[CONTINT-5217][CONTINT-5218][CONTINT-5219][CONTINT-5220] Upgrade Docker SDK from docker/docker v28 to moby/moby v29

.copyright-overrides.yml

@@ -266,6 +266,7 @@ github.com/gogo/protobuf: ["Copyright (c) 2013, The GoGo Authors. All rights res
 #  * Year is based on the year of the first commit to the repository
 #  * Author, when known only by GitHub username, is "GitHub Full Name (github-username)"
 github.com/moby/docker-image-spec/specs-go/v1: Copyright 2012-2017 Docker, Inc.
+github.com/moby/moby/*: Copyright 2012-2017 Docker, Inc.
 github.com/moby/sys/mountinfo: Copyright (c) 2014-2018 The Docker & Go Authors. All rights reserved.
 github.com/moby/sys/signal: Copyright (c) 2014-2018 The Docker & Go Authors. All rights reserved.
 github.com/moby/sys/user: Copyright (c) 2014-2018 The Docker & Go Authors. All rights reserved.

LICENSE-3rdparty.csv

@@ -931,8 +931,6 @@ core,github.com/docker/docker/api/types/time,Apache-2.0,"Copyright 2012-2017 Doc
 core,github.com/docker/docker/api/types/versions,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
 core,github.com/docker/docker/api/types/volume,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
 core,github.com/docker/docker/client,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
-core,github.com/docker/docker/pkg/stdcopy,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
-core,github.com/docker/docker/pkg/system,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
 core,github.com/docker/go-connections/nat,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
 core,github.com/docker/go-connections/sockets,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
 core,github.com/docker/go-connections/tlsconfig,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
@@ -1564,6 +1562,28 @@ core,github.com/mitchellh/reflectwalk,MIT,Copyright (c) 2013 Mitchell Hashimoto
 core,github.com/mkrautz/goar,BSD-3-Clause,Copyright (c) 2011 Mikkel Krautz
 core,github.com/moby/docker-image-spec/specs-go/v1,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
 core,github.com/moby/locker,Apache-2.0,"Copyright 2013-2018 Docker, Inc"
+core,github.com/moby/moby/api/types,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
+core,github.com/moby/moby/api/types/blkiodev,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
+core,github.com/moby/moby/api/types/build,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
+core,github.com/moby/moby/api/types/checkpoint,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
+core,github.com/moby/moby/api/types/common,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
+core,github.com/moby/moby/api/types/container,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
+core,github.com/moby/moby/api/types/events,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
+core,github.com/moby/moby/api/types/image,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
+core,github.com/moby/moby/api/types/jsonstream,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
+core,github.com/moby/moby/api/types/mount,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
+core,github.com/moby/moby/api/types/network,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
+core,github.com/moby/moby/api/types/plugin,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
+core,github.com/moby/moby/api/types/registry,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
+core,github.com/moby/moby/api/types/storage,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
+core,github.com/moby/moby/api/types/swarm,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
+core,github.com/moby/moby/api/types/system,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
+core,github.com/moby/moby/api/types/volume,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
+core,github.com/moby/moby/client,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
+core,github.com/moby/moby/client/internal,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
+core,github.com/moby/moby/client/internal/mod,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
+core,github.com/moby/moby/client/internal/timestamp,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
+core,github.com/moby/moby/client/pkg/versions,Apache-2.0,"Copyright 2012-2017 Docker, Inc."
 core,github.com/moby/spdystream,Apache-2.0,"Copyright 2013-2021 Docker, inc. Released under the [Apache 2.0 license](LICENSE) | Copyright 2014-2021 Docker Inc"
 core,github.com/moby/spdystream/spdy,Apache-2.0,"Copyright 2013-2021 Docker, inc. Released under the [Apache 2.0 license](LICENSE) | Copyright 2014-2021 Docker Inc"
 core,github.com/moby/sys/mountinfo,Apache-2.0,Copyright (c) 2014-2018 The Docker & Go Authors. All rights reserved.

comp/core/workloadfilter/util/docker/create.go

@@ -9,7 +9,7 @@
 package docker
 
 import (
-	"github.com/docker/docker/api/types/container"
+	"github.com/moby/moby/api/types/container"
 
 	workloadfilter "github.com/DataDog/datadog-agent/comp/core/workloadfilter/def"
 	"github.com/DataDog/datadog-agent/pkg/proto/pbgo/core"

comp/core/workloadmeta/collectors/internal/docker/docker.go

@@ -18,11 +18,11 @@ import (
 	"sync"
 	"time"
 
-	"github.com/docker/docker/api/types/container"
-	"github.com/docker/docker/api/types/events"
-	"github.com/docker/docker/api/types/image"
-	"github.com/docker/docker/api/types/network"
-	"github.com/docker/go-connections/nat"
+	"github.com/moby/moby/api/types/container"
+	"github.com/moby/moby/api/types/events"
+	"github.com/moby/moby/api/types/image"
+	"github.com/moby/moby/api/types/network"
+	dockerclient "github.com/moby/moby/client"
 	v1 "github.com/opencontainers/image-spec/specs-go/v1"
 	"go.uber.org/fx"
 
@@ -199,7 +199,7 @@ func (c *collector) generateEventsFromContainerList(ctx context.Context, filter
 		return errors.New("Start was not called")
 	}
 
-	containers, err := c.dockerUtil.RawContainerListWithFilter(ctx, container.ListOptions{}, filter, c.store)
+	containers, err := c.dockerUtil.RawContainerListWithFilter(ctx, dockerclient.ContainerListOptions{}, filter, c.store)
 	if err != nil {
 		return err
 	}
@@ -459,35 +459,32 @@ func extractPorts(container container.InspectResponse) []workloadmeta.ContainerP
 	return ports
 }
 
-func extractPort(port nat.Port) []workloadmeta.ContainerPort {
+func extractPort(port network.Port) []workloadmeta.ContainerPort {
 	var output []workloadmeta.ContainerPort
 
-	// Try to parse a port range, eg. 22-25
-	first, last, err := port.Range()
-	if err != nil {
-		log.Debugf("cannot get port range from nat.Port: %s", err)
-		return output
-	}
+	pr := port.Range()
+	first := int(pr.Start())
+	last := int(pr.End())
 
 	if last > first {
 		output = make([]workloadmeta.ContainerPort, 0, last-first+1)
 		for p := first; p <= last; p++ {
 			output = append(output, workloadmeta.ContainerPort{
 				Port:     p,
-				Protocol: port.Proto(),
+				Protocol: string(port.Proto()),
 			})
 		}
 
 		return output
 	}
 
-	// Try to parse a single port (most common case)
-	p := port.Int()
+	// Single port (most common case)
+	p := int(port.Num())
 	if p > 0 {
 		output = []workloadmeta.ContainerPort{
 			{
 				Port:     p,
-				Protocol: port.Proto(),
+				Protocol: string(port.Proto()),
 			},
 		}
 	}
@@ -499,8 +496,8 @@ func extractNetworkIPs(networks map[string]*network.EndpointSettings) map[string
 	networkIPs := make(map[string]string)
 
 	for net, settings := range networks {
-		if len(settings.IPAddress) > 0 {
-			networkIPs[net] = settings.IPAddress
+		if settings.IPAddress.IsValid() {
+			networkIPs[net] = settings.IPAddress.String()
 		}
 	}
 

comp/core/workloadmeta/collectors/internal/docker/docker_test.go

@@ -11,7 +11,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/docker/docker/api/types/image"
+	"github.com/moby/moby/api/types/image"
 	v1 "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/stretchr/testify/assert"
 

deps/go.MODULE.bazel

@@ -245,8 +245,6 @@ use_repo(
     "com_github_datadog_zstd",
     "com_github_davecgh_go_spew",
     "com_github_distribution_reference",
-    "com_github_docker_docker",
-    "com_github_docker_go_connections",
     "com_github_dustin_go_humanize",
     "com_github_elastic_go_freelru",
     "com_github_elastic_go_libaudit_v2",
@@ -339,6 +337,8 @@ use_repo(
     "com_github_miekg_dns",
     "com_github_mitchellh_mapstructure",
     "com_github_moby_docker_image_spec",
+    "com_github_moby_moby_api",
+    "com_github_moby_moby_client",
     "com_github_moby_sys_mountinfo",
     "com_github_modelcontextprotocol_go_sdk",
     "com_github_mohae_deepcopy",

go.mod

@@ -216,8 +216,8 @@ require (
 	github.com/cyphar/filepath-securejoin v0.6.0
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
 	github.com/distribution/reference v0.6.0
-	github.com/docker/docker v28.5.2+incompatible
-	github.com/docker/go-connections v0.6.0
+	github.com/docker/docker v28.5.2+incompatible // indirect
+	github.com/docker/go-connections v0.6.0 // indirect
 	github.com/dustin/go-humanize v1.0.1
 	github.com/elastic/go-libaudit/v2 v2.6.2
 	github.com/elastic/go-seccomp-bpf v1.6.0
@@ -685,7 +685,6 @@ require (
 	github.com/moby/docker-image-spec v1.3.1
 	github.com/moby/locker v1.0.1 // indirect
 	github.com/moby/spdystream v0.5.0 // indirect
-	github.com/moby/sys/atomicwriter v0.1.0 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/moby/sys/signal v0.7.1 // indirect
 	github.com/moby/sys/user v0.4.0 // indirect
@@ -993,6 +992,8 @@ require (
 	github.com/hashicorp/vault/api/auth/userpass v0.11.0
 	github.com/jarcoal/httpmock v1.4.1
 	github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c
+	github.com/moby/moby/api v1.54.1
+	github.com/moby/moby/client v0.4.0
 	github.com/modelcontextprotocol/go-sdk v1.4.1
 	github.com/qri-io/jsonpointer v0.1.1
 	github.com/santhosh-tekuri/jsonschema/v5 v5.3.1
@@ -1161,8 +1162,6 @@ require (
 	github.com/lestrrat-go/option v1.0.1 // indirect
 	github.com/mattn/go-zglob v0.0.2-0.20191112051448-a8912a37f9e7 // indirect
 	github.com/mitchellh/pointerstructure v1.2.1 // indirect
-	github.com/moby/moby/api v1.52.0 // indirect
-	github.com/moby/moby/client v0.2.1 // indirect
 	github.com/montanaflynn/stats v0.7.1 // indirect
 	github.com/nexus-rpc/sdk-go v0.5.1 // indirect
 	github.com/nicolai86/scaleway-sdk v1.10.2-0.20180628010248-798f60e20bb2 // indirect
@@ -1230,8 +1229,12 @@ replace github.com/hashicorp/vault/api/auth/aws => github.com/DataDog/vault/api/
 
 // Use custom Trivy fork to reduce binary size
 // Pull in replacements needed by upstream Trivy
-// Maps to Trivy fork https://github.com/DataDog/trivy/commits/djc/main-dd-060-no-buildinfo
-replace github.com/aquasecurity/trivy => github.com/DataDog/trivy v0.0.0-20251216175138-81422df93657
+// Maps to Trivy fork https://github.com/DataDog/trivy/pull/32
+replace github.com/aquasecurity/trivy => github.com/DataDog/trivy v0.0.0-20260407220859-6cf8ddc1826c
+
+// github.com/docker/docker v28 has known security vulnerabilities (CVE-2026-34040, CVE-2026-33997).
+// Pin to the 28.x branch head which includes the backported security fixes (not yet tagged).
+replace github.com/docker/docker => github.com/docker/docker v28.5.3-0.20260325154711-31a1689cb0a1+incompatible
 
 // Prevent dependencies to be bumped by Trivy
 // github.com/DataDog/aptly@v1.5.3 depends on gopenpgp/v2, so we use latest version of go-crypto before the move to gopenpgp/v3

pkg/collector/corechecks/containers/docker/check.go

@@ -16,7 +16,8 @@ import (
 	"strings"
 	"time"
 
-	"github.com/docker/docker/api/types/container"
+	"github.com/moby/moby/api/types/container"
+	dockerclient "github.com/moby/moby/client"
 
 	"github.com/DataDog/datadog-agent/comp/core/autodiscovery/integration"
 	tagger "github.com/DataDog/datadog-agent/comp/core/tagger/def"
@@ -171,7 +172,7 @@ func (d *DockerCheck) Run() error {
 		d.collectContainerSizeCounter = (d.collectContainerSizeCounter + 1) % d.instance.CollectContainerSizeFreq
 	}
 
-	rawContainerList, err := du.RawContainerList(context.TODO(), container.ListOptions{All: true, Size: collectContainerSize})
+	rawContainerList, err := du.RawContainerList(context.TODO(), dockerclient.ContainerListOptions{All: true, Size: collectContainerSize})
 	if err != nil {
 		sender.ServiceCheck(DockerServiceUp, servicecheck.ServiceCheckCritical, "", nil, err.Error())
 		_ = d.Warnf("Error collecting containers: %s", err)
@@ -207,7 +208,7 @@ func (d *DockerCheck) runDockerCustom(sender sender.Sender, du docker.Client, ra
 	}
 
 	for _, rawContainer := range rawContainerList {
-		if rawContainer.State == string(workloadmeta.ContainerStatusRunning) {
+		if string(rawContainer.State) == string(workloadmeta.ContainerStatusRunning) {
 			containersRunning++
 		} else {
 			containersStopped++
@@ -238,7 +239,7 @@ func (d *DockerCheck) runDockerCustom(sender sender.Sender, du docker.Client, ra
 		}
 
 		isContainerExcluded := d.containerFilter.IsExcluded(filterableContainer)
-		isContainerRunning := rawContainer.State == string(workloadmeta.ContainerStatusRunning)
+		isContainerRunning := string(rawContainer.State) == string(workloadmeta.ContainerStatusRunning)
 		taggerEntityID := types.NewEntityID(types.ContainerID, rawContainer.ID)
 		tags, err := d.getImageTagsFromContainer(taggerEntityID, resolvedImageName, isContainerExcluded || !isContainerRunning)
 		if err != nil {
@@ -337,8 +338,7 @@ func (d *DockerCheck) collectImageMetrics(sender sender.Sender, du docker.Client
 				continue
 			}
 
-			//nolint:staticcheck // TODO(CINT) Fix staticcheck linter
-			sender.Gauge("docker.image.virtual_size", float64(image.VirtualSize), "", imageTags)
+			sender.Gauge("docker.image.virtual_size", float64(image.Size), "", imageTags)
 			sender.Gauge("docker.image.size", float64(image.Size), "", imageTags)
 		}
 	}

pkg/collector/corechecks/containers/docker/check_linux_test.go

@@ -8,10 +8,11 @@
 package docker
 
 import (
+	"net/netip"
 	"testing"
 
-	"github.com/docker/docker/api/types/container"
-	dockerNetworkTypes "github.com/docker/docker/api/types/network"
+	"github.com/moby/moby/api/types/container"
+	dockerNetworkTypes "github.com/moby/moby/api/types/network"
 
 	nooptagger "github.com/DataDog/datadog-agent/comp/core/tagger/impl-noop"
 	workloadmeta "github.com/DataDog/datadog-agent/comp/core/workloadmeta/def"
@@ -138,7 +139,7 @@ func TestDockerNetworkExtension(t *testing.T) {
 	})
 	container1RawDocker := container.Summary{
 		ID:    "kube-host-network",
-		State: string(workloadmeta.ContainerStatusRunning),
+		State: container.ContainerState(workloadmeta.ContainerStatusRunning),
 		HostConfig: struct {
 			NetworkMode string            `json:",omitempty"`
 			Annotations map[string]string `json:",omitempty"`
@@ -169,7 +170,7 @@ func TestDockerNetworkExtension(t *testing.T) {
 	})
 	container2RawDocker := container.Summary{
 		ID:    "kube-app",
-		State: string(workloadmeta.ContainerStatusRunning),
+		State: container.ContainerState(workloadmeta.ContainerStatusRunning),
 		HostConfig: struct {
 			NetworkMode string            `json:",omitempty"`
 			Annotations map[string]string `json:",omitempty"`
@@ -182,7 +183,7 @@ func TestDockerNetworkExtension(t *testing.T) {
 	// Container3 is only raw as it's excluded (pause container)
 	container3RawDocker := container.Summary{
 		ID:    "kube-app-pause",
-		State: string(workloadmeta.ContainerStatusRunning),
+		State: container.ContainerState(workloadmeta.ContainerStatusRunning),
 		HostConfig: struct {
 			NetworkMode string            `json:",omitempty"`
 			Annotations map[string]string `json:",omitempty"`
@@ -219,18 +220,18 @@ func TestDockerNetworkExtension(t *testing.T) {
 	})
 	container4RawDocker := container.Summary{
 		ID:    "docker-app",
-		State: string(workloadmeta.ContainerStatusRunning),
+		State: container.ContainerState(workloadmeta.ContainerStatusRunning),
 		HostConfig: struct {
 			NetworkMode string            `json:",omitempty"`
 			Annotations map[string]string `json:",omitempty"`
 		}{NetworkMode: "ubuntu_default"},
 		NetworkSettings: &container.NetworkSettingsSummary{
 			Networks: map[string]*dockerNetworkTypes.EndpointSettings{
 				"ubuntu_default": {
-					IPAddress: "172.18.0.2",
+					IPAddress: netip.MustParseAddr("172.18.0.2"),
 				},
 				"bridge": {
-					IPAddress: "172.17.0.2",
+					IPAddress: netip.MustParseAddr("172.17.0.2"),
 				},
 			},
 		},
@@ -293,7 +294,7 @@ func TestNetworkCustomOnFailure(t *testing.T) {
 		Labels: map[string]string{
 			"io.kubernetes.pod.namespace": "kubens",
 		},
-		State:      string(workloadmeta.ContainerStatusRunning),
+		State:      container.ContainerState(workloadmeta.ContainerStatusRunning),
 		SizeRw:     100,
 		SizeRootFs: 200,
 	})