Migrate container client to moby/moby modules

github.com/docker/docker is deprecated as of Docker v29 (November
2025) and is frozen: it receives no further releases, including fixes
for the daemon-side advisories CVE-2026-33997 and CVE-2026-34040 that
govulncheck currently suppresses for this project. Upstream now ships
the maintained client and API types as the split modules
github.com/moby/moby/client and github.com/moby/moby/api, both of
which ToolHive already requires.

Migrate pkg/container/docker and pkg/container/images off
github.com/docker/docker/{client,api/types,pkg/stdcopy} and
github.com/docker/go-connections/nat onto github.com/moby/moby/client
and github.com/moby/moby/api. The new client exposes a redesigned
surface, so call sites are adapted to the per-operation
Options/Result structs, the client.Filters type, the network.Port
struct (replacing the nat.Port string), and netip.Addr host
addresses, while preserving existing behavior. After this change the
production build no longer imports github.com/docker/docker; it
remains only as an indirect test dependency via testcontainers-go.

Drop the now-dormant govulncheck ignore entries for GO-2026-4883 and
GO-2026-4887. These daemon-side Moby advisories are no longer in
govulncheck's called set once docker/docker is off the production
build, so the suppressions are no longer needed.

Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: rdimitrov

.github/workflows/security-scan.yml

@@ -61,18 +61,7 @@ jobs:
           #   Indirect dependency via mcp-go, invopop/jsonschema, wk8/go-ordered-map.
           #   The vulnerability is in the Delete function which is not called by ToolHive
           #   or any of its dependencies. No fixed version exists yet (all versions affected).
-          # GO-2026-4883: Off-by-one error in Moby plugin privilege validation (CVE-2026-33997)
-          #   Affects the Docker daemon's plugin privilege handling code. ToolHive only uses
-          #   the Docker client SDK to manage containers, not the daemon plugin subsystem.
-          #   No fixed version exists for github.com/docker/docker; fix is only in
-          #   github.com/moby/moby/v2 v2.0.0-beta.8+ which is not yet available as a
-          #   docker/docker release.
-          # GO-2026-4887: AuthZ plugin bypass with oversized request bodies (CVE-2026-34040)
-          #   Affects the Docker daemon's AuthZ plugin mechanism. ToolHive only uses the
-          #   Docker client SDK and does not run or configure AuthZ plugins. No fixed version
-          #   exists for github.com/docker/docker; fix is only in github.com/moby/moby/v2
-          #   v2.0.0-beta.8+ which is not yet available as a docker/docker release.
-          IGNORED_VULNS="GO-2026-4514 GO-2026-4883 GO-2026-4887"
+          IGNORED_VULNS="GO-2026-4514"
 
           # Show the raw output for debugging
           echo "::group::govulncheck raw output"

go.mod

@@ -18,8 +18,8 @@ require (
 	github.com/charmbracelet/x/ansi v0.11.7
 	github.com/containerd/errdefs v1.0.0
 	github.com/coreos/go-oidc/v3 v3.18.0
-	github.com/docker/docker v28.5.2+incompatible
-	github.com/docker/go-connections v0.7.0
+	github.com/docker/docker v28.5.2+incompatible // indirect
+	github.com/docker/go-connections v0.7.0 // indirect
 	github.com/evanphx/json-patch/v5 v5.9.11
 	github.com/go-chi/chi/v5 v5.2.5
 	github.com/go-git/go-billy/v5 v5.9.0
@@ -208,7 +208,7 @@ require (
 	github.com/mfridman/interpolate v0.0.2 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/moby/go-archive v0.1.0 // indirect
-	github.com/moby/moby/api v1.54.2 // indirect
+	github.com/moby/moby/api v1.54.2
 	github.com/moby/patternmatcher v0.6.0 // indirect
 	github.com/moby/spdystream v0.5.1 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect