Cgroup adopt

.devcontainer/devcontainer.json

@@ -5,8 +5,8 @@
     "dockerfile": "../Dockerfile",
     "target": "devcontainer"
   },
-  "workspaceFolder": "/go/src/github.com/docker/docker",
-  "workspaceMount": "source=${localWorkspaceFolder},target=/go/src/github.com/docker/docker,type=bind,consistency=cached",
+  "workspaceFolder": "/usr/src/moby",
+  "workspaceMount": "source=${localWorkspaceFolder},target=${containerWorkspaceFolder},type=bind,consistency=cached",
 
   "remoteUser": "root",
   "runArgs": ["--privileged"],

.gitattributes

@@ -1 +1,8 @@
 Dockerfile* linguist-language=Dockerfile
+
+*.c    diff=cpp
+*.h    diff=cpp
+*.go   diff=golang
+*.md   diff=markdown
+*.py   diff=python
+*.sh   diff=bash

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,8 +1,8 @@
 name: Bug report
 description: Create a report to help us improve
+type: "bug"
 labels:
   - kind/bug
-  - status/0-triage
 body:
   - type: markdown
     attributes:

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,8 +1,8 @@
 name: Feature request
 description: Missing functionality? Come tell us about it!
+type: "enhancement"
 labels:
   - kind/feature
-  - status/0-triage
 body:
   - type: textarea
     id: description

.github/ISSUE_TEMPLATE/flaky_test.yml

@@ -0,0 +1,22 @@
+name: Flaky test
+description: Report a test that fails intermittently
+title: "Flaky test: "
+type: "bug"
+labels:
+  - flaky
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: Add optional context, such as CI links, affected platforms or jobs, passing runs, frequency, suspected cause, or related issues
+    validations:
+      required: false
+  - type: textarea
+    id: failure_output
+    attributes:
+      label: Failure output
+      description: Paste the complete failure output, including the fully qualified test name
+      render: text
+    validations:
+      required: false

.github/PULL_REQUEST_TEMPLATE.md

@@ -2,35 +2,40 @@
 Please make sure you've read and understood our contributing guidelines;
 https://github.com/moby/moby/blob/master/CONTRIBUTING.md
 
-** Make sure all your commits include a signature generated with `git commit -s` **
+Make sure commits are signed off (`git commit -s`) with your real name.
 
-For additional information on our contributing process, read our contributing
-guide https://github.com/moby/moby/blob/master/docs/contributing/
+To explicitly stress-test specific integration tests for flakiness in CI,
+add a /flaky-check directive anywhere in the PR body (outside of comments):
+  /flaky-check=TestFoo,TestBar
 
-If this is a bug fix, make sure your description includes "fixes #xxxx", or
-"closes #xxxx"
+If the PR relates to an existing issue or PR, mention it at the top:
 
-Please provide the following information:
+- Fixes: https://github.com/moby/moby/issues/12345678
+- Replaces: https://github.com/moby/moby/pull/12345678
+- Follow up to: https://github.com/moby/moby/pull/12345678
+- Related to: https://github.com/moby/moby/issues/12345678
 -->
 
-**- What I did**
+## Summary
 
-**- How I did it**
+## Release notes (optional)
 
-**- How to verify it**
-
-**- Human readable description for the release notes**
 <!--
-Write a short (one line) summary that describes the changes in this
-pull request for inclusion in the changelog.
-It must be placed inside the below triple backticks section.
+One-sentence user-facing release note.
+Leave empty if the change is not changelog-worthy.
+Use present tense and imperative tone.
+
+Good:
+- Fix a panic when running `docker top` on a non-running Windows container.
+- Don't print warnings in `docker info` for broken symlinks in CLI plugin directories.
 
-NOTE: Only fill this section if changes introduced in this PR are user-facing.
-The PR must have a relevant impact/ label.
+Bad:
+- Refactor test TestFooWithBar
+- Fixed a panic when running docker top
 -->
+
 ```markdown changelog
 
 ```
 
-**- A picture of a cute animal (not mandatory but encouraged)**
-
+## A picture of a cute animal (not mandatory but encouraged)

.github/actions/ensure-windows-docker/action.yml

@@ -0,0 +1,31 @@
+name: 'Ensure Windows Docker'
+description: 'Ensure the Docker daemon is ready on Windows runners'
+
+runs:
+  using: composite
+  steps:
+    - run: |
+        $tries = 30
+        Write-Host "Waiting for Docker daemon..."
+        while ($true) {
+          $ErrorActionPreference = "SilentlyContinue"
+          docker version 2>&1 | Out-Null
+          $ok = ($LastExitCode -eq 0)
+          $ErrorActionPreference = "Stop"
+          if ($ok) { break }
+          # Check if Docker service exists and try to start it if stopped
+          $svc = Get-Service docker -ErrorAction SilentlyContinue
+          if ($svc) {
+            if ($svc.Status -ne 'Running') {
+              Write-Host "Docker service status: $($svc.Status) - attempting to start..."
+              Start-Service docker -ErrorAction SilentlyContinue
+            }
+          } else {
+            Write-Host "Docker service not found!"
+          }
+          $tries--
+          if ($tries -le 0) { throw "Docker daemon did not become ready" }
+          Start-Sleep -Seconds 2
+        }
+        docker info
+      shell: pwsh

.github/actions/setup-windows-test-daemon/action.yml

@@ -0,0 +1,121 @@
+name: 'Setup Windows test daemon'
+description: 'Set up the Windows test daemon as a service'
+
+inputs:
+  bin_out:
+    description: 'Path containing the Docker binaries'
+    required: true
+  containerd:
+    description: 'Containerd mode (embedded or external)'
+    required: true
+  runtime:
+    description: 'Runtime mode (containerd or legacy)'
+    required: true
+  storage:
+    description: 'Storage mode (snapshotter or graphdriver)'
+    required: true
+
+runs:
+  using: composite
+  steps:
+    -
+      # Docker is not installed as a PackageManagement package, so remove its
+      # service directly to let the test daemon register under the same name.
+      name: Removing current daemon
+      shell: pwsh
+      run: |
+        if (Get-Service docker -ErrorAction SilentlyContinue) {
+          $dockerVersion = (docker version -f "{{.Server.Version}}")
+          Write-Host "Current installed Docker version: $dockerVersion"
+          # remove service
+          Stop-Service -Force -Name docker
+          Remove-Service -Name docker
+          # removes event log entry. we could use "Remove-EventLog -LogName -Source docker"
+          # but this cmd is not available atm
+          $ErrorActionPreference = "SilentlyContinue"
+          & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\docker" /f 2>&1 | Out-Null
+          $ErrorActionPreference = "Stop"
+          Write-Host "Service removed"
+        }
+    -
+      name: Starting test daemon
+      shell: pwsh
+      env:
+        BIN_OUT: ${{ inputs.bin_out }}
+        INPUT_CONTAINERD: ${{ inputs.containerd }}
+        INPUT_RUNTIME: ${{ inputs.runtime }}
+        INPUT_STORAGE: ${{ inputs.storage }}
+      run: |
+        Write-Host "Creating service"
+        $args = @(
+          "--debug",
+          "--host=npipe:////./pipe/docker_engine", `
+          "--data-root=$env:TEMP\moby-root", `
+          "--exec-root=$env:TEMP\moby-exec", `
+          "--pidfile=$env:TEMP\docker.pid", `
+          "--register-service"
+        )
+        If ($env:INPUT_CONTAINERD -eq "embedded") {
+          $args += "--feature=embedded-containerd"
+        } ElseIf ($env:INPUT_RUNTIME -eq "containerd") {
+          $args += "--default-runtime=io.containerd.runhcs.v1"
+          echo "DOCKER_WINDOWS_CONTAINERD_RUNTIME=1" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf-8 -Append
+        }
+        if ($env:INPUT_STORAGE -eq "snapshotter") {
+          $args += "--feature=containerd-snapshotter"
+        }
+        New-Item -ItemType Directory "$env:TEMP\moby-root" -ErrorAction SilentlyContinue | Out-Null
+        New-Item -ItemType Directory "$env:TEMP\moby-exec" -ErrorAction SilentlyContinue | Out-Null
+        Start-Process -Wait -NoNewWindow "$env:BIN_OUT\dockerd" -ArgumentList $args
+        # Make the env-var visible to the service-managed dockerd, as there's no CLI flag for this option.
+        $dockerEnviron = @("DOCKER_MIN_API_VERSION=1.24")
+        $dockerEnviron += @(Get-Item Env:\OTEL_* -ErrorAction SilentlyContinue | ForEach-Object { "$($_.Name)=$($_.Value)" })
+        If ($env:INPUT_STORAGE -eq "graphdriver") {
+          $dockerEnviron += @("TEST_INTEGRATION_USE_GRAPHDRIVER=1")
+          echo "TEST_INTEGRATION_USE_GRAPHDRIVER=1" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf-8 -Append
+        }
+        If ($env:INPUT_CONTAINERD -eq "embedded") {
+          $dockerEnviron += @("TEST_INTEGRATION_CONTAINERD_EMBEDDED=1")
+          echo "TEST_INTEGRATION_CONTAINERD_EMBEDDED=1" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf-8 -Append
+        }
+        New-ItemProperty -Name "Environment" -Path "HKLM:\SYSTEM\CurrentControlSet\Services\docker" -PropertyType MultiString -Value $dockerEnviron
+        Write-Host "Starting service"
+        Start-Service -Name docker
+        Write-Host "Service started successfully!"
+    -
+      name: Waiting for test daemon to start
+      shell: pwsh
+      env:
+        BIN_OUT: ${{ inputs.bin_out }}
+        INPUT_CONTAINERD: ${{ inputs.containerd }}
+        INPUT_RUNTIME: ${{ inputs.runtime }}
+        DOCKER_HOST: npipe:////./pipe/docker_engine
+      run: |
+        $tries=20
+        Write-Host "Waiting for the test daemon to start..."
+        While ($true) {
+          $ErrorActionPreference = "SilentlyContinue"
+          & "$env:BIN_OUT\docker" version
+          $ErrorActionPreference = "Stop"
+          If ($LastExitCode -eq 0) {
+            break
+          }
+          $tries--
+          If ($tries -le 0) {
+            Throw "Failed to get a response from the daemon"
+          }
+          Write-Host -NoNewline "."
+          Start-Sleep -Seconds 1
+        }
+        Write-Host "Test daemon started and replied!"
+        If ($env:INPUT_CONTAINERD -eq "external" -and $env:INPUT_RUNTIME -eq "containerd") {
+          $containerdProcesses = Get-Process -Name containerd -ErrorAction:SilentlyContinue
+          If (-not $containerdProcesses) {
+            Throw "containerd process is not running"
+          } else {
+            foreach ($process in $containerdProcesses) {
+              $processPath = (Get-Process -Id $process.Id -FileVersionInfo).FileName
+              Write-Output "Running containerd instance binary Path: $($processPath)"
+            }
+          }
+        }

.github/copilot-instructions.md

@@ -0,0 +1,2 @@
+- When reviewing pull requests, do not rely only on the PR title, labels, or autogenerated dependency bump message. Inspect the actual diff and describe the likely behavioral, build, test, security, and compatibility impact.
+- For changes that appear mechanical, check whether they affect daemon behavior, client behavior, API compatibility, packaging, CI reliability, supported platforms, or released artifacts.

.github/instructions/review-ci-and-action-bumps.instructions.md

@@ -0,0 +1,15 @@
+# Review CI and action bumps carefully
+
+For GitHub Actions, CI, toolchain, base image, or packaging bump PRs, review the effective change, not just the version or SHA update.
+
+Check for impact on:
+
+- workflow permissions and token usage
+- defaults, inputs, deprecated behavior, and runner compatibility
+- test reliability and coverage
+- release, packaging, provenance, and published artifacts
+- cache behavior, artifact handling, reproducibility, and multi-platform builds
+
+Do not approve only because the change is in workflows, is SHA-pinned, or CI passes.
+
+In the review summary, state what changed, what was inspected, and any remaining risk or recommended verification.

.github/instructions/review-go-dependency-bumps.instructions.md

@@ -0,0 +1,15 @@
+# Review Go dependency bumps carefully
+
+For Go module, `go.sum`, and `vendor/` bump PRs, review the actual code changes, not just the version bump.
+
+Check for impact on:
+
+- daemon or API behavior
+- container runtime, networking, storage, archive, registry, and BuildKit-related paths
+- syscall, namespace, cgroup, mount, or rootless behavior
+- transitive dependency changes
+- major version jumps, default changes, error handling changes, or hidden logic changes in vendored churn
+
+Do not approve only because the PR is autogenerated, the version bump is small, or CI passes.
+
+In the review summary, state what changed, what relevant code paths were inspected, and any remaining risk or need for targeted testing.

.github/labeler.yml

@@ -36,6 +36,7 @@ area/networking:
       - 'api/types/network/**'
       - 'daemon/network*'
       - 'daemon/network/**'
+      - 'daemon/libnetwork/**'
       - 'integration/network/**'
       - 'integration/networking/**'
 

.github/renovate.json5

@@ -9,13 +9,42 @@
     ":gitSignOff"
   ],
   "postUpdateOptions": ["gomodTidy"],
+  "minimumReleaseAge": "3 days",
+  "internalChecksFilter": "strict",
+  "customManagers": [
+    {
+      "customType": "regex",
+      "managerFilePatterns": ["/^Dockerfile$/"],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+) versioning=(?<versioning>\\S+)[ \\t]*\\r?\\n[ \\t]*ARG[ \\t]+\\w+=(?<currentValue>\\S+)"
+      ]
+    },
+    {
+      "customType": "regex",
+      "managerFilePatterns": ["/^hack/make\\.ps1$/"],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+) versioning=(?<versioning>\\S+)[ \\t]*\\r?\\n[ \\t]*\\$\\w+[ \\t]*=[ \\t]*\"(?<currentValue>[^\"]+)\""
+      ]
+    }
+  ],
   "packageRules": [
+    {
+      "matchDatasources": ["docker", "github-tags"],
+      "matchDepNames": ["docker/buildx-bin", "docker/cli"],
+      "minimumReleaseAge": "0 days"
+    },
     {
       "matchManagers": ["gomod"],
       "groupName": "golang.org/x packages",
       "groupSlug": "golang-x",
       "matchDepNames": ["/^golang\\.org\\/x\\//"]
     },
+    {
+      "matchManagers": ["github-actions"],
+      "groupName": "docker GitHub Actions",
+      "groupSlug": "docker-actions",
+      "matchDepNames": ["/^docker\\//"]
+    },
     {
       // Keep all the google.golang.org/genproto modules at the same version.
       "matchManagers": ["gomod"],