chore: upgrade github.com/docker/cli to v29 #1547

Open

aahlenst wants to merge 1 commit from aahlenst/runner:docker-29 into main

pull from: aahlenst/runner:docker-29

merge into: forgejo:main

forgejo:main

forgejo:renovate/go.etcd.io-bbolt-1.x

forgejo:renovate/github.com-powerman-fileuri-0.x

forgejo:renovate/forgejo-lxc-13.x

forgejo:validate-1460

forgejo:chore/testing-trixie

forgejo:chore/testing-bookworm

forgejo:expand-reusable-workflows-working-branch

forgejo:feat-default_actions_url-on-step

forgejo:2023-05-22-main-before-force-push

forgejo:2023-04-30-main-before-force-push

Conversation 5 Commits 1 Files changed 27 +1186 -843

aahlenst commented 2026-06-02 18:04:35 +00:00

Member

Copy link

github.com/docker/cli v29 brings multiple breaking changes due to changed method signatures. github.com/docker/docker has been deprecated and replaced with github.com/moby/moby/client and github.com/moby/moby/api.

• other
  • PR: chore: upgrade github.com/docker/cli to v29

github.com/docker/cli v29 brings multiple breaking changes due to changed method signatures. github.com/docker/docker has been deprecated and replaced with github.com/moby/moby/client and github.com/moby/moby/api. <!--start release-notes-assistant--> <!--URL:https://code.forgejo.org/forgejo/runner--> - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1547): <!--number 1547 --><!--line 0 --><!--description Y2hvcmU6IHVwZ3JhZGUgZ2l0aHViLmNvbS9kb2NrZXIvY2xpIHRvIHYyOQ==-->chore: upgrade github.com/docker/cli to v29<!--description--> <!--end release-notes-assistant-->

aahlenst force-pushed docker-29 from 63ff6aeb18 to 9f5a5046a6 2026-06-02 19:15:40 +00:00 Compare

aahlenst force-pushed docker-29 from 9f5a5046a6 to a4c12f58ec 2026-06-02 19:23:24 +00:00 Compare

aahlenst commented 2026-06-02 20:12:08 +00:00

Author

Member

Copy link

It looks like this update hits https://github.com/moby/moby/pull/49520 with the Docker version included in Debian 13. That's why the forgejo-runner exec job fails.

In short, Docker includes the network prefix in the gateway's address when creating IPv6 networks. This causes netip.ParseAddr() inside the Docker API to fail when fetching the list of networks. There isn't really a way around fetching the list of networks because we only have the network's name and need it's ID to operate on it.

Do we accept that and recommend that users that need IPv6 upgrade to the Docker version shipped by Docker?

It looks like this update hits https://github.com/moby/moby/pull/49520 with the Docker version included in Debian 13. That's why the `forgejo-runner exec` job fails. In short, Docker includes the network prefix in the gateway's address when creating IPv6 networks. This causes `netip.ParseAddr()` inside the Docker API to fail when fetching the list of networks. There isn't really a way around fetching the list of networks because we only have the network's name and need it's ID to operate on it. Do we accept that and recommend that users that need IPv6 upgrade to the Docker version shipped by Docker?

mfenniak commented 2026-06-06 01:22:19 +00:00

Owner

Copy link

@aahlenst wrote in #1547 (comment):

Do we accept that and recommend that users that need IPv6 upgrade to the Docker version shipped by Docker?

Hm... the docker-stable test runs on Debian Bookworm. Debian's primary support EOL for Bookworm is 10 June 2026... huh... that's rather soon... but then it transitions to long-term support until 2028. It's fairly reasonable to assume people will be running it for a while.

I understand this dependency upgrade isn't being done because of specific value added, but as an inevitable requirement. Eventually we'll want to use an API that requires an updated client, or be affected by a bug or security issue.

I think it seems reasonable to move forward with this change. Doesn't seem right for us to be stuck on a dependency because of a slow-moving distro with long-term support, especially when there's a pathway for such users to address it: update their Docker dependency independent of their OS.

I'm thinking we should consider it a breaking change, and document the minimum Docker version required for compatibility. And then... probably do a v13? We could tackle the other v13 issues that we've discussed in the same time. (We could either hold this PR and others unmerged, or, do a temporary v13 branch -- but keep main releasable for a few weeks while we get those v13 issues ready.)

@aahlenst wrote in https://code.forgejo.org/forgejo/runner/pulls/1547#issuecomment-89368: > Do we accept that and recommend that users that need IPv6 upgrade to the Docker version shipped by Docker? Hm... the docker-stable test runs on Debian Bookworm. Debian's primary support EOL for Bookworm is 10 June 2026... huh... that's rather soon... but then it transitions to [long-term support](https://wiki.debian.org/LTS) until 2028. It's fairly reasonable to assume people will be running it for a while. I understand this dependency upgrade isn't being done because of specific value added, but as an inevitable requirement. Eventually we'll want to use an API that requires an updated client, or be affected by a bug or security issue. I think it seems reasonable to move forward with this change. Doesn't seem right for us to be stuck on a dependency because of a slow-moving distro with long-term support, especially when there's a pathway for such users to address it: update their Docker dependency independent of their OS. I'm thinking we should consider it a breaking change, and document the minimum Docker version required for compatibility. And then... probably do a v13? We could tackle the other v13 issues that we've discussed in the same time. (We could either hold this PR and others unmerged, or, do a temporary v13 branch -- but keep `main` releasable for a few weeks while we get those v13 issues ready.)

aahlenst commented 2026-06-06 10:56:37 +00:00

Author

Member

Copy link

@mfenniak wrote in #1547 (comment):

Hm... the docker-stable test runs on Debian Bookworm. Debian's primary support EOL for Bookworm is 10 June 2026... huh... that's rather soon... but then it transitions to long-term support until 2028. It's fairly reasonable to assume people will be running it for a while.

Unfortunately, the impact is much bigger. My test machine uses Debian 13. That's Trixie. And it has the same problem. It affects Docker versions < 27. Interestingly, Canonical has added Docker 29 to Ubuntu 24.04.

Forgejo Runner is not the only software that seems to be affected.

I understand this dependency upgrade isn't being done because of specific value added, but as an inevitable requirement. Eventually we'll want to use an API that requires an updated client, or be affected by a bug or security issue.

Correct.

I'm thinking we should consider it a breaking change, and document the minimum Docker version required for compatibility. And then... probably do a v13?

Technically, the minimal version is 25.0. It's only a problem if you run into that Docker bug with IPv6. Doing a major version because of that seems kinda... extreme?

Lobbying the Moby folks to make their parsing more lenient would be a possibility, too.

If we decide to do v13, my preference would be a temporary branch. Fewer merge conflicts, easier to test, ...

@mfenniak wrote in https://code.forgejo.org/forgejo/runner/pulls/1547#issuecomment-90706: > Hm... the docker-stable test runs on Debian Bookworm. Debian's primary support EOL for Bookworm is 10 June 2026... huh... that's rather soon... but then it transitions to [long-term support](https://wiki.debian.org/LTS) until 2028. It's fairly reasonable to assume people will be running it for a while. Unfortunately, the impact is much bigger. My test machine uses Debian 13. That's Trixie. And it has the same problem. It affects Docker versions < 27. Interestingly, Canonical has added Docker 29 to Ubuntu 24.04. Forgejo Runner is not the only software that seems to be affected. > I understand this dependency upgrade isn't being done because of specific value added, but as an inevitable requirement. Eventually we'll want to use an API that requires an updated client, or be affected by a bug or security issue. Correct. > I'm thinking we should consider it a breaking change, and document the minimum Docker version required for compatibility. And then... probably do a v13? Technically, the [minimal version is 25.0](https://github.com/moby/moby/releases/tag/docker-v29.0.0). It's only a problem if you run into that Docker bug with IPv6. Doing a major version because of that seems kinda... extreme? Lobbying the Moby folks to make their parsing more lenient would be a possibility, too. If we decide to do v13, my preference would be a temporary branch. Fewer merge conflicts, easier to test, ...

mfenniak commented 2026-06-06 13:57:57 +00:00

Owner

Copy link

@aahlenst wrote in #1547 (comment):

Technically, the minimal version is 25.0. It's only a problem if you run into that Docker bug with IPv6. Doing a major version because of that seems kinda... extreme?

Link is to v29, text says v25?

My thought process on a major version is kinda simple: we did v12.0.0 when we added git as an external dependency, and the release of this PR would bump the minimum supported version of an external dependency.

I guess it could be argued that the combination of having an IPv6 network on your Docker system, and using a >6 month old Docker release, may not be a common combination. But we do know there are users with the IPv6 facet at least (#1399, #119). And I'm not sure if common matters, as we're planning other v13 things that also won't affect common users (eg. removing DOCKER_PASSWORD). The major version bump just waves a small flag to people saying, "pay attention on this upgrade".

@aahlenst wrote in https://code.forgejo.org/forgejo/runner/pulls/1547#issuecomment-90728: > Technically, the [minimal version is 25.0](https://github.com/moby/moby/releases/tag/docker-v29.0.0). It's only a problem if you run into that Docker bug with IPv6. Doing a major version because of that seems kinda... extreme? Link is to v29, text says v25? My thought process on a major version is kinda simple: we did v12.0.0 when we added `git` as an external dependency, and the release of this PR would bump the minimum supported version of an external dependency. I guess it could be argued that the combination of having an IPv6 network on your Docker system, and using a >6 month old Docker release, may not be a common combination. But we do know there are users with the IPv6 facet at least (#1399, #119). And I'm not sure if common matters, as we're planning other v13 things that also won't affect common users (eg. removing `DOCKER_PASSWORD`). The major version bump just waves a small flag to people saying, "pay attention on this upgrade".

aahlenst commented 2026-06-06 14:14:21 +00:00

Author

Member

Copy link

@mfenniak wrote in #1547 (comment):

Link is to v29, text says v25?

Yes, because we would update to v29 and the oldest supported version of v29 is documented in there.

The major version bump just waves a small flag to people saying, "pay attention on this upgrade".

I'm not opposed. Waiting forever makes upgrading more painful.

@mfenniak wrote in https://code.forgejo.org/forgejo/runner/pulls/1547#issuecomment-90735: > Link is to v29, text says v25? Yes, because we would update to v29 and the oldest supported version of v29 is documented in there. > The major version bump just waves a small flag to people saying, "pay attention on this upgrade". I'm not opposed. Waiting forever makes upgrading more painful.

viceice referenced this pull request 2026-07-07 10:52:16 +00:00

Update module github.com/docker/cli to v29 [SECURITY] #1584

viceice referenced this pull request 2026-07-07 10:52:32 +00:00

Update module github.com/docker/go-connections to v0.7.0 #1562

Some checks failed

Hide checks

cascade / debug (pull_request_target) Has been skipped

Required

Details

cascade / forgejo (pull_request_target) Has been skipped

Required

Details

cascade / end-to-end (pull_request_target) Has been skipped

Required

Details

issue-labels / release-notes (pull_request_target) Successful in 6s

Details

checks / validate mocks (pull_request) Successful in 26s

Details

checks / Build Forgejo Runner (pull_request) Successful in 27s

Required

Details

checks / validate pre-commit-hooks file (pull_request) Successful in 34s

Details

checks / Build unsupported platforms (pull_request) Successful in 18s

Details

checks / runner exec tests (pull_request) Failing after 21s

Required

Details

Integration tests for the release process / release-simulation (pull_request) Successful in 4m29s

Details

checks / Run integration tests with Docker (docker-latest) (pull_request) Successful in 10m15s

Required

Details

checks / Run integration tests with Podman (pull_request) Successful in 11m34s

Required

Details

checks / Run integration tests with Docker (docker-stable) (pull_request) Successful in 12m27s

Required

Details

This pull request has changes conflicting with the target branch.

• act/container/docker/endpoint.go
• act/container/docker/images_test.go
• act/container/docker/run_test.go
• act/runner/runner_test.go
• go.sum

View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Merge commit title chore: upgrade github.com/docker/cli to v29 (#1547)

Merge commit body Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1547

chore: upgrade github.com/docker/cli to v29 (#1547) Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1547 Copy merge commit message

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u docker-29:aahlenst-docker-29

git switch aahlenst-docker-29

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

FreeBSD

  

Kind/Breaking

Breaking change that won't be backward compatible

  

Kind/Bug

Something is not working

  

Kind/Chore

It is no fun but it needs to be done, this is a chore.

  

Kind/DependencyUpdate

for pull requests that are created by renovate when updating a dependency

  

Kind/Documentation

Documentation changes

  

Kind/Enhancement

Improve existing functionality

  

Kind/Feature

New functionality

  

Kind/Security

This is security issue

  

Kind/Testing

Issue or pull request related to testing

  

Priority

Critical

The priority is critical

  

Priority

High

The priority is high

  

Priority

Low

The priority is low

  

Priority

Medium

The priority is medium

  

Reviewed

Confirmed

Issue has been confirmed

  

Reviewed

Duplicate

This issue or pull request already exists

  

Reviewed

Invalid

Invalid issue

  

Reviewed

Won't Fix

This issue won't be fixed

  

Status

Abandoned

Somebody has started to work on this but abandoned work

  

Status

Blocked

Something is blocking this issue or pull request

  

Status

Need More Info

Feedback is required to reproduce issue or to continue work

  

Windows

Windows ports is an independent project, see https://github.com/Crown0815/Forgejo-runner-windows-builder

  

linux-powerpc64le

powerpc64le

  

linux-riscv64

  

linux-s390x

  

run-end-to-end-tests

Run https://code.forgejo.org/forgejo/end-to-end with a runner compiled from this pull request

  

run-forgejo-tests

Run https://codeberg.org/forgejo/forgejo tests importing the runner from this pull request

  

run-multi-platform-tests

Label a PR for automatic execution of test suite on arm64 architecture.

No labels

FreeBSD

Kind/Breaking

Kind/Bug

Kind/Chore

Kind/DependencyUpdate

Kind/Documentation

Kind/Enhancement

Kind/Feature

Kind/Security

Kind/Testing

Priority

Critical

Priority

High

Priority

Low

Priority

Medium

Reviewed

Confirmed

Reviewed

Duplicate

Reviewed

Invalid

Reviewed

Won't Fix

Status

Abandoned

Status

Blocked

Status

Need More Info

Windows

linux-powerpc64le

linux-riscv64

linux-s390x

run-end-to-end-tests

run-forgejo-tests

run-multi-platform-tests

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

forgejo/runner!1547

No description provided.