Remove docker/docker as a dependency#2298
Conversation
moby/go-archive is the standalone archive module extracted from docker/docker; use it directly rather than going through docker/docker's re-export shim.
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: rh-roman The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
WalkthroughThis PR updates archive extraction to use moby archive and user mapping packages with local xattr and timestamp helpers, switches release and image extraction decompression call sites, and migrates docker credential handling to Podman auth config types. ChangesArchive extraction and platform helper migration
Estimated code review effort: 4 (Complex) | ~55 minutes Sequence Diagram(s)sequenceDiagram
participant ReleaseCommand
participant ExtractCommand
participant ArchivePackage
participant Filesystem
participant CredentialsFactory
ReleaseCommand->>ArchivePackage: DecompressStream(r)
ExtractCommand->>ArchivePackage: DecompressStream
ArchivePackage->>Filesystem: os.MkdirAll / lsetxattr / chtimes / lutimesNano
CredentialsFactory->>CredentialsFactory: build DockerAuthConfig
🚥 Pre-merge checks | ✅ 5 | ❌ 10❌ Failed checks (10 inconclusive)
✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
pkg/pools, pkg/system, and pkg/idtools have no stable API outside docker/docker. Replace with stdlib (bufio sync.Pool, os.MkdirAll/Chtimes), direct unix syscalls (lgetxattr/lsetxattr/UtimesNanoAt), and moby/sys/user for identity mapping. Replace api/types/registry.AuthConfig with the podman-equivalent DockerAuthConfig already used elsewhere in this package.
v1.13.2 drops docker/docker in favour of moby/moby, removing the last transitive dependency on github.com/docker/docker.
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
pkg/cli/image/manifest/dockercredentials/credential_store_factory.go (1)
37-46: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueSimplify the credential copy.
findAuthenticationreturnscontainertypes.DockerAuthConfig, so this field-by-field literal is redundant; pass&authCfgdirectly toNewDynamicCredentialStoreinstead.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/cli/image/manifest/dockercredentials/credential_store_factory.go` around lines 37 - 46, The credential creation in CredentialStoreFactory is doing a redundant field-by-field copy after findAuthentication already returns a containertypes.DockerAuthConfig. Update the return in CredentialStoreFactory to pass the authCfg value directly into NewDynamicCredentialStore, keeping the existing error handling and the nocreds fallback unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pkg/cli/image/archive/archive.go`:
- Around line 81-89: The RemapIDs type currently cannot be safely created
outside its package because mappings is unexported, and Alter will panic if
mappings is nil. Add a constructor or exported setter for RemapIDs so callers
can provide the moby_user.IdentityMapping, and update Alter to guard against a
nil mappings value before calling ToHost. Use the RemapIDs and Alter symbols to
locate and fix the construction and nil-handling path.
---
Nitpick comments:
In `@pkg/cli/image/manifest/dockercredentials/credential_store_factory.go`:
- Around line 37-46: The credential creation in CredentialStoreFactory is doing
a redundant field-by-field copy after findAuthentication already returns a
containertypes.DockerAuthConfig. Update the return in CredentialStoreFactory to
pass the authCfg value directly into NewDynamicCredentialStore, keeping the
existing error handling and the nocreds fallback unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 753fb51d-28d5-48e2-8898-8789271e9a99
⛔ Files ignored due to path filters (139)
go.sumis excluded by!**/*.sumvendor/github.com/docker/docker/AUTHORSis excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/NOTICEis excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/blkiodev/blkio.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/common/id_response.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/container/change_type.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/container/change_types.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/container/commit.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/container/config.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/container/container.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/container/create_request.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/container/create_response.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/container/disk_usage.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/container/errors.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/container/exec.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/container/filesystem_change.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/container/health.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/container/hostconfig.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/container/hostconfig_unix.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/container/hostconfig_windows.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/container/network_settings.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/container/options.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/container/port.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/container/state.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/container/stats.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/container/top_response.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/container/update_response.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/container/wait_exit_error.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/container/wait_response.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/container/waitcondition.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/filters/errors.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/filters/filters_deprecated.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/filters/parse.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/mount/mount.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/network/create_response.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/network/endpoint.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/network/ipam.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/network/network.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/registry/authconfig.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/registry/authenticate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/registry/registry.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/storage/driver_data.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/strslice/strslice.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/swarm/common.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/swarm/config.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/swarm/container.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/swarm/network.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/swarm/node.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/swarm/runtime.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/swarm/runtime/runtime.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/swarm/secret.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/swarm/service.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/swarm/service_create_response.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/swarm/service_update_response.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/swarm/swarm.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/swarm/task.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/api/types/versions/compare.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/archive/archive_deprecated.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/archive/changes_deprecated.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/archive/copy_deprecated.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/archive/diff_deprecated.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/archive/path_deprecated.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/archive/utils.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/archive/whiteouts_deprecated.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/archive/wrap_deprecated.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/homedir/homedir.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/homedir/homedir_linux.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/homedir/homedir_others.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/idtools/idtools.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/idtools/idtools_windows.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/ioutils/fswriters_deprecated.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/ioutils/readers.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/ioutils/writeflusher.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/ioutils/writers.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/jsonmessage/jsonmessage.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/pools/pools.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/system/args_windows.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/system/chtimes.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/system/chtimes_nowindows.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/system/chtimes_windows.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/system/errors.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/system/filesys.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/system/filesys_unix.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/system/filesys_windows.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/system/init_windows.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/system/utimes_unix.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/system/utimes_unsupported.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/system/xattrs.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/system/xattrs_linux.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/docker/pkg/system/xattrs_unsupported.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/go-connections/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/go-connections/nat/nat.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/go-connections/nat/parse.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/docker/go-connections/nat/sort.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fsouza/go-dockerclient/.golangci.yamlis excluded by!vendor/**,!**/vendor/**vendor/github.com/fsouza/go-dockerclient/client.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fsouza/go-dockerclient/container.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fsouza/go-dockerclient/container_stats.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fsouza/go-dockerclient/container_update.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fsouza/go-dockerclient/distribution.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fsouza/go-dockerclient/event.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fsouza/go-dockerclient/exec.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fsouza/go-dockerclient/image.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fsouza/go-dockerclient/misc.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fsouza/go-dockerclient/network.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fsouza/go-dockerclient/plugin.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fsouza/go-dockerclient/swarm.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fsouza/go-dockerclient/swarm_configs.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fsouza/go-dockerclient/swarm_node.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fsouza/go-dockerclient/swarm_secrets.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fsouza/go-dockerclient/swarm_service.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fsouza/go-dockerclient/swarm_task.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fsouza/go-dockerclient/tar.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fsouza/go-dockerclient/volume.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/moby/docker-image-spec/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/github.com/moby/docker-image-spec/specs-go/v1/image.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/moby/go-archive/archive.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/moby/go-archive/xattr_supported_unix.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/moby/moby/api/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/github.com/moby/moby/api/pkg/stdcopy/stdcopy.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/moby/moby/api/types/jsonstream/json_error.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/moby/moby/api/types/jsonstream/message.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/moby/moby/api/types/jsonstream/progress.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/moby/moby/api/types/registry/auth_response.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/moby/moby/api/types/registry/authconfig.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/moby/moby/api/types/registry/registry.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/moby/moby/api/types/registry/search.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/moby/moby/client/pkg/jsonmessage/jsonmessage.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/moby/patternmatcher/patternmatcher.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/moby/sys/atomicwriter/atomicwriter.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/morikuni/aec/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/github.com/morikuni/aec/README.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/morikuni/aec/aec.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/morikuni/aec/ansi.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/morikuni/aec/builder.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/morikuni/aec/sample.gifis excluded by!**/*.gif,!vendor/**,!**/vendor/**vendor/github.com/morikuni/aec/sgr.gois excluded by!vendor/**,!**/vendor/**vendor/modules.txtis excluded by!vendor/**,!**/vendor/**
📒 Files selected for processing (7)
go.modpkg/cli/admin/release/new.gopkg/cli/image/archive/archive.gopkg/cli/image/archive/archive_linux.gopkg/cli/image/archive/archive_other.gopkg/cli/image/extract/extract.gopkg/cli/image/manifest/dockercredentials/credential_store_factory.go
|
/retest |
|
/hold |
| "github.com/docker/docker/pkg/system" | ||
| "github.com/moby/go-archive/compression" | ||
| "github.com/moby/sys/sequential" | ||
| moby_user "github.com/moby/sys/user" |
There was a problem hiding this comment.
Hi, I would prefer to have this labeled as mobyuser. I don't think underscores are very often used.
|
@rh-roman: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Per moby/moby#52404
Although
ocdoesn't use a lot of functionality fromdocker/docker, it will get flagged any time CVEs are found in docker (like https://www.cve.org/CVERecord?id=CVE-2026-42306).Updating
octo not depend on docker/docker.Summary by CodeRabbit