Merge branch 'main' into fix/multi-network-old-daemon-compat

Author: jotka

.github/workflows/ci.yml

@@ -45,7 +45,7 @@ jobs:
           make ${{ matrix.target }}
 
   binary:
-    uses: docker/github-builder/.github/workflows/bake.yml@v1
+    uses: docker/github-builder/.github/workflows/bake.yml@v1.4.0
     permissions:
       contents: read # same as global permission
       id-token: write # for signing attestation(s) with GitHub OIDC Token
@@ -111,7 +111,7 @@ jobs:
 
   bin-image-test:
     if: github.event_name == 'pull_request'
-    uses: docker/github-builder/.github/workflows/bake.yml@v1
+    uses: docker/github-builder/.github/workflows/bake.yml@v1.4.0
     with:
       runner: amd64
       target: image-cross

.github/workflows/merge.yml

@@ -83,7 +83,7 @@ jobs:
       - run: echo "Exposing env vars for reusable workflow"
 
   bin-image:
-    uses: docker/github-builder/.github/workflows/bake.yml@v1
+    uses: docker/github-builder/.github/workflows/bake.yml@v1.4.0
     needs:
       - bin-image-prepare
     permissions:

.github/workflows/pr-review.yml

@@ -0,0 +1,44 @@
+name: PR Review
+
+on:
+  pull_request_target:
+    types: [opened, ready_for_review]
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+
+# Serialize reviews per PR; do not cancel in-progress runs
+# so no review is silently dropped mid-execution.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.issue.number }}
+  cancel-in-progress: false
+
+jobs:
+  review:
+    # Only run on the upstream repo (not forks) to prevent credential leaks.
+    # Skip draft PRs (ready_for_review will fire when promoted).
+    # Skip bot actors to avoid reviewing Dependabot and automation PRs.
+    # Require collaborator-level access for comment-triggered events.
+    # Only trigger on PR comments, not plain issue comments.
+    if: >-
+      github.repository == 'docker/compose' &&
+      (github.event_name != 'pull_request_target' || github.event.pull_request.draft == false) &&
+      (github.event_name == 'pull_request_target' ||
+       (github.event_name == 'issue_comment' &&
+        github.event.issue.pull_request &&
+        contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) ||
+       (github.event_name == 'pull_request_review_comment' &&
+        contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association))) &&
+      !endsWith(github.actor, '[bot]')
+    uses: docker/cagent-action/.github/workflows/review-pr.yml@3a12dbd0c6cd7dda3d4e05f24f0143c9701456de # v1.2.13
+    secrets:
+      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+      CAGENT_ORG_MEMBERSHIP_TOKEN: ${{ secrets.CAGENT_ORG_MEMBERSHIP_TOKEN }}
+      CAGENT_REVIEWER_APP_ID: ${{ secrets.CAGENT_REVIEWER_APP_ID }}
+      CAGENT_REVIEWER_APP_PRIVATE_KEY: ${{ secrets.CAGENT_REVIEWER_APP_PRIVATE_KEY }}
+    permissions:
+      contents: read       # to fetch code
+      pull-requests: write # to post review comments
+      issues: write        # to reply to issue/PR comments
+      checks: write        # to update check statuses

CLAUDE.md

@@ -0,0 +1,27 @@
+# Project: Docker Compose
+
+## Build & Test
+
+- Build: `make build`
+- Test all: `make test`
+- Test unit: `go test ./pkg/...`
+- Test single: `go test ./pkg/compose/ -run TestFunctionName`
+- E2E tests: `go test -tags e2e ./pkg/e2e/ -run TestName`
+
+## Lint
+
+- Linter: golangci-lint v2 (config in `.golangci.yml`)
+- Run: `golangci-lint run --build-tags "e2e" ./...`
+- **After modifying any Go code, ALWAYS run the linter and fix all reported issues before considering the task complete.**
+- Lint is also run via Docker: `docker buildx bake lint` (uses version pinned in `Dockerfile`)
+
+## Code Style
+
+- Formatting is enforced by golangci-lint (gofumpt + gci)
+- Import order: stdlib, third-party, local module (enforced by gci)
+- Max line length: 200 chars
+- Max cyclomatic complexity: 16
+- No `io/ioutil`, `github.com/pkg/errors`, `gopkg.in/yaml.v2`, `golang.org/x/exp/maps`, `golang.org/x/exp/slices`
+- Use `github.com/containerd/errdefs` instead of `github.com/docker/docker/errdefs`
+- In tests: use `t.Context()` instead of `context.Background()` or `context.TODO()`
+- Prefer `fmt.Fprintf` over `WriteString(fmt.Sprintf(...))`

Dockerfile

@@ -17,7 +17,7 @@
 
 ARG GO_VERSION=1.25.8
 ARG XX_VERSION=1.9.0
-ARG GOLANGCI_LINT_VERSION=v2.8.0
+ARG GOLANGCI_LINT_VERSION=v2.11.3
 ARG ADDLICENSE_VERSION=v1.0.0
 
 ARG BUILD_TAGS="e2e"

cmd/display/tty.go

@@ -176,13 +176,13 @@ func (w *ttyWriter) Start(ctx context.Context, operation string) {
 
 func (w *ttyWriter) Done(operation string, success bool) {
 	w.print()
+	w.done <- true
 	w.mtx.Lock()
 	defer w.mtx.Unlock()
 	if w.ticker != nil {
 		w.ticker.Stop()
 	}
 	w.operation = ""
-	w.done <- true
 }
 
 func (w *ttyWriter) On(events ...api.Resource) {
@@ -339,6 +339,21 @@ func (w *ttyWriter) printWithDimensions(terminalWidth, terminalHeight int) {
 		}
 	}
 
+	// pad timers so they all have the same visible width
+	for i := range lines {
+		l := &lines[i]
+		if l.timer == "" {
+			continue
+		}
+		timerWidth := utf8.RuneCountInString(l.timer)
+		if timerWidth < timerLen {
+			// Left-pad so the timer's right edge stays aligned on the terminal.
+			// This also prevents stale suffix characters from visually “sticking”
+			// when a previously-rendered timer was wider (e.g. "10.6s" -> "0.0s").
+			l.timer = strings.Repeat(" ", timerLen-timerWidth) + l.timer
+		}
+	}
+
 	// shorten details/taskID to fit terminal width
 	w.adjustLineWidth(lines, timerLen, terminalWidth)
 

cmd/display/tty_test.go

@@ -18,6 +18,7 @@ package display
 
 import (
 	"bytes"
+	"context"
 	"strings"
 	"sync"
 	"testing"
@@ -403,6 +404,67 @@ func TestPrintWithDimensions_PulledAndPullingWithLongIDs(t *testing.T) {
 	}
 }
 
+func TestPrintWithDimensions_TimerIsRightAligned(t *testing.T) {
+	w, buf := newTestWriter()
+
+	base := time.Unix(0, 0)
+
+	// Long timer: "10.6s" (length 5)
+	longTask := &task{
+		ID:        "task-long",
+		parents:   make(map[string]struct{}),
+		startTime: base,
+		endTime:   base.Add(10*time.Second + 600*time.Millisecond),
+		text:      "Pulled",
+		status:    api.Done,
+		spinner:   NewSpinner(),
+	}
+	longTask.spinner.Stop()
+	w.tasks[longTask.ID] = longTask
+	w.ids = append(w.ids, longTask.ID)
+
+	// Short timer: "0.0s" (length 4)
+	shortTask := &task{
+		ID:        "task-short",
+		parents:   make(map[string]struct{}),
+		startTime: base,
+		endTime:   base,
+		text:      "Pulled",
+		status:    api.Done,
+		spinner:   NewSpinner(),
+	}
+	shortTask.spinner.Stop()
+	w.tasks[shortTask.ID] = shortTask
+	w.ids = append(w.ids, shortTask.ID)
+
+	terminalWidth := 80
+	w.printWithDimensions(terminalWidth, 24)
+
+	// Strip ANSI codes from output and split by newline
+	stripped := stripAnsi(buf.String())
+	lines := strings.Split(stripped, "\n")
+
+	var nonEmptyLines []string
+	for _, line := range lines {
+		if strings.TrimSpace(line) != "" {
+			nonEmptyLines = append(nonEmptyLines, line)
+		}
+	}
+
+	// Find the line containing the shorter timer.
+	var shortLine string
+	for _, line := range nonEmptyLines {
+		if strings.Contains(line, "0.0s") {
+			shortLine = line
+			break
+		}
+	}
+	assert.Assert(t, shortLine != "", "expected to find a rendered line containing \"0.0s\"")
+	assert.Assert(t, strings.HasSuffix(shortLine, "0.0s"),
+		"short timer should be left-padded (no trailing spaces after the timer); got: %q",
+		shortLine)
+}
+
 func TestLenAnsi(t *testing.T) {
 	testCases := []struct {
 		input    string
@@ -422,3 +484,23 @@ func TestLenAnsi(t *testing.T) {
 		})
 	}
 }
+
+func TestDoneDeadlockFix(t *testing.T) {
+	w, _ := newTestWriter()
+	addTask(w, "test-task", "Working", "details", api.Working)
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+
+	w.Start(ctx, "test")
+	done := make(chan bool)
+	go func() {
+		w.Done("test", true)
+		done <- true
+	}()
+
+	select {
+	case <-done:
+	case <-time.After(5 * time.Second):
+		t.Fatal("Deadlock detected: Done() did not complete within 5 seconds")
+	}
+}

go.mod

@@ -10,9 +10,9 @@ require (
 	github.com/buger/goterm v1.0.4
 	github.com/compose-spec/compose-go/v2 v2.10.1
 	github.com/containerd/console v1.0.5
-	github.com/containerd/containerd/v2 v2.2.1
+	github.com/containerd/containerd/v2 v2.2.2
 	github.com/containerd/errdefs v1.0.0
-	github.com/containerd/platforms v1.0.0-rc.2
+	github.com/containerd/platforms v1.0.0-rc.3
 	github.com/distribution/reference v0.6.0
 	github.com/docker/buildx v0.31.1
 	github.com/docker/cli v29.2.1+incompatible
@@ -31,7 +31,7 @@ require (
 	github.com/moby/buildkit v0.27.1
 	github.com/moby/go-archive v0.2.0
 	github.com/moby/moby/api v1.54.0
-	github.com/moby/moby/client v0.2.2
+	github.com/moby/moby/client v0.3.0
 	github.com/moby/patternmatcher v0.6.0
 	github.com/moby/sys/atomicwriter v0.1.0
 	github.com/morikuni/aec v1.1.0
@@ -45,25 +45,26 @@ require (
 	github.com/stretchr/testify v1.11.1
 	github.com/tilt-dev/fsnotify v1.4.8-0.20220602155310-fff9c274a375
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0
-	go.opentelemetry.io/otel v1.38.0
+	go.opentelemetry.io/otel v1.39.0
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0
-	go.opentelemetry.io/otel/metric v1.38.0
-	go.opentelemetry.io/otel/sdk v1.38.0
-	go.opentelemetry.io/otel/trace v1.38.0
+	go.opentelemetry.io/otel/metric v1.39.0
+	go.opentelemetry.io/otel/sdk v1.39.0
+	go.opentelemetry.io/otel/trace v1.39.0
 	go.uber.org/goleak v1.3.0
 	go.uber.org/mock v0.6.0
 	go.yaml.in/yaml/v4 v4.0.0-rc.4
-	golang.org/x/sync v0.19.0
+	golang.org/x/sync v0.20.0
 	golang.org/x/sys v0.42.0
-	google.golang.org/grpc v1.78.0
+	google.golang.org/grpc v1.79.3
 	gotest.tools/v3 v3.5.2
 	tags.cncf.io/container-device-interface v1.1.0
 )
 
 require (
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/containerd/containerd/api v1.10.0 // indirect
 	github.com/containerd/continuity v0.4.5 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
@@ -131,16 +132,16 @@ require (
 	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.38.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.38.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.38.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.38.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.39.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.7.1 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/crypto v0.46.0 // indirect
 	golang.org/x/net v0.48.0 // indirect
 	golang.org/x/term v0.38.0 // indirect
 	golang.org/x/text v0.32.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20251103181224-f26f9409b101 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20251103181224-f26f9409b101 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect