu-quota", 0, "Limit CPU CFS (Completely Fair Scheduler) quota")
 	flags.Int64Var(&options.cpuRealtimePeriod, "cpu-rt-period", 0, "Limit the CPU real-time period in microseconds")
-	flags.SetAnnotation("cpu-rt-period", "version", []string{"1.25"})
+	_ = flags.SetAnnotation("cpu-rt-period", "version", []string{"1.25"})
 	flags.Int64Var(&options.cpuRealtimeRuntime, "cpu-rt-runtime", 0, "Limit the CPU real-time runtime in microseconds")
-	flags.SetAnnotation("cpu-rt-runtime", "version", []string{"1.25"})
+	_ = flags.SetAnnotation("cpu-rt-runtime", "version", []string{"1.25"})
 	flags.StringVar(&options.cpusetCpus, "cpuset-cpus", "", "CPUs in which to allow execution (0-3, 0,1)")
 	flags.StringVar(&options.cpusetMems, "cpuset-mems", "", "MEMs in which to allow execution (0-3, 0,1)")
 	flags.Int64VarP(&options.cpuShares, "cpu-shares", "c", 0, "CPU shares (relative weight)")
@@ -72,10 +73,10 @@ func newUpdateCommand(dockerCLI command.Cli) *cobra.Command {
 
 	flags.StringVar(&options.restartPolicy, "restart", "", "Restart policy to apply when a container exits")
 	flags.Int64Var(&options.pidsLimit, "pids-limit", 0, `Tune container pids limit (set -1 for unlimited)`)
-	flags.SetAnnotation("pids-limit", "version", []string{"1.40"})
+	_ = flags.SetAnnotation("pids-limit", "version", []string{"1.40"})
 
 	flags.Var(&options.cpus, "cpus", "Number of CPUs")
-	flags.SetAnnotation("cpus", "version", []string{"1.29"})
+	_ = flags.SetAnnotation("cpus", "version", []string{"1.29"})
 
 	_ = cmd.RegisterFlagCompletionFunc("restart", completeRestartPolicies)
 
@@ -107,8 +108,8 @@ func runUpdate(ctx context.Context, dockerCli command.Cli, options *updateOption
 		pidsLimit = &options.pidsLimit
 	}
 
-	updateConfig := containertypes.UpdateConfig{
-		Resources: containertypes.Resources{
+	updateConfig := client.ContainerUpdateOptions{
+		Resources: &containertypes.Resources{
 			BlkioWeight:        options.blkioWeight,
 			CpusetCpus:         options.cpusetCpus,
 			CpusetMems:         options.cpusetMems,
@@ -123,7 +124,7 @@ func runUpdate(ctx context.Context, dockerCli command.Cli, options *updateOption
 			NanoCPUs:           options.cpus.Value(),
 			PidsLimit:          pidsLimit,
 		},
-		RestartPolicy: restartPolicy,
+		RestartPolicy: &restartPolicy,
 	}
 
 	var (

cli/command/container/utils.go

@@ -20,7 +20,9 @@ func waitExitOrRemoved(ctx context.Context, apiClient client.APIClient, containe
 		condition = container.WaitConditionRemoved
 	}
 
-	resultC, errC := apiClient.ContainerWait(ctx, containerID, condition)
+	waitRes := apiClient.ContainerWait(ctx, containerID, client.ContainerWaitOptions{
+		Condition: condition,
+	})
 
 	statusC := make(chan int)
 	go func() {
@@ -28,14 +30,14 @@ func waitExitOrRemoved(ctx context.Context, apiClient client.APIClient, containe
 		select {
 		case <-ctx.Done():
 			return
-		case result := <-resultC:
+		case result := <-waitRes.Result:
 			if result.Error != nil {
 				logrus.Errorf("Error waiting for container: %v", result.Error.Message)
 				statusC <- 125
 			} else {
 				statusC <- int(result.StatusCode)
 			}
-		case err := <-errC:
+		case err := <-waitRes.Error:
 			if errors.Is(err, context.Canceled) {
 				return
 			}

cli/command/container/utils_test.go

@@ -12,7 +12,7 @@ import (
 	is "gotest.tools/v3/assert/cmp"
 )
 
-func waitFn(cid string) (<-chan container.WaitResponse, <-chan error) {
+func waitFn(cid string) client.ContainerWaitResult {
 	resC := make(chan container.WaitResponse)
 	errC := make(chan error, 1)
 	var res container.WaitResponse
@@ -33,8 +33,10 @@ func waitFn(cid string) (<-chan container.WaitResponse, <-chan error) {
 			resC <- res
 		}
 	}()
-
-	return resC, errC
+	return client.ContainerWaitResult{
+		Result: resC,
+		Error:  errC,
+	}
 }
 
 func TestWaitExitOrRemoved(t *testing.T) {

cli/command/container/wait.go

@@ -4,10 +4,12 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"strconv"
 
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/cli/command/completion"
+	"github.com/moby/moby/client"
 	"github.com/spf13/cobra"
 )
 
@@ -42,12 +44,12 @@ func runWait(ctx context.Context, dockerCLI command.Cli, opts *waitOptions) erro
 
 	var errs []error
 	for _, ctr := range opts.containers {
-		resultC, errC := apiClient.ContainerWait(ctx, ctr, "")
+		res := apiClient.ContainerWait(ctx, ctr, client.ContainerWaitOptions{})
 
 		select {
-		case result := <-resultC:
-			_, _ = fmt.Fprintf(dockerCLI.Out(), "%d\n", result.StatusCode)
-		case err := <-errC:
+		case result := <-res.Result:
+			_, _ = fmt.Fprintln(dockerCLI.Out(), strconv.FormatInt(result.StatusCode, 10))
+		case err := <-res.Error:
 			errs = append(errs, err)
 		}
 	}

cli/command/context.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.23
+//go:build go1.24
 
 package command
 

cli/command/context/completion.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.23
+//go:build go1.24
 
 package context
 

cli/command/context/create.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.23
+//go:build go1.24
 
 package context
 

cli/command/context/create_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.23
+//go:build go1.24
 
 package context