test(agent): Migrate integration tests to moby v29; drop docker/docker

Migrate the agent module's integration and sudo-tagged test files off
github.com/docker/docker onto the moby v29 SDK (moby/moby/client +
api/types). These were the last non-vendor importers of docker/docker,
so go mod tidy now drops it from agent/go.mod and the vendored
docker/docker tree is removed entirely.

Mirrors the unit-test migration: reshaped client Options/Result structs,
renamed exec methods (ContainerExec* -> Exec*), ContainerInspect result
under .Container, ContainerKill/ContainerTop/ContainerStop option
structs, and network.EndpointSettings.IPAddress as netip.Addr.

Verified in a finch Linux container: engine + stats compile clean under
-tags integration and -tags sudo, windows integ cross-compiles, and
linux+windows production builds pass. gomod is idempotent (diff-clean);
gofmt + goimports clean on all touched files.

Author: Thean Lim

agent/engine/common_unix_integ_testutil.go

@@ -45,9 +45,8 @@ import (
 	apitaskstatus "github.com/aws/amazon-ecs-agent/ecs-agent/api/task/status"
 	"github.com/aws/amazon-ecs-agent/ecs-agent/ec2"
 
-	"github.com/docker/docker/api/types"
-	sdkClient "github.com/docker/docker/client"
 	dockercontainer "github.com/moby/moby/api/types/container"
+	sdkClient "github.com/moby/moby/client"
 	"github.com/pborman/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -419,7 +418,7 @@ func logContainerLogs(t *testing.T, taskEngine TaskEngine, taskArn string, conta
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
 
-	logReader, err := client.ContainerLogs(ctx, container.DockerID, types.ContainerLogsOptions{
+	logReader, err := client.ContainerLogs(ctx, container.DockerID, sdkClient.ContainerLogsOptions{
 		ShowStdout: true,
 		ShowStderr: true,
 	})

agent/engine/docker_image_manager_integ_test.go

@@ -35,8 +35,8 @@ import (
 	apicontainerstatus "github.com/aws/amazon-ecs-agent/ecs-agent/api/container/status"
 	apitaskstatus "github.com/aws/amazon-ecs-agent/ecs-agent/api/task/status"
 
-	"github.com/docker/docker/api/types"
-	"github.com/docker/docker/client"
+	cerrdefs "github.com/containerd/errdefs"
+	"github.com/moby/moby/client"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -149,11 +149,11 @@ func TestIntegImageCleanupHappyCase(t *testing.T) {
 
 	// Verify top 2 LRU images are removed from docker
 	_, err = dockerClient.InspectImage(imageState1ImageID)
-	if !client.IsErrNotFound(err) {
+	if !cerrdefs.IsNotFound(err) {
 		t.Fatalf("Image was not removed successfully")
 	}
 	_, err = dockerClient.InspectImage(imageState2ImageID)
-	if !client.IsErrNotFound(err) {
+	if !cerrdefs.IsNotFound(err) {
 		t.Fatalf("Image was not removed successfully")
 	}
 
@@ -263,11 +263,11 @@ func TestIntegImageCleanupThreshold(t *testing.T) {
 
 	// Verify Image1 & Image3 are removed from docker
 	_, err = dockerClient.InspectImage(imageState1ImageID)
-	if !client.IsErrNotFound(err) {
+	if !cerrdefs.IsNotFound(err) {
 		t.Fatalf("Image was not removed successfully")
 	}
 	_, err = dockerClient.InspectImage(imageState3ImageID)
-	if !client.IsErrNotFound(err) {
+	if !cerrdefs.IsNotFound(err) {
 		t.Fatalf("Image was not removed successfully")
 	}
 
@@ -302,15 +302,15 @@ func TestImageWithSameNameAndDifferentID(t *testing.T) {
 	stateChangeEvents := taskEngine.StateChangeEvents()
 
 	// Pull the images needed for the test
-	if _, err = dockerClient.InspectImage(test3Image1Name); client.IsErrNotFound(err) {
+	if _, err = dockerClient.InspectImage(test3Image1Name); cerrdefs.IsNotFound(err) {
 		metadata := dockerClient.PullImage(ctx, test3Image1Name, nil, dockerclient.LoadImageTimeout)
 		assert.NoError(t, metadata.Error, "Failed to pull image %s", test3Image1Name)
 	}
-	if _, err = dockerClient.InspectImage(test3Image2Name); client.IsErrNotFound(err) {
+	if _, err = dockerClient.InspectImage(test3Image2Name); cerrdefs.IsNotFound(err) {
 		metadata := dockerClient.PullImage(ctx, test3Image2Name, nil, dockerclient.LoadImageTimeout)
 		assert.NoError(t, metadata.Error, "Failed to pull image %s", test3Image2Name)
 	}
-	if _, err = dockerClient.InspectImage(test3Image3Name); client.IsErrNotFound(err) {
+	if _, err = dockerClient.InspectImage(test3Image3Name); cerrdefs.IsNotFound(err) {
 		metadata := dockerClient.PullImage(ctx, test3Image3Name, nil, dockerclient.LoadImageTimeout)
 		assert.NoError(t, metadata.Error, "Failed to pull image %s", test3Image3Name)
 	}
@@ -409,11 +409,11 @@ func TestImageWithSameNameAndDifferentID(t *testing.T) {
 
 	// Verify images are removed by docker
 	_, err = dockerClient.InspectImage(imageID1)
-	assert.True(t, client.IsErrNotFound(err), "Image was not removed successfully, image: %s", imageID1)
+	assert.True(t, cerrdefs.IsNotFound(err), "Image was not removed successfully, image: %s", imageID1)
 	_, err = dockerClient.InspectImage(imageID2)
-	assert.True(t, client.IsErrNotFound(err), "Image was not removed successfully, image: %s", imageID2)
+	assert.True(t, cerrdefs.IsNotFound(err), "Image was not removed successfully, image: %s", imageID2)
 	_, err = dockerClient.InspectImage(imageID3)
-	assert.True(t, client.IsErrNotFound(err), "Image was not removed successfully, image: %s", imageID3)
+	assert.True(t, cerrdefs.IsNotFound(err), "Image was not removed successfully, image: %s", imageID3)
 }
 
 // TestImageWithSameIDAndDifferentNames tests images can be correctly removed if
@@ -448,7 +448,7 @@ func TestImageWithSameIDAndDifferentNames(t *testing.T) {
 	task3.Containers[0].Image = "testimagewithsameidanddifferentnames-3:latest"
 
 	// Pull the images needed for the test
-	if _, err = dockerClient.InspectImage(test4Image1Name); client.IsErrNotFound(err) {
+	if _, err = dockerClient.InspectImage(test4Image1Name); cerrdefs.IsNotFound(err) {
 		metadata := dockerClient.PullImage(ctx, test4Image1Name, nil, DefaultTestConfigIntegTest().ImagePullTimeout)
 		assert.NoError(t, metadata.Error, "Failed to pull image %s", test4Image1Name)
 	}
@@ -468,7 +468,7 @@ func TestImageWithSameIDAndDifferentNames(t *testing.T) {
 	imageID1 := imageState1.Image.ImageID
 
 	// copy the image for task2 to run with same image but different name
-	err = sdkDockerClient.ImageTag(ctx, task1.Containers[0].Image, task2.Containers[0].Image)
+	_, err = sdkDockerClient.ImageTag(ctx, client.ImageTagOptions{Source: task1.Containers[0].Image, Target: task2.Containers[0].Image})
 	require.NoError(t, err, "Trying to copy image failed")
 
 	// Start and wait for task2 to be running
@@ -483,7 +483,7 @@ func TestImageWithSameIDAndDifferentNames(t *testing.T) {
 	require.Equal(t, imageID2, imageID1, "The image id in task2 should be same as in task1")
 
 	// make task3 use the same image name but different image id
-	err = sdkDockerClient.ImageTag(ctx, task1.Containers[0].Image, task3.Containers[0].Image)
+	_, err = sdkDockerClient.ImageTag(ctx, client.ImageTagOptions{Source: task1.Containers[0].Image, Target: task3.Containers[0].Image})
 	require.NoError(t, err, "Trying to copy image failed")
 
 	// Start and wait for task3 to be running
@@ -530,21 +530,21 @@ func TestImageWithSameIDAndDifferentNames(t *testing.T) {
 
 	// Verify images are removed by docker
 	_, err = dockerClient.InspectImage(imageID1)
-	assert.True(t, client.IsErrNotFound(err), "Image was not removed successfully")
+	assert.True(t, cerrdefs.IsNotFound(err), "Image was not removed successfully")
 }
 
 // renameImage retag the image with the target tag and delete the source tag
-func renameImage(source string, target string, client *client.Client) error {
+func renameImage(source string, target string, dockerClient *client.Client) error {
 	ctx, cancel := context.WithCancel(context.TODO())
 	defer cancel()
 
-	err := client.ImageTag(ctx, source, target)
+	_, err := dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: source, Target: target})
 	if err != nil {
 		return fmt.Errorf("Trying to tag image failed, err: %v", err)
 	}
 
 	// delete the source tag
-	_, err = client.ImageRemove(ctx, source, types.ImageRemoveOptions{})
+	_, err = dockerClient.ImageRemove(ctx, source, client.ImageRemoveOptions{})
 	if err != nil {
 		return fmt.Errorf("Failed to remove the source tag of the image: %s", source)
 	}

agent/engine/engine_integ_test.go

@@ -39,9 +39,8 @@ import (
 	"github.com/aws/amazon-ecs-agent/ecs-agent/credentials"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/docker/docker/api/types"
-	sdkClient "github.com/docker/docker/client"
 	"github.com/moby/moby/api/types/container"
+	sdkClient "github.com/moby/moby/client"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -115,7 +114,7 @@ func dialWithRetries(proto string, address string, tries int, timeout time.Durat
 func removeImage(t *testing.T, img string) {
 	client, err := sdkClient.NewClientWithOpts(sdkClient.WithHost(endpoint), sdkClient.WithVersion(sdkclientfactory.GetDefaultVersion().String()))
 	require.NoError(t, err, "create docker client failed")
-	client.ImageRemove(context.TODO(), img, types.ImageRemoveOptions{})
+	client.ImageRemove(context.TODO(), img, sdkClient.ImageRemoveOptions{})
 }
 
 func cleanVolumes(testTask *apitask.Task, dockerClient dockerapi.DockerClient) {
@@ -148,18 +147,18 @@ func TestDockerStateToContainerState(t *testing.T) {
 
 	containerMetadata = taskEngine.(*DockerTaskEngine).createContainer(testTask, container)
 	assert.NoError(t, containerMetadata.Error)
-	state, _ := client.ContainerInspect(ctx, containerMetadata.DockerID)
-	assert.Equal(t, apicontainerstatus.ContainerCreated, dockerapi.DockerStateToState(state.ContainerJSONBase.State))
+	state, _ := client.ContainerInspect(ctx, containerMetadata.DockerID, sdkClient.ContainerInspectOptions{})
+	assert.Equal(t, apicontainerstatus.ContainerCreated, dockerapi.DockerStateToState(state.Container.State))
 
 	containerMetadata = taskEngine.(*DockerTaskEngine).startContainer(testTask, container)
 	assert.NoError(t, containerMetadata.Error)
-	state, _ = client.ContainerInspect(ctx, containerMetadata.DockerID)
-	assert.Equal(t, apicontainerstatus.ContainerRunning, dockerapi.DockerStateToState(state.ContainerJSONBase.State))
+	state, _ = client.ContainerInspect(ctx, containerMetadata.DockerID, sdkClient.ContainerInspectOptions{})
+	assert.Equal(t, apicontainerstatus.ContainerRunning, dockerapi.DockerStateToState(state.Container.State))
 
 	containerMetadata = taskEngine.(*DockerTaskEngine).stopContainer(testTask, container)
 	assert.NoError(t, containerMetadata.Error)
-	state, _ = client.ContainerInspect(ctx, containerMetadata.DockerID)
-	assert.Equal(t, apicontainerstatus.ContainerStopped, dockerapi.DockerStateToState(state.ContainerJSONBase.State))
+	state, _ = client.ContainerInspect(ctx, containerMetadata.DockerID, sdkClient.ContainerInspectOptions{})
+	assert.Equal(t, apicontainerstatus.ContainerStopped, dockerapi.DockerStateToState(state.Container.State))
 
 	// clean up the container
 	err = taskEngine.(*DockerTaskEngine).removeContainer(testTask, container)
@@ -173,8 +172,8 @@ func TestDockerStateToContainerState(t *testing.T) {
 	assert.NoError(t, containerMetadata.Error)
 	containerMetadata = taskEngine.(*DockerTaskEngine).startContainer(testTask, container)
 	assert.Error(t, containerMetadata.Error)
-	state, _ = client.ContainerInspect(ctx, containerMetadata.DockerID)
-	assert.Equal(t, apicontainerstatus.ContainerStopped, dockerapi.DockerStateToState(state.ContainerJSONBase.State))
+	state, _ = client.ContainerInspect(ctx, containerMetadata.DockerID, sdkClient.ContainerInspectOptions{})
+	assert.Equal(t, apicontainerstatus.ContainerStopped, dockerapi.DockerStateToState(state.Container.State))
 
 	// clean up the container
 	err = taskEngine.(*DockerTaskEngine).removeContainer(testTask, container)
@@ -443,9 +442,9 @@ func TestLabels(t *testing.T) {
 
 	containerMap, _ := taskEngine.(*DockerTaskEngine).state.ContainerMapByArn(testTask.Arn)
 	cid := containerMap[testTask.Containers[0].Name].DockerID
-	state, _ := client.ContainerInspect(ctx, cid)
-	assert.EqualValues(t, "value", state.Config.Labels["com.foo.label2"])
-	assert.EqualValues(t, "", state.Config.Labels["label1"])
+	state, _ := client.ContainerInspect(ctx, cid, sdkClient.ContainerInspectOptions{})
+	assert.EqualValues(t, "value", state.Container.Config.Labels["com.foo.label2"])
+	assert.EqualValues(t, "", state.Container.Config.Labels["label1"])
 
 	// Kill the existing container now
 	// Create instead of copying the testTask, to avoid race condition.
@@ -487,14 +486,14 @@ func TestLogDriverOptions(t *testing.T) {
 
 	containerMap, _ := taskEngine.(*DockerTaskEngine).state.ContainerMapByArn(testTask.Arn)
 	cid := containerMap[testTask.Containers[0].Name].DockerID
-	state, _ := client.ContainerInspect(ctx, cid)
+	state, _ := client.ContainerInspect(ctx, cid, sdkClient.ContainerInspectOptions{})
 
 	containerExpected := container.LogConfig{
 		Type:   "json-file",
 		Config: map[string]string{"max-file": "50", "max-size": "50k"},
 	}
 
-	assert.EqualValues(t, containerExpected, state.HostConfig.LogConfig)
+	assert.EqualValues(t, containerExpected, state.Container.HostConfig.LogConfig)
 
 	// Kill the existing container now
 	// Create instead of copying the testTask, to avoid race condition.
@@ -538,11 +537,11 @@ func testNetworkMode(t *testing.T, networkMode string) {
 	containerMap, _ := taskEngine.(*DockerTaskEngine).state.ContainerMapByArn(testTask.Arn)
 	cid := containerMap[testTask.Containers[0].Name].DockerID
 
-	state, _ := client.ContainerInspect(ctx, cid)
-	assert.NotNil(t, state.NetworkSettings, "Couldn't find the container network setting info")
+	state, _ := client.ContainerInspect(ctx, cid, sdkClient.ContainerInspectOptions{})
+	assert.NotNil(t, state.Container.NetworkSettings, "Couldn't find the container network setting info")
 
 	var networks []string
-	for key := range state.NetworkSettings.Networks {
+	for key := range state.Container.NetworkSettings.Networks {
 		networks = append(networks, key)
 	}
 	assert.Equal(t, 1, len(networks), "found multiple networks in container config")
@@ -583,7 +582,7 @@ func TestTaskCleanup(t *testing.T) {
 
 	containerMap, _ := taskEngine.(*DockerTaskEngine).state.ContainerMapByArn(testTask.Arn)
 	cid := containerMap[testTask.Containers[0].Name].DockerID
-	_, err = client.ContainerInspect(ctx, cid)
+	_, err = client.ContainerInspect(ctx, cid, sdkClient.ContainerInspectOptions{})
 	assert.NoError(t, err, "Inspect should work")
 
 	// Create instead of copying the testTask, to avoid race condition.
@@ -598,6 +597,6 @@ func TestTaskCleanup(t *testing.T) {
 	task.SetSentStatus(apitaskstatus.TaskStopped)   // cleanupTask waits for TaskStopped to be sent before cleaning
 	waitForTaskCleanup(t, taskEngine, testArn, 120) // 120 seconds
 
-	_, err = client.ContainerInspect(ctx, cid)
+	_, err = client.ContainerInspect(ctx, cid, sdkClient.ContainerInspectOptions{})
 	assert.Error(t, err, "Inspect should not work")
 }

agent/engine/engine_sudo_linux_integ_test.go

@@ -49,8 +49,8 @@ import (
 
 	ecstypes "github.com/aws/aws-sdk-go-v2/service/ecs/types"
 	"github.com/cihub/seelog"
-	"github.com/docker/docker/api/types"
-	sdkClient "github.com/docker/docker/client"
+	dockercontainer "github.com/moby/moby/api/types/container"
+	sdkClient "github.com/moby/moby/client"
 	"github.com/pkg/errors"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -491,7 +491,7 @@ func verifyExecCmdAgentExpectedMounts(t *testing.T,
 	ctx context.Context,
 	client *sdkClient.Client,
 	testTaskId, containerId, containerName, testExecCmdHostVersionedBinDir, testConfigFileName, testLogConfigFileName string) {
-	inspectState, err := client.ContainerInspect(ctx, containerId)
+	inspectState, err := client.ContainerInspect(ctx, containerId, sdkClient.ContainerInspectOptions{})
 	require.NoError(t, err)
 
 	expectedMounts := []struct {
@@ -537,8 +537,8 @@ func verifyExecCmdAgentExpectedMounts(t *testing.T,
 	}
 
 	for _, em := range expectedMounts {
-		var found *types.MountPoint
-		for _, m := range inspectState.Mounts {
+		var found *dockercontainer.MountPoint
+		for _, m := range inspectState.Container.Mounts {
 			if m.Source == em.source {
 				found = &m
 				break
@@ -554,7 +554,7 @@ func verifyExecCmdAgentExpectedMounts(t *testing.T,
 		require.Equal(t, "bind", string(found.Type), "Destination for mount point (%s) is not of type bind", em.source)
 	}
 
-	require.Equal(t, len(expectedMounts), len(inspectState.Mounts), "Wrong number of bind mounts detected in container (%s)", containerName)
+	require.Equal(t, len(expectedMounts), len(inspectState.Container.Mounts), "Wrong number of bind mounts detected in container (%s)", containerName)
 }
 
 func verifyMockExecCommandAgentIsRunning(t *testing.T, client *sdkClient.Client, containerId string) string {
@@ -631,7 +631,7 @@ func waitForKillProcToFinish(t *testing.T, client *sdkClient.Client, containerId
 func findContainerProcess(client *sdkClient.Client, containerId, matching string) (string, string, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), time.Second*10)
 	defer cancel()
-	top, err := client.ContainerTop(ctx, containerId, nil)
+	top, err := client.ContainerTop(ctx, containerId, sdkClient.ContainerTopOptions{})
 	if err != nil {
 		return "", "", fmt.Errorf("failed to run container top: %w", err)
 	}
@@ -665,13 +665,12 @@ func findContainerProcess(client *sdkClient.Client, containerId, matching string
 func killMockExecCommandAgent(t *testing.T, client *sdkClient.Client, containerId, pid string) {
 	ctx, cancel := context.WithTimeout(context.Background(), time.Second*10)
 	defer cancel()
-	create, err := client.ContainerExecCreate(ctx, containerId, types.ExecConfig{
-		Detach: true,
-		Cmd:    []string{testExecCommandAgentKillBin, "-pid=" + pid},
+	create, err := client.ExecCreate(ctx, containerId, sdkClient.ExecCreateOptions{
+		Cmd: []string{testExecCommandAgentKillBin, "-pid=" + pid},
 	})
 	require.NoError(t, err)
 
-	err = client.ContainerExecStart(ctx, create.ID, types.ExecStartCheck{
+	_, err = client.ExecStart(ctx, create.ID, sdkClient.ExecStartOptions{
 		Detach: true,
 	})
 	require.NoError(t, err)
@@ -758,7 +757,7 @@ func TestGMSATaskFile(t *testing.T) {
 	assert.NoError(t, err)
 
 	// Kill the existing container now
-	err = client.ContainerKill(context.TODO(), cid, "SIGKILL")
+	_, err = client.ContainerKill(context.TODO(), cid, sdkClient.ContainerKillOptions{Signal: "SIGKILL"})
 	assert.NoError(t, err, "Could not kill container")
 
 	VerifyTaskIsStopped(stateChangeEvents, testTask)
@@ -851,7 +850,7 @@ func TestGMSADomainlessTaskFile(t *testing.T) {
 	assert.NoError(t, err)
 
 	// Kill the existing container now
-	err = client.ContainerKill(context.TODO(), cid, "SIGKILL")
+	_, err = client.ContainerKill(context.TODO(), cid, sdkClient.ContainerKillOptions{Signal: "SIGKILL"})
 	assert.NoError(t, err, "Could not kill container")
 
 	VerifyTaskIsStopped(stateChangeEvents, testTask)
@@ -1033,12 +1032,12 @@ func TestGMSANotRunningErr(t *testing.T) {
 }
 
 func verifyContainerBindMount(client *sdkClient.Client, id, expectedBind string) error {
-	dockerContainer, err := client.ContainerInspect(context.TODO(), id)
+	dockerContainer, err := client.ContainerInspect(context.TODO(), id, sdkClient.ContainerInspectOptions{})
 	if err != nil {
 		return err
 	}
 
-	for _, opt := range dockerContainer.HostConfig.Binds {
+	for _, opt := range dockerContainer.Container.HostConfig.Binds {
 		if opt == expectedBind {
 			return nil
 		}