[VAULT-43618] Resolve GHSA-x744-4wpc-v9h2 and GHSA-pxq6-2prw-chj9 in plugincontainer

plugincontainer/config.go

@@ -4,7 +4,7 @@
 package plugincontainer
 
 import (
-	"github.com/docker/docker/api/types/network"
+	"github.com/moby/moby/api/types/network"
 )
 
 // Config is used to opt in to running plugins inside a container.

plugincontainer/container_reattach_linux.go

@@ -7,24 +7,25 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/docker/docker/client"
+	"github.com/moby/moby/client"
+
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-plugin/runner"
 )
 
 func ReattachFunc(logger hclog.Logger, id, hostSocketDir string) (runner.AttachedRunner, error) {
-	client, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())
+	docker, err := client.New(client.FromEnv)
 	if err != nil {
 		return nil, err
 	}
 
-	_, err = client.ContainerInspect(context.Background(), id)
+	_, err = docker.ContainerInspect(context.Background(), id, client.ContainerInspectOptions{})
 	if err != nil {
 		return nil, fmt.Errorf("container with ID %s not found: %w", id, err)
 	}
 
 	return &containerRunner{
-		dockerClient:  client,
+		dockerClient:  docker,
 		logger:        logger,
 		id:            id,
 		hostSocketDir: hostSocketDir,

plugincontainer/container_runner_external_test.go

@@ -14,9 +14,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/docker/docker/api/types/filters"
-	"github.com/docker/docker/api/types/image"
-	"github.com/docker/docker/client"
+	"github.com/moby/moby/client"
+
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-plugin"
 	"github.com/hashicorp/go-secure-stdlib/plugincontainer"
@@ -42,16 +41,16 @@ func TestExamplePlugin(t *testing.T) {
 	}
 
 	// Get the full sha256 of the image we just built so we can test pinning.
-	images, err := dockerClient.ImageList(context.Background(), image.ListOptions{
-		Filters: filters.NewArgs(filters.Arg("reference", "go-plugin-counter:latest")),
+	images, err := dockerClient.ImageList(context.Background(), client.ImageListOptions{
+		Filters: make(client.Filters).Add("reference", "go-plugin-counter:latest"),
 	})
 	if err != nil {
 		t.Fatal(err)
 	}
-	if len(images) != 1 {
+	if len(images.Items) != 1 {
 		t.Fatal(err)
 	}
-	id := images[0].ID
+	id := images.Items[0].ID
 	sha256 := strings.TrimPrefix(id, "sha256:")
 
 	// Default docker runtime.

plugincontainer/container_runner_linux.go

@@ -15,17 +15,16 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/docker/docker/api/types/container"
-	"github.com/docker/docker/api/types/filters"
-	"github.com/docker/docker/api/types/image"
-	"github.com/docker/docker/api/types/mount"
-	"github.com/docker/docker/api/types/network"
-	"github.com/docker/docker/client"
-	"github.com/docker/docker/pkg/stdcopy"
+	"github.com/joshlf/go-acl"
+	"github.com/moby/moby/api/pkg/stdcopy"
+	"github.com/moby/moby/api/types/container"
+	"github.com/moby/moby/api/types/mount"
+	"github.com/moby/moby/api/types/network"
+	"github.com/moby/moby/client"
+
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-plugin"
 	"github.com/hashicorp/go-plugin/runner"
-	"github.com/joshlf/go-acl"
 )
 
 const pluginSocketDir = "/tmp/go-plugin-container"
@@ -64,7 +63,7 @@ func (cfg *Config) NewContainerRunner(logger hclog.Logger, cmd *exec.Cmd, hostSo
 		return nil, fmt.Errorf("image %q must not have any ':' characters, use the Tag field to specify a tag", cfg.Image)
 	}
 
-	client, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())
+	client, err := client.New(client.FromEnv)
 	if err != nil {
 		return nil, err
 	}
@@ -177,14 +176,14 @@ func (c *containerRunner) Start(ctx context.Context) error {
 			ref += ":" + c.tag
 		}
 		// Check the Image and SHA256 provided in the config match up.
-		images, err := c.dockerClient.ImageList(ctx, image.ListOptions{
-			Filters: filters.NewArgs(filters.Arg("reference", ref)),
+		images, err := c.dockerClient.ImageList(ctx, client.ImageListOptions{
+			Filters: make(client.Filters).Add("reference", ref),
 		})
 		if err != nil {
 			return fmt.Errorf("failed to verify that image %s matches with provided SHA256 hash %s: %w", ref, c.sha256, err)
 		}
 		var imageFound bool
-		for _, image := range images {
+		for _, image := range images.Items {
 			if image.ID == "sha256:"+c.sha256 {
 				imageFound = true
 				break
@@ -195,21 +194,25 @@ func (c *containerRunner) Start(ctx context.Context) error {
 		}
 	}
 
-	resp, err := c.dockerClient.ContainerCreate(ctx, c.containerConfig, c.hostConfig, c.networkConfig, nil, "")
+	resp, err := c.dockerClient.ContainerCreate(ctx, client.ContainerCreateOptions{
+		Config:           c.containerConfig,
+		HostConfig:       c.hostConfig,
+		NetworkingConfig: c.networkConfig,
+	})
 	if err != nil {
 		return fmt.Errorf("error creating container: %w", err)
 	}
 	c.id = resp.ID
 	c.logger.Trace("created container", "image", c.image, "id", c.id)
 
-	if err := c.dockerClient.ContainerStart(ctx, c.id, container.StartOptions{}); err != nil {
+	if _, err := c.dockerClient.ContainerStart(ctx, c.id, client.ContainerStartOptions{}); err != nil {
 		return fmt.Errorf("error starting container: %w", err)
 	}
 
 	// ContainerLogs combines stdout and stderr.
 	// Container logs will stream beyond the lifetime of the initial start
 	// context, so we pass it a fresh context with no timeout.
-	logReader, err := c.dockerClient.ContainerLogs(context.Background(), c.id, container.LogsOptions{
+	logReader, err := c.dockerClient.ContainerLogs(context.Background(), c.id, client.ContainerLogsOptions{
 		Follow:     true,
 		ShowStdout: true,
 		ShowStderr: true,
@@ -240,13 +243,15 @@ func (c *containerRunner) Start(ctx context.Context) error {
 }
 
 func (c *containerRunner) Wait(ctx context.Context) error {
-	statusCh, errCh := c.dockerClient.ContainerWait(ctx, c.id, container.WaitConditionNotRunning)
+	wait := c.dockerClient.ContainerWait(ctx, c.id, client.ContainerWaitOptions{
+		Condition: container.WaitConditionNotRunning,
+	})
 	select {
-	case err := <-errCh:
+	case err := <-wait.Error:
 		if err != nil {
 			return err
 		}
-	case st := <-statusCh:
+	case st := <-wait.Result:
 		if st.StatusCode != 0 {
 			c.logger.Error("plugin shut down with non-0 exit code", "id", c.id, "status", st.StatusCode)
 		}
@@ -266,15 +271,15 @@ func (c *containerRunner) Kill(ctx context.Context) error {
 	if c.id != "" {
 		if c.debug {
 			defer func() {
-				err := c.dockerClient.ContainerRemove(ctx, c.id, container.RemoveOptions{
+				_, err := c.dockerClient.ContainerRemove(ctx, c.id, client.ContainerRemoveOptions{
 					Force: true,
 				})
 				if err != nil {
 					c.logger.Error("error removing container", "error", err)
 				}
 			}()
 		}
-		err := c.dockerClient.ContainerStop(ctx, c.id, container.StopOptions{})
+		_, err := c.dockerClient.ContainerStop(ctx, c.id, client.ContainerStopOptions{})
 		if err != nil {
 			// Docker SDK does not seem to expose sentinel errors in a way we can
 			// use here instead of string matching.
@@ -361,10 +366,11 @@ func emptyStrSlice(s []string) bool {
 }
 
 func (c *containerRunner) diagnoseContainerInfo(ctx context.Context) string {
-	info, err := c.dockerClient.ContainerInspect(ctx, c.id)
+	res, err := c.dockerClient.ContainerInspect(ctx, c.id, client.ContainerInspectOptions{})
 	if err != nil {
 		return ""
 	}
+	info := res.Container
 
 	notes := "Container config:\n"
 	notes += fmt.Sprintf("Image: %s\n", info.Image)
@@ -401,7 +407,7 @@ Check stdout in the logs below.
 }
 
 func (c *containerRunner) diagnoseLogs(ctx context.Context) string {
-	logReader, err := c.dockerClient.ContainerLogs(ctx, c.id, container.LogsOptions{
+	logReader, err := c.dockerClient.ContainerLogs(ctx, c.id, client.ContainerLogsOptions{
 		ShowStdout: true,
 		ShowStderr: true,
 		Follow:     false,

plugincontainer/container_runner_linux_test.go

@@ -11,9 +11,9 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/docker/docker/api/types/network"
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-plugin"
+	"github.com/moby/moby/api/types/network"
 )
 
 // TestNewContainerRunner_config ensures all the config options passed in have

plugincontainer/go.mod

@@ -1,56 +1,47 @@
 module github.com/hashicorp/go-secure-stdlib/plugincontainer
 
-go 1.24
+go 1.25.5
 
 require (
-	github.com/docker/docker v28.3.3+incompatible
 	github.com/hashicorp/go-hclog v1.6.3
-	github.com/hashicorp/go-plugin v1.6.1
+	github.com/hashicorp/go-plugin v1.7.0
 	github.com/joshlf/go-acl v0.0.0-20200411065538-eae00ae38531
-	golang.org/x/sys v0.25.0
-	google.golang.org/grpc v1.67.0
-	google.golang.org/protobuf v1.34.2
+	github.com/moby/moby/api v1.54.0
+	github.com/moby/moby/client v0.3.0
+	golang.org/x/sys v0.42.0
+	google.golang.org/grpc v1.79.3
+	google.golang.org/protobuf v1.36.11
 )
 
 require (
-	github.com/Microsoft/go-winio v0.6.1 // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
-	github.com/containerd/log v0.1.0 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/distribution/reference v0.6.0 // indirect
-	github.com/docker/go-connections v0.4.0 // indirect
+	github.com/docker/go-connections v0.6.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
-	github.com/fatih/color v1.14.1 // indirect
+	github.com/fatih/color v1.19.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/hashicorp/yamux v0.1.1 // indirect
+	github.com/hashicorp/yamux v0.1.2 // indirect
 	github.com/joshlf/testutil v0.0.0-20170608050642-b5d8aa79d93d // indirect
-	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.17 // indirect
-	github.com/mitchellh/go-testing-interface v1.14.1 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/sys/atomicwriter v0.1.0 // indirect
-	github.com/moby/term v0.5.0 // indirect
-	github.com/morikuni/aec v1.0.0 // indirect
-	github.com/oklog/run v1.1.0 // indirect
+	github.com/oklog/run v1.2.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.0.2 // indirect
-	github.com/pkg/errors v0.9.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.51.0 // indirect
-	go.opentelemetry.io/otel v1.30.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.30.0 // indirect
-	go.opentelemetry.io/otel/metric v1.30.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.30.0 // indirect
-	go.opentelemetry.io/otel/trace v1.30.0 // indirect
-	golang.org/x/mod v0.17.0 // indirect
-	golang.org/x/net v0.29.0 // indirect
-	golang.org/x/sync v0.8.0 // indirect
-	golang.org/x/text v0.18.0 // indirect
-	golang.org/x/time v0.3.0 // indirect
-	golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1 // indirect
-	gotest.tools/v3 v3.5.0 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect
+	go.opentelemetry.io/otel v1.42.0 // indirect
+	go.opentelemetry.io/otel/metric v1.42.0 // indirect
+	go.opentelemetry.io/otel/trace v1.42.0 // indirect
+	golang.org/x/net v0.52.0 // indirect
+	golang.org/x/text v0.35.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260330182312-d5a96adf58d8 // indirect
 )