Migrate container client to moby/moby modules

[rdimitrov]

Summary

Migrates pkg/container/docker and pkg/container/images off the deprecated github.com/docker/docker module onto the maintained split modules github.com/moby/moby/client and github.com/moby/moby/api (both already required by ToolHive).

github.com/docker/docker is deprecated as of Docker v29 (Nov 2025) and frozen — it gets no further releases, including fixes for the daemon-side advisories CVE-2026-33997 (GO-2026-4883) and CVE-2026-34040 (GO-2026-4887) that we currently suppress in govulncheck (#4521). Rather than carry a suppression for a dead module indefinitely, this removes the dependency from the production build. The moby README migration map:

github.com/docker/docker/client       → github.com/moby/moby/client
github.com/docker/docker/api/types/X   → github.com/moby/moby/api/types/X
github.com/docker/docker/pkg/stdcopy   → github.com/moby/moby/api/pkg/stdcopy
github.com/docker/go-connections/nat   → github.com/moby/moby/api/types/network

After this change the production build no longer imports github.com/docker/docker (go mod why → "main module does not need package"); it remains only as an indirect test dependency via testcontainers-go.

What changed

The new moby/moby/client is a redesigned API, not a drop-in rename, so call sites were adapted while preserving behavior:

• Per-operation Options/Result structs — e.g. ContainerList(ctx, ContainerListOptions{…}) → res.Items, ContainerCreate(ctx, ContainerCreateOptions{Config, HostConfig, NetworkingConfig, Name}), Ping(ctx, PingOptions{}). dockerAPI interface and the fakeDockerAPI test double updated to match.
• Filters — filters.NewArgs()/Arg() → the chainable client.Filters map.
• Ports — nat.Port (string) → network.Port (struct): nat.NewPort("tcp", n) → network.ParsePort(n), .Int()/.Proto() → .Num()/.Proto().
• Host addresses — PortBinding.HostIP, IPAMConfig.Gateway, EndpointSettings.IPAddress, HostConfig.DNS moved from string/[]string to netip.Addr/[]netip.Addr; a small parseHostIP helper maps empty↔zero to preserve "all interfaces" semantics, and reads are IsValid()-guarded so the zero value still renders as "".
• Logs/Attach — ContainerLogsResult is an io.ReadCloser and ContainerAttachResult embeds HijackedResponse, so existing stream handling is unchanged (only the stdcopy import path moved).
• SDK factory — client.NewClientWithOpts(...) → mobyclient.New(...); dropped WithAPIVersionNegotiation() (now the default).
• registry.go — since *mobyclient.Client directly satisfies go-containerregistry's daemon.Client, the previously separate daemon client is dropped and a single client serves both ImageBuild and daemon.Image/daemon.Write.

~670 lines, mostly mechanical option/result adaptation + test fixtures.

Test plan

• go build ./...
• go vet ./...
• go test ./pkg/container/... — all pass
• golangci-lint run ./pkg/container/... — 0 issues
• gofmt clean; GOOS=windows go build ./pkg/container/docker/sdk/ compiles
• No github.com/docker/docker / go-connections/nat source imports remain in pkg/
• Needs review + manual Docker integration testing of the full container lifecycle (deploy/list/stop/remove, network isolation, ingress/egress squid, DNS). Unit tests pass against the fake, but the live-daemon paths (port bindings, host IPs, attach/logs streaming) were not exercised against a real daemon in this change.

Reviewer notes (behavior-equivalence)

• HostConfig.DNS now returns an error on an unparseable address (was silent passthrough). In practice additionalDNS only ever comes from an inspected container IP, so this path shouldn't trigger.
• Please sanity-check parseHostIP, getDockerBridgeGatewayIP, the DNS-IP extraction in createDnsContainer, and the network.Port rework in setupExposedPorts/setupPortBindings/comparePortConfig.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 66.32653% with 33 lines in your changes missing coverage. Please review.
✅ Project coverage is 68.85%. Comparing base (8fce30e) to head (233f4a9).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/container/docker/client.go	65.47%	27 Missing and 2 partials ⚠️
pkg/container/images/registry.go	33.33%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5420      +/-   ##
==========================================
- Coverage   68.85%   68.85%   -0.01%     
==========================================
  Files         634      634              
  Lines       64422    64433      +11     
==========================================
+ Hits        44358    44363       +5     
- Misses      16783    16788       +5     
- Partials     3281     3282       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.