Merge 26ec2674b0 into 2995631498

.github/workflows/codeql.yml

@@ -62,7 +62,7 @@ jobs:
         name: Update Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.23.3
+          go-version: 1.23.2
       -
         name: Initialize CodeQL
         uses: github/codeql-action/init@v3

.github/workflows/test.yml

@@ -68,7 +68,7 @@ jobs:
         name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.23.3
+          go-version: 1.23.2
       -
         name: Test
         run: |

.golangci.yml

@@ -41,9 +41,6 @@ linters:
     - errcheck
 
 run:
-  # prevent golangci-lint from deducting the go version to lint for through go.mod,
-  # which causes it to fallback to go1.17 semantics.
-  go: "1.23.3"
   timeout: 5m
 
 linters-settings:

Dockerfile

@@ -4,12 +4,12 @@ ARG BASE_VARIANT=alpine
 ARG ALPINE_VERSION=3.20
 ARG BASE_DEBIAN_DISTRO=bookworm
 
-ARG GO_VERSION=1.23.3
+ARG GO_VERSION=1.23.2
 ARG XX_VERSION=1.5.0
 ARG GOVERSIONINFO_VERSION=v1.3.0
 ARG GOTESTSUM_VERSION=v1.10.0
-ARG BUILDX_VERSION=0.18.0
-ARG COMPOSE_VERSION=v2.30.3
+ARG BUILDX_VERSION=0.17.1
+ARG COMPOSE_VERSION=v2.29.7
 
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
 

cli-plugins/manager/cobra.go

@@ -52,6 +52,7 @@ func AddPluginCommandStubs(dockerCli command.Cli, rootCmd *cobra.Command) (err e
 			return
 		}
 		for _, p := range plugins {
+			p := p
 			vendor := p.Vendor
 			if vendor == "" {
 				vendor = "unknown"

cli-plugins/manager/error.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package manager
 

cli/command/cli.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package command
 

cli/command/cli_test.go

@@ -187,18 +187,19 @@ func TestInitializeFromClient(t *testing.T) {
 		},
 	}
 
-	for _, tc := range testcases {
-		t.Run(tc.doc, func(t *testing.T) {
+	for _, testcase := range testcases {
+		testcase := testcase
+		t.Run(testcase.doc, func(t *testing.T) {
 			apiclient := &fakeClient{
-				pingFunc: tc.pingFunc,
+				pingFunc: testcase.pingFunc,
 				version:  defaultVersion,
 			}
 
 			cli := &DockerCli{client: apiclient}
 			err := cli.Initialize(flags.NewClientOptions())
 			assert.NilError(t, err)
-			assert.DeepEqual(t, cli.ServerInfo(), tc.expectedServer)
-			assert.Equal(t, apiclient.negotiated, tc.negotiated)
+			assert.DeepEqual(t, cli.ServerInfo(), testcase.expectedServer)
+			assert.Equal(t, apiclient.negotiated, testcase.negotiated)
 		})
 	}
 }
@@ -276,9 +277,10 @@ func TestExperimentalCLI(t *testing.T) {
 		},
 	}
 
-	for _, tc := range testcases {
-		t.Run(tc.doc, func(t *testing.T) {
-			dir := fs.NewDir(t, tc.doc, fs.WithFile("config.json", tc.configfile))
+	for _, testcase := range testcases {
+		testcase := testcase
+		t.Run(testcase.doc, func(t *testing.T) {
+			dir := fs.NewDir(t, testcase.doc, fs.WithFile("config.json", testcase.configfile))
 			defer dir.Remove()
 			apiclient := &fakeClient{
 				version: defaultVersion,

cli/command/completion/functions_test.go

@@ -150,6 +150,7 @@ func TestCompleteContainerNames(t *testing.T) {
 	}
 
 	for _, tc := range tests {
+		tc := tc
 		t.Run(tc.doc, func(t *testing.T) {
 			if tc.showIDs {
 				t.Setenv("DOCKER_COMPLETION_SHOW_CONTAINER_IDS", "yes")
@@ -226,6 +227,7 @@ func TestCompleteImageNames(t *testing.T) {
 	}
 
 	for _, tc := range tests {
+		tc := tc
 		t.Run(tc.doc, func(t *testing.T) {
 			comp := ImageNames(fakeCLI{&fakeClient{
 				imageListFunc: func(options image.ListOptions) ([]image.Summary, error) {
@@ -271,6 +273,7 @@ func TestCompleteNetworkNames(t *testing.T) {
 	}
 
 	for _, tc := range tests {
+		tc := tc
 		t.Run(tc.doc, func(t *testing.T) {
 			comp := NetworkNames(fakeCLI{&fakeClient{
 				networkListFunc: func(ctx context.Context, options network.ListOptions) ([]network.Summary, error) {
@@ -328,6 +331,7 @@ func TestCompleteVolumeNames(t *testing.T) {
 	}
 
 	for _, tc := range tests {
+		tc := tc
 		t.Run(tc.doc, func(t *testing.T) {
 			comp := VolumeNames(fakeCLI{&fakeClient{
 				volumeListFunc: func(filter filters.Args) (volume.ListResponse, error) {

cli/command/config/create_test.go

@@ -43,6 +43,7 @@ func TestConfigCreateErrors(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.expectedError, func(t *testing.T) {
 			cmd := newConfigCreateCommand(
 				test.NewFakeCli(&fakeClient{

cli/command/config/formatter_test.go

@@ -61,6 +61,7 @@ id_rsa
 		},
 	}
 	for _, tc := range cases {
+		tc := tc
 		t.Run(string(tc.context.Format), func(t *testing.T) {
 			var out bytes.Buffer
 			tc.context.Output = &out

cli/command/config/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package config
 

cli/command/container/attach_test.go

@@ -73,6 +73,7 @@ func TestNewAttachCommandErrors(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cmd := NewAttachCommand(test.NewFakeCli(&fakeClient{inspectFunc: tc.containerInspectFunc}))
 			cmd.SetOut(io.Discard)

cli/command/container/completion.go

@@ -1,7 +1,3 @@
-// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
-// +build go1.22
-
 package container
 
 import (
@@ -48,65 +44,6 @@ var allLinuxCapabilities = sync.OnceValue(func() []string {
 	return out
 })
 
-// logDriverOptions provides the options for each built-in logging driver.
-var logDriverOptions = map[string][]string{
-	"awslogs": {
-		"max-buffer-size", "mode", "awslogs-create-group", "awslogs-credentials-endpoint", "awslogs-datetime-format",
-		"awslogs-group", "awslogs-multiline-pattern", "awslogs-region", "awslogs-stream", "tag",
-	},
-	"fluentd": {
-		"max-buffer-size", "mode", "env", "env-regex", "labels", "fluentd-address", "fluentd-async",
-		"fluentd-buffer-limit", "fluentd-request-ack", "fluentd-retry-wait", "fluentd-max-retries",
-		"fluentd-sub-second-precision", "tag",
-	},
-	"gcplogs": {
-		"max-buffer-size", "mode", "env", "env-regex", "labels", "gcp-log-cmd", "gcp-meta-id", "gcp-meta-name",
-		"gcp-meta-zone", "gcp-project",
-	},
-	"gelf": {
-		"max-buffer-size", "mode", "env", "env-regex", "labels", "gelf-address", "gelf-compression-level",
-		"gelf-compression-type", "gelf-tcp-max-reconnect", "gelf-tcp-reconnect-delay", "tag",
-	},
-	"journald":  {"max-buffer-size", "mode", "env", "env-regex", "labels", "tag"},
-	"json-file": {"max-buffer-size", "mode", "env", "env-regex", "labels", "compress", "max-file", "max-size"},
-	"local":     {"max-buffer-size", "mode", "compress", "max-file", "max-size"},
-	"none":      {},
-	"splunk": {
-		"max-buffer-size", "mode", "env", "env-regex", "labels", "splunk-caname", "splunk-capath", "splunk-format",
-		"splunk-gzip", "splunk-gzip-level", "splunk-index", "splunk-insecureskipverify", "splunk-source",
-		"splunk-sourcetype", "splunk-token", "splunk-url", "splunk-verify-connection", "tag",
-	},
-	"syslog": {
-		"max-buffer-size", "mode", "env", "env-regex", "labels", "syslog-address", "syslog-facility", "syslog-format",
-		"syslog-tls-ca-cert", "syslog-tls-cert", "syslog-tls-key", "syslog-tls-skip-verify", "tag",
-	},
-}
-
-// builtInLogDrivers provides a list of the built-in logging drivers.
-var builtInLogDrivers = sync.OnceValue(func() []string {
-	drivers := make([]string, 0, len(logDriverOptions))
-	for driver := range logDriverOptions {
-		drivers = append(drivers, driver)
-	}
-	return drivers
-})
-
-// allLogDriverOptions provides all options of the built-in logging drivers.
-// The list does not contain duplicates.
-var allLogDriverOptions = sync.OnceValue(func() []string {
-	var result []string
-	seen := make(map[string]bool)
-	for driver := range logDriverOptions {
-		for _, opt := range logDriverOptions[driver] {
-			if !seen[opt] {
-				seen[opt] = true
-				result = append(result, opt)
-			}
-		}
-	}
-	return result
-})
-
 // restartPolicies is a list of all valid restart-policies..
 //
 // TODO(thaJeztah): add descriptions, and enable descriptions for our completion scripts (cobra.CompletionOptions.DisableDescriptions is currently set to "true")
@@ -117,207 +54,6 @@ var restartPolicies = []string{
 	string(container.RestartPolicyUnlessStopped),
 }
 
-// addCompletions adds the completions that `run` and `create` have in common.
-func addCompletions(cmd *cobra.Command, dockerCLI completion.APIClientProvider) {
-	_ = cmd.RegisterFlagCompletionFunc("attach", completion.FromList("stderr", "stdin", "stdout"))
-	_ = cmd.RegisterFlagCompletionFunc("cap-add", completeLinuxCapabilityNames)
-	_ = cmd.RegisterFlagCompletionFunc("cap-drop", completeLinuxCapabilityNames)
-	_ = cmd.RegisterFlagCompletionFunc("cgroupns", completeCgroupns())
-	_ = cmd.RegisterFlagCompletionFunc("env", completion.EnvVarNames)
-	_ = cmd.RegisterFlagCompletionFunc("env-file", completion.FileNames)
-	_ = cmd.RegisterFlagCompletionFunc("ipc", completeIpc(dockerCLI))
-	_ = cmd.RegisterFlagCompletionFunc("link", completeLink(dockerCLI))
-	_ = cmd.RegisterFlagCompletionFunc("log-driver", completeLogDriver(dockerCLI))
-	_ = cmd.RegisterFlagCompletionFunc("log-opt", completeLogOpt)
-	_ = cmd.RegisterFlagCompletionFunc("network", completion.NetworkNames(dockerCLI))
-	_ = cmd.RegisterFlagCompletionFunc("pid", completePid(dockerCLI))
-	_ = cmd.RegisterFlagCompletionFunc("platform", completion.Platforms)
-	_ = cmd.RegisterFlagCompletionFunc("pull", completion.FromList(PullImageAlways, PullImageMissing, PullImageNever))
-	_ = cmd.RegisterFlagCompletionFunc("restart", completeRestartPolicies)
-	_ = cmd.RegisterFlagCompletionFunc("security-opt", completeSecurityOpt)
-	_ = cmd.RegisterFlagCompletionFunc("stop-signal", completeSignals)
-	_ = cmd.RegisterFlagCompletionFunc("storage-opt", completeStorageOpt)
-	_ = cmd.RegisterFlagCompletionFunc("ulimit", completeUlimit)
-	_ = cmd.RegisterFlagCompletionFunc("userns", completion.FromList("host"))
-	_ = cmd.RegisterFlagCompletionFunc("uts", completion.FromList("host"))
-	_ = cmd.RegisterFlagCompletionFunc("volume-driver", completeVolumeDriver(dockerCLI))
-	_ = cmd.RegisterFlagCompletionFunc("volumes-from", completion.ContainerNames(dockerCLI, true))
-}
-
-// completeCgroupns implements shell completion for the `--cgroupns` option of `run` and `create`.
-func completeCgroupns() completion.ValidArgsFn {
-	return completion.FromList(string(container.CgroupnsModeHost), string(container.CgroupnsModePrivate))
-}
-
-// completeDetachKeys implements shell completion for the `--detach-keys` option of `run` and `create`.
-func completeDetachKeys(_ *cobra.Command, _ []string, _ string) ([]string, cobra.ShellCompDirective) {
-	return []string{"ctrl-"}, cobra.ShellCompDirectiveNoSpace
-}
-
-// completeIpc implements shell completion for the `--ipc` option of `run` and `create`.
-// The completion is partly composite.
-func completeIpc(dockerCLI completion.APIClientProvider) func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
-	return func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
-		if len(toComplete) > 0 && strings.HasPrefix("container", toComplete) { //nolint:gocritic // not swapped, matches partly typed "container"
-			return []string{"container:"}, cobra.ShellCompDirectiveNoSpace
-		}
-		if strings.HasPrefix(toComplete, "container:") {
-			names, _ := completion.ContainerNames(dockerCLI, true)(cmd, args, toComplete)
-			return prefixWith("container:", names), cobra.ShellCompDirectiveNoFileComp
-		}
-		return []string{
-			string(container.IPCModeContainer + ":"),
-			string(container.IPCModeHost),
-			string(container.IPCModeNone),
-			string(container.IPCModePrivate),
-			string(container.IPCModeShareable),
-		}, cobra.ShellCompDirectiveNoFileComp
-	}
-}
-
-// completeLink implements shell completion for the `--link` option  of `run` and `create`.
-func completeLink(dockerCLI completion.APIClientProvider) func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
-	return func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
-		return postfixWith(":", containerNames(dockerCLI, cmd, args, toComplete)), cobra.ShellCompDirectiveNoSpace
-	}
-}
-
-// completeLogDriver implements shell completion for the `--log-driver` option  of `run` and `create`.
-// The log drivers are collected from a call to the Info endpoint with a fallback to a hard-coded list
-// of the build-in log drivers.
-func completeLogDriver(dockerCLI completion.APIClientProvider) completion.ValidArgsFn {
-	return func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
-		info, err := dockerCLI.Client().Info(cmd.Context())
-		if err != nil {
-			return builtInLogDrivers(), cobra.ShellCompDirectiveNoFileComp
-		}
-		drivers := info.Plugins.Log
-		return drivers, cobra.ShellCompDirectiveNoFileComp
-	}
-}
-
-// completeLogOpt implements shell completion for the `--log-opt` option  of `run` and `create`.
-// If the user supplied a log-driver, only options for that driver are returned.
-func completeLogOpt(cmd *cobra.Command, _ []string, _ string) ([]string, cobra.ShellCompDirective) {
-	driver, _ := cmd.Flags().GetString("log-driver")
-	if options, exists := logDriverOptions[driver]; exists {
-		return postfixWith("=", options), cobra.ShellCompDirectiveNoSpace | cobra.ShellCompDirectiveNoFileComp
-	}
-	return postfixWith("=", allLogDriverOptions()), cobra.ShellCompDirectiveNoSpace
-}
-
-// completePid implements shell completion for the `--pid` option  of `run` and `create`.
-func completePid(dockerCLI completion.APIClientProvider) func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
-	return func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
-		if len(toComplete) > 0 && strings.HasPrefix("container", toComplete) { //nolint:gocritic // not swapped, matches partly typed "container"
-			return []string{"container:"}, cobra.ShellCompDirectiveNoSpace
-		}
-		if strings.HasPrefix(toComplete, "container:") {
-			names, _ := completion.ContainerNames(dockerCLI, true)(cmd, args, toComplete)
-			return prefixWith("container:", names), cobra.ShellCompDirectiveNoFileComp
-		}
-		return []string{"container:", "host"}, cobra.ShellCompDirectiveNoFileComp
-	}
-}
-
-// completeSecurityOpt implements shell completion for the `--security-opt` option of `run` and `create`.
-// The completion is partly composite.
-func completeSecurityOpt(_ *cobra.Command, _ []string, toComplete string) ([]string, cobra.ShellCompDirective) {
-	if len(toComplete) > 0 && strings.HasPrefix("apparmor=", toComplete) { //nolint:gocritic // not swapped, matches partly typed "apparmor="
-		return []string{"apparmor="}, cobra.ShellCompDirectiveNoSpace
-	}
-	if len(toComplete) > 0 && strings.HasPrefix("label", toComplete) { //nolint:gocritic // not swapped, matches partly typed "label"
-		return []string{"label="}, cobra.ShellCompDirectiveNoSpace
-	}
-	if strings.HasPrefix(toComplete, "label=") {
-		if strings.HasPrefix(toComplete, "label=d") {
-			return []string{"label=disable"}, cobra.ShellCompDirectiveNoFileComp
-		}
-		labels := []string{"disable", "level:", "role:", "type:", "user:"}
-		return prefixWith("label=", labels), cobra.ShellCompDirectiveNoSpace | cobra.ShellCompDirectiveNoFileComp
-	}
-	// length must be > 1 here so that completion of "s" falls through.
-	if len(toComplete) > 1 && strings.HasPrefix("seccomp", toComplete) { //nolint:gocritic // not swapped, matches partly typed "seccomp"
-		return []string{"seccomp="}, cobra.ShellCompDirectiveNoSpace
-	}
-	if strings.HasPrefix(toComplete, "seccomp=") {
-		return []string{"seccomp=unconfined"}, cobra.ShellCompDirectiveNoFileComp
-	}
-	return []string{"apparmor=", "label=", "no-new-privileges", "seccomp=", "systempaths=unconfined"}, cobra.ShellCompDirectiveNoFileComp
-}
-
-// completeStorageOpt implements shell completion for the `--storage-opt` option  of `run` and `create`.
-func completeStorageOpt(_ *cobra.Command, _ []string, _ string) ([]string, cobra.ShellCompDirective) {
-	return []string{"size="}, cobra.ShellCompDirectiveNoSpace
-}
-
-// completeUlimit implements shell completion for the `--ulimit` option of `run` and `create`.
-func completeUlimit(_ *cobra.Command, _ []string, _ string) ([]string, cobra.ShellCompDirective) {
-	limits := []string{
-		"as",
-		"chroot",
-		"core",
-		"cpu",
-		"data",
-		"fsize",
-		"locks",
-		"maxlogins",
-		"maxsyslogins",
-		"memlock",
-		"msgqueue",
-		"nice",
-		"nofile",
-		"nproc",
-		"priority",
-		"rss",
-		"rtprio",
-		"sigpending",
-		"stack",
-	}
-	return postfixWith("=", limits), cobra.ShellCompDirectiveNoSpace
-}
-
-// completeVolumeDriver contacts the API to get the built-in and installed volume drivers.
-func completeVolumeDriver(dockerCLI completion.APIClientProvider) completion.ValidArgsFn {
-	return func(cmd *cobra.Command, _ []string, _ string) ([]string, cobra.ShellCompDirective) {
-		info, err := dockerCLI.Client().Info(cmd.Context())
-		if err != nil {
-			// fallback: the built-in drivers
-			return []string{"local"}, cobra.ShellCompDirectiveNoFileComp
-		}
-		drivers := info.Plugins.Volume
-		return drivers, cobra.ShellCompDirectiveNoFileComp
-	}
-}
-
-// containerNames contacts the API to get names and optionally IDs of containers.
-// In case of an error, an empty list is returned.
-func containerNames(dockerCLI completion.APIClientProvider, cmd *cobra.Command, args []string, toComplete string) []string {
-	names, _ := completion.ContainerNames(dockerCLI, true)(cmd, args, toComplete)
-	if names == nil {
-		return []string{}
-	}
-	return names
-}
-
-// prefixWith prefixes every element in the slice with the given prefix.
-func prefixWith(prefix string, values []string) []string {
-	result := make([]string, len(values))
-	for i, v := range values {
-		result[i] = prefix + v
-	}
-	return result
-}
-
-// postfixWith appends postfix to every element in the slice.
-func postfixWith(postfix string, values []string) []string {
-	result := make([]string, len(values))
-	for i, v := range values {
-		result[i] = v + postfix
-	}
-	return result
-}
-
 func completeLinuxCapabilityNames(cmd *cobra.Command, args []string, toComplete string) (names []string, _ cobra.ShellCompDirective) {
 	return completion.FromList(allLinuxCapabilities()...)(cmd, args, toComplete)
 }

cli/command/container/completion_test.go

@@ -4,9 +4,6 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/builders"
-	"github.com/docker/docker/api/types/container"
 	"github.com/moby/sys/signal"
 	"github.com/spf13/cobra"
 	"gotest.tools/v3/assert"
@@ -24,48 +21,6 @@ func TestCompleteLinuxCapabilityNames(t *testing.T) {
 	}
 }
 
-func TestCompletePid(t *testing.T) {
-	tests := []struct {
-		containerListFunc   func(container.ListOptions) ([]container.Summary, error)
-		toComplete          string
-		expectedCompletions []string
-		expectedDirective   cobra.ShellCompDirective
-	}{
-		{
-			toComplete:          "",
-			expectedCompletions: []string{"container:", "host"},
-			expectedDirective:   cobra.ShellCompDirectiveNoFileComp,
-		},
-		{
-			toComplete:          "c",
-			expectedCompletions: []string{"container:"},
-			expectedDirective:   cobra.ShellCompDirectiveNoSpace,
-		},
-		{
-			containerListFunc: func(container.ListOptions) ([]container.Summary, error) {
-				return []container.Summary{
-					*builders.Container("c1"),
-					*builders.Container("c2"),
-				}, nil
-			},
-			toComplete:          "container:",
-			expectedCompletions: []string{"container:c1", "container:c2"},
-			expectedDirective:   cobra.ShellCompDirectiveNoFileComp,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.toComplete, func(t *testing.T) {
-			cli := test.NewFakeCli(&fakeClient{
-				containerListFunc: tc.containerListFunc,
-			})
-			completions, directive := completePid(cli)(NewRunCommand(cli), nil, tc.toComplete)
-			assert.Check(t, is.DeepEqual(completions, tc.expectedCompletions))
-			assert.Check(t, is.Equal(directive, tc.expectedDirective))
-		})
-	}
-}
-
 func TestCompleteRestartPolicies(t *testing.T) {
 	values, directives := completeRestartPolicies(nil, nil, "")
 	assert.Check(t, is.Equal(directives&cobra.ShellCompDirectiveNoFileComp, cobra.ShellCompDirectiveNoFileComp), "Should not perform file completion")
@@ -73,59 +28,6 @@ func TestCompleteRestartPolicies(t *testing.T) {
 	assert.Check(t, is.DeepEqual(values, expected))
 }
 
-func TestCompleteSecurityOpt(t *testing.T) {
-	tests := []struct {
-		toComplete          string
-		expectedCompletions []string
-		expectedDirective   cobra.ShellCompDirective
-	}{
-		{
-			toComplete:          "",
-			expectedCompletions: []string{"apparmor=", "label=", "no-new-privileges", "seccomp=", "systempaths=unconfined"},
-			expectedDirective:   cobra.ShellCompDirectiveNoFileComp,
-		},
-		{
-			toComplete:          "apparmor=",
-			expectedCompletions: []string{"apparmor="},
-			expectedDirective:   cobra.ShellCompDirectiveNoSpace,
-		},
-		{
-			toComplete:          "label=",
-			expectedCompletions: []string{"label=disable", "label=level:", "label=role:", "label=type:", "label=user:"},
-			expectedDirective:   cobra.ShellCompDirectiveNoSpace | cobra.ShellCompDirectiveNoFileComp,
-		},
-		{
-			toComplete: "s",
-			// We do not filter matching completions but delegate this task to the shell script.
-			expectedCompletions: []string{"apparmor=", "label=", "no-new-privileges", "seccomp=", "systempaths=unconfined"},
-			expectedDirective:   cobra.ShellCompDirectiveNoFileComp,
-		},
-		{
-			toComplete:          "se",
-			expectedCompletions: []string{"seccomp="},
-			expectedDirective:   cobra.ShellCompDirectiveNoSpace,
-		},
-		{
-			toComplete:          "seccomp=",
-			expectedCompletions: []string{"seccomp=unconfined"},
-			expectedDirective:   cobra.ShellCompDirectiveNoFileComp,
-		},
-		{
-			toComplete:          "sy",
-			expectedCompletions: []string{"apparmor=", "label=", "no-new-privileges", "seccomp=", "systempaths=unconfined"},
-			expectedDirective:   cobra.ShellCompDirectiveNoFileComp,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.toComplete, func(t *testing.T) {
-			completions, directive := completeSecurityOpt(nil, nil, tc.toComplete)
-			assert.Check(t, is.DeepEqual(completions, tc.expectedCompletions))
-			assert.Check(t, is.Equal(directive, tc.expectedDirective))
-		})
-	}
-}
-
 func TestCompleteSignals(t *testing.T) {
 	values, directives := completeSignals(nil, nil, "")
 	assert.Check(t, is.Equal(directives&cobra.ShellCompDirectiveNoFileComp, cobra.ShellCompDirectiveNoFileComp), "Should not perform file completion")

cli/command/container/cp_test.go

@@ -178,6 +178,7 @@ func TestSplitCpArg(t *testing.T) {
 		},
 	}
 	for _, tc := range testcases {
+		tc := tc
 		t.Run(tc.doc, func(t *testing.T) {
 			if tc.os == "windows" && runtime.GOOS != "windows" {
 				t.Skip("skipping windows test on non-windows platform")

cli/command/container/create.go

@@ -78,15 +78,16 @@ func NewCreateCommand(dockerCli command.Cli) *cobra.Command {
 	command.AddTrustVerificationFlags(flags, &options.untrusted, dockerCli.ContentTrustEnabled())
 	copts = addFlags(flags)
 
-	addCompletions(cmd, dockerCli)
-
-	flags.VisitAll(func(flag *pflag.Flag) {
-		// Set a default completion function if none was set. We don't look
-		// up if it does already have one set, because Cobra does this for
-		// us, and returns an error (which we ignore for this reason).
-		_ = cmd.RegisterFlagCompletionFunc(flag.Name, completion.NoComplete)
-	})
-
+	_ = cmd.RegisterFlagCompletionFunc("cap-add", completeLinuxCapabilityNames)
+	_ = cmd.RegisterFlagCompletionFunc("cap-drop", completeLinuxCapabilityNames)
+	_ = cmd.RegisterFlagCompletionFunc("env", completion.EnvVarNames)
+	_ = cmd.RegisterFlagCompletionFunc("env-file", completion.FileNames)
+	_ = cmd.RegisterFlagCompletionFunc("network", completion.NetworkNames(dockerCli))
+	_ = cmd.RegisterFlagCompletionFunc("platform", completion.Platforms)
+	_ = cmd.RegisterFlagCompletionFunc("pull", completion.FromList(PullImageAlways, PullImageMissing, PullImageNever))
+	_ = cmd.RegisterFlagCompletionFunc("restart", completeRestartPolicies)
+	_ = cmd.RegisterFlagCompletionFunc("stop-signal", completeSignals)
+	_ = cmd.RegisterFlagCompletionFunc("volumes-from", completion.ContainerNames(dockerCli, true))
 	return cmd
 }
 

cli/command/container/create_test.go

@@ -113,6 +113,7 @@ func TestCreateContainerImagePullPolicy(t *testing.T) {
 		},
 	}
 	for _, tc := range cases {
+		tc := tc
 		t.Run(tc.PullPolicy, func(t *testing.T) {
 			pullCounter := 0
 
@@ -175,6 +176,7 @@ func TestCreateContainerImagePullPolicyInvalid(t *testing.T) {
 		},
 	}
 	for _, tc := range cases {
+		tc := tc
 		t.Run(tc.PullPolicy, func(t *testing.T) {
 			dockerCli := test.NewFakeCli(&fakeClient{})
 			err := runCreate(
@@ -205,6 +207,7 @@ func TestCreateContainerValidateFlags(t *testing.T) {
 			expectedErr: `invalid argument "STDINFO" for "-a, --attach" flag: valid streams are STDIN, STDOUT and STDERR`,
 		},
 	} {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cmd := NewCreateCommand(test.NewFakeCli(&fakeClient{}))
 			cmd.SetOut(io.Discard)
@@ -248,6 +251,7 @@ func TestNewCreateCommandWithContentTrustErrors(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		fakeCLI := test.NewFakeCli(&fakeClient{
 			createContainerFunc: func(config *container.Config,
 				hostConfig *container.HostConfig,
@@ -308,6 +312,7 @@ func TestNewCreateCommandWithWarnings(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			fakeCLI := test.NewFakeCli(&fakeClient{
 				createContainerFunc: func(config *container.Config,

cli/command/container/formatter_diff_test.go

@@ -47,6 +47,7 @@ D: /usr/app/old_app.js
 	}
 
 	for _, tc := range cases {
+		tc := tc
 		t.Run(string(tc.context.Format), func(t *testing.T) {
 			out := bytes.NewBufferString("")
 			tc.context.Output = out

cli/command/container/formatter_stats_test.go

@@ -178,6 +178,7 @@ container2  --  --
 	}
 
 	for _, tc := range cases {
+		tc := tc
 		t.Run(string(tc.context.Format), func(t *testing.T) {
 			var out bytes.Buffer
 			tc.context.Output = &out
@@ -222,6 +223,7 @@ func TestContainerStatsContextWriteWithNoStats(t *testing.T) {
 	}
 
 	for _, tc := range cases {
+		tc := tc
 		t.Run(string(tc.context.Format), func(t *testing.T) {
 			err := statsFormatWrite(tc.context, []StatsEntry{}, "linux", false)
 			assert.NilError(t, err)
@@ -263,6 +265,7 @@ func TestContainerStatsContextWriteWithNoStatsWindows(t *testing.T) {
 	}
 
 	for _, tc := range cases {
+		tc := tc
 		t.Run(string(tc.context.Format), func(t *testing.T) {
 			err := statsFormatWrite(tc.context, []StatsEntry{}, "windows", false)
 			assert.NilError(t, err)

cli/command/container/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package container
 

cli/command/container/list_test.go

@@ -277,6 +277,7 @@ func TestContainerListFormatSizeSetsOption(t *testing.T) {
 	}
 
 	for _, tc := range tests {
+		tc := tc
 		t.Run(tc.doc, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{
 				containerListFunc: func(options container.ListOptions) ([]container.Summary, error) {

cli/command/container/opts.go

@@ -762,6 +762,7 @@ func parseNetworkOpts(copts *containerOptions) (map[string]*networktypes.Endpoin
 	}
 
 	for i, n := range copts.netMode.Value() {
+		n := n
 		if container.NetworkMode(n.Target).IsUserDefined() {
 			hasUserDefined = true
 		} else {

cli/command/container/opts_test.go

@@ -126,6 +126,7 @@ func TestParseRunAttach(t *testing.T) {
 		},
 	}
 	for _, tc := range tests {
+		tc := tc
 		t.Run(tc.input, func(t *testing.T) {
 			config, _, _ := mustParse(t, tc.input)
 			assert.Equal(t, config.AttachStdin, tc.expected.AttachStdin)
@@ -801,6 +802,7 @@ func TestParseRestartPolicy(t *testing.T) {
 		},
 	}
 	for _, tc := range tests {
+		tc := tc
 		t.Run(tc.input, func(t *testing.T) {
 			_, hostConfig, _, err := parseRun([]string{"--restart=" + tc.input, "img", "cmd"})
 			if tc.expectedErr != "" {

cli/command/container/port_test.go

@@ -43,6 +43,7 @@ func TestNewPortCommandOutput(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{
 				inspectFunc: func(string) (container.InspectResponse, error) {

cli/command/container/restart_test.go

@@ -58,6 +58,7 @@ func TestRestart(t *testing.T) {
 			expectedErr: "conflicting options: cannot specify both --timeout and --time",
 		},
 	} {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			var restarted []string
 			mutex := new(sync.Mutex)

cli/command/container/rm_test.go

@@ -23,6 +23,7 @@ func TestRemoveForce(t *testing.T) {
 		{name: "without force", args: []string{"nosuchcontainer", "mycontainer"}, expectedErr: "no such container"},
 		{name: "with force", args: []string{"--force", "nosuchcontainer", "mycontainer"}, expectedErr: ""},
 	} {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			var removed []string
 			mutex := new(sync.Mutex)

cli/command/container/run.go

@@ -69,16 +69,16 @@ func NewRunCommand(dockerCli command.Cli) *cobra.Command {
 	command.AddTrustVerificationFlags(flags, &options.untrusted, dockerCli.ContentTrustEnabled())
 	copts = addFlags(flags)
 
-	_ = cmd.RegisterFlagCompletionFunc("detach-keys", completeDetachKeys)
-	addCompletions(cmd, dockerCli)
-
-	flags.VisitAll(func(flag *pflag.Flag) {
-		// Set a default completion function if none was set. We don't look
-		// up if it does already have one set, because Cobra does this for
-		// us, and returns an error (which we ignore for this reason).
-		_ = cmd.RegisterFlagCompletionFunc(flag.Name, completion.NoComplete)
-	})
-
+	_ = cmd.RegisterFlagCompletionFunc("cap-add", completeLinuxCapabilityNames)
+	_ = cmd.RegisterFlagCompletionFunc("cap-drop", completeLinuxCapabilityNames)
+	_ = cmd.RegisterFlagCompletionFunc("env", completion.EnvVarNames)
+	_ = cmd.RegisterFlagCompletionFunc("env-file", completion.FileNames)
+	_ = cmd.RegisterFlagCompletionFunc("network", completion.NetworkNames(dockerCli))
+	_ = cmd.RegisterFlagCompletionFunc("platform", completion.Platforms)
+	_ = cmd.RegisterFlagCompletionFunc("pull", completion.FromList(PullImageAlways, PullImageMissing, PullImageNever))
+	_ = cmd.RegisterFlagCompletionFunc("restart", completeRestartPolicies)
+	_ = cmd.RegisterFlagCompletionFunc("stop-signal", completeSignals)
+	_ = cmd.RegisterFlagCompletionFunc("volumes-from", completion.ContainerNames(dockerCli, true))
 	return cmd
 }
 

cli/command/container/run_test.go

@@ -35,6 +35,7 @@ func TestRunValidateFlags(t *testing.T) {
 			expectedErr: "conflicting options: cannot specify both --attach and --detach",
 		},
 	} {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cmd := NewRunCommand(test.NewFakeCli(&fakeClient{}))
 			cmd.SetOut(io.Discard)
@@ -244,6 +245,7 @@ func TestRunCommandWithContentTrustErrors(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			fakeCLI := test.NewFakeCli(&fakeClient{
 				createContainerFunc: func(config *container.Config,
@@ -284,6 +286,7 @@ func TestRunContainerImagePullPolicyInvalid(t *testing.T) {
 		},
 	}
 	for _, tc := range cases {
+		tc := tc
 		t.Run(tc.PullPolicy, func(t *testing.T) {
 			dockerCli := test.NewFakeCli(&fakeClient{})
 			err := runRun(

cli/command/container/stop_test.go

@@ -58,6 +58,7 @@ func TestStop(t *testing.T) {
 			expectedErr: "conflicting options: cannot specify both --timeout and --time",
 		},
 	} {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			var stopped []string
 			mutex := new(sync.Mutex)

cli/command/context.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package command
 

cli/command/context/create.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package context
 

cli/command/context/create_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package context
 
@@ -94,6 +94,7 @@ func TestCreate(t *testing.T) {
 		},
 	}
 	for _, tc := range tests {
+		tc := tc
 		t.Run(tc.options.Name, func(t *testing.T) {
 			err := RunCreate(cli, &tc.options)
 			if tc.expecterErr == "" {
@@ -163,24 +164,25 @@ func TestCreateFromContext(t *testing.T) {
 
 	cli.SetCurrentContext("dummy")
 
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
+	for _, c := range cases {
+		c := c
+		t.Run(c.name, func(t *testing.T) {
 			cli.ResetOutputBuffers()
 			err := RunCreate(cli, &CreateOptions{
 				From:        "original",
-				Name:        tc.name,
-				Description: tc.description,
-				Docker:      tc.docker,
+				Name:        c.name,
+				Description: c.description,
+				Docker:      c.docker,
 			})
 			assert.NilError(t, err)
-			assertContextCreateLogging(t, cli, tc.name)
-			newContext, err := cli.ContextStore().GetMetadata(tc.name)
+			assertContextCreateLogging(t, cli, c.name)
+			newContext, err := cli.ContextStore().GetMetadata(c.name)
 			assert.NilError(t, err)
 			newContextTyped, err := command.GetDockerContext(newContext)
 			assert.NilError(t, err)
 			dockerEndpoint, err := docker.EndpointFromContext(newContext)
 			assert.NilError(t, err)
-			assert.Equal(t, newContextTyped.Description, tc.expectedDescription)
+			assert.Equal(t, newContextTyped.Description, c.expectedDescription)
 			assert.Equal(t, dockerEndpoint.Host, "tcp://42.42.42.42:2375")
 		})
 	}
@@ -217,22 +219,23 @@ func TestCreateFromCurrent(t *testing.T) {
 
 	cli.SetCurrentContext("original")
 
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
+	for _, c := range cases {
+		c := c
+		t.Run(c.name, func(t *testing.T) {
 			cli.ResetOutputBuffers()
 			err := RunCreate(cli, &CreateOptions{
-				Name:        tc.name,
-				Description: tc.description,
+				Name:        c.name,
+				Description: c.description,
 			})
 			assert.NilError(t, err)
-			assertContextCreateLogging(t, cli, tc.name)
-			newContext, err := cli.ContextStore().GetMetadata(tc.name)
+			assertContextCreateLogging(t, cli, c.name)
+			newContext, err := cli.ContextStore().GetMetadata(c.name)
 			assert.NilError(t, err)
 			newContextTyped, err := command.GetDockerContext(newContext)
 			assert.NilError(t, err)
 			dockerEndpoint, err := docker.EndpointFromContext(newContext)
 			assert.NilError(t, err)
-			assert.Equal(t, newContextTyped.Description, tc.expectedDescription)
+			assert.Equal(t, newContextTyped.Description, c.expectedDescription)
 			assert.Equal(t, dockerEndpoint.Host, "tcp://42.42.42.42:2375")
 		})
 	}

cli/command/context/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package context
 

cli/command/context/list.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package context
 

cli/command/context_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package command
 

cli/command/defaultcontextstore.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package command
 

cli/command/defaultcontextstore_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package command
 

cli/command/formatter/container.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package formatter
 

cli/command/formatter/container_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package formatter
 
@@ -346,6 +346,7 @@ size: 0B
 	}
 
 	for _, tc := range cases {
+		tc := tc
 		t.Run(string(tc.context.Format), func(t *testing.T) {
 			var out bytes.Buffer
 			tc.context.Output = &out
@@ -410,6 +411,7 @@ func TestContainerContextWriteWithNoContainers(t *testing.T) {
 	}
 
 	for _, tc := range cases {
+		tc := tc
 		t.Run(string(tc.context.Format), func(t *testing.T) {
 			err := ContainerWrite(tc.context, containers)
 			assert.NilError(t, err)

cli/command/formatter/custom.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package formatter
 

cli/command/formatter/disk_usage_test.go

@@ -106,6 +106,7 @@ Build Cache     0         0         0B        0B
 	}
 
 	for _, tc := range cases {
+		tc := tc
 		t.Run(string(tc.context.Format), func(t *testing.T) {
 			var out bytes.Buffer
 			tc.context.Output = &out

cli/command/formatter/formatter.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package formatter
 

cli/command/formatter/formatter_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package formatter
 

cli/command/formatter/image_test.go

@@ -304,6 +304,7 @@ image_id: imageID3
 	}
 
 	for _, tc := range cases {
+		tc := tc
 		t.Run(string(tc.context.Format), func(t *testing.T) {
 			var out bytes.Buffer
 			tc.context.Output = &out
@@ -364,6 +365,7 @@ func TestImageContextWriteWithNoImage(t *testing.T) {
 	}
 
 	for _, tc := range cases {
+		tc := tc
 		t.Run(string(tc.context.Format), func(t *testing.T) {
 			err := ImageWrite(tc.context, images)
 			assert.NilError(t, err)

cli/command/formatter/reflect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package formatter
 

cli/command/formatter/reflect_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package formatter
 

cli/command/formatter/volume_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package formatter
 
@@ -131,6 +131,7 @@ foobar_bar
 	}
 
 	for _, tc := range cases {
+		tc := tc
 		t.Run(string(tc.context.Format), func(t *testing.T) {
 			var out bytes.Buffer
 			tc.context.Output = &out

cli/command/idresolver/idresolver.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package idresolver
 

cli/command/image/formatter_history_test.go

@@ -255,6 +255,7 @@ imageID6   17 years ago   /bin/bash echo                                  183MB
 	}
 
 	for _, tc := range cases {
+		tc := tc
 		t.Run(string(tc.context.Format), func(t *testing.T) {
 			err := HistoryWrite(tc.context, true, histories)
 			assert.NilError(t, err)

cli/command/image/history_test.go

@@ -42,6 +42,7 @@ func TestNewHistoryCommandErrors(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cmd := NewHistoryCommand(test.NewFakeCli(&fakeClient{imageHistoryFunc: tc.imageHistoryFunc}))
 			cmd.SetOut(io.Discard)
@@ -108,6 +109,7 @@ func TestNewHistoryCommandSuccess(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			// Set to UTC timezone as timestamps in output are
 			// printed in the current timezone

cli/command/image/import_test.go

@@ -98,6 +98,7 @@ func TestNewImportCommandSuccess(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cmd := NewImportCommand(test.NewFakeCli(&fakeClient{imageImportFunc: tc.imageImportFunc}))
 			cmd.SetOut(io.Discard)

cli/command/image/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package image
 

cli/command/image/inspect_test.go

@@ -25,6 +25,7 @@ func TestNewInspectCommandErrors(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cmd := newInspectCommand(test.NewFakeCli(&fakeClient{}))
 			cmd.SetOut(io.Discard)
@@ -78,6 +79,7 @@ func TestNewInspectCommandSuccess(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			imageInspectInvocationCount = 0
 			cli := test.NewFakeCli(&fakeClient{imageInspectFunc: tc.imageInspectFunc})

cli/command/image/list_test.go

@@ -35,6 +35,7 @@ func TestNewImagesCommandErrors(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cmd := NewImagesCommand(test.NewFakeCli(&fakeClient{imageListFunc: tc.imageListFunc}))
 			cmd.SetOut(io.Discard)
@@ -82,6 +83,7 @@ func TestNewImagesCommandSuccess(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{imageListFunc: tc.imageListFunc})
 			cli.SetConfigFile(&configfile.ConfigFile{ImagesFormat: tc.imageFormat})

cli/command/image/load_test.go

@@ -52,6 +52,7 @@ func TestNewLoadCommandErrors(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{imageLoadFunc: tc.imageLoadFunc})
 			cli.In().SetIsTerminal(tc.isTerminalIn)
@@ -115,6 +116,7 @@ func TestNewLoadCommandSuccess(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{imageLoadFunc: tc.imageLoadFunc})
 			cmd := NewLoadCommand(cli)

cli/command/image/prune_test.go

@@ -39,6 +39,7 @@ func TestNewPruneCommandErrors(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cmd := NewPruneCommand(test.NewFakeCli(&fakeClient{
 				imagesPruneFunc: tc.imagesPruneFunc,
@@ -97,6 +98,7 @@ func TestNewPruneCommandSuccess(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{imagesPruneFunc: tc.imagesPruneFunc})
 			// when prompted, answer "Y" to confirm the prune.

cli/command/image/pull_test.go

@@ -38,6 +38,7 @@ func TestNewPullCommandErrors(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{})
 			cmd := NewPullCommand(cli)
@@ -72,6 +73,7 @@ func TestNewPullCommandSuccess(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{
 				imagePullFunc: func(ref string, options image.PullOptions) (io.ReadCloser, error) {
@@ -117,6 +119,7 @@ func TestNewPullCommandWithContentTrustErrors(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{
 				imagePullFunc: func(ref string, options image.PullOptions) (io.ReadCloser, error) {

cli/command/image/push.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package image
 

cli/command/image/push_test.go

@@ -38,6 +38,7 @@ func TestNewPushCommandErrors(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{imagePushFunc: tc.imagePushFunc})
 			cmd := NewPushCommand(cli)
@@ -67,6 +68,7 @@ func TestNewPushCommandSuccess(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{
 				imagePushFunc: func(ref string, options image.PushOptions) (io.ReadCloser, error) {

cli/command/image/remove_test.go

@@ -62,6 +62,7 @@ func TestNewRemoveCommandErrors(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cmd := NewRemoveCommand(test.NewFakeCli(&fakeClient{
 				imageRemoveFunc: tc.imageRemoveFunc,
@@ -120,6 +121,7 @@ func TestNewRemoveCommandSuccess(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{imageRemoveFunc: tc.imageRemoveFunc})
 			cmd := NewRemoveCommand(cli)

cli/command/image/save_test.go

@@ -59,6 +59,7 @@ func TestNewSaveCommandErrors(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{imageSaveFunc: tc.imageSaveFunc})
 			cli.Out().SetIsTerminal(tc.isTerminal)
@@ -112,6 +113,7 @@ func TestNewSaveCommandSuccess(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(strings.Join(tc.args, " "), func(t *testing.T) {
 			cmd := NewSaveCommand(test.NewFakeCli(&fakeClient{
 				imageSaveFunc: tc.imageSaveFunc,

cli/command/image/tree.go

@@ -56,6 +56,7 @@ func runTree(ctx context.Context, dockerCLI command.Cli, opts treeOptions) error
 				continue
 			}
 
+			im := im
 			sub := subImage{
 				Platform:  platforms.Format(im.ImageData.Platform),
 				Available: im.Available,

cli/command/inspect/inspector.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package inspect
 

cli/command/manifest/create_test.go

@@ -31,6 +31,7 @@ func TestManifestCreateErrors(t *testing.T) {
 	}
 
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.expectedError, func(t *testing.T) {
 			cli := test.NewFakeCli(nil)
 			cmd := newCreateListCommand(cli)

cli/command/network/create_test.go

@@ -218,6 +218,7 @@ func TestNetworkCreateIPv6(t *testing.T) {
 	}
 
 	for _, tc := range tests {
+		tc := tc
 		t.Run(tc.doc, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{
 				networkCreateFunc: func(ctx context.Context, name string, createBody network.CreateOptions) (network.CreateResponse, error) {

cli/command/network/formatter_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package network
 
@@ -161,6 +161,7 @@ foobar_bar 2017-01-01 00:00:00 +0000 UTC
 	}
 
 	for _, tc := range cases {
+		tc := tc
 		t.Run(string(tc.context.Format), func(t *testing.T) {
 			var out bytes.Buffer
 			tc.context.Output = &out

cli/command/network/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package network
 

cli/command/network/list_test.go

@@ -83,6 +83,7 @@ func TestNetworkList(t *testing.T) {
 	}
 
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.doc, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{networkListFunc: tc.networkListFunc})
 			cmd := newListCommand(cli)

cli/command/network/remove_test.go

@@ -63,6 +63,7 @@ func TestNetworkRemoveForce(t *testing.T) {
 	}
 
 	for _, tc := range tests {
+		tc := tc
 		t.Run(tc.doc, func(t *testing.T) {
 			fakeCli := test.NewFakeCli(&fakeClient{
 				networkRemoveFunc: func(ctx context.Context, networkID string) error {

cli/command/node/formatter_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package node
 
@@ -202,6 +202,7 @@ foobar_boo  Unknown
 	}
 
 	for _, tc := range cases {
+		tc := tc
 		t.Run(string(tc.context.Format), func(t *testing.T) {
 			var out bytes.Buffer
 			tc.context.Output = &out

cli/command/node/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package node
 

cli/command/node/inspect_test.go

@@ -106,6 +106,7 @@ func TestNodeInspectPretty(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{
 				nodeInspectFunc: tc.nodeInspectFunc,

cli/command/node/ps_test.go

@@ -134,6 +134,7 @@ func TestNodePs(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{
 				infoFunc:           tc.infoFunc,

cli/command/plugin/formatter_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package plugin
 
@@ -131,6 +131,7 @@ foobar_bar
 	}
 
 	for _, tc := range cases {
+		tc := tc
 		t.Run(string(tc.context.Format), func(t *testing.T) {
 			var out bytes.Buffer
 			tc.context.Output = &out

cli/command/plugin/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package plugin
 

cli/command/plugin/inspect_test.go

@@ -66,6 +66,7 @@ func TestInspectErrors(t *testing.T) {
 	}
 
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.description, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{pluginInspectFunc: tc.inspectFunc})
 			cmd := newInspectCommand(cli)
@@ -137,6 +138,7 @@ func TestInspect(t *testing.T) {
 	}
 
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.description, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{pluginInspectFunc: tc.inspectFunc})
 			cmd := newInspectCommand(cli)

cli/command/plugin/install_test.go

@@ -54,6 +54,7 @@ func TestInstallErrors(t *testing.T) {
 	}
 
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.description, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{pluginInstallFunc: tc.installFunc})
 			cmd := newInstallCommand(cli)
@@ -93,6 +94,7 @@ func TestInstallContentTrustErrors(t *testing.T) {
 	}
 
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.description, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{
 				pluginInstallFunc: func(name string, options types.PluginInstallOptions) (io.ReadCloser, error) {
@@ -136,6 +138,7 @@ func TestInstall(t *testing.T) {
 	}
 
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.description, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{pluginInstallFunc: tc.installFunc})
 			cmd := newInstallCommand(cli)

cli/command/plugin/list_test.go

@@ -46,6 +46,7 @@ func TestListErrors(t *testing.T) {
 	}
 
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.description, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{pluginListFunc: tc.listFunc})
 			cmd := newListCommand(cli)
@@ -165,6 +166,7 @@ func TestList(t *testing.T) {
 	}
 
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.description, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{pluginListFunc: tc.listFunc})
 			cmd := newListCommand(cli)

cli/command/registry/formatter_search_test.go

@@ -203,6 +203,7 @@ result2 5
 	}
 
 	for _, tc := range cases {
+		tc := tc
 		t.Run(tc.doc, func(t *testing.T) {
 			var out bytes.Buffer
 			err := SearchWrite(formatter.Context{Format: tc.format, Output: &out}, results)

cli/command/secret/formatter_test.go

@@ -61,6 +61,7 @@ id_rsa
 		},
 	}
 	for _, tc := range cases {
+		tc := tc
 		t.Run(string(tc.context.Format), func(t *testing.T) {
 			var out bytes.Buffer
 			tc.context.Output = &out

cli/command/secret/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package secret
 

cli/command/secret/inspect_test.go

@@ -93,6 +93,7 @@ func TestSecretInspectWithoutFormat(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{
 				secretInspectFunc: tc.secretInspectFunc,
@@ -131,6 +132,7 @@ func TestSecretInspectWithFormat(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{
 				secretInspectFunc: tc.secretInspectFunc,

cli/command/service/formatter_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package service
 
@@ -223,6 +223,7 @@ zarp2
 	}
 
 	for _, tc := range cases {
+		tc := tc
 		t.Run(string(tc.context.Format), func(t *testing.T) {
 			var out bytes.Buffer
 			tc.context.Output = &out

cli/command/service/inspect.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package service
 

cli/command/service/inspect_test.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package service
 

cli/command/service/list_test.go

@@ -168,6 +168,7 @@ func TestServiceListServiceStatus(t *testing.T) {
 	}
 
 	for _, tc := range matrix {
+		tc := tc
 		t.Run(tc.doc, func(t *testing.T) {
 			if tc.cluster == nil {
 				tc.cluster = generateCluster(t, tc.opts)

cli/command/service/opts.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package service
 

cli/command/service/opts_test.go

@@ -50,6 +50,7 @@ func TestCredentialSpecOpt(t *testing.T) {
 	}
 
 	for _, tc := range tests {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			var cs credentialSpecOpt
 

cli/command/service/rollback_test.go

@@ -91,6 +91,7 @@ func TestRollbackWithErrors(t *testing.T) {
 	}
 
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cmd := newRollbackCommand(
 				test.NewFakeCli(&fakeClient{

cli/command/service/update.go

@@ -1058,6 +1058,7 @@ func updatePorts(flags *pflag.FlagSet, portConfig *[]swarm.PortConfig) error {
 
 	// Build the current list of portConfig
 	for _, entry := range *portConfig {
+		entry := entry
 		if _, ok := portSet[portConfigToString(&entry)]; !ok {
 			portSet[portConfigToString(&entry)] = entry
 		}
@@ -1085,6 +1086,7 @@ portLoop:
 		ports := flags.Lookup(flagPublishAdd).Value.(*opts.PortOpt).Value()
 
 		for _, port := range ports {
+			port := port
 			if _, ok := portSet[portConfigToString(&port)]; ok {
 				continue
 			}

cli/command/service/update_test.go

@@ -1690,6 +1690,7 @@ func TestUpdateUlimits(t *testing.T) {
 	}
 
 	for _, tc := range tests {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			svc := swarm.ServiceSpec{
 				TaskTemplate: swarm.TaskSpec{

cli/command/stack/formatter/formatter_test.go

@@ -51,6 +51,7 @@ bar
 		{Name: "bar", Services: 1},
 	}
 	for _, tc := range cases {
+		tc := tc
 		t.Run(string(tc.context.Format), func(t *testing.T) {
 			var out bytes.Buffer
 			tc.context.Output = &out

cli/command/stack/list_test.go

@@ -48,6 +48,7 @@ func TestListErrors(t *testing.T) {
 	}
 
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.expectedError, func(t *testing.T) {
 			cmd := newListCommand(test.NewFakeCli(&fakeClient{
 				serviceListFunc: tc.serviceListFunc,
@@ -103,6 +104,7 @@ func TestStackList(t *testing.T) {
 	}
 
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.doc, func(t *testing.T) {
 			var services []swarm.Service
 			for _, name := range tc.serviceNames {

cli/command/stack/loader/loader.go

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.21
 
 package loader
 

cli/command/stack/ps_test.go

@@ -40,6 +40,7 @@ func TestStackPsErrors(t *testing.T) {
 	}
 
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.expectedError, func(t *testing.T) {
 			cmd := newPsCommand(test.NewFakeCli(&fakeClient{
 				taskListFunc: tc.taskListFunc,
@@ -159,6 +160,7 @@ func TestStackPs(t *testing.T) {
 	}
 
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.doc, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{
 				taskListFunc:       tc.taskListFunc,

cli/command/stack/services_test.go

@@ -67,6 +67,7 @@ func TestStackServicesErrors(t *testing.T) {
 	}
 
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.expectedError, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{
 				serviceListFunc: tc.serviceListFunc,

cli/command/stack/swarm/deploy_test.go

@@ -88,6 +88,7 @@ func TestServiceUpdateResolveImageChanged(t *testing.T) {
 	ctx := context.Background()
 
 	for _, tc := range testcases {
+		tc := tc
 		t.Run(tc.image, func(t *testing.T) {
 			spec := map[string]swarm.ServiceSpec{
 				"myservice": {

cli/command/swarm/init_test.go

@@ -63,6 +63,7 @@ func TestSwarmInitErrorOnAPIFailure(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cmd := newInitCommand(
 				test.NewFakeCli(&fakeClient{

cli/command/swarm/join_test.go

@@ -48,6 +48,7 @@ func TestSwarmJoinErrors(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cmd := newJoinCommand(
 				test.NewFakeCli(&fakeClient{
@@ -92,6 +93,7 @@ func TestSwarmJoin(t *testing.T) {
 		},
 	}
 	for _, tc := range testCases {
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			cli := test.NewFakeCli(&fakeClient{
 				infoFunc: tc.infoFunc,