vendor: update docker/docker to latest v25.0.0-dev

full diff: 88f4bf4ae4...cf4df9d8ae

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

vendor.mod

@@ -6,14 +6,11 @@ module github.com/docker/cli
 
 go 1.18
 
-// use a replace rule to prevent go mod downgrading (because master gets v24.0.0-rc.2.xxx pseudo-versions)
-replace github.com/docker/docker => github.com/docker/docker v24.0.0-rc.2.0.20230506131059-88f4bf4ae4ba+incompatible
-
 require (
 	github.com/containerd/containerd v1.6.21
 	github.com/creack/pty v1.1.18
 	github.com/docker/distribution v2.8.2+incompatible
-	github.com/docker/docker v24.0.0-rc.2.0.20230506131059-88f4bf4ae4ba+incompatible // replaced; this is master / v25.0.0-dev; see replace rule above.
+	github.com/docker/docker v24.0.0-rc.2.0.20230523155306-cf4df9d8ae4c+incompatible // master (v25.0.0-dev)
 	github.com/docker/docker-credential-helpers v0.7.0
 	github.com/docker/go-connections v0.4.0
 	github.com/docker/go-units v0.5.0

vendor.sum

@@ -96,8 +96,8 @@ github.com/denisenkom/go-mssqldb v0.0.0-20191128021309-1d7a30a10f73/go.mod h1:xb
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.8.2+incompatible h1:T3de5rq0dB1j30rp0sA2rER+m322EBzniBPB6ZIzuh8=
 github.com/docker/distribution v2.8.2+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v24.0.0-rc.2.0.20230506131059-88f4bf4ae4ba+incompatible h1:JH72n+pwNXSy/3lBlzKDQ22RcL+tDqVOU5O6m/dLuho=
+github.com/docker/docker v24.0.0-rc.2.0.20230523155306-cf4df9d8ae4c+incompatible h1:stJU/EC2yJHujjvqyEAHeNxsIXtwuCvvYwImyaJ0wtI=
-github.com/docker/docker v24.0.0-rc.2.0.20230506131059-88f4bf4ae4ba+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v24.0.0-rc.2.0.20230523155306-cf4df9d8ae4c+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.7.0 h1:xtCHsjxogADNZcdv1pKUHXryefjlVRqWqIhk/uXJp0A=
 github.com/docker/docker-credential-helpers v0.7.0/go.mod h1:rETQfLdHNT3foU5kuNkFR1R1V12OJRRO5lzt2D1b5X0=
 github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c h1:lzqkGL9b3znc+ZUgi7FlLnqjQhcXxkNM/quxIjBVMD0=

vendor/github.com/docker/docker/AUTHORS

@@ -173,6 +173,7 @@ Andy Rothfusz <github@developersupport.net>
 Andy Smith <github@anarkystic.com>
 Andy Wilson <wilson.andrew.j+github@gmail.com>
 Andy Zhang <andy.zhangtao@hotmail.com>
+Aneesh Kulkarni <askthefactorcamera@gmail.com>
 Anes Hasicic <anes.hasicic@gmail.com>
 Angel Velazquez <angelcar@amazon.com>
 Anil Belur <askb23@gmail.com>
@@ -262,7 +263,7 @@ Billy Ridgway <wrridgwa@us.ibm.com>
 Bily Zhang <xcoder@tenxcloud.com>
 Bin Liu <liubin0329@gmail.com>
 Bingshen Wang <bingshen.wbs@alibaba-inc.com>
-Bjorn Neergaard <bneergaard@mirantis.com>
+Bjorn Neergaard <bjorn@neersighted.com>
 Blake Geno <blakegeno@gmail.com>
 Boaz Shuster <ripcurld.github@gmail.com>
 bobby abbott <ttobbaybbob@gmail.com>
@@ -433,6 +434,7 @@ Cristian Staretu <cristian.staretu@gmail.com>
 cristiano balducci <cristiano.balducci@gmail.com>
 Cristina Yenyxe Gonzalez Garcia <cristina.yenyxe@gmail.com>
 Cruceru Calin-Cristian <crucerucalincristian@gmail.com>
+cui fliter <imcusg@gmail.com>
 CUI Wei <ghostplant@qq.com>
 cuishuang <imcusg@gmail.com>
 Cuong Manh Le <cuong.manhle.vn@gmail.com>
@@ -602,6 +604,7 @@ Donald Huang <don.hcd@gmail.com>
 Dong Chen <dongluo.chen@docker.com>
 Donghwa Kim <shanytt@gmail.com>
 Donovan Jones <git@gamma.net.nz>
+Dorin Geman <dorin.geman@docker.com>
 Doron Podoleanu <doronp@il.ibm.com>
 Doug Davis <dug@us.ibm.com>
 Doug MacEachern <dougm@vmware.com>
@@ -1225,6 +1228,7 @@ Konstantin Gribov <grossws@gmail.com>
 Konstantin L <sw.double@gmail.com>
 Konstantin Pelykh <kpelykh@zettaset.com>
 Kostadin Plachkov <k.n.plachkov@gmail.com>
+kpcyrd <git@rxv.cc>
 Krasi Georgiev <krasi@vip-consult.solutions>
 Krasimir Georgiev <support@vip-consult.co.uk>
 Kris-Mikael Krister <krismikael@protonmail.com>
@@ -2250,6 +2254,7 @@ Wenxuan Zhao <viz@linux.com>
 Wenyu You <21551128@zju.edu.cn>
 Wenzhi Liang <wenzhi.liang@gmail.com>
 Wes Morgan <cap10morgan@gmail.com>
+Wesley Pettit <wppttt@amazon.com>
 Wewang Xiaorenfine <wang.xiaoren@zte.com.cn>
 Wiktor Kwapisiewicz <wiktor@metacode.biz>
 Will Dietz <w@wdtz.org>
@@ -2381,6 +2386,7 @@ Zuhayr Elahi <zuhayr.elahi@docker.com>
 Zunayed Ali <zunayed@gmail.com>
 Álvaro Lázaro <alvaro.lazaro.g@gmail.com>
 Átila Camurça Alves <camurca.home@gmail.com>
+吴小白 <296015668@qq.com>
 尹吉峰 <jifeng.yin@gmail.com>
 屈骏 <qujun@tiduyun.com>
 徐俊杰 <paco.xu@daocloud.io>

vendor/github.com/docker/docker/api/common_unix.go

@@ -1,5 +1,4 @@
 //go:build !windows
-// +build !windows
 
 package api // import "github.com/docker/docker/api"
 

vendor/github.com/docker/docker/api/swagger.yaml

@@ -1781,13 +1781,7 @@ definitions:
         description: |
           Total size of the image including all layers it is composed of.
 
-          In versions of Docker before v1.10, this field was calculated from
+          Deprecated: this field is omitted in API v1.44, but kept for backward compatibility. Use Size instead.
-          the image itself and all of its parent images. Images are now stored
-          self-contained, and no longer use a parent-chain, making this field
-          an equivalent of the Size field.
-
-          > **Deprecated**: this field is kept for backward compatibility, but
-          > will be removed in API v1.44.
         type: "integer"
         format: "int64"
         example: 1239828
@@ -1925,12 +1919,7 @@ definitions:
         description: |-
           Total size of the image including all layers it is composed of.
 
-          In versions of Docker before v1.10, this field was calculated from
+          Deprecated: this field is omitted in API v1.44, but kept for backward compatibility. Use Size instead.
-          the image itself and all of its parent images. Images are now stored
-          self-contained, and no longer use a parent-chain, making this field
-          an equivalent of the Size field.
-
-          Deprecated: this field is kept for backward compatibility, and will be removed in API v1.44.
         type: "integer"
         format: "int64"
         example: 172064416
@@ -6597,7 +6586,7 @@ paths:
                 StopSignal: "SIGTERM"
                 StopTimeout: 10
               Created: "2015-01-06T15:47:31.485331387Z"
-              Driver: "devicemapper"
+              Driver: "overlay2"
               ExecIDs:
                 - "b35395de42bc8abd327f9dd65d913b9ba28c74d2f0734eeeae84fa1c616a0fca"
                 - "3fc1232e5cd20c8de182ed81178503dc6437f4e7ef12b52cc5e8de020652f1c4"
@@ -9066,7 +9055,6 @@ paths:
                   Created: 1466724217
                   Size: 1092588
                   SharedSize: 0
-                  VirtualSize: 1092588
                   Labels: {}
                   Containers: 1
               Containers:

vendor/github.com/docker/docker/api/types/auth.go

@@ -1,7 +0,0 @@
-package types // import "github.com/docker/docker/api/types"
-import "github.com/docker/docker/api/types/registry"
-
-// AuthConfig contains authorization information for connecting to a Registry.
-//
-// Deprecated: use github.com/docker/docker/api/types/registry.AuthConfig
-type AuthConfig = registry.AuthConfig

vendor/github.com/docker/docker/api/types/configs.go

@@ -3,7 +3,7 @@ package types // import "github.com/docker/docker/api/types"
 import (
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/network"
-	specs "github.com/opencontainers/image-spec/specs-go/v1"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 )
 
 // configs holds structs used for internal communication between the
@@ -16,7 +16,7 @@ type ContainerCreateConfig struct {
 	Config           *container.Config
 	HostConfig       *container.HostConfig
 	NetworkingConfig *network.NetworkingConfig
-	Platform         *specs.Platform
+	Platform         *ocispec.Platform
 	AdjustCPUShares  bool
 }
 

vendor/github.com/docker/docker/api/types/container/change_response_deprecated.go

@@ -1,6 +0,0 @@
-package container
-
-// ContainerChangeResponseItem change item in response to ContainerChanges operation
-//
-// Deprecated: use [FilesystemChange].
-type ContainerChangeResponseItem = FilesystemChange

vendor/github.com/docker/docker/api/types/container/hostconfig_unix.go

@@ -1,5 +1,4 @@
 //go:build !windows
-// +build !windows
 
 package container // import "github.com/docker/docker/api/types/container"
 

vendor/github.com/docker/docker/api/types/image/opts.go

@@ -1,9 +1,9 @@
 package image
 
-import specs "github.com/opencontainers/image-spec/specs-go/v1"
+import ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 
 // GetImageOpts holds parameters to inspect an image.
 type GetImageOpts struct {
-	Platform *specs.Platform
+	Platform *ocispec.Platform
 	Details  bool
 }

vendor/github.com/docker/docker/api/types/image_summary.go

@@ -84,11 +84,6 @@ type ImageSummary struct {
 
 	// Total size of the image including all layers it is composed of.
 	//
-	// In versions of Docker before v1.10, this field was calculated from
+	// Deprecated: this field is omitted in API v1.44, but kept for backward compatibility. Use Size instead.
-	// the image itself and all of its parent images. Images are now stored
-	// self-contained, and no longer use a parent-chain, making this field
-	// an equivalent of the Size field.
-	//
-	// Deprecated: this field is kept for backward compatibility, and will be removed in API v1.44.
 	VirtualSize int64 `json:"VirtualSize,omitempty"`
 }

vendor/github.com/docker/docker/api/types/registry/registry.go

@@ -4,7 +4,7 @@ import (
 	"encoding/json"
 	"net"
 
-	v1 "github.com/opencontainers/image-spec/specs-go/v1"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 )
 
 // ServiceConfig stores daemon registry services configuration.
@@ -113,8 +113,8 @@ type SearchResults struct {
 type DistributionInspect struct {
 	// Descriptor contains information about the manifest, including
 	// the content addressable digest
-	Descriptor v1.Descriptor
+	Descriptor ocispec.Descriptor
 	// Platforms contains the list of platforms supported by the image,
 	// obtained by parsing the manifest
-	Platforms []v1.Platform
+	Platforms []ocispec.Platform
 }

vendor/github.com/docker/docker/api/types/types.go

@@ -118,12 +118,7 @@ type ImageInspect struct {
 	// VirtualSize is the total size of the image including all layers it is
 	// composed of.
 	//
-	// In versions of Docker before v1.10, this field was calculated from
+	// Deprecated: this field is omitted in API v1.44, but kept for backward compatibility. Use Size instead.
-	// the image itself and all of its parent images. Docker v1.10 and up
-	// store images self-contained, and no longer use a parent-chain, making
-	// this field an equivalent of the Size field.
-	//
-	// Deprecated: Unused in API 1.43 and up, but kept for backward compatibility with older API versions.
 	VirtualSize int64 `json:"VirtualSize,omitempty"`
 
 	// GraphDriver holds information about the storage driver used to store the

vendor/github.com/docker/docker/client/client_unix.go

@@ -1,5 +1,4 @@
 //go:build !windows
-// +build !windows
 
 package client // import "github.com/docker/docker/client"
 

vendor/github.com/docker/docker/client/container_create.go

@@ -9,7 +9,7 @@ import (
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/api/types/versions"
-	specs "github.com/opencontainers/image-spec/specs-go/v1"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 )
 
 type configWrapper struct {
@@ -20,7 +20,7 @@ type configWrapper struct {
 
 // ContainerCreate creates a new container based on the given configuration.
 // It can be associated with a name, but it's not mandatory.
-func (cli *Client) ContainerCreate(ctx context.Context, config *container.Config, hostConfig *container.HostConfig, networkingConfig *network.NetworkingConfig, platform *specs.Platform, containerName string) (container.CreateResponse, error) {
+func (cli *Client) ContainerCreate(ctx context.Context, config *container.Config, hostConfig *container.HostConfig, networkingConfig *network.NetworkingConfig, platform *ocispec.Platform, containerName string) (container.CreateResponse, error) {
 	var response container.CreateResponse
 
 	if err := cli.NewVersionError("1.25", "stop timeout"); config != nil && config.StopTimeout != nil && err != nil {
@@ -75,7 +75,7 @@ func (cli *Client) ContainerCreate(ctx context.Context, config *container.Config
 // Similar to containerd's platforms.Format(), but does allow components to be
 // omitted (e.g. pass "architecture" only, without "os":
 // https://github.com/containerd/containerd/blob/v1.5.2/platforms/platforms.go#L243-L263
-func formatPlatform(platform *specs.Platform) string {
+func formatPlatform(platform *ocispec.Platform) string {
 	if platform == nil {
 		return ""
 	}

vendor/github.com/docker/docker/client/errors.go

@@ -31,20 +31,10 @@ func ErrorConnectionFailed(host string) error {
 	return errConnectionFailed{host: host}
 }
 
-// Deprecated: use the errdefs.NotFound() interface instead. Kept for backward compatibility
-type notFound interface {
-	error
-	NotFound() bool
-}
-
 // IsErrNotFound returns true if the error is a NotFound error, which is returned
-// by the API when some object is not found.
+// by the API when some object is not found. It is an alias for [errdefs.IsNotFound].
 func IsErrNotFound(err error) bool {
-	if errdefs.IsNotFound(err) {
+	return errdefs.IsNotFound(err)
-		return true
-	}
-	var e notFound
-	return errors.As(err, &e)
 }
 
 type objectNotFoundError struct {

vendor/github.com/docker/docker/client/interface.go

@@ -15,7 +15,7 @@ import (
 	"github.com/docker/docker/api/types/registry"
 	"github.com/docker/docker/api/types/swarm"
 	"github.com/docker/docker/api/types/volume"
-	specs "github.com/opencontainers/image-spec/specs-go/v1"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 )
 
 // CommonAPIClient is the common methods between stable and experimental versions of APIClient.
@@ -47,7 +47,7 @@ type CommonAPIClient interface {
 type ContainerAPIClient interface {
 	ContainerAttach(ctx context.Context, container string, options types.ContainerAttachOptions) (types.HijackedResponse, error)
 	ContainerCommit(ctx context.Context, container string, options types.ContainerCommitOptions) (types.IDResponse, error)
-	ContainerCreate(ctx context.Context, config *container.Config, hostConfig *container.HostConfig, networkingConfig *network.NetworkingConfig, platform *specs.Platform, containerName string) (container.CreateResponse, error)
+	ContainerCreate(ctx context.Context, config *container.Config, hostConfig *container.HostConfig, networkingConfig *network.NetworkingConfig, platform *ocispec.Platform, containerName string) (container.CreateResponse, error)
 	ContainerDiff(ctx context.Context, container string) ([]container.FilesystemChange, error)
 	ContainerExecAttach(ctx context.Context, execID string, config types.ExecStartCheck) (types.HijackedResponse, error)
 	ContainerExecCreate(ctx context.Context, container string, config types.ExecConfig) (types.IDResponse, error)

vendor/github.com/docker/docker/client/request.go

@@ -10,6 +10,7 @@ import (
 	"net/http"
 	"net/url"
 	"os"
+	"reflect"
 	"strings"
 
 	"github.com/docker/docker/api/types"
@@ -54,11 +55,17 @@ func (cli *Client) put(ctx context.Context, path string, query url.Values, obj i
 	if err != nil {
 		return serverResponse{}, err
 	}
-	return cli.sendRequest(ctx, http.MethodPut, path, query, body, headers)
+	return cli.putRaw(ctx, path, query, body, headers)
 }
 
 // putRaw sends an http request to the docker API using the method PUT.
 func (cli *Client) putRaw(ctx context.Context, path string, query url.Values, body io.Reader, headers map[string][]string) (serverResponse, error) {
+	// PUT requests are expected to always have a body (apparently)
+	// so explicitly pass an empty body to sendRequest to signal that
+	// it should set the Content-Type header if not already present.
+	if body == nil {
+		body = http.NoBody
+	}
 	return cli.sendRequest(ctx, http.MethodPut, path, query, body, headers)
 }
 
@@ -73,6 +80,12 @@ func encodeBody(obj interface{}, headers headers) (io.Reader, headers, error) {
 	if obj == nil {
 		return nil, headers, nil
 	}
+	// encoding/json encodes a nil pointer as the JSON document `null`,
+	// irrespective of whether the type implements json.Marshaler or encoding.TextMarshaler.
+	// That is almost certainly not what the caller intended as the request body.
+	if reflect.TypeOf(obj).Kind() == reflect.Ptr && reflect.ValueOf(obj).IsNil() {
+		return nil, headers, nil
+	}
 
 	body, err := encodeData(obj)
 	if err != nil {
@@ -86,11 +99,6 @@ func encodeBody(obj interface{}, headers headers) (io.Reader, headers, error) {
 }
 
 func (cli *Client) buildRequest(method, path string, body io.Reader, headers headers) (*http.Request, error) {
-	expectedPayload := (method == http.MethodPost || method == http.MethodPut)
-	if expectedPayload && body == nil {
-		body = bytes.NewReader([]byte{})
-	}
-
 	req, err := http.NewRequest(method, path, body)
 	if err != nil {
 		return nil, err
@@ -106,7 +114,7 @@ func (cli *Client) buildRequest(method, path string, body io.Reader, headers hea
 	req.URL.Host = cli.addr
 	req.URL.Scheme = cli.scheme
 
-	if expectedPayload && req.Header.Get("Content-Type") == "" {
+	if body != nil && req.Header.Get("Content-Type") == "" {
 		req.Header.Set("Content-Type", "text/plain")
 	}
 	return req, nil

vendor/github.com/docker/docker/pkg/archive/archive.go

@@ -70,6 +70,12 @@ type (
 		// replaced with the matching name from this map.
 		RebaseNames map[string]string
 		InUserNS    bool
+		// Allow unpacking to succeed in spite of failures to set extended
+		// attributes on the unpacked files due to the destination filesystem
+		// not supporting them or a lack of permissions. Extended attributes
+		// were probably in the archive for a reason, so set this option at
+		// your own peril.
+		BestEffortXattrs bool
 	}
 )
 
@@ -666,7 +672,19 @@ func (ta *tarAppender) addTarFile(path, name string) error {
 	return nil
 }
 
-func createTarFile(path, extractDir string, hdr *tar.Header, reader io.Reader, Lchown bool, chownOpts *idtools.Identity, inUserns bool) error {
+func createTarFile(path, extractDir string, hdr *tar.Header, reader io.Reader, opts *TarOptions) error {
+	var (
+		Lchown                     = true
+		inUserns, bestEffortXattrs bool
+		chownOpts                  *idtools.Identity
+	)
+	if opts != nil {
+		Lchown = !opts.NoLchown
+		inUserns = opts.InUserNS
+		chownOpts = opts.ChownOpts
+		bestEffortXattrs = opts.BestEffortXattrs
+	}
+
 	// hdr.Mode is in linux format, which we can use for sycalls,
 	// but for os.Foo() calls we need the mode converted to os.FileMode,
 	// so use hdrInfo.Mode() (they differ for e.g. setuid bits)
@@ -757,26 +775,22 @@ func createTarFile(path, extractDir string, hdr *tar.Header, reader io.Reader, L
 		}
 	}
 
-	var errors []string
+	var xattrErrs []string
 	for key, value := range hdr.Xattrs {
 		if err := system.Lsetxattr(path, key, []byte(value), 0); err != nil {
-			if err == syscall.ENOTSUP || err == syscall.EPERM {
+			if bestEffortXattrs && errors.Is(err, syscall.ENOTSUP) || errors.Is(err, syscall.EPERM) {
-				// We ignore errors here because not all graphdrivers support
-				// xattrs *cough* old versions of AUFS *cough*. However only
-				// ENOTSUP should be emitted in that case, otherwise we still
-				// bail.
 				// EPERM occurs if modifying xattrs is not allowed. This can
 				// happen when running in userns with restrictions (ChromeOS).
-				errors = append(errors, err.Error())
+				xattrErrs = append(xattrErrs, err.Error())
 				continue
 			}
 			return err
 		}
 	}
 
-	if len(errors) > 0 {
+	if len(xattrErrs) > 0 {
 		logrus.WithFields(logrus.Fields{
-			"errors": errors,
+			"errors": xattrErrs,
 		}).Warn("ignored xattrs in archive: underlying filesystem doesn't support them")
 	}
 
@@ -1158,7 +1172,7 @@ loop:
 			}
 		}
 
-		if err := createTarFile(path, dest, hdr, trBuf, !options.NoLchown, options.ChownOpts, options.InUserNS); err != nil {
+		if err := createTarFile(path, dest, hdr, trBuf, options); err != nil {
 			return err
 		}
 

vendor/github.com/docker/docker/pkg/archive/archive_other.go

@@ -1,5 +1,4 @@
 //go:build !linux
-// +build !linux
 
 package archive // import "github.com/docker/docker/pkg/archive"
 

vendor/github.com/docker/docker/pkg/archive/archive_unix.go

@@ -1,5 +1,4 @@
 //go:build !windows
-// +build !windows
 
 package archive // import "github.com/docker/docker/pkg/archive"
 

vendor/github.com/docker/docker/pkg/archive/changes_other.go

@@ -1,5 +1,4 @@
 //go:build !linux
-// +build !linux
 
 package archive // import "github.com/docker/docker/pkg/archive"
 

vendor/github.com/docker/docker/pkg/archive/changes_unix.go

@@ -1,5 +1,4 @@
 //go:build !windows
-// +build !windows
 
 package archive // import "github.com/docker/docker/pkg/archive"
 

vendor/github.com/docker/docker/pkg/archive/copy_unix.go

@@ -1,5 +1,4 @@
 //go:build !windows
-// +build !windows
 
 package archive // import "github.com/docker/docker/pkg/archive"
 

vendor/github.com/docker/docker/pkg/archive/diff.go

@@ -92,7 +92,7 @@ func UnpackLayer(dest string, layer io.Reader, options *TarOptions) (size int64,
 					}
 					defer os.RemoveAll(aufsTempdir)
 				}
-				if err := createTarFile(filepath.Join(aufsTempdir, basename), dest, hdr, tr, true, nil, options.InUserNS); err != nil {
+				if err := createTarFile(filepath.Join(aufsTempdir, basename), dest, hdr, tr, options); err != nil {
 					return 0, err
 				}
 			}
@@ -183,7 +183,7 @@ func UnpackLayer(dest string, layer io.Reader, options *TarOptions) (size int64,
 				return 0, err
 			}
 
-			if err := createTarFile(path, dest, srcHdr, srcData, !options.NoLchown, nil, options.InUserNS); err != nil {
+			if err := createTarFile(path, dest, srcHdr, srcData, options); err != nil {
 				return 0, err
 			}
 

vendor/github.com/docker/docker/pkg/archive/diff_unix.go

@@ -1,5 +1,4 @@
 //go:build !windows
-// +build !windows
 
 package archive
 

vendor/github.com/docker/docker/pkg/archive/path_unix.go

@@ -1,5 +1,4 @@
 //go:build !windows
-// +build !windows
 
 package archive
 

vendor/github.com/docker/docker/pkg/archive/time_unsupported.go

@@ -1,5 +1,4 @@
 //go:build !linux
-// +build !linux
 
 package archive // import "github.com/docker/docker/pkg/archive"
 

vendor/github.com/docker/docker/pkg/homedir/homedir_others.go

@@ -1,5 +1,4 @@
 //go:build !linux
-// +build !linux
 
 package homedir // import "github.com/docker/docker/pkg/homedir"
 

vendor/github.com/docker/docker/pkg/homedir/homedir_unix.go

@@ -1,5 +1,4 @@
 //go:build !windows
-// +build !windows
 
 package homedir // import "github.com/docker/docker/pkg/homedir"
 

vendor/github.com/docker/docker/pkg/idtools/idtools_unix.go

@@ -1,5 +1,4 @@
 //go:build !windows
-// +build !windows
 
 package idtools // import "github.com/docker/docker/pkg/idtools"
 

vendor/github.com/docker/docker/pkg/idtools/usergroupadd_unsupported.go

@@ -1,5 +1,4 @@
 //go:build !linux
-// +build !linux
 
 package idtools // import "github.com/docker/docker/pkg/idtools"
 

vendor/github.com/docker/docker/pkg/idtools/utils_unix.go

@@ -1,5 +1,4 @@
 //go:build !windows
-// +build !windows
 
 package idtools // import "github.com/docker/docker/pkg/idtools"
 

vendor/github.com/docker/docker/pkg/ioutils/tempdir_deprecated.go

@@ -1,10 +0,0 @@
-package ioutils
-
-import "github.com/docker/docker/pkg/longpath"
-
-// TempDir is the equivalent of [os.MkdirTemp], except that on Windows
-// the result is in Windows longpath format. On Unix systems it is
-// equivalent to [os.MkdirTemp].
-//
-// Deprecated: use [longpath.MkdirTemp].
-var TempDir = longpath.MkdirTemp

vendor/github.com/docker/docker/pkg/meminfo/meminfo.go

@@ -1,26 +0,0 @@
-// Package meminfo provides utilites to retrieve memory statistics of
-// the host system.
-package meminfo
-
-// Read retrieves memory statistics of the host system and returns a
-// Memory type. It is only supported on Linux and Windows, and returns an
-// error on other platforms.
-func Read() (*Memory, error) {
-	return readMemInfo()
-}
-
-// Memory contains memory statistics of the host system.
-type Memory struct {
-	// Total usable RAM (i.e. physical RAM minus a few reserved bits and the
-	// kernel binary code).
-	MemTotal int64
-
-	// Amount of free memory.
-	MemFree int64
-
-	// Total amount of swap space available.
-	SwapTotal int64
-
-	// Amount of swap space that is currently unused.
-	SwapFree int64
-}

vendor/github.com/docker/docker/pkg/meminfo/meminfo_linux.go

@@ -1,69 +0,0 @@
-package meminfo
-
-import (
-	"bufio"
-	"io"
-	"os"
-	"strconv"
-	"strings"
-)
-
-// readMemInfo retrieves memory statistics of the host system and returns a
-// Memory type.
-func readMemInfo() (*Memory, error) {
-	file, err := os.Open("/proc/meminfo")
-	if err != nil {
-		return nil, err
-	}
-	defer file.Close()
-	return parseMemInfo(file)
-}
-
-// parseMemInfo parses the /proc/meminfo file into
-// a Memory object given an io.Reader to the file.
-// Throws error if there are problems reading from the file
-func parseMemInfo(reader io.Reader) (*Memory, error) {
-	meminfo := &Memory{}
-	scanner := bufio.NewScanner(reader)
-	memAvailable := int64(-1)
-	for scanner.Scan() {
-		// Expected format: ["MemTotal:", "1234", "kB"]
-		parts := strings.Fields(scanner.Text())
-
-		// Sanity checks: Skip malformed entries.
-		if len(parts) < 3 || parts[2] != "kB" {
-			continue
-		}
-
-		// Convert to bytes.
-		size, err := strconv.Atoi(parts[1])
-		if err != nil {
-			continue
-		}
-		// Convert to KiB
-		bytes := int64(size) * 1024
-
-		switch parts[0] {
-		case "MemTotal:":
-			meminfo.MemTotal = bytes
-		case "MemFree:":
-			meminfo.MemFree = bytes
-		case "MemAvailable:":
-			memAvailable = bytes
-		case "SwapTotal:":
-			meminfo.SwapTotal = bytes
-		case "SwapFree:":
-			meminfo.SwapFree = bytes
-		}
-	}
-	if memAvailable != -1 {
-		meminfo.MemFree = memAvailable
-	}
-
-	// Handle errors that may have occurred during the reading of the file.
-	if err := scanner.Err(); err != nil {
-		return nil, err
-	}
-
-	return meminfo, nil
-}

vendor/github.com/docker/docker/pkg/meminfo/meminfo_unsupported.go

@@ -1,11 +0,0 @@
-//go:build !linux && !windows
-// +build !linux,!windows
-
-package meminfo
-
-import "errors"
-
-// readMemInfo is not supported on platforms other than linux and windows.
-func readMemInfo() (*Memory, error) {
-	return nil, errors.New("platform and architecture is not supported")
-}

vendor/github.com/docker/docker/pkg/meminfo/meminfo_windows.go

@@ -1,45 +0,0 @@
-package meminfo
-
-import (
-	"unsafe"
-
-	"golang.org/x/sys/windows"
-)
-
-var (
-	modkernel32 = windows.NewLazySystemDLL("kernel32.dll")
-
-	procGlobalMemoryStatusEx = modkernel32.NewProc("GlobalMemoryStatusEx")
-)
-
-// https://msdn.microsoft.com/en-us/library/windows/desktop/aa366589(v=vs.85).aspx
-// https://msdn.microsoft.com/en-us/library/windows/desktop/aa366770(v=vs.85).aspx
-type memorystatusex struct {
-	dwLength                uint32
-	dwMemoryLoad            uint32
-	ullTotalPhys            uint64
-	ullAvailPhys            uint64
-	ullTotalPageFile        uint64
-	ullAvailPageFile        uint64
-	ullTotalVirtual         uint64
-	ullAvailVirtual         uint64
-	ullAvailExtendedVirtual uint64
-}
-
-// readMemInfo retrieves memory statistics of the host system and returns a
-// Memory type.
-func readMemInfo() (*Memory, error) {
-	msi := &memorystatusex{
-		dwLength: 64,
-	}
-	r1, _, _ := procGlobalMemoryStatusEx.Call(uintptr(unsafe.Pointer(msi)))
-	if r1 == 0 {
-		return &Memory{}, nil
-	}
-	return &Memory{
-		MemTotal:  int64(msi.ullTotalPhys),
-		MemFree:   int64(msi.ullAvailPhys),
-		SwapTotal: int64(msi.ullTotalPageFile),
-		SwapFree:  int64(msi.ullAvailPageFile),
-	}, nil
-}

vendor/github.com/docker/docker/pkg/process/doc.go

@@ -1,3 +0,0 @@
-// Package process provides a set of basic functions to manage individual
-// processes.
-package process

vendor/github.com/docker/docker/pkg/process/process_unix.go

@@ -1,82 +0,0 @@
-//go:build !windows
-// +build !windows
-
-package process
-
-import (
-	"bytes"
-	"fmt"
-	"os"
-	"path/filepath"
-	"runtime"
-	"strconv"
-
-	"golang.org/x/sys/unix"
-)
-
-// Alive returns true if process with a given pid is running. It only considers
-// positive PIDs; 0 (all processes in the current process group), -1 (all processes
-// with a PID larger than 1), and negative (-n, all processes in process group
-// "n") values for pid are never considered to be alive.
-func Alive(pid int) bool {
-	if pid < 1 {
-		return false
-	}
-	switch runtime.GOOS {
-	case "darwin":
-		// OS X does not have a proc filesystem. Use kill -0 pid to judge if the
-		// process exists. From KILL(2): https://www.freebsd.org/cgi/man.cgi?query=kill&sektion=2&manpath=OpenDarwin+7.2.1
-		//
-		// Sig may be one of the signals specified in sigaction(2) or it may
-		// be 0, in which case error checking is performed but no signal is
-		// actually sent. This can be used to check the validity of pid.
-		err := unix.Kill(pid, 0)
-
-		// Either the PID was found (no error) or we get an EPERM, which means
-		// the PID exists, but we don't have permissions to signal it.
-		return err == nil || err == unix.EPERM
-	default:
-		_, err := os.Stat(filepath.Join("/proc", strconv.Itoa(pid)))
-		return err == nil
-	}
-}
-
-// Kill force-stops a process. It only considers positive PIDs; 0 (all processes
-// in the current process group), -1 (all processes with a PID larger than 1),
-// and negative (-n, all processes in process group "n") values for pid are
-// ignored. Refer to [KILL(2)] for details.
-//
-// [KILL(2)]: https://man7.org/linux/man-pages/man2/kill.2.html
-func Kill(pid int) error {
-	if pid < 1 {
-		return fmt.Errorf("invalid PID (%d): only positive PIDs are allowed", pid)
-	}
-	err := unix.Kill(pid, unix.SIGKILL)
-	if err != nil && err != unix.ESRCH {
-		return err
-	}
-	return nil
-}
-
-// Zombie return true if process has a state with "Z". It only considers positive
-// PIDs; 0 (all processes in the current process group), -1 (all processes with
-// a PID larger than 1), and negative (-n, all processes in process group "n")
-// values for pid are ignored. Refer to [PROC(5)] for details.
-//
-// [PROC(5)]: https://man7.org/linux/man-pages/man5/proc.5.html
-func Zombie(pid int) (bool, error) {
-	if pid < 1 {
-		return false, nil
-	}
-	data, err := os.ReadFile(fmt.Sprintf("/proc/%d/stat", pid))
-	if err != nil {
-		if os.IsNotExist(err) {
-			return false, nil
-		}
-		return false, err
-	}
-	if cols := bytes.SplitN(data, []byte(" "), 4); len(cols) >= 3 && string(cols[2]) == "Z" {
-		return true, nil
-	}
-	return false, nil
-}

vendor/github.com/docker/docker/pkg/process/process_windows.go

@@ -1,52 +0,0 @@
-package process
-
-import (
-	"os"
-
-	"golang.org/x/sys/windows"
-)
-
-// Alive returns true if process with a given pid is running.
-func Alive(pid int) bool {
-	h, err := windows.OpenProcess(windows.PROCESS_QUERY_LIMITED_INFORMATION, false, uint32(pid))
-	if err != nil {
-		return false
-	}
-	var c uint32
-	err = windows.GetExitCodeProcess(h, &c)
-	_ = windows.CloseHandle(h)
-	if err != nil {
-		// From the GetExitCodeProcess function (processthreadsapi.h) API docs:
-		// https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-getexitcodeprocess
-		//
-		// The GetExitCodeProcess function returns a valid error code defined by the
-		// application only after the thread terminates. Therefore, an application should
-		// not use STILL_ACTIVE (259) as an error code (STILL_ACTIVE is a macro for
-		// STATUS_PENDING (minwinbase.h)). If a thread returns STILL_ACTIVE (259) as
-		// an error code, then applications that test for that value could interpret it
-		// to mean that the thread is still running, and continue to test for the
-		// completion of the thread after the thread has terminated, which could put
-		// the application into an infinite loop.
-		return c == uint32(windows.STATUS_PENDING)
-	}
-	return true
-}
-
-// Kill force-stops a process.
-func Kill(pid int) error {
-	p, err := os.FindProcess(pid)
-	if err == nil {
-		err = p.Kill()
-		if err != nil && err != os.ErrProcessDone {
-			return err
-		}
-	}
-	return nil
-}
-
-// Zombie is not supported on Windows.
-//
-// TODO(thaJeztah): remove once we remove the stubs from pkg/system.
-func Zombie(_ int) (bool, error) {
-	return false, nil
-}

vendor/github.com/docker/docker/pkg/system/chtimes_nowindows.go

@@ -1,5 +1,4 @@
 //go:build !windows
-// +build !windows
 
 package system // import "github.com/docker/docker/pkg/system"
 

vendor/github.com/docker/docker/pkg/system/filesys_unix.go

@@ -1,5 +1,4 @@
 //go:build !windows
-// +build !windows
 
 package system // import "github.com/docker/docker/pkg/system"
 

vendor/github.com/docker/docker/pkg/system/lstat_unix.go

@@ -1,5 +1,4 @@
 //go:build !windows
-// +build !windows
 
 package system // import "github.com/docker/docker/pkg/system"
 

vendor/github.com/docker/docker/pkg/system/meminfo_deprecated.go

@@ -1,16 +0,0 @@
-package system
-
-import "github.com/docker/docker/pkg/meminfo"
-
-// MemInfo contains memory statistics of the host system.
-//
-// Deprecated: use [meminfo.Memory].
-type MemInfo = meminfo.Memory
-
-// ReadMemInfo retrieves memory statistics of the host system and returns a
-// MemInfo type.
-//
-// Deprecated: use [meminfo.Read].
-func ReadMemInfo() (*meminfo.Memory, error) {
-	return meminfo.Read()
-}

vendor/github.com/docker/docker/pkg/system/mknod.go

@@ -1,5 +1,4 @@
 //go:build !windows
-// +build !windows
 
 package system // import "github.com/docker/docker/pkg/system"
 

vendor/github.com/docker/docker/pkg/system/mknod_freebsd.go

@@ -1,5 +1,4 @@
 //go:build freebsd
-// +build freebsd
 
 package system // import "github.com/docker/docker/pkg/system"
 

vendor/github.com/docker/docker/pkg/system/mknod_unix.go

@@ -1,5 +1,4 @@
 //go:build !freebsd && !windows
-// +build !freebsd,!windows
 
 package system // import "github.com/docker/docker/pkg/system"
 

vendor/github.com/docker/docker/pkg/system/path_deprecated.go

@@ -1,18 +0,0 @@
-package system
-
-const defaultUnixPathEnv = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
-
-// DefaultPathEnv is unix style list of directories to search for
-// executables. Each directory is separated from the next by a colon
-// ':' character .
-// For Windows containers, an empty string is returned as the default
-// path will be set by the container, and Docker has no context of what the
-// default path should be.
-//
-// Deprecated: use oci.DefaultPathEnv
-func DefaultPathEnv(os string) string {
-	if os == "windows" {
-		return ""
-	}
-	return defaultUnixPathEnv
-}

vendor/github.com/docker/docker/pkg/system/process_deprecated.go

@@ -1,27 +0,0 @@
-//go:build linux || freebsd || darwin || windows
-// +build linux freebsd darwin windows
-
-package system
-
-import "github.com/docker/docker/pkg/process"
-
-var (
-	// IsProcessAlive returns true if process with a given pid is running.
-	//
-	// Deprecated: use [process.Alive].
-	IsProcessAlive = process.Alive
-
-	// IsProcessZombie return true if process has a state with "Z"
-	//
-	// Deprecated: use [process.Zombie].
-	//
-	// TODO(thaJeztah): remove the Windows implementation in process once we remove this stub.
-	IsProcessZombie = process.Zombie
-)
-
-// KillProcess force-stops a process.
-//
-// Deprecated: use [process.Kill].
-func KillProcess(pid int) {
-	_ = process.Kill(pid)
-}

vendor/github.com/docker/docker/pkg/system/stat_bsd.go

@@ -1,5 +1,4 @@
 //go:build freebsd || netbsd
-// +build freebsd netbsd
 
 package system // import "github.com/docker/docker/pkg/system"
 

vendor/github.com/docker/docker/pkg/system/stat_unix.go

@@ -1,5 +1,4 @@
 //go:build !windows
-// +build !windows
 
 package system // import "github.com/docker/docker/pkg/system"
 

vendor/github.com/docker/docker/pkg/system/utimes_unix.go

@@ -1,5 +1,4 @@
 //go:build linux || freebsd
-// +build linux freebsd
 
 package system // import "github.com/docker/docker/pkg/system"
 

vendor/github.com/docker/docker/pkg/system/utimes_unsupported.go

@@ -1,5 +1,4 @@
 //go:build !linux && !freebsd
-// +build !linux,!freebsd
 
 package system // import "github.com/docker/docker/pkg/system"
 

vendor/github.com/docker/docker/pkg/system/xattrs_linux.go

@@ -1,11 +1,19 @@
 package system // import "github.com/docker/docker/pkg/system"
 
-import "golang.org/x/sys/unix"
+import (
+	"io/fs"
+
+	"golang.org/x/sys/unix"
+)
 
 // Lgetxattr retrieves the value of the extended attribute identified by attr
 // and associated with the given path in the file system.
 // It will returns a nil slice and nil error if the xattr is not set.
 func Lgetxattr(path string, attr string) ([]byte, error) {
+	pathErr := func(err error) ([]byte, error) {
+		return nil, &fs.PathError{Op: "lgetxattr", Path: path, Err: err}
+	}
+
 	// Start with a 128 length byte array
 	dest := make([]byte, 128)
 	sz, errno := unix.Lgetxattr(path, attr, dest)
@@ -14,7 +22,7 @@ func Lgetxattr(path string, attr string) ([]byte, error) {
 		// Buffer too small, use zero-sized buffer to get the actual size
 		sz, errno = unix.Lgetxattr(path, attr, []byte{})
 		if errno != nil {
-			return nil, errno
+			return pathErr(errno)
 		}
 		dest = make([]byte, sz)
 		sz, errno = unix.Lgetxattr(path, attr, dest)
@@ -24,7 +32,7 @@ func Lgetxattr(path string, attr string) ([]byte, error) {
 	case errno == unix.ENODATA:
 		return nil, nil
 	case errno != nil:
-		return nil, errno
+		return pathErr(errno)
 	}
 
 	return dest[:sz], nil
@@ -33,5 +41,9 @@ func Lgetxattr(path string, attr string) ([]byte, error) {
 // Lsetxattr sets the value of the extended attribute identified by attr
 // and associated with the given path in the file system.
 func Lsetxattr(path string, attr string, data []byte, flags int) error {
-	return unix.Lsetxattr(path, attr, data, flags)
+	err := unix.Lsetxattr(path, attr, data, flags)
+	if err != nil {
+		return &fs.PathError{Op: "lsetxattr", Path: path, Err: err}
+	}
+	return nil
 }

vendor/github.com/docker/docker/pkg/system/xattrs_unsupported.go

@@ -1,5 +1,4 @@
 //go:build !linux
-// +build !linux
 
 package system // import "github.com/docker/docker/pkg/system"
 

vendor/github.com/docker/docker/registry/config_unix.go

@@ -1,5 +1,4 @@
 //go:build !windows
-// +build !windows
 
 package registry // import "github.com/docker/docker/registry"
 

vendor/modules.txt

@@ -40,7 +40,7 @@ github.com/docker/distribution/registry/client/transport
 github.com/docker/distribution/registry/storage/cache
 github.com/docker/distribution/registry/storage/cache/memory
 github.com/docker/distribution/uuid
-# github.com/docker/docker v24.0.0-rc.2.0.20230506131059-88f4bf4ae4ba+incompatible => github.com/docker/docker v24.0.0-rc.2.0.20230506131059-88f4bf4ae4ba+incompatible
+# github.com/docker/docker v24.0.0-rc.2.0.20230523155306-cf4df9d8ae4c+incompatible
 ## explicit
 github.com/docker/docker/api
 github.com/docker/docker/api/types
@@ -68,9 +68,7 @@ github.com/docker/docker/pkg/idtools
 github.com/docker/docker/pkg/ioutils
 github.com/docker/docker/pkg/jsonmessage
 github.com/docker/docker/pkg/longpath
-github.com/docker/docker/pkg/meminfo
 github.com/docker/docker/pkg/pools
-github.com/docker/docker/pkg/process
 github.com/docker/docker/pkg/progress
 github.com/docker/docker/pkg/stdcopy
 github.com/docker/docker/pkg/streamformatter
@@ -406,4 +404,3 @@ gotest.tools/v3/internal/format
 gotest.tools/v3/internal/source
 gotest.tools/v3/poll
 gotest.tools/v3/skip
-# github.com/docker/docker => github.com/docker/docker v24.0.0-rc.2.0.20230506131059-88f4bf4ae4ba+incompatible