Cgroup adopt

.devcontainer/devcontainer.json

@@ -5,8 +5,8 @@
     "dockerfile": "../Dockerfile",
     "target": "devcontainer"
   },
-  "workspaceFolder": "/go/src/github.com/docker/docker",
-  "workspaceMount": "source=${localWorkspaceFolder},target=/go/src/github.com/docker/docker,type=bind,consistency=cached",
+  "workspaceFolder": "/usr/src/moby",
+  "workspaceMount": "source=${localWorkspaceFolder},target=${containerWorkspaceFolder},type=bind,consistency=cached",
 
   "remoteUser": "root",
   "runArgs": ["--privileged"],

.gitattributes

@@ -1 +1,8 @@
 Dockerfile* linguist-language=Dockerfile
+
+*.c    diff=cpp
+*.h    diff=cpp
+*.go   diff=golang
+*.md   diff=markdown
+*.py   diff=python
+*.sh   diff=bash

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,8 +1,8 @@
 name: Bug report
 description: Create a report to help us improve
+type: "bug"
 labels:
   - kind/bug
-  - status/0-triage
 body:
   - type: markdown
     attributes:

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,8 +1,8 @@
 name: Feature request
 description: Missing functionality? Come tell us about it!
+type: "enhancement"
 labels:
   - kind/feature
-  - status/0-triage
 body:
   - type: textarea
     id: description

.github/PULL_REQUEST_TEMPLATE.md

@@ -2,35 +2,40 @@
 Please make sure you've read and understood our contributing guidelines;
 https://github.com/moby/moby/blob/master/CONTRIBUTING.md
 
-** Make sure all your commits include a signature generated with `git commit -s` **
+Make sure commits are signed off (`git commit -s`) with your real name.
 
-For additional information on our contributing process, read our contributing
-guide https://github.com/moby/moby/blob/master/docs/contributing/
+To explicitly stress-test specific integration tests for flakiness in CI,
+add a /flaky-check directive anywhere in the PR body (outside of comments):
+  /flaky-check=TestFoo,TestBar
 
-If this is a bug fix, make sure your description includes "fixes #xxxx", or
-"closes #xxxx"
+If the PR relates to an existing issue or PR, mention it at the top:
 
-Please provide the following information:
+- Fixes: https://github.com/moby/moby/issues/12345678
+- Replaces: https://github.com/moby/moby/pull/12345678
+- Follow up to: https://github.com/moby/moby/pull/12345678
+- Related to: https://github.com/moby/moby/issues/12345678
 -->
 
-**- What I did**
+## Summary
 
-**- How I did it**
+## Release notes (optional)
 
-**- How to verify it**
-
-**- Human readable description for the release notes**
 <!--
-Write a short (one line) summary that describes the changes in this
-pull request for inclusion in the changelog.
-It must be placed inside the below triple backticks section.
+One-sentence user-facing release note.
+Leave empty if the change is not changelog-worthy.
+Use present tense and imperative tone.
+
+Good:
+- Fix a panic when running `docker top` on a non-running Windows container.
+- Don't print warnings in `docker info` for broken symlinks in CLI plugin directories.
 
-NOTE: Only fill this section if changes introduced in this PR are user-facing.
-The PR must have a relevant impact/ label.
+Bad:
+- Refactor test TestFooWithBar
+- Fixed a panic when running docker top
 -->
+
 ```markdown changelog
 
 ```
 
-**- A picture of a cute animal (not mandatory but encouraged)**
-
+## A picture of a cute animal (not mandatory but encouraged)

.github/copilot-instructions.md

@@ -0,0 +1,2 @@
+- When reviewing pull requests, do not rely only on the PR title, labels, or autogenerated dependency bump message. Inspect the actual diff and describe the likely behavioral, build, test, security, and compatibility impact.
+- For changes that appear mechanical, check whether they affect daemon behavior, client behavior, API compatibility, packaging, CI reliability, supported platforms, or released artifacts.

.github/instructions/review-ci-and-action-bumps.instructions.md

@@ -0,0 +1,15 @@
+# Review CI and action bumps carefully
+
+For GitHub Actions, CI, toolchain, base image, or packaging bump PRs, review the effective change, not just the version or SHA update.
+
+Check for impact on:
+
+- workflow permissions and token usage
+- defaults, inputs, deprecated behavior, and runner compatibility
+- test reliability and coverage
+- release, packaging, provenance, and published artifacts
+- cache behavior, artifact handling, reproducibility, and multi-platform builds
+
+Do not approve only because the change is in workflows, is SHA-pinned, or CI passes.
+
+In the review summary, state what changed, what was inspected, and any remaining risk or recommended verification.

.github/instructions/review-go-dependency-bumps.instructions.md

@@ -0,0 +1,15 @@
+# Review Go dependency bumps carefully
+
+For Go module, `go.sum`, and `vendor/` bump PRs, review the actual code changes, not just the version bump.
+
+Check for impact on:
+
+- daemon or API behavior
+- container runtime, networking, storage, archive, registry, and BuildKit-related paths
+- syscall, namespace, cgroup, mount, or rootless behavior
+- transitive dependency changes
+- major version jumps, default changes, error handling changes, or hidden logic changes in vendored churn
+
+Do not approve only because the PR is autogenerated, the version bump is small, or CI passes.
+
+In the review summary, state what changed, what relevant code paths were inspected, and any remaining risk or need for targeted testing.

.github/labeler.yml

@@ -36,6 +36,7 @@ area/networking:
       - 'api/types/network/**'
       - 'daemon/network*'
       - 'daemon/network/**'
+      - 'daemon/libnetwork/**'
       - 'integration/network/**'
       - 'integration/networking/**'
 

.github/renovate.json5

@@ -9,6 +9,8 @@
     ":gitSignOff"
   ],
   "postUpdateOptions": ["gomodTidy"],
+  "minimumReleaseAge": "3 days",
+  "internalChecksFilter": "strict",
   "packageRules": [
     {
       "matchManagers": ["gomod"],

.github/workflows/.dco.yml

@@ -19,7 +19,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       -
@@ -48,7 +48,9 @@ jobs:
             -w /workspace \
             -e VALIDATE_REPO \
             -e VALIDATE_BRANCH \
+            -e VALIDATE_ORIGIN_BRANCH \
             alpine:${{ env.ALPINE_VERSION }} sh -c 'apk add --no-cache -q bash git openssh-client && git config --system --add safe.directory /workspace && hack/validate/dco'
         env:
           VALIDATE_REPO: ${{ github.server_url }}/${{ github.repository }}.git
           VALIDATE_BRANCH: ${{ steps.base-ref.outputs.result }}
+          VALIDATE_ORIGIN_BRANCH: ${{ github.event.pull_request.base.sha || '' }}

.github/workflows/.test-unit.yml

@@ -8,20 +8,29 @@ permissions:
 
 on:
   workflow_call:
+    inputs:
+      arch:
+        required: false
+        type: string
+        default: amd64
+      runnerSuffix:
+        required: false
+        type: string
+        default: ""
     secrets:
       CODECOV_TOKEN:
         required: false
 
 env:
-  GO_VERSION: "1.26.2"
+  GO_VERSION: "1.26.5"
   GOTESTLIST_VERSION: v0.3.1
   TESTSTAT_VERSION: v0.1.25
   SETUP_BUILDX_VERSION: edge
   SETUP_BUILDKIT_IMAGE: moby/buildkit:latest
 
 jobs:
   unit:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-24.04${{ inputs.runnerSuffix }}
     timeout-minutes: 120 # guardrails timeout for the whole job
     continue-on-error: ${{ github.event_name != 'pull_request' }}
     strategy:
@@ -33,31 +42,32 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       -
         name: Set up runner
         uses: ./.github/actions/setup-runner
       -
         name: Prepare
         env:
+          ARCH: ${{ inputs.arch }}
           MODE: ${{ matrix.mode }}
         run: |
-          CACHE_DEV_SCOPE=dev
+          CACHE_DEV_SCOPE=dev-${ARCH}
           if [[ "$MODE" == *"firewalld"* ]]; then
             echo "FIREWALLD=true" >> $GITHUB_ENV
-            CACHE_DEV_SCOPE="${CACHE_DEV_SCOPE}firewalld"
+            CACHE_DEV_SCOPE="dev-firewalld-${ARCH}"
           fi
           echo "CACHE_DEV_SCOPE=${CACHE_DEV_SCOPE}" >> $GITHUB_ENV
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
         with:
           version: ${{ env.SETUP_BUILDX_VERSION }}
           driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }}
           buildkitd-flags: --debug
       -
         name: Build dev image
-        uses: docker/bake-action@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
+        uses: docker/bake-action@6614cfa25eff9a0b2b2697efb0b6159e7680d584 # v7.2.0
         with:
           targets: dev
           set: |
@@ -77,18 +87,18 @@ jobs:
           tree -nh /tmp/reports
       -
         name: Send to Codecov
-        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6.0.2
         with:
           directory: ./bundles
           env_vars: RUNNER_OS
-          flags: unit
+          flags: unit,${{ inputs.arch }}
           token: ${{ secrets.CODECOV_TOKEN }}  # used to upload coverage reports: https://github.com/moby/buildkit/pull/4660#issue-2142122533
       -
         name: Upload reports
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: test-reports-unit--${{ matrix.mode }}
+          name: test-reports-unit-${{ inputs.arch }}-${{ matrix.mode }}
           path: /tmp/reports/*
           retention-days: 1
 
@@ -110,7 +120,7 @@ jobs:
         name: Download reports
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          pattern: test-reports-unit-*
+          pattern: test-reports-unit-${{ inputs.arch }}-*
           path: /tmp/reports
       -
         name: Install teststat
@@ -119,4 +129,6 @@ jobs:
       -
         name: Create summary
         run: |
-          find /tmp/reports -type f -name '*-go-test-report.json' -exec teststat -markdown {} \+ >> $GITHUB_STEP_SUMMARY
+          if [ -d /tmp/reports ]; then
+            find /tmp/reports -type f -name '*-go-test-report.json' -exec teststat -markdown {} \+ >> "$GITHUB_STEP_SUMMARY"
+          fi