DNM: Migrate off gogo protobuf (rebase)

.gitignore

@@ -34,3 +34,7 @@ bin/swarmkitstate
 
 # dev sync, if used
 /.docker-sync/
+
+# transient protobuf rename map produced by protoc-gen-goswarm and consumed by
+# proto-name-fix during `make protos`; regenerated every time, not source.
+/rename_map.json

.golangci.yml

@@ -17,6 +17,14 @@ linters:
     govet:
       enable:
         - nilness
+      disable:
+        # google.golang.org/protobuf messages embed protoimpl.MessageState
+        # (which contains a sync.Mutex), so copylocks fires wherever a proto
+        # message is passed or ranged over by value. SwarmKit's APIs do this
+        # in many places (e.g. the Remotes/Proposer interfaces, state.Change).
+        # Pointerizing all of them is a large, separate refactor; until then
+        # copylocks is disabled to avoid a wall of false-positive-ish findings.
+        - copylocks
   exclusions:
     generated: lax
     presets:

Dockerfile

@@ -1,11 +1,19 @@
 # syntax=docker/dockerfile:1
 
-ARG GO_VERSION=1.24
-ARG PROTOC_VERSION=3.14.0
+# Go 1.26 is required by the etcd 3.7 dependency stack (go.etcd.io/raft and
+# go.etcd.io/etcd/* declare `go 1.26`).
+ARG GO_VERSION=1.26
+# protoc release 21.12 == libprotoc 3.21.12 (the version recorded in the
+# generated *.pb.go headers).
+ARG PROTOC_VERSION=21.12
+ARG PROTOC_GEN_GO_VERSION=v1.36.11
+ARG PROTOC_GEN_GO_GRPC_VERSION=v1.6.2
+# golangci-lint must be built with Go >= 1.26 to lint a go-1.26 module
+# (the etcd 3.7 stack requires go 1.26). v2.12.2 is built with go1.26.x.
 ARG GOLANGCI_LINT_VERSION=v2.12.2
 ARG DEBIAN_FRONTEND=noninteractive
 
-FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-bullseye AS gobase
+FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-bookworm AS gobase
 ARG DEBIAN_FRONTEND
 RUN apt-get update && apt-get install -y --no-install-recommends git make rsync
 WORKDIR /go/src/github.com/docker/swarmkit
@@ -43,16 +51,6 @@ RUN --mount=type=bind,target=.,rw \
   fi
 EOT
 
-FROM gobase AS protoc-gen-gogoswarm
-RUN --mount=type=bind,target=.,rw \
-    --mount=type=cache,target=/root/.cache \
-    make bin/protoc-gen-gogoswarm && mv bin/protoc-gen-gogoswarm /usr/local/bin/
-
-FROM gobase AS protobuild
-RUN --mount=type=bind,target=. \
-    --mount=type=cache,target=/root/.cache \
-    go install tool github.com/containerd/protobuild
-
 FROM gobase AS generate-base
 ARG DEBIAN_FRONTEND
 RUN apt-get --no-install-recommends install -y unzip
@@ -65,17 +63,25 @@ RUN <<EOT
   wget -q https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VERSION}/protoc-${PROTOC_VERSION}-${TARGETOS}-${arch}.zip
   unzip protoc-${PROTOC_VERSION}-${TARGETOS}-${arch}.zip -d /usr/local
 EOT
+# Install the standard protobuf Go plugins (protoc-gen-goswarm and
+# proto-name-fix are built from this repo by `make protos`).
+ARG PROTOC_GEN_GO_VERSION
+ARG PROTOC_GEN_GO_GRPC_VERSION
+RUN --mount=type=cache,target=/root/.cache \
+    --mount=type=cache,target=/go/pkg/mod <<EOT
+  set -e
+  go install google.golang.org/protobuf/cmd/protoc-gen-go@${PROTOC_GEN_GO_VERSION}
+  go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@${PROTOC_GEN_GO_GRPC_VERSION}
+EOT
 
 FROM generate-base AS generate-build
 RUN --mount=type=bind,target=.,rw \
-    --mount=from=packages,source=/tmp/packages,target=/tmp/packages \
-    --mount=from=protobuild,source=/go/bin/protobuild,target=/usr/bin/protobuild \
-    --mount=from=protoc-gen-gogoswarm,source=/usr/local/bin/protoc-gen-gogoswarm,target=/usr/bin/protoc-gen-gogoswarm <<EOT
+    --mount=type=cache,target=/root/.cache \
+    --mount=type=cache,target=/go/pkg/mod <<EOT
   set -ex
-  protobuild $(cat /tmp/packages/packages)
-  go generate -mod=vendor -x $(cat /tmp/packages/packages)
+  make protos
   mkdir /out
-  git ls-files -m --others -- ':!vendor' '**/*.pb.go' | tar -cf - --files-from - | tar -C /out -xf -
+  git ls-files -m --others -- ':!vendor' '**/*.pb.go' '**/*.pb.*.go' | tar -cf - --files-from - | tar -C /out -xf -
 EOT
 
 FROM scratch AS generate-update
@@ -89,7 +95,7 @@ RUN --mount=type=bind,target=.,rw \
   if [ "$(ls -A /generated)" ]; then
     cp -rf /generated/* .
   fi
-  diff=$(git status --porcelain -- ':!vendor' '**/*.pb.go')
+  diff=$(git status --porcelain -- ':!vendor' '**/*.pb.go' '**/*.pb.*.go')
   if [ -n "$diff" ]; then
     echo >&2 'ERROR: The result of "go generate" differs. Please update with "make generate"'
     echo "$diff"
@@ -100,9 +106,10 @@ EOT
 FROM golangci/golangci-lint:${GOLANGCI_LINT_VERSION} AS golangci-lint
 FROM gobase AS lint
 ARG DEBIAN_FRONTEND
-RUN apt-get install -y --no-install-recommends libgcc-10-dev libc6-dev
+RUN apt-get install -y --no-install-recommends libgcc-12-dev libc6-dev
 RUN --mount=type=bind,target=. \
     --mount=type=cache,target=/root/.cache \
+    --mount=type=cache,target=/go/pkg/mod \
     --mount=from=golangci-lint,source=/usr/bin/golangci-lint,target=/usr/bin/golangci-lint <<EOT
   set -e
   config=$(pwd)/.golangci.yml

agent/agent.go

@@ -4,13 +4,15 @@ import (
 	"bytes"
 	"context"
 	"math/rand"
-	"reflect"
 	"sync"
 	"time"
 
+	"google.golang.org/protobuf/proto"
+
 	"github.com/moby/swarmkit/v2/agent/exec"
 	"github.com/moby/swarmkit/v2/api"
 	"github.com/moby/swarmkit/v2/log"
+	"github.com/moby/swarmkit/v2/remotes"
 	"github.com/pkg/errors"
 )
 
@@ -249,7 +251,7 @@ func (a *Agent) run(ctx context.Context) {
 		// if the node description has changed, update it to the new one
 		// and close the session. The old session will be stopped and a
 		// new one will be created with the updated description
-		if !reflect.DeepEqual(nodeDescription, newNodeDescription) {
+		if !proto.Equal(nodeDescription, newNodeDescription) {
 			nodeDescription = newNodeDescription
 			// close the session
 			log.G(ctx).Info("agent: found node update")
@@ -414,14 +416,14 @@ func (a *Agent) run(ctx context.Context) {
 }
 
 func (a *Agent) handleSessionMessage(ctx context.Context, message *api.SessionMessage, nti *api.NodeTLSInfo) error {
-	seen := map[api.Peer]struct{}{}
+	seen := map[remotes.PeerKey]struct{}{}
 	for _, manager := range message.Managers {
-		if manager.Peer.Addr == "" {
+		if manager.Peer == nil || manager.Peer.Addr == "" {
 			continue
 		}
 
 		a.config.ConnBroker.Remotes().Observe(*manager.Peer, int(manager.Weight))
-		seen[*manager.Peer] = struct{}{}
+		seen[remotes.ToPeerKey(*manager.Peer)] = struct{}{}
 	}
 
 	var changes *NodeChanges
@@ -447,9 +449,9 @@ func (a *Agent) handleSessionMessage(ctx context.Context, message *api.SessionMe
 	}
 
 	// prune managers not in list.
-	for peer := range a.config.ConnBroker.Remotes().Weights() {
-		if _, ok := seen[peer]; !ok {
-			a.config.ConnBroker.Remotes().Remove(peer)
+	for pkey := range a.config.ConnBroker.Remotes().Weights() {
+		if _, ok := seen[pkey]; !ok {
+			a.config.ConnBroker.Remotes().Remove(remotes.FromPeerKey(pkey))
 		}
 	}
 
@@ -620,7 +622,7 @@ func (a *Agent) Publisher(ctx context.Context, subscriptionID string) (exec.LogP
 
 			return publisher.Send(&api.PublishLogsMessage{
 				SubscriptionID: subscriptionID,
-				Messages:       []api.LogMessage{message},
+				Messages:       []*api.LogMessage{&message},
 			})
 		}), func() {
 			sendCloseMsg()
@@ -649,8 +651,8 @@ func (a *Agent) nodeDescriptionWithHostname(ctx context.Context, tlsInfo *api.No
 func nodesEqual(a, b *api.Node) bool {
 	a, b = a.Copy(), b.Copy()
 
-	a.Status, b.Status = api.NodeStatus{}, api.NodeStatus{}
-	a.Meta, b.Meta = api.Meta{}, api.Meta{}
+	a.Status, b.Status = nil, nil
+	a.Meta, b.Meta = nil, nil
 
-	return reflect.DeepEqual(a, b)
+	return proto.Equal(a, b)
 }

agent/agent_test.go

@@ -12,7 +12,9 @@ import (
 	"time"
 
 	"google.golang.org/grpc"
+
 	"google.golang.org/grpc/credentials"
+	"google.golang.org/protobuf/proto"
 
 	events "github.com/docker/go-events"
 	agentutils "github.com/moby/swarmkit/v2/agent/testutils"
@@ -263,7 +265,7 @@ func TestSessionRestartedOnNodeDescriptionChange(t *testing.T) {
 		}
 		return nil
 	}, 2*time.Second))
-	require.NotEqual(t, currSession, gotSession)
+	require.False(t, proto.Equal(currSession, gotSession), "sessions should be different")
 	require.NotNil(t, gotSession.Description)
 	require.Equal(t, "testAgent", gotSession.Description.Hostname)
 	require.True(t, gotSession.Description.FIPS)
@@ -273,7 +275,7 @@ func TestSessionRestartedOnNodeDescriptionChange(t *testing.T) {
 	tlsCh <- gotSession.Description.TLSInfo
 	time.Sleep(1 * time.Second)
 	gotSession, closedSessions = tester.dispatcher.GetSessions()
-	require.Equal(t, currSession, gotSession)
+	require.True(t, proto.Equal(currSession, gotSession), "sessions should be equal")
 	require.Len(t, closedSessions, 1)
 
 	newTLSInfo := &api.NodeTLSInfo{
@@ -292,10 +294,10 @@ func TestSessionRestartedOnNodeDescriptionChange(t *testing.T) {
 		}
 		return nil
 	}, 2*time.Second))
-	require.NotEqual(t, currSession, gotSession)
+	require.False(t, proto.Equal(currSession, gotSession), "sessions should be different")
 	require.NotNil(t, gotSession.Description)
 	require.Equal(t, "testAgent", gotSession.Description.Hostname)
-	require.Equal(t, newTLSInfo, gotSession.Description.TLSInfo)
+	require.True(t, proto.Equal(newTLSInfo, gotSession.Description.TLSInfo), "TLSInfo should match")
 	require.True(t, gotSession.Description.FIPS)
 }
 
@@ -575,10 +577,10 @@ type fakeRemotes struct {
 	peer api.Peer
 }
 
-func (f *fakeRemotes) Weights() map[api.Peer]int {
+func (f *fakeRemotes) Weights() map[remotes.PeerKey]int {
 	f.mu.Lock()
 	defer f.mu.Unlock()
-	return map[api.Peer]int{f.peer: 1}
+	return map[remotes.PeerKey]int{remotes.ToPeerKey(f.peer): 1}
 }
 
 func (f *fakeRemotes) Select(...string) (api.Peer, error) {

agent/exec/controller.go

@@ -94,9 +94,16 @@ type PortStatuser interface {
 // error merely reports the failure at getting the controller.
 func Resolve(ctx context.Context, task *api.Task, executor Executor) (Controller, *api.TaskStatus, error) {
 	status := task.Status.Copy()
+	if status == nil {
+		status = &api.TaskStatus{}
+	}
 
 	defer func() {
-		logStateChange(ctx, task.DesiredState, task.Status.State, status.State)
+		taskStatusState := api.TaskState(0)
+		if task.Status != nil {
+			taskStatusState = task.Status.State
+		}
+		logStateChange(ctx, task.DesiredState, taskStatusState, status.State)
 	}()
 
 	ctlr, err := executor.Controller(task)
@@ -109,12 +116,16 @@ func Resolve(ctx context.Context, task *api.Task, executor Executor) (Controller
 		// before the task has been started, we consider it a rejection.
 		// if task is running, consider the task has failed
 		// otherwise keep the existing state
-		if task.Status.State < api.TaskStateStarting {
+		taskState := api.TaskState(0)
+		if task.Status != nil {
+			taskState = task.Status.State
+		}
+		if taskState < api.TaskStateStarting {
 			status.State = api.TaskStateRejected
-		} else if task.Status.State <= api.TaskStateRunning {
+		} else if taskState <= api.TaskStateRunning {
 			status.State = api.TaskStateFailed
 		}
-	} else if task.Status.State < api.TaskStateAccepted {
+	} else if task.GetStatus().GetState() < api.TaskStateAccepted {
 		// we always want to proceed to accepted when we resolve the controller
 		status.Message = "accepted"
 		status.State = api.TaskStateAccepted
@@ -141,6 +152,9 @@ func Resolve(ctx context.Context, task *api.Task, executor Executor) (Controller
 // action.
 func Do(ctx context.Context, task *api.Task, ctlr Controller) (*api.TaskStatus, error) {
 	status := task.Status.Copy()
+	if status == nil {
+		status = &api.TaskStatus{}
+	}
 
 	// stay in the current state.
 	noop := func(_ ...error) (*api.TaskStatus, error) {
@@ -224,9 +238,13 @@ func Do(ctx context.Context, task *api.Task, ctlr Controller) (*api.TaskStatus,
 	// below, we have several callbacks that are run after the state transition
 	// is completed.
 	defer func() {
-		logStateChange(ctx, task.DesiredState, task.Status.State, status.State)
+		taskStatusState := api.TaskState(0)
+		if task.Status != nil {
+			taskStatusState = task.Status.State
+		}
+		logStateChange(ctx, task.DesiredState, taskStatusState, status.State)
 
-		if !equality.TaskStatusesEqualStable(status, &task.Status) {
+		if !equality.TaskStatusesEqualStable(status, task.Status) {
 			status.Timestamp = ptypes.MustTimestampProto(time.Now())
 		}
 	}()