fix: bump Go version to 1.26

behzad-mir · Copilot · behzad-mir · commit 53ec62eacf18 · 2026-04-21T22:55:35.000Z
Upgrade Go toolchain from 1.24 to 1.26 across all build configurations. Go 1.26 enforces FIPS-compliant system crypto for Microsoft compliance. Changes: - build/images.mk: GO_IMG 1.24 → 1.26-azurelinux3.0 - go.mod: go 1.24.1 → go 1.26 - install-go.sh: DEFAULT_IMAGE updated to Go 1.26 azurelinux3.0 SHA - bpf-prog/ipv6-hp-bpf/linux.Dockerfile: updated to Go 1.26 MCR SHA - npm/linux.Dockerfile, npm/windows.Dockerfile: 1.25.5 → 1.26 - .devcontainer/Dockerfile: VARIANT 1.24 → 1.26 - Regenerated all template Dockerfiles via make dockerfiles SHAs: - azurelinux3.0: sha256:eb3ce814e96f3319f1b5985021021682b47975f6decfe00eaac84abff0ae25c9 - MCR golang:1.26: sha256:6c27ae470941ef215b3eea86fcd6632a7ab975f391e5a75f546d3a76fd686705 Resolves #4365 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
@@ -1,4 +1,4 @@
-ARG VARIANT="1.24"
+ARG VARIANT="1.26"
 FROM mcr.microsoft.com/vscode/devcontainers/go:${VARIANT}
 RUN apt-get update && \
     export DEBIAN_FRONTEND=noninteractive && \
diff --git a/.pipelines/build/scripts/azure-ip-masq-merger.sh b/.pipelines/build/scripts/azure-ip-masq-merger.sh
@@ -5,6 +5,7 @@ set -eux
 FILE_EXT=''
 
 export CGO_ENABLED=0
+export GOEXPERIMENT=systemcrypto
 
 mkdir -p "$OUT_DIR"/bin
 mkdir -p "$OUT_DIR"/files
diff --git a/.pipelines/build/scripts/azure-ipam.sh b/.pipelines/build/scripts/azure-ipam.sh
@@ -4,6 +4,7 @@ set -eux
 [[ $OS =~ windows ]] && FILE_EXT='.exe' || FILE_EXT=''
 
 export CGO_ENABLED=0
+export GOEXPERIMENT=systemcrypto
 
 mkdir -p "$OUT_DIR"/bin
 mkdir -p "$OUT_DIR"/files
diff --git a/.pipelines/build/scripts/azure-iptables-monitor.sh b/.pipelines/build/scripts/azure-iptables-monitor.sh
@@ -5,6 +5,7 @@ set -eux
 FILE_EXT=''
 
 export CGO_ENABLED=0
+export GOEXPERIMENT=systemcrypto
 export C_INCLUDE_PATH=/usr/include/bpf
 
 mkdir -p "$OUT_DIR"/bin
diff --git a/.pipelines/build/scripts/cilium-log-collector.sh b/.pipelines/build/scripts/cilium-log-collector.sh
@@ -4,6 +4,7 @@ set -eux
 [[ $OS =~ windows ]] && { echo "cilium-log-collector is not supported on Windows"; exit 1; }
 # enable cgo for -buildmode=c-shared
 export CGO_ENABLED=1
+export GOEXPERIMENT=systemcrypto
 
 mkdir -p "$OUT_DIR"/bin
 mkdir -p "$OUT_DIR"/files
diff --git a/.pipelines/build/scripts/cni.sh b/.pipelines/build/scripts/cni.sh
@@ -7,6 +7,7 @@ mkdir -p "$OUT_DIR"/files
 mkdir -p "$OUT_DIR"/bin
 
 export CGO_ENABLED=0
+export GOEXPERIMENT=systemcrypto
 
 
 CNI_NET_DIR="$REPO_ROOT"/cni/network/plugin
diff --git a/.pipelines/build/scripts/cns.sh b/.pipelines/build/scripts/cns.sh
@@ -4,6 +4,7 @@ set -eux
 [[ $OS =~ windows ]] && FILE_EXT='.exe' || FILE_EXT=''
 
 export CGO_ENABLED=0
+export GOEXPERIMENT=systemcrypto
 
 mkdir -p "$OUT_DIR"/files
 mkdir -p "$OUT_DIR"/bin
diff --git a/.pipelines/build/scripts/dropgz.sh b/.pipelines/build/scripts/dropgz.sh
@@ -21,6 +21,7 @@ function files::remove_exe_extensions() {
 [[ $OS =~ windows ]] && FILE_EXT='.exe' || FILE_EXT=''
 
 export CGO_ENABLED=0
+export GOEXPERIMENT=systemcrypto
 
 mkdir -p "$GEN_DIR"
 mkdir -p "$OUT_DIR"/bin
diff --git a/.pipelines/build/scripts/install-go.sh b/.pipelines/build/scripts/install-go.sh
@@ -12,7 +12,7 @@ set -eux
 #
 # To update the fallback, run:
 #   skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.24-azurelinux3.0 --format "{{.Name}}@{{.Digest}}"
-DEFAULT_IMAGE="mcr.microsoft.com/oss/go/microsoft/golang@sha256:3999f970bb52b7413ef9be2803173d4fd7f1f3c59362a98a0c78d155e3a0e59f"
+DEFAULT_IMAGE="mcr.microsoft.com/oss/go/microsoft/golang@sha256:eb3ce814e96f3319f1b5985021021682b47975f6decfe00eaac84abff0ae25c9"
 
 # Resolves the golang image from the source Dockerfile for the given $name.
 # Echoes the image reference, or empty string if it cannot be determined.
diff --git a/.pipelines/build/scripts/ipv6-hp-bpf.sh b/.pipelines/build/scripts/ipv6-hp-bpf.sh
@@ -38,6 +38,7 @@ function findcp::shared_library() {
 [[ $OS =~ windows ]] && FILE_EXT='.exe' || FILE_EXT=''
 
 export CGO_ENABLED=0
+export GOEXPERIMENT=systemcrypto
 export C_INCLUDE_PATH=/usr/include/bpf
 
 mkdir -p "$OUT_DIR"/bin
diff --git a/.pipelines/build/scripts/npm.sh b/.pipelines/build/scripts/npm.sh
@@ -4,6 +4,7 @@ set -eux
 [[ $OS =~ windows ]] && FILE_EXT='.exe' || FILE_EXT=''
 
 export CGO_ENABLED=0
+export GOEXPERIMENT=systemcrypto
 
 mkdir -p "$OUT_DIR"/files
 mkdir -p "$OUT_DIR"/bin
diff --git a/azure-ip-masq-merger/Dockerfile b/azure-ip-masq-merger/Dockerfile
@@ -3,8 +3,9 @@
 ARG ARCH
 ARG OS
 
-# mcr.microsoft.com/oss/go/microsoft/golang:1.24-azurelinux3.0
-FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:bc7423b52b62e8f0281b5f7f564eb1862dc315bc57e1373c6a81e87ef3ac39ab AS go
+# mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0
+FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:eb3ce814e96f3319f1b5985021021682b47975f6decfe00eaac84abff0ae25c9 AS go
+ENV GOEXPERIMENT=systemcrypto
 
 FROM go AS azure-ip-masq-merger
 ARG OS
diff --git a/azure-ip-masq-merger/Dockerfile.tmpl b/azure-ip-masq-merger/Dockerfile.tmpl
@@ -5,6 +5,7 @@ ARG OS
 
 # {{.GO_IMG}}
 FROM --platform=linux/${ARCH} {{.GO_PIN}} AS go
+ENV GOEXPERIMENT=systemcrypto
 
 FROM go AS azure-ip-masq-merger
 ARG OS
diff --git a/azure-ipam/Dockerfile b/azure-ipam/Dockerfile
@@ -5,8 +5,9 @@ ARG DROPGZ_VERSION=v0.0.12
 ARG OS_VERSION
 ARG OS
 
-# mcr.microsoft.com/oss/go/microsoft/golang:1.24-azurelinux3.0
-FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:bc7423b52b62e8f0281b5f7f564eb1862dc315bc57e1373c6a81e87ef3ac39ab AS go
+# mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0
+FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:eb3ce814e96f3319f1b5985021021682b47975f6decfe00eaac84abff0ae25c9 AS go
+ENV GOEXPERIMENT=systemcrypto
 
 # mcr.microsoft.com/azurelinux/base/core:3.0
 FROM --platform=linux/${ARCH} mcr.microsoft.com/azurelinux/base/core@sha256:35149ae8dd179684f969944f54a337c665a64e702486154eb44253fb39c2505b AS mariner-core
diff --git a/azure-ipam/Dockerfile.tmpl b/azure-ipam/Dockerfile.tmpl
@@ -7,6 +7,7 @@ ARG OS
 
 # {{.GO_IMG}}
 FROM --platform=linux/${ARCH} {{.GO_PIN}} AS go
+ENV GOEXPERIMENT=systemcrypto
 
 # {{.MARINER_CORE_IMG}}
 FROM --platform=linux/${ARCH} {{.MARINER_CORE_PIN}} AS mariner-core
diff --git a/azure-iptables-monitor/Dockerfile b/azure-iptables-monitor/Dockerfile
@@ -8,8 +8,9 @@ FROM mcr.microsoft.com/azurelinux/base/core@sha256:35149ae8dd179684f969944f54a33
 # mcr.microsoft.com/azurelinux/distroless/base:3.0
 FROM mcr.microsoft.com/azurelinux/distroless/base@sha256:32820d2cf20e896aa9111742dd683dd0ccff370f742e256889bb3bb50320c0d4 AS mariner-distroless
 
-# mcr.microsoft.com/oss/go/microsoft/golang:1.24-azurelinux3.0
-FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:bc7423b52b62e8f0281b5f7f564eb1862dc315bc57e1373c6a81e87ef3ac39ab AS go
+# mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0
+FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:eb3ce814e96f3319f1b5985021021682b47975f6decfe00eaac84abff0ae25c9 AS go
+ENV GOEXPERIMENT=systemcrypto
 
 
 FROM go AS azure-iptables-monitor
diff --git a/azure-iptables-monitor/Dockerfile.tmpl b/azure-iptables-monitor/Dockerfile.tmpl
@@ -10,6 +10,7 @@ FROM {{.MARINER_DISTROLESS_PIN}} AS mariner-distroless
 
 # {{.GO_IMG}}
 FROM --platform=linux/${ARCH} {{.GO_PIN}} AS go
+ENV GOEXPERIMENT=systemcrypto
 
 
 FROM go AS azure-iptables-monitor
diff --git a/bpf-prog/ipv6-hp-bpf/linux.Dockerfile b/bpf-prog/ipv6-hp-bpf/linux.Dockerfile
@@ -1,11 +1,12 @@
 ARG ARCH
-# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.24 --format "{{.Name}}@{{.Digest}}"
-FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:f3e556c9de4dd93be774dc0fa2ce3cfa76f7744d0bacada92d1624f04ce69461 AS go
+# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.26 --format "{{.Name}}@{{.Digest}}"
+FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:6c27ae470941ef215b3eea86fcd6632a7ab975f391e5a75f546d3a76fd686705 AS go
 ARG VERSION
 ARG DEBUG
 ARG OS
 ARG ARCH
 WORKDIR /bpf-prog/ipv6-hp-bpf
+ENV GOEXPERIMENT=systemcrypto
 COPY ./bpf-prog/ipv6-hp-bpf .
 COPY ./bpf-prog/ipv6-hp-bpf/cmd/ipv6-hp-bpf/*.go /bpf-prog/ipv6-hp-bpf/
 COPY ./bpf-prog/ipv6-hp-bpf/include/helper.h /bpf-prog/ipv6-hp-bpf/include/helper.h
diff --git a/build/images.mk b/build/images.mk
@@ -1,5 +1,5 @@
 # Source images
-export GO_IMG					?= mcr.microsoft.com/oss/go/microsoft/golang:1.24-azurelinux3.0
+export GO_IMG					?= mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0
 export MARINER_CORE_IMG			?= mcr.microsoft.com/azurelinux/base/core:3.0
 export MARINER_DISTROLESS_IMG	?= mcr.microsoft.com/azurelinux/distroless/base:3.0
 export WIN_HPC_IMG				?= mcr.microsoft.com/oss/kubernetes/windows-host-process-containers-base-image:v1.0.0
diff --git a/cilium-log-collector/Dockerfile b/cilium-log-collector/Dockerfile
@@ -3,8 +3,9 @@
 ARG ARCH
 ARG OS
 
-# mcr.microsoft.com/oss/go/microsoft/golang:1.24-azurelinux3.0
-FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:bc7423b52b62e8f0281b5f7f564eb1862dc315bc57e1373c6a81e87ef3ac39ab AS go
+# mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0
+FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:eb3ce814e96f3319f1b5985021021682b47975f6decfe00eaac84abff0ae25c9 AS go
+ENV GOEXPERIMENT=systemcrypto
 
 FROM go AS fluent-bit-plugin
 ARG VERSION
diff --git a/cilium-log-collector/Dockerfile.tmpl b/cilium-log-collector/Dockerfile.tmpl
@@ -5,6 +5,7 @@ ARG OS
 
 # {{.GO_IMG}}
 FROM --platform=linux/${ARCH} {{.GO_PIN}} AS go
+ENV GOEXPERIMENT=systemcrypto
 
 FROM go AS fluent-bit-plugin
 ARG VERSION
diff --git a/cni/Dockerfile b/cni/Dockerfile
@@ -5,8 +5,9 @@ ARG DROPGZ_VERSION=v0.0.12
 ARG OS_VERSION
 ARG OS
 
-# mcr.microsoft.com/oss/go/microsoft/golang:1.24-azurelinux3.0
-FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:bc7423b52b62e8f0281b5f7f564eb1862dc315bc57e1373c6a81e87ef3ac39ab AS go
+# mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0
+FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:eb3ce814e96f3319f1b5985021021682b47975f6decfe00eaac84abff0ae25c9 AS go
+ENV GOEXPERIMENT=systemcrypto
 
 # mcr.microsoft.com/azurelinux/base/core:3.0
 FROM --platform=linux/${ARCH} mcr.microsoft.com/azurelinux/base/core@sha256:35149ae8dd179684f969944f54a337c665a64e702486154eb44253fb39c2505b AS mariner-core
diff --git a/cni/Dockerfile.tmpl b/cni/Dockerfile.tmpl
@@ -7,6 +7,7 @@ ARG OS
 
 # {{.GO_IMG}}
 FROM --platform=linux/${ARCH} {{.GO_PIN}} AS go
+ENV GOEXPERIMENT=systemcrypto
 
 # {{.MARINER_CORE_IMG}}
 FROM --platform=linux/${ARCH} {{.MARINER_CORE_PIN}} AS mariner-core
diff --git a/cns/Dockerfile b/cns/Dockerfile
@@ -4,8 +4,9 @@ ARG ARCH
 ARG OS_VERSION
 ARG OS
 
-# mcr.microsoft.com/oss/go/microsoft/golang:1.24-azurelinux3.0
-FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:bc7423b52b62e8f0281b5f7f564eb1862dc315bc57e1373c6a81e87ef3ac39ab AS go
+# mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0
+FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:eb3ce814e96f3319f1b5985021021682b47975f6decfe00eaac84abff0ae25c9 AS go
+ENV GOEXPERIMENT=systemcrypto
 
 # mcr.microsoft.com/azurelinux/base/core:3.0
 FROM mcr.microsoft.com/azurelinux/base/core@sha256:35149ae8dd179684f969944f54a337c665a64e702486154eb44253fb39c2505b AS mariner-core
diff --git a/cns/Dockerfile.tmpl b/cns/Dockerfile.tmpl
@@ -6,6 +6,7 @@ ARG OS
 
 # {{.GO_IMG}}
 FROM --platform=linux/${ARCH} {{.GO_PIN}} AS go
+ENV GOEXPERIMENT=systemcrypto
 
 # {{.MARINER_CORE_IMG}}
 FROM {{.MARINER_CORE_PIN}} AS mariner-core
diff --git a/go.mod b/go.mod
@@ -1,6 +1,6 @@
 module github.com/Azure/azure-container-networking
 
-go 1.24.1
+go 1.26
 
 require (
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.19.1
diff --git a/npm/linux.Dockerfile b/npm/linux.Dockerfile
@@ -1,10 +1,11 @@
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.5 AS builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.26 AS builder
 ARG VERSION
 ARG NPM_AI_PATH
 ARG NPM_AI_ID
 WORKDIR /usr/local/src
 COPY . .
-RUN MS_GO_NOSYSTEMCRYPTO=1 CGO_ENABLED=0 go build -v -o /usr/local/bin/azure-npm -ldflags "-s -w -X main.version="$VERSION" -X "$NPM_AI_PATH"="$NPM_AI_ID"" -gcflags="-dwarflocationlists=true" npm/cmd/*.go
+ENV GOEXPERIMENT=systemcrypto
+RUN CGO_ENABLED=0 go build -v -o /usr/local/bin/azure-npm -ldflags "-s -w -X main.version="$VERSION" -X "$NPM_AI_PATH"="$NPM_AI_ID"" -gcflags="-dwarflocationlists=true" npm/cmd/*.go
 
 FROM mcr.microsoft.com/mirror/docker/library/ubuntu:24.04 as linux
 COPY --from=builder /usr/local/bin/azure-npm /usr/bin/azure-npm
diff --git a/npm/windows.Dockerfile b/npm/windows.Dockerfile
@@ -1,11 +1,12 @@
 ARG OS_VERSION
-FROM --platform=linux/amd64 mcr.microsoft.com/oss/go/microsoft/golang:1.25.5 AS builder
+FROM --platform=linux/amd64 mcr.microsoft.com/oss/go/microsoft/golang:1.26 AS builder
 ARG VERSION
 ARG NPM_AI_PATH
 ARG NPM_AI_ID
 WORKDIR /usr/local/src
 COPY . .
-RUN MS_GO_NOSYSTEMCRYPTO=1 GOOS=windows CGO_ENABLED=0 go build -v -o /usr/local/bin/azure-npm.exe -ldflags "-s -w -X main.version="$VERSION" -X "$NPM_AI_PATH"="$NPM_AI_ID"" -gcflags="-dwarflocationlists=true" npm/cmd/*.go
+ENV GOEXPERIMENT=systemcrypto
+RUN GOOS=windows CGO_ENABLED=0 go build -v -o /usr/local/bin/azure-npm.exe -ldflags "-s -w -X main.version="$VERSION" -X "$NPM_AI_PATH"="$NPM_AI_ID"" -gcflags="-dwarflocationlists=true" npm/cmd/*.go
 
 # intermediate for win-ltsc2022
 FROM mcr.microsoft.com/windows/servercore@sha256:3a2a2fdfbae2f720f6fe26f2d7680146712ce330f605b02a61d624889735c72e as windows

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-ARG VARIANT="1.24"`
	`1`	`+ARG VARIANT="1.26"`
`2`	`2`	`FROM mcr.microsoft.com/vscode/devcontainers/go:${VARIANT}`
`3`	`3`	`RUN apt-get update && \`
`4`	`4`	`export DEBIAN_FRONTEND=noninteractive && \`
Original file line number	Diff line number	Diff line change
`@@ -12,7 +12,7 @@ set -eux`
`12`	`12`	`#`
`13`	`13`	`# To update the fallback, run:`
`14`	`14`	`# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.24-azurelinux3.0 --format "{{.Name}}@{{.Digest}}"`
`15`		`-DEFAULT_IMAGE="mcr.microsoft.com/oss/go/microsoft/golang@sha256:3999f970bb52b7413ef9be2803173d4fd7f1f3c59362a98a0c78d155e3a0e59f"`
	`15`	`+DEFAULT_IMAGE="mcr.microsoft.com/oss/go/microsoft/golang@sha256:eb3ce814e96f3319f1b5985021021682b47975f6decfe00eaac84abff0ae25c9"`
`16`	`16`
`17`	`17`	`# Resolves the golang image from the source Dockerfile for the given $name.`
`18`	`18`	`# Echoes the image reference, or empty string if it cannot be determined.`