vendor: github.com/docker/cli v28.1.0

full diff: https://github.com/docker/cli/compare/v28.0.4...v28.1.0 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2025-04-18 15:54:36 -07:00
parent ac970c03e7
commit 286c018f84
291 changed files with 366 additions and 49078 deletions
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.23

 package command

@@ -59,7 +59,9 @@ type Cli interface {
 }

 // DockerCli is an instance the docker command line client.
-// Instances of the client can be returned from NewDockerCli.
+// Instances of the client should be created using the [NewDockerCli]
+// constructor to make sure they are properly initialized with defaults
+// set.
 type DockerCli struct {
 	configFile         *configfile.ConfigFile
 	options            *cliflags.ClientOptions
@@ -74,7 +76,7 @@ type DockerCli struct {
 	init               sync.Once
 	initErr            error
 	dockerEndpoint     docker.Endpoint
-	contextStoreConfig store.Config
+	contextStoreConfig *store.Config
 	initTimeout        time.Duration
 	res                telemetryResource

@@ -250,13 +252,33 @@ func (cli *DockerCli) Initialize(opts *cliflags.ClientOptions, ops ...CLIOption)
 		return errors.New("conflicting options: cannot specify both --host and --context")
 	}

+	if cli.contextStoreConfig == nil {
+		// This path can be hit when calling Initialize on a DockerCli that's
+		// not constructed through [NewDockerCli]. Using the default context
+		// store without a config set will result in Endpoints from contexts
+		// not being type-mapped correctly, and used as a generic "map[string]any",
+		// instead of a [docker.EndpointMeta].
+		//
+		// When looking up the API endpoint (using [EndpointFromContext]), no
+		// endpoint will be found, and a default, empty endpoint will be used
+		// instead which in its turn, causes newAPIClientFromEndpoint to
+		// be initialized with the default config instead of settings for
+		// the current context (which may mean; connecting with the wrong
+		// endpoint and/or TLS Config to be missing).
+		//
+		// [EndpointFromContext]: https://github.com/docker/cli/blob/33494921b80fd0b5a06acc3a34fa288de4bb2e6b/cli/context/docker/load.go#L139-L149
+		if err := WithDefaultContextStoreConfig()(cli); err != nil {
+			return err
+		}
+	}
+
 	cli.options = opts
 	cli.configFile = config.LoadDefaultConfigFile(cli.err)
 	cli.currentContext = resolveContextName(cli.options, cli.configFile)
 	cli.contextStore = &ContextStoreWithDefault{
-		Store: store.New(config.ContextStoreDir(), cli.contextStoreConfig),
+		Store: store.New(config.ContextStoreDir(), *cli.contextStoreConfig),
 		Resolver: func() (*DefaultContext, error) {
-			return ResolveDefaultContext(cli.options, cli.contextStoreConfig)
+			return ResolveDefaultContext(cli.options, *cli.contextStoreConfig)
 		},
 	}

@@ -101,7 +101,8 @@ func WithContentTrust(enabled bool) CLIOption {
 // WithDefaultContextStoreConfig configures the cli to use the default context store configuration.
 func WithDefaultContextStoreConfig() CLIOption {
 	return func(cli *DockerCli) error {
-		cli.contextStoreConfig = DefaultContextStoreConfig()
+		cfg := DefaultContextStoreConfig()
+		cli.contextStoreConfig = &cfg
 		return nil
 	}
 }
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.23

 package command

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.23

 package command

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.23

 package formatter

@@ -1,7 +1,5 @@
 package formatter

-import "encoding/json"
-
 const (
 	// ClientContextTableFormat is the default client context format.
 	ClientContextTableFormat = "table {{.Name}}{{if .Current}} *{{end}}\t{{.Description}}\t{{.DockerEndpoint}}\t{{.Error}}"
@@ -30,13 +28,6 @@ type ClientContext struct {
 	DockerEndpoint string
 	Current        bool
 	Error          string
-
-	// ContextType is a temporary field for compatibility with
-	// Visual Studio, which depends on this from the "cloud integration"
-	// wrapper.
-	//
-	// Deprecated: this type is only for backward-compatibility. Do not use.
-	ContextType string `json:"ContextType,omitempty"`
 }

 // ClientContextWrite writes formatted contexts using the Context
@@ -69,13 +60,6 @@ func newClientContextContext() *clientContextContext {
 }

 func (c *clientContextContext) MarshalJSON() ([]byte, error) {
-	if c.c.ContextType != "" {
-		// We only have ContextType set for plain "json" or "{{json .}}" formatting,
-		// so we should be able to just use the default json.Marshal with no
-		// special handling.
-		return json.Marshal(c.c)
-	}
-	// FIXME(thaJeztah): why do we need a special marshal function here?
 	return MarshalJSON(c)
 }

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.23

 package formatter

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.23

 package formatter

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.23

 package formatter

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.23

 package formatter

@@ -13,9 +13,9 @@ import (
 	configtypes "github.com/docker/cli/cli/config/types"
 	"github.com/docker/cli/cli/hints"
 	"github.com/docker/cli/cli/streams"
+	"github.com/docker/cli/internal/prompt"
 	"github.com/docker/cli/internal/tui"
 	registrytypes "github.com/docker/docker/api/types/registry"
-	"github.com/docker/docker/registry"
 	"github.com/morikuni/aec"
 	"github.com/pkg/errors"
 )
@@ -28,16 +28,22 @@ const (
 		"for organizations using SSO. Learn more at https://docs.docker.com/go/access-tokens/"
 )

+// authConfigKey is the key used to store credentials for Docker Hub. It is
+// a copy of [registry.IndexServer].
+//
+// [registry.IndexServer]: https://pkg.go.dev/github.com/docker/docker/registry#IndexServer
+const authConfigKey = "https://index.docker.io/v1/"
+
 // RegistryAuthenticationPrivilegedFunc returns a RequestPrivilegeFunc from the specified registry index info
 // for the given command.
 func RegistryAuthenticationPrivilegedFunc(cli Cli, index *registrytypes.IndexInfo, cmdName string) registrytypes.RequestAuthConfig {
+	configKey := getAuthConfigKey(index.Name)
+	isDefaultRegistry := configKey == authConfigKey || index.Official
 	return func(ctx context.Context) (string, error) {
 		_, _ = fmt.Fprintf(cli.Out(), "\nLogin prior to %s:\n", cmdName)
-		indexServer := registry.GetAuthConfigKey(index)
-		isDefaultRegistry := indexServer == registry.IndexServer
-		authConfig, err := GetDefaultAuthConfig(cli.ConfigFile(), true, indexServer, isDefaultRegistry)
+		authConfig, err := GetDefaultAuthConfig(cli.ConfigFile(), true, configKey, isDefaultRegistry)
 		if err != nil {
-			_, _ = fmt.Fprintf(cli.Err(), "Unable to retrieve stored credentials for %s, error: %s.\n", indexServer, err)
+			_, _ = fmt.Fprintf(cli.Err(), "Unable to retrieve stored credentials for %s, error: %s.\n", authConfigKey, err)
 		}

 		select {
@@ -46,7 +52,7 @@ func RegistryAuthenticationPrivilegedFunc(cli Cli, index *registrytypes.IndexInf
 		default:
 		}

-		authConfig, err = PromptUserForCredentials(ctx, cli, "", "", authConfig.Username, indexServer)
+		authConfig, err = PromptUserForCredentials(ctx, cli, "", "", authConfig.Username, authConfigKey)
 		if err != nil {
 			return "", err
 		}
@@ -63,7 +69,7 @@ func RegistryAuthenticationPrivilegedFunc(cli Cli, index *registrytypes.IndexInf
 func ResolveAuthConfig(cfg *configfile.ConfigFile, index *registrytypes.IndexInfo) registrytypes.AuthConfig {
 	configKey := index.Name
 	if index.Official {
-		configKey = registry.IndexServer
+		configKey = authConfigKey
 	}

 	a, _ := cfg.GetAuthConfig(configKey)
@@ -132,7 +138,7 @@ func PromptUserForCredentials(ctx context.Context, cli Cli, argUser, argPassword

 	argUser = strings.TrimSpace(argUser)
 	if argUser == "" {
-		if serverAddress == registry.IndexServer {
+		if serverAddress == authConfigKey {
 			// When signing in to the default (Docker Hub) registry, we display
 			// hints for creating an account, and (if hints are enabled), using
 			// a token instead of a password.
@@ -143,16 +149,16 @@ func PromptUserForCredentials(ctx context.Context, cli Cli, argUser, argPassword
 			}
 		}

-		var prompt string
+		var msg string
 		defaultUsername = strings.TrimSpace(defaultUsername)
 		if defaultUsername == "" {
-			prompt = "Username: "
+			msg = "Username: "
 		} else {
-			prompt = fmt.Sprintf("Username (%s): ", defaultUsername)
+			msg = fmt.Sprintf("Username (%s): ", defaultUsername)
 		}

 		var err error
-		argUser, err = PromptForInput(ctx, cli.In(), cli.Out(), prompt)
+		argUser, err = prompt.ReadInput(ctx, cli.In(), cli.Out(), msg)
 		if err != nil {
 			return registrytypes.AuthConfig{}, err
 		}
@@ -166,7 +172,7 @@ func PromptUserForCredentials(ctx context.Context, cli Cli, argUser, argPassword

 	argPassword = strings.TrimSpace(argPassword)
 	if argPassword == "" {
-		restoreInput, err := DisableInputEcho(cli.In())
+		restoreInput, err := prompt.DisableInputEcho(cli.In())
 		if err != nil {
 			return registrytypes.AuthConfig{}, err
 		}
@@ -180,10 +186,13 @@ func PromptUserForCredentials(ctx context.Context, cli Cli, argUser, argPassword
 			}
 		}()

-		out := tui.NewOutput(cli.Err())
-		out.PrintNote("A Personal Access Token (PAT) can be used instead.\n" +
-			"To create a PAT, visit " + aec.Underline.Apply("https://app.docker.com/settings") + "\n\n")
-		argPassword, err = PromptForInput(ctx, cli.In(), cli.Out(), "Password: ")
+		if serverAddress == authConfigKey {
+			out := tui.NewOutput(cli.Err())
+			out.PrintNote("A Personal Access Token (PAT) can be used instead.\n" +
+				"To create a PAT, visit " + aec.Underline.Apply("https://app.docker.com/settings") + "\n\n")
+		}
+
+		argPassword, err = prompt.ReadInput(ctx, cli.In(), cli.Out(), "Password: ")
 		if err != nil {
 			return registrytypes.AuthConfig{}, err
 		}
@@ -225,9 +234,25 @@ func resolveAuthConfigFromImage(cfg *configfile.ConfigFile, image string) (regis
 	if err != nil {
 		return registrytypes.AuthConfig{}, err
 	}
-	repoInfo, err := registry.ParseRepositoryInfo(registryRef)
+	configKey := getAuthConfigKey(reference.Domain(registryRef))
+	a, err := cfg.GetAuthConfig(configKey)
 	if err != nil {
 		return registrytypes.AuthConfig{}, err
 	}
-	return ResolveAuthConfig(cfg, repoInfo.Index), nil
+	return registrytypes.AuthConfig(a), nil
+}
+
+// getAuthConfigKey special-cases using the full index address of the official
+// index as the AuthConfig key, and uses the (host)name[:port] for private indexes.
+//
+// It is similar to [registry.GetAuthConfigKey], but does not require on
+// [registrytypes.IndexInfo] as intermediate.
+//
+// [registry.GetAuthConfigKey]: https://pkg.go.dev/github.com/docker/docker/registry#GetAuthConfigKey
+// [registrytypes.IndexInfo]:https://pkg.go.dev/github.com/docker/docker/api/types/registry#IndexInfo
+func getAuthConfigKey(domainName string) string {
+	if domainName == "docker.io" || domainName == "index.docker.io" {
+		return authConfigKey
+	}
+	return domainName
 }
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.23

 package command

@@ -1,70 +1,45 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.23

 package command

 import (
-	"bufio"
 	"context"
-	"fmt"
 	"io"
 	"os"
 	"path/filepath"
-	"runtime"
 	"strings"

 	"github.com/docker/cli/cli/config"
 	"github.com/docker/cli/cli/streams"
+	"github.com/docker/cli/internal/prompt"
 	"github.com/docker/docker/api/types/filters"
-	"github.com/docker/docker/errdefs"
-	"github.com/moby/sys/sequential"
-	"github.com/moby/term"
+	"github.com/moby/sys/atomicwriter"
 	"github.com/pkg/errors"
 	"github.com/spf13/pflag"
 )

 // CopyToFile writes the content of the reader to the specified file
+//
+// Deprecated: use [atomicwriter.New].
 func CopyToFile(outfile string, r io.Reader) error {
-	// We use sequential file access here to avoid depleting the standby list
-	// on Windows. On Linux, this is a call directly to os.CreateTemp
-	tmpFile, err := sequential.CreateTemp(filepath.Dir(outfile), ".docker_temp_")
+	writer, err := atomicwriter.New(outfile, 0o600)
 	if err != nil {
 		return err
 	}
-
-	tmpPath := tmpFile.Name()
-
-	_, err = io.Copy(tmpFile, r)
-	tmpFile.Close()
-
-	if err != nil {
-		os.Remove(tmpPath)
-		return err
-	}
-
-	if err = os.Rename(tmpPath, outfile); err != nil {
-		os.Remove(tmpPath)
-		return err
-	}
-
-	return nil
+	defer writer.Close()
+	_, err = io.Copy(writer, r)
+	return err
 }

-var ErrPromptTerminated = errdefs.Cancelled(errors.New("prompt terminated"))
+const ErrPromptTerminated = prompt.ErrTerminated

 // DisableInputEcho disables input echo on the provided streams.In.
 // This is useful when the user provides sensitive information like passwords.
 // The function returns a restore function that should be called to restore the
 // terminal state.
 func DisableInputEcho(ins *streams.In) (restore func() error, err error) {
-	oldState, err := term.SaveState(ins.FD())
-	if err != nil {
-		return nil, err
-	}
-	restore = func() error {
-		return term.RestoreTerminal(ins.FD(), oldState)
-	}
-	return restore, term.DisableEcho(ins.FD(), oldState)
+	return prompt.DisableInputEcho(ins)
 }

 // PromptForInput requests input from the user.
@@ -75,23 +50,7 @@ func DisableInputEcho(ins *streams.In) (restore func() error, err error) {
 // the stack and close the io.Reader used for the prompt which will prevent the
 // background goroutine from blocking indefinitely.
 func PromptForInput(ctx context.Context, in io.Reader, out io.Writer, message string) (string, error) {
-	_, _ = fmt.Fprint(out, message)
-
-	result := make(chan string)
-	go func() {
-		scanner := bufio.NewScanner(in)
-		if scanner.Scan() {
-			result <- strings.TrimSpace(scanner.Text())
-		}
-	}()
-
-	select {
-	case <-ctx.Done():
-		_, _ = fmt.Fprintln(out, "")
-		return "", ErrPromptTerminated
-	case r := <-result:
-		return r, nil
-	}
+	return prompt.ReadInput(ctx, in, out, message)
 }

 // PromptForConfirmation requests and checks confirmation from the user.
@@ -105,68 +64,45 @@ func PromptForInput(ctx context.Context, in io.Reader, out io.Writer, message st
 // the stack and close the io.Reader used for the prompt which will prevent the
 // background goroutine from blocking indefinitely.
 func PromptForConfirmation(ctx context.Context, ins io.Reader, outs io.Writer, message string) (bool, error) {
-	if message == "" {
-		message = "Are you sure you want to proceed?"
-	}
-	message += " [y/N] "
-
-	_, _ = fmt.Fprint(outs, message)
-
-	// On Windows, force the use of the regular OS stdin stream.
-	if runtime.GOOS == "windows" {
-		ins = streams.NewIn(os.Stdin)
-	}
-
-	result := make(chan bool)
-
-	go func() {
-		var res bool
-		scanner := bufio.NewScanner(ins)
-		if scanner.Scan() {
-			answer := strings.TrimSpace(scanner.Text())
-			if strings.EqualFold(answer, "y") {
-				res = true
-			}
-		}
-		result <- res
-	}()
-
-	select {
-	case <-ctx.Done():
-		_, _ = fmt.Fprintln(outs, "")
-		return false, ErrPromptTerminated
-	case r := <-result:
-		return r, nil
-	}
+	return prompt.Confirm(ctx, ins, outs, message)
 }

-// PruneFilters returns consolidated prune filters obtained from config.json and cli
+// PruneFilters merges prune filters specified in config.json with those specified
+// as command-line flags.
+//
+// CLI label filters have precedence over those specified in config.json. If a
+// label filter specified as flag conflicts with a label defined in config.json
+// (i.e., "label=some-value" conflicts with "label!=some-value", and vice versa),
+// then the filter defined in config.json is omitted.
 func PruneFilters(dockerCLI config.Provider, pruneFilters filters.Args) filters.Args {
 	cfg := dockerCLI.ConfigFile()
 	if cfg == nil {
 		return pruneFilters
 	}
+
+	// Merge filters provided through the CLI with default filters defined
+	// in the CLI-configfile.
 	for _, f := range cfg.PruneFilters {
 		k, v, ok := strings.Cut(f, "=")
 		if !ok {
 			continue
 		}
-		if k == "label" {
-			// CLI label filter supersede config.json.
-			// If CLI label filter conflict with config.json,
-			// skip adding label! filter in config.json.
-			if pruneFilters.Contains("label!") && pruneFilters.ExactMatch("label!", v) {
+		switch k {
+		case "label":
+			// "label != some-value" conflicts with "label = some-value"
+			if pruneFilters.ExactMatch("label!", v) {
 				continue
 			}
-		} else if k == "label!" {
-			// CLI label! filter supersede config.json.
-			// If CLI label! filter conflict with config.json,
-			// skip adding label filter in config.json.
-			if pruneFilters.Contains("label") && pruneFilters.ExactMatch("label", v) {
+			pruneFilters.Add(k, v)
+		case "label!":
+			// "label != some-value" conflicts with "label = some-value"
+			if pruneFilters.ExactMatch("label", v) {
 				continue
 			}
+			pruneFilters.Add(k, v)
+		default:
+			pruneFilters.Add(k, v)
 		}
-		pruneFilters.Add(k, v)
 	}

 	return pruneFilters
@@ -178,7 +114,7 @@ func AddPlatformFlag(flags *pflag.FlagSet, target *string) {
 	_ = flags.SetAnnotation("platform", "version", []string{"1.32"})
 }

-// ValidateOutputPath validates the output paths of the `export` and `save` commands.
+// ValidateOutputPath validates the output paths of the "docker cp" command.
 func ValidateOutputPath(path string) error {
 	dir := filepath.Dir(filepath.Clean(path))
 	if dir != "" && dir != "." {
@@ -204,8 +140,8 @@ func ValidateOutputPath(path string) error {
 	return nil
 }

-// ValidateOutputPathFileMode validates the output paths of the `cp` command and serves as a
-// helper to `ValidateOutputPath`
+// ValidateOutputPathFileMode validates the output paths of the "docker cp" command
+// and serves as a helper to [ValidateOutputPath]
 func ValidateOutputPathFileMode(fileMode os.FileMode) error {
 	switch {
 	case fileMode&os.ModeDevice != 0:
@@ -36,12 +36,14 @@ type ConfigFile struct {
 	NodesFormat          string                       `json:"nodesFormat,omitempty"`
 	PruneFilters         []string                     `json:"pruneFilters,omitempty"`
 	Proxies              map[string]ProxyConfig       `json:"proxies,omitempty"`
-	Experimental         string                       `json:"experimental,omitempty"`
 	CurrentContext       string                       `json:"currentContext,omitempty"`
 	CLIPluginsExtraDirs  []string                     `json:"cliPluginsExtraDirs,omitempty"`
 	Plugins              map[string]map[string]string `json:"plugins,omitempty"`
 	Aliases              map[string]string            `json:"aliases,omitempty"`
 	Features             map[string]string            `json:"features,omitempty"`
+
+	// Deprecated: experimental CLI features are always enabled and this field is no longer used. Use [Features] instead for optional features. This field will be removed in a future release.
+	Experimental string `json:"experimental,omitempty"`
 }

 // ProxyConfig contains proxy configuration settings
@@ -5,14 +5,14 @@ import (
 	"io"
 )

-// LimitedReader is a fork of io.LimitedReader to override Read.
-type LimitedReader struct {
+// limitedReader is a fork of [io.LimitedReader] to override Read.
+type limitedReader struct {
 	R io.Reader
 	N int64 // max bytes remaining
 }

-// Read is a fork of io.LimitedReader.Read that returns an error when limit exceeded.
-func (l *LimitedReader) Read(p []byte) (n int, err error) {
+// Read is a fork of [io.LimitedReader.Read] that returns an error when limit exceeded.
+func (l *limitedReader) Read(p []byte) (n int, err error) {
 	if l.N < 0 {
 		return 0, errors.New("read exceeds the defined limit")
 	}
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.23

 package store

@@ -12,8 +12,8 @@ import (
 	"sort"

 	"github.com/docker/docker/errdefs"
-	"github.com/docker/docker/pkg/atomicwriter"
 	"github.com/fvbommel/sortorder"
+	"github.com/moby/sys/atomicwriter"
 	"github.com/pkg/errors"
 )

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.23

 package store

@@ -14,9 +14,9 @@ import (
 	"net/http"
 	"path"
 	"path/filepath"
-	"regexp"
 	"strings"

+	"github.com/docker/cli/internal/lazyregexp"
 	"github.com/docker/docker/errdefs"
 	"github.com/opencontainers/go-digest"
 	"github.com/pkg/errors"
@@ -24,7 +24,7 @@ import (

 const restrictedNamePattern = "^[a-zA-Z0-9][a-zA-Z0-9_.+-]+$"

-var restrictedNameRegEx = regexp.MustCompile(restrictedNamePattern)
+var restrictedNameRegEx = lazyregexp.New(restrictedNamePattern)

 // Store provides a context store for easily remembering endpoints configuration
 type Store interface {
@@ -356,7 +356,7 @@ func isValidFilePath(p string) error {
 }

 func importTar(name string, s Writer, reader io.Reader) error {
-	tr := tar.NewReader(&LimitedReader{R: reader, N: maxAllowedFileSizeToImport})
+	tr := tar.NewReader(&limitedReader{R: reader, N: maxAllowedFileSizeToImport})
 	tlsData := ContextTLSData{
 		Endpoints: map[string]EndpointTLSData{},
 	}
@@ -406,7 +406,7 @@ func importTar(name string, s Writer, reader io.Reader) error {
 }

 func importZip(name string, s Writer, reader io.Reader) error {
-	body, err := io.ReadAll(&LimitedReader{R: reader, N: maxAllowedFileSizeToImport})
+	body, err := io.ReadAll(&limitedReader{R: reader, N: maxAllowedFileSizeToImport})
 	if err != nil {
 		return err
 	}
@@ -434,7 +434,7 @@ func importZip(name string, s Writer, reader io.Reader) error {
 				return err
 			}

-			data, err := io.ReadAll(&LimitedReader{R: f, N: maxAllowedFileSizeToImport})
+			data, err := io.ReadAll(&limitedReader{R: f, N: maxAllowedFileSizeToImport})
 			defer f.Close()
 			if err != nil {
 				return err
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.23

 package store

@@ -5,7 +5,7 @@ import (
 	"path/filepath"

 	"github.com/docker/docker/errdefs"
-	"github.com/docker/docker/pkg/atomicwriter"
+	"github.com/moby/sys/atomicwriter"
 	"github.com/pkg/errors"
 )

@@ -0,0 +1,98 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Code below was largely copied from golang.org/x/mod@v0.22;
+// https://github.com/golang/mod/blob/v0.22.0/internal/lazyregexp/lazyre.go
+// with some additional methods added.
+
+// Package lazyregexp is a thin wrapper over regexp, allowing the use of global
+// regexp variables without forcing them to be compiled at init.
+package lazyregexp
+
+import (
+	"os"
+	"regexp"
+	"strings"
+	"sync"
+)
+
+// Regexp is a wrapper around [regexp.Regexp], where the underlying regexp will be
+// compiled the first time it is needed.
+type Regexp struct {
+	str  string
+	once sync.Once
+	rx   *regexp.Regexp
+}
+
+func (r *Regexp) re() *regexp.Regexp {
+	r.once.Do(r.build)
+	return r.rx
+}
+
+func (r *Regexp) build() {
+	r.rx = regexp.MustCompile(r.str)
+	r.str = ""
+}
+
+func (r *Regexp) FindSubmatch(s []byte) [][]byte {
+	return r.re().FindSubmatch(s)
+}
+
+func (r *Regexp) FindAllStringSubmatch(s string, n int) [][]string {
+	return r.re().FindAllStringSubmatch(s, n)
+}
+
+func (r *Regexp) FindStringSubmatch(s string) []string {
+	return r.re().FindStringSubmatch(s)
+}
+
+func (r *Regexp) FindStringSubmatchIndex(s string) []int {
+	return r.re().FindStringSubmatchIndex(s)
+}
+
+func (r *Regexp) ReplaceAllString(src, repl string) string {
+	return r.re().ReplaceAllString(src, repl)
+}
+
+func (r *Regexp) FindString(s string) string {
+	return r.re().FindString(s)
+}
+
+func (r *Regexp) FindAllString(s string, n int) []string {
+	return r.re().FindAllString(s, n)
+}
+
+func (r *Regexp) MatchString(s string) bool {
+	return r.re().MatchString(s)
+}
+
+func (r *Regexp) ReplaceAllStringFunc(src string, repl func(string) string) string {
+	return r.re().ReplaceAllStringFunc(src, repl)
+}
+
+func (r *Regexp) ReplaceAllLiteralString(src, repl string) string {
+	return r.re().ReplaceAllLiteralString(src, repl)
+}
+
+func (r *Regexp) String() string {
+	return r.re().String()
+}
+
+func (r *Regexp) SubexpNames() []string {
+	return r.re().SubexpNames()
+}
+
+var inTest = len(os.Args) > 0 && strings.HasSuffix(strings.TrimSuffix(os.Args[0], ".exe"), ".test")
+
+// New creates a new lazy regexp, delaying the compiling work until it is first
+// needed. If the code is being run as part of tests, the regexp compiling will
+// happen immediately.
+func New(str string) *Regexp {
+	lr := &Regexp{str: str}
+	if inTest {
+		// In tests, always compile the regexps early.
+		lr.re()
+	}
+	return lr
+}
@@ -0,0 +1,116 @@
+// Package prompt provides utilities to prompt the user for input.
+
+package prompt
+
+import (
+	"bufio"
+	"context"
+	"io"
+	"os"
+	"runtime"
+	"strings"
+
+	"github.com/docker/cli/cli/streams"
+	"github.com/moby/term"
+)
+
+const ErrTerminated cancelledErr = "prompt terminated"
+
+type cancelledErr string
+
+func (e cancelledErr) Error() string {
+	return string(e)
+}
+
+func (cancelledErr) Cancelled() {}
+
+// DisableInputEcho disables input echo on the provided streams.In.
+// This is useful when the user provides sensitive information like passwords.
+// The function returns a restore function that should be called to restore the
+// terminal state.
+//
+// TODO(thaJeztah): implement without depending on streams?
+func DisableInputEcho(ins *streams.In) (restore func() error, _ error) {
+	oldState, err := term.SaveState(ins.FD())
+	if err != nil {
+		return nil, err
+	}
+	restore = func() error {
+		return term.RestoreTerminal(ins.FD(), oldState)
+	}
+	return restore, term.DisableEcho(ins.FD(), oldState)
+}
+
+// ReadInput requests input from the user.
+//
+// It returns an empty string ("") with an [ErrTerminated] if the user terminates
+// the CLI with SIGINT or SIGTERM while the prompt is active. If the prompt
+// returns an error, the caller should close the [io.Reader] used for the prompt
+// and propagate the error up the stack to prevent the background goroutine
+// from blocking indefinitely.
+func ReadInput(ctx context.Context, in io.Reader, out io.Writer, message string) (string, error) {
+	_, _ = out.Write([]byte(message))
+
+	result := make(chan string)
+	go func() {
+		scanner := bufio.NewScanner(in)
+		if scanner.Scan() {
+			result <- strings.TrimSpace(scanner.Text())
+		}
+	}()
+
+	select {
+	case <-ctx.Done():
+		_, _ = out.Write([]byte("\n"))
+		return "", ErrTerminated
+	case r := <-result:
+		return r, nil
+	}
+}
+
+// Confirm requests and checks confirmation from the user.
+//
+// It displays the provided message followed by "[y/N]". If the user
+// input 'y' or 'Y' it returns true otherwise false. If no message is provided,
+// "Are you sure you want to proceed? [y/N] " will be used instead.
+//
+// It returns false with an [ErrTerminated] if the user terminates
+// the CLI with SIGINT or SIGTERM while the prompt is active. If the prompt
+// returns an error, the caller should close the [io.Reader] used for the prompt
+// and propagate the error up the stack to prevent the background goroutine
+// from blocking indefinitely.
+func Confirm(ctx context.Context, in io.Reader, out io.Writer, message string) (bool, error) {
+	if message == "" {
+		message = "Are you sure you want to proceed?"
+	}
+	message += " [y/N] "
+
+	_, _ = out.Write([]byte(message))
+
+	// On Windows, force the use of the regular OS stdin stream.
+	if runtime.GOOS == "windows" {
+		in = streams.NewIn(os.Stdin)
+	}
+
+	result := make(chan bool)
+
+	go func() {
+		var res bool
+		scanner := bufio.NewScanner(in)
+		if scanner.Scan() {
+			answer := strings.TrimSpace(scanner.Text())
+			if strings.EqualFold(answer, "y") {
+				res = true
+			}
+		}
+		result <- res
+	}()
+
+	select {
+	case <-ctx.Done():
+		_, _ = out.Write([]byte("\n"))
+		return false, ErrTerminated
+	case r := <-result:
+		return r, nil
+	}
+}
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.23

 package tui

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.23

 package tui

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.23

 package tui

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.23

 package tui

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.23

 package tui

@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.23

 package tui

@@ -6,16 +6,16 @@ import (
 	"math/big"
 	"net"
 	"path"
-	"regexp"
 	"strings"

+	"github.com/docker/cli/internal/lazyregexp"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/docker/go-units"
 )

 var (
-	alphaRegexp  = regexp.MustCompile(`[a-zA-Z]`)
-	domainRegexp = regexp.MustCompile(`^(:?(:?[a-zA-Z0-9]|(:?[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9]))(:?\.(:?[a-zA-Z0-9]|(:?[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])))*)\.?\s*$`)
+	alphaRegexp  = lazyregexp.New(`[a-zA-Z]`)
+	domainRegexp = lazyregexp.New(`^(:?(:?[a-zA-Z0-9]|(:?[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9]))(:?\.(:?[a-zA-Z0-9]|(:?[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])))*)\.?\s*$`)
 )

 // ListOpts holds a list of values and a validation function.
@@ -1,18 +0,0 @@
-package opts
-
-import "github.com/docker/cli/opts/swarmopts"
-
-// PortOpt represents a port config in swarm mode.
-//
-// Deprecated: use [swarmopts.PortOpt]
-type PortOpt = swarmopts.PortOpt
-
-// ConfigOpt is a Value type for parsing configs.
-//
-// Deprecated: use [swarmopts.ConfigOpt]
-type ConfigOpt = swarmopts.ConfigOpt
-
-// SecretOpt is a Value type for parsing secrets
-//
-// Deprecated: use [swarmopts.SecretOpt]
-type SecretOpt = swarmopts.SecretOpt
@@ -1,100 +0,0 @@
-package swarmopts
-
-import (
-	"encoding/csv"
-	"errors"
-	"fmt"
-	"os"
-	"strconv"
-	"strings"
-
-	"github.com/docker/docker/api/types/swarm"
-)
-
-// ConfigOpt is a Value type for parsing configs
-type ConfigOpt struct {
-	values []*swarm.ConfigReference
-}
-
-// Set a new config value
-func (o *ConfigOpt) Set(value string) error {
-	csvReader := csv.NewReader(strings.NewReader(value))
-	fields, err := csvReader.Read()
-	if err != nil {
-		return err
-	}
-
-	options := &swarm.ConfigReference{
-		File: &swarm.ConfigReferenceFileTarget{
-			UID:  "0",
-			GID:  "0",
-			Mode: 0o444,
-		},
-	}
-
-	// support a simple syntax of --config foo
-	if len(fields) == 1 && !strings.Contains(fields[0], "=") {
-		options.File.Name = fields[0]
-		options.ConfigName = fields[0]
-		o.values = append(o.values, options)
-		return nil
-	}
-
-	for _, field := range fields {
-		key, val, ok := strings.Cut(field, "=")
-		if !ok || key == "" {
-			return fmt.Errorf("invalid field '%s' must be a key=value pair", field)
-		}
-
-		// TODO(thaJeztah): these options should not be case-insensitive.
-		switch strings.ToLower(key) {
-		case "source", "src":
-			options.ConfigName = val
-		case "target":
-			options.File.Name = val
-		case "uid":
-			options.File.UID = val
-		case "gid":
-			options.File.GID = val
-		case "mode":
-			m, err := strconv.ParseUint(val, 0, 32)
-			if err != nil {
-				return fmt.Errorf("invalid mode specified: %v", err)
-			}
-
-			options.File.Mode = os.FileMode(m)
-		default:
-			return fmt.Errorf("invalid field in config request: %s", key)
-		}
-	}
-
-	if options.ConfigName == "" {
-		return errors.New("source is required")
-	}
-	if options.File.Name == "" {
-		options.File.Name = options.ConfigName
-	}
-
-	o.values = append(o.values, options)
-	return nil
-}
-
-// Type returns the type of this option
-func (*ConfigOpt) Type() string {
-	return "config"
-}
-
-// String returns a string repr of this option
-func (o *ConfigOpt) String() string {
-	configs := []string{}
-	for _, config := range o.values {
-		repr := fmt.Sprintf("%s -> %s", config.ConfigName, config.File.Name)
-		configs = append(configs, repr)
-	}
-	return strings.Join(configs, ", ")
-}
-
-// Value returns the config requests
-func (o *ConfigOpt) Value() []*swarm.ConfigReference {
-	return o.values
-}
@@ -1,181 +0,0 @@
-package swarmopts
-
-import (
-	"encoding/csv"
-	"errors"
-	"fmt"
-	"net"
-	"regexp"
-	"strconv"
-	"strings"
-
-	"github.com/docker/docker/api/types/swarm"
-	"github.com/docker/go-connections/nat"
-	"github.com/sirupsen/logrus"
-)
-
-const (
-	portOptTargetPort    = "target"
-	portOptPublishedPort = "published"
-	portOptProtocol      = "protocol"
-	portOptMode          = "mode"
-)
-
-// PortOpt represents a port config in swarm mode.
-type PortOpt struct {
-	ports []swarm.PortConfig
-}
-
-// Set a new port value
-//
-//nolint:gocyclo
-func (p *PortOpt) Set(value string) error {
-	longSyntax, err := regexp.MatchString(`\w+=\w+(,\w+=\w+)*`, value)
-	if err != nil {
-		return err
-	}
-	if longSyntax {
-		csvReader := csv.NewReader(strings.NewReader(value))
-		fields, err := csvReader.Read()
-		if err != nil {
-			return err
-		}
-
-		pConfig := swarm.PortConfig{}
-		for _, field := range fields {
-			// TODO(thaJeztah): these options should not be case-insensitive.
-			key, val, ok := strings.Cut(strings.ToLower(field), "=")
-			if !ok || key == "" {
-				return fmt.Errorf("invalid field: %s", field)
-			}
-			switch key {
-			case portOptProtocol:
-				if val != string(swarm.PortConfigProtocolTCP) && val != string(swarm.PortConfigProtocolUDP) && val != string(swarm.PortConfigProtocolSCTP) {
-					return fmt.Errorf("invalid protocol value '%s'", val)
-				}
-
-				pConfig.Protocol = swarm.PortConfigProtocol(val)
-			case portOptMode:
-				if val != string(swarm.PortConfigPublishModeIngress) && val != string(swarm.PortConfigPublishModeHost) {
-					return fmt.Errorf("invalid publish mode value (%s): must be either '%s' or '%s'", val, swarm.PortConfigPublishModeIngress, swarm.PortConfigPublishModeHost)
-				}
-
-				pConfig.PublishMode = swarm.PortConfigPublishMode(val)
-			case portOptTargetPort:
-				tPort, err := strconv.ParseUint(val, 10, 16)
-				if err != nil {
-					var numErr *strconv.NumError
-					if errors.As(err, &numErr) {
-						err = numErr.Err
-					}
-					return fmt.Errorf("invalid target port (%s): value must be an integer: %w", val, err)
-				}
-
-				pConfig.TargetPort = uint32(tPort)
-			case portOptPublishedPort:
-				pPort, err := strconv.ParseUint(val, 10, 16)
-				if err != nil {
-					var numErr *strconv.NumError
-					if errors.As(err, &numErr) {
-						err = numErr.Err
-					}
-					return fmt.Errorf("invalid published port (%s): value must be an integer: %w", val, err)
-				}
-
-				pConfig.PublishedPort = uint32(pPort)
-			default:
-				return fmt.Errorf("invalid field key: %s", key)
-			}
-		}
-
-		if pConfig.TargetPort == 0 {
-			return fmt.Errorf("missing mandatory field '%s'", portOptTargetPort)
-		}
-
-		if pConfig.PublishMode == "" {
-			pConfig.PublishMode = swarm.PortConfigPublishModeIngress
-		}
-
-		if pConfig.Protocol == "" {
-			pConfig.Protocol = swarm.PortConfigProtocolTCP
-		}
-
-		p.ports = append(p.ports, pConfig)
-	} else {
-		// short syntax
-		portConfigs := []swarm.PortConfig{}
-		ports, portBindingMap, err := nat.ParsePortSpecs([]string{value})
-		if err != nil {
-			return err
-		}
-		for _, portBindings := range portBindingMap {
-			for _, portBinding := range portBindings {
-				if portBinding.HostIP != "" {
-					return errors.New("hostip is not supported")
-				}
-			}
-		}
-
-		for port := range ports {
-			portConfig, err := ConvertPortToPortConfig(port, portBindingMap)
-			if err != nil {
-				return err
-			}
-			portConfigs = append(portConfigs, portConfig...)
-		}
-		p.ports = append(p.ports, portConfigs...)
-	}
-	return nil
-}
-
-// Type returns the type of this option
-func (*PortOpt) Type() string {
-	return "port"
-}
-
-// String returns a string repr of this option
-func (p *PortOpt) String() string {
-	ports := []string{}
-	for _, port := range p.ports {
-		repr := fmt.Sprintf("%v:%v/%s/%s", port.PublishedPort, port.TargetPort, port.Protocol, port.PublishMode)
-		ports = append(ports, repr)
-	}
-	return strings.Join(ports, ", ")
-}
-
-// Value returns the ports
-func (p *PortOpt) Value() []swarm.PortConfig {
-	return p.ports
-}
-
-// ConvertPortToPortConfig converts ports to the swarm type
-func ConvertPortToPortConfig(
-	port nat.Port,
-	portBindings map[nat.Port][]nat.PortBinding,
-) ([]swarm.PortConfig, error) {
-	ports := []swarm.PortConfig{}
-
-	for _, binding := range portBindings[port] {
-		if p := net.ParseIP(binding.HostIP); p != nil && !p.IsUnspecified() {
-			// TODO(thaJeztah): use context-logger, so that this output can be suppressed (in tests).
-			logrus.Warnf("ignoring IP-address (%s:%s) service will listen on '0.0.0.0'", net.JoinHostPort(binding.HostIP, binding.HostPort), port)
-		}
-
-		startHostPort, endHostPort, err := nat.ParsePortRange(binding.HostPort)
-
-		if err != nil && binding.HostPort != "" {
-			return nil, fmt.Errorf("invalid hostport binding (%s) for port (%s)", binding.HostPort, port.Port())
-		}
-
-		for i := startHostPort; i <= endHostPort; i++ {
-			ports = append(ports, swarm.PortConfig{
-				// TODO Name: ?
-				Protocol:      swarm.PortConfigProtocol(strings.ToLower(port.Proto())),
-				TargetPort:    uint32(port.Int()),
-				PublishedPort: uint32(i),
-				PublishMode:   swarm.PortConfigPublishModeIngress,
-			})
-		}
-	}
-	return ports, nil
-}
@@ -1,99 +0,0 @@
-package swarmopts
-
-import (
-	"encoding/csv"
-	"errors"
-	"fmt"
-	"os"
-	"strconv"
-	"strings"
-
-	"github.com/docker/docker/api/types/swarm"
-)
-
-// SecretOpt is a Value type for parsing secrets
-type SecretOpt struct {
-	values []*swarm.SecretReference
-}
-
-// Set a new secret value
-func (o *SecretOpt) Set(value string) error {
-	csvReader := csv.NewReader(strings.NewReader(value))
-	fields, err := csvReader.Read()
-	if err != nil {
-		return err
-	}
-
-	options := &swarm.SecretReference{
-		File: &swarm.SecretReferenceFileTarget{
-			UID:  "0",
-			GID:  "0",
-			Mode: 0o444,
-		},
-	}
-
-	// support a simple syntax of --secret foo
-	if len(fields) == 1 && !strings.Contains(fields[0], "=") {
-		options.File.Name = fields[0]
-		options.SecretName = fields[0]
-		o.values = append(o.values, options)
-		return nil
-	}
-
-	for _, field := range fields {
-		key, val, ok := strings.Cut(field, "=")
-		if !ok || key == "" {
-			return fmt.Errorf("invalid field '%s' must be a key=value pair", field)
-		}
-		// TODO(thaJeztah): these options should not be case-insensitive.
-		switch strings.ToLower(key) {
-		case "source", "src":
-			options.SecretName = val
-		case "target":
-			options.File.Name = val
-		case "uid":
-			options.File.UID = val
-		case "gid":
-			options.File.GID = val
-		case "mode":
-			m, err := strconv.ParseUint(val, 0, 32)
-			if err != nil {
-				return fmt.Errorf("invalid mode specified: %v", err)
-			}
-
-			options.File.Mode = os.FileMode(m)
-		default:
-			return errors.New("invalid field in secret request: " + key)
-		}
-	}
-
-	if options.SecretName == "" {
-		return errors.New("source is required")
-	}
-	if options.File.Name == "" {
-		options.File.Name = options.SecretName
-	}
-
-	o.values = append(o.values, options)
-	return nil
-}
-
-// Type returns the type of this option
-func (*SecretOpt) Type() string {
-	return "secret"
-}
-
-// String returns a string repr of this option
-func (o *SecretOpt) String() string {
-	secrets := []string{}
-	for _, secret := range o.values {
-		repr := fmt.Sprintf("%s -> %s", secret.SecretName, secret.File.Name)
-		secrets = append(secrets, repr)
-	}
-	return strings.Join(secrets, ", ")
-}
-
-// Value returns the secret requests
-func (o *SecretOpt) Value() []*swarm.SecretReference {
-	return o.values
-}
@@ -1,5 +1,5 @@
 // FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
-//go:build go1.22
+//go:build go1.23

 package templates