From 2d02a313dd7e669577dc5035afb7fe4f761caccb Mon Sep 17 00:00:00 2001
From: Steve Azzopardi <steveazz@outlook.com>
Date: Fri, 8 Feb 2019 08:20:50 +0100
Subject: [PATCH] Version pin github.com/docker/docker

Change the source for `github.com/docker/docker` to
`github.com/docker/engine` and version pin it to the latest tag `18.09`
this would match the version of `github.com/docker/cli`. There is a good
explantion as to why use `github.com/docker/engine` as a source instead
of `github.com/moby/moby` in
https://github.com/moby/moby/issues/38063#issuecomment-431324613.

Some other related issues as to why using `github.com/docker/engine` is
ideal:
- https://github.com/moby/moby/issues/38507
- https://github.com/moby/moby/issues/38134
- https://github.com/moby/moby/issues/37683
- https://github.com/moby/moby/issues/37529
- https://github.com/moby/moby/issues/38063

https://gitlab.com/gitlab-org/gitlab-runner/issues/3488
---
 Gopkg.lock                                    |   7 +-
 Gopkg.toml                                    |   7 +-
 vendor/github.com/docker/docker/AUTHORS       |  42 +-
 vendor/github.com/docker/docker/LICENSE       |   2 +-
 vendor/github.com/docker/docker/api/common.go |   2 +-
 .../docker/api/server/httputils/errors.go     |   6 +-
 .../docker/api/server/httputils/httputils.go  |   6 +-
 .../docker/api/server/middleware/version.go   |   2 +-
 .../docker/api/server/router/build/build.go   |   4 +-
 .../api/server/router/container/container.go  |   8 +-
 .../router/container/container_routes.go      |  14 +-
 .../docker/api/server/router/experimental.go  |   2 +-
 .../docker/api/server/router/image/image.go   |   6 +-
 .../docker/docker/api/server/router/local.go  |  33 ++
 .../api/server/router/network/network.go      |   2 +-
 .../docker/api/server/router/plugin/plugin.go |   8 +-
 .../docker/api/server/router/swarm/cluster.go |   4 +-
 .../api/server/router/swarm/cluster_routes.go |  43 +-
 .../docker/api/server/router/system/system.go |   4 +-
 .../docker/api/server/router/volume/volume.go |   2 +-
 .../docker/docker/api/server/server.go        |   5 +-
 .../docker/api/types/container/host_config.go |   1 -
 .../docker/docker/api/types/filters/parse.go  |  16 -
 .../docker/api/types/filters/parse_test.go    |   8 -
 .../docker/docker/api/types/mount/mount.go    |   3 +-
 .../docker/docker/api/types/stats.go          |   4 +-
 .../api/types/strslice/strslice_test.go       |   4 +-
 .../docker/api/types/swarm/container.go       |   1 -
 .../docker/docker/api/types/swarm/swarm.go    |   2 -
 .../docker/docker/api/types/swarm/task.go     |   1 -
 .../docker/docker/api/types/types.go          |   1 -
 .../docker/builder/builder-next/builder.go    |   4 +-
 .../docker/builder/dockerfile/buildargs.go    |   2 +-
 .../builder/dockerfile/evaluator_test.go      |   5 +-
 .../builder/dockerfile/internals_test.go      |   9 +-
 .../github.com/docker/docker/client/client.go |  31 +-
 .../docker/docker/client/client_test.go       |  16 +-
 .../docker/docker/client/container_inspect.go |   2 +-
 .../docker/client/container_logs_test.go      |   2 +-
 .../docker/client/container_wait_test.go      |   2 +-
 .../docker/docker/client/request.go           |  14 +-
 .../docker/docker/client/service_logs_test.go |   2 +-
 .../docker/docker/client/service_update.go    |   4 +-
 .../docker/docker/cmd/dockerd/daemon.go       |  61 +--
 .../docker/docker/cmd/dockerd/daemon_test.go  |  20 +-
 .../docker/docker/cmd/dockerd/docker.go       |   7 -
 .../docker/docker/cmd/dockerd/options.go      |  16 +
 .../docker/cmd/dockerd/service_windows.go     |   6 +-
 .../docker/docker/container/container_unix.go |  28 +-
 .../docker/container/container_windows.go     |   2 +-
 .../docker/docker/container/mounts_unix.go    |  11 +-
 .../docker/docker/container/view.go           |   2 +-
 .../docker/{oci => daemon}/caps/utils.go      |   2 +-
 .../docker/docker/daemon/checkpoint.go        |   4 +-
 .../daemon/cluster/convert/container.go       |   8 -
 .../docker/daemon/cluster/convert/service.go  |   4 +-
 .../docker/daemon/cluster/convert/swarm.go    |   1 -
 .../cluster/executor/container/container.go   |   3 -
 .../cluster/executor/container/controller.go  |   2 +-
 .../cluster/executor/container/validate.go    |   7 +-
 .../container/validate_windows_test.go        |  16 -
 .../docker/docker/daemon/cluster/filters.go   |   2 -
 .../docker/daemon/cluster/listen_addr.go      |  19 -
 .../docker/daemon/cluster/noderunner.go       |   7 +-
 .../docker/docker/daemon/cluster/swarm.go     |   7 -
 .../docker/docker/daemon/config/config.go     |  14 +-
 .../docker/docker/daemon/container.go         | 187 +++----
 .../daemon/container_operations_unix.go       |   4 +
 .../daemon/container_operations_windows.go    |   4 +
 .../github.com/docker/docker/daemon/daemon.go | 212 +++-----
 .../docker/docker/daemon/daemon_unix.go       |  79 +--
 .../docker/docker/daemon/daemon_unix_test.go  | 110 ----
 .../docker/docker/daemon/daemon_windows.go    |  21 +-
 .../github.com/docker/docker/daemon/errors.go |   4 +-
 .../docker/docker/daemon/exec_linux.go        |   2 +-
 .../docker/daemon/graphdriver/aufs/aufs.go    |  10 +-
 .../daemon/graphdriver/aufs/mount_linux.go    |   7 +
 .../graphdriver/aufs/mount_unsupported.go     |  12 +
 .../docker/daemon/graphdriver/btrfs/btrfs.go  |   2 +-
 .../daemon/graphdriver/devmapper/deviceset.go |   4 +-
 .../daemon/graphdriver/devmapper/driver.go    |   7 +-
 .../docker/daemon/graphdriver/driver.go       |   7 +-
 .../docker/daemon/graphdriver/fsdiff.go       |   4 +-
 .../docker/daemon/graphdriver/lcow/lcow.go    |   6 +-
 .../daemon/graphdriver/lcow/lcow_svm.go       |  17 +-
 .../daemon/graphdriver/windows/windows.go     |   2 +-
 .../docker/daemon/graphdriver/zfs/zfs.go      |   3 +-
 .../docker/docker/daemon/images/images.go     |  13 +-
 .../github.com/docker/docker/daemon/info.go   |   2 +-
 .../docker/docker/daemon/info_unix.go         |  10 +-
 .../docker/docker/daemon/licensing_test.go    |   2 +-
 .../docker/docker/daemon/links/links.go       |   4 +-
 .../github.com/docker/docker/daemon/list.go   |   6 +-
 .../docker/daemon/listeners/group_unix.go     |  18 +-
 .../docker/daemon/logdrivers_windows.go       |   1 -
 .../daemon/logger/awslogs/cloudwatchlogs.go   | 165 ++----
 .../logger/awslogs/cloudwatchlogs_test.go     | 128 +----
 .../docker/daemon/logger/gelf/gelf_test.go    |   2 +-
 .../docker/daemon/logger/journald/journald.go |  11 +-
 .../docker/daemon/logger/journald/read.go     |  10 +-
 .../docker/docker/daemon/logger/logger.go     |   2 +-
 .../daemon/logger/loggerutils/logfile.go      |   4 +-
 .../daemon/logger/splunk/splunk_test.go       |  14 +-
 .../docker/daemon/logger/syslog/syslog.go     |   2 +-
 .../daemon/logger/syslog/syslog_test.go       |  97 ----
 .../docker/docker/daemon/metrics.go           |   2 +-
 .../docker/docker/daemon/metrics_unix.go      |   2 +-
 .../docker/docker/{oci => daemon}/oci.go      |  26 +-
 .../docker/docker/daemon/oci_linux.go         |  49 +-
 .../docker/docker/daemon/oci_linux_test.go    | 116 ++--
 .../docker/docker/daemon/oci_windows.go       |  28 +-
 .../github.com/docker/docker/daemon/reload.go |  21 +-
 .../github.com/docker/docker/daemon/rename.go |   3 +-
 .../github.com/docker/docker/daemon/start.go  |   2 +-
 .../docker/docker/daemon/volumes_unix.go      |  14 +-
 .../docker/docker/distribution/errors.go      |   7 +-
 .../docker/docker/dockerversion/useragent.go  |   6 +-
 .../docker/dockerversion/version_lib.go       |   2 +-
 .../docker/docker/errdefs/helpers.go          |  55 +-
 .../agent/worker/executor.go                  |   2 +-
 .../agent/worker/worker.go                    |   2 +-
 .../host/dockercmd.go                         |   9 +-
 .../integration-cli-on-swarm/host/host.go     |   6 +-
 .../docker/integration-cli/check_test.go      |  16 +-
 .../integration-cli/daemon/daemon_swarm.go    |  15 +-
 .../integration-cli/docker_api_attach_test.go |   2 +-
 .../integration-cli/docker_api_build_test.go  |   8 +-
 .../docker_api_containers_test.go             | 225 +++-----
 .../docker_api_containers_windows_test.go     |   2 +-
 .../integration-cli/docker_api_create_test.go | 136 +++++
 .../integration-cli/docker_api_exec_test.go   |   6 +-
 .../integration-cli/docker_api_images_test.go |   8 +-
 .../docker_api_inspect_test.go                |   2 +-
 .../docker_api_ipcmode_test.go                |  81 +++
 .../integration-cli/docker_api_logs_test.go   |   8 +-
 .../integration-cli/docker_api_stats_test.go  |   6 +-
 .../docker_api_swarm_node_test.go             |   2 +-
 .../docker_api_swarm_service_test.go          |  11 +-
 .../integration-cli/docker_api_swarm_test.go  |  57 +-
 .../docker_cli_attach_unix_test.go            |  68 ++-
 .../integration-cli/docker_cli_build_test.go  |  29 +-
 .../docker_cli_config_create_test.go          |  33 ++
 .../integration-cli/docker_cli_cp_test.go     |  10 +-
 .../docker_cli_cp_to_container_test.go        |   2 +-
 .../docker_cli_cp_to_container_unix_test.go   |   4 +-
 .../docker_cli_cp_utils_test.go               |   2 +-
 .../integration-cli/docker_cli_create_test.go |   4 +-
 .../docker_cli_daemon_plugins_test.go         |   4 +-
 .../integration-cli/docker_cli_daemon_test.go |  97 +++-
 .../integration-cli/docker_cli_events_test.go |   4 +-
 .../docker_cli_events_unix_test.go            |   4 +-
 .../integration-cli/docker_cli_exec_test.go   |   6 +-
 .../docker_cli_exec_unix_test.go              |   6 +-
 .../docker_cli_export_import_test.go          |  34 ++
 ...er_cli_external_volume_driver_unix_test.go |   2 +-
 .../integration-cli/docker_cli_info_test.go   |  12 +-
 .../docker_cli_info_unix_test.go              |   2 +-
 .../integration-cli/docker_cli_links_test.go  |   4 +-
 .../docker_cli_network_unix_test.go           |  26 +-
 .../docker_cli_plugins_logdriver_test.go      |   2 +-
 .../docker_cli_plugins_test.go                |   4 +-
 .../integration-cli/docker_cli_proxy_test.go  |   4 +-
 .../docker_cli_restart_test.go                |   8 +-
 .../integration-cli/docker_cli_run_test.go    |  82 +--
 .../docker_cli_run_unix_test.go               |  76 +--
 .../docker_cli_save_load_test.go              |   2 +-
 .../docker_cli_secret_create_test.go          |  95 ++++
 .../docker_cli_service_update_test.go         | 137 +++++
 .../integration-cli/docker_cli_start_test.go  |   9 +-
 .../integration-cli/docker_cli_swarm_test.go  | 180 +++++--
 .../docker_cli_update_unix_test.go            |   2 +-
 .../integration-cli/docker_cli_userns_test.go |   2 +-
 .../integration-cli/docker_cli_volume_test.go |   6 +-
 .../integration-cli/docker_cli_wait_test.go   |  98 ++++
 .../docker_hub_pull_suite_test.go             |   2 +-
 .../integration-cli/docker_utils_test.go      |  10 +-
 .../integration-cli/requirements_test.go      |  24 +-
 .../integration-cli/requirements_unix_test.go |  17 +-
 .../integration/build/build_session_test.go   |   2 +-
 .../integration/build/build_squash_test.go    |   2 +-
 .../docker/integration/build/build_test.go    |  36 +-
 .../docker/integration/config/config_test.go  |   2 +-
 .../integration/container/create_test.go      |  97 +---
 .../container/daemon_linux_test.go            |  14 +-
 .../docker/integration/container/diff_test.go |   3 +-
 .../docker/integration/container/exec_test.go |   5 +-
 .../integration/container/export_test.go      |  12 +-
 .../integration/container/health_test.go      |   3 +-
 ...{ipcmode_linux_test.go => ipcmode_test.go} | 127 +----
 .../docker/integration/container/kill_test.go |  12 +-
 .../integration/container/links_linux_test.go |   7 +-
 .../docker/integration/container/logs_test.go |   5 +-
 .../container/mounts_linux_test.go            | 119 ++---
 .../docker/integration/container/nat_test.go  |  16 +-
 .../integration/container/pause_test.go       |   6 +-
 .../docker/integration/container/ps_test.go   |   3 +-
 .../integration/container/remove_test.go      |  13 +-
 .../integration/container/rename_test.go      |  19 +-
 .../integration/container/resize_test.go      |   7 +-
 .../integration/container/restart_test.go     |   9 +-
 .../integration/container/run_linux_test.go   |  91 ----
 .../integration/container/stats_test.go       |   3 +-
 .../integration/container/stop_linux_test.go  |   7 +-
 .../docker/integration/container/stop_test.go |   3 +-
 .../container/stop_windows_test.go            |   3 +-
 .../container/update_linux_test.go            |   7 +-
 .../integration/container/update_test.go      |   5 +-
 .../docker/integration/container/wait_test.go | 102 ----
 .../docker/integration/image/commit_test.go   |   3 +-
 .../docker/integration/image/import_test.go   |  11 +-
 .../docker/integration/image/list_test.go     |  49 --
 .../docker/integration/image/remove_test.go   |   3 +-
 .../docker/integration/image/tag_test.go      |  13 +-
 .../integration/internal/container/ops.go     |   8 -
 .../integration/internal/container/states.go  |  18 -
 .../integration/internal/network/states.go    |  20 -
 .../integration/internal/swarm/service.go     |  53 +-
 .../docker/integration/network/delete_test.go |  13 +-
 .../integration/network/inspect_test.go       |  12 +-
 .../integration/network/ipvlan/ipvlan_test.go |  19 +-
 .../network/macvlan/macvlan_test.go           |  19 +-
 .../integration/network/network_test.go       |  23 +-
 .../integration/network/service_test.go       | 180 ++-----
 .../plugin/authz/authz_plugin_test.go         |  92 ++--
 .../plugin/authz/authz_plugin_v2_test.go      |  41 +-
 .../plugin/logging/helpers_test.go            |   2 +-
 .../plugin/logging/logging_linux_test.go      |   2 +-
 .../plugin/logging/validation_test.go         |   9 +-
 .../plugin/volumes/helpers_test.go            |   2 +-
 .../integration/plugin/volumes/mounts_test.go |  11 +-
 .../docker/integration/secret/secret_test.go  |  74 +--
 .../docker/integration/service/create_test.go | 166 +-----
 .../integration/service/inspect_test.go       |   2 +-
 .../docker/integration/service/update_test.go | 233 --------
 .../system/cgroupdriver_systemd_test.go       |  14 +-
 .../docker/integration/system/event_test.go   |   4 +-
 .../integration/system/info_linux_test.go     |   7 +-
 .../docker/integration/system/info_test.go    |  11 +-
 .../docker/integration/system/login_test.go   |   4 +-
 .../docker/integration/system/version_test.go |   4 +-
 .../docker/integration/volume/volume_test.go  |   6 +-
 .../docker/internal/test/daemon/daemon.go     |  43 +-
 .../internal/test/daemon/daemon_unix.go       |   2 +-
 .../docker/internal/test/daemon/node.go       |   2 +-
 .../docker/docker/internal/test/daemon/ops.go |   7 -
 .../docker/internal/test/daemon/swarm.go      |  35 +-
 .../internal/test/environment/environment.go  |   6 -
 .../internal/test/fakestorage/storage.go      |   2 +-
 .../internal/test/fixtures/plugin/plugin.go   |   4 +-
 .../docker/docker/layer/layer_store.go        |   7 +-
 .../docker/docker/layer/layer_windows.go      |   2 +-
 .../libcontainerd/client_local_windows.go     |  29 +-
 .../libcontainerd/supervisor/remote_daemon.go |   2 +-
 .../docker/docker/migrate/v1/migratev1.go     | 501 ++++++++++++++++++
 .../docker/migrate/v1/migratev1_test.go       | 437 +++++++++++++++
 .../docker/docker/opts/hosts_test.go          |  24 +-
 .../docker/docker/pkg/archive/archive.go      |   8 +-
 .../docker/pkg/archive/archive_linux.go       | 179 +------
 .../docker/pkg/archive/archive_linux_test.go  | 132 -----
 .../docker/pkg/archive/archive_other.go       |   2 +-
 .../docker/docker/pkg/archive/archive_test.go |  40 +-
 .../docker/pkg/archive/archive_unix_test.go   |  22 +-
 .../docker/docker/pkg/archive/changes.go      |  12 +-
 .../docker/docker/pkg/archive/changes_test.go | 116 ++--
 .../docker/docker/pkg/archive/changes_unix.go |   8 +-
 .../docker/pkg/archive/changes_windows.go     |   8 +-
 .../docker/docker/pkg/archive/diff.go         |  10 +-
 .../docker/docker/pkg/archive/diff_test.go    |  25 +-
 .../docker/pkg/authorization/api_test.go      |   2 +-
 .../docker/docker/pkg/authorization/authz.go  |  38 +-
 .../pkg/authorization/authz_unix_test.go      |  86 ++-
 .../docker/docker/pkg/fileutils/fileutils.go  |   2 +-
 .../docker/docker/pkg/mount/mount.go          |  62 +--
 .../docker/pkg/mount/mounter_freebsd.go       |  17 +-
 .../docker/docker/pkg/mount/mounter_linux.go  |  30 +-
 .../docker/pkg/mount/mounter_unsupported.go   |   4 +
 .../pkg/mount/sharedsubtree_linux_test.go     |   3 +-
 .../docker/docker/pkg/mount/unmount_unix.go   |  22 -
 .../docker/pkg/mount/unmount_unsupported.go   |   7 -
 .../pkg/namesgenerator/names-generator.go     |  36 --
 .../pkg/parsers/kernel/kernel_unix_test.go    |   1 -
 .../docker/docker/pkg/plugins/plugins.go      |   2 +-
 .../docker/docker/pkg/signal/signal_linux.go  |   2 -
 .../docker/pkg/signal/signal_linux_mipsx.go   |  84 ---
 .../pkg/streamformatter/streamformatter.go    |   2 +-
 .../docker/docker/pkg/symlink/LICENSE.APACHE  |   2 +-
 .../docker/docker/pkg/symlink/LICENSE.BSD     |   2 +-
 .../docker/docker/pkg/sysinfo/sysinfo.go      |   3 -
 .../docker/pkg/sysinfo/sysinfo_linux.go       |   5 -
 .../docker/docker/pkg/system/lstat_unix.go    |   3 +-
 .../docker/docker/pkg/system/path_unix.go     |  10 -
 .../docker/docker/pkg/system/path_windows.go  |  24 -
 .../docker/docker/pkg/system/stat_unix.go     |   3 +-
 .../docker/docker/plugin/manager_linux.go     |   2 +-
 .../docker/docker/project/CONTRIBUTING.md     |   1 +
 .../docker/docker/reference/store.go          |   5 -
 .../docker/docker/reference/store_test.go     |  18 +-
 .../docker/docker/registry/service_v2.go      |   4 +-
 .../docker/runconfig/hostconfig_test.go       |  16 +-
 .../docker/docker/volume/local/local.go       |  23 +-
 .../docker/docker/volume/local/local_unix.go  |  35 +-
 .../docker/volume/local/local_windows.go      |   8 +-
 .../docker/volume/mounts/linux_parser.go      |   3 -
 .../docker/docker/volume/service/opts/opts.go |   2 +-
 .../docker/docker/volume/service/service.go   |  22 +-
 .../docker/docker/volume/service/store.go     |   2 +-
 306 files changed, 3673 insertions(+), 4290 deletions(-)
 rename vendor/github.com/docker/docker/{oci => daemon}/caps/utils.go (98%)
 create mode 100644 vendor/github.com/docker/docker/daemon/graphdriver/aufs/mount_linux.go
 create mode 100644 vendor/github.com/docker/docker/daemon/graphdriver/aufs/mount_unsupported.go
 rename vendor/github.com/docker/docker/{oci => daemon}/oci.go (74%)
 create mode 100644 vendor/github.com/docker/docker/integration-cli/docker_api_create_test.go
 create mode 100644 vendor/github.com/docker/docker/integration-cli/docker_api_ipcmode_test.go
 create mode 100644 vendor/github.com/docker/docker/integration-cli/docker_cli_config_create_test.go
 create mode 100644 vendor/github.com/docker/docker/integration-cli/docker_cli_export_import_test.go
 create mode 100644 vendor/github.com/docker/docker/integration-cli/docker_cli_secret_create_test.go
 create mode 100644 vendor/github.com/docker/docker/integration-cli/docker_cli_service_update_test.go
 create mode 100644 vendor/github.com/docker/docker/integration-cli/docker_cli_wait_test.go
 rename vendor/github.com/docker/docker/integration/container/{ipcmode_linux_test.go => ipcmode_test.go} (57%)
 delete mode 100644 vendor/github.com/docker/docker/integration/container/run_linux_test.go
 delete mode 100644 vendor/github.com/docker/docker/integration/container/wait_test.go
 delete mode 100644 vendor/github.com/docker/docker/integration/image/list_test.go
 delete mode 100644 vendor/github.com/docker/docker/integration/internal/network/states.go
 delete mode 100644 vendor/github.com/docker/docker/integration/service/update_test.go
 create mode 100644 vendor/github.com/docker/docker/migrate/v1/migratev1.go
 create mode 100644 vendor/github.com/docker/docker/migrate/v1/migratev1_test.go
 delete mode 100644 vendor/github.com/docker/docker/pkg/mount/unmount_unix.go
 delete mode 100644 vendor/github.com/docker/docker/pkg/mount/unmount_unsupported.go
 delete mode 100644 vendor/github.com/docker/docker/pkg/signal/signal_linux_mipsx.go
 delete mode 100644 vendor/github.com/docker/docker/pkg/system/path_unix.go
 delete mode 100644 vendor/github.com/docker/docker/pkg/system/path_windows.go
 create mode 120000 vendor/github.com/docker/docker/project/CONTRIBUTING.md

diff --git a/Gopkg.lock b/Gopkg.lock
index 90c253ee9..3b2174595 100644
--- a/Gopkg.lock
+++ b/Gopkg.lock
@@ -144,8 +144,7 @@
   version = "v2.7.0"
 
 [[projects]]
-  branch = "master"
-  digest = "1:f42dd37461aa6e799cbd6165311d1be69c670d62685fe325853a0363763d2b83"
+  digest = "1:2b83a7c64adb49e6068c189032bbdd63638abfa29ec108cb9a6d03dd58beebfe"
   name = "github.com/docker/docker"
   packages = [
     "api",
@@ -182,7 +181,9 @@
     "registry/resumable",
   ]
   pruneopts = "N"
-  revision = "beef00cb2612754d73024fd89d417b3a7114f87f"
+  revision = "a79fabbfe84117696a19671f4aa88b82d0f64fc1"
+  source = "github.com/docker/engine"
+  version = "v18.09.1"
 
 [[projects]]
   digest = "1:ee3f6491ac8a1721b5fa9655da1f7a11e4ab56c0eaf8ffe79debaee49807cfab"
diff --git a/Gopkg.toml b/Gopkg.toml
index a22189a3f..603bd0462 100644
--- a/Gopkg.toml
+++ b/Gopkg.toml
@@ -42,9 +42,14 @@ ignored = ["test", "appengine"]
   name = "github.com/docker/distribution"
   version = "2.7"
 
+# We are using `github.com/docker/engine` as source since it has tagged
+# versions, unlike `github.com/moby/moby`, please read
+# https://github.com/moby/moby/issues/38063#issuecomment-431324613 for a
+# detailed explanation.
 [[constraint]]
   name = "github.com/docker/docker"
-  branch = "master"
+  source = "github.com/docker/engine"
+  version = "18.09"
 
 [[constraint]]
   name = "github.com/docker/cli"
diff --git a/vendor/github.com/docker/docker/AUTHORS b/vendor/github.com/docker/docker/AUTHORS
index c6c8fb40e..46102d740 100644
--- a/vendor/github.com/docker/docker/AUTHORS
+++ b/vendor/github.com/docker/docker/AUTHORS
@@ -201,7 +201,6 @@ Ben Severson <BenSeverson@users.noreply.github.com>
 Ben Toews <mastahyeti@gmail.com>
 Ben Wiklund <ben@daisyowl.com>
 Benjamin Atkin <ben@benatkin.com>
-Benjamin Baker <Benjamin.baker@utexas.edu>
 Benjamin Boudreau <boudreau.benjamin@gmail.com>
 Benjamin Yolken <yolken@stripe.com>
 Benoit Chesneau <bchesneau@gmail.com>
@@ -247,7 +246,6 @@ Brian Torres-Gil <brian@dralth.com>
 Brian Trump <btrump@yelp.com>
 Brice Jaglin <bjaglin@teads.tv>
 Briehan Lombaard <briehan.lombaard@gmail.com>
-Brielle Broder <bbroder@google.com>
 Bruno Bigras <bigras.bruno@gmail.com>
 Bruno Binet <bruno.binet@gmail.com>
 Bruno Gazzera <bgazzera@paginar.com>
@@ -327,11 +325,9 @@ Chris Swan <chris.swan@iee.org>
 Chris Telfer <ctelfer@docker.com>
 Chris Wahl <github@wahlnetwork.com>
 Chris Weyl <cweyl@alumni.drew.edu>
-Chris White <me@cwprogram.com>
 Christian Berendt <berendt@b1-systems.de>
 Christian Brauner <christian.brauner@ubuntu.com>
 Christian Böhme <developement@boehme3d.de>
-Christian Muehlhaeuser <muesli@gmail.com>
 Christian Persson <saser@live.se>
 Christian Rotzoll <ch.rotzoll@gmail.com>
 Christian Simon <simon@swine.de>
@@ -448,7 +444,6 @@ David Röthlisberger <david@rothlis.net>
 David Sheets <dsheets@docker.com>
 David Sissitka <me@dsissitka.com>
 David Trott <github@davidtrott.com>
-David Wang <00107082@163.com>
 David Williamson <david.williamson@docker.com>
 David Xia <dxia@spotify.com>
 David Young <yangboh@cn.ibm.com>
@@ -456,7 +451,6 @@ Davide Ceretti <davide.ceretti@hogarthww.com>
 Dawn Chen <dawnchen@google.com>
 dbdd <wangtong2712@gmail.com>
 dcylabs <dcylabs@gmail.com>
-Debayan De <debayande@users.noreply.github.com>
 Deborah Gertrude Digges <deborah.gertrude.digges@gmail.com>
 deed02392 <georgehafiz@gmail.com>
 Deng Guangxing <dengguangxing@huawei.com>
@@ -509,7 +503,6 @@ Don Kjer <don.kjer@gmail.com>
 Don Spaulding <donspauldingii@gmail.com>
 Donald Huang <don.hcd@gmail.com>
 Dong Chen <dongluo.chen@docker.com>
-Donghwa Kim <shanytt@gmail.com>
 Donovan Jones <git@gamma.net.nz>
 Doron Podoleanu <doronp@il.ibm.com>
 Doug Davis <dug@us.ibm.com>
@@ -587,7 +580,6 @@ Eystein Måløy Stenberg <eystein.maloy.stenberg@cfengine.com>
 ezbercih <cem.ezberci@gmail.com>
 Ezra Silvera <ezra@il.ibm.com>
 Fabian Lauer <kontakt@softwareschmiede-saar.de>
-Fabian Raetz <fabian.raetz@gmail.com>
 Fabiano Rosas <farosas@br.ibm.com>
 Fabio Falci <fabiofalci@gmail.com>
 Fabio Kung <fabio.kung@gmail.com>
@@ -599,7 +591,6 @@ Faiz Khan <faizkhan00@gmail.com>
 falmp <chico.lopes@gmail.com>
 Fangming Fang <fangming.fang@arm.com>
 Fangyuan Gao <21551127@zju.edu.cn>
-fanjiyun <fan.jiyun@zte.com.cn>
 Fareed Dudhia <fareeddudhia@googlemail.com>
 Fathi Boudra <fathi.boudra@linaro.org>
 Federico Gimenez <fgimenez@coit.es>
@@ -630,7 +621,6 @@ Florin Patan <florinpatan@gmail.com>
 fonglh <fonglh@gmail.com>
 Foysal Iqbal <foysal.iqbal.fb@gmail.com>
 Francesc Campoy <campoy@google.com>
-Francesco Mari <mari.francesco@gmail.com>
 Francis Chuang <francis.chuang@boostport.com>
 Francisco Carriedo <fcarriedo@gmail.com>
 Francisco Souza <f@souza.cc>
@@ -663,7 +653,6 @@ Gaël PORTAY <gael.portay@savoirfairelinux.com>
 Genki Takiuchi <genki@s21g.com>
 GennadySpb <lipenkov@gmail.com>
 Geoffrey Bachelet <grosfrais@gmail.com>
-Geon Kim <geon0250@gmail.com>
 George Kontridze <george@bugsnag.com>
 George MacRorie <gmacr31@gmail.com>
 George Xie <georgexsh@gmail.com>
@@ -687,7 +676,6 @@ Gopikannan Venugopalsamy <gopikannan.venugopalsamy@gmail.com>
 Gosuke Miyashita <gosukenator@gmail.com>
 Gou Rao <gou@portworx.com>
 Govinda Fichtner <govinda.fichtner@googlemail.com>
-Grant Millar <grant@cylo.io>
 Grant Reaber <grant.reaber@gmail.com>
 Graydon Hoare <graydon@pobox.com>
 Greg Fausak <greg@tacodata.com>
@@ -706,7 +694,6 @@ Guruprasad <lgp171188@gmail.com>
 Gustav Sinder <gustav.sinder@gmail.com>
 gwx296173 <gaojing3@huawei.com>
 Günter Zöchbauer <guenter@gzoechbauer.com>
-haikuoliu <haikuo@amazon.com>
 Hakan Özler <hakan.ozler@kodcu.com>
 Hans Kristian Flaatten <hans@starefossen.com>
 Hans Rødtang <hansrodtang@gmail.com>
@@ -748,7 +735,6 @@ Ian Bishop <ianbishop@pace7.com>
 Ian Bull <irbull@gmail.com>
 Ian Calvert <ianjcalvert@gmail.com>
 Ian Campbell <ian.campbell@docker.com>
-Ian Chen <ianre657@gmail.com>
 Ian Lee <IanLee1521@gmail.com>
 Ian Main <imain@redhat.com>
 Ian Philpot <ian.philpot@microsoft.com>
@@ -769,7 +755,6 @@ Ingo Gottwald <in.gottwald@gmail.com>
 Isaac Dupree <antispam@idupree.com>
 Isabel Jimenez <contact.isabeljimenez@gmail.com>
 Isao Jonas <isao.jonas@gmail.com>
-Iskander Sharipov <quasilyte@gmail.com>
 Ivan Babrou <ibobrik@gmail.com>
 Ivan Fraixedes <ifcdev@gmail.com>
 Ivan Grcic <igrcic@gmail.com>
@@ -862,7 +847,7 @@ Jeroen Franse <jeroenfranse@gmail.com>
 Jeroen Jacobs <github@jeroenj.be>
 Jesse Dearing <jesse.dearing@gmail.com>
 Jesse Dubay <jesse@thefortytwo.net>
-Jessica Frazelle <acidburn@microsoft.com>
+Jessica Frazelle <jessfraz@google.com>
 Jezeniel Zapanta <jpzapanta22@gmail.com>
 Jhon Honce <jhonce@redhat.com>
 Ji.Zhilong <zhilongji@gmail.com>
@@ -998,7 +983,6 @@ Karl Grzeszczak <karlgrz@gmail.com>
 Karol Duleba <mr.fuxi@gmail.com>
 Karthik Karanth <karanth.karthik@gmail.com>
 Karthik Nayak <Karthik.188@gmail.com>
-Kasper Fabæch Brandt <poizan@poizan.dk>
 Kate Heddleston <kate.heddleston@gmail.com>
 Katie McLaughlin <katie@glasnt.com>
 Kato Kazuyoshi <kato.kazuyoshi@gmail.com>
@@ -1006,7 +990,6 @@ Katrina Owen <katrina.owen@gmail.com>
 Kawsar Saiyeed <kawsar.saiyeed@projiris.com>
 Kay Yan <kay.yan@daocloud.io>
 kayrus <kay.diam@gmail.com>
-Kazuhiro Sera <seratch@gmail.com>
 Ke Li <kel@splunk.com>
 Ke Xu <leonhartx.k@gmail.com>
 Kei Ohmura <ohmura.kei@gmail.com>
@@ -1015,7 +998,6 @@ Keli Hu <dev@keli.hu>
 Ken Cochrane <kencochrane@gmail.com>
 Ken Herner <kherner@progress.com>
 Ken ICHIKAWA <ichikawa.ken@jp.fujitsu.com>
-Ken Reese <krrgithub@gmail.com>
 Kenfe-Mickaël Laventure <mickael.laventure@gmail.com>
 Kenjiro Nakayama <nakayamakenjiro@gmail.com>
 Kent Johnson <kentoj@gmail.com>
@@ -1053,9 +1035,9 @@ Krasimir Georgiev <support@vip-consult.co.uk>
 Kris-Mikael Krister <krismikael@protonmail.com>
 Kristian Haugene <kristian.haugene@capgemini.com>
 Kristina Zabunova <triara.xiii@gmail.com>
+krrg <krrgithub@gmail.com>
 Kun Zhang <zkazure@gmail.com>
 Kunal Kushwaha <kushwaha_kunal_v7@lab.ntt.co.jp>
-Kunal Tyagi <tyagi.kunal@live.com>
 Kyle Conroy <kyle.j.conroy@gmail.com>
 Kyle Linden <linden.kyle@gmail.com>
 kyu <leehk1227@gmail.com>
@@ -1078,7 +1060,6 @@ Leandro Siqueira <leandro.siqueira@gmail.com>
 Lee Chao <932819864@qq.com>
 Lee, Meng-Han <sunrisedm4@gmail.com>
 leeplay <hyeongkyu.lee@navercorp.com>
-Lei Gong <lgong@alauda.io>
 Lei Jitang <leijitang@huawei.com>
 Len Weincier <len@cloudafrica.net>
 Lennie <github@consolejunkie.net>
@@ -1114,7 +1095,6 @@ Lokesh Mandvekar <lsm5@fedoraproject.org>
 longliqiang88 <394564827@qq.com>
 Lorenz Leutgeb <lorenz.leutgeb@gmail.com>
 Lorenzo Fontana <lo@linux.com>
-Lotus Fenn <fenn.lotus@gmail.com>
 Louis Opter <kalessin@kalessin.fr>
 Luca Favatella <luca.favatella@erlang-solutions.com>
 Luca Marturana <lucamarturana@gmail.com>
@@ -1187,7 +1167,6 @@ Martijn van Oosterhout <kleptog@svana.org>
 Martin Honermeyer <maze@strahlungsfrei.de>
 Martin Kelly <martin@surround.io>
 Martin Mosegaard Amdisen <martin.amdisen@praqma.com>
-Martin Muzatko <martin@happy-css.com>
 Martin Redmond <redmond.martin@gmail.com>
 Mary Anthony <mary.anthony@docker.com>
 Masahito Zembutsu <zembutsu@users.noreply.github.com>
@@ -1269,9 +1248,8 @@ Michal Wieczorek <wieczorek-michal@wp.pl>
 Michaël Pailloncy <mpapo.dev@gmail.com>
 Michał Czeraszkiewicz <czerasz@gmail.com>
 Michał Gryko <github@odkurzacz.org>
-Michiel de Jong <michiel@unhosted.org>
-Mickaël Fortunato <morsi.morsicus@gmail.com>
-Mickaël Remars <mickael@remars.com>
+Michiel@unhosted <michiel@unhosted.org>
+Mickaël FORTUNATO <morsi.morsicus@gmail.com>
 Miguel Angel Fernández <elmendalerenda@gmail.com>
 Miguel Morales <mimoralea@gmail.com>
 Mihai Borobocea <MihaiBorob@gmail.com>
@@ -1359,7 +1337,6 @@ Nicolas Dudebout <nicolas.dudebout@gatech.edu>
 Nicolas Goy <kuon@goyman.com>
 Nicolas Kaiser <nikai@nikai.net>
 Nicolas Sterchele <sterchele.nicolas@gmail.com>
-Nicolas V Castet <nvcastet@us.ibm.com>
 Nicolás Hock Isaza <nhocki@gmail.com>
 Nigel Poulton <nigelpoulton@hotmail.com>
 Nik Nyby <nikolas@gnu.org>
@@ -1475,7 +1452,6 @@ Prasanna Gautam <prasannagautam@gmail.com>
 Pratik Karki <prertik@outlook.com>
 Prayag Verma <prayag.verma@gmail.com>
 Priya Wadhwa <priyawadhwa@google.com>
-Projjol Banerji <probaner23@gmail.com>
 Przemek Hejman <przemyslaw.hejman@gmail.com>
 Pure White <daniel48@126.com>
 pysqz <randomq@126.com>
@@ -1570,7 +1546,6 @@ Rozhnov Alexandr <nox73@ya.ru>
 Rudolph Gottesheim <r.gottesheim@loot.at>
 Rui Lopes <rgl@ruilopes.com>
 Runshen Zhu <runshen.zhu@gmail.com>
-Russ Magee <rmagee@gmail.com>
 Ryan Abrams <rdabrams@gmail.com>
 Ryan Anderson <anderson.ryanc@gmail.com>
 Ryan Aslett <github@mixologic.com>
@@ -1597,7 +1572,6 @@ Sachin Joshi <sachin_jayant_joshi@hotmail.com>
 Sagar Hani <sagarhani33@gmail.com>
 Sainath Grandhi <sainath.grandhi@intel.com>
 Sakeven Jiang <jc5930@sina.cn>
-Salahuddin Khan <salah@docker.com>
 Sally O'Malley <somalley@redhat.com>
 Sam Abed <sam.abed@gmail.com>
 Sam Alba <sam.alba@gmail.com>
@@ -1646,7 +1620,6 @@ Sergey Alekseev <sergey.alekseev.minsk@gmail.com>
 Sergey Evstifeev <sergey.evstifeev@gmail.com>
 Sergii Kabashniuk <skabashnyuk@codenvy.com>
 Serhat Gülçiçek <serhat25@gmail.com>
-SeungUkLee <lsy931106@gmail.com>
 Sevki Hasirci <s@sevki.org>
 Shane Canon <scanon@lbl.gov>
 Shane da Silva <shane@dasilva.io>
@@ -1741,11 +1714,10 @@ tang0th <tang0th@gmx.com>
 Tangi Colin <tangicolin@gmail.com>
 Tatsuki Sugiura <sugi@nemui.org>
 Tatsushi Inagaki <e29253@jp.ibm.com>
-Taylan Isikdemir <taylani@google.com>
 Taylor Jones <monitorjbl@gmail.com>
+tbonza <tylers.pile@gmail.com>
 Ted M. Young <tedyoung@gmail.com>
 Tehmasp Chaudhri <tehmasp@gmail.com>
-Tejaswini Duggaraju <naduggar@microsoft.com>
 Tejesh Mehta <tejesh.mehta@gmail.com>
 terryding77 <550147740@qq.com>
 tgic <farmer1992@gmail.com>
@@ -1839,7 +1811,6 @@ Tristan Carel <tristan@cogniteev.com>
 Troy Denton <trdenton@gmail.com>
 Tycho Andersen <tycho@docker.com>
 Tyler Brock <tyler.brock@gmail.com>
-Tyler Brown <tylers.pile@gmail.com>
 Tzu-Jung Lee <roylee17@gmail.com>
 uhayate <uhayate.gong@daocloud.io>
 Ulysse Carion <ulyssecarion@gmail.com>
@@ -1935,13 +1906,11 @@ XiaoBing Jiang <s7v7nislands@gmail.com>
 Xiaoxu Chen <chenxiaoxu14@otcaix.iscas.ac.cn>
 Xiaoyu Zhang <zhang.xiaoyu33@zte.com.cn>
 xiekeyang <xiekeyang@huawei.com>
-Ximo Guanter Gonzálbez <joaquin.guantergonzalbez@telefonica.com>
 Xinbo Weng <xihuanbo_0521@zju.edu.cn>
 Xinzi Zhou <imdreamrunner@gmail.com>
 Xiuming Chen <cc@cxm.cc>
 Xuecong Liao <satorulogic@gmail.com>
 xuzhaokui <cynicholas@gmail.com>
-Yadnyawalkya Tale <ytale@redhat.com>
 Yahya <ya7yaz@gmail.com>
 YAMADA Tsuyoshi <tyamada@minimum2scp.org>
 Yamasaki Masahide <masahide.y@gmail.com>
@@ -1972,7 +1941,6 @@ Yu-Ju Hong <yjhong@google.com>
 Yuan Sun <sunyuan3@huawei.com>
 Yuanhong Peng <pengyuanhong@huawei.com>
 Yuhao Fang <fangyuhao@gmail.com>
-Yuichiro Kaneko <spiketeika@gmail.com>
 Yunxiang Huang <hyxqshk@vip.qq.com>
 Yurii Rashkovskii <yrashk@gmail.com>
 Yves Junqueira <yves.junqueira@gmail.com>
diff --git a/vendor/github.com/docker/docker/LICENSE b/vendor/github.com/docker/docker/LICENSE
index 6d8d58fb6..9c8e20ab8 100644
--- a/vendor/github.com/docker/docker/LICENSE
+++ b/vendor/github.com/docker/docker/LICENSE
@@ -176,7 +176,7 @@
 
    END OF TERMS AND CONDITIONS
 
-   Copyright 2013-2018 Docker, Inc.
+   Copyright 2013-2017 Docker, Inc.
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
diff --git a/vendor/github.com/docker/docker/api/common.go b/vendor/github.com/docker/docker/api/common.go
index aa146cdae..4582eb92e 100644
--- a/vendor/github.com/docker/docker/api/common.go
+++ b/vendor/github.com/docker/docker/api/common.go
@@ -3,7 +3,7 @@ package api // import "github.com/docker/docker/api"
 // Common constants for daemon and client.
 const (
 	// DefaultVersion of Current REST API
-	DefaultVersion = "1.40"
+	DefaultVersion = "1.39"
 
 	// NoBaseImageSpecifier is the symbol used by the FROM
 	// command to specify that no base image is to be used.
diff --git a/vendor/github.com/docker/docker/api/server/httputils/errors.go b/vendor/github.com/docker/docker/api/server/httputils/errors.go
index 88e83139d..a21affff3 100644
--- a/vendor/github.com/docker/docker/api/server/httputils/errors.go
+++ b/vendor/github.com/docker/docker/api/server/httputils/errors.go
@@ -9,8 +9,8 @@ import (
 	"github.com/docker/docker/errdefs"
 	"github.com/gorilla/mux"
 	"github.com/sirupsen/logrus"
+	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
 )
 
 type causer interface {
@@ -89,14 +89,14 @@ func MakeErrorHandler(err error) http.HandlerFunc {
 			}
 			WriteJSON(w, statusCode, response)
 		} else {
-			http.Error(w, status.Convert(err).Message(), statusCode)
+			http.Error(w, grpc.ErrorDesc(err), statusCode)
 		}
 	}
 }
 
 // statusCodeFromGRPCError returns status code according to gRPC error
 func statusCodeFromGRPCError(err error) int {
-	switch status.Code(err) {
+	switch grpc.Code(err) {
 	case codes.InvalidArgument: // code 3
 		return http.StatusBadRequest
 	case codes.NotFound: // code 5
diff --git a/vendor/github.com/docker/docker/api/server/httputils/httputils.go b/vendor/github.com/docker/docker/api/server/httputils/httputils.go
index 730381499..5a6854415 100644
--- a/vendor/github.com/docker/docker/api/server/httputils/httputils.go
+++ b/vendor/github.com/docker/docker/api/server/httputils/httputils.go
@@ -12,8 +12,10 @@ import (
 	"github.com/sirupsen/logrus"
 )
 
+type contextKey string
+
 // APIVersionKey is the client's requested API version.
-type APIVersionKey struct{}
+const APIVersionKey contextKey = "api-version"
 
 // APIFunc is an adapter to allow the use of ordinary functions as Docker API endpoints.
 // Any function that has the appropriate signature can be registered as an API endpoint (e.g. getVersion).
@@ -81,7 +83,7 @@ func VersionFromContext(ctx context.Context) string {
 		return ""
 	}
 
-	if val := ctx.Value(APIVersionKey{}); val != nil {
+	if val := ctx.Value(APIVersionKey); val != nil {
 		return val.(string)
 	}
 
diff --git a/vendor/github.com/docker/docker/api/server/middleware/version.go b/vendor/github.com/docker/docker/api/server/middleware/version.go
index 424f3b598..88b11ca37 100644
--- a/vendor/github.com/docker/docker/api/server/middleware/version.go
+++ b/vendor/github.com/docker/docker/api/server/middleware/version.go
@@ -58,7 +58,7 @@ func (v VersionMiddleware) WrapHandler(handler func(ctx context.Context, w http.
 		if versions.GreaterThan(apiVersion, v.defaultVersion) {
 			return versionUnsupportedError{version: apiVersion, maxVersion: v.defaultVersion}
 		}
-		ctx = context.WithValue(ctx, httputils.APIVersionKey{}, apiVersion)
+		ctx = context.WithValue(ctx, httputils.APIVersionKey, apiVersion)
 		return handler(ctx, w, r, vars)
 	}
 
diff --git a/vendor/github.com/docker/docker/api/server/router/build/build.go b/vendor/github.com/docker/docker/api/server/router/build/build.go
index 8ad89ac2b..e6b42ad16 100644
--- a/vendor/github.com/docker/docker/api/server/router/build/build.go
+++ b/vendor/github.com/docker/docker/api/server/router/build/build.go
@@ -31,8 +31,8 @@ func (r *buildRouter) Routes() []router.Route {
 
 func (r *buildRouter) initRoutes() {
 	r.routes = []router.Route{
-		router.NewPostRoute("/build", r.postBuild),
-		router.NewPostRoute("/build/prune", r.postPrune),
+		router.NewPostRoute("/build", r.postBuild, router.WithCancel),
+		router.NewPostRoute("/build/prune", r.postPrune, router.WithCancel),
 		router.NewPostRoute("/build/cancel", r.postCancel),
 	}
 }
diff --git a/vendor/github.com/docker/docker/api/server/router/container/container.go b/vendor/github.com/docker/docker/api/server/router/container/container.go
index 401be4a3f..358f2bc2c 100644
--- a/vendor/github.com/docker/docker/api/server/router/container/container.go
+++ b/vendor/github.com/docker/docker/api/server/router/container/container.go
@@ -38,8 +38,8 @@ func (r *containerRouter) initRoutes() {
 		router.NewGetRoute("/containers/{name:.*}/changes", r.getContainersChanges),
 		router.NewGetRoute("/containers/{name:.*}/json", r.getContainersByName),
 		router.NewGetRoute("/containers/{name:.*}/top", r.getContainersTop),
-		router.NewGetRoute("/containers/{name:.*}/logs", r.getContainersLogs),
-		router.NewGetRoute("/containers/{name:.*}/stats", r.getContainersStats),
+		router.NewGetRoute("/containers/{name:.*}/logs", r.getContainersLogs, router.WithCancel),
+		router.NewGetRoute("/containers/{name:.*}/stats", r.getContainersStats, router.WithCancel),
 		router.NewGetRoute("/containers/{name:.*}/attach/ws", r.wsContainersAttach),
 		router.NewGetRoute("/exec/{id:.*}/json", r.getExecByID),
 		router.NewGetRoute("/containers/{name:.*}/archive", r.getContainersArchive),
@@ -51,7 +51,7 @@ func (r *containerRouter) initRoutes() {
 		router.NewPostRoute("/containers/{name:.*}/restart", r.postContainersRestart),
 		router.NewPostRoute("/containers/{name:.*}/start", r.postContainersStart),
 		router.NewPostRoute("/containers/{name:.*}/stop", r.postContainersStop),
-		router.NewPostRoute("/containers/{name:.*}/wait", r.postContainersWait),
+		router.NewPostRoute("/containers/{name:.*}/wait", r.postContainersWait, router.WithCancel),
 		router.NewPostRoute("/containers/{name:.*}/resize", r.postContainersResize),
 		router.NewPostRoute("/containers/{name:.*}/attach", r.postContainersAttach),
 		router.NewPostRoute("/containers/{name:.*}/copy", r.postContainersCopy), // Deprecated since 1.8, Errors out since 1.12
@@ -60,7 +60,7 @@ func (r *containerRouter) initRoutes() {
 		router.NewPostRoute("/exec/{name:.*}/resize", r.postContainerExecResize),
 		router.NewPostRoute("/containers/{name:.*}/rename", r.postContainerRename),
 		router.NewPostRoute("/containers/{name:.*}/update", r.postContainerUpdate),
-		router.NewPostRoute("/containers/prune", r.postContainersPrune),
+		router.NewPostRoute("/containers/prune", r.postContainersPrune, router.WithCancel),
 		router.NewPostRoute("/commit", r.postCommit),
 		// PUT
 		router.NewPutRoute("/containers/{name:.*}/archive", r.putContainersArchive),
diff --git a/vendor/github.com/docker/docker/api/server/router/container/container_routes.go b/vendor/github.com/docker/docker/api/server/router/container/container_routes.go
index 09d4a75d1..9282cea09 100644
--- a/vendor/github.com/docker/docker/api/server/router/container/container_routes.go
+++ b/vendor/github.com/docker/docker/api/server/router/container/container_routes.go
@@ -338,6 +338,9 @@ func (s *containerRouter) postContainersWait(ctx context.Context, w http.Respons
 		}
 	}
 
+	// Note: the context should get canceled if the client closes the
+	// connection since this handler has been wrapped by the
+	// router.WithCancel() wrapper.
 	waitC, err := s.backend.ContainerWait(ctx, vars["name"], waitCondition)
 	if err != nil {
 		return err
@@ -462,17 +465,6 @@ func (s *containerRouter) postContainersCreate(ctx context.Context, w http.Respo
 		hostConfig.AutoRemove = false
 	}
 
-	if hostConfig != nil && versions.LessThan(version, "1.40") {
-		// Ignore BindOptions.NonRecursive because it was added in API 1.40.
-		for _, m := range hostConfig.Mounts {
-			if bo := m.BindOptions; bo != nil {
-				bo.NonRecursive = false
-			}
-		}
-		// Ignore KernelMemoryTCP because it was added in API 1.40.
-		hostConfig.KernelMemoryTCP = 0
-	}
-
 	ccr, err := s.backend.ContainerCreate(types.ContainerCreateConfig{
 		Name:             name,
 		Config:           config,
diff --git a/vendor/github.com/docker/docker/api/server/router/experimental.go b/vendor/github.com/docker/docker/api/server/router/experimental.go
index d6f0c77b3..c42e53a3d 100644
--- a/vendor/github.com/docker/docker/api/server/router/experimental.go
+++ b/vendor/github.com/docker/docker/api/server/router/experimental.go
@@ -44,7 +44,7 @@ func experimentalHandler(ctx context.Context, w http.ResponseWriter, r *http.Req
 	return notImplementedError{}
 }
 
-// Handler returns the APIFunc to let the server wrap it in middlewares.
+// Handler returns returns the APIFunc to let the server wrap it in middlewares.
 func (r *experimentalRoute) Handler() httputils.APIFunc {
 	return r.handler
 }
diff --git a/vendor/github.com/docker/docker/api/server/router/image/image.go b/vendor/github.com/docker/docker/api/server/router/image/image.go
index 42f89153b..6d5d87f63 100644
--- a/vendor/github.com/docker/docker/api/server/router/image/image.go
+++ b/vendor/github.com/docker/docker/api/server/router/image/image.go
@@ -34,10 +34,10 @@ func (r *imageRouter) initRoutes() {
 		router.NewGetRoute("/images/{name:.*}/json", r.getImagesByName),
 		// POST
 		router.NewPostRoute("/images/load", r.postImagesLoad),
-		router.NewPostRoute("/images/create", r.postImagesCreate),
-		router.NewPostRoute("/images/{name:.*}/push", r.postImagesPush),
+		router.NewPostRoute("/images/create", r.postImagesCreate, router.WithCancel),
+		router.NewPostRoute("/images/{name:.*}/push", r.postImagesPush, router.WithCancel),
 		router.NewPostRoute("/images/{name:.*}/tag", r.postImagesTag),
-		router.NewPostRoute("/images/prune", r.postImagesPrune),
+		router.NewPostRoute("/images/prune", r.postImagesPrune, router.WithCancel),
 		// DELETE
 		router.NewDeleteRoute("/images/{name:.*}", r.deleteImages),
 	}
diff --git a/vendor/github.com/docker/docker/api/server/router/local.go b/vendor/github.com/docker/docker/api/server/router/local.go
index 3f629e8e4..79a323928 100644
--- a/vendor/github.com/docker/docker/api/server/router/local.go
+++ b/vendor/github.com/docker/docker/api/server/router/local.go
@@ -1,6 +1,9 @@
 package router // import "github.com/docker/docker/api/server/router"
 
 import (
+	"context"
+	"net/http"
+
 	"github.com/docker/docker/api/server/httputils"
 )
 
@@ -69,3 +72,33 @@ func NewOptionsRoute(path string, handler httputils.APIFunc, opts ...RouteWrappe
 func NewHeadRoute(path string, handler httputils.APIFunc, opts ...RouteWrapper) Route {
 	return NewRoute("HEAD", path, handler, opts...)
 }
+
+func cancellableHandler(h httputils.APIFunc) httputils.APIFunc {
+	return func(ctx context.Context, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+		if notifier, ok := w.(http.CloseNotifier); ok {
+			notify := notifier.CloseNotify()
+			notifyCtx, cancel := context.WithCancel(ctx)
+			finished := make(chan struct{})
+			defer close(finished)
+			ctx = notifyCtx
+			go func() {
+				select {
+				case <-notify:
+					cancel()
+				case <-finished:
+				}
+			}()
+		}
+		return h(ctx, w, r, vars)
+	}
+}
+
+// WithCancel makes new route which embeds http.CloseNotifier feature to
+// context.Context of handler.
+func WithCancel(r Route) Route {
+	return localRoute{
+		method:  r.Method(),
+		path:    r.Path(),
+		handler: cancellableHandler(r.Handler()),
+	}
+}
diff --git a/vendor/github.com/docker/docker/api/server/router/network/network.go b/vendor/github.com/docker/docker/api/server/router/network/network.go
index d31883500..4eee97079 100644
--- a/vendor/github.com/docker/docker/api/server/router/network/network.go
+++ b/vendor/github.com/docker/docker/api/server/router/network/network.go
@@ -36,7 +36,7 @@ func (r *networkRouter) initRoutes() {
 		router.NewPostRoute("/networks/create", r.postNetworkCreate),
 		router.NewPostRoute("/networks/{id:.*}/connect", r.postNetworkConnect),
 		router.NewPostRoute("/networks/{id:.*}/disconnect", r.postNetworkDisconnect),
-		router.NewPostRoute("/networks/prune", r.postNetworksPrune),
+		router.NewPostRoute("/networks/prune", r.postNetworksPrune, router.WithCancel),
 		// DELETE
 		router.NewDeleteRoute("/networks/{id:.*}", r.deleteNetwork),
 	}
diff --git a/vendor/github.com/docker/docker/api/server/router/plugin/plugin.go b/vendor/github.com/docker/docker/api/server/router/plugin/plugin.go
index 96190b3d0..7a4f987aa 100644
--- a/vendor/github.com/docker/docker/api/server/router/plugin/plugin.go
+++ b/vendor/github.com/docker/docker/api/server/router/plugin/plugin.go
@@ -28,11 +28,11 @@ func (r *pluginRouter) initRoutes() {
 		router.NewGetRoute("/plugins/{name:.*}/json", r.inspectPlugin),
 		router.NewGetRoute("/plugins/privileges", r.getPrivileges),
 		router.NewDeleteRoute("/plugins/{name:.*}", r.removePlugin),
-		router.NewPostRoute("/plugins/{name:.*}/enable", r.enablePlugin),
+		router.NewPostRoute("/plugins/{name:.*}/enable", r.enablePlugin), // PATCH?
 		router.NewPostRoute("/plugins/{name:.*}/disable", r.disablePlugin),
-		router.NewPostRoute("/plugins/pull", r.pullPlugin),
-		router.NewPostRoute("/plugins/{name:.*}/push", r.pushPlugin),
-		router.NewPostRoute("/plugins/{name:.*}/upgrade", r.upgradePlugin),
+		router.NewPostRoute("/plugins/pull", r.pullPlugin, router.WithCancel),
+		router.NewPostRoute("/plugins/{name:.*}/push", r.pushPlugin, router.WithCancel),
+		router.NewPostRoute("/plugins/{name:.*}/upgrade", r.upgradePlugin, router.WithCancel),
 		router.NewPostRoute("/plugins/{name:.*}/set", r.setPlugin),
 		router.NewPostRoute("/plugins/create", r.createPlugin),
 	}
diff --git a/vendor/github.com/docker/docker/api/server/router/swarm/cluster.go b/vendor/github.com/docker/docker/api/server/router/swarm/cluster.go
index 96385d619..52f950a3a 100644
--- a/vendor/github.com/docker/docker/api/server/router/swarm/cluster.go
+++ b/vendor/github.com/docker/docker/api/server/router/swarm/cluster.go
@@ -37,7 +37,7 @@ func (sr *swarmRouter) initRoutes() {
 		router.NewPostRoute("/services/create", sr.createService),
 		router.NewPostRoute("/services/{id}/update", sr.updateService),
 		router.NewDeleteRoute("/services/{id}", sr.removeService),
-		router.NewGetRoute("/services/{id}/logs", sr.getServiceLogs),
+		router.NewGetRoute("/services/{id}/logs", sr.getServiceLogs, router.WithCancel),
 
 		router.NewGetRoute("/nodes", sr.getNodes),
 		router.NewGetRoute("/nodes/{id}", sr.getNode),
@@ -46,7 +46,7 @@ func (sr *swarmRouter) initRoutes() {
 
 		router.NewGetRoute("/tasks", sr.getTasks),
 		router.NewGetRoute("/tasks/{id}", sr.getTask),
-		router.NewGetRoute("/tasks/{id}/logs", sr.getTaskLogs),
+		router.NewGetRoute("/tasks/{id}/logs", sr.getTaskLogs, router.WithCancel),
 
 		router.NewGetRoute("/secrets", sr.getSecrets),
 		router.NewPostRoute("/secrets/create", sr.createSecret),
diff --git a/vendor/github.com/docker/docker/api/server/router/swarm/cluster_routes.go b/vendor/github.com/docker/docker/api/server/router/swarm/cluster_routes.go
index 509c7acad..c1a3e73a2 100644
--- a/vendor/github.com/docker/docker/api/server/router/swarm/cluster_routes.go
+++ b/vendor/github.com/docker/docker/api/server/router/swarm/cluster_routes.go
@@ -28,16 +28,11 @@ func (sr *swarmRouter) initCluster(ctx context.Context, w http.ResponseWriter, r
 		return errdefs.InvalidParameter(err)
 	}
 	version := httputils.VersionFromContext(ctx)
-
 	// DefaultAddrPool and SubnetSize were added in API 1.39. Ignore on older API versions.
 	if versions.LessThan(version, "1.39") {
 		req.DefaultAddrPool = nil
 		req.SubnetSize = 0
 	}
-	// DataPathPort was added in API 1.40. Ignore this option on older API versions.
-	if versions.LessThan(version, "1.40") {
-		req.DataPathPort = 0
-	}
 	nodeID, err := sr.backend.Init(req)
 	if err != nil {
 		logrus.Errorf("Error initializing swarm: %v", err)
@@ -209,23 +204,8 @@ func (sr *swarmRouter) createService(ctx context.Context, w http.ResponseWriter,
 	encodedAuth := r.Header.Get("X-Registry-Auth")
 	cliVersion := r.Header.Get("version")
 	queryRegistry := false
-	if cliVersion != "" {
-		if versions.LessThan(cliVersion, "1.30") {
-			queryRegistry = true
-		}
-		if versions.LessThan(cliVersion, "1.40") {
-			if service.TaskTemplate.ContainerSpec != nil {
-				// Sysctls for docker swarm services weren't supported before
-				// API version 1.40
-				service.TaskTemplate.ContainerSpec.Sysctls = nil
-			}
-
-			if service.TaskTemplate.Placement != nil {
-				// MaxReplicas for docker swarm services weren't supported before
-				// API version 1.40
-				service.TaskTemplate.Placement.MaxReplicas = 0
-			}
-		}
+	if cliVersion != "" && versions.LessThan(cliVersion, "1.30") {
+		queryRegistry = true
 	}
 
 	resp, err := sr.backend.CreateService(service, encodedAuth, queryRegistry)
@@ -261,23 +241,8 @@ func (sr *swarmRouter) updateService(ctx context.Context, w http.ResponseWriter,
 	flags.Rollback = r.URL.Query().Get("rollback")
 	cliVersion := r.Header.Get("version")
 	queryRegistry := false
-	if cliVersion != "" {
-		if versions.LessThan(cliVersion, "1.30") {
-			queryRegistry = true
-		}
-		if versions.LessThan(cliVersion, "1.40") {
-			if service.TaskTemplate.ContainerSpec != nil {
-				// Sysctls for docker swarm services weren't supported before
-				// API version 1.40
-				service.TaskTemplate.ContainerSpec.Sysctls = nil
-			}
-
-			if service.TaskTemplate.Placement != nil {
-				// MaxReplicas for docker swarm services weren't supported before
-				// API version 1.40
-				service.TaskTemplate.Placement.MaxReplicas = 0
-			}
-		}
+	if cliVersion != "" && versions.LessThan(cliVersion, "1.30") {
+		queryRegistry = true
 	}
 
 	resp, err := sr.backend.UpdateService(vars["id"], version, service, flags, queryRegistry)
diff --git a/vendor/github.com/docker/docker/api/server/router/system/system.go b/vendor/github.com/docker/docker/api/server/router/system/system.go
index e0c4a3eef..bbe32fb4b 100644
--- a/vendor/github.com/docker/docker/api/server/router/system/system.go
+++ b/vendor/github.com/docker/docker/api/server/router/system/system.go
@@ -30,10 +30,10 @@ func NewRouter(b Backend, c ClusterBackend, fscache *fscache.FSCache, builder *b
 	r.routes = []router.Route{
 		router.NewOptionsRoute("/{anyroute:.*}", optionsHandler),
 		router.NewGetRoute("/_ping", r.pingHandler),
-		router.NewGetRoute("/events", r.getEvents),
+		router.NewGetRoute("/events", r.getEvents, router.WithCancel),
 		router.NewGetRoute("/info", r.getInfo),
 		router.NewGetRoute("/version", r.getVersion),
-		router.NewGetRoute("/system/df", r.getDiskUsage),
+		router.NewGetRoute("/system/df", r.getDiskUsage, router.WithCancel),
 		router.NewPostRoute("/auth", r.postAuth),
 	}
 
diff --git a/vendor/github.com/docker/docker/api/server/router/volume/volume.go b/vendor/github.com/docker/docker/api/server/router/volume/volume.go
index 875497b3e..04f365e37 100644
--- a/vendor/github.com/docker/docker/api/server/router/volume/volume.go
+++ b/vendor/github.com/docker/docker/api/server/router/volume/volume.go
@@ -29,7 +29,7 @@ func (r *volumeRouter) initRoutes() {
 		router.NewGetRoute("/volumes/{name:.*}", r.getVolumeByName),
 		// POST
 		router.NewPostRoute("/volumes/create", r.postVolumesCreate),
-		router.NewPostRoute("/volumes/prune", r.postVolumesPrune),
+		router.NewPostRoute("/volumes/prune", r.postVolumesPrune, router.WithCancel),
 		// DELETE
 		router.NewDeleteRoute("/volumes/{name:.*}", r.deleteVolumes),
 	}
diff --git a/vendor/github.com/docker/docker/api/server/server.go b/vendor/github.com/docker/docker/api/server/server.go
index 9c9b8fec6..c36400828 100644
--- a/vendor/github.com/docker/docker/api/server/server.go
+++ b/vendor/github.com/docker/docker/api/server/server.go
@@ -129,8 +129,8 @@ func (s *Server) makeHTTPHandler(handler httputils.APIFunc) http.HandlerFunc {
 
 		// use intermediate variable to prevent "should not use basic type
 		// string as key in context.WithValue" golint errors
-		ctx := context.WithValue(r.Context(), dockerversion.UAStringKey{}, r.Header.Get("User-Agent"))
-		r = r.WithContext(ctx)
+		var ki interface{} = dockerversion.UAStringKey
+		ctx := context.WithValue(context.Background(), ki, r.Header.Get("User-Agent"))
 		handlerFunc := s.handlerWithGlobalMiddlewares(handler)
 
 		vars := mux.Vars(r)
@@ -192,7 +192,6 @@ func (s *Server) createMux() *mux.Router {
 	notFoundHandler := httputils.MakeErrorHandler(pageNotFoundError{})
 	m.HandleFunc(versionMatcher+"/{path:.*}", notFoundHandler)
 	m.NotFoundHandler = notFoundHandler
-	m.MethodNotAllowedHandler = notFoundHandler
 
 	return m
 }
diff --git a/vendor/github.com/docker/docker/api/types/container/host_config.go b/vendor/github.com/docker/docker/api/types/container/host_config.go
index 44bdfec96..4ef26fa6c 100644
--- a/vendor/github.com/docker/docker/api/types/container/host_config.go
+++ b/vendor/github.com/docker/docker/api/types/container/host_config.go
@@ -329,7 +329,6 @@ type Resources struct {
 	DeviceCgroupRules    []string        // List of rule to be added to the device cgroup
 	DiskQuota            int64           // Disk limit (in bytes)
 	KernelMemory         int64           // Kernel memory limit (in bytes)
-	KernelMemoryTCP      int64           // Hard limit for kernel TCP buffer memory (in bytes)
 	MemoryReservation    int64           // Memory soft limit (in bytes)
 	MemorySwap           int64           // Total memory usage (memory + swap); set `-1` to enable unlimited swap
 	MemorySwappiness     *int64          // Tuning container memory swappiness behaviour
diff --git a/vendor/github.com/docker/docker/api/types/filters/parse.go b/vendor/github.com/docker/docker/api/types/filters/parse.go
index d8f19ae22..a41e3d8d9 100644
--- a/vendor/github.com/docker/docker/api/types/filters/parse.go
+++ b/vendor/github.com/docker/docker/api/types/filters/parse.go
@@ -323,22 +323,6 @@ func (args Args) WalkValues(field string, op func(value string) error) error {
 	return nil
 }
 
-// Clone returns a copy of args.
-func (args Args) Clone() (newArgs Args) {
-	newArgs.fields = make(map[string]map[string]bool, len(args.fields))
-	for k, m := range args.fields {
-		var mm map[string]bool
-		if m != nil {
-			mm = make(map[string]bool, len(m))
-			for kk, v := range m {
-				mm[kk] = v
-			}
-		}
-		newArgs.fields[k] = mm
-	}
-	return newArgs
-}
-
 func deprecatedArgs(d map[string][]string) map[string]map[string]bool {
 	m := map[string]map[string]bool{}
 	for k, v := range d {
diff --git a/vendor/github.com/docker/docker/api/types/filters/parse_test.go b/vendor/github.com/docker/docker/api/types/filters/parse_test.go
index 17feefe74..e8345a1d5 100644
--- a/vendor/github.com/docker/docker/api/types/filters/parse_test.go
+++ b/vendor/github.com/docker/docker/api/types/filters/parse_test.go
@@ -421,11 +421,3 @@ func TestFuzzyMatch(t *testing.T) {
 		}
 	}
 }
-
-func TestClone(t *testing.T) {
-	f := NewArgs()
-	f.Add("foo", "bar")
-	f2 := f.Clone()
-	f2.Add("baz", "qux")
-	assert.Check(t, is.Len(f.Get("baz"), 0))
-}
diff --git a/vendor/github.com/docker/docker/api/types/mount/mount.go b/vendor/github.com/docker/docker/api/types/mount/mount.go
index ab4446b38..3fef974df 100644
--- a/vendor/github.com/docker/docker/api/types/mount/mount.go
+++ b/vendor/github.com/docker/docker/api/types/mount/mount.go
@@ -79,8 +79,7 @@ const (
 
 // BindOptions defines options specific to mounts of type "bind".
 type BindOptions struct {
-	Propagation  Propagation `json:",omitempty"`
-	NonRecursive bool        `json:",omitempty"`
+	Propagation Propagation `json:",omitempty"`
 }
 
 // VolumeOptions represents the options for a mount of type volume.
diff --git a/vendor/github.com/docker/docker/api/types/stats.go b/vendor/github.com/docker/docker/api/types/stats.go
index 20daebed1..60175c061 100644
--- a/vendor/github.com/docker/docker/api/types/stats.go
+++ b/vendor/github.com/docker/docker/api/types/stats.go
@@ -120,7 +120,7 @@ type NetworkStats struct {
 	RxBytes uint64 `json:"rx_bytes"`
 	// Packets received. Windows and Linux.
 	RxPackets uint64 `json:"rx_packets"`
-	// Received errors. Not used on Windows. Note that we don't `omitempty` this
+	// Received errors. Not used on Windows. Note that we dont `omitempty` this
 	// field as it is expected in the >=v1.21 API stats structure.
 	RxErrors uint64 `json:"rx_errors"`
 	// Incoming packets dropped. Windows and Linux.
@@ -129,7 +129,7 @@ type NetworkStats struct {
 	TxBytes uint64 `json:"tx_bytes"`
 	// Packets sent. Windows and Linux.
 	TxPackets uint64 `json:"tx_packets"`
-	// Sent errors. Not used on Windows. Note that we don't `omitempty` this
+	// Sent errors. Not used on Windows. Note that we dont `omitempty` this
 	// field as it is expected in the >=v1.21 API stats structure.
 	TxErrors uint64 `json:"tx_errors"`
 	// Outgoing packets dropped. Windows and Linux.
diff --git a/vendor/github.com/docker/docker/api/types/strslice/strslice_test.go b/vendor/github.com/docker/docker/api/types/strslice/strslice_test.go
index 8a768d49a..a065eb555 100644
--- a/vendor/github.com/docker/docker/api/types/strslice/strslice_test.go
+++ b/vendor/github.com/docker/docker/api/types/strslice/strslice_test.go
@@ -29,8 +29,8 @@ func TestStrSliceMarshalJSON(t *testing.T) {
 
 func TestStrSliceUnmarshalJSON(t *testing.T) {
 	parts := map[string][]string{
-		"":                        {"default", "values"},
-		"[]":                      {},
+		"":   {"default", "values"},
+		"[]": {},
 		`["/bin/sh","-c","echo"]`: {"/bin/sh", "-c", "echo"},
 	}
 	for json, expectedParts := range parts {
diff --git a/vendor/github.com/docker/docker/api/types/swarm/container.go b/vendor/github.com/docker/docker/api/types/swarm/container.go
index e12f09837..151211ff5 100644
--- a/vendor/github.com/docker/docker/api/types/swarm/container.go
+++ b/vendor/github.com/docker/docker/api/types/swarm/container.go
@@ -71,5 +71,4 @@ type ContainerSpec struct {
 	Secrets   []*SecretReference  `json:",omitempty"`
 	Configs   []*ConfigReference  `json:",omitempty"`
 	Isolation container.Isolation `json:",omitempty"`
-	Sysctls   map[string]string   `json:",omitempty"`
 }
diff --git a/vendor/github.com/docker/docker/api/types/swarm/swarm.go b/vendor/github.com/docker/docker/api/types/swarm/swarm.go
index 484cd0be7..b742cf1bf 100644
--- a/vendor/github.com/docker/docker/api/types/swarm/swarm.go
+++ b/vendor/github.com/docker/docker/api/types/swarm/swarm.go
@@ -14,7 +14,6 @@ type ClusterInfo struct {
 	RootRotationInProgress bool
 	DefaultAddrPool        []string
 	SubnetSize             uint32
-	DataPathPort           uint32
 }
 
 // Swarm represents a swarm.
@@ -154,7 +153,6 @@ type InitRequest struct {
 	ListenAddr       string
 	AdvertiseAddr    string
 	DataPathAddr     string
-	DataPathPort     uint32
 	ForceNewCluster  bool
 	Spec             Spec
 	AutoLockManagers bool
diff --git a/vendor/github.com/docker/docker/api/types/swarm/task.go b/vendor/github.com/docker/docker/api/types/swarm/task.go
index d5a57df5d..b35605d12 100644
--- a/vendor/github.com/docker/docker/api/types/swarm/task.go
+++ b/vendor/github.com/docker/docker/api/types/swarm/task.go
@@ -127,7 +127,6 @@ type ResourceRequirements struct {
 type Placement struct {
 	Constraints []string              `json:",omitempty"`
 	Preferences []PlacementPreference `json:",omitempty"`
-	MaxReplicas uint64                `json:",omitempty"`
 
 	// Platforms stores all the platforms that the image can run on.
 	// This field is used in the platform filter for scheduling. If empty,
diff --git a/vendor/github.com/docker/docker/api/types/types.go b/vendor/github.com/docker/docker/api/types/types.go
index 2accda9d0..a8fae3ba3 100644
--- a/vendor/github.com/docker/docker/api/types/types.go
+++ b/vendor/github.com/docker/docker/api/types/types.go
@@ -158,7 +158,6 @@ type Info struct {
 	MemoryLimit        bool
 	SwapLimit          bool
 	KernelMemory       bool
-	KernelMemoryTCP    bool
 	CPUCfsPeriod       bool `json:"CpuCfsPeriod"`
 	CPUCfsQuota        bool `json:"CpuCfsQuota"`
 	CPUShares          bool
diff --git a/vendor/github.com/docker/docker/builder/builder-next/builder.go b/vendor/github.com/docker/docker/builder/builder-next/builder.go
index 859f80eab..463b45aba 100644
--- a/vendor/github.com/docker/docker/builder/builder-next/builder.go
+++ b/vendor/github.com/docker/docker/builder/builder-next/builder.go
@@ -239,7 +239,9 @@ func (b *Builder) Build(ctx context.Context, opt backend.BuildConfig) (*builder.
 
 	id := identity.NewID()
 
-	frontendAttrs := map[string]string{}
+	frontendAttrs := map[string]string{
+		"override-copy-image": "docker.io/docker/dockerfile-copy:v0.1.9@sha256:e8f159d3f00786604b93c675ee2783f8dc194bb565e61ca5788f6a6e9d304061",
+	}
 
 	if opt.Options.Target != "" {
 		frontendAttrs["target"] = opt.Options.Target
diff --git a/vendor/github.com/docker/docker/builder/dockerfile/buildargs.go b/vendor/github.com/docker/docker/builder/dockerfile/buildargs.go
index aa794fb7b..f9cceaa05 100644
--- a/vendor/github.com/docker/docker/builder/dockerfile/buildargs.go
+++ b/vendor/github.com/docker/docker/builder/dockerfile/buildargs.go
@@ -113,7 +113,7 @@ func (b *BuildArgs) GetAllAllowed() map[string]string {
 	return b.getAllFromMapping(b.allowedBuildArgs)
 }
 
-// GetAllMeta returns a mapping with all the meta args
+// GetAllMeta returns a mapping with all the meta meta args
 func (b *BuildArgs) GetAllMeta() map[string]string {
 	return b.getAllFromMapping(b.allowedMetaArgs)
 }
diff --git a/vendor/github.com/docker/docker/builder/dockerfile/evaluator_test.go b/vendor/github.com/docker/docker/builder/dockerfile/evaluator_test.go
index 28607ead0..fb79b238e 100644
--- a/vendor/github.com/docker/docker/builder/dockerfile/evaluator_test.go
+++ b/vendor/github.com/docker/docker/builder/dockerfile/evaluator_test.go
@@ -2,7 +2,6 @@ package dockerfile // import "github.com/docker/docker/builder/dockerfile"
 
 import (
 	"os"
-	"runtime"
 	"testing"
 
 	"github.com/docker/docker/builder/remotecontext"
@@ -98,9 +97,7 @@ func initDispatchTestCases() []dispatchTestCase {
 }
 
 func TestDispatch(t *testing.T) {
-	if runtime.GOOS != "windows" {
-		skip.If(t, os.Getuid() != 0, "skipping test that requires root")
-	}
+	skip.If(t, os.Getuid() != 0, "skipping test that requires root")
 	testCases := initDispatchTestCases()
 
 	for _, testCase := range testCases {
diff --git a/vendor/github.com/docker/docker/builder/dockerfile/internals_test.go b/vendor/github.com/docker/docker/builder/dockerfile/internals_test.go
index b1ef6c80d..1c34fd387 100644
--- a/vendor/github.com/docker/docker/builder/dockerfile/internals_test.go
+++ b/vendor/github.com/docker/docker/builder/dockerfile/internals_test.go
@@ -47,9 +47,6 @@ func TestDockerfileOutsideTheBuildContext(t *testing.T) {
 	defer cleanup()
 
 	expectedError := "Forbidden path outside the build context: ../../Dockerfile ()"
-	if runtime.GOOS == "windows" {
-		expectedError = "failed to resolve scoped path ../../Dockerfile ()"
-	}
 
 	readAndCheckDockerfile(t, "DockerfileOutsideTheBuildContext", contextDir, "../../Dockerfile", expectedError)
 }
@@ -64,9 +61,7 @@ func TestNonExistingDockerfile(t *testing.T) {
 }
 
 func readAndCheckDockerfile(t *testing.T, testName, contextDir, dockerfilePath, expectedError string) {
-	if runtime.GOOS != "windows" {
-		skip.If(t, os.Getuid() != 0, "skipping test that requires root")
-	}
+	skip.If(t, os.Getuid() != 0, "skipping test that requires root")
 	tarStream, err := archive.Tar(contextDir, archive.Uncompressed)
 	assert.NilError(t, err)
 
@@ -85,7 +80,7 @@ func readAndCheckDockerfile(t *testing.T, testName, contextDir, dockerfilePath,
 		Source:  tarStream,
 	}
 	_, _, err = remotecontext.Detect(config)
-	assert.Check(t, is.ErrorContains(err, expectedError))
+	assert.Check(t, is.Error(err, expectedError))
 }
 
 func TestCopyRunConfig(t *testing.T) {
diff --git a/vendor/github.com/docker/docker/client/client.go b/vendor/github.com/docker/docker/client/client.go
index 1e2ef80ac..5031502ac 100644
--- a/vendor/github.com/docker/docker/client/client.go
+++ b/vendor/github.com/docker/docker/client/client.go
@@ -23,7 +23,7 @@ For example, to list running containers (the equivalent of "docker ps"):
 	)
 
 	func main() {
-		cli, err := client.NewClientWithOpts(client.FromEnv)
+		cli, err := client.NewEnvClient()
 		if err != nil {
 			panic(err)
 		}
@@ -234,14 +234,6 @@ func WithHTTPHeaders(headers map[string]string) func(*Client) error {
 	}
 }
 
-// WithScheme overrides the client scheme with the specified one
-func WithScheme(scheme string) func(*Client) error {
-	return func(c *Client) error {
-		c.scheme = scheme
-		return nil
-	}
-}
-
 // NewClientWithOpts initializes a new API client with default values. It takes functors
 // to modify values when creating it, like `NewClientWithOpts(WithVersion(…))`
 // It also initializes the custom http headers to add to each request.
@@ -257,6 +249,7 @@ func NewClientWithOpts(ops ...func(*Client) error) (*Client, error) {
 	c := &Client{
 		host:    DefaultDockerHost,
 		version: api.DefaultVersion,
+		scheme:  "http",
 		client:  client,
 		proto:   defaultProto,
 		addr:    defaultAddr,
@@ -271,18 +264,14 @@ func NewClientWithOpts(ops ...func(*Client) error) (*Client, error) {
 	if _, ok := c.client.Transport.(http.RoundTripper); !ok {
 		return nil, fmt.Errorf("unable to verify TLS configuration, invalid transport %v", c.client.Transport)
 	}
-	if c.scheme == "" {
-		c.scheme = "http"
-
-		tlsConfig := resolveTLSConfig(c.client.Transport)
-		if tlsConfig != nil {
-			// TODO(stevvooe): This isn't really the right way to write clients in Go.
-			// `NewClient` should probably only take an `*http.Client` and work from there.
-			// Unfortunately, the model of having a host-ish/url-thingy as the connection
-			// string has us confusing protocol and transport layers. We continue doing
-			// this to avoid breaking existing clients but this should be addressed.
-			c.scheme = "https"
-		}
+	tlsConfig := resolveTLSConfig(c.client.Transport)
+	if tlsConfig != nil {
+		// TODO(stevvooe): This isn't really the right way to write clients in Go.
+		// `NewClient` should probably only take an `*http.Client` and work from there.
+		// Unfortunately, the model of having a host-ish/url-thingy as the connection
+		// string has us confusing protocol and transport layers. We continue doing
+		// this to avoid breaking existing clients but this should be addressed.
+		c.scheme = "https"
 	}
 
 	return c, nil
diff --git a/vendor/github.com/docker/docker/client/client_test.go b/vendor/github.com/docker/docker/client/client_test.go
index 23ba3d36b..58bccaa31 100644
--- a/vendor/github.com/docker/docker/client/client_test.go
+++ b/vendor/github.com/docker/docker/client/client_test.go
@@ -16,7 +16,7 @@ import (
 	"gotest.tools/skip"
 )
 
-func TestNewClientWithOpsFromEnv(t *testing.T) {
+func TestNewEnvClient(t *testing.T) {
 	skip.If(t, runtime.GOOS == "windows")
 
 	testcases := []struct {
@@ -86,7 +86,7 @@ func TestNewClientWithOpsFromEnv(t *testing.T) {
 	defer env.PatchAll(t, nil)()
 	for _, c := range testcases {
 		env.PatchAll(t, c.envs)
-		apiclient, err := NewClientWithOpts(FromEnv)
+		apiclient, err := NewEnvClient()
 		if c.expectedError != "" {
 			assert.Check(t, is.Error(err, c.expectedError), c.doc)
 		} else {
@@ -167,7 +167,7 @@ func TestParseHostURL(t *testing.T) {
 	}
 }
 
-func TestNewClientWithOpsFromEnvSetsDefaultVersion(t *testing.T) {
+func TestNewEnvClientSetsDefaultVersion(t *testing.T) {
 	defer env.PatchAll(t, map[string]string{
 		"DOCKER_HOST":        "",
 		"DOCKER_API_VERSION": "",
@@ -175,7 +175,7 @@ func TestNewClientWithOpsFromEnvSetsDefaultVersion(t *testing.T) {
 		"DOCKER_CERT_PATH":   "",
 	})()
 
-	client, err := NewClientWithOpts(FromEnv)
+	client, err := NewEnvClient()
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -183,7 +183,7 @@ func TestNewClientWithOpsFromEnvSetsDefaultVersion(t *testing.T) {
 
 	expected := "1.22"
 	os.Setenv("DOCKER_API_VERSION", expected)
-	client, err = NewClientWithOpts(FromEnv)
+	client, err = NewEnvClient()
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -195,7 +195,7 @@ func TestNewClientWithOpsFromEnvSetsDefaultVersion(t *testing.T) {
 func TestNegotiateAPIVersionEmpty(t *testing.T) {
 	defer env.PatchAll(t, map[string]string{"DOCKER_API_VERSION": ""})()
 
-	client, err := NewClientWithOpts(FromEnv)
+	client, err := NewEnvClient()
 	assert.NilError(t, err)
 
 	ping := types.Ping{
@@ -219,7 +219,7 @@ func TestNegotiateAPIVersionEmpty(t *testing.T) {
 // TestNegotiateAPIVersion asserts that client.Client can
 // negotiate a compatible APIVersion with the server
 func TestNegotiateAPIVersion(t *testing.T) {
-	client, err := NewClientWithOpts(FromEnv)
+	client, err := NewEnvClient()
 	assert.NilError(t, err)
 
 	expected := "1.21"
@@ -251,7 +251,7 @@ func TestNegotiateAPVersionOverride(t *testing.T) {
 	expected := "9.99"
 	defer env.PatchAll(t, map[string]string{"DOCKER_API_VERSION": expected})()
 
-	client, err := NewClientWithOpts(FromEnv)
+	client, err := NewEnvClient()
 	assert.NilError(t, err)
 
 	ping := types.Ping{
diff --git a/vendor/github.com/docker/docker/client/container_inspect.go b/vendor/github.com/docker/docker/client/container_inspect.go
index e34bb16a2..f453064cf 100644
--- a/vendor/github.com/docker/docker/client/container_inspect.go
+++ b/vendor/github.com/docker/docker/client/container_inspect.go
@@ -19,10 +19,10 @@ func (cli *Client) ContainerInspect(ctx context.Context, containerID string) (ty
 	if err != nil {
 		return types.ContainerJSON{}, wrapResponseError(err, serverResp, "container", containerID)
 	}
-	defer ensureReaderClosed(serverResp)
 
 	var response types.ContainerJSON
 	err = json.NewDecoder(serverResp.body).Decode(&response)
+	ensureReaderClosed(serverResp)
 	return response, err
 }
 
diff --git a/vendor/github.com/docker/docker/client/container_logs_test.go b/vendor/github.com/docker/docker/client/container_logs_test.go
index b610eb04f..6d6e34e10 100644
--- a/vendor/github.com/docker/docker/client/container_logs_test.go
+++ b/vendor/github.com/docker/docker/client/container_logs_test.go
@@ -153,7 +153,7 @@ func ExampleClient_ContainerLogs_withTimeout() {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	client, _ := NewClientWithOpts(FromEnv)
+	client, _ := NewEnvClient()
 	reader, err := client.ContainerLogs(ctx, "container_id", types.ContainerLogsOptions{})
 	if err != nil {
 		log.Fatal(err)
diff --git a/vendor/github.com/docker/docker/client/container_wait_test.go b/vendor/github.com/docker/docker/client/container_wait_test.go
index 9236f6f40..11a9203dd 100644
--- a/vendor/github.com/docker/docker/client/container_wait_test.go
+++ b/vendor/github.com/docker/docker/client/container_wait_test.go
@@ -65,7 +65,7 @@ func ExampleClient_ContainerWait_withTimeout() {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	client, _ := NewClientWithOpts(FromEnv)
+	client, _ := NewEnvClient()
 	_, errC := client.ContainerWait(ctx, "container_id", "")
 	if err := <-errC; err != nil {
 		log.Fatal(err)
diff --git a/vendor/github.com/docker/docker/client/request.go b/vendor/github.com/docker/docker/client/request.go
index f1c256ad0..9b8639a1e 100644
--- a/vendor/github.com/docker/docker/client/request.go
+++ b/vendor/github.com/docker/docker/client/request.go
@@ -16,6 +16,7 @@ import (
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/versions"
 	"github.com/pkg/errors"
+	"golang.org/x/net/context/ctxhttp"
 )
 
 // serverResponse is a wrapper for http API responses.
@@ -128,15 +129,14 @@ func (cli *Client) sendRequest(ctx context.Context, method, path string, query u
 func (cli *Client) doRequest(ctx context.Context, req *http.Request) (serverResponse, error) {
 	serverResp := serverResponse{statusCode: -1, reqURL: req.URL}
 
-	req = req.WithContext(ctx)
-	resp, err := cli.client.Do(req)
+	resp, err := ctxhttp.Do(ctx, cli.client, req)
 	if err != nil {
 		if cli.scheme != "https" && strings.Contains(err.Error(), "malformed HTTP response") {
 			return serverResp, fmt.Errorf("%v.\n* Are you trying to connect to a TLS-enabled daemon without TLS?", err)
 		}
 
 		if cli.scheme == "https" && strings.Contains(err.Error(), "bad certificate") {
-			return serverResp, errors.Wrap(err, "The server probably has client authentication (--tlsverify) enabled. Please check your TLS client certification settings")
+			return serverResp, fmt.Errorf("The server probably has client authentication (--tlsverify) enabled. Please check your TLS client certification settings: %v", err)
 		}
 
 		// Don't decorate context sentinel errors; users may be comparing to
@@ -220,14 +220,14 @@ func (cli *Client) checkResponseErr(serverResp serverResponse) error {
 	if (cli.version == "" || versions.GreaterThan(cli.version, "1.23")) && ct == "application/json" {
 		var errorResponse types.ErrorResponse
 		if err := json.Unmarshal(body, &errorResponse); err != nil {
-			return errors.Wrap(err, "Error reading JSON")
+			return fmt.Errorf("Error reading JSON: %v", err)
 		}
-		errorMessage = strings.TrimSpace(errorResponse.Message)
+		errorMessage = errorResponse.Message
 	} else {
-		errorMessage = strings.TrimSpace(string(body))
+		errorMessage = string(body)
 	}
 
-	return errors.Wrap(errors.New(errorMessage), "Error response from daemon")
+	return fmt.Errorf("Error response from daemon: %s", strings.TrimSpace(errorMessage))
 }
 
 func (cli *Client) addHeaders(req *http.Request, headers headers) *http.Request {
diff --git a/vendor/github.com/docker/docker/client/service_logs_test.go b/vendor/github.com/docker/docker/client/service_logs_test.go
index d8779e060..28f3ab5c6 100644
--- a/vendor/github.com/docker/docker/client/service_logs_test.go
+++ b/vendor/github.com/docker/docker/client/service_logs_test.go
@@ -122,7 +122,7 @@ func ExampleClient_ServiceLogs_withTimeout() {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	client, _ := NewClientWithOpts(FromEnv)
+	client, _ := NewEnvClient()
 	reader, err := client.ServiceLogs(ctx, "service_id", types.ContainerLogsOptions{})
 	if err != nil {
 		log.Fatal(err)
diff --git a/vendor/github.com/docker/docker/client/service_update.go b/vendor/github.com/docker/docker/client/service_update.go
index 3c21214f6..5a7a61b01 100644
--- a/vendor/github.com/docker/docker/client/service_update.go
+++ b/vendor/github.com/docker/docker/client/service_update.go
@@ -10,9 +10,7 @@ import (
 	"github.com/docker/docker/api/types/swarm"
 )
 
-// ServiceUpdate updates a Service. The version number is required to avoid conflicting writes.
-// It should be the value as set *before* the update. You can find this value in the Meta field
-// of swarm.Service, which can be found using ServiceInspectWithRaw.
+// ServiceUpdate updates a Service.
 func (cli *Client) ServiceUpdate(ctx context.Context, serviceID string, version swarm.Version, service swarm.ServiceSpec, options types.ServiceUpdateOptions) (types.ServiceUpdateResponse, error) {
 	var (
 		query   = url.Values{}
diff --git a/vendor/github.com/docker/docker/cmd/dockerd/daemon.go b/vendor/github.com/docker/docker/cmd/dockerd/daemon.go
index 0daf19727..839537316 100644
--- a/vendor/github.com/docker/docker/cmd/dockerd/daemon.go
+++ b/vendor/github.com/docker/docker/cmd/dockerd/daemon.go
@@ -83,11 +83,6 @@ func (cli *DaemonCli) start(opts *daemonOptions) (err error) {
 	if cli.Config, err = loadDaemonCliConfig(opts); err != nil {
 		return err
 	}
-
-	if err := configureDaemonLogs(cli.Config); err != nil {
-		return err
-	}
-
 	cli.configFile = &opts.configFile
 	cli.flags = opts.flags
 
@@ -99,10 +94,16 @@ func (cli *DaemonCli) start(opts *daemonOptions) (err error) {
 		logrus.Warn("Running experimental build")
 	}
 
+	logrus.SetFormatter(&logrus.TextFormatter{
+		TimestampFormat: jsonmessage.RFC3339NanoFixed,
+		DisableColors:   cli.Config.RawLogs,
+		FullTimestamp:   true,
+	})
+
 	system.InitLCOW(cli.Config.Experimental)
 
 	if err := setDefaultUmask(); err != nil {
-		return err
+		return fmt.Errorf("Failed to set umask: %v", err)
 	}
 
 	// Create the daemon root before we create ANY other files (PID, or migrate keys)
@@ -118,7 +119,7 @@ func (cli *DaemonCli) start(opts *daemonOptions) (err error) {
 	if cli.Pidfile != "" {
 		pf, err := pidfile.New(cli.Pidfile)
 		if err != nil {
-			return errors.Wrap(err, "failed to start daemon")
+			return fmt.Errorf("Error starting daemon: %v", err)
 		}
 		defer func() {
 			if err := pf.Remove(); err != nil {
@@ -129,13 +130,13 @@ func (cli *DaemonCli) start(opts *daemonOptions) (err error) {
 
 	serverConfig, err := newAPIServerConfig(cli)
 	if err != nil {
-		return errors.Wrap(err, "failed to create API server")
+		return fmt.Errorf("Failed to create API server: %v", err)
 	}
 	cli.api = apiserver.New(serverConfig)
 
 	hosts, err := loadListeners(cli, serverConfig)
 	if err != nil {
-		return errors.Wrap(err, "failed to load listeners")
+		return fmt.Errorf("Failed to load listeners: %v", err)
 	}
 
 	ctx, cancel := context.WithCancel(context.Background())
@@ -144,13 +145,13 @@ func (cli *DaemonCli) start(opts *daemonOptions) (err error) {
 			opts, err := cli.getContainerdDaemonOpts()
 			if err != nil {
 				cancel()
-				return errors.Wrap(err, "failed to generate containerd options")
+				return fmt.Errorf("Failed to generate containerd options: %v", err)
 			}
 
 			r, err := supervisor.Start(ctx, filepath.Join(cli.Config.Root, "containerd"), filepath.Join(cli.Config.ExecRoot, "containerd"), opts...)
 			if err != nil {
 				cancel()
-				return errors.Wrap(err, "failed to start containerd")
+				return fmt.Errorf("Failed to start containerd: %v", err)
 			}
 			cli.Config.ContainerdAddr = r.Address()
 
@@ -178,20 +179,20 @@ func (cli *DaemonCli) start(opts *daemonOptions) (err error) {
 
 	d, err := daemon.NewDaemon(ctx, cli.Config, pluginStore)
 	if err != nil {
-		return errors.Wrap(err, "failed to start daemon")
+		return fmt.Errorf("Error starting daemon: %v", err)
 	}
 
 	d.StoreHosts(hosts)
 
-	// validate after NewDaemon has restored enabled plugins. Don't change order.
+	// validate after NewDaemon has restored enabled plugins. Dont change order.
 	if err := validateAuthzPlugins(cli.Config.AuthorizationPlugins, pluginStore); err != nil {
-		return errors.Wrap(err, "failed to validate authorization plugin")
+		return fmt.Errorf("Error validating authorization plugin: %v", err)
 	}
 
 	// TODO: move into startMetricsServer()
 	if cli.Config.MetricsAddress != "" {
 		if !d.HasExperimental() {
-			return errors.Wrap(err, "metrics-addr is only supported when experimental is enabled")
+			return fmt.Errorf("metrics-addr is only supported when experimental is enabled")
 		}
 		if err := startMetricsServer(cli.Config.MetricsAddress); err != nil {
 			return err
@@ -245,7 +246,7 @@ func (cli *DaemonCli) start(opts *daemonOptions) (err error) {
 	cancel()
 
 	if errAPI != nil {
-		return errors.Wrap(errAPI, "shutting down due to ServeAPI error")
+		return fmt.Errorf("Shutting down due to ServeAPI error: %v", errAPI)
 	}
 
 	return nil
@@ -409,14 +410,14 @@ func loadDaemonCliConfig(opts *daemonOptions) (*config.Config, error) {
 	}
 
 	if flags.Changed("graph") && flags.Changed("data-root") {
-		return nil, errors.New(`cannot specify both "--graph" and "--data-root" option`)
+		return nil, fmt.Errorf(`cannot specify both "--graph" and "--data-root" option`)
 	}
 
 	if opts.configFile != "" {
 		c, err := config.MergeDaemonConfigurations(conf, flags, opts.configFile)
 		if err != nil {
 			if flags.Changed("config-file") || !os.IsNotExist(err) {
-				return nil, errors.Wrapf(err, "unable to configure the Docker daemon with file %s", opts.configFile)
+				return nil, fmt.Errorf("unable to configure the Docker daemon with file %s: %v", opts.configFile, err)
 			}
 		}
 		// the merged configuration can be nil if the config file didn't exist.
@@ -470,6 +471,9 @@ func loadDaemonCliConfig(opts *daemonOptions) (*config.Config, error) {
 		conf.TLS = true
 	}
 
+	// ensure that the log level is the one set after merging configurations
+	setLogLevel(conf.LogLevel)
+
 	return conf, nil
 }
 
@@ -586,7 +590,7 @@ func loadListeners(cli *DaemonCli, serverConfig *apiserver.Config) ([]string, er
 	for i := 0; i < len(cli.Config.Hosts); i++ {
 		var err error
 		if cli.Config.Hosts[i], err = dopts.ParseHost(cli.Config.TLS, cli.Config.Hosts[i]); err != nil {
-			return nil, errors.Wrapf(err, "error parsing -H %s", cli.Config.Hosts[i])
+			return nil, fmt.Errorf("error parsing -H %s : %v", cli.Config.Hosts[i], err)
 		}
 
 		protoAddr := cli.Config.Hosts[i]
@@ -666,22 +670,3 @@ func systemContainerdRunning() bool {
 	_, err := os.Lstat(containerddefaults.DefaultAddress)
 	return err == nil
 }
-
-// configureDaemonLogs sets the logrus logging level and formatting
-func configureDaemonLogs(conf *config.Config) error {
-	if conf.LogLevel != "" {
-		lvl, err := logrus.ParseLevel(conf.LogLevel)
-		if err != nil {
-			return fmt.Errorf("unable to parse logging level: %s", conf.LogLevel)
-		}
-		logrus.SetLevel(lvl)
-	} else {
-		logrus.SetLevel(logrus.InfoLevel)
-	}
-	logrus.SetFormatter(&logrus.TextFormatter{
-		TimestampFormat: jsonmessage.RFC3339NanoFixed,
-		DisableColors:   conf.RawLogs,
-		FullTimestamp:   true,
-	})
-	return nil
-}
diff --git a/vendor/github.com/docker/docker/cmd/dockerd/daemon_test.go b/vendor/github.com/docker/docker/cmd/dockerd/daemon_test.go
index 38b2d0fb5..ad447e3b9 100644
--- a/vendor/github.com/docker/docker/cmd/dockerd/daemon_test.go
+++ b/vendor/github.com/docker/docker/cmd/dockerd/daemon_test.go
@@ -146,6 +146,7 @@ func TestLoadDaemonCliConfigWithLogLevel(t *testing.T) {
 	assert.NilError(t, err)
 	assert.Assert(t, loadedConfig != nil)
 	assert.Check(t, is.Equal("warn", loadedConfig.LogLevel))
+	assert.Check(t, is.Equal(logrus.WarnLevel, logrus.GetLevel()))
 }
 
 func TestLoadDaemonConfigWithEmbeddedOptions(t *testing.T) {
@@ -179,22 +180,3 @@ func TestLoadDaemonConfigWithRegistryOptions(t *testing.T) {
 	assert.Check(t, is.Len(loadedConfig.Mirrors, 1))
 	assert.Check(t, is.Len(loadedConfig.InsecureRegistries, 1))
 }
-
-func TestConfigureDaemonLogs(t *testing.T) {
-	conf := &config.Config{}
-	err := configureDaemonLogs(conf)
-	assert.NilError(t, err)
-	assert.Check(t, is.Equal(logrus.InfoLevel, logrus.GetLevel()))
-
-	conf.LogLevel = "warn"
-	err = configureDaemonLogs(conf)
-	assert.NilError(t, err)
-	assert.Check(t, is.Equal(logrus.WarnLevel, logrus.GetLevel()))
-
-	conf.LogLevel = "foobar"
-	err = configureDaemonLogs(conf)
-	assert.Error(t, err, "unable to parse logging level: foobar")
-
-	// log level should not be changed after a failure
-	assert.Check(t, is.Equal(logrus.WarnLevel, logrus.GetLevel()))
-}
diff --git a/vendor/github.com/docker/docker/cmd/dockerd/docker.go b/vendor/github.com/docker/docker/cmd/dockerd/docker.go
index 6097e2c6b..197bb49c9 100644
--- a/vendor/github.com/docker/docker/cmd/dockerd/docker.go
+++ b/vendor/github.com/docker/docker/cmd/dockerd/docker.go
@@ -8,7 +8,6 @@ import (
 	"github.com/docker/docker/cli"
 	"github.com/docker/docker/daemon/config"
 	"github.com/docker/docker/dockerversion"
-	"github.com/docker/docker/pkg/jsonmessage"
 	"github.com/docker/docker/pkg/reexec"
 	"github.com/docker/docker/pkg/term"
 	"github.com/moby/buildkit/util/apicaps"
@@ -55,12 +54,6 @@ func main() {
 		return
 	}
 
-	// initial log formatting; this setting is updated after the daemon configuration is loaded.
-	logrus.SetFormatter(&logrus.TextFormatter{
-		TimestampFormat: jsonmessage.RFC3339NanoFixed,
-		FullTimestamp:   true,
-	})
-
 	// Set terminal emulation based on platform as required.
 	_, stdout, stderr := term.StdStreams()
 
diff --git a/vendor/github.com/docker/docker/cmd/dockerd/options.go b/vendor/github.com/docker/docker/cmd/dockerd/options.go
index cb5601a76..a6276add5 100644
--- a/vendor/github.com/docker/docker/cmd/dockerd/options.go
+++ b/vendor/github.com/docker/docker/cmd/dockerd/options.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"fmt"
 	"os"
 	"path/filepath"
 
@@ -8,6 +9,7 @@ import (
 	"github.com/docker/docker/daemon/config"
 	"github.com/docker/docker/opts"
 	"github.com/docker/go-connections/tlsconfig"
+	"github.com/sirupsen/logrus"
 	"github.com/spf13/pflag"
 )
 
@@ -104,3 +106,17 @@ func (o *daemonOptions) SetDefaultOptions(flags *pflag.FlagSet) {
 		}
 	}
 }
+
+// setLogLevel sets the logrus logging level
+func setLogLevel(logLevel string) {
+	if logLevel != "" {
+		lvl, err := logrus.ParseLevel(logLevel)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "Unable to parse logging level: %s\n", logLevel)
+			os.Exit(1)
+		}
+		logrus.SetLevel(lvl)
+	} else {
+		logrus.SetLevel(logrus.InfoLevel)
+	}
+}
diff --git a/vendor/github.com/docker/docker/cmd/dockerd/service_windows.go b/vendor/github.com/docker/docker/cmd/dockerd/service_windows.go
index 07977d95c..00432af64 100644
--- a/vendor/github.com/docker/docker/cmd/dockerd/service_windows.go
+++ b/vendor/github.com/docker/docker/cmd/dockerd/service_windows.go
@@ -396,8 +396,8 @@ func initPanicFile(path string) error {
 	// Update STD_ERROR_HANDLE to point to the panic file so that Go writes to
 	// it when it panics. Remember the old stderr to restore it before removing
 	// the panic file.
-	sh := uint32(windows.STD_ERROR_HANDLE)
-	h, err := windows.GetStdHandle(sh)
+	sh := windows.STD_ERROR_HANDLE
+	h, err := windows.GetStdHandle(uint32(sh))
 	if err != nil {
 		return err
 	}
@@ -421,7 +421,7 @@ func initPanicFile(path string) error {
 func removePanicFile() {
 	if st, err := panicFile.Stat(); err == nil {
 		if st.Size() == 0 {
-			sh := uint32(windows.STD_ERROR_HANDLE)
+			sh := windows.STD_ERROR_HANDLE
 			setStdHandle.Call(uintptr(sh), uintptr(oldStderr))
 			panicFile.Close()
 			os.Remove(panicFile.Name())
diff --git a/vendor/github.com/docker/docker/container/container_unix.go b/vendor/github.com/docker/docker/container/container_unix.go
index 6d402be3a..ed664f3ee 100644
--- a/vendor/github.com/docker/docker/container/container_unix.go
+++ b/vendor/github.com/docker/docker/container/container_unix.go
@@ -6,7 +6,6 @@ import (
 	"io/ioutil"
 	"os"
 	"path/filepath"
-	"syscall"
 
 	"github.com/containerd/continuity/fs"
 	"github.com/docker/docker/api/types"
@@ -175,8 +174,8 @@ func (container *Container) HasMountFor(path string) bool {
 	return false
 }
 
-// UnmountIpcMount unmounts shm if it was mounted
-func (container *Container) UnmountIpcMount() error {
+// UnmountIpcMount uses the provided unmount function to unmount shm if it was mounted
+func (container *Container) UnmountIpcMount(unmount func(pth string) error) error {
 	if container.HasMountFor("/dev/shm") {
 		return nil
 	}
@@ -190,8 +189,10 @@ func (container *Container) UnmountIpcMount() error {
 	if shmPath == "" {
 		return nil
 	}
-	if err = mount.Unmount(shmPath); err != nil && !os.IsNotExist(err) {
-		return err
+	if err = unmount(shmPath); err != nil && !os.IsNotExist(err) {
+		if mounted, mErr := mount.Mounted(shmPath); mounted || mErr != nil {
+			return errors.Wrapf(err, "umount %s", shmPath)
+		}
 	}
 	return nil
 }
@@ -381,25 +382,12 @@ func (container *Container) DetachAndUnmount(volumeEventLog func(name, action st
 
 	for _, mountPath := range mountPaths {
 		if err := mount.Unmount(mountPath); err != nil {
-			logrus.WithError(err).WithField("container", container.ID).
-				Warn("Unable to unmount")
+			logrus.Warnf("%s unmountVolumes: Failed to do lazy umount fo volume '%s': %v", container.ID, mountPath, err)
 		}
 	}
 	return container.UnmountVolumes(volumeEventLog)
 }
 
-// ignoreUnsupportedXAttrs ignores errors when extended attributes
-// are not supported
-func ignoreUnsupportedXAttrs() fs.CopyDirOpt {
-	xeh := func(dst, src, xattrKey string, err error) error {
-		if errors.Cause(err) != syscall.ENOTSUP {
-			return err
-		}
-		return nil
-	}
-	return fs.WithXAttrErrorHandler(xeh)
-}
-
 // copyExistingContents copies from the source to the destination and
 // ensures the ownership is appropriately set.
 func copyExistingContents(source, destination string) error {
@@ -411,7 +399,7 @@ func copyExistingContents(source, destination string) error {
 		// destination is not empty, do not copy
 		return nil
 	}
-	return fs.CopyDir(destination, source, ignoreUnsupportedXAttrs())
+	return fs.CopyDir(destination, source)
 }
 
 // TmpfsMounts returns the list of tmpfs mounts
diff --git a/vendor/github.com/docker/docker/container/container_windows.go b/vendor/github.com/docker/docker/container/container_windows.go
index 090db12c2..b5bdb5bc3 100644
--- a/vendor/github.com/docker/docker/container/container_windows.go
+++ b/vendor/github.com/docker/docker/container/container_windows.go
@@ -22,7 +22,7 @@ const (
 
 // UnmountIpcMount unmounts Ipc related mounts.
 // This is a NOOP on windows.
-func (container *Container) UnmountIpcMount() error {
+func (container *Container) UnmountIpcMount(unmount func(pth string) error) error {
 	return nil
 }
 
diff --git a/vendor/github.com/docker/docker/container/mounts_unix.go b/vendor/github.com/docker/docker/container/mounts_unix.go
index 2c1160464..62f4441dc 100644
--- a/vendor/github.com/docker/docker/container/mounts_unix.go
+++ b/vendor/github.com/docker/docker/container/mounts_unix.go
@@ -4,10 +4,9 @@ package container // import "github.com/docker/docker/container"
 
 // Mount contains information for a mount operation.
 type Mount struct {
-	Source       string `json:"source"`
-	Destination  string `json:"destination"`
-	Writable     bool   `json:"writable"`
-	Data         string `json:"data"`
-	Propagation  string `json:"mountpropagation"`
-	NonRecursive bool   `json:"nonrecursive"`
+	Source      string `json:"source"`
+	Destination string `json:"destination"`
+	Writable    bool   `json:"writable"`
+	Data        string `json:"data"`
+	Propagation string `json:"mountpropagation"`
 }
diff --git a/vendor/github.com/docker/docker/container/view.go b/vendor/github.com/docker/docker/container/view.go
index aabb01923..b63149941 100644
--- a/vendor/github.com/docker/docker/container/view.go
+++ b/vendor/github.com/docker/docker/container/view.go
@@ -473,7 +473,7 @@ type namesByContainerIDIndexer struct{}
 func (e *namesByContainerIDIndexer) FromObject(obj interface{}) (bool, []byte, error) {
 	n, ok := obj.(nameAssociation)
 	if !ok {
-		return false, nil, fmt.Errorf(`%T does not have type "nameAssociation"`, obj)
+		return false, nil, fmt.Errorf(`%T does not have type "nameAssocation"`, obj)
 	}
 
 	// Add the null character as a terminator
diff --git a/vendor/github.com/docker/docker/oci/caps/utils.go b/vendor/github.com/docker/docker/daemon/caps/utils.go
similarity index 98%
rename from vendor/github.com/docker/docker/oci/caps/utils.go
rename to vendor/github.com/docker/docker/daemon/caps/utils.go
index 9b939fffc..c5ded542e 100644
--- a/vendor/github.com/docker/docker/oci/caps/utils.go
+++ b/vendor/github.com/docker/docker/daemon/caps/utils.go
@@ -1,4 +1,4 @@
-package caps // import "github.com/docker/docker/oci/caps"
+package caps // import "github.com/docker/docker/daemon/caps"
 
 import (
 	"fmt"
diff --git a/vendor/github.com/docker/docker/daemon/checkpoint.go b/vendor/github.com/docker/docker/daemon/checkpoint.go
index ae57a2164..4a1cb0e10 100644
--- a/vendor/github.com/docker/docker/daemon/checkpoint.go
+++ b/vendor/github.com/docker/docker/daemon/checkpoint.go
@@ -42,7 +42,7 @@ func getCheckpointDir(checkDir, checkpointID, ctrName, ctrID, ctrCheckpointDir s
 	} else {
 		switch {
 		case err != nil:
-			err2 = fmt.Errorf("checkpoint %s does not exist for container %s", checkpointID, ctrName)
+			err2 = fmt.Errorf("checkpoint %s does not exists for container %s", checkpointID, ctrName)
 		case err == nil && stat.IsDir():
 			err2 = nil
 		case err == nil:
@@ -95,7 +95,7 @@ func (daemon *Daemon) CheckpointDelete(name string, config types.CheckpointDelet
 	}
 	checkpointDir, err := getCheckpointDir(config.CheckpointDir, config.CheckpointID, name, container.ID, container.CheckpointDir(), false)
 	if err == nil {
-		return os.RemoveAll(checkpointDir)
+		return os.RemoveAll(filepath.Join(checkpointDir, config.CheckpointID))
 	}
 	return err
 }
diff --git a/vendor/github.com/docker/docker/daemon/cluster/convert/container.go b/vendor/github.com/docker/docker/daemon/cluster/convert/container.go
index 37f562ad2..d889b4004 100644
--- a/vendor/github.com/docker/docker/daemon/cluster/convert/container.go
+++ b/vendor/github.com/docker/docker/daemon/cluster/convert/container.go
@@ -36,7 +36,6 @@ func containerSpecFromGRPC(c *swarmapi.ContainerSpec) *types.ContainerSpec {
 		Configs:    configReferencesFromGRPC(c.Configs),
 		Isolation:  IsolationFromGRPC(c.Isolation),
 		Init:       initFromGRPC(c.Init),
-		Sysctls:    c.Sysctls,
 	}
 
 	if c.DNSConfig != nil {
@@ -252,7 +251,6 @@ func containerToGRPC(c *types.ContainerSpec) (*swarmapi.ContainerSpec, error) {
 		Configs:    configReferencesToGRPC(c.Configs),
 		Isolation:  isolationToGRPC(c.Isolation),
 		Init:       initToGRPC(c.Init),
-		Sysctls:    c.Sysctls,
 	}
 
 	if c.DNSConfig != nil {
@@ -321,12 +319,6 @@ func containerToGRPC(c *types.ContainerSpec) (*swarmapi.ContainerSpec, error) {
 			} else if string(m.BindOptions.Propagation) != "" {
 				return nil, fmt.Errorf("invalid MountPropagation: %q", m.BindOptions.Propagation)
 			}
-
-			if m.BindOptions.NonRecursive {
-				// TODO(AkihiroSuda): NonRecursive is unsupported for Swarm-mode now because of mutual vendoring
-				// across moby and swarmkit. Will be available soon after the moby PR gets merged.
-				return nil, fmt.Errorf("invalid NonRecursive: %q", m.BindOptions.Propagation)
-			}
 		}
 
 		if m.VolumeOptions != nil {
diff --git a/vendor/github.com/docker/docker/daemon/cluster/convert/service.go b/vendor/github.com/docker/docker/daemon/cluster/convert/service.go
index 2b7234259..5a1609aa0 100644
--- a/vendor/github.com/docker/docker/daemon/cluster/convert/service.go
+++ b/vendor/github.com/docker/docker/daemon/cluster/convert/service.go
@@ -208,7 +208,7 @@ func ServiceSpecToGRPC(s types.ServiceSpec) (swarmapi.ServiceSpec, error) {
 		}
 	case types.RuntimeNetworkAttachment:
 		// NOTE(dperny) I'm leaving this case here for completeness. The actual
-		// code is left out deliberately, as we should refuse to parse a
+		// code is left out out deliberately, as we should refuse to parse a
 		// Network Attachment runtime; it will cause weird behavior all over
 		// the system if we do. Instead, fallthrough and return
 		// ErrUnsupportedRuntime if we get one.
@@ -246,7 +246,6 @@ func ServiceSpecToGRPC(s types.ServiceSpec) (swarmapi.ServiceSpec, error) {
 		spec.Task.Placement = &swarmapi.Placement{
 			Constraints: s.TaskTemplate.Placement.Constraints,
 			Preferences: preferences,
-			MaxReplicas: s.TaskTemplate.Placement.MaxReplicas,
 			Platforms:   platforms,
 		}
 	}
@@ -473,7 +472,6 @@ func placementFromGRPC(p *swarmapi.Placement) *types.Placement {
 	}
 	r := &types.Placement{
 		Constraints: p.Constraints,
-		MaxReplicas: p.MaxReplicas,
 	}
 
 	for _, pref := range p.Preferences {
diff --git a/vendor/github.com/docker/docker/daemon/cluster/convert/swarm.go b/vendor/github.com/docker/docker/daemon/cluster/convert/swarm.go
index bdad2a5ea..643505bad 100644
--- a/vendor/github.com/docker/docker/daemon/cluster/convert/swarm.go
+++ b/vendor/github.com/docker/docker/daemon/cluster/convert/swarm.go
@@ -42,7 +42,6 @@ func SwarmFromGRPC(c swarmapi.Cluster) types.Swarm {
 			RootRotationInProgress: c.RootCA.RootRotation != nil,
 			DefaultAddrPool:        c.DefaultAddressPool,
 			SubnetSize:             c.SubnetSize,
-			DataPathPort:           c.VXLANUDPPort,
 		},
 		JoinTokens: types.JoinTokens{
 			Worker:  c.RootCA.JoinTokens.Worker,
diff --git a/vendor/github.com/docker/docker/daemon/cluster/executor/container/container.go b/vendor/github.com/docker/docker/daemon/cluster/executor/container/container.go
index b26076bcd..77d21d2c1 100644
--- a/vendor/github.com/docker/docker/daemon/cluster/executor/container/container.go
+++ b/vendor/github.com/docker/docker/daemon/cluster/executor/container/container.go
@@ -285,8 +285,6 @@ func convertMount(m api.Mount) enginemount.Mount {
 		mount.Type = enginemount.TypeVolume
 	case api.MountTypeTmpfs:
 		mount.Type = enginemount.TypeTmpfs
-	case api.MountTypeNamedPipe:
-		mount.Type = enginemount.TypeNamedPipe
 	}
 
 	if m.BindOptions != nil {
@@ -366,7 +364,6 @@ func (c *containerConfig) hostConfig() *enginecontainer.HostConfig {
 		ReadonlyRootfs: c.spec().ReadOnly,
 		Isolation:      c.isolation(),
 		Init:           c.init(),
-		Sysctls:        c.spec().Sysctls,
 	}
 
 	if c.spec().DNSConfig != nil {
diff --git a/vendor/github.com/docker/docker/daemon/cluster/executor/container/controller.go b/vendor/github.com/docker/docker/daemon/cluster/executor/container/controller.go
index 5552b1332..8d070799f 100644
--- a/vendor/github.com/docker/docker/daemon/cluster/executor/container/controller.go
+++ b/vendor/github.com/docker/docker/daemon/cluster/executor/container/controller.go
@@ -527,7 +527,7 @@ func (r *controller) Logs(ctx context.Context, publisher exec.LogPublisher, opti
 		}
 
 		if msg.Err != nil {
-			// the deferred cancel closes the adapter's log stream
+			// the defered cancel closes the adapter's log stream
 			return msg.Err
 		}
 
diff --git a/vendor/github.com/docker/docker/daemon/cluster/executor/container/validate.go b/vendor/github.com/docker/docker/daemon/cluster/executor/container/validate.go
index b90eb9898..cbe1f53c3 100644
--- a/vendor/github.com/docker/docker/daemon/cluster/executor/container/validate.go
+++ b/vendor/github.com/docker/docker/daemon/cluster/executor/container/validate.go
@@ -11,8 +11,7 @@ import (
 func validateMounts(mounts []api.Mount) error {
 	for _, mount := range mounts {
 		// Target must always be absolute
-		// except if target is Windows named pipe
-		if !filepath.IsAbs(mount.Target) && mount.Type != api.MountTypeNamedPipe {
+		if !filepath.IsAbs(mount.Target) {
 			return fmt.Errorf("invalid mount target, must be an absolute path: %s", mount.Target)
 		}
 
@@ -33,10 +32,6 @@ func validateMounts(mounts []api.Mount) error {
 			if mount.Source != "" {
 				return errors.New("invalid tmpfs source, source must be empty")
 			}
-		case api.MountTypeNamedPipe:
-			if mount.Source == "" {
-				return errors.New("invalid npipe source, source must not be empty")
-			}
 		default:
 			return fmt.Errorf("invalid mount type: %s", mount.Type)
 		}
diff --git a/vendor/github.com/docker/docker/daemon/cluster/executor/container/validate_windows_test.go b/vendor/github.com/docker/docker/daemon/cluster/executor/container/validate_windows_test.go
index e0d5bc2e6..6ee4c9643 100644
--- a/vendor/github.com/docker/docker/daemon/cluster/executor/container/validate_windows_test.go
+++ b/vendor/github.com/docker/docker/daemon/cluster/executor/container/validate_windows_test.go
@@ -1,24 +1,8 @@
 // +build windows
 
 package container // import "github.com/docker/docker/daemon/cluster/executor/container"
-import (
-	"strings"
-	"testing"
-
-	"github.com/docker/swarmkit/api"
-)
 
 const (
 	testAbsPath        = `c:\foo`
 	testAbsNonExistent = `c:\some-non-existing-host-path\`
 )
-
-func TestControllerValidateMountNamedPipe(t *testing.T) {
-	if _, err := newTestControllerWithMount(api.Mount{
-		Type:   api.MountTypeNamedPipe,
-		Source: "",
-		Target: `\\.\pipe\foo`,
-	}); err == nil || !strings.Contains(err.Error(), "invalid npipe source, source must not be empty") {
-		t.Fatalf("expected error, got: %v", err)
-	}
-}
diff --git a/vendor/github.com/docker/docker/daemon/cluster/filters.go b/vendor/github.com/docker/docker/daemon/cluster/filters.go
index 9a3180b83..15469f907 100644
--- a/vendor/github.com/docker/docker/daemon/cluster/filters.go
+++ b/vendor/github.com/docker/docker/daemon/cluster/filters.go
@@ -16,7 +16,6 @@ func newListNodesFilters(filter filters.Args) (*swarmapi.ListNodesRequest_Filter
 		"label":      true,
 		"role":       true,
 		"membership": true,
-		"node.label": true,
 	}
 	if err := filter.Validate(accepted); err != nil {
 		return nil, err
@@ -25,7 +24,6 @@ func newListNodesFilters(filter filters.Args) (*swarmapi.ListNodesRequest_Filter
 		NamePrefixes: filter.Get("name"),
 		IDPrefixes:   filter.Get("id"),
 		Labels:       runconfigopts.ConvertKVStringsToMap(filter.Get("label")),
-		NodeLabels:   runconfigopts.ConvertKVStringsToMap(filter.Get("node.label")),
 	}
 
 	for _, r := range filter.Get("role") {
diff --git a/vendor/github.com/docker/docker/daemon/cluster/listen_addr.go b/vendor/github.com/docker/docker/daemon/cluster/listen_addr.go
index 9e455d317..44ea5fce4 100644
--- a/vendor/github.com/docker/docker/daemon/cluster/listen_addr.go
+++ b/vendor/github.com/docker/docker/daemon/cluster/listen_addr.go
@@ -123,25 +123,6 @@ func validateDefaultAddrPool(defaultAddrPool []string, size uint32) error {
 	return nil
 }
 
-// getDataPathPort validates vxlan udp port (data path port) number.
-// if no port is set, the default (4789) is returned
-// valid port numbers are between 1024 and 49151
-func getDataPathPort(portNum uint32) (uint32, error) {
-	// if the value comes as 0 by any reason we set it to default value 4789
-	if portNum == 0 {
-		portNum = 4789
-		return portNum, nil
-	}
-	// IANA procedures for each range in detail
-	// The Well Known Ports, aka the System Ports, from 0-1023
-	// The Registered Ports, aka the User Ports, from 1024-49151
-	// The Dynamic Ports, aka the Private Ports, from 49152-65535
-	// So we can allow range between 1024 to 49151
-	if portNum < 1024 || portNum > 49151 {
-		return 0, fmt.Errorf("Datapath port number is not in valid range (1024-49151) : %d", portNum)
-	}
-	return portNum, nil
-}
 func resolveDataPathAddr(dataPathAddr string) (string, error) {
 	if dataPathAddr == "" {
 		// dataPathAddr is not defined
diff --git a/vendor/github.com/docker/docker/daemon/cluster/noderunner.go b/vendor/github.com/docker/docker/daemon/cluster/noderunner.go
index ef46021e4..071d8af5a 100644
--- a/vendor/github.com/docker/docker/daemon/cluster/noderunner.go
+++ b/vendor/github.com/docker/docker/daemon/cluster/noderunner.go
@@ -13,7 +13,7 @@ import (
 	"github.com/docker/docker/daemon/cluster/executor/container"
 	lncluster "github.com/docker/libnetwork/cluster"
 	swarmapi "github.com/docker/swarmkit/api"
-	swarmallocator "github.com/docker/swarmkit/manager/allocator/cnmallocator"
+	"github.com/docker/swarmkit/manager/allocator/cnmallocator"
 	swarmnode "github.com/docker/swarmkit/node"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
@@ -57,8 +57,6 @@ type nodeStartConfig struct {
 	DefaultAddressPool []string
 	// SubnetSize contains subnet size of DefaultAddressPool
 	SubnetSize uint32
-	// DataPathPort contains Data path port (VXLAN UDP port) number that is used for data traffic.
-	DataPathPort uint32
 	// JoinInProgress is set to true if a join operation has started, but
 	// not completed yet.
 	JoinInProgress bool
@@ -124,10 +122,9 @@ func (n *nodeRunner) start(conf nodeStartConfig) error {
 		ListenControlAPI:   control,
 		ListenRemoteAPI:    conf.ListenAddr,
 		AdvertiseRemoteAPI: conf.AdvertiseAddr,
-		NetworkConfig: &swarmallocator.NetworkConfig{
+		NetworkConfig: &cnmallocator.NetworkConfig{
 			DefaultAddrPool: conf.DefaultAddressPool,
 			SubnetSize:      conf.SubnetSize,
-			VXLANUDPPort:    conf.DataPathPort,
 		},
 		JoinAddr:  joinAddr,
 		StateDir:  n.cluster.root,
diff --git a/vendor/github.com/docker/docker/daemon/cluster/swarm.go b/vendor/github.com/docker/docker/daemon/cluster/swarm.go
index 8cc172e9c..65dfe9eb4 100644
--- a/vendor/github.com/docker/docker/daemon/cluster/swarm.go
+++ b/vendor/github.com/docker/docker/daemon/cluster/swarm.go
@@ -96,12 +96,6 @@ func (c *Cluster) Init(req types.InitRequest) (string, error) {
 	if err := validateDefaultAddrPool(req.DefaultAddrPool, req.SubnetSize); err != nil {
 		return "", err
 	}
-
-	port, err := getDataPathPort(req.DataPathPort)
-	if err != nil {
-		return "", err
-	}
-
 	nr, err := c.newNodeRunner(nodeStartConfig{
 		forceNewCluster:    req.ForceNewCluster,
 		autolock:           req.AutoLockManagers,
@@ -112,7 +106,6 @@ func (c *Cluster) Init(req types.InitRequest) (string, error) {
 		DefaultAddressPool: req.DefaultAddrPool,
 		SubnetSize:         req.SubnetSize,
 		availability:       req.Availability,
-		DataPathPort:       port,
 	})
 	if err != nil {
 		return "", err
diff --git a/vendor/github.com/docker/docker/daemon/config/config.go b/vendor/github.com/docker/docker/daemon/config/config.go
index 1b1dc9ca1..8b2c844a5 100644
--- a/vendor/github.com/docker/docker/daemon/config/config.go
+++ b/vendor/github.com/docker/docker/daemon/config/config.go
@@ -3,6 +3,7 @@ package config // import "github.com/docker/docker/daemon/config"
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"io/ioutil"
@@ -18,7 +19,6 @@ import (
 	"github.com/docker/docker/pkg/discovery"
 	"github.com/docker/docker/registry"
 	"github.com/imdario/mergo"
-	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/pflag"
 )
@@ -264,7 +264,7 @@ func ParseClusterAdvertiseSettings(clusterStore, clusterAdvertise string) (strin
 
 	advertise, err := discovery.ParseAdvertise(clusterAdvertise)
 	if err != nil {
-		return "", errors.Wrap(err, "discovery advertise parsing failed")
+		return "", fmt.Errorf("discovery advertise parsing failed (%v)", err)
 	}
 	return advertise, nil
 }
@@ -318,13 +318,13 @@ func Reload(configFile string, flags *pflag.FlagSet, reload func(*Config)) error
 	newConfig, err := getConflictFreeConfiguration(configFile, flags)
 	if err != nil {
 		if flags.Changed("config-file") || !os.IsNotExist(err) {
-			return errors.Wrapf(err, "unable to configure the Docker daemon with file %s", configFile)
+			return fmt.Errorf("unable to configure the Docker daemon with file %s: %v", configFile, err)
 		}
 		newConfig = New()
 	}
 
 	if err := Validate(newConfig); err != nil {
-		return errors.Wrap(err, "file configuration validation failed")
+		return fmt.Errorf("file configuration validation failed (%v)", err)
 	}
 
 	// Check if duplicate label-keys with different values are found
@@ -355,7 +355,7 @@ func MergeDaemonConfigurations(flagsConfig *Config, flags *pflag.FlagSet, config
 	}
 
 	if err := Validate(fileConfig); err != nil {
-		return nil, errors.Wrap(err, "configuration validation from file failed")
+		return nil, fmt.Errorf("configuration validation from file failed (%v)", err)
 	}
 
 	// merge flags configuration on top of the file configuration
@@ -366,7 +366,7 @@ func MergeDaemonConfigurations(flagsConfig *Config, flags *pflag.FlagSet, config
 	// We need to validate again once both fileConfig and flagsConfig
 	// have been merged
 	if err := Validate(fileConfig); err != nil {
-		return nil, errors.Wrap(err, "merged configuration validation from file and command line flags failed")
+		return nil, fmt.Errorf("merged configuration validation from file and command line flags failed (%v)", err)
 	}
 
 	return fileConfig, nil
@@ -438,7 +438,7 @@ func getConflictFreeConfiguration(configFile string, flags *pflag.FlagSet) (*Con
 		logrus.Warn(`The "graph" config file option is deprecated. Please use "data-root" instead.`)
 
 		if config.Root != "" {
-			return nil, errors.New(`cannot specify both "graph" and "data-root" config file options`)
+			return nil, fmt.Errorf(`cannot specify both "graph" and "data-root" config file options`)
 		}
 
 		config.Root = config.RootDeprecated
diff --git a/vendor/github.com/docker/docker/daemon/container.go b/vendor/github.com/docker/docker/daemon/container.go
index 56c986564..c8e205397 100644
--- a/vendor/github.com/docker/docker/daemon/container.go
+++ b/vendor/github.com/docker/docker/daemon/container.go
@@ -24,7 +24,6 @@ import (
 	"github.com/docker/go-connections/nat"
 	"github.com/opencontainers/selinux/go-selinux/label"
 	"github.com/pkg/errors"
-	"github.com/sirupsen/logrus"
 )
 
 // GetContainer looks for a container using the provided information, which could be
@@ -232,150 +231,128 @@ func (daemon *Daemon) setHostConfig(container *container.Container, hostConfig *
 
 // verifyContainerSettings performs validation of the hostconfig and config
 // structures.
-func (daemon *Daemon) verifyContainerSettings(platform string, hostConfig *containertypes.HostConfig, config *containertypes.Config, update bool) (warnings []string, err error) {
+func (daemon *Daemon) verifyContainerSettings(platform string, hostConfig *containertypes.HostConfig, config *containertypes.Config, update bool) ([]string, error) {
 	// First perform verification of settings common across all platforms.
-	if err = validateContainerConfig(config, platform); err != nil {
-		return warnings, err
-	}
-	if err := validateHostConfig(hostConfig, platform); err != nil {
-		return warnings, err
-	}
+	if config != nil {
+		if config.WorkingDir != "" {
+			wdInvalid := false
+			if runtime.GOOS == platform {
+				config.WorkingDir = filepath.FromSlash(config.WorkingDir) // Ensure in platform semantics
+				if !system.IsAbs(config.WorkingDir) {
+					wdInvalid = true
+				}
+			} else {
+				// LCOW. Force Unix semantics
+				config.WorkingDir = strings.Replace(config.WorkingDir, string(os.PathSeparator), "/", -1)
+				if !path.IsAbs(config.WorkingDir) {
+					wdInvalid = true
+				}
+			}
+			if wdInvalid {
+				return nil, fmt.Errorf("the working directory '%s' is invalid, it needs to be an absolute path", config.WorkingDir)
+			}
+		}
 
-	// Now do platform-specific verification
-	warnings, err = verifyPlatformContainerSettings(daemon, hostConfig, update)
-	for _, w := range warnings {
-		logrus.Warn(w)
-	}
-	return warnings, err
-}
+		if len(config.StopSignal) > 0 {
+			_, err := signal.ParseSignal(config.StopSignal)
+			if err != nil {
+				return nil, err
+			}
+		}
 
-func validateContainerConfig(config *containertypes.Config, platform string) error {
-	if config == nil {
-		return nil
-	}
-	if err := translateWorkingDir(config, platform); err != nil {
-		return err
-	}
-	if len(config.StopSignal) > 0 {
-		if _, err := signal.ParseSignal(config.StopSignal); err != nil {
-			return err
+		// Validate if Env contains empty variable or not (e.g., ``, `=foo`)
+		for _, env := range config.Env {
+			if _, err := opts.ValidateEnv(env); err != nil {
+				return nil, err
+			}
 		}
-	}
-	// Validate if Env contains empty variable or not (e.g., ``, `=foo`)
-	for _, env := range config.Env {
-		if _, err := opts.ValidateEnv(env); err != nil {
-			return err
+
+		// Validate the healthcheck params of Config
+		if config.Healthcheck != nil {
+			if config.Healthcheck.Interval != 0 && config.Healthcheck.Interval < containertypes.MinimumDuration {
+				return nil, errors.Errorf("Interval in Healthcheck cannot be less than %s", containertypes.MinimumDuration)
+			}
+
+			if config.Healthcheck.Timeout != 0 && config.Healthcheck.Timeout < containertypes.MinimumDuration {
+				return nil, errors.Errorf("Timeout in Healthcheck cannot be less than %s", containertypes.MinimumDuration)
+			}
+
+			if config.Healthcheck.Retries < 0 {
+				return nil, errors.Errorf("Retries in Healthcheck cannot be negative")
+			}
+
+			if config.Healthcheck.StartPeriod != 0 && config.Healthcheck.StartPeriod < containertypes.MinimumDuration {
+				return nil, errors.Errorf("StartPeriod in Healthcheck cannot be less than %s", containertypes.MinimumDuration)
+			}
 		}
 	}
-	return validateHealthCheck(config.Healthcheck)
-}
 
-func validateHostConfig(hostConfig *containertypes.HostConfig, platform string) error {
 	if hostConfig == nil {
-		return nil
+		return nil, nil
 	}
+
 	if hostConfig.AutoRemove && !hostConfig.RestartPolicy.IsNone() {
-		return errors.Errorf("can't create 'AutoRemove' container with restart policy")
+		return nil, errors.Errorf("can't create 'AutoRemove' container with restart policy")
 	}
+
 	// Validate mounts; check if host directories still exist
 	parser := volumemounts.NewParser(platform)
 	for _, cfg := range hostConfig.Mounts {
 		if err := parser.ValidateMountConfig(&cfg); err != nil {
-			return err
+			return nil, err
 		}
 	}
+
 	for _, extraHost := range hostConfig.ExtraHosts {
 		if _, err := opts.ValidateExtraHost(extraHost); err != nil {
-			return err
+			return nil, err
 		}
 	}
-	if err := validatePortBindings(hostConfig.PortBindings); err != nil {
-		return err
-	}
-	if err := validateRestartPolicy(hostConfig.RestartPolicy); err != nil {
-		return err
-	}
-	if !hostConfig.Isolation.IsValid() {
-		return errors.Errorf("invalid isolation '%s' on %s", hostConfig.Isolation, runtime.GOOS)
-	}
-	return nil
-}
-
-// validateHealthCheck validates the healthcheck params of Config
-func validateHealthCheck(healthConfig *containertypes.HealthConfig) error {
-	if healthConfig == nil {
-		return nil
-	}
-	if healthConfig.Interval != 0 && healthConfig.Interval < containertypes.MinimumDuration {
-		return errors.Errorf("Interval in Healthcheck cannot be less than %s", containertypes.MinimumDuration)
-	}
-	if healthConfig.Timeout != 0 && healthConfig.Timeout < containertypes.MinimumDuration {
-		return errors.Errorf("Timeout in Healthcheck cannot be less than %s", containertypes.MinimumDuration)
-	}
-	if healthConfig.Retries < 0 {
-		return errors.Errorf("Retries in Healthcheck cannot be negative")
-	}
-	if healthConfig.StartPeriod != 0 && healthConfig.StartPeriod < containertypes.MinimumDuration {
-		return errors.Errorf("StartPeriod in Healthcheck cannot be less than %s", containertypes.MinimumDuration)
-	}
-	return nil
-}
 
-func validatePortBindings(ports nat.PortMap) error {
-	for port := range ports {
+	for port := range hostConfig.PortBindings {
 		_, portStr := nat.SplitProtoPort(string(port))
 		if _, err := nat.ParsePort(portStr); err != nil {
-			return errors.Errorf("invalid port specification: %q", portStr)
+			return nil, errors.Errorf("invalid port specification: %q", portStr)
 		}
-		for _, pb := range ports[port] {
+		for _, pb := range hostConfig.PortBindings[port] {
 			_, err := nat.NewPort(nat.SplitProtoPort(pb.HostPort))
 			if err != nil {
-				return errors.Errorf("invalid port specification: %q", pb.HostPort)
+				return nil, errors.Errorf("invalid port specification: %q", pb.HostPort)
 			}
 		}
 	}
-	return nil
-}
 
-func validateRestartPolicy(policy containertypes.RestartPolicy) error {
-	switch policy.Name {
+	p := hostConfig.RestartPolicy
+
+	switch p.Name {
 	case "always", "unless-stopped", "no":
-		if policy.MaximumRetryCount != 0 {
-			return errors.Errorf("maximum retry count cannot be used with restart policy '%s'", policy.Name)
+		if p.MaximumRetryCount != 0 {
+			return nil, errors.Errorf("maximum retry count cannot be used with restart policy '%s'", p.Name)
 		}
 	case "on-failure":
-		if policy.MaximumRetryCount < 0 {
-			return errors.Errorf("maximum retry count cannot be negative")
+		if p.MaximumRetryCount < 0 {
+			return nil, errors.Errorf("maximum retry count cannot be negative")
 		}
 	case "":
 		// do nothing
-		return nil
 	default:
-		return errors.Errorf("invalid restart policy '%s'", policy.Name)
+		return nil, errors.Errorf("invalid restart policy '%s'", p.Name)
 	}
-	return nil
-}
 
-// translateWorkingDir translates the working-dir for the target platform,
-// and returns an error if the given path is not an absolute path.
-func translateWorkingDir(config *containertypes.Config, platform string) error {
-	if config.WorkingDir == "" {
-		return nil
+	if !hostConfig.Isolation.IsValid() {
+		return nil, errors.Errorf("invalid isolation '%s' on %s", hostConfig.Isolation, runtime.GOOS)
 	}
-	wd := config.WorkingDir
-	switch {
-	case runtime.GOOS != platform:
-		// LCOW. Force Unix semantics
-		wd = strings.Replace(wd, string(os.PathSeparator), "/", -1)
-		if !path.IsAbs(wd) {
-			return fmt.Errorf("the working directory '%s' is invalid, it needs to be an absolute path", config.WorkingDir)
-		}
-	default:
-		wd = filepath.FromSlash(wd) // Ensure in platform semantics
-		if !system.IsAbs(wd) {
-			return fmt.Errorf("the working directory '%s' is invalid, it needs to be an absolute path", config.WorkingDir)
-		}
+
+	var (
+		err      error
+		warnings []string
+	)
+	// Now do platform-specific verification
+	if warnings, err = verifyPlatformContainerSettings(daemon, hostConfig, config, update); err != nil {
+		return warnings, err
 	}
-	config.WorkingDir = wd
-	return nil
+	if hostConfig.NetworkMode.IsHost() && len(hostConfig.PortBindings) > 0 {
+		warnings = append(warnings, "Published ports are discarded when using host network mode")
+	}
+	return warnings, err
 }
diff --git a/vendor/github.com/docker/docker/daemon/container_operations_unix.go b/vendor/github.com/docker/docker/daemon/container_operations_unix.go
index 5552d09df..9953c7f3f 100644
--- a/vendor/github.com/docker/docker/daemon/container_operations_unix.go
+++ b/vendor/github.com/docker/docker/daemon/container_operations_unix.go
@@ -351,6 +351,10 @@ func killProcessDirectly(cntr *container.Container) error {
 	return nil
 }
 
+func detachMounted(path string) error {
+	return unix.Unmount(path, unix.MNT_DETACH)
+}
+
 func isLinkable(child *container.Container) bool {
 	// A container is linkable only if it belongs to the default network
 	_, ok := child.NetworkSettings.Networks[runconfig.DefaultDaemonNetworkMode().NetworkName()]
diff --git a/vendor/github.com/docker/docker/daemon/container_operations_windows.go b/vendor/github.com/docker/docker/daemon/container_operations_windows.go
index 10bfd53d6..349d3a156 100644
--- a/vendor/github.com/docker/docker/daemon/container_operations_windows.go
+++ b/vendor/github.com/docker/docker/daemon/container_operations_windows.go
@@ -78,6 +78,10 @@ func (daemon *Daemon) mountVolumes(container *container.Container) error {
 	return nil
 }
 
+func detachMounted(path string) error {
+	return nil
+}
+
 func (daemon *Daemon) setupSecretDir(c *container.Container) (setupErr error) {
 	if len(c.SecretReferences) == 0 {
 		return nil
diff --git a/vendor/github.com/docker/docker/daemon/daemon.go b/vendor/github.com/docker/docker/daemon/daemon.go
index 651a57a13..a30786301 100644
--- a/vendor/github.com/docker/docker/daemon/daemon.go
+++ b/vendor/github.com/docker/docker/daemon/daemon.go
@@ -50,6 +50,7 @@ import (
 	"github.com/docker/docker/image"
 	"github.com/docker/docker/layer"
 	"github.com/docker/docker/libcontainerd"
+	"github.com/docker/docker/migrate/v1"
 	"github.com/docker/docker/pkg/idtools"
 	"github.com/docker/docker/pkg/locker"
 	"github.com/docker/docker/pkg/plugingetter"
@@ -66,7 +67,6 @@ import (
 	"github.com/docker/libnetwork/cluster"
 	nwconfig "github.com/docker/libnetwork/config"
 	"github.com/pkg/errors"
-	"golang.org/x/sync/semaphore"
 )
 
 // ContainersNamespace is the name of the namespace used for users containers
@@ -198,7 +198,6 @@ func (daemon *Daemon) NewResolveOptionsFunc() resolver.ResolveOptionsFunc {
 }
 
 func (daemon *Daemon) restore() error {
-	var mapLock sync.Mutex
 	containers := make(map[string]*container.Container)
 
 	logrus.Info("Loading containers: start.")
@@ -208,99 +207,68 @@ func (daemon *Daemon) restore() error {
 		return err
 	}
 
-	// parallelLimit is the maximum number of parallel startup jobs that we
-	// allow (this is the limited used for all startup semaphores). The multipler
-	// (128) was chosen after some fairly significant benchmarking -- don't change
-	// it unless you've tested it significantly (this value is adjusted if
-	// RLIMIT_NOFILE is small to avoid EMFILE).
-	parallelLimit := adjustParallelLimit(len(dir), 128*runtime.NumCPU())
-
-	// Re-used for all parallel startup jobs.
-	var group sync.WaitGroup
-	sem := semaphore.NewWeighted(int64(parallelLimit))
-
 	for _, v := range dir {
-		group.Add(1)
-		go func(id string) {
-			defer group.Done()
-			_ = sem.Acquire(context.Background(), 1)
-			defer sem.Release(1)
-
-			container, err := daemon.load(id)
+		id := v.Name()
+		container, err := daemon.load(id)
+		if err != nil {
+			logrus.Errorf("Failed to load container %v: %v", id, err)
+			continue
+		}
+		if !system.IsOSSupported(container.OS) {
+			logrus.Errorf("Failed to load container %v: %s (%q)", id, system.ErrNotSupportedOperatingSystem, container.OS)
+			continue
+		}
+		// Ignore the container if it does not support the current driver being used by the graph
+		currentDriverForContainerOS := daemon.graphDrivers[container.OS]
+		if (container.Driver == "" && currentDriverForContainerOS == "aufs") || container.Driver == currentDriverForContainerOS {
+			rwlayer, err := daemon.imageService.GetLayerByID(container.ID, container.OS)
 			if err != nil {
-				logrus.Errorf("Failed to load container %v: %v", id, err)
-				return
-			}
-			if !system.IsOSSupported(container.OS) {
-				logrus.Errorf("Failed to load container %v: %s (%q)", id, system.ErrNotSupportedOperatingSystem, container.OS)
-				return
+				logrus.Errorf("Failed to load container mount %v: %v", id, err)
+				continue
 			}
-			// Ignore the container if it does not support the current driver being used by the graph
-			currentDriverForContainerOS := daemon.graphDrivers[container.OS]
-			if (container.Driver == "" && currentDriverForContainerOS == "aufs") || container.Driver == currentDriverForContainerOS {
-				rwlayer, err := daemon.imageService.GetLayerByID(container.ID, container.OS)
-				if err != nil {
-					logrus.Errorf("Failed to load container mount %v: %v", id, err)
-					return
-				}
-				container.RWLayer = rwlayer
-				logrus.Debugf("Loaded container %v, isRunning: %v", container.ID, container.IsRunning())
+			container.RWLayer = rwlayer
+			logrus.Debugf("Loaded container %v, isRunning: %v", container.ID, container.IsRunning())
 
-				mapLock.Lock()
-				containers[container.ID] = container
-				mapLock.Unlock()
-			} else {
-				logrus.Debugf("Cannot load container %s because it was created with another graph driver.", container.ID)
-			}
-		}(v.Name())
+			containers[container.ID] = container
+		} else {
+			logrus.Debugf("Cannot load container %s because it was created with another graph driver.", container.ID)
+		}
 	}
-	group.Wait()
 
 	removeContainers := make(map[string]*container.Container)
 	restartContainers := make(map[*container.Container]chan struct{})
 	activeSandboxes := make(map[string]interface{})
+	for id, c := range containers {
+		if err := daemon.registerName(c); err != nil {
+			logrus.Errorf("Failed to register container name %s: %s", c.ID, err)
+			delete(containers, id)
+			continue
+		}
+		if err := daemon.Register(c); err != nil {
+			logrus.Errorf("Failed to register container %s: %s", c.ID, err)
+			delete(containers, id)
+			continue
+		}
 
-	for _, c := range containers {
-		group.Add(1)
-		go func(c *container.Container) {
-			defer group.Done()
-			_ = sem.Acquire(context.Background(), 1)
-			defer sem.Release(1)
-
-			if err := daemon.registerName(c); err != nil {
-				logrus.Errorf("Failed to register container name %s: %s", c.ID, err)
-				mapLock.Lock()
-				delete(containers, c.ID)
-				mapLock.Unlock()
-				return
-			}
-			if err := daemon.Register(c); err != nil {
-				logrus.Errorf("Failed to register container %s: %s", c.ID, err)
-				mapLock.Lock()
-				delete(containers, c.ID)
-				mapLock.Unlock()
-				return
-			}
-
-			// The LogConfig.Type is empty if the container was created before docker 1.12 with default log driver.
-			// We should rewrite it to use the daemon defaults.
-			// Fixes https://github.com/docker/docker/issues/22536
-			if c.HostConfig.LogConfig.Type == "" {
-				if err := daemon.mergeAndVerifyLogConfig(&c.HostConfig.LogConfig); err != nil {
-					logrus.Errorf("Failed to verify log config for container %s: %q", c.ID, err)
-				}
+		// The LogConfig.Type is empty if the container was created before docker 1.12 with default log driver.
+		// We should rewrite it to use the daemon defaults.
+		// Fixes https://github.com/docker/docker/issues/22536
+		if c.HostConfig.LogConfig.Type == "" {
+			if err := daemon.mergeAndVerifyLogConfig(&c.HostConfig.LogConfig); err != nil {
+				logrus.Errorf("Failed to verify log config for container %s: %q", c.ID, err)
+				continue
 			}
-		}(c)
+		}
 	}
-	group.Wait()
 
+	var (
+		wg      sync.WaitGroup
+		mapLock sync.Mutex
+	)
 	for _, c := range containers {
-		group.Add(1)
+		wg.Add(1)
 		go func(c *container.Container) {
-			defer group.Done()
-			_ = sem.Acquire(context.Background(), 1)
-			defer sem.Release(1)
-
+			defer wg.Done()
 			daemon.backportMountSpec(c)
 			if err := daemon.checkpointAndSave(c); err != nil {
 				logrus.WithError(err).WithField("container", c.ID).Error("error saving backported mountspec to disk")
@@ -447,8 +415,7 @@ func (daemon *Daemon) restore() error {
 			c.Unlock()
 		}(c)
 	}
-	group.Wait()
-
+	wg.Wait()
 	daemon.netController, err = daemon.initNetworkController(daemon.configStore, activeSandboxes)
 	if err != nil {
 		return fmt.Errorf("Error initializing network controller: %v", err)
@@ -456,24 +423,18 @@ func (daemon *Daemon) restore() error {
 
 	// Now that all the containers are registered, register the links
 	for _, c := range containers {
-		group.Add(1)
-		go func(c *container.Container) {
-			_ = sem.Acquire(context.Background(), 1)
-
-			if err := daemon.registerLinks(c, c.HostConfig); err != nil {
-				logrus.Errorf("failed to register link for container %s: %v", c.ID, err)
-			}
-
-			sem.Release(1)
-			group.Done()
-		}(c)
+		if err := daemon.registerLinks(c, c.HostConfig); err != nil {
+			logrus.Errorf("failed to register link for container %s: %v", c.ID, err)
+		}
 	}
-	group.Wait()
 
+	group := sync.WaitGroup{}
 	for c, notifier := range restartContainers {
 		group.Add(1)
+
 		go func(c *container.Container, chNotify chan struct{}) {
-			_ = sem.Acquire(context.Background(), 1)
+			defer group.Done()
+
 			logrus.Debugf("Starting container %s", c.ID)
 
 			// ignore errors here as this is a best effort to wait for children to be
@@ -495,27 +456,22 @@ func (daemon *Daemon) restore() error {
 				logrus.Errorf("Failed to start container %s: %s", c.ID, err)
 			}
 			close(chNotify)
-
-			sem.Release(1)
-			group.Done()
 		}(c, notifier)
+
 	}
 	group.Wait()
 
+	removeGroup := sync.WaitGroup{}
 	for id := range removeContainers {
-		group.Add(1)
+		removeGroup.Add(1)
 		go func(cid string) {
-			_ = sem.Acquire(context.Background(), 1)
-
 			if err := daemon.ContainerRm(cid, &types.ContainerRmConfig{ForceRemove: true, RemoveVolume: true}); err != nil {
 				logrus.Errorf("Failed to remove container %s: %s", cid, err)
 			}
-
-			sem.Release(1)
-			group.Done()
+			removeGroup.Done()
 		}(id)
 	}
-	group.Wait()
+	removeGroup.Wait()
 
 	// any containers that were started above would already have had this done,
 	// however we need to now prepare the mountpoints for the rest of the containers as well.
@@ -536,16 +492,13 @@ func (daemon *Daemon) restore() error {
 
 		group.Add(1)
 		go func(c *container.Container) {
-			_ = sem.Acquire(context.Background(), 1)
-
+			defer group.Done()
 			if err := daemon.prepareMountPoints(c); err != nil {
 				logrus.Error(err)
 			}
-
-			sem.Release(1)
-			group.Done()
 		}(c)
 	}
+
 	group.Wait()
 
 	logrus.Info("Loading containers: done.")
@@ -556,18 +509,7 @@ func (daemon *Daemon) restore() error {
 // RestartSwarmContainers restarts any autostart container which has a
 // swarm endpoint.
 func (daemon *Daemon) RestartSwarmContainers() {
-	ctx := context.Background()
-
-	// parallelLimit is the maximum number of parallel startup jobs that we
-	// allow (this is the limited used for all startup semaphores). The multipler
-	// (128) was chosen after some fairly significant benchmarking -- don't change
-	// it unless you've tested it significantly (this value is adjusted if
-	// RLIMIT_NOFILE is small to avoid EMFILE).
-	parallelLimit := adjustParallelLimit(len(daemon.List()), 128*runtime.NumCPU())
-
-	var group sync.WaitGroup
-	sem := semaphore.NewWeighted(int64(parallelLimit))
-
+	group := sync.WaitGroup{}
 	for _, c := range daemon.List() {
 		if !c.IsRunning() && !c.IsPaused() {
 			// Autostart all the containers which has a
@@ -576,21 +518,14 @@ func (daemon *Daemon) RestartSwarmContainers() {
 			if daemon.configStore.AutoRestart && c.ShouldRestart() && c.NetworkSettings.HasSwarmEndpoint && c.HasBeenStartedBefore {
 				group.Add(1)
 				go func(c *container.Container) {
-					if err := sem.Acquire(ctx, 1); err != nil {
-						// ctx is done.
-						group.Done()
-						return
-					}
-
+					defer group.Done()
 					if err := daemon.containerStart(c, "", "", true); err != nil {
 						logrus.Error(err)
 					}
-
-					sem.Release(1)
-					group.Done()
 				}(c)
 			}
 		}
+
 	}
 	group.Wait()
 }
@@ -867,7 +802,7 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S
 		grpc.WithDefaultCallOptions(grpc.MaxCallSendMsgSize(defaults.DefaultMaxSendMsgSize)),
 	}
 	if config.ContainerdAddr != "" {
-		d.containerdCli, err = containerd.New(config.ContainerdAddr, containerd.WithDefaultNamespace(ContainersNamespace), containerd.WithDialOpts(gopts), containerd.WithTimeout(60*time.Second))
+		d.containerdCli, err = containerd.New(config.ContainerdAddr, containerd.WithDefaultNamespace(ContainersNamespace), containerd.WithDialOpts(gopts))
 		if err != nil {
 			return nil, errors.Wrapf(err, "failed to dial %q", config.ContainerdAddr)
 		}
@@ -879,7 +814,7 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S
 		// Windows is not currently using containerd, keep the
 		// client as nil
 		if config.ContainerdAddr != "" {
-			pluginCli, err = containerd.New(config.ContainerdAddr, containerd.WithDefaultNamespace(pluginexec.PluginNamespace), containerd.WithDialOpts(gopts), containerd.WithTimeout(60*time.Second))
+			pluginCli, err = containerd.New(config.ContainerdAddr, containerd.WithDefaultNamespace(pluginexec.PluginNamespace), containerd.WithDialOpts(gopts))
 			if err != nil {
 				return nil, errors.Wrapf(err, "failed to dial %q", config.ContainerdAddr)
 			}
@@ -909,7 +844,7 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S
 
 	for operatingSystem, gd := range d.graphDrivers {
 		layerStores[operatingSystem], err = layer.NewStoreFromOptions(layer.StoreOptions{
-			Root:                      config.Root,
+			Root: config.Root,
 			MetadataStorePathTemplate: filepath.Join(config.Root, "image", "%s", "layerdb"),
 			GraphDriver:               gd,
 			GraphDriverOptions:        config.GraphOptions,
@@ -986,6 +921,15 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S
 		return nil, err
 	}
 
+	// No content-addressability migration on Windows as it never supported pre-CA
+	if runtime.GOOS != "windows" {
+		migrationStart := time.Now()
+		if err := v1.Migrate(config.Root, d.graphDrivers[runtime.GOOS], layerStores[runtime.GOOS], imageStore, rs, distributionMetadataStore); err != nil {
+			logrus.Errorf("Graph migration failed: %q. Your old graph data was found to be too inconsistent for upgrading to content-addressable storage. Some of the old data was probably not upgraded. We recommend starting over with a clean storage directory if possible.", err)
+		}
+		logrus.Infof("Graph migration to content-addressability took %.2f seconds", time.Since(migrationStart).Seconds())
+	}
+
 	// Discovery is only enabled when the daemon is launched with an address to advertise.  When
 	// initialized, the daemon is registered and we can store the discovery backend as it's read-only
 	if err := d.initDiscovery(config); err != nil {
diff --git a/vendor/github.com/docker/docker/daemon/daemon_unix.go b/vendor/github.com/docker/docker/daemon/daemon_unix.go
index 817025e93..5234201c8 100644
--- a/vendor/github.com/docker/docker/daemon/daemon_unix.go
+++ b/vendor/github.com/docker/docker/daemon/daemon_unix.go
@@ -111,10 +111,6 @@ func getMemoryResources(config containertypes.Resources) *specs.LinuxMemory {
 		memory.Kernel = &config.KernelMemory
 	}
 
-	if config.KernelMemoryTCP != 0 {
-		memory.KernelTCP = &config.KernelMemoryTCP
-	}
-
 	return &memory
 }
 
@@ -257,41 +253,6 @@ func getBlkioThrottleDevices(devs []*blkiodev.ThrottleDevice) ([]specs.LinuxThro
 	return throttleDevices, nil
 }
 
-// adjustParallelLimit takes a number of objects and a proposed limit and
-// figures out if it's reasonable (and adjusts it accordingly). This is only
-// used for daemon startup, which does a lot of parallel loading of containers
-// (and if we exceed RLIMIT_NOFILE then we're in trouble).
-func adjustParallelLimit(n int, limit int) int {
-	// Rule-of-thumb overhead factor (how many files will each goroutine open
-	// simultaneously). Yes, this is ugly but to be frank this whole thing is
-	// ugly.
-	const overhead = 2
-
-	// On Linux, we need to ensure that parallelStartupJobs doesn't cause us to
-	// exceed RLIMIT_NOFILE. If parallelStartupJobs is too large, we reduce it
-	// and give a warning (since in theory the user should increase their
-	// ulimits to the largest possible value for dockerd).
-	var rlim unix.Rlimit
-	if err := unix.Getrlimit(unix.RLIMIT_NOFILE, &rlim); err != nil {
-		logrus.Warnf("Couldn't find dockerd's RLIMIT_NOFILE to double-check startup parallelism factor: %v", err)
-		return limit
-	}
-	softRlimit := int(rlim.Cur)
-
-	// Much fewer containers than RLIMIT_NOFILE. No need to adjust anything.
-	if softRlimit > overhead*n {
-		return limit
-	}
-
-	// RLIMIT_NOFILE big enough, no need to adjust anything.
-	if softRlimit > overhead*limit {
-		return limit
-	}
-
-	logrus.Warnf("Found dockerd's open file ulimit (%v) is far too small -- consider increasing it significantly (at least %v)", softRlimit, overhead*limit)
-	return softRlimit / overhead
-}
-
 func checkKernel() error {
 	// Check for unsupported kernel versions
 	// FIXME: it would be cleaner to not test for specific versions, but rather
@@ -389,8 +350,8 @@ func adaptSharedNamespaceContainer(daemon containerGetter, hostConfig *container
 	}
 }
 
-// verifyPlatformContainerResources performs platform-specific validation of the container's resource-configuration
-func verifyPlatformContainerResources(resources *containertypes.Resources, sysInfo *sysinfo.SysInfo, update bool) (warnings []string, err error) {
+func verifyContainerResources(resources *containertypes.Resources, sysInfo *sysinfo.SysInfo, update bool) ([]string, error) {
+	warnings := []string{}
 	fixMemorySwappiness(resources)
 
 	// memory subsystem checks and adjustments
@@ -399,11 +360,13 @@ func verifyPlatformContainerResources(resources *containertypes.Resources, sysIn
 	}
 	if resources.Memory > 0 && !sysInfo.MemoryLimit {
 		warnings = append(warnings, "Your kernel does not support memory limit capabilities or the cgroup is not mounted. Limitation discarded.")
+		logrus.Warn("Your kernel does not support memory limit capabilities or the cgroup is not mounted. Limitation discarded.")
 		resources.Memory = 0
 		resources.MemorySwap = -1
 	}
 	if resources.Memory > 0 && resources.MemorySwap != -1 && !sysInfo.SwapLimit {
 		warnings = append(warnings, "Your kernel does not support swap limit capabilities or the cgroup is not mounted. Memory limited without swap.")
+		logrus.Warn("Your kernel does not support swap limit capabilities,or the cgroup is not mounted. Memory limited without swap.")
 		resources.MemorySwap = -1
 	}
 	if resources.Memory > 0 && resources.MemorySwap > 0 && resources.MemorySwap < resources.Memory {
@@ -414,6 +377,7 @@ func verifyPlatformContainerResources(resources *containertypes.Resources, sysIn
 	}
 	if resources.MemorySwappiness != nil && !sysInfo.MemorySwappiness {
 		warnings = append(warnings, "Your kernel does not support memory swappiness capabilities or the cgroup is not mounted. Memory swappiness discarded.")
+		logrus.Warn("Your kernel does not support memory swappiness capabilities, or the cgroup is not mounted. Memory swappiness discarded.")
 		resources.MemorySwappiness = nil
 	}
 	if resources.MemorySwappiness != nil {
@@ -424,6 +388,7 @@ func verifyPlatformContainerResources(resources *containertypes.Resources, sysIn
 	}
 	if resources.MemoryReservation > 0 && !sysInfo.MemoryReservation {
 		warnings = append(warnings, "Your kernel does not support memory soft limit capabilities or the cgroup is not mounted. Limitation discarded.")
+		logrus.Warn("Your kernel does not support memory soft limit capabilities or the cgroup is not mounted. Limitation discarded.")
 		resources.MemoryReservation = 0
 	}
 	if resources.MemoryReservation > 0 && resources.MemoryReservation < linuxMinMemory {
@@ -434,6 +399,7 @@ func verifyPlatformContainerResources(resources *containertypes.Resources, sysIn
 	}
 	if resources.KernelMemory > 0 && !sysInfo.KernelMemory {
 		warnings = append(warnings, "Your kernel does not support kernel memory limit capabilities or the cgroup is not mounted. Limitation discarded.")
+		logrus.Warn("Your kernel does not support kernel memory limit capabilities or the cgroup is not mounted. Limitation discarded.")
 		resources.KernelMemory = 0
 	}
 	if resources.KernelMemory > 0 && resources.KernelMemory < linuxMinMemory {
@@ -441,20 +407,21 @@ func verifyPlatformContainerResources(resources *containertypes.Resources, sysIn
 	}
 	if resources.KernelMemory > 0 && !kernel.CheckKernelVersion(4, 0, 0) {
 		warnings = append(warnings, "You specified a kernel memory limit on a kernel older than 4.0. Kernel memory limits are experimental on older kernels, it won't work as expected and can cause your system to be unstable.")
+		logrus.Warn("You specified a kernel memory limit on a kernel older than 4.0. Kernel memory limits are experimental on older kernels, it won't work as expected and can cause your system to be unstable.")
 	}
 	if resources.OomKillDisable != nil && !sysInfo.OomKillDisable {
 		// only produce warnings if the setting wasn't to *disable* the OOM Kill; no point
 		// warning the caller if they already wanted the feature to be off
 		if *resources.OomKillDisable {
 			warnings = append(warnings, "Your kernel does not support OomKillDisable. OomKillDisable discarded.")
+			logrus.Warn("Your kernel does not support OomKillDisable. OomKillDisable discarded.")
 		}
 		resources.OomKillDisable = nil
 	}
-	if resources.OomKillDisable != nil && *resources.OomKillDisable && resources.Memory == 0 {
-		warnings = append(warnings, "OOM killer is disabled for the container, but no memory limit is set, this can result in the system running out of resources.")
-	}
+
 	if resources.PidsLimit != 0 && !sysInfo.PidsLimit {
 		warnings = append(warnings, "Your kernel does not support pids limit capabilities or the cgroup is not mounted. PIDs limit discarded.")
+		logrus.Warn("Your kernel does not support pids limit capabilities or the cgroup is not mounted. PIDs limit discarded.")
 		resources.PidsLimit = 0
 	}
 
@@ -481,10 +448,12 @@ func verifyPlatformContainerResources(resources *containertypes.Resources, sysIn
 
 	if resources.CPUShares > 0 && !sysInfo.CPUShares {
 		warnings = append(warnings, "Your kernel does not support CPU shares or the cgroup is not mounted. Shares discarded.")
+		logrus.Warn("Your kernel does not support CPU shares or the cgroup is not mounted. Shares discarded.")
 		resources.CPUShares = 0
 	}
 	if resources.CPUPeriod > 0 && !sysInfo.CPUCfsPeriod {
 		warnings = append(warnings, "Your kernel does not support CPU cfs period or the cgroup is not mounted. Period discarded.")
+		logrus.Warn("Your kernel does not support CPU cfs period or the cgroup is not mounted. Period discarded.")
 		resources.CPUPeriod = 0
 	}
 	if resources.CPUPeriod != 0 && (resources.CPUPeriod < 1000 || resources.CPUPeriod > 1000000) {
@@ -492,6 +461,7 @@ func verifyPlatformContainerResources(resources *containertypes.Resources, sysIn
 	}
 	if resources.CPUQuota > 0 && !sysInfo.CPUCfsQuota {
 		warnings = append(warnings, "Your kernel does not support CPU cfs quota or the cgroup is not mounted. Quota discarded.")
+		logrus.Warn("Your kernel does not support CPU cfs quota or the cgroup is not mounted. Quota discarded.")
 		resources.CPUQuota = 0
 	}
 	if resources.CPUQuota > 0 && resources.CPUQuota < 1000 {
@@ -499,12 +469,14 @@ func verifyPlatformContainerResources(resources *containertypes.Resources, sysIn
 	}
 	if resources.CPUPercent > 0 {
 		warnings = append(warnings, fmt.Sprintf("%s does not support CPU percent. Percent discarded.", runtime.GOOS))
+		logrus.Warnf("%s does not support CPU percent. Percent discarded.", runtime.GOOS)
 		resources.CPUPercent = 0
 	}
 
 	// cpuset subsystem checks and adjustments
 	if (resources.CpusetCpus != "" || resources.CpusetMems != "") && !sysInfo.Cpuset {
 		warnings = append(warnings, "Your kernel does not support cpuset or the cgroup is not mounted. Cpuset discarded.")
+		logrus.Warn("Your kernel does not support cpuset or the cgroup is not mounted. Cpuset discarded.")
 		resources.CpusetCpus = ""
 		resources.CpusetMems = ""
 	}
@@ -526,6 +498,7 @@ func verifyPlatformContainerResources(resources *containertypes.Resources, sysIn
 	// blkio subsystem checks and adjustments
 	if resources.BlkioWeight > 0 && !sysInfo.BlkioWeight {
 		warnings = append(warnings, "Your kernel does not support Block I/O weight or the cgroup is not mounted. Weight discarded.")
+		logrus.Warn("Your kernel does not support Block I/O weight or the cgroup is not mounted. Weight discarded.")
 		resources.BlkioWeight = 0
 	}
 	if resources.BlkioWeight > 0 && (resources.BlkioWeight < 10 || resources.BlkioWeight > 1000) {
@@ -536,23 +509,28 @@ func verifyPlatformContainerResources(resources *containertypes.Resources, sysIn
 	}
 	if len(resources.BlkioWeightDevice) > 0 && !sysInfo.BlkioWeightDevice {
 		warnings = append(warnings, "Your kernel does not support Block I/O weight_device or the cgroup is not mounted. Weight-device discarded.")
+		logrus.Warn("Your kernel does not support Block I/O weight_device or the cgroup is not mounted. Weight-device discarded.")
 		resources.BlkioWeightDevice = []*pblkiodev.WeightDevice{}
 	}
 	if len(resources.BlkioDeviceReadBps) > 0 && !sysInfo.BlkioReadBpsDevice {
 		warnings = append(warnings, "Your kernel does not support BPS Block I/O read limit or the cgroup is not mounted. Block I/O BPS read limit discarded.")
+		logrus.Warn("Your kernel does not support BPS Block I/O read limit or the cgroup is not mounted. Block I/O BPS read limit discarded")
 		resources.BlkioDeviceReadBps = []*pblkiodev.ThrottleDevice{}
 	}
 	if len(resources.BlkioDeviceWriteBps) > 0 && !sysInfo.BlkioWriteBpsDevice {
 		warnings = append(warnings, "Your kernel does not support BPS Block I/O write limit or the cgroup is not mounted. Block I/O BPS write limit discarded.")
+		logrus.Warn("Your kernel does not support BPS Block I/O write limit or the cgroup is not mounted. Block I/O BPS write limit discarded.")
 		resources.BlkioDeviceWriteBps = []*pblkiodev.ThrottleDevice{}
 
 	}
 	if len(resources.BlkioDeviceReadIOps) > 0 && !sysInfo.BlkioReadIOpsDevice {
 		warnings = append(warnings, "Your kernel does not support IOPS Block read limit or the cgroup is not mounted. Block I/O IOPS read limit discarded.")
+		logrus.Warn("Your kernel does not support IOPS Block I/O read limit in IO or the cgroup is not mounted. Block I/O IOPS read limit discarded.")
 		resources.BlkioDeviceReadIOps = []*pblkiodev.ThrottleDevice{}
 	}
 	if len(resources.BlkioDeviceWriteIOps) > 0 && !sysInfo.BlkioWriteIOpsDevice {
 		warnings = append(warnings, "Your kernel does not support IOPS Block write limit or the cgroup is not mounted. Block I/O IOPS write limit discarded.")
+		logrus.Warn("Your kernel does not support IOPS Block I/O write limit or the cgroup is not mounted. Block I/O IOPS write limit discarded.")
 		resources.BlkioDeviceWriteIOps = []*pblkiodev.ThrottleDevice{}
 	}
 
@@ -596,13 +574,11 @@ func UsingSystemd(config *config.Config) bool {
 
 // verifyPlatformContainerSettings performs platform-specific validation of the
 // hostconfig and config structures.
-func verifyPlatformContainerSettings(daemon *Daemon, hostConfig *containertypes.HostConfig, update bool) (warnings []string, err error) {
-	if hostConfig == nil {
-		return nil, nil
-	}
+func verifyPlatformContainerSettings(daemon *Daemon, hostConfig *containertypes.HostConfig, config *containertypes.Config, update bool) ([]string, error) {
+	var warnings []string
 	sysInfo := sysinfo.New(true)
 
-	w, err := verifyPlatformContainerResources(&hostConfig.Resources, sysInfo, update)
+	w, err := verifyContainerResources(&hostConfig.Resources, sysInfo, update)
 
 	// no matter err is nil or not, w could have data in itself.
 	warnings = append(warnings, w...)
@@ -622,11 +598,8 @@ func verifyPlatformContainerSettings(daemon *Daemon, hostConfig *containertypes.
 	// ip-forwarding does not affect container with '--net=host' (or '--net=none')
 	if sysInfo.IPv4ForwardingDisabled && !(hostConfig.NetworkMode.IsHost() || hostConfig.NetworkMode.IsNone()) {
 		warnings = append(warnings, "IPv4 forwarding is disabled. Networking will not work.")
+		logrus.Warn("IPv4 forwarding is disabled. Networking will not work")
 	}
-	if hostConfig.NetworkMode.IsHost() && len(hostConfig.PortBindings) > 0 {
-		warnings = append(warnings, "Published ports are discarded when using host network mode")
-	}
-
 	// check for various conflicting options with user namespaces
 	if daemon.configStore.RemappedRoot != "" && hostConfig.UsernsMode.IsPrivate() {
 		if hostConfig.Privileged {
diff --git a/vendor/github.com/docker/docker/daemon/daemon_unix_test.go b/vendor/github.com/docker/docker/daemon/daemon_unix_test.go
index c8575ad8d..36c603098 100644
--- a/vendor/github.com/docker/docker/daemon/daemon_unix_test.go
+++ b/vendor/github.com/docker/docker/daemon/daemon_unix_test.go
@@ -11,9 +11,6 @@ import (
 	containertypes "github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/container"
 	"github.com/docker/docker/daemon/config"
-	"github.com/docker/docker/pkg/sysinfo"
-	"gotest.tools/assert"
-	is "gotest.tools/assert/cmp"
 )
 
 type fakeContainerGetter struct {
@@ -269,110 +266,3 @@ func TestNetworkOptions(t *testing.T) {
 		t.Fatal("Expected networkOptions error, got nil")
 	}
 }
-
-func TestVerifyPlatformContainerResources(t *testing.T) {
-	t.Parallel()
-	var (
-		no  = false
-		yes = true
-	)
-
-	withMemoryLimit := func(si *sysinfo.SysInfo) {
-		si.MemoryLimit = true
-	}
-	withSwapLimit := func(si *sysinfo.SysInfo) {
-		si.SwapLimit = true
-	}
-	withOomKillDisable := func(si *sysinfo.SysInfo) {
-		si.OomKillDisable = true
-	}
-
-	tests := []struct {
-		name             string
-		resources        containertypes.Resources
-		sysInfo          sysinfo.SysInfo
-		update           bool
-		expectedWarnings []string
-	}{
-		{
-			name:             "no-oom-kill-disable",
-			resources:        containertypes.Resources{},
-			sysInfo:          sysInfo(t, withMemoryLimit),
-			expectedWarnings: []string{},
-		},
-		{
-			name: "oom-kill-disable-disabled",
-			resources: containertypes.Resources{
-				OomKillDisable: &no,
-			},
-			sysInfo:          sysInfo(t, withMemoryLimit),
-			expectedWarnings: []string{},
-		},
-		{
-			name: "oom-kill-disable-not-supported",
-			resources: containertypes.Resources{
-				OomKillDisable: &yes,
-			},
-			sysInfo: sysInfo(t, withMemoryLimit),
-			expectedWarnings: []string{
-				"Your kernel does not support OomKillDisable. OomKillDisable discarded.",
-			},
-		},
-		{
-			name: "oom-kill-disable-without-memory-constraints",
-			resources: containertypes.Resources{
-				OomKillDisable: &yes,
-				Memory:         0,
-			},
-			sysInfo: sysInfo(t, withMemoryLimit, withOomKillDisable, withSwapLimit),
-			expectedWarnings: []string{
-				"OOM killer is disabled for the container, but no memory limit is set, this can result in the system running out of resources.",
-			},
-		},
-		{
-			name: "oom-kill-disable-with-memory-constraints-but-no-memory-limit-support",
-			resources: containertypes.Resources{
-				OomKillDisable: &yes,
-				Memory:         linuxMinMemory,
-			},
-			sysInfo: sysInfo(t, withOomKillDisable),
-			expectedWarnings: []string{
-				"Your kernel does not support memory limit capabilities or the cgroup is not mounted. Limitation discarded.",
-				"OOM killer is disabled for the container, but no memory limit is set, this can result in the system running out of resources.",
-			},
-		},
-		{
-			name: "oom-kill-disable-with-memory-constraints",
-			resources: containertypes.Resources{
-				OomKillDisable: &yes,
-				Memory:         linuxMinMemory,
-			},
-			sysInfo:          sysInfo(t, withMemoryLimit, withOomKillDisable, withSwapLimit),
-			expectedWarnings: []string{},
-		},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-			warnings, err := verifyPlatformContainerResources(&tc.resources, &tc.sysInfo, tc.update)
-			assert.NilError(t, err)
-			for _, w := range tc.expectedWarnings {
-				assert.Assert(t, is.Contains(warnings, w))
-			}
-		})
-	}
-}
-
-func sysInfo(t *testing.T, opts ...func(*sysinfo.SysInfo)) sysinfo.SysInfo {
-	t.Helper()
-	si := sysinfo.SysInfo{}
-
-	for _, opt := range opts {
-		opt(&si)
-	}
-
-	if si.OomKillDisable {
-		t.Log(t.Name(), "OOM disable supported")
-	}
-	return si
-}
diff --git a/vendor/github.com/docker/docker/daemon/daemon_windows.go b/vendor/github.com/docker/docker/daemon/daemon_windows.go
index a160fb7fb..e534d7ecc 100644
--- a/vendor/github.com/docker/docker/daemon/daemon_windows.go
+++ b/vendor/github.com/docker/docker/daemon/daemon_windows.go
@@ -40,11 +40,6 @@ const (
 	windowsMaxCPUPercent = 100
 )
 
-// Windows doesn't really have rlimits.
-func adjustParallelLimit(n int, limit int) int {
-	return limit
-}
-
 // Windows has no concept of an execution state directory. So use config.Root here.
 func getPluginExecRoot(root string) string {
 	return filepath.Join(root, "plugins")
@@ -80,8 +75,8 @@ func (daemon *Daemon) adaptContainerSettings(hostConfig *containertypes.HostConf
 	return nil
 }
 
-// verifyPlatformContainerResources performs platform-specific validation of the container's resource-configuration
-func verifyPlatformContainerResources(resources *containertypes.Resources, isHyperv bool) (warnings []string, err error) {
+func verifyContainerResources(resources *containertypes.Resources, isHyperv bool) ([]string, error) {
+	warnings := []string{}
 	fixMemorySwappiness(resources)
 	if !isHyperv {
 		// The processor resource controls are mutually exclusive on
@@ -90,15 +85,18 @@ func verifyPlatformContainerResources(resources *containertypes.Resources, isHyp
 		if resources.CPUCount > 0 {
 			if resources.CPUShares > 0 {
 				warnings = append(warnings, "Conflicting options: CPU count takes priority over CPU shares on Windows Server Containers. CPU shares discarded")
+				logrus.Warn("Conflicting options: CPU count takes priority over CPU shares on Windows Server Containers. CPU shares discarded")
 				resources.CPUShares = 0
 			}
 			if resources.CPUPercent > 0 {
 				warnings = append(warnings, "Conflicting options: CPU count takes priority over CPU percent on Windows Server Containers. CPU percent discarded")
+				logrus.Warn("Conflicting options: CPU count takes priority over CPU percent on Windows Server Containers. CPU percent discarded")
 				resources.CPUPercent = 0
 			}
 		} else if resources.CPUShares > 0 {
 			if resources.CPUPercent > 0 {
 				warnings = append(warnings, "Conflicting options: CPU shares takes priority over CPU percent on Windows Server Containers. CPU percent discarded")
+				logrus.Warn("Conflicting options: CPU shares takes priority over CPU percent on Windows Server Containers. CPU percent discarded")
 				resources.CPUPercent = 0
 			}
 		}
@@ -133,6 +131,7 @@ func verifyPlatformContainerResources(resources *containertypes.Resources, isHyp
 			resources.NanoCPUs = ((resources.NanoCPUs + 1e9/2) / 1e9) * 1e9
 			warningString := fmt.Sprintf("Your current OS version does not support Hyper-V containers with NanoCPUs greater than 1000000000 but not divisible by 1000000000. NanoCPUs rounded to %d", resources.NanoCPUs)
 			warnings = append(warnings, warningString)
+			logrus.Warn(warningString)
 		}
 	}
 
@@ -192,10 +191,8 @@ func verifyPlatformContainerResources(resources *containertypes.Resources, isHyp
 
 // verifyPlatformContainerSettings performs platform-specific validation of the
 // hostconfig and config structures.
-func verifyPlatformContainerSettings(daemon *Daemon, hostConfig *containertypes.HostConfig, update bool) (warnings []string, err error) {
-	if hostConfig == nil {
-		return nil, nil
-	}
+func verifyPlatformContainerSettings(daemon *Daemon, hostConfig *containertypes.HostConfig, config *containertypes.Config, update bool) ([]string, error) {
+	warnings := []string{}
 	osv := system.GetOSVersion()
 	hyperv := daemon.runAsHyperVContainer(hostConfig)
 
@@ -207,7 +204,7 @@ func verifyPlatformContainerSettings(daemon *Daemon, hostConfig *containertypes.
 		return warnings, fmt.Errorf("Windows client operating systems earlier than version 1809 can only run Hyper-V containers")
 	}
 
-	w, err := verifyPlatformContainerResources(&hostConfig.Resources, hyperv)
+	w, err := verifyContainerResources(&hostConfig.Resources, hyperv)
 	warnings = append(warnings, w...)
 	return warnings, err
 }
diff --git a/vendor/github.com/docker/docker/daemon/errors.go b/vendor/github.com/docker/docker/daemon/errors.go
index ed60ce769..6d02af3d5 100644
--- a/vendor/github.com/docker/docker/daemon/errors.go
+++ b/vendor/github.com/docker/docker/daemon/errors.go
@@ -7,7 +7,7 @@ import (
 
 	"github.com/docker/docker/errdefs"
 	"github.com/pkg/errors"
-	"google.golang.org/grpc/status"
+	"google.golang.org/grpc"
 )
 
 func errNotRunning(id string) error {
@@ -122,7 +122,7 @@ func (e startInvalidConfigError) Error() string {
 func (e startInvalidConfigError) InvalidParameter() {} // Is this right???
 
 func translateContainerdStartErr(cmd string, setExitCode func(int), err error) error {
-	errDesc := status.Convert(err).Message()
+	errDesc := grpc.ErrorDesc(err)
 	contains := func(s1, s2 string) bool {
 		return strings.Contains(strings.ToLower(s1), s2)
 	}
diff --git a/vendor/github.com/docker/docker/daemon/exec_linux.go b/vendor/github.com/docker/docker/daemon/exec_linux.go
index 2c4f96a5c..cd52f4886 100644
--- a/vendor/github.com/docker/docker/daemon/exec_linux.go
+++ b/vendor/github.com/docker/docker/daemon/exec_linux.go
@@ -2,8 +2,8 @@ package daemon // import "github.com/docker/docker/daemon"
 
 import (
 	"github.com/docker/docker/container"
+	"github.com/docker/docker/daemon/caps"
 	"github.com/docker/docker/daemon/exec"
-	"github.com/docker/docker/oci/caps"
 	"github.com/opencontainers/runc/libcontainer/apparmor"
 	"github.com/opencontainers/runtime-spec/specs-go"
 )
diff --git a/vendor/github.com/docker/docker/daemon/graphdriver/aufs/aufs.go b/vendor/github.com/docker/docker/daemon/graphdriver/aufs/aufs.go
index 11ca93990..114aa9a61 100644
--- a/vendor/github.com/docker/docker/daemon/graphdriver/aufs/aufs.go
+++ b/vendor/github.com/docker/docker/daemon/graphdriver/aufs/aufs.go
@@ -43,7 +43,7 @@ import (
 	"github.com/docker/docker/pkg/directory"
 	"github.com/docker/docker/pkg/idtools"
 	"github.com/docker/docker/pkg/locker"
-	"github.com/docker/docker/pkg/mount"
+	mountpk "github.com/docker/docker/pkg/mount"
 	"github.com/docker/docker/pkg/system"
 	rsystem "github.com/opencontainers/runc/libcontainer/system"
 	"github.com/opencontainers/selinux/go-selinux/label"
@@ -598,7 +598,7 @@ func (a *Driver) Cleanup() error {
 			logger.Debugf("error unmounting %s: %s", m, err)
 		}
 	}
-	return mount.RecursiveUnmount(a.root)
+	return mountpk.RecursiveUnmount(a.root)
 }
 
 func (a *Driver) aufsMount(ro []string, rw, target, mountLabel string) (err error) {
@@ -632,14 +632,14 @@ func (a *Driver) aufsMount(ro []string, rw, target, mountLabel string) (err erro
 		opts += ",dirperm1"
 	}
 	data := label.FormatMountLabel(fmt.Sprintf("%s,%s", string(b[:bp]), opts), mountLabel)
-	if err = unix.Mount("none", target, "aufs", 0, data); err != nil {
+	if err = mount("none", target, "aufs", 0, data); err != nil {
 		return
 	}
 
 	for ; index < len(ro); index++ {
 		layer := fmt.Sprintf(":%s=ro+wh", ro[index])
 		data := label.FormatMountLabel(fmt.Sprintf("append%s", layer), mountLabel)
-		if err = unix.Mount("none", target, "aufs", unix.MS_REMOUNT, data); err != nil {
+		if err = mount("none", target, "aufs", unix.MS_REMOUNT, data); err != nil {
 			return
 		}
 	}
@@ -666,7 +666,7 @@ func useDirperm() bool {
 		defer os.RemoveAll(union)
 
 		opts := fmt.Sprintf("br:%s,dirperm1,xino=/dev/shm/aufs.xino", base)
-		if err := unix.Mount("none", union, "aufs", 0, opts); err != nil {
+		if err := mount("none", union, "aufs", 0, opts); err != nil {
 			return
 		}
 		enableDirperm = true
diff --git a/vendor/github.com/docker/docker/daemon/graphdriver/aufs/mount_linux.go b/vendor/github.com/docker/docker/daemon/graphdriver/aufs/mount_linux.go
new file mode 100644
index 000000000..8d5ad8f32
--- /dev/null
+++ b/vendor/github.com/docker/docker/daemon/graphdriver/aufs/mount_linux.go
@@ -0,0 +1,7 @@
+package aufs // import "github.com/docker/docker/daemon/graphdriver/aufs"
+
+import "golang.org/x/sys/unix"
+
+func mount(source string, target string, fstype string, flags uintptr, data string) error {
+	return unix.Mount(source, target, fstype, flags, data)
+}
diff --git a/vendor/github.com/docker/docker/daemon/graphdriver/aufs/mount_unsupported.go b/vendor/github.com/docker/docker/daemon/graphdriver/aufs/mount_unsupported.go
new file mode 100644
index 000000000..cf7f58c29
--- /dev/null
+++ b/vendor/github.com/docker/docker/daemon/graphdriver/aufs/mount_unsupported.go
@@ -0,0 +1,12 @@
+// +build !linux
+
+package aufs // import "github.com/docker/docker/daemon/graphdriver/aufs"
+
+import "errors"
+
+// MsRemount declared to specify a non-linux system mount.
+const MsRemount = 0
+
+func mount(source string, target string, fstype string, flags uintptr, data string) (err error) {
+	return errors.New("mount is not implemented on this platform")
+}
diff --git a/vendor/github.com/docker/docker/daemon/graphdriver/btrfs/btrfs.go b/vendor/github.com/docker/docker/daemon/graphdriver/btrfs/btrfs.go
index fcaedc6ea..7ce7edef3 100644
--- a/vendor/github.com/docker/docker/daemon/graphdriver/btrfs/btrfs.go
+++ b/vendor/github.com/docker/docker/daemon/graphdriver/btrfs/btrfs.go
@@ -178,7 +178,7 @@ func (d *Driver) Cleanup() error {
 	}
 
 	if umountErr != nil {
-		return umountErr
+		return errors.Wrapf(umountErr, "error unmounting %s", d.home)
 	}
 
 	return nil
diff --git a/vendor/github.com/docker/docker/daemon/graphdriver/devmapper/deviceset.go b/vendor/github.com/docker/docker/daemon/graphdriver/devmapper/deviceset.go
index c41b50c11..5dc01d71d 100644
--- a/vendor/github.com/docker/docker/daemon/graphdriver/devmapper/deviceset.go
+++ b/vendor/github.com/docker/docker/daemon/graphdriver/devmapper/deviceset.go
@@ -1200,7 +1200,7 @@ func (devices *DeviceSet) growFS(info *devInfo) error {
 	options = joinMountOptions(options, devices.mountOptions)
 
 	if err := mount.Mount(info.DevName(), fsMountPoint, devices.BaseDeviceFilesystem, options); err != nil {
-		return errors.Wrapf(err, "Failed to mount; dmesg: %s", string(dmesg.Dmesg(256)))
+		return fmt.Errorf("Error mounting '%s' on '%s' (fstype='%s' options='%s'): %s\n%v", info.DevName(), fsMountPoint, devices.BaseDeviceFilesystem, options, err, string(dmesg.Dmesg(256)))
 	}
 
 	defer unix.Unmount(fsMountPoint, unix.MNT_DETACH)
@@ -2381,7 +2381,7 @@ func (devices *DeviceSet) MountDevice(hash, path, mountLabel string) error {
 	options = joinMountOptions(options, label.FormatMountLabel("", mountLabel))
 
 	if err := mount.Mount(info.DevName(), path, fstype, options); err != nil {
-		return errors.Wrapf(err, "Failed to mount; dmesg: %s", string(dmesg.Dmesg(256)))
+		return fmt.Errorf("devmapper: Error mounting '%s' on '%s' (fstype='%s' options='%s'): %s\n%v", info.DevName(), path, fstype, options, err, string(dmesg.Dmesg(256)))
 	}
 
 	if fstype == "xfs" && devices.xfsNospaceRetries != "" {
diff --git a/vendor/github.com/docker/docker/daemon/graphdriver/devmapper/driver.go b/vendor/github.com/docker/docker/daemon/graphdriver/devmapper/driver.go
index a42a03ba9..899b1f867 100644
--- a/vendor/github.com/docker/docker/daemon/graphdriver/devmapper/driver.go
+++ b/vendor/github.com/docker/docker/daemon/graphdriver/devmapper/driver.go
@@ -16,6 +16,7 @@ import (
 	"github.com/docker/docker/pkg/locker"
 	"github.com/docker/docker/pkg/mount"
 	"github.com/docker/go-units"
+	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"golang.org/x/sys/unix"
 )
@@ -128,7 +129,11 @@ func (d *Driver) Cleanup() error {
 		return err
 	}
 
-	return umountErr
+	if umountErr != nil {
+		return errors.Wrapf(umountErr, "error unmounting %s", d.home)
+	}
+
+	return nil
 }
 
 // CreateReadWrite creates a layer that is writable for use as a container
diff --git a/vendor/github.com/docker/docker/daemon/graphdriver/driver.go b/vendor/github.com/docker/docker/daemon/graphdriver/driver.go
index 44434f7dc..2db61aac4 100644
--- a/vendor/github.com/docker/docker/daemon/graphdriver/driver.go
+++ b/vendor/github.com/docker/docker/daemon/graphdriver/driver.go
@@ -253,11 +253,6 @@ func New(name string, pg plugingetter.PluginGetter, config Options) (Driver, err
 
 	// Check all registered drivers if no priority driver is found
 	for name, initFunc := range drivers {
-		if isDeprecated(name) {
-			// Deprecated storage-drivers are skipped in automatic selection, but
-			// can be selected through configuration.
-			continue
-		}
 		driver, err := initFunc(filepath.Join(config.Root, name), config.DriverOptions, config.UIDMaps, config.GIDMaps)
 		if err != nil {
 			if IsDriverNotSupported(err) {
@@ -319,7 +314,7 @@ func isEmptyDir(name string) bool {
 func isDeprecated(name string) bool {
 	switch name {
 	// NOTE: when deprecating a driver, update daemon.fillDriverInfo() accordingly
-	case "aufs", "devicemapper", "overlay":
+	case "devicemapper", "overlay":
 		return true
 	}
 	return false
diff --git a/vendor/github.com/docker/docker/daemon/graphdriver/fsdiff.go b/vendor/github.com/docker/docker/daemon/graphdriver/fsdiff.go
index f06caedb9..e1f368508 100644
--- a/vendor/github.com/docker/docker/daemon/graphdriver/fsdiff.go
+++ b/vendor/github.com/docker/docker/daemon/graphdriver/fsdiff.go
@@ -145,11 +145,11 @@ func (gdw *NaiveDiffDriver) ApplyDiff(id, parent string, diff io.Reader) (size i
 	options := &archive.TarOptions{UIDMaps: gdw.uidMaps,
 		GIDMaps: gdw.gidMaps}
 	start := time.Now().UTC()
-	logrus.WithField("id", id).Debug("Start untar layer")
+	logrus.Debug("Start untar layer")
 	if size, err = ApplyUncompressedLayer(layerFs, diff, options); err != nil {
 		return
 	}
-	logrus.WithField("id", id).Debugf("Untar time: %vs", time.Now().UTC().Sub(start).Seconds())
+	logrus.Debugf("Untar time: %vs", time.Now().UTC().Sub(start).Seconds())
 
 	return
 }
diff --git a/vendor/github.com/docker/docker/daemon/graphdriver/lcow/lcow.go b/vendor/github.com/docker/docker/daemon/graphdriver/lcow/lcow.go
index 321d3a36f..7004a72c1 100644
--- a/vendor/github.com/docker/docker/daemon/graphdriver/lcow/lcow.go
+++ b/vendor/github.com/docker/docker/daemon/graphdriver/lcow/lcow.go
@@ -249,7 +249,7 @@ func (d *Driver) startServiceVMIfNotRunning(id string, mvdToAdd []hcsshim.Mapped
 	logrus.Debugf("%s: adding entry to service vm map", title)
 	svm, exists, err := d.serviceVms.add(id)
 	if err != nil && err == errVMisTerminating {
-		// VM is in the process of terminating. Wait until it's done and then try again
+		// VM is in the process of terminating. Wait until it's done and and then try again
 		logrus.Debugf("%s: VM with current ID still in the process of terminating", title)
 		if err := svm.getStopError(); err != nil {
 			logrus.Debugf("%s: VM did not stop successfully: %s", title, err)
@@ -686,7 +686,7 @@ func (d *Driver) Get(id, mountLabel string) (containerfs.ContainerFS, error) {
 	title := fmt.Sprintf("lcowdriver: get: %s", id)
 	logrus.Debugf(title)
 
-	// Generate the mounts needed for the deferred operation.
+	// Generate the mounts needed for the defered operation.
 	disks, err := d.getAllMounts(id)
 	if err != nil {
 		logrus.Debugf("%s failed to get all layer details for %s: %s", title, d.dir(id), err)
@@ -764,7 +764,7 @@ func (d *Driver) Cleanup() error {
 
 	// Note we don't return an error below - it's possible the files
 	// are locked. However, next time around after the daemon exits,
-	// we likely will be able to cleanup successfully. Instead we log
+	// we likely will be able to to cleanup successfully. Instead we log
 	// warnings if there are errors.
 	for _, item := range items {
 		if item.IsDir() && strings.HasSuffix(item.Name(), "-removing") {
diff --git a/vendor/github.com/docker/docker/daemon/graphdriver/lcow/lcow_svm.go b/vendor/github.com/docker/docker/daemon/graphdriver/lcow/lcow_svm.go
index a70e1b248..fdb0553de 100644
--- a/vendor/github.com/docker/docker/daemon/graphdriver/lcow/lcow_svm.go
+++ b/vendor/github.com/docker/docker/daemon/graphdriver/lcow/lcow_svm.go
@@ -4,6 +4,7 @@ package lcow // import "github.com/docker/docker/daemon/graphdriver/lcow"
 
 import (
 	"bytes"
+	"errors"
 	"fmt"
 	"io"
 	"strings"
@@ -12,7 +13,6 @@ import (
 
 	"github.com/Microsoft/hcsshim"
 	"github.com/Microsoft/opengcs/client"
-	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 )
 
@@ -323,9 +323,8 @@ func (svm *serviceVM) createUnionMount(mountName string, mvds ...hcsshim.MappedV
 	}
 
 	logrus.Debugf("Doing the overlay mount with union directory=%s", mountName)
-	errOut := &bytes.Buffer{}
-	if err = svm.runProcess(fmt.Sprintf("mkdir -p %s", mountName), nil, nil, errOut); err != nil {
-		return errors.Wrapf(err, "mkdir -p %s failed (%s)", mountName, errOut.String())
+	if err = svm.runProcess(fmt.Sprintf("mkdir -p %s", mountName), nil, nil, nil); err != nil {
+		return err
 	}
 
 	var cmd string
@@ -341,9 +340,8 @@ func (svm *serviceVM) createUnionMount(mountName string, mvds ...hcsshim.MappedV
 		upper := fmt.Sprintf("%s/upper", svm.getShortContainerPath(&mvds[0]))
 		work := fmt.Sprintf("%s/work", svm.getShortContainerPath(&mvds[0]))
 
-		errOut := &bytes.Buffer{}
-		if err = svm.runProcess(fmt.Sprintf("mkdir -p %s %s", upper, work), nil, nil, errOut); err != nil {
-			return errors.Wrapf(err, "mkdir -p %s failed (%s)", mountName, errOut.String())
+		if err = svm.runProcess(fmt.Sprintf("mkdir -p %s %s", upper, work), nil, nil, nil); err != nil {
+			return err
 		}
 
 		cmd = fmt.Sprintf("mount -t overlay overlay -olowerdir=%s,upperdir=%s,workdir=%s %s",
@@ -354,9 +352,8 @@ func (svm *serviceVM) createUnionMount(mountName string, mvds ...hcsshim.MappedV
 	}
 
 	logrus.Debugf("createUnionMount: Executing mount=%s", cmd)
-	errOut = &bytes.Buffer{}
-	if err = svm.runProcess(cmd, nil, nil, errOut); err != nil {
-		return errors.Wrapf(err, "%s failed (%s)", cmd, errOut.String())
+	if err = svm.runProcess(cmd, nil, nil, nil); err != nil {
+		return err
 	}
 
 	svm.unionMounts[mountName] = 1
diff --git a/vendor/github.com/docker/docker/daemon/graphdriver/windows/windows.go b/vendor/github.com/docker/docker/daemon/graphdriver/windows/windows.go
index 347231b10..52b0c6d84 100644
--- a/vendor/github.com/docker/docker/daemon/graphdriver/windows/windows.go
+++ b/vendor/github.com/docker/docker/daemon/graphdriver/windows/windows.go
@@ -456,7 +456,7 @@ func (d *Driver) Cleanup() error {
 
 	// Note we don't return an error below - it's possible the files
 	// are locked. However, next time around after the daemon exits,
-	// we likely will be able to cleanup successfully. Instead we log
+	// we likely will be able to to cleanup successfully. Instead we log
 	// warnings if there are errors.
 	for _, item := range items {
 		if item.IsDir() && strings.HasSuffix(item.Name(), "-removing") {
diff --git a/vendor/github.com/docker/docker/daemon/graphdriver/zfs/zfs.go b/vendor/github.com/docker/docker/daemon/graphdriver/zfs/zfs.go
index c83446cf8..8a798778d 100644
--- a/vendor/github.com/docker/docker/daemon/graphdriver/zfs/zfs.go
+++ b/vendor/github.com/docker/docker/daemon/graphdriver/zfs/zfs.go
@@ -19,7 +19,6 @@ import (
 	"github.com/docker/docker/pkg/parsers"
 	"github.com/mistifyio/go-zfs"
 	"github.com/opencontainers/selinux/go-selinux/label"
-	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"golang.org/x/sys/unix"
 )
@@ -391,7 +390,7 @@ func (d *Driver) Get(id, mountLabel string) (_ containerfs.ContainerFS, retErr e
 	}
 
 	if err := mount.Mount(filesystem, mountpoint, "zfs", options); err != nil {
-		return nil, errors.Wrap(err, "error creating zfs mount")
+		return nil, fmt.Errorf("error creating zfs mount of %s to %s: %v", filesystem, mountpoint, err)
 	}
 
 	// this could be our first mount after creation of the filesystem, and the root dir may still have root
diff --git a/vendor/github.com/docker/docker/daemon/images/images.go b/vendor/github.com/docker/docker/daemon/images/images.go
index d17a2e245..49212341c 100644
--- a/vendor/github.com/docker/docker/daemon/images/images.go
+++ b/vendor/github.com/docker/docker/daemon/images/images.go
@@ -152,9 +152,6 @@ func (i *ImageService) Images(imageFilters filters.Args, all bool, withExtraAttr
 					if matchErr != nil {
 						return nil, matchErr
 					}
-					if found {
-						break
-					}
 				}
 				if !found {
 					continue
@@ -190,15 +187,7 @@ func (i *ImageService) Images(imageFilters filters.Args, all bool, withExtraAttr
 			// lazily init variables
 			if imagesMap == nil {
 				allContainers = i.containers.List()
-
-				// allLayers is built from all layerstores combined
-				allLayers = make(map[layer.ChainID]layer.Layer)
-				for _, ls := range i.layerStores {
-					layers := ls.Map()
-					for k, v := range layers {
-						allLayers[k] = v
-					}
-				}
+				allLayers = i.layerStores[img.OperatingSystem()].Map()
 				imagesMap = make(map[*image.Image]*types.ImageSummary)
 				layerRefs = make(map[layer.ChainID]int)
 			}
diff --git a/vendor/github.com/docker/docker/daemon/info.go b/vendor/github.com/docker/docker/daemon/info.go
index 5332ce103..603474ab9 100644
--- a/vendor/github.com/docker/docker/daemon/info.go
+++ b/vendor/github.com/docker/docker/daemon/info.go
@@ -132,7 +132,7 @@ func (daemon *Daemon) fillDriverInfo(v *types.Info) {
 			drivers += fmt.Sprintf(" (%s) ", os)
 		}
 		switch gd {
-		case "aufs", "devicemapper", "overlay":
+		case "devicemapper", "overlay":
 			v.Warnings = append(v.Warnings, fmt.Sprintf("WARNING: the %s storage-driver is deprecated, and will be removed in a future release.", gd))
 		}
 	}
diff --git a/vendor/github.com/docker/docker/daemon/info_unix.go b/vendor/github.com/docker/docker/daemon/info_unix.go
index 6efdc1695..55b6c6e79 100644
--- a/vendor/github.com/docker/docker/daemon/info_unix.go
+++ b/vendor/github.com/docker/docker/daemon/info_unix.go
@@ -20,7 +20,6 @@ func (daemon *Daemon) fillPlatformInfo(v *types.Info, sysInfo *sysinfo.SysInfo)
 	v.MemoryLimit = sysInfo.MemoryLimit
 	v.SwapLimit = sysInfo.SwapLimit
 	v.KernelMemory = sysInfo.KernelMemory
-	v.KernelMemoryTCP = sysInfo.KernelMemoryTCP
 	v.OomKillDisable = sysInfo.OomKillDisable
 	v.CPUCfsPeriod = sysInfo.CPUCfsPeriod
 	v.CPUCfsQuota = sysInfo.CPUCfsQuota
@@ -86,9 +85,6 @@ func (daemon *Daemon) fillPlatformInfo(v *types.Info, sysInfo *sysinfo.SysInfo)
 	if !v.KernelMemory {
 		v.Warnings = append(v.Warnings, "WARNING: No kernel memory limit support")
 	}
-	if !v.KernelMemoryTCP {
-		v.Warnings = append(v.Warnings, "WARNING: No kernel memory TCP limit support")
-	}
 	if !v.OomKillDisable {
 		v.Warnings = append(v.Warnings, "WARNING: No oom kill disable support")
 	}
@@ -116,6 +112,9 @@ func (daemon *Daemon) fillPlatformInfo(v *types.Info, sysInfo *sysinfo.SysInfo)
 }
 
 func fillDriverWarnings(v *types.Info) {
+	if v.DriverStatus == nil {
+		return
+	}
 	for _, pair := range v.DriverStatus {
 		if pair[0] == "Data loop file" {
 			msg := fmt.Sprintf("WARNING: %s: usage of loopback devices is "+
@@ -141,6 +140,9 @@ func fillDriverWarnings(v *types.Info) {
 }
 
 func getBackingFs(v *types.Info) string {
+	if v.DriverStatus == nil {
+		return ""
+	}
 	for _, pair := range v.DriverStatus {
 		if pair[0] == "Backing Filesystem" {
 			return pair[1]
diff --git a/vendor/github.com/docker/docker/daemon/licensing_test.go b/vendor/github.com/docker/docker/daemon/licensing_test.go
index 5e0a5affb..5a97ce8fa 100644
--- a/vendor/github.com/docker/docker/daemon/licensing_test.go
+++ b/vendor/github.com/docker/docker/daemon/licensing_test.go
@@ -8,7 +8,7 @@ import (
 	"gotest.tools/assert"
 )
 
-func TestFillLicense(t *testing.T) {
+func TestfillLicense(t *testing.T) {
 	v := &types.Info{}
 	d := &Daemon{
 		root: "/var/lib/docker/",
diff --git a/vendor/github.com/docker/docker/daemon/links/links.go b/vendor/github.com/docker/docker/daemon/links/links.go
index be153f6bb..2bcb48325 100644
--- a/vendor/github.com/docker/docker/daemon/links/links.go
+++ b/vendor/github.com/docker/docker/daemon/links/links.go
@@ -8,7 +8,7 @@ import (
 	"github.com/docker/go-connections/nat"
 )
 
-// Link struct holds information about parent/child linked container
+// Link struct holds informations about parent/child linked container
 type Link struct {
 	// Parent container IP address
 	ParentIP string
@@ -43,7 +43,7 @@ func NewLink(parentIP, childIP, name string, env []string, exposedPorts map[nat.
 	}
 }
 
-// ToEnv creates a string's slice containing child container information in
+// ToEnv creates a string's slice containing child container informations in
 // the form of environment variables which will be later exported on container
 // startup.
 func (l *Link) ToEnv() []string {
diff --git a/vendor/github.com/docker/docker/daemon/list.go b/vendor/github.com/docker/docker/daemon/list.go
index 69fb69a90..0a0cf221f 100644
--- a/vendor/github.com/docker/docker/daemon/list.go
+++ b/vendor/github.com/docker/docker/daemon/list.go
@@ -77,12 +77,12 @@ type listContext struct {
 
 	// beforeFilter is a filter to ignore containers that appear before the one given
 	beforeFilter *container.Snapshot
-	// sinceFilter is a filter to stop the filtering when the iterator arrives to the given container
+	// sinceFilter is a filter to stop the filtering when the iterator arrive to the given container
 	sinceFilter *container.Snapshot
 
-	// taskFilter tells if we should filter based on whether a container is part of a task
+	// taskFilter tells if we should filter based on wether a container is part of a task
 	taskFilter bool
-	// isTask tells us if we should filter container that is a task (true) or not (false)
+	// isTask tells us if the we should filter container that are a task (true) or not (false)
 	isTask bool
 
 	// publish is a list of published ports to filter with
diff --git a/vendor/github.com/docker/docker/daemon/listeners/group_unix.go b/vendor/github.com/docker/docker/daemon/listeners/group_unix.go
index 68c079198..9cc17eba7 100644
--- a/vendor/github.com/docker/docker/daemon/listeners/group_unix.go
+++ b/vendor/github.com/docker/docker/daemon/listeners/group_unix.go
@@ -6,15 +6,25 @@ import (
 	"fmt"
 	"strconv"
 
-	"github.com/docker/docker/pkg/idtools"
+	"github.com/opencontainers/runc/libcontainer/user"
+	"github.com/pkg/errors"
 )
 
 const defaultSocketGroup = "docker"
 
 func lookupGID(name string) (int, error) {
-	group, err := idtools.LookupGroup(name)
-	if err == nil {
-		return group.Gid, nil
+	groupFile, err := user.GetGroupPath()
+	if err != nil {
+		return -1, errors.Wrap(err, "error looking up groups")
+	}
+	groups, err := user.ParseGroupFileFilter(groupFile, func(g user.Group) bool {
+		return g.Name == name || strconv.Itoa(g.Gid) == name
+	})
+	if err != nil {
+		return -1, errors.Wrapf(err, "error parsing groups for %s", name)
+	}
+	if len(groups) > 0 {
+		return groups[0].Gid, nil
 	}
 	gid, err := strconv.Atoi(name)
 	if err == nil {
diff --git a/vendor/github.com/docker/docker/daemon/logdrivers_windows.go b/vendor/github.com/docker/docker/daemon/logdrivers_windows.go
index 425a4d89b..62e7a6f95 100644
--- a/vendor/github.com/docker/docker/daemon/logdrivers_windows.go
+++ b/vendor/github.com/docker/docker/daemon/logdrivers_windows.go
@@ -6,7 +6,6 @@ import (
 	_ "github.com/docker/docker/daemon/logger/awslogs"
 	_ "github.com/docker/docker/daemon/logger/etwlogs"
 	_ "github.com/docker/docker/daemon/logger/fluentd"
-	_ "github.com/docker/docker/daemon/logger/gcplogs"
 	_ "github.com/docker/docker/daemon/logger/gelf"
 	_ "github.com/docker/docker/daemon/logger/jsonfilelog"
 	_ "github.com/docker/docker/daemon/logger/logentries"
diff --git a/vendor/github.com/docker/docker/daemon/logger/awslogs/cloudwatchlogs.go b/vendor/github.com/docker/docker/daemon/logger/awslogs/cloudwatchlogs.go
index f9cf1a984..44e35e52b 100644
--- a/vendor/github.com/docker/docker/daemon/logger/awslogs/cloudwatchlogs.go
+++ b/vendor/github.com/docker/docker/daemon/logger/awslogs/cloudwatchlogs.go
@@ -39,11 +39,7 @@ const (
 	datetimeFormatKey      = "awslogs-datetime-format"
 	multilinePatternKey    = "awslogs-multiline-pattern"
 	credentialsEndpointKey = "awslogs-credentials-endpoint"
-	forceFlushIntervalKey  = "awslogs-force-flush-interval-seconds"
-	maxBufferedEventsKey   = "awslogs-max-buffered-events"
-
-	defaultForceFlushInterval = 5 * time.Second
-	defaultMaxBufferedEvents  = 4096
+	batchPublishFrequency  = 5 * time.Second
 
 	// See: http://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutLogEvents.html
 	perEventBytes          = 26
@@ -68,27 +64,16 @@ const (
 )
 
 type logStream struct {
-	logStreamName      string
-	logGroupName       string
-	logCreateGroup     bool
-	logNonBlocking     bool
-	forceFlushInterval time.Duration
-	multilinePattern   *regexp.Regexp
-	client             api
-	messages           chan *logger.Message
-	lock               sync.RWMutex
-	closed             bool
-	sequenceToken      *string
-}
-
-type logStreamConfig struct {
-	logStreamName      string
-	logGroupName       string
-	logCreateGroup     bool
-	logNonBlocking     bool
-	forceFlushInterval time.Duration
-	maxBufferedEvents  int
-	multilinePattern   *regexp.Regexp
+	logStreamName    string
+	logGroupName     string
+	logCreateGroup   bool
+	logNonBlocking   bool
+	multilinePattern *regexp.Regexp
+	client           api
+	messages         chan *logger.Message
+	lock             sync.RWMutex
+	closed           bool
+	sequenceToken    *string
 }
 
 var _ logger.SizedLogger = &logStream{}
@@ -138,28 +123,47 @@ type eventBatch struct {
 // AWS_REGION, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, the shared credentials
 // file (~/.aws/credentials), and the EC2 Instance Metadata Service.
 func New(info logger.Info) (logger.Logger, error) {
-	containerStreamConfig, err := newStreamConfig(info)
+	logGroupName := info.Config[logGroupKey]
+	logStreamName, err := loggerutils.ParseLogTag(info, "{{.FullID}}")
+	if err != nil {
+		return nil, err
+	}
+	logCreateGroup := false
+	if info.Config[logCreateGroupKey] != "" {
+		logCreateGroup, err = strconv.ParseBool(info.Config[logCreateGroupKey])
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	logNonBlocking := info.Config["mode"] == "non-blocking"
+
+	if info.Config[logStreamKey] != "" {
+		logStreamName = info.Config[logStreamKey]
+	}
+
+	multilinePattern, err := parseMultilineOptions(info)
 	if err != nil {
 		return nil, err
 	}
+
 	client, err := newAWSLogsClient(info)
 	if err != nil {
 		return nil, err
 	}
 
 	containerStream := &logStream{
-		logStreamName:      containerStreamConfig.logStreamName,
-		logGroupName:       containerStreamConfig.logGroupName,
-		logCreateGroup:     containerStreamConfig.logCreateGroup,
-		logNonBlocking:     containerStreamConfig.logNonBlocking,
-		forceFlushInterval: containerStreamConfig.forceFlushInterval,
-		multilinePattern:   containerStreamConfig.multilinePattern,
-		client:             client,
-		messages:           make(chan *logger.Message, containerStreamConfig.maxBufferedEvents),
+		logStreamName:    logStreamName,
+		logGroupName:     logGroupName,
+		logCreateGroup:   logCreateGroup,
+		logNonBlocking:   logNonBlocking,
+		multilinePattern: multilinePattern,
+		client:           client,
+		messages:         make(chan *logger.Message, 4096),
 	}
 
 	creationDone := make(chan bool)
-	if containerStream.logNonBlocking {
+	if logNonBlocking {
 		go func() {
 			backoff := 1
 			maxBackoff := 32
@@ -199,63 +203,6 @@ func New(info logger.Info) (logger.Logger, error) {
 	return containerStream, nil
 }
 
-// Parses most of the awslogs- options and prepares a config object to be used for newing the actual stream
-// It has been formed out to ease Utest of the New above
-func newStreamConfig(info logger.Info) (*logStreamConfig, error) {
-	logGroupName := info.Config[logGroupKey]
-	logStreamName, err := loggerutils.ParseLogTag(info, "{{.FullID}}")
-	if err != nil {
-		return nil, err
-	}
-	logCreateGroup := false
-	if info.Config[logCreateGroupKey] != "" {
-		logCreateGroup, err = strconv.ParseBool(info.Config[logCreateGroupKey])
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	logNonBlocking := info.Config["mode"] == "non-blocking"
-
-	forceFlushInterval := defaultForceFlushInterval
-	if info.Config[forceFlushIntervalKey] != "" {
-		forceFlushIntervalAsInt, err := strconv.Atoi(info.Config[forceFlushIntervalKey])
-		if err != nil {
-			return nil, err
-		}
-		forceFlushInterval = time.Duration(forceFlushIntervalAsInt) * time.Second
-	}
-
-	maxBufferedEvents := int(defaultMaxBufferedEvents)
-	if info.Config[maxBufferedEventsKey] != "" {
-		maxBufferedEvents, err = strconv.Atoi(info.Config[maxBufferedEventsKey])
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	if info.Config[logStreamKey] != "" {
-		logStreamName = info.Config[logStreamKey]
-	}
-
-	multilinePattern, err := parseMultilineOptions(info)
-	if err != nil {
-		return nil, err
-	}
-
-	containerStreamConfig := &logStreamConfig{
-		logStreamName:      logStreamName,
-		logGroupName:       logGroupName,
-		logCreateGroup:     logCreateGroup,
-		logNonBlocking:     logNonBlocking,
-		forceFlushInterval: forceFlushInterval,
-		maxBufferedEvents:  maxBufferedEvents,
-		multilinePattern:   multilinePattern,
-	}
-
-	return containerStreamConfig, nil
-}
-
 // Parses awslogs-multiline-pattern and awslogs-datetime-format options
 // If awslogs-datetime-format is present, convert the format from strftime
 // to regexp and return.
@@ -346,7 +293,7 @@ func newAWSLogsClient(info logger.Info) (api, error) {
 
 	sess, err := session.NewSession()
 	if err != nil {
-		return nil, errors.New("Failed to create a service client session for awslogs driver")
+		return nil, errors.New("Failed to create a service client session for for awslogs driver")
 	}
 
 	// attach region to cloudwatchlogs config
@@ -433,17 +380,13 @@ func (l *logStream) create() error {
 		if l.logCreateGroup {
 			if awsErr, ok := err.(awserr.Error); ok && awsErr.Code() == resourceNotFoundCode {
 				if err := l.createLogGroup(); err != nil {
-					return errors.Wrap(err, "failed to create Cloudwatch log group")
-				}
-				err := l.createLogStream()
-				if err != nil {
-					return errors.Wrap(err, "failed to create Cloudwatch log stream")
+					return err
 				}
-				return nil
+				return l.createLogStream()
 			}
 		}
 		if err != nil {
-			return errors.Wrap(err, "failed to create Cloudwatch log stream")
+			return err
 		}
 	}
 
@@ -524,11 +467,7 @@ var newTicker = func(freq time.Duration) *time.Ticker {
 func (l *logStream) collectBatch(created chan bool) {
 	// Wait for the logstream/group to be created
 	<-created
-	flushInterval := l.forceFlushInterval
-	if flushInterval <= 0 {
-		flushInterval = defaultForceFlushInterval
-	}
-	ticker := newTicker(flushInterval)
+	ticker := newTicker(batchPublishFrequency)
 	var eventBuffer []byte
 	var eventBufferTimestamp int64
 	var batch = newEventBatch()
@@ -538,7 +477,7 @@ func (l *logStream) collectBatch(created chan bool) {
 			// If event buffer is older than batch publish frequency flush the event buffer
 			if eventBufferTimestamp > 0 && len(eventBuffer) > 0 {
 				eventBufferAge := t.UnixNano()/int64(time.Millisecond) - eventBufferTimestamp
-				eventBufferExpired := eventBufferAge >= int64(flushInterval)/int64(time.Millisecond)
+				eventBufferExpired := eventBufferAge >= int64(batchPublishFrequency)/int64(time.Millisecond)
 				eventBufferNegative := eventBufferAge < 0
 				if eventBufferExpired || eventBufferNegative {
 					l.processEvent(batch, eventBuffer, eventBufferTimestamp)
@@ -729,8 +668,6 @@ func ValidateLogOpt(cfg map[string]string) error {
 		case datetimeFormatKey:
 		case multilinePatternKey:
 		case credentialsEndpointKey:
-		case forceFlushIntervalKey:
-		case maxBufferedEventsKey:
 		default:
 			return fmt.Errorf("unknown log opt '%s' for %s log driver", key, name)
 		}
@@ -743,16 +680,6 @@ func ValidateLogOpt(cfg map[string]string) error {
 			return fmt.Errorf("must specify valid value for log opt '%s': %v", logCreateGroupKey, err)
 		}
 	}
-	if cfg[forceFlushIntervalKey] != "" {
-		if value, err := strconv.Atoi(cfg[forceFlushIntervalKey]); err != nil || value <= 0 {
-			return fmt.Errorf("must specify a positive integer for log opt '%s': %v", forceFlushIntervalKey, cfg[forceFlushIntervalKey])
-		}
-	}
-	if cfg[maxBufferedEventsKey] != "" {
-		if value, err := strconv.Atoi(cfg[maxBufferedEventsKey]); err != nil || value <= 0 {
-			return fmt.Errorf("must specify a positive integer for log opt '%s': %v", maxBufferedEventsKey, cfg[maxBufferedEventsKey])
-		}
-	}
 	_, datetimeFormatKeyExists := cfg[datetimeFormatKey]
 	_, multilinePatternKeyExists := cfg[multilinePatternKey]
 	if datetimeFormatKeyExists && multilinePatternKeyExists {
diff --git a/vendor/github.com/docker/docker/daemon/logger/awslogs/cloudwatchlogs_test.go b/vendor/github.com/docker/docker/daemon/logger/awslogs/cloudwatchlogs_test.go
index 7ed52ee19..fdae99c76 100644
--- a/vendor/github.com/docker/docker/daemon/logger/awslogs/cloudwatchlogs_test.go
+++ b/vendor/github.com/docker/docker/daemon/logger/awslogs/cloudwatchlogs_test.go
@@ -10,7 +10,6 @@ import (
 	"reflect"
 	"regexp"
 	"runtime"
-	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -60,63 +59,6 @@ func testEventBatch(events []wrappedEvent) *eventBatch {
 	return batch
 }
 
-func TestNewStreamConfig(t *testing.T) {
-	tests := []struct {
-		logStreamName      string
-		logGroupName       string
-		logCreateGroup     string
-		logNonBlocking     string
-		forceFlushInterval string
-		maxBufferedEvents  string
-		datetimeFormat     string
-		multilinePattern   string
-		shouldErr          bool
-		testName           string
-	}{
-		{"", groupName, "", "", "", "", "", "", false, "defaults"},
-		{"", groupName, "invalid create group", "", "", "", "", "", true, "invalid create group"},
-		{"", groupName, "", "", "invalid flush interval", "", "", "", true, "invalid flush interval"},
-		{"", groupName, "", "", "", "invalid max buffered events", "", "", true, "invalid max buffered events"},
-		{"", groupName, "", "", "", "", "", "n{1001}", true, "invalid multiline pattern"},
-		{"", groupName, "", "", "15", "", "", "", false, "flush interval at 15"},
-		{"", groupName, "", "", "", "1024", "", "", false, "max buffered events at 1024"},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.testName, func(t *testing.T) {
-			cfg := map[string]string{
-				logGroupKey:           tc.logGroupName,
-				logCreateGroupKey:     tc.logCreateGroup,
-				"mode":                tc.logNonBlocking,
-				forceFlushIntervalKey: tc.forceFlushInterval,
-				maxBufferedEventsKey:  tc.maxBufferedEvents,
-				logStreamKey:          tc.logStreamName,
-				datetimeFormatKey:     tc.datetimeFormat,
-				multilinePatternKey:   tc.multilinePattern,
-			}
-
-			info := logger.Info{
-				Config: cfg,
-			}
-			logStreamConfig, err := newStreamConfig(info)
-			if tc.shouldErr {
-				assert.Check(t, err != nil, "Expected an error")
-			} else {
-				assert.Check(t, err == nil, "Unexpected error")
-				assert.Check(t, logStreamConfig.logGroupName == tc.logGroupName, "Unexpected logGroupName")
-				if tc.forceFlushInterval != "" {
-					forceFlushIntervalAsInt, _ := strconv.Atoi(info.Config[forceFlushIntervalKey])
-					assert.Check(t, logStreamConfig.forceFlushInterval == time.Duration(forceFlushIntervalAsInt)*time.Second, "Unexpected forceFlushInterval")
-				}
-				if tc.maxBufferedEvents != "" {
-					maxBufferedEvents, _ := strconv.Atoi(info.Config[maxBufferedEventsKey])
-					assert.Check(t, logStreamConfig.maxBufferedEvents == maxBufferedEvents, "Unexpected maxBufferedEvents")
-				}
-			}
-		})
-	}
-}
-
 func TestNewAWSLogsClientUserAgentHandler(t *testing.T) {
 	info := logger.Info{
 		Config: map[string]string{
@@ -820,10 +762,10 @@ func TestCollectBatchMultilinePatternMaxEventAge(t *testing.T) {
 		Timestamp: time.Now().Add(time.Second),
 	})
 
-	// Fire ticker defaultForceFlushInterval seconds later
-	ticks <- time.Now().Add(defaultForceFlushInterval + time.Second)
+	// Fire ticker batchPublishFrequency seconds later
+	ticks <- time.Now().Add(batchPublishFrequency + time.Second)
 
-	// Verify single multiline event is flushed after maximum event buffer age (defaultForceFlushInterval)
+	// Verify single multiline event is flushed after maximum event buffer age (batchPublishFrequency)
 	argument := <-mockClient.putLogEventsArgument
 	assert.Check(t, argument != nil, "Expected non-nil PutLogEventsInput")
 	assert.Check(t, is.Equal(1, len(argument.LogEvents)), "Expected single multiline event")
@@ -835,8 +777,8 @@ func TestCollectBatchMultilinePatternMaxEventAge(t *testing.T) {
 		Timestamp: time.Now().Add(time.Second),
 	})
 
-	// Fire ticker another defaultForceFlushInterval seconds later
-	ticks <- time.Now().Add(2*defaultForceFlushInterval + time.Second)
+	// Fire ticker another batchPublishFrequency seconds later
+	ticks <- time.Now().Add(2*batchPublishFrequency + time.Second)
 
 	// Verify the event buffer is truly flushed - we should only receive a single event
 	argument = <-mockClient.putLogEventsArgument
@@ -938,7 +880,7 @@ func TestCollectBatchMultilinePatternMaxEventSize(t *testing.T) {
 	})
 
 	// Fire ticker
-	ticks <- time.Now().Add(defaultForceFlushInterval)
+	ticks <- time.Now().Add(batchPublishFrequency)
 
 	// Verify multiline events
 	// We expect a maximum sized event with no new line characters and a
@@ -1477,64 +1419,6 @@ func TestValidateLogOptionsDatetimeFormatAndMultilinePattern(t *testing.T) {
 	assert.Check(t, is.Equal(err.Error(), conflictingLogOptionsError), "Received invalid error")
 }
 
-func TestValidateLogOptionsForceFlushIntervalSeconds(t *testing.T) {
-	tests := []struct {
-		input     string
-		shouldErr bool
-	}{
-		{"0", true},
-		{"-1", true},
-		{"a", true},
-		{"10", false},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.input, func(t *testing.T) {
-			cfg := map[string]string{
-				forceFlushIntervalKey: tc.input,
-				logGroupKey:           groupName,
-			}
-
-			err := ValidateLogOpt(cfg)
-			if tc.shouldErr {
-				expectedErr := "must specify a positive integer for log opt 'awslogs-force-flush-interval-seconds': " + tc.input
-				assert.Error(t, err, expectedErr)
-			} else {
-				assert.NilError(t, err)
-			}
-		})
-	}
-}
-
-func TestValidateLogOptionsMaxBufferedEvents(t *testing.T) {
-	tests := []struct {
-		input     string
-		shouldErr bool
-	}{
-		{"0", true},
-		{"-1", true},
-		{"a", true},
-		{"10", false},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.input, func(t *testing.T) {
-			cfg := map[string]string{
-				maxBufferedEventsKey: tc.input,
-				logGroupKey:          groupName,
-			}
-
-			err := ValidateLogOpt(cfg)
-			if tc.shouldErr {
-				expectedErr := "must specify a positive integer for log opt 'awslogs-max-buffered-events': " + tc.input
-				assert.Error(t, err, expectedErr)
-			} else {
-				assert.NilError(t, err)
-			}
-		})
-	}
-}
-
 func TestCreateTagSuccess(t *testing.T) {
 	mockClient := newMockClient()
 	info := logger.Info{
diff --git a/vendor/github.com/docker/docker/daemon/logger/gelf/gelf_test.go b/vendor/github.com/docker/docker/daemon/logger/gelf/gelf_test.go
index 3610bc6d3..a88d56ce1 100644
--- a/vendor/github.com/docker/docker/daemon/logger/gelf/gelf_test.go
+++ b/vendor/github.com/docker/docker/daemon/logger/gelf/gelf_test.go
@@ -156,7 +156,7 @@ func TestNewGELFTCPWriter(t *testing.T) {
 			"gelf-address":             url,
 			"gelf-tcp-max-reconnect":   "0",
 			"gelf-tcp-reconnect-delay": "0",
-			"tag":                      "{{.ID}}",
+			"tag": "{{.ID}}",
 		},
 		ContainerID: "12345678901234567890",
 	}
diff --git a/vendor/github.com/docker/docker/daemon/logger/journald/journald.go b/vendor/github.com/docker/docker/daemon/logger/journald/journald.go
index 8750cae09..342e18f57 100644
--- a/vendor/github.com/docker/docker/daemon/logger/journald/journald.go
+++ b/vendor/github.com/docker/docker/daemon/logger/journald/journald.go
@@ -20,10 +20,14 @@ const name = "journald"
 type journald struct {
 	mu      sync.Mutex
 	vars    map[string]string // additional variables and values to send to the journal along with the log message
-	readers map[*logger.LogWatcher]struct{}
+	readers readerList
 	closed  bool
 }
 
+type readerList struct {
+	readers map[*logger.LogWatcher]*logger.LogWatcher
+}
+
 func init() {
 	if err := logger.RegisterLogDriver(name, New); err != nil {
 		logrus.Fatal(err)
@@ -71,7 +75,6 @@ func New(info logger.Info) (logger.Logger, error) {
 		"CONTAINER_ID_FULL": info.ContainerID,
 		"CONTAINER_NAME":    info.Name(),
 		"CONTAINER_TAG":     tag,
-		"IMAGE_NAME":        info.ImageName(),
 		"SYSLOG_IDENTIFIER": tag,
 	}
 	extraAttrs, err := info.ExtraAttributes(sanitizeKeyMod)
@@ -81,7 +84,7 @@ func New(info logger.Info) (logger.Logger, error) {
 	for k, v := range extraAttrs {
 		vars[k] = v
 	}
-	return &journald{vars: vars, readers: make(map[*logger.LogWatcher]struct{})}, nil
+	return &journald{vars: vars, readers: readerList{readers: make(map[*logger.LogWatcher]*logger.LogWatcher)}}, nil
 }
 
 // We don't actually accept any options, but we have to supply a callback for
@@ -105,7 +108,7 @@ func (s *journald) Log(msg *logger.Message) error {
 	for k, v := range s.vars {
 		vars[k] = v
 	}
-	if msg.PLogMetaData != nil && !msg.PLogMetaData.Last {
+	if msg.PLogMetaData != nil {
 		vars["CONTAINER_PARTIAL_MESSAGE"] = "true"
 	}
 
diff --git a/vendor/github.com/docker/docker/daemon/logger/journald/read.go b/vendor/github.com/docker/docker/daemon/logger/journald/read.go
index 4bddfd578..cadb97f4c 100644
--- a/vendor/github.com/docker/docker/daemon/logger/journald/read.go
+++ b/vendor/github.com/docker/docker/daemon/logger/journald/read.go
@@ -164,10 +164,8 @@ import (
 func (s *journald) Close() error {
 	s.mu.Lock()
 	s.closed = true
-	for r := range s.readers {
-		r.ProducerGone()
-		delete(s.readers, r)
-
+	for reader := range s.readers.readers {
+		reader.ProducerGone()
 	}
 	s.mu.Unlock()
 	return nil
@@ -255,7 +253,7 @@ drain:
 
 func (s *journald) followJournal(logWatcher *logger.LogWatcher, j *C.sd_journal, pfd [2]C.int, cursor *C.char, untilUnixMicro uint64) *C.char {
 	s.mu.Lock()
-	s.readers[logWatcher] = struct{}{}
+	s.readers.readers[logWatcher] = logWatcher
 	if s.closed {
 		// the journald Logger is closed, presumably because the container has been
 		// reset.  So we shouldn't follow, because we'll never be woken up.  But we
@@ -292,7 +290,7 @@ func (s *journald) followJournal(logWatcher *logger.LogWatcher, j *C.sd_journal,
 		// Clean up.
 		C.close(pfd[0])
 		s.mu.Lock()
-		delete(s.readers, logWatcher)
+		delete(s.readers.readers, logWatcher)
 		s.mu.Unlock()
 		close(logWatcher.Msg)
 		newCursor <- cursor
diff --git a/vendor/github.com/docker/docker/daemon/logger/logger.go b/vendor/github.com/docker/docker/daemon/logger/logger.go
index 6308270b2..12e8d0054 100644
--- a/vendor/github.com/docker/docker/daemon/logger/logger.go
+++ b/vendor/github.com/docker/docker/daemon/logger/logger.go
@@ -103,7 +103,7 @@ type LogReader interface {
 type LogWatcher struct {
 	// For sending log messages to a reader.
 	Msg chan *Message
-	// For sending error messages that occur while reading logs.
+	// For sending error messages that occur while while reading logs.
 	Err          chan error
 	producerOnce sync.Once
 	producerGone chan struct{}
diff --git a/vendor/github.com/docker/docker/daemon/logger/loggerutils/logfile.go b/vendor/github.com/docker/docker/daemon/logger/loggerutils/logfile.go
index fa45154ec..623f78f5e 100644
--- a/vendor/github.com/docker/docker/daemon/logger/loggerutils/logfile.go
+++ b/vendor/github.com/docker/docker/daemon/logger/loggerutils/logfile.go
@@ -668,9 +668,9 @@ func watchFile(name string) (filenotify.FileWatcher, error) {
 	var fileWatcher filenotify.FileWatcher
 
 	if runtime.GOOS == "windows" {
-		// FileWatcher on Windows files is based on the syscall notifications which has an issue because of file caching.
+		// FileWatcher on Windows files is based on the syscall notifications which has an issue becuase of file caching.
 		// It is based on ReadDirectoryChangesW() which doesn't detect writes to the cache. It detects writes to disk only.
-		// Because of the OS lazy writing, we don't get notifications for file writes and thereby the watcher
+		// Becuase of the OS lazy writing, we don't get notifications for file writes and thereby the watcher
 		// doesn't work. Hence for Windows we will use poll based notifier.
 		fileWatcher = filenotify.NewPollingWatcher()
 	} else {
diff --git a/vendor/github.com/docker/docker/daemon/logger/splunk/splunk_test.go b/vendor/github.com/docker/docker/daemon/logger/splunk/splunk_test.go
index 654e96a30..cfb83e80d 100644
--- a/vendor/github.com/docker/docker/daemon/logger/splunk/splunk_test.go
+++ b/vendor/github.com/docker/docker/daemon/logger/splunk/splunk_test.go
@@ -30,10 +30,10 @@ func TestValidateLogOpt(t *testing.T) {
 		splunkVerifyConnectionKey:     "true",
 		splunkGzipCompressionKey:      "true",
 		splunkGzipCompressionLevelKey: "1",
-		envKey:                        "a",
-		envRegexKey:                   "^foo",
-		labelsKey:                     "b",
-		tagKey:                        "c",
+		envKey:      "a",
+		envRegexKey: "^foo",
+		labelsKey:   "b",
+		tagKey:      "c",
 	})
 	if err != nil {
 		t.Fatal(err)
@@ -251,9 +251,9 @@ func TestInlineFormatWithNonDefaultOptions(t *testing.T) {
 			splunkIndexKey:           "myindex",
 			splunkFormatKey:          splunkFormatInline,
 			splunkGzipCompressionKey: "true",
-			tagKey:                   "{{.ImageName}}/{{.Name}}",
-			labelsKey:                "a",
-			envRegexKey:              "^foo",
+			tagKey:      "{{.ImageName}}/{{.Name}}",
+			labelsKey:   "a",
+			envRegexKey: "^foo",
 		},
 		ContainerID:        "containeriid",
 		ContainerName:      "/container_name",
diff --git a/vendor/github.com/docker/docker/daemon/logger/syslog/syslog.go b/vendor/github.com/docker/docker/daemon/logger/syslog/syslog.go
index 61f9f1434..94bdee364 100644
--- a/vendor/github.com/docker/docker/daemon/logger/syslog/syslog.go
+++ b/vendor/github.com/docker/docker/daemon/logger/syslog/syslog.go
@@ -77,7 +77,7 @@ func rfc5424formatterWithAppNameAsTag(p syslog.Priority, hostname, tag, content
 // for multiple syntaxes, there are further restrictions in rfc5424, i.e., the maximum
 // resolution is limited to "TIME-SECFRAC" which is 6 (microsecond resolution)
 func rfc5424microformatterWithAppNameAsTag(p syslog.Priority, hostname, tag, content string) string {
-	timestamp := time.Now().Format("2006-01-02T15:04:05.000000Z07:00")
+	timestamp := time.Now().Format("2006-01-02T15:04:05.999999Z07:00")
 	pid := os.Getpid()
 	msg := fmt.Sprintf("<%d>%d %s %s %s %d %s - %s",
 		p, 1, timestamp, hostname, tag, pid, tag, content)
diff --git a/vendor/github.com/docker/docker/daemon/logger/syslog/syslog_test.go b/vendor/github.com/docker/docker/daemon/logger/syslog/syslog_test.go
index ea531a243..4631788fb 100644
--- a/vendor/github.com/docker/docker/daemon/logger/syslog/syslog_test.go
+++ b/vendor/github.com/docker/docker/daemon/logger/syslog/syslog_test.go
@@ -1,7 +1,6 @@
 package syslog // import "github.com/docker/docker/daemon/logger/syslog"
 
 import (
-	"net"
 	"reflect"
 	"testing"
 
@@ -61,99 +60,3 @@ func TestValidateLogOptEmpty(t *testing.T) {
 		t.Fatal("Failed to parse empty config", err)
 	}
 }
-
-func TestValidateSyslogAddress(t *testing.T) {
-	err := ValidateLogOpt(map[string]string{
-		"syslog-address": "this is not an uri",
-	})
-	if err == nil {
-		t.Fatal("Expected error with invalid uri")
-	}
-
-	// File exists
-	err = ValidateLogOpt(map[string]string{
-		"syslog-address": "unix:///",
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// File does not exist
-	err = ValidateLogOpt(map[string]string{
-		"syslog-address": "unix:///does_not_exist",
-	})
-	if err == nil {
-		t.Fatal("Expected error when address is non existing file")
-	}
-
-	// accepts udp and tcp URIs
-	err = ValidateLogOpt(map[string]string{
-		"syslog-address": "udp://1.2.3.4",
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = ValidateLogOpt(map[string]string{
-		"syslog-address": "tcp://1.2.3.4",
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-}
-
-func TestParseAddressDefaultPort(t *testing.T) {
-	_, address, err := parseAddress("tcp://1.2.3.4")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	_, port, _ := net.SplitHostPort(address)
-	if port != "514" {
-		t.Fatalf("Expected to default to port 514. It used port %s", port)
-	}
-}
-
-func TestValidateSyslogFacility(t *testing.T) {
-	err := ValidateLogOpt(map[string]string{
-		"syslog-facility": "Invalid facility",
-	})
-	if err == nil {
-		t.Fatal("Expected error if facility level is invalid")
-	}
-}
-
-func TestValidateLogOptSyslogFormat(t *testing.T) {
-	err := ValidateLogOpt(map[string]string{
-		"syslog-format": "Invalid format",
-	})
-	if err == nil {
-		t.Fatal("Expected error if format is invalid")
-	}
-}
-
-func TestValidateLogOpt(t *testing.T) {
-	err := ValidateLogOpt(map[string]string{
-		"env":                    "http://127.0.0.1",
-		"env-regex":              "abc",
-		"labels":                 "labelA",
-		"syslog-address":         "udp://1.2.3.4:1111",
-		"syslog-facility":        "daemon",
-		"syslog-tls-ca-cert":     "/etc/ca-certificates/custom/ca.pem",
-		"syslog-tls-cert":        "/etc/ca-certificates/custom/cert.pem",
-		"syslog-tls-key":         "/etc/ca-certificates/custom/key.pem",
-		"syslog-tls-skip-verify": "true",
-		"tag":                    "true",
-		"syslog-format":          "rfc3164",
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = ValidateLogOpt(map[string]string{
-		"not-supported-option": "a",
-	})
-	if err == nil {
-		t.Fatal("Expecting error on unsupported options")
-	}
-}
diff --git a/vendor/github.com/docker/docker/daemon/metrics.go b/vendor/github.com/docker/docker/daemon/metrics.go
index 20030c427..f6961a355 100644
--- a/vendor/github.com/docker/docker/daemon/metrics.go
+++ b/vendor/github.com/docker/docker/daemon/metrics.go
@@ -123,7 +123,7 @@ func (d *Daemon) cleanupMetricsPlugins() {
 
 			adapter, err := makePluginAdapter(p)
 			if err != nil {
-				logrus.WithError(err).WithField("plugin", p.Name()).Error("Error creating metrics plugin adapter")
+				logrus.WithError(err).WithField("plugin", p.Name()).Error("Error creating metrics plugin adapater")
 				return
 			}
 			if err := adapter.StopMetrics(); err != nil {
diff --git a/vendor/github.com/docker/docker/daemon/metrics_unix.go b/vendor/github.com/docker/docker/daemon/metrics_unix.go
index a9b5f810b..452424e68 100644
--- a/vendor/github.com/docker/docker/daemon/metrics_unix.go
+++ b/vendor/github.com/docker/docker/daemon/metrics_unix.go
@@ -51,7 +51,7 @@ func registerMetricsPluginCallback(store *plugin.Store, sockPath string) {
 
 		adapter, err := makePluginAdapter(p)
 		if err != nil {
-			logrus.WithError(err).WithField("plugin", p.Name()).Error("Error creating plugin adapter")
+			logrus.WithError(err).WithField("plugin", p.Name()).Error("Error creating plugin adapater")
 		}
 		if err := adapter.StartMetrics(); err != nil {
 			logrus.WithError(err).WithField("plugin", p.Name()).Error("Error starting metrics collector plugin")
diff --git a/vendor/github.com/docker/docker/oci/oci.go b/vendor/github.com/docker/docker/daemon/oci.go
similarity index 74%
rename from vendor/github.com/docker/docker/oci/oci.go
rename to vendor/github.com/docker/docker/daemon/oci.go
index adc6a3715..52050e24f 100644
--- a/vendor/github.com/docker/docker/oci/oci.go
+++ b/vendor/github.com/docker/docker/daemon/oci.go
@@ -1,28 +1,27 @@
-package oci // import "github.com/docker/docker/oci"
+package daemon // import "github.com/docker/docker/daemon"
 
 import (
 	"fmt"
 	"regexp"
 	"strconv"
 
-	"github.com/docker/docker/oci/caps"
+	"github.com/docker/docker/container"
+	"github.com/docker/docker/daemon/caps"
 	specs "github.com/opencontainers/runtime-spec/specs-go"
 )
 
 // nolint: gosimple
-var deviceCgroupRuleRegex = regexp.MustCompile("^([acb]) ([0-9]+|\\*):([0-9]+|\\*) ([rwm]{1,3})$")
+var (
+	deviceCgroupRuleRegex = regexp.MustCompile("^([acb]) ([0-9]+|\\*):([0-9]+|\\*) ([rwm]{1,3})$")
+)
 
-// SetCapabilities sets the provided capabilities on the spec
-// All capabilities are added if privileged is true
-func SetCapabilities(s *specs.Spec, add, drop []string, privileged bool) error {
-	var (
-		caplist []string
-		err     error
-	)
-	if privileged {
+func setCapabilities(s *specs.Spec, c *container.Container) error {
+	var caplist []string
+	var err error
+	if c.HostConfig.Privileged {
 		caplist = caps.GetAllCapabilities()
 	} else {
-		caplist, err = caps.TweakCapabilities(s.Process.Capabilities.Bounding, add, drop)
+		caplist, err = caps.TweakCapabilities(s.Process.Capabilities.Bounding, c.HostConfig.CapAdd, c.HostConfig.CapDrop)
 		if err != nil {
 			return err
 		}
@@ -40,8 +39,7 @@ func SetCapabilities(s *specs.Spec, add, drop []string, privileged bool) error {
 	return nil
 }
 
-// AppendDevicePermissionsFromCgroupRules takes rules for the devices cgroup to append to the default set
-func AppendDevicePermissionsFromCgroupRules(devPermissions []specs.LinuxDeviceCgroup, rules []string) ([]specs.LinuxDeviceCgroup, error) {
+func appendDevicePermissionsFromCgroupRules(devPermissions []specs.LinuxDeviceCgroup, rules []string) ([]specs.LinuxDeviceCgroup, error) {
 	for _, deviceCgroupRule := range rules {
 		ss := deviceCgroupRuleRegex.FindAllStringSubmatch(deviceCgroupRule, -1)
 		if len(ss[0]) != 5 {
diff --git a/vendor/github.com/docker/docker/daemon/oci_linux.go b/vendor/github.com/docker/docker/daemon/oci_linux.go
index e330f4fc6..7611fc054 100644
--- a/vendor/github.com/docker/docker/daemon/oci_linux.go
+++ b/vendor/github.com/docker/docker/daemon/oci_linux.go
@@ -27,10 +27,6 @@ import (
 	"golang.org/x/sys/unix"
 )
 
-const (
-	inContainerInitPath = "/sbin/" + daemonconfig.DefaultInitBinary
-)
-
 func setResources(s *specs.Spec, r containertypes.Resources) error {
 	weightDevices, err := getBlkioWeightDevices(r)
 	if err != nil {
@@ -113,7 +109,7 @@ func setDevices(s *specs.Spec, c *container.Container) error {
 		}
 
 		var err error
-		devPermissions, err = oci.AppendDevicePermissionsFromCgroupRules(devPermissions, c.HostConfig.DeviceCgroupRules)
+		devPermissions, err = appendDevicePermissionsFromCgroupRules(devPermissions, c.HostConfig.DeviceCgroupRules)
 		if err != nil {
 			return err
 		}
@@ -498,6 +494,12 @@ func setMounts(daemon *Daemon, s *specs.Spec, c *container.Container, mounts []c
 
 	s.Mounts = defaultMounts
 	for _, m := range mounts {
+		for _, cm := range s.Mounts {
+			if cm.Destination == m.Destination {
+				return duplicateMountPointError(m.Destination)
+			}
+		}
+
 		if m.Source == "tmpfs" {
 			data := m.Data
 			parser := volumemounts.NewParser("linux")
@@ -565,11 +567,7 @@ func setMounts(daemon *Daemon, s *specs.Spec, c *container.Container, mounts []c
 			}
 		}
 
-		bindMode := "rbind"
-		if m.NonRecursive {
-			bindMode = "bind"
-		}
-		opts := []string{bindMode}
+		opts := []string{"rbind"}
 		if !m.Writable {
 			opts = append(opts, "ro")
 		}
@@ -659,16 +657,19 @@ func (daemon *Daemon) populateCommonSpec(s *specs.Spec, c *container.Container)
 	if c.HostConfig.PidMode.IsPrivate() {
 		if (c.HostConfig.Init != nil && *c.HostConfig.Init) ||
 			(c.HostConfig.Init == nil && daemon.configStore.Init) {
-			s.Process.Args = append([]string{inContainerInitPath, "--", c.Path}, c.Args...)
-			path := daemon.configStore.InitPath
-			if path == "" {
+			s.Process.Args = append([]string{"/dev/init", "--", c.Path}, c.Args...)
+			var path string
+			if daemon.configStore.InitPath == "" {
 				path, err = exec.LookPath(daemonconfig.DefaultInitBinary)
 				if err != nil {
 					return err
 				}
 			}
+			if daemon.configStore.InitPath != "" {
+				path = daemon.configStore.InitPath
+			}
 			s.Mounts = append(s.Mounts, specs.Mount{
-				Destination: inContainerInitPath,
+				Destination: "/dev/init",
 				Type:        "bind",
 				Source:      path,
 				Options:     []string{"bind", "ro"},
@@ -678,15 +679,7 @@ func (daemon *Daemon) populateCommonSpec(s *specs.Spec, c *container.Container)
 	s.Process.Cwd = cwd
 	s.Process.Env = c.CreateDaemonEnvironment(c.Config.Tty, linkedEnv)
 	s.Process.Terminal = c.Config.Tty
-
-	s.Hostname = c.Config.Hostname
-	// There isn't a field in the OCI for the NIS domainname, but luckily there
-	// is a sysctl which has an identical effect to setdomainname(2) so there's
-	// no explicit need for runtime support.
-	s.Linux.Sysctl = make(map[string]string)
-	if c.Config.Domainname != "" {
-		s.Linux.Sysctl["kernel.domainname"] = c.Config.Domainname
-	}
+	s.Hostname = c.FullHostname()
 
 	return nil
 }
@@ -722,11 +715,7 @@ func (daemon *Daemon) createSpec(c *container.Container) (retSpec *specs.Spec, e
 	if err := setResources(&s, c.HostConfig.Resources); err != nil {
 		return nil, fmt.Errorf("linux runtime spec resources: %v", err)
 	}
-	// We merge the sysctls injected above with the HostConfig (latter takes
-	// precedence for backwards-compatibility reasons).
-	for k, v := range c.HostConfig.Sysctls {
-		s.Linux.Sysctl[k] = v
-	}
+	s.Linux.Sysctl = c.HostConfig.Sysctls
 
 	p := s.Linux.CgroupsPath
 	if useSystemd {
@@ -762,7 +751,7 @@ func (daemon *Daemon) createSpec(c *container.Container) (retSpec *specs.Spec, e
 	if err := setNamespaces(daemon, &s, c); err != nil {
 		return nil, fmt.Errorf("linux spec namespaces: %v", err)
 	}
-	if err := oci.SetCapabilities(&s, c.HostConfig.CapAdd, c.HostConfig.CapDrop, c.HostConfig.Privileged); err != nil {
+	if err := setCapabilities(&s, c); err != nil {
 		return nil, fmt.Errorf("linux spec capabilities: %v", err)
 	}
 	if err := setSeccomp(daemon, &s, c); err != nil {
@@ -819,7 +808,7 @@ func (daemon *Daemon) createSpec(c *container.Container) (retSpec *specs.Spec, e
 			s.Hooks = &specs.Hooks{
 				Prestart: []specs.Hook{{
 					Path: target,
-					Args: []string{"libnetwork-setkey", "-exec-root=" + daemon.configStore.GetExecRoot(), c.ID, daemon.netController.ID()},
+					Args: []string{"libnetwork-setkey", c.ID, daemon.netController.ID()},
 				}},
 			}
 		}
diff --git a/vendor/github.com/docker/docker/daemon/oci_linux_test.go b/vendor/github.com/docker/docker/daemon/oci_linux_test.go
index 33fab7028..bb296a870 100644
--- a/vendor/github.com/docker/docker/daemon/oci_linux_test.go
+++ b/vendor/github.com/docker/docker/daemon/oci_linux_test.go
@@ -1,67 +1,29 @@
 package daemon // import "github.com/docker/docker/daemon"
 
 import (
-	"io/ioutil"
 	"os"
-	"path/filepath"
 	"testing"
 
 	containertypes "github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/container"
 	"github.com/docker/docker/daemon/config"
-	"github.com/docker/docker/daemon/network"
-	"github.com/docker/docker/pkg/containerfs"
+	"github.com/docker/docker/oci"
 	"github.com/docker/docker/pkg/idtools"
-	"github.com/docker/libnetwork"
 	"gotest.tools/assert"
 	is "gotest.tools/assert/cmp"
 )
 
-func setupFakeDaemon(t *testing.T, c *container.Container) *Daemon {
-	root, err := ioutil.TempDir("", "oci_linux_test-root")
-	assert.NilError(t, err)
-
-	rootfs := filepath.Join(root, "rootfs")
-	err = os.MkdirAll(rootfs, 0755)
-	assert.NilError(t, err)
-
-	netController, err := libnetwork.New()
-	assert.NilError(t, err)
-
-	d := &Daemon{
-		// some empty structs to avoid getting a panic
-		// caused by a null pointer dereference
-		idMapping:     &idtools.IdentityMapping{},
-		configStore:   &config.Config{},
-		linkIndex:     newLinkIndex(),
-		netController: netController,
-	}
-
-	c.Root = root
-	c.BaseFS = containerfs.NewLocalContainerFS(rootfs)
-
-	if c.Config == nil {
-		c.Config = new(containertypes.Config)
-	}
-	if c.HostConfig == nil {
-		c.HostConfig = new(containertypes.HostConfig)
-	}
-	if c.NetworkSettings == nil {
-		c.NetworkSettings = &network.Settings{Networks: make(map[string]*network.EndpointSettings)}
-	}
-
-	return d
-}
-
-func cleanupFakeContainer(c *container.Container) {
-	os.RemoveAll(c.Root)
-}
-
 // TestTmpfsDevShmNoDupMount checks that a user-specified /dev/shm tmpfs
 // mount (as in "docker run --tmpfs /dev/shm:rw,size=NNN") does not result
 // in "Duplicate mount point" error from the engine.
 // https://github.com/moby/moby/issues/35455
 func TestTmpfsDevShmNoDupMount(t *testing.T) {
+	d := Daemon{
+		// some empty structs to avoid getting a panic
+		// caused by a null pointer dereference
+		idMapping:   &idtools.IdentityMapping{},
+		configStore: &config.Config{},
+	}
 	c := &container.Container{
 		ShmPath: "foobar", // non-empty, for c.IpcMounts() to work
 		HostConfig: &containertypes.HostConfig{
@@ -72,10 +34,19 @@ func TestTmpfsDevShmNoDupMount(t *testing.T) {
 			},
 		},
 	}
-	d := setupFakeDaemon(t, c)
-	defer cleanupFakeContainer(c)
 
-	_, err := d.createSpec(c)
+	// Mimick the code flow of daemon.createSpec(), enough to reproduce the issue
+	ms, err := d.setupMounts(c)
+	assert.Check(t, err)
+
+	ms = append(ms, c.IpcMounts()...)
+
+	tmpfsMounts, err := c.TmpfsMounts()
+	assert.Check(t, err)
+	ms = append(ms, tmpfsMounts...)
+
+	s := oci.DefaultSpec()
+	err = setMounts(&d, &s, c, ms)
 	assert.Check(t, err)
 }
 
@@ -84,16 +55,28 @@ func TestTmpfsDevShmNoDupMount(t *testing.T) {
 // the resulting /dev/shm mount is NOT made read-only.
 // https://github.com/moby/moby/issues/36503
 func TestIpcPrivateVsReadonly(t *testing.T) {
+	d := Daemon{
+		// some empty structs to avoid getting a panic
+		// caused by a null pointer dereference
+		idMapping:   &idtools.IdentityMapping{},
+		configStore: &config.Config{},
+	}
 	c := &container.Container{
 		HostConfig: &containertypes.HostConfig{
 			IpcMode:        containertypes.IpcMode("private"),
 			ReadonlyRootfs: true,
 		},
 	}
-	d := setupFakeDaemon(t, c)
-	defer cleanupFakeContainer(c)
 
-	s, err := d.createSpec(c)
+	// We can't call createSpec() so mimick the minimal part
+	// of its code flow, just enough to reproduce the issue.
+	ms, err := d.setupMounts(c)
+	assert.Check(t, err)
+
+	s := oci.DefaultSpec()
+	s.Root.Readonly = c.HostConfig.ReadonlyRootfs
+
+	err = setMounts(&d, &s, c, ms)
 	assert.Check(t, err)
 
 	// Find the /dev/shm mount in ms, check it does not have ro
@@ -105,37 +88,6 @@ func TestIpcPrivateVsReadonly(t *testing.T) {
 	}
 }
 
-// TestSysctlOverride ensures that any implicit sysctls (such as
-// Config.Domainname) are overridden by an explicit sysctl in the HostConfig.
-func TestSysctlOverride(t *testing.T) {
-	c := &container.Container{
-		Config: &containertypes.Config{
-			Hostname:   "foobar",
-			Domainname: "baz.cyphar.com",
-		},
-		HostConfig: &containertypes.HostConfig{
-			Sysctls: map[string]string{},
-		},
-	}
-	d := setupFakeDaemon(t, c)
-	defer cleanupFakeContainer(c)
-
-	// Ensure that the implicit sysctl is set correctly.
-	s, err := d.createSpec(c)
-	assert.NilError(t, err)
-	assert.Equal(t, s.Hostname, "foobar")
-	assert.Equal(t, s.Linux.Sysctl["kernel.domainname"], c.Config.Domainname)
-
-	// Set an explicit sysctl.
-	c.HostConfig.Sysctls["kernel.domainname"] = "foobar.net"
-	assert.Assert(t, c.HostConfig.Sysctls["kernel.domainname"] != c.Config.Domainname)
-
-	s, err = d.createSpec(c)
-	assert.NilError(t, err)
-	assert.Equal(t, s.Hostname, "foobar")
-	assert.Equal(t, s.Linux.Sysctl["kernel.domainname"], c.HostConfig.Sysctls["kernel.domainname"])
-}
-
 func TestGetSourceMount(t *testing.T) {
 	// must be able to find source mount for /
 	mnt, _, err := getSourceMount("/")
diff --git a/vendor/github.com/docker/docker/daemon/oci_windows.go b/vendor/github.com/docker/docker/daemon/oci_windows.go
index 8cffbc6b1..6279d7dd2 100644
--- a/vendor/github.com/docker/docker/daemon/oci_windows.go
+++ b/vendor/github.com/docker/docker/daemon/oci_windows.go
@@ -332,30 +332,6 @@ func (daemon *Daemon) createSpecWindowsFields(c *container.Container, s *specs.S
 		s.Windows.CredentialSpec = cs
 	}
 
-	// Do we have any assigned devices?
-	if len(c.HostConfig.Devices) > 0 {
-		if isHyperV {
-			return errors.New("device assignment is not supported for HyperV containers")
-		}
-		if system.GetOSVersion().Build < 17763 {
-			return errors.New("device assignment requires Windows builds RS5 (17763+) or later")
-		}
-		for _, deviceMapping := range c.HostConfig.Devices {
-			srcParts := strings.SplitN(deviceMapping.PathOnHost, "/", 2)
-			if len(srcParts) != 2 {
-				return errors.New("invalid device assignment path")
-			}
-			if srcParts[0] != "class" {
-				return errors.Errorf("invalid device assignment type: '%s' should be 'class'", srcParts[0])
-			}
-			wd := specs.WindowsDevice{
-				ID:     srcParts[1],
-				IDType: srcParts[0],
-			}
-			s.Windows.Devices = append(s.Windows.Devices, wd)
-		}
-	}
-
 	return nil
 }
 
@@ -368,10 +344,10 @@ func (daemon *Daemon) createSpecLinuxFields(c *container.Container, s *specs.Spe
 	}
 	s.Root.Path = "rootfs"
 	s.Root.Readonly = c.HostConfig.ReadonlyRootfs
-	if err := oci.SetCapabilities(s, c.HostConfig.CapAdd, c.HostConfig.CapDrop, c.HostConfig.Privileged); err != nil {
+	if err := setCapabilities(s, c); err != nil {
 		return fmt.Errorf("linux spec capabilities: %v", err)
 	}
-	devPermissions, err := oci.AppendDevicePermissionsFromCgroupRules(nil, c.HostConfig.DeviceCgroupRules)
+	devPermissions, err := appendDevicePermissionsFromCgroupRules(nil, c.HostConfig.DeviceCgroupRules)
 	if err != nil {
 		return fmt.Errorf("linux runtime spec devices: %v", err)
 	}
diff --git a/vendor/github.com/docker/docker/daemon/reload.go b/vendor/github.com/docker/docker/daemon/reload.go
index a31dd0cb8..026d7dd51 100644
--- a/vendor/github.com/docker/docker/daemon/reload.go
+++ b/vendor/github.com/docker/docker/daemon/reload.go
@@ -84,26 +84,25 @@ func (daemon *Daemon) reloadDebug(conf *config.Config, attributes map[string]str
 func (daemon *Daemon) reloadMaxConcurrentDownloadsAndUploads(conf *config.Config, attributes map[string]string) {
 	// If no value is set for max-concurrent-downloads we assume it is the default value
 	// We always "reset" as the cost is lightweight and easy to maintain.
-	maxConcurrentDownloads := config.DefaultMaxConcurrentDownloads
 	if conf.IsValueSet("max-concurrent-downloads") && conf.MaxConcurrentDownloads != nil {
-		maxConcurrentDownloads = *conf.MaxConcurrentDownloads
+		*daemon.configStore.MaxConcurrentDownloads = *conf.MaxConcurrentDownloads
+	} else {
+		maxConcurrentDownloads := config.DefaultMaxConcurrentDownloads
+		daemon.configStore.MaxConcurrentDownloads = &maxConcurrentDownloads
 	}
-	daemon.configStore.MaxConcurrentDownloads = &maxConcurrentDownloads
 	logrus.Debugf("Reset Max Concurrent Downloads: %d", *daemon.configStore.MaxConcurrentDownloads)
 
 	// If no value is set for max-concurrent-upload we assume it is the default value
 	// We always "reset" as the cost is lightweight and easy to maintain.
-	maxConcurrentUploads := config.DefaultMaxConcurrentUploads
 	if conf.IsValueSet("max-concurrent-uploads") && conf.MaxConcurrentUploads != nil {
-		maxConcurrentUploads = *conf.MaxConcurrentUploads
+		*daemon.configStore.MaxConcurrentUploads = *conf.MaxConcurrentUploads
+	} else {
+		maxConcurrentUploads := config.DefaultMaxConcurrentUploads
+		daemon.configStore.MaxConcurrentUploads = &maxConcurrentUploads
 	}
-	daemon.configStore.MaxConcurrentUploads = &maxConcurrentUploads
 	logrus.Debugf("Reset Max Concurrent Uploads: %d", *daemon.configStore.MaxConcurrentUploads)
 
-	if daemon.imageService != nil {
-		daemon.imageService.UpdateConfig(&maxConcurrentDownloads, &maxConcurrentUploads)
-	}
-
+	daemon.imageService.UpdateConfig(conf.MaxConcurrentDownloads, conf.MaxConcurrentUploads)
 	// prepare reload event attributes with updatable configurations
 	attributes["max-concurrent-downloads"] = fmt.Sprintf("%d", *daemon.configStore.MaxConcurrentDownloads)
 	// prepare reload event attributes with updatable configurations
@@ -295,7 +294,7 @@ func (daemon *Daemon) reloadRegistryMirrors(conf *config.Config, attributes map[
 	return nil
 }
 
-// reloadLiveRestore updates configuration with live restore option
+// reloadLiveRestore updates configuration with live retore option
 // and updates the passed attributes
 func (daemon *Daemon) reloadLiveRestore(conf *config.Config, attributes map[string]string) error {
 	// update corresponding configuration
diff --git a/vendor/github.com/docker/docker/daemon/rename.go b/vendor/github.com/docker/docker/daemon/rename.go
index 6b099018f..2b2c48b29 100644
--- a/vendor/github.com/docker/docker/daemon/rename.go
+++ b/vendor/github.com/docker/docker/daemon/rename.go
@@ -74,8 +74,6 @@ func (daemon *Daemon) ContainerRename(oldName, newName string) error {
 				daemon.containersReplica.ReleaseName(newName + k)
 			}
 			daemon.releaseName(newName)
-		} else {
-			daemon.releaseName(oldName)
 		}
 	}()
 
@@ -83,6 +81,7 @@ func (daemon *Daemon) ContainerRename(oldName, newName string) error {
 		daemon.linkIndex.unlink(oldName+k, v, container)
 		daemon.containersReplica.ReleaseName(oldName + k)
 	}
+	daemon.releaseName(oldName)
 	if err = container.CheckpointTo(daemon.containersReplica); err != nil {
 		return err
 	}
diff --git a/vendor/github.com/docker/docker/daemon/start.go b/vendor/github.com/docker/docker/daemon/start.go
index f8a0dbf20..c00bd9ceb 100644
--- a/vendor/github.com/docker/docker/daemon/start.go
+++ b/vendor/github.com/docker/docker/daemon/start.go
@@ -216,7 +216,7 @@ func (daemon *Daemon) containerStart(container *container.Container, checkpoint
 func (daemon *Daemon) Cleanup(container *container.Container) {
 	daemon.releaseNetwork(container)
 
-	if err := container.UnmountIpcMount(); err != nil {
+	if err := container.UnmountIpcMount(detachMounted); err != nil {
 		logrus.Warnf("%s cleanup: failed to unmount IPC: %s", container.ID, err)
 	}
 
diff --git a/vendor/github.com/docker/docker/daemon/volumes_unix.go b/vendor/github.com/docker/docker/daemon/volumes_unix.go
index 5b47c4661..5ddb926de 100644
--- a/vendor/github.com/docker/docker/daemon/volumes_unix.go
+++ b/vendor/github.com/docker/docker/daemon/volumes_unix.go
@@ -9,7 +9,6 @@ import (
 	"strconv"
 	"strings"
 
-	mounttypes "github.com/docker/docker/api/types/mount"
 	"github.com/docker/docker/container"
 	"github.com/docker/docker/pkg/fileutils"
 	"github.com/docker/docker/pkg/mount"
@@ -59,9 +58,6 @@ func (daemon *Daemon) setupMounts(c *container.Container) ([]container.Mount, er
 				Writable:    m.RW,
 				Propagation: string(m.Propagation),
 			}
-			if m.Spec.Type == mounttypes.TypeBind && m.Spec.BindOptions != nil {
-				mnt.NonRecursive = m.Spec.BindOptions.NonRecursive
-			}
 			if m.Volume != nil {
 				attributes := map[string]string{
 					"driver":      m.Volume.DriverName(),
@@ -133,15 +129,11 @@ func (daemon *Daemon) mountVolumes(container *container.Container) error {
 			return err
 		}
 
-		bindMode := "rbind"
-		if m.NonRecursive {
-			bindMode = "bind"
-		}
-		writeMode := "ro"
+		opts := "rbind,ro"
 		if m.Writable {
-			writeMode = "rw"
+			opts = "rbind,rw"
 		}
-		opts := strings.Join([]string{bindMode, writeMode}, ",")
+
 		if err := mount.Mount(m.Source, dest, bindMountType, opts); err != nil {
 			return err
 		}
diff --git a/vendor/github.com/docker/docker/distribution/errors.go b/vendor/github.com/docker/docker/distribution/errors.go
index 9dc5955f2..e2913d45d 100644
--- a/vendor/github.com/docker/docker/distribution/errors.go
+++ b/vendor/github.com/docker/docker/distribution/errors.go
@@ -14,7 +14,6 @@ import (
 	"github.com/docker/distribution/registry/client/auth"
 	"github.com/docker/docker/distribution/xfer"
 	"github.com/docker/docker/errdefs"
-	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 )
 
@@ -71,11 +70,11 @@ func (e notFoundError) Error() string {
 	switch e.cause.Code {
 	case errcode.ErrorCodeDenied:
 		// ErrorCodeDenied is used when access to the repository was denied
-		return errors.Wrapf(e.cause, "pull access denied for %s, repository does not exist or may require 'docker login'", reference.FamiliarName(e.ref)).Error()
+		return fmt.Sprintf("pull access denied for %s, repository does not exist or may require 'docker login'", reference.FamiliarName(e.ref))
 	case v2.ErrorCodeManifestUnknown:
-		return errors.Wrapf(e.cause, "manifest for %s not found", reference.FamiliarString(e.ref)).Error()
+		return fmt.Sprintf("manifest for %s not found", reference.FamiliarString(e.ref))
 	case v2.ErrorCodeNameUnknown:
-		return errors.Wrapf(e.cause, "repository %s not found", reference.FamiliarName(e.ref)).Error()
+		return fmt.Sprintf("repository %s not found", reference.FamiliarName(e.ref))
 	}
 	// Shouldn't get here, but this is better than returning an empty string
 	return e.cause.Message
diff --git a/vendor/github.com/docker/docker/dockerversion/useragent.go b/vendor/github.com/docker/docker/dockerversion/useragent.go
index afbdcd858..2eceb6fa9 100644
--- a/vendor/github.com/docker/docker/dockerversion/useragent.go
+++ b/vendor/github.com/docker/docker/dockerversion/useragent.go
@@ -10,7 +10,7 @@ import (
 )
 
 // UAStringKey is used as key type for user-agent string in net/context struct
-type UAStringKey struct{}
+const UAStringKey = "upstream-user-agent"
 
 // DockerUserAgent is the User-Agent the Docker client uses to identify itself.
 // In accordance with RFC 7231 (5.5.3) is of the form:
@@ -39,9 +39,9 @@ func DockerUserAgent(ctx context.Context) string {
 func getUserAgentFromContext(ctx context.Context) string {
 	var upstreamUA string
 	if ctx != nil {
-		var ki interface{} = ctx.Value(UAStringKey{})
+		var ki interface{} = ctx.Value(UAStringKey)
 		if ki != nil {
-			upstreamUA = ctx.Value(UAStringKey{}).(string)
+			upstreamUA = ctx.Value(UAStringKey).(string)
 		}
 	}
 	return upstreamUA
diff --git a/vendor/github.com/docker/docker/dockerversion/version_lib.go b/vendor/github.com/docker/docker/dockerversion/version_lib.go
index b7d465044..5d9b3fdd2 100644
--- a/vendor/github.com/docker/docker/dockerversion/version_lib.go
+++ b/vendor/github.com/docker/docker/dockerversion/version_lib.go
@@ -4,7 +4,7 @@
 package dockerversion // import "github.com/docker/docker/dockerversion"
 
 // Default build-time variable for library-import.
-// This file is overridden on build with build-time information.
+// This file is overridden on build with build-time informations.
 const (
 	GitCommit             = "library-import"
 	Version               = "library-import"
diff --git a/vendor/github.com/docker/docker/errdefs/helpers.go b/vendor/github.com/docker/docker/errdefs/helpers.go
index a28881caf..6169c2bc6 100644
--- a/vendor/github.com/docker/docker/errdefs/helpers.go
+++ b/vendor/github.com/docker/docker/errdefs/helpers.go
@@ -12,8 +12,8 @@ func (e errNotFound) Cause() error {
 
 // NotFound is a helper to create an error of the class with the same name from any error type
 func NotFound(err error) error {
-	if err == nil || IsNotFound(err) {
-		return err
+	if err == nil {
+		return nil
 	}
 	return errNotFound{err}
 }
@@ -28,8 +28,8 @@ func (e errInvalidParameter) Cause() error {
 
 // InvalidParameter is a helper to create an error of the class with the same name from any error type
 func InvalidParameter(err error) error {
-	if err == nil || IsInvalidParameter(err) {
-		return err
+	if err == nil {
+		return nil
 	}
 	return errInvalidParameter{err}
 }
@@ -44,8 +44,8 @@ func (e errConflict) Cause() error {
 
 // Conflict is a helper to create an error of the class with the same name from any error type
 func Conflict(err error) error {
-	if err == nil || IsConflict(err) {
-		return err
+	if err == nil {
+		return nil
 	}
 	return errConflict{err}
 }
@@ -60,8 +60,8 @@ func (e errUnauthorized) Cause() error {
 
 // Unauthorized is a helper to create an error of the class with the same name from any error type
 func Unauthorized(err error) error {
-	if err == nil || IsUnauthorized(err) {
-		return err
+	if err == nil {
+		return nil
 	}
 	return errUnauthorized{err}
 }
@@ -76,9 +76,6 @@ func (e errUnavailable) Cause() error {
 
 // Unavailable is a helper to create an error of the class with the same name from any error type
 func Unavailable(err error) error {
-	if err == nil || IsUnavailable(err) {
-		return err
-	}
 	return errUnavailable{err}
 }
 
@@ -92,8 +89,8 @@ func (e errForbidden) Cause() error {
 
 // Forbidden is a helper to create an error of the class with the same name from any error type
 func Forbidden(err error) error {
-	if err == nil || IsForbidden(err) {
-		return err
+	if err == nil {
+		return nil
 	}
 	return errForbidden{err}
 }
@@ -108,8 +105,8 @@ func (e errSystem) Cause() error {
 
 // System is a helper to create an error of the class with the same name from any error type
 func System(err error) error {
-	if err == nil || IsSystem(err) {
-		return err
+	if err == nil {
+		return nil
 	}
 	return errSystem{err}
 }
@@ -124,8 +121,8 @@ func (e errNotModified) Cause() error {
 
 // NotModified is a helper to create an error of the class with the same name from any error type
 func NotModified(err error) error {
-	if err == nil || IsNotModified(err) {
-		return err
+	if err == nil {
+		return nil
 	}
 	return errNotModified{err}
 }
@@ -140,8 +137,8 @@ func (e errAlreadyExists) Cause() error {
 
 // AlreadyExists is a helper to create an error of the class with the same name from any error type
 func AlreadyExists(err error) error {
-	if err == nil || IsAlreadyExists(err) {
-		return err
+	if err == nil {
+		return nil
 	}
 	return errAlreadyExists{err}
 }
@@ -156,8 +153,8 @@ func (e errNotImplemented) Cause() error {
 
 // NotImplemented is a helper to create an error of the class with the same name from any error type
 func NotImplemented(err error) error {
-	if err == nil || IsNotImplemented(err) {
-		return err
+	if err == nil {
+		return nil
 	}
 	return errNotImplemented{err}
 }
@@ -172,8 +169,8 @@ func (e errUnknown) Cause() error {
 
 // Unknown is a helper to create an error of the class with the same name from any error type
 func Unknown(err error) error {
-	if err == nil || IsUnknown(err) {
-		return err
+	if err == nil {
+		return nil
 	}
 	return errUnknown{err}
 }
@@ -188,8 +185,8 @@ func (e errCancelled) Cause() error {
 
 // Cancelled is a helper to create an error of the class with the same name from any error type
 func Cancelled(err error) error {
-	if err == nil || IsCancelled(err) {
-		return err
+	if err == nil {
+		return nil
 	}
 	return errCancelled{err}
 }
@@ -204,8 +201,8 @@ func (e errDeadline) Cause() error {
 
 // Deadline is a helper to create an error of the class with the same name from any error type
 func Deadline(err error) error {
-	if err == nil || IsDeadline(err) {
-		return err
+	if err == nil {
+		return nil
 	}
 	return errDeadline{err}
 }
@@ -220,8 +217,8 @@ func (e errDataLoss) Cause() error {
 
 // DataLoss is a helper to create an error of the class with the same name from any error type
 func DataLoss(err error) error {
-	if err == nil || IsDataLoss(err) {
-		return err
+	if err == nil {
+		return nil
 	}
 	return errDataLoss{err}
 }
diff --git a/vendor/github.com/docker/docker/hack/integration-cli-on-swarm/agent/worker/executor.go b/vendor/github.com/docker/docker/hack/integration-cli-on-swarm/agent/worker/executor.go
index d37b6533f..eef80d461 100644
--- a/vendor/github.com/docker/docker/hack/integration-cli-on-swarm/agent/worker/executor.go
+++ b/vendor/github.com/docker/docker/hack/integration-cli-on-swarm/agent/worker/executor.go
@@ -29,7 +29,7 @@ func dryTestChunkExecutor() testChunkExecutor {
 // service via bind-mounted API socket so as to execute the test chunk
 func privilegedTestChunkExecutor(autoRemove bool) testChunkExecutor {
 	return func(image string, tests []string) (int64, string, error) {
-		cli, err := client.NewClientWithOpts(client.FromEnv)
+		cli, err := client.NewEnvClient()
 		if err != nil {
 			return 0, "", err
 		}
diff --git a/vendor/github.com/docker/docker/hack/integration-cli-on-swarm/agent/worker/worker.go b/vendor/github.com/docker/docker/hack/integration-cli-on-swarm/agent/worker/worker.go
index f2b1e7d32..ea8bb3fe2 100644
--- a/vendor/github.com/docker/docker/hack/integration-cli-on-swarm/agent/worker/worker.go
+++ b/vendor/github.com/docker/docker/hack/integration-cli-on-swarm/agent/worker/worker.go
@@ -40,7 +40,7 @@ func xmain() error {
 }
 
 func handle(workerImageDigest string, executor testChunkExecutor) error {
-	log.Print("Waiting for a funker request")
+	log.Printf("Waiting for a funker request")
 	return funker.Handle(func(args *types.Args) types.Result {
 		log.Printf("Executing chunk %d, contains %d test filters",
 			args.ChunkID, len(args.Tests))
diff --git a/vendor/github.com/docker/docker/hack/integration-cli-on-swarm/host/dockercmd.go b/vendor/github.com/docker/docker/hack/integration-cli-on-swarm/host/dockercmd.go
index b828f6a50..c08b763a2 100644
--- a/vendor/github.com/docker/docker/hack/integration-cli-on-swarm/host/dockercmd.go
+++ b/vendor/github.com/docker/docker/hack/integration-cli-on-swarm/host/dockercmd.go
@@ -15,6 +15,7 @@ func system(commands [][]string) error {
 		cmd := exec.Command(c[0], c[1:]...)
 		cmd.Stdout = os.Stdout
 		cmd.Stderr = os.Stderr
+		cmd.Env = os.Environ()
 		if err := cmd.Run(); err != nil {
 			return err
 		}
@@ -22,7 +23,7 @@ func system(commands [][]string) error {
 	return nil
 }
 
-func pushImage(_ *client.Client, remote, local string) error {
+func pushImage(unusedCli *client.Client, remote, local string) error {
 	// FIXME: eliminate os/exec (but it is hard to pass auth without os/exec ...)
 	return system([][]string{
 		{"docker", "image", "tag", local, remote},
@@ -30,7 +31,7 @@ func pushImage(_ *client.Client, remote, local string) error {
 	})
 }
 
-func deployStack(_ *client.Client, stackName, composeFilePath string) error {
+func deployStack(unusedCli *client.Client, stackName, composeFilePath string) error {
 	// FIXME: eliminate os/exec (but stack is implemented in CLI ...)
 	return system([][]string{
 		{"docker", "stack", "deploy",
@@ -40,7 +41,7 @@ func deployStack(_ *client.Client, stackName, composeFilePath string) error {
 	})
 }
 
-func hasStack(_ *client.Client, stackName string) bool {
+func hasStack(unusedCli *client.Client, stackName string) bool {
 	// FIXME: eliminate os/exec (but stack is implemented in CLI ...)
 	out, err := exec.Command("docker", "stack", "ls").CombinedOutput()
 	if err != nil {
@@ -50,7 +51,7 @@ func hasStack(_ *client.Client, stackName string) bool {
 	return strings.Contains(string(out), stackName)
 }
 
-func removeStack(_ *client.Client, stackName string) error {
+func removeStack(unusedCli *client.Client, stackName string) error {
 	// FIXME: eliminate os/exec (but stack is implemented in CLI ...)
 	if err := system([][]string{
 		{"docker", "stack", "rm", stackName},
diff --git a/vendor/github.com/docker/docker/hack/integration-cli-on-swarm/host/host.go b/vendor/github.com/docker/docker/hack/integration-cli-on-swarm/host/host.go
index a21c51c77..fdc2a83e7 100644
--- a/vendor/github.com/docker/docker/hack/integration-cli-on-swarm/host/host.go
+++ b/vendor/github.com/docker/docker/hack/integration-cli-on-swarm/host/host.go
@@ -50,7 +50,7 @@ func xmain() (int, error) {
 	if *randSeed == int64(0) {
 		*randSeed = time.Now().UnixNano()
 	}
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	if err != nil {
 		return 1, err
 	}
@@ -100,7 +100,7 @@ func xmain() (int, error) {
 	}
 	logrus.Infof("Deploying stack %s from %s", defaultStackName, compose)
 	defer func() {
-		logrus.Info("NOTE: You may want to inspect or clean up following resources:")
+		logrus.Infof("NOTE: You may want to inspect or clean up following resources:")
 		logrus.Infof(" - Stack: %s", defaultStackName)
 		logrus.Infof(" - Volume: %s", defaultVolumeName)
 		logrus.Infof(" - Compose file: %s", compose)
@@ -170,7 +170,7 @@ func waitForMasterUp(cli *client.Client, stackName string) (string, error) {
 		return "", err
 	}
 	if len(masters) == 0 {
-		return "", fmt.Errorf("master not running in stack %s", stackName)
+		return "", fmt.Errorf("master not running in stack %s?", stackName)
 	}
 	return masters[0].ID, nil
 }
diff --git a/vendor/github.com/docker/docker/integration-cli/check_test.go b/vendor/github.com/docker/docker/integration-cli/check_test.go
index 0abf18154..2282967ee 100644
--- a/vendor/github.com/docker/docker/integration-cli/check_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/check_test.go
@@ -125,7 +125,7 @@ func (s *DockerRegistrySuite) OnTimeout(c *check.C) {
 }
 
 func (s *DockerRegistrySuite) SetUpTest(c *check.C) {
-	testRequires(c, DaemonIsLinux, RegistryHosting, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, RegistryHosting, SameHostDaemon)
 	s.reg = registry.NewV2(c)
 	s.reg.WaitReady(c)
 	s.d = daemon.New(c, dockerBinary, dockerdBinary, testdaemon.WithEnvironment(testEnv.Execution))
@@ -158,7 +158,7 @@ func (s *DockerSchema1RegistrySuite) OnTimeout(c *check.C) {
 }
 
 func (s *DockerSchema1RegistrySuite) SetUpTest(c *check.C) {
-	testRequires(c, DaemonIsLinux, RegistryHosting, NotArm64, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, RegistryHosting, NotArm64, SameHostDaemon)
 	s.reg = registry.NewV2(c, registry.Schema1)
 	s.reg.WaitReady(c)
 	s.d = daemon.New(c, dockerBinary, dockerdBinary, testdaemon.WithEnvironment(testEnv.Execution))
@@ -191,7 +191,7 @@ func (s *DockerRegistryAuthHtpasswdSuite) OnTimeout(c *check.C) {
 }
 
 func (s *DockerRegistryAuthHtpasswdSuite) SetUpTest(c *check.C) {
-	testRequires(c, DaemonIsLinux, RegistryHosting, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, RegistryHosting, SameHostDaemon)
 	s.reg = registry.NewV2(c, registry.Htpasswd)
 	s.reg.WaitReady(c)
 	s.d = daemon.New(c, dockerBinary, dockerdBinary, testdaemon.WithEnvironment(testEnv.Execution))
@@ -226,7 +226,7 @@ func (s *DockerRegistryAuthTokenSuite) OnTimeout(c *check.C) {
 }
 
 func (s *DockerRegistryAuthTokenSuite) SetUpTest(c *check.C) {
-	testRequires(c, DaemonIsLinux, RegistryHosting, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, RegistryHosting, SameHostDaemon)
 	s.d = daemon.New(c, dockerBinary, dockerdBinary, testdaemon.WithEnvironment(testEnv.Execution))
 }
 
@@ -266,12 +266,12 @@ func (s *DockerDaemonSuite) OnTimeout(c *check.C) {
 }
 
 func (s *DockerDaemonSuite) SetUpTest(c *check.C) {
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
 	s.d = daemon.New(c, dockerBinary, dockerdBinary, testdaemon.WithEnvironment(testEnv.Execution))
 }
 
 func (s *DockerDaemonSuite) TearDownTest(c *check.C) {
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
 	if s.d != nil {
 		s.d.Stop(c)
 	}
@@ -318,7 +318,7 @@ func (s *DockerSwarmSuite) OnTimeout(c *check.C) {
 }
 
 func (s *DockerSwarmSuite) SetUpTest(c *check.C) {
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
 }
 
 func (s *DockerSwarmSuite) AddDaemon(c *check.C, joinSwarm, manager bool) *daemon.Daemon {
@@ -333,7 +333,7 @@ func (s *DockerSwarmSuite) AddDaemon(c *check.C, joinSwarm, manager bool) *daemo
 			d.StartAndSwarmInit(c)
 		}
 	} else {
-		d.StartNode(c)
+		d.StartWithBusybox(c, "--iptables=false", "--swarm-default-advertise-addr=lo")
 	}
 
 	s.portIndex++
diff --git a/vendor/github.com/docker/docker/integration-cli/daemon/daemon_swarm.go b/vendor/github.com/docker/docker/integration-cli/daemon/daemon_swarm.go
index f43bd3b29..4a6ce8a5c 100644
--- a/vendor/github.com/docker/docker/integration-cli/daemon/daemon_swarm.go
+++ b/vendor/github.com/docker/docker/integration-cli/daemon/daemon_swarm.go
@@ -67,7 +67,8 @@ func (d *Daemon) CheckServiceUpdateState(service string) func(*check.C) (interfa
 // CheckPluginRunning returns the runtime state of the plugin
 func (d *Daemon) CheckPluginRunning(plugin string) func(c *check.C) (interface{}, check.CommentInterface) {
 	return func(c *check.C) (interface{}, check.CommentInterface) {
-		apiclient := d.NewClientT(c)
+		apiclient, err := d.NewClient()
+		assert.NilError(c, err)
 		resp, _, err := apiclient.PluginInspectWithRaw(context.Background(), plugin)
 		if client.IsErrNotFound(err) {
 			return false, check.Commentf("%v", err)
@@ -80,7 +81,8 @@ func (d *Daemon) CheckPluginRunning(plugin string) func(c *check.C) (interface{}
 // CheckPluginImage returns the runtime state of the plugin
 func (d *Daemon) CheckPluginImage(plugin string) func(c *check.C) (interface{}, check.CommentInterface) {
 	return func(c *check.C) (interface{}, check.CommentInterface) {
-		apiclient := d.NewClientT(c)
+		apiclient, err := d.NewClient()
+		assert.NilError(c, err)
 		resp, _, err := apiclient.PluginInspectWithRaw(context.Background(), plugin)
 		if client.IsErrNotFound(err) {
 			return false, check.Commentf("%v", err)
@@ -100,7 +102,8 @@ func (d *Daemon) CheckServiceTasks(service string) func(*check.C) (interface{},
 
 // CheckRunningTaskNetworks returns the number of times each network is referenced from a task.
 func (d *Daemon) CheckRunningTaskNetworks(c *check.C) (interface{}, check.CommentInterface) {
-	cli := d.NewClientT(c)
+	cli, err := d.NewClient()
+	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
 	filterArgs := filters.NewArgs()
@@ -124,7 +127,8 @@ func (d *Daemon) CheckRunningTaskNetworks(c *check.C) (interface{}, check.Commen
 
 // CheckRunningTaskImages returns the times each image is running as a task.
 func (d *Daemon) CheckRunningTaskImages(c *check.C) (interface{}, check.CommentInterface) {
-	cli := d.NewClientT(c)
+	cli, err := d.NewClient()
+	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
 	filterArgs := filters.NewArgs()
@@ -173,7 +177,8 @@ func (d *Daemon) CheckControlAvailable(c *check.C) (interface{}, check.CommentIn
 
 // CheckLeader returns whether there is a leader on the swarm or not
 func (d *Daemon) CheckLeader(c *check.C) (interface{}, check.CommentInterface) {
-	cli := d.NewClientT(c)
+	cli, err := d.NewClient()
+	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
 	errList := check.Commentf("could not get node list")
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_api_attach_test.go b/vendor/github.com/docker/docker/integration-cli/docker_api_attach_test.go
index ed03f3333..26633841d 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_api_attach_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_api_attach_test.go
@@ -177,7 +177,7 @@ func (s *DockerSuite) TestPostContainersAttach(c *check.C) {
 	expectTimeout(conn, br, "stdout")
 
 	// Test the client API
-	client, err := client.NewClientWithOpts(client.FromEnv)
+	client, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer client.Close()
 
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_api_build_test.go b/vendor/github.com/docker/docker/integration-cli/docker_api_build_test.go
index c6e39696c..144acbd04 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_api_build_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_api_build_test.go
@@ -298,7 +298,7 @@ func (s *DockerSuite) TestBuildOnBuildCache(c *check.C) {
 
 		out, err := request.ReadBody(body)
 		assert.NilError(c, err)
-		assert.Assert(c, is.Contains(string(out), "Successfully built"))
+		assert.Check(c, is.Contains(string(out), "Successfully built"))
 		return out
 	}
 
@@ -313,7 +313,7 @@ func (s *DockerSuite) TestBuildOnBuildCache(c *check.C) {
 	out := build(dockerfile)
 
 	imageIDs := getImageIDsFromBuild(c, out)
-	assert.Assert(c, is.Len(imageIDs, 2))
+	assert.Check(c, is.Len(imageIDs, 2))
 	parentID, childID := imageIDs[0], imageIDs[1]
 
 	client := testEnv.APIClient()
@@ -457,10 +457,8 @@ COPY file /file`
 
 		out, err := request.ReadBody(body)
 		assert.NilError(c, err)
-		assert.Assert(c, is.Contains(string(out), "Successfully built"))
 
 		ids := getImageIDsFromBuild(c, out)
-		assert.Assert(c, is.Len(ids, 1))
 		return ids[len(ids)-1]
 	}
 
@@ -498,10 +496,8 @@ ADD file /file`
 
 		out, err := request.ReadBody(body)
 		assert.NilError(c, err)
-		assert.Assert(c, is.Contains(string(out), "Successfully built"))
 
 		ids := getImageIDsFromBuild(c, out)
-		assert.Assert(c, is.Len(ids, 1))
 		return ids[len(ids)-1]
 	}
 
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_api_containers_test.go b/vendor/github.com/docker/docker/integration-cli/docker_api_containers_test.go
index 25ddc43e2..ef6789410 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_api_containers_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_api_containers_test.go
@@ -43,7 +43,7 @@ func (s *DockerSuite) TestContainerAPIGetAll(c *check.C) {
 	name := "getall"
 	dockerCmd(c, "run", "--name", name, "busybox", "true")
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -62,7 +62,7 @@ func (s *DockerSuite) TestContainerAPIGetJSONNoFieldsOmitted(c *check.C) {
 	startCount := getContainerCount(c)
 	dockerCmd(c, "run", "busybox", "true")
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -111,7 +111,7 @@ func (s *DockerSuite) TestContainerAPIPsOmitFields(c *check.C) {
 	port := 80
 	runSleepingContainer(c, "--name", name, "--expose", strconv.Itoa(port))
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -143,7 +143,7 @@ func (s *DockerSuite) TestContainerAPIGetExport(c *check.C) {
 	name := "exportcontainer"
 	dockerCmd(c, "run", "--name", name, "busybox", "touch", "/test")
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -170,7 +170,7 @@ func (s *DockerSuite) TestContainerAPIGetChanges(c *check.C) {
 	name := "changescontainer"
 	dockerCmd(c, "run", "--name", name, "busybox", "rm", "/etc/passwd")
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -200,7 +200,7 @@ func (s *DockerSuite) TestGetContainerStats(c *check.C) {
 
 	bc := make(chan b, 1)
 	go func() {
-		cli, err := client.NewClientWithOpts(client.FromEnv)
+		cli, err := client.NewEnvClient()
 		c.Assert(err, checker.IsNil)
 		defer cli.Close()
 
@@ -234,7 +234,7 @@ func (s *DockerSuite) TestGetContainerStatsRmRunning(c *check.C) {
 	buf := &ChannelBuffer{C: make(chan []byte, 1)}
 	defer buf.Close()
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -305,7 +305,7 @@ func (s *DockerSuite) TestGetContainerStatsStream(c *check.C) {
 
 	bc := make(chan b, 1)
 	go func() {
-		cli, err := client.NewClientWithOpts(client.FromEnv)
+		cli, err := client.NewEnvClient()
 		c.Assert(err, checker.IsNil)
 		defer cli.Close()
 
@@ -347,7 +347,7 @@ func (s *DockerSuite) TestGetContainerStatsNoStream(c *check.C) {
 	bc := make(chan b, 1)
 
 	go func() {
-		cli, err := client.NewClientWithOpts(client.FromEnv)
+		cli, err := client.NewEnvClient()
 		c.Assert(err, checker.IsNil)
 		defer cli.Close()
 
@@ -384,7 +384,7 @@ func (s *DockerSuite) TestGetStoppedContainerStats(c *check.C) {
 	// We expect an immediate response, but if it's not immediate, the test would hang, so put it in a goroutine
 	// below we'll check this on a timeout.
 	go func() {
-		cli, err := client.NewClientWithOpts(client.FromEnv)
+		cli, err := client.NewEnvClient()
 		c.Assert(err, checker.IsNil)
 		defer cli.Close()
 
@@ -412,7 +412,7 @@ func (s *DockerSuite) TestContainerAPIPause(c *check.C) {
 	out := cli.DockerCmd(c, "run", "-d", "busybox", "sleep", "30").Combined()
 	ContainerID := strings.TrimSpace(out)
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -438,7 +438,7 @@ func (s *DockerSuite) TestContainerAPITop(c *check.C) {
 	id := strings.TrimSpace(string(out))
 	c.Assert(waitRun(id), checker.IsNil)
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -461,7 +461,7 @@ func (s *DockerSuite) TestContainerAPITopWindows(c *check.C) {
 	id := strings.TrimSpace(string(out))
 	c.Assert(waitRun(id), checker.IsNil)
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -490,7 +490,7 @@ func (s *DockerSuite) TestContainerAPICommit(c *check.C) {
 	cName := "testapicommit"
 	dockerCmd(c, "run", "--name="+cName, "busybox", "/bin/sh", "-c", "touch /test")
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -512,7 +512,7 @@ func (s *DockerSuite) TestContainerAPICommitWithLabelInConfig(c *check.C) {
 	cName := "testapicommitwithconfig"
 	dockerCmd(c, "run", "--name="+cName, "busybox", "/bin/sh", "-c", "touch /test")
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -559,7 +559,7 @@ func (s *DockerSuite) TestContainerAPIBadPort(c *check.C) {
 		},
 	}
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -573,7 +573,7 @@ func (s *DockerSuite) TestContainerAPICreate(c *check.C) {
 		Cmd:   []string{"/bin/sh", "-c", "touch /test && ls /test"},
 	}
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -586,7 +586,7 @@ func (s *DockerSuite) TestContainerAPICreate(c *check.C) {
 
 func (s *DockerSuite) TestContainerAPICreateEmptyConfig(c *check.C) {
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -610,7 +610,7 @@ func (s *DockerSuite) TestContainerAPICreateMultipleNetworksConfig(c *check.C) {
 		},
 	}
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -632,7 +632,7 @@ func (s *DockerSuite) TestContainerAPICreateWithHostName(c *check.C) {
 		Domainname: domainName,
 	}
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -668,7 +668,7 @@ func UtilCreateNetworkMode(c *check.C, networkMode containertypes.NetworkMode) {
 		NetworkMode: networkMode,
 	}
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -695,7 +695,7 @@ func (s *DockerSuite) TestContainerAPICreateWithCpuSharesCpuset(c *check.C) {
 		},
 	}
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -943,7 +943,7 @@ func (s *DockerSuite) TestContainerAPIRename(c *check.C) {
 	containerID := strings.TrimSpace(out)
 	newName := "TestContainerAPIRenameNew"
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -958,7 +958,7 @@ func (s *DockerSuite) TestContainerAPIKill(c *check.C) {
 	name := "test-api-kill"
 	runSleepingContainer(c, "-i", "--name", name)
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -972,7 +972,7 @@ func (s *DockerSuite) TestContainerAPIKill(c *check.C) {
 func (s *DockerSuite) TestContainerAPIRestart(c *check.C) {
 	name := "test-api-restart"
 	runSleepingContainer(c, "-di", "--name", name)
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -989,7 +989,7 @@ func (s *DockerSuite) TestContainerAPIRestartNotimeoutParam(c *check.C) {
 	id := strings.TrimSpace(out)
 	c.Assert(waitRun(id), checker.IsNil)
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -1007,7 +1007,7 @@ func (s *DockerSuite) TestContainerAPIStart(c *check.C) {
 		OpenStdin: true,
 	}
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -1030,7 +1030,7 @@ func (s *DockerSuite) TestContainerAPIStop(c *check.C) {
 	runSleepingContainer(c, "-i", "--name", name)
 	timeout := 30 * time.Second
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -1053,7 +1053,7 @@ func (s *DockerSuite) TestContainerAPIWait(c *check.C) {
 	}
 	dockerCmd(c, "run", "--name", name, "busybox", sleepCmd, "2")
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -1171,7 +1171,7 @@ func (s *DockerSuite) TestContainerAPIDelete(c *check.C) {
 
 	dockerCmd(c, "stop", id)
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -1180,7 +1180,7 @@ func (s *DockerSuite) TestContainerAPIDelete(c *check.C) {
 }
 
 func (s *DockerSuite) TestContainerAPIDeleteNotExist(c *check.C) {
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -1197,7 +1197,7 @@ func (s *DockerSuite) TestContainerAPIDeleteForce(c *check.C) {
 		Force: true,
 	}
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -1225,7 +1225,7 @@ func (s *DockerSuite) TestContainerAPIDeleteRemoveLinks(c *check.C) {
 		RemoveLinks: true,
 	}
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -1242,7 +1242,7 @@ func (s *DockerSuite) TestContainerAPIDeleteConflict(c *check.C) {
 	id := strings.TrimSpace(out)
 	c.Assert(waitRun(id), checker.IsNil)
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -1252,7 +1252,7 @@ func (s *DockerSuite) TestContainerAPIDeleteConflict(c *check.C) {
 }
 
 func (s *DockerSuite) TestContainerAPIDeleteRemoveVolume(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 
 	vol := "/testvolume"
 	if testEnv.OSType == "windows" {
@@ -1274,7 +1274,7 @@ func (s *DockerSuite) TestContainerAPIDeleteRemoveVolume(c *check.C) {
 		RemoveVolumes: true,
 	}
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -1312,7 +1312,7 @@ func (s *DockerSuite) TestContainerAPIPostContainerStop(c *check.C) {
 	containerID := strings.TrimSpace(out)
 	c.Assert(waitRun(containerID), checker.IsNil)
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -1329,7 +1329,7 @@ func (s *DockerSuite) TestPostContainerAPICreateWithStringOrSliceEntrypoint(c *c
 		Cmd:        []string{"hello", "world"},
 	}
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -1356,7 +1356,7 @@ func (s *DockerSuite) TestPostContainersCreateWithStringOrSliceCmd(c *check.C) {
 		Cmd:   []string{"echo", "hello", "world"},
 	}
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -1397,7 +1397,7 @@ func (s *DockerSuite) TestPostContainersCreateWithStringOrSliceCapAddDrop(c *che
 		CapDrop: []string{"SETGID"},
 	}
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -1426,7 +1426,7 @@ func (s *DockerSuite) TestPutContainerArchiveErrSymlinkInVolumeToReadOnlyRootfs(
 	// Windows does not support read-only rootfs
 	// Requires local volume mount bind.
 	// --read-only + userns has remount issues
-	testRequires(c, testEnv.IsLocalDaemon, NotUserNamespace, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, NotUserNamespace, DaemonIsLinux)
 
 	testVol := getTestDir(c, "test-put-container-archive-err-symlink-in-volume-to-read-only-rootfs-")
 	defer os.RemoveAll(testVol)
@@ -1453,7 +1453,7 @@ func (s *DockerSuite) TestPostContainersCreateWithWrongCpusetValues(c *check.C)
 	// Not supported on Windows
 	testRequires(c, DaemonIsLinux)
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -1492,7 +1492,7 @@ func (s *DockerSuite) TestPostContainersCreateShmSizeNegative(c *check.C) {
 		ShmSize: -1,
 	}
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -1509,7 +1509,7 @@ func (s *DockerSuite) TestPostContainersCreateShmSizeHostConfigOmitted(c *check.
 		Cmd:   []string{"mount"},
 	}
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -1536,7 +1536,7 @@ func (s *DockerSuite) TestPostContainersCreateShmSizeOmitted(c *check.C) {
 		Cmd:   []string{"mount"},
 	}
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -1567,7 +1567,7 @@ func (s *DockerSuite) TestPostContainersCreateWithShmSize(c *check.C) {
 		ShmSize: 1073741824,
 	}
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -1593,7 +1593,7 @@ func (s *DockerSuite) TestPostContainersCreateMemorySwappinessHostConfigOmitted(
 		Image: "busybox",
 	}
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -1623,7 +1623,7 @@ func (s *DockerSuite) TestPostContainersCreateWithOomScoreAdjInvalidRange(c *che
 		OomScoreAdj: 1001,
 	}
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -1646,7 +1646,7 @@ func (s *DockerSuite) TestPostContainersCreateWithOomScoreAdjInvalidRange(c *che
 
 // test case for #22210 where an empty container name caused panic.
 func (s *DockerSuite) TestContainerAPIDeleteWithEmptyName(c *check.C) {
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -1666,7 +1666,7 @@ func (s *DockerSuite) TestContainerAPIStatsWithNetworkDisabled(c *check.C) {
 		NetworkDisabled: true,
 	}
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -1797,7 +1797,7 @@ func (s *DockerSuite) TestContainersAPICreateMountsValidation(c *check.C) {
 		},
 	}
 
-	if testEnv.IsLocalDaemon() {
+	if SameHostDaemon() {
 		tmpDir, err := ioutils.TempDir("", "test-mounts-api")
 		c.Assert(err, checker.IsNil)
 		defer os.RemoveAll(tmpDir)
@@ -1828,32 +1828,6 @@ func (s *DockerSuite) TestContainersAPICreateMountsValidation(c *check.C) {
 		}...)
 	}
 
-	if DaemonIsWindows() {
-		cases = append(cases, []testCase{
-			{
-				config: containertypes.Config{
-					Image: "busybox",
-				},
-				hostConfig: containertypes.HostConfig{
-					Mounts: []mounttypes.Mount{
-						{
-							Type:   "volume",
-							Source: "not-supported-on-windows",
-							Target: destPath,
-							VolumeOptions: &mounttypes.VolumeOptions{
-								DriverConfig: &mounttypes.Driver{
-									Name:    "local",
-									Options: map[string]string{"type": "tmpfs"},
-								},
-							},
-						},
-					},
-				},
-				msg: `options are not supported on this platform`,
-			},
-		}...)
-	}
-
 	if DaemonIsLinux() {
 		cases = append(cases, []testCase{
 			{
@@ -1861,83 +1835,14 @@ func (s *DockerSuite) TestContainersAPICreateMountsValidation(c *check.C) {
 					Image: "busybox",
 				},
 				hostConfig: containertypes.HostConfig{
-					Mounts: []mounttypes.Mount{
-						{
-							Type:   "volume",
-							Source: "missing-device-opt",
-							Target: destPath,
-							VolumeOptions: &mounttypes.VolumeOptions{
-								DriverConfig: &mounttypes.Driver{
-									Name:    "local",
-									Options: map[string]string{"foobar": "foobaz"},
-								},
-							},
-						},
-					},
-				},
-				msg: `invalid option: "foobar"`,
-			},
-			{
-				config: containertypes.Config{
-					Image: "busybox",
-				},
-				hostConfig: containertypes.HostConfig{
-					Mounts: []mounttypes.Mount{
-						{
-							Type:   "volume",
-							Source: "missing-device-opt",
-							Target: destPath,
-							VolumeOptions: &mounttypes.VolumeOptions{
-								DriverConfig: &mounttypes.Driver{
-									Name:    "local",
-									Options: map[string]string{"type": "tmpfs"},
-								},
-							},
-						},
-					},
-				},
-				msg: `missing required option: "device"`,
-			},
-			{
-				config: containertypes.Config{
-					Image: "busybox",
-				},
-				hostConfig: containertypes.HostConfig{
-					Mounts: []mounttypes.Mount{
-						{
-							Type:   "volume",
-							Source: "missing-type-opt",
-							Target: destPath,
-							VolumeOptions: &mounttypes.VolumeOptions{
-								DriverConfig: &mounttypes.Driver{
-									Name:    "local",
-									Options: map[string]string{"device": "tmpfs"},
-								},
-							},
-						},
-					},
-				},
-				msg: `missing required option: "type"`,
-			},
-			{
-				config: containertypes.Config{
-					Image: "busybox",
-				},
-				hostConfig: containertypes.HostConfig{
-					Mounts: []mounttypes.Mount{
-						{
-							Type:   "volume",
-							Source: "hello4",
-							Target: destPath,
-							VolumeOptions: &mounttypes.VolumeOptions{
-								DriverConfig: &mounttypes.Driver{
-									Name:    "local",
-									Options: map[string]string{"o": "size=1", "type": "tmpfs", "device": "tmpfs"},
-								},
-							},
-						},
-					},
-				},
+					Mounts: []mounttypes.Mount{{
+						Type:   "volume",
+						Source: "hello3",
+						Target: destPath,
+						VolumeOptions: &mounttypes.VolumeOptions{
+							DriverConfig: &mounttypes.Driver{
+								Name:    "local",
+								Options: map[string]string{"o": "size=1"}}}}}},
 				msg: "",
 			},
 			{
@@ -1964,6 +1869,7 @@ func (s *DockerSuite) TestContainersAPICreateMountsValidation(c *check.C) {
 						}}}},
 				msg: "",
 			},
+
 			{
 				config: containertypes.Config{
 					Image: "busybox",
@@ -1978,11 +1884,10 @@ func (s *DockerSuite) TestContainersAPICreateMountsValidation(c *check.C) {
 		}...)
 
 	}
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
-	// TODO add checks for statuscode returned by API
 	for i, x := range cases {
 		c.Logf("case %d", i)
 		_, err = cli.ContainerCreate(context.Background(), &x.config, &x.hostConfig, &networktypes.NetworkingConfig{}, "")
@@ -1995,7 +1900,7 @@ func (s *DockerSuite) TestContainersAPICreateMountsValidation(c *check.C) {
 }
 
 func (s *DockerSuite) TestContainerAPICreateMountsBindRead(c *check.C) {
-	testRequires(c, NotUserNamespace, testEnv.IsLocalDaemon)
+	testRequires(c, NotUserNamespace, SameHostDaemon)
 	// also with data in the host side
 	prefix, slash := getPrefixAndSlashFromDaemonPlatform()
 	destPath := prefix + slash + "foo"
@@ -2013,7 +1918,7 @@ func (s *DockerSuite) TestContainerAPICreateMountsBindRead(c *check.C) {
 			{Type: "bind", Source: tmpDir, Target: destPath},
 		},
 	}
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -2083,7 +1988,7 @@ func (s *DockerSuite) TestContainersAPICreateMountsCreate(c *check.C) {
 		},
 	}
 
-	if testEnv.IsLocalDaemon() {
+	if SameHostDaemon() {
 		// setup temp dir for testing binds
 		tmpDir1, err := ioutil.TempDir("", "test-mounts-api-1")
 		c.Assert(err, checker.IsNil)
@@ -2264,7 +2169,7 @@ func (s *DockerSuite) TestContainersAPICreateMountsTmpfs(c *check.C) {
 		},
 	}
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_api_containers_windows_test.go b/vendor/github.com/docker/docker/integration-cli/docker_api_containers_windows_test.go
index dc3fbefbf..c569574de 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_api_containers_windows_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_api_containers_windows_test.go
@@ -19,7 +19,7 @@ import (
 )
 
 func (s *DockerSuite) TestContainersAPICreateMountsBindNamedPipe(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsWindowsAtLeastBuild(16299)) // Named pipe support was added in RS3
+	testRequires(c, SameHostDaemon, DaemonIsWindowsAtLeastBuild(16299)) // Named pipe support was added in RS3
 
 	// Create a host pipe to map into the container
 	hostPipeName := fmt.Sprintf(`\\.\pipe\docker-cli-test-pipe-%x`, rand.Uint64())
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_api_create_test.go b/vendor/github.com/docker/docker/integration-cli/docker_api_create_test.go
new file mode 100644
index 000000000..8c7fff477
--- /dev/null
+++ b/vendor/github.com/docker/docker/integration-cli/docker_api_create_test.go
@@ -0,0 +1,136 @@
+package main
+
+import (
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/versions"
+	"github.com/docker/docker/integration-cli/checker"
+	"github.com/docker/docker/internal/test/request"
+	"github.com/go-check/check"
+)
+
+func (s *DockerSuite) TestAPICreateWithInvalidHealthcheckParams(c *check.C) {
+	// test invalid Interval in Healthcheck: less than 0s
+	name := "test1"
+	config := map[string]interface{}{
+		"Image": "busybox",
+		"Healthcheck": map[string]interface{}{
+			"Interval": -10 * time.Millisecond,
+			"Timeout":  time.Second,
+			"Retries":  int(1000),
+		},
+	}
+
+	res, body, err := request.Post("/containers/create?name="+name, request.JSONBody(config))
+	c.Assert(err, check.IsNil)
+	if versions.LessThan(testEnv.DaemonAPIVersion(), "1.32") {
+		c.Assert(res.StatusCode, check.Equals, http.StatusInternalServerError)
+	} else {
+		c.Assert(res.StatusCode, check.Equals, http.StatusBadRequest)
+	}
+
+	buf, err := request.ReadBody(body)
+	c.Assert(err, checker.IsNil)
+
+	expected := fmt.Sprintf("Interval in Healthcheck cannot be less than %s", container.MinimumDuration)
+	c.Assert(getErrorMessage(c, buf), checker.Contains, expected)
+
+	// test invalid Interval in Healthcheck: larger than 0s but less than 1ms
+	name = "test2"
+	config = map[string]interface{}{
+		"Image": "busybox",
+		"Healthcheck": map[string]interface{}{
+			"Interval": 500 * time.Microsecond,
+			"Timeout":  time.Second,
+			"Retries":  int(1000),
+		},
+	}
+	res, body, err = request.Post("/containers/create?name="+name, request.JSONBody(config))
+	c.Assert(err, check.IsNil)
+
+	buf, err = request.ReadBody(body)
+	c.Assert(err, checker.IsNil)
+
+	if versions.LessThan(testEnv.DaemonAPIVersion(), "1.32") {
+		c.Assert(res.StatusCode, check.Equals, http.StatusInternalServerError)
+	} else {
+		c.Assert(res.StatusCode, check.Equals, http.StatusBadRequest)
+	}
+	c.Assert(getErrorMessage(c, buf), checker.Contains, expected)
+
+	// test invalid Timeout in Healthcheck: less than 1ms
+	name = "test3"
+	config = map[string]interface{}{
+		"Image": "busybox",
+		"Healthcheck": map[string]interface{}{
+			"Interval": time.Second,
+			"Timeout":  -100 * time.Millisecond,
+			"Retries":  int(1000),
+		},
+	}
+	res, body, err = request.Post("/containers/create?name="+name, request.JSONBody(config))
+	c.Assert(err, check.IsNil)
+	if versions.LessThan(testEnv.DaemonAPIVersion(), "1.32") {
+		c.Assert(res.StatusCode, check.Equals, http.StatusInternalServerError)
+	} else {
+		c.Assert(res.StatusCode, check.Equals, http.StatusBadRequest)
+	}
+
+	buf, err = request.ReadBody(body)
+	c.Assert(err, checker.IsNil)
+
+	expected = fmt.Sprintf("Timeout in Healthcheck cannot be less than %s", container.MinimumDuration)
+	c.Assert(getErrorMessage(c, buf), checker.Contains, expected)
+
+	// test invalid Retries in Healthcheck: less than 0
+	name = "test4"
+	config = map[string]interface{}{
+		"Image": "busybox",
+		"Healthcheck": map[string]interface{}{
+			"Interval": time.Second,
+			"Timeout":  time.Second,
+			"Retries":  int(-10),
+		},
+	}
+	res, body, err = request.Post("/containers/create?name="+name, request.JSONBody(config))
+	c.Assert(err, check.IsNil)
+	if versions.LessThan(testEnv.DaemonAPIVersion(), "1.32") {
+		c.Assert(res.StatusCode, check.Equals, http.StatusInternalServerError)
+	} else {
+		c.Assert(res.StatusCode, check.Equals, http.StatusBadRequest)
+	}
+
+	buf, err = request.ReadBody(body)
+	c.Assert(err, checker.IsNil)
+
+	expected = "Retries in Healthcheck cannot be negative"
+	c.Assert(getErrorMessage(c, buf), checker.Contains, expected)
+
+	// test invalid StartPeriod in Healthcheck: not 0 and less than 1ms
+	name = "test3"
+	config = map[string]interface{}{
+		"Image": "busybox",
+		"Healthcheck": map[string]interface{}{
+			"Interval":    time.Second,
+			"Timeout":     time.Second,
+			"Retries":     int(1000),
+			"StartPeriod": 100 * time.Microsecond,
+		},
+	}
+	res, body, err = request.Post("/containers/create?name="+name, request.JSONBody(config))
+	c.Assert(err, check.IsNil)
+	if versions.LessThan(testEnv.DaemonAPIVersion(), "1.32") {
+		c.Assert(res.StatusCode, check.Equals, http.StatusInternalServerError)
+	} else {
+		c.Assert(res.StatusCode, check.Equals, http.StatusBadRequest)
+	}
+
+	buf, err = request.ReadBody(body)
+	c.Assert(err, checker.IsNil)
+
+	expected = fmt.Sprintf("StartPeriod in Healthcheck cannot be less than %s", container.MinimumDuration)
+	c.Assert(getErrorMessage(c, buf), checker.Contains, expected)
+}
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_api_exec_test.go b/vendor/github.com/docker/docker/integration-cli/docker_api_exec_test.go
index 3c98eb4ac..118f9971a 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_api_exec_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_api_exec_test.go
@@ -71,7 +71,7 @@ func (s *DockerSuite) TestExecAPICreateContainerPaused(c *check.C) {
 
 	dockerCmd(c, "pause", name)
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -155,7 +155,7 @@ func (s *DockerSuite) TestExecAPIStartWithDetach(c *check.C) {
 		AttachStderr: true,
 	}
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -212,7 +212,7 @@ func (s *DockerSuite) TestExecAPIStartInvalidCommand(c *check.C) {
 }
 
 func (s *DockerSuite) TestExecStateCleanup(c *check.C) {
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
 
 	// This test checks accidental regressions. Not part of stable API.
 
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_api_images_test.go b/vendor/github.com/docker/docker/integration-cli/docker_api_images_test.go
index 416c1f715..f306cca61 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_api_images_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_api_images_test.go
@@ -20,7 +20,7 @@ import (
 )
 
 func (s *DockerSuite) TestAPIImagesFilter(c *check.C) {
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -88,7 +88,7 @@ func (s *DockerSuite) TestAPIImagesSaveAndLoad(c *check.C) {
 }
 
 func (s *DockerSuite) TestAPIImagesDelete(c *check.C) {
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -112,7 +112,7 @@ func (s *DockerSuite) TestAPIImagesDelete(c *check.C) {
 }
 
 func (s *DockerSuite) TestAPIImagesHistory(c *check.C) {
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -147,7 +147,7 @@ func (s *DockerSuite) TestAPIImagesImportBadSrc(c *check.C) {
 		}
 	}
 
-	testRequires(c, Network, testEnv.IsLocalDaemon)
+	testRequires(c, Network, SameHostDaemon)
 
 	server := httptest.NewServer(http.NewServeMux())
 	defer server.Close()
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_api_inspect_test.go b/vendor/github.com/docker/docker/integration-cli/docker_api_inspect_test.go
index 5c452db32..68055b6c1 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_api_inspect_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_api_inspect_test.go
@@ -107,7 +107,7 @@ func (s *DockerSuite) TestInspectAPIContainerVolumeDriver(c *check.C) {
 
 func (s *DockerSuite) TestInspectAPIImageResponse(c *check.C) {
 	dockerCmd(c, "tag", "busybox:latest", "busybox:mytag")
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_api_ipcmode_test.go b/vendor/github.com/docker/docker/integration-cli/docker_api_ipcmode_test.go
new file mode 100644
index 000000000..9eb483d8b
--- /dev/null
+++ b/vendor/github.com/docker/docker/integration-cli/docker_api_ipcmode_test.go
@@ -0,0 +1,81 @@
+// build +linux
+package main
+
+import (
+	"bufio"
+	"context"
+	"io/ioutil"
+	"os"
+	"strings"
+
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/integration-cli/checker"
+	"github.com/docker/docker/integration-cli/cli"
+	"github.com/go-check/check"
+)
+
+/* testIpcCheckDevExists checks whether a given mount (identified by its
+ * major:minor pair from /proc/self/mountinfo) exists on the host system.
+ *
+ * The format of /proc/self/mountinfo is like:
+ *
+ * 29 23 0:24 / /dev/shm rw,nosuid,nodev shared:4 - tmpfs tmpfs rw
+ *       ^^^^\
+ *            - this is the minor:major we look for
+ */
+func testIpcCheckDevExists(mm string) (bool, error) {
+	f, err := os.Open("/proc/self/mountinfo")
+	if err != nil {
+		return false, err
+	}
+	defer f.Close()
+
+	s := bufio.NewScanner(f)
+	for s.Scan() {
+		fields := strings.Fields(s.Text())
+		if len(fields) < 7 {
+			continue
+		}
+		if fields[2] == mm {
+			return true, nil
+		}
+	}
+
+	return false, s.Err()
+}
+
+/* TestAPIIpcModeHost checks that a container created with --ipc host
+ * can use IPC of the host system.
+ */
+func (s *DockerSuite) TestAPIIpcModeHost(c *check.C) {
+	testRequires(c, DaemonIsLinux, SameHostDaemon, NotUserNamespace)
+
+	cfg := container.Config{
+		Image: "busybox",
+		Cmd:   []string{"top"},
+	}
+	hostCfg := container.HostConfig{
+		IpcMode: container.IpcMode("host"),
+	}
+	ctx := context.Background()
+
+	client := testEnv.APIClient()
+	resp, err := client.ContainerCreate(ctx, &cfg, &hostCfg, nil, "")
+	c.Assert(err, checker.IsNil)
+	c.Assert(len(resp.Warnings), checker.Equals, 0)
+	name := resp.ID
+
+	err = client.ContainerStart(ctx, name, types.ContainerStartOptions{})
+	c.Assert(err, checker.IsNil)
+
+	// check that IPC is shared
+	// 1. create a file inside container
+	cli.DockerCmd(c, "exec", name, "sh", "-c", "printf covfefe > /dev/shm/."+name)
+	// 2. check it's the same on the host
+	bytes, err := ioutil.ReadFile("/dev/shm/." + name)
+	c.Assert(err, checker.IsNil)
+	c.Assert(string(bytes), checker.Matches, "^covfefe$")
+	// 3. clean up
+	cli.DockerCmd(c, "exec", name, "rm", "-f", "/dev/shm/."+name)
+}
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_api_logs_test.go b/vendor/github.com/docker/docker/integration-cli/docker_api_logs_test.go
index 2e5bd724f..e809b46c2 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_api_logs_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_api_logs_test.go
@@ -59,7 +59,7 @@ func (s *DockerSuite) TestLogsAPIWithStdout(c *check.C) {
 func (s *DockerSuite) TestLogsAPINoStdoutNorStderr(c *check.C) {
 	name := "logs_test"
 	dockerCmd(c, "run", "-d", "-t", "--name", name, "busybox", "/bin/sh")
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -102,7 +102,7 @@ func (s *DockerSuite) TestLogsAPIUntilFutureFollow(c *check.C) {
 	c.Assert(err, checker.IsNil)
 	until := daemonTime(c).Add(untilDur)
 
-	client, err := client.NewClientWithOpts(client.FromEnv)
+	client, err := client.NewEnvClient()
 	if err != nil {
 		c.Fatal(err)
 	}
@@ -153,7 +153,7 @@ func (s *DockerSuite) TestLogsAPIUntil(c *check.C) {
 	name := "logsuntil"
 	dockerCmd(c, "run", "--name", name, "busybox", "/bin/sh", "-c", "for i in $(seq 1 3); do echo log$i; sleep 1; done")
 
-	client, err := client.NewClientWithOpts(client.FromEnv)
+	client, err := client.NewEnvClient()
 	if err != nil {
 		c.Fatal(err)
 	}
@@ -190,7 +190,7 @@ func (s *DockerSuite) TestLogsAPIUntilDefaultValue(c *check.C) {
 	name := "logsuntildefaultval"
 	dockerCmd(c, "run", "--name", name, "busybox", "/bin/sh", "-c", "for i in $(seq 1 3); do echo log$i; done")
 
-	client, err := client.NewClientWithOpts(client.FromEnv)
+	client, err := client.NewEnvClient()
 	if err != nil {
 		c.Fatal(err)
 	}
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_api_stats_test.go b/vendor/github.com/docker/docker/integration-cli/docker_api_stats_test.go
index d715cc67f..3954e4b2e 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_api_stats_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_api_stats_test.go
@@ -97,7 +97,7 @@ func (s *DockerSuite) TestAPIStatsStoppedContainerInGoroutines(c *check.C) {
 }
 
 func (s *DockerSuite) TestAPIStatsNetworkStats(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 
 	out := runSleepingContainer(c)
 	id := strings.TrimSpace(out)
@@ -165,7 +165,7 @@ func (s *DockerSuite) TestAPIStatsNetworkStats(c *check.C) {
 
 func (s *DockerSuite) TestAPIStatsNetworkStatsVersioning(c *check.C) {
 	// Windows doesn't support API versions less than 1.25, so no point testing 1.17 .. 1.21
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	out := runSleepingContainer(c)
 	id := strings.TrimSpace(out)
@@ -262,7 +262,7 @@ func jsonBlobHasGTE121NetworkStats(blob map[string]interface{}) bool {
 
 func (s *DockerSuite) TestAPIStatsContainerNotFound(c *check.C) {
 	testRequires(c, DaemonIsLinux)
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_api_swarm_node_test.go b/vendor/github.com/docker/docker/integration-cli/docker_api_swarm_node_test.go
index 30c228546..191391620 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_api_swarm_node_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_api_swarm_node_test.go
@@ -62,7 +62,7 @@ func (s *DockerSwarmSuite) TestAPISwarmNodeRemove(c *check.C) {
 	c.Assert(len(nodes), checker.Equals, 2, check.Commentf("nodes: %#v", nodes))
 
 	// Restart the node that was removed
-	d2.RestartNode(c)
+	d2.Restart(c)
 
 	// Give some time for the node to rejoin
 	time.Sleep(1 * time.Second)
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_api_swarm_service_test.go b/vendor/github.com/docker/docker/integration-cli/docker_api_swarm_service_test.go
index 9b6764a71..4d39a34b0 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_api_swarm_service_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_api_swarm_service_test.go
@@ -66,19 +66,20 @@ func (s *DockerSwarmSuite) TestAPISwarmServicesCreate(c *check.C) {
 	id := d.CreateService(c, simpleTestService, setInstances(instances))
 	waitAndAssert(c, defaultReconciliationTimeout, d.CheckActiveContainerCount, checker.Equals, instances)
 
-	client := d.NewClientT(c)
-	defer client.Close()
+	cli, err := d.NewClient()
+	c.Assert(err, checker.IsNil)
+	defer cli.Close()
 
 	options := types.ServiceInspectOptions{InsertDefaults: true}
 
 	// insertDefaults inserts UpdateConfig when service is fetched by ID
-	resp, _, err := client.ServiceInspectWithRaw(context.Background(), id, options)
+	resp, _, err := cli.ServiceInspectWithRaw(context.Background(), id, options)
 	out := fmt.Sprintf("%+v", resp)
 	c.Assert(err, checker.IsNil)
 	c.Assert(out, checker.Contains, "UpdateConfig")
 
 	// insertDefaults inserts UpdateConfig when service is fetched by ID
-	resp, _, err = client.ServiceInspectWithRaw(context.Background(), "top", options)
+	resp, _, err = cli.ServiceInspectWithRaw(context.Background(), "top", options)
 	out = fmt.Sprintf("%+v", resp)
 	c.Assert(err, checker.IsNil)
 	c.Assert(string(out), checker.Contains, "UpdateConfig")
@@ -537,7 +538,7 @@ func (s *DockerSwarmSuite) TestAPISwarmServicePlacementPrefs(c *check.C) {
 }
 
 func (s *DockerSwarmSuite) TestAPISwarmServicesStateReporting(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 	testRequires(c, DaemonIsLinux)
 
 	d1 := s.AddDaemon(c, true, true)
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_api_swarm_test.go b/vendor/github.com/docker/docker/integration-cli/docker_api_swarm_test.go
index 65f815908..10b993848 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_api_swarm_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_api_swarm_test.go
@@ -9,7 +9,6 @@ import (
 	"net"
 	"net/http"
 	"path/filepath"
-	"runtime"
 	"strings"
 	"sync"
 	"time"
@@ -67,8 +66,8 @@ func (s *DockerSwarmSuite) TestAPISwarmInit(c *check.C) {
 	d1.Stop(c)
 	d2.Stop(c)
 
-	d1.StartNode(c)
-	d2.StartNode(c)
+	d1.Start(c)
+	d2.Start(c)
 
 	info = d1.SwarmInfo(c)
 	c.Assert(info.ControlAvailable, checker.True)
@@ -295,13 +294,6 @@ func (s *DockerSwarmSuite) TestAPISwarmLeaderProxy(c *check.C) {
 }
 
 func (s *DockerSwarmSuite) TestAPISwarmLeaderElection(c *check.C) {
-	if runtime.GOARCH == "s390x" {
-		c.Skip("Disabled on s390x")
-	}
-	if runtime.GOARCH == "ppc64le" {
-		c.Skip("Disabled on  ppc64le")
-	}
-
 	// Create 3 nodes
 	d1 := s.AddDaemon(c, true, true)
 	d2 := s.AddDaemon(c, true, true)
@@ -340,7 +332,6 @@ func (s *DockerSwarmSuite) TestAPISwarmLeaderElection(c *check.C) {
 	}
 
 	// wait for an election to occur
-	c.Logf("Waiting for election to occur...")
 	waitAndAssert(c, defaultReconciliationTimeout, checkLeader(d2, d3), checker.True)
 
 	// assert that we have a new leader
@@ -350,10 +341,11 @@ func (s *DockerSwarmSuite) TestAPISwarmLeaderElection(c *check.C) {
 	stableleader := leader
 
 	// add the d1, the initial leader, back
-	d1.StartNode(c)
+	d1.Start(c)
+
+	// TODO(stevvooe): may need to wait for rejoin here
 
 	// wait for possible election
-	c.Logf("Waiting for possible election...")
 	waitAndAssert(c, defaultReconciliationTimeout, checkLeader(d1, d2, d3), checker.True)
 	// pick out the leader and the followers again
 
@@ -365,13 +357,6 @@ func (s *DockerSwarmSuite) TestAPISwarmLeaderElection(c *check.C) {
 }
 
 func (s *DockerSwarmSuite) TestAPISwarmRaftQuorum(c *check.C) {
-	if runtime.GOARCH == "s390x" {
-		c.Skip("Disabled on s390x")
-	}
-	if runtime.GOARCH == "ppc64le" {
-		c.Skip("Disabled on  ppc64le")
-	}
-
 	d1 := s.AddDaemon(c, true, true)
 	d2 := s.AddDaemon(c, true, true)
 	d3 := s.AddDaemon(c, true, true)
@@ -392,16 +377,17 @@ func (s *DockerSwarmSuite) TestAPISwarmRaftQuorum(c *check.C) {
 	var service swarm.Service
 	simpleTestService(&service)
 	service.Spec.Name = "top2"
-	cli := d1.NewClientT(c)
+	cli, err := d1.NewClient()
+	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
 	// d1 will eventually step down from leader because there is no longer an active quorum, wait for that to happen
 	waitAndAssert(c, defaultReconciliationTimeout, func(c *check.C) (interface{}, check.CommentInterface) {
-		_, err := cli.ServiceCreate(context.Background(), service.Spec, types.ServiceCreateOptions{})
+		_, err = cli.ServiceCreate(context.Background(), service.Spec, types.ServiceCreateOptions{})
 		return err.Error(), nil
 	}, checker.Contains, "Make sure more than half of the managers are online.")
 
-	d2.StartNode(c)
+	d2.Start(c)
 
 	// make sure there is a leader
 	waitAndAssert(c, defaultReconciliationTimeout, d1.CheckLeader, checker.IsNil)
@@ -477,7 +463,8 @@ func (s *DockerSwarmSuite) TestAPISwarmRestoreOnPendingJoin(c *check.C) {
 
 	waitAndAssert(c, defaultReconciliationTimeout, d.CheckLocalNodeState, checker.Equals, swarm.LocalNodeStatePending)
 
-	d.RestartNode(c)
+	d.Stop(c)
+	d.Start(c)
 
 	info := d.SwarmInfo(c)
 	c.Assert(info.LocalNodeState, checker.Equals, swarm.LocalNodeStateInactive)
@@ -490,22 +477,25 @@ func (s *DockerSwarmSuite) TestAPISwarmManagerRestore(c *check.C) {
 	id := d1.CreateService(c, simpleTestService, setInstances(instances))
 
 	d1.GetService(c, id)
-	d1.RestartNode(c)
+	d1.Stop(c)
+	d1.Start(c)
 	d1.GetService(c, id)
 
 	d2 := s.AddDaemon(c, true, true)
 	d2.GetService(c, id)
-	d2.RestartNode(c)
+	d2.Stop(c)
+	d2.Start(c)
 	d2.GetService(c, id)
 
 	d3 := s.AddDaemon(c, true, true)
 	d3.GetService(c, id)
-	d3.RestartNode(c)
+	d3.Stop(c)
+	d3.Start(c)
 	d3.GetService(c, id)
 
 	d3.Kill()
 	time.Sleep(1 * time.Second) // time to handle signal
-	d3.StartNode(c)
+	d3.Start(c)
 	d3.GetService(c, id)
 }
 
@@ -863,9 +853,10 @@ func (s *DockerSwarmSuite) TestAPISwarmServicesUpdateWithName(c *check.C) {
 	instances = 5
 
 	setInstances(instances)(service)
-	cli := d.NewClientT(c)
+	cli, err := d.NewClient()
+	c.Assert(err, checker.IsNil)
 	defer cli.Close()
-	_, err := cli.ServiceUpdate(context.Background(), service.Spec.Name, service.Version, service.Spec, types.ServiceUpdateOptions{})
+	_, err = cli.ServiceUpdate(context.Background(), service.Spec.Name, service.Version, service.Spec, types.ServiceUpdateOptions{})
 	c.Assert(err, checker.IsNil)
 	waitAndAssert(c, defaultReconciliationTimeout, d.CheckActiveContainerCount, checker.Equals, instances)
 }
@@ -897,7 +888,8 @@ func (s *DockerSwarmSuite) TestAPISwarmErrorHandling(c *check.C) {
 // This test makes sure the fixes correctly output scopes instead.
 func (s *DockerSwarmSuite) TestAPIDuplicateNetworks(c *check.C) {
 	d := s.AddDaemon(c, true, true)
-	cli := d.NewClientT(c)
+	cli, err := d.NewClient()
+	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
 	name := "foo"
@@ -1026,7 +1018,8 @@ func (s *DockerSwarmSuite) TestAPINetworkInspectWithScope(c *check.C) {
 
 	name := "test-scoped-network"
 	ctx := context.Background()
-	apiclient := d.NewClientT(c)
+	apiclient, err := d.NewClient()
+	assert.NilError(c, err)
 
 	resp, err := apiclient.NetworkCreate(ctx, name, types.NetworkCreate{Driver: "overlay"})
 	assert.NilError(c, err)
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_attach_unix_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_attach_unix_test.go
index 6430d68ed..9affb944b 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_attach_unix_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_attach_unix_test.go
@@ -10,13 +10,14 @@ import (
 	"time"
 
 	"github.com/docker/docker/integration-cli/checker"
+	"github.com/docker/docker/pkg/stringid"
 	"github.com/go-check/check"
 	"github.com/kr/pty"
 )
 
 // #9860 Make sure attach ends when container ends (with no errors)
 func (s *DockerSuite) TestAttachClosedOnContainerStop(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 
 	out, _ := dockerCmd(c, "run", "-dti", "busybox", "/bin/sh", "-c", `trap 'exit 0' SIGTERM; while true; do sleep 1; done`)
 
@@ -145,7 +146,7 @@ func (s *DockerSuite) TestAttachDetach(c *check.C) {
 	c.Assert(err, check.IsNil)
 	out, err = bufio.NewReader(stdout).ReadString('\n')
 	c.Assert(err, check.IsNil)
-	c.Assert(strings.TrimSpace(out), checker.Equals, "hello")
+	c.Assert(strings.TrimSpace(out), checker.Equals, "hello", check.Commentf("expected 'hello', got %q", out))
 
 	// escape sequence
 	_, err = cpty.Write([]byte{16})
@@ -157,15 +158,72 @@ func (s *DockerSuite) TestAttachDetach(c *check.C) {
 	ch := make(chan struct{})
 	go func() {
 		cmd.Wait()
-		close(ch)
+		ch <- struct{}{}
+	}()
+
+	running := inspectField(c, id, "State.Running")
+	c.Assert(running, checker.Equals, "true", check.Commentf("expected container to still be running"))
+
+	go func() {
+		dockerCmdWithResult("kill", id)
 	}()
 
 	select {
 	case <-ch:
-	case <-time.After(1 * time.Second):
+	case <-time.After(10 * time.Millisecond):
 		c.Fatal("timed out waiting for container to exit")
 	}
 
+}
+
+// TestAttachDetachTruncatedID checks that attach in tty mode can be detached
+func (s *DockerSuite) TestAttachDetachTruncatedID(c *check.C) {
+	out, _ := dockerCmd(c, "run", "-itd", "busybox", "cat")
+	id := stringid.TruncateID(strings.TrimSpace(out))
+	c.Assert(waitRun(id), check.IsNil)
+
+	cpty, tty, err := pty.Open()
+	c.Assert(err, checker.IsNil)
+	defer cpty.Close()
+
+	cmd := exec.Command(dockerBinary, "attach", id)
+	cmd.Stdin = tty
+	stdout, err := cmd.StdoutPipe()
+	c.Assert(err, checker.IsNil)
+	defer stdout.Close()
+	err = cmd.Start()
+	c.Assert(err, checker.IsNil)
+
+	_, err = cpty.Write([]byte("hello\n"))
+	c.Assert(err, checker.IsNil)
+	out, err = bufio.NewReader(stdout).ReadString('\n')
+	c.Assert(err, checker.IsNil)
+	c.Assert(strings.TrimSpace(out), checker.Equals, "hello", check.Commentf("expected 'hello', got %q", out))
+
+	// escape sequence
+	_, err = cpty.Write([]byte{16})
+	c.Assert(err, checker.IsNil)
+	time.Sleep(100 * time.Millisecond)
+	_, err = cpty.Write([]byte{17})
+	c.Assert(err, checker.IsNil)
+
+	ch := make(chan struct{})
+	go func() {
+		cmd.Wait()
+		ch <- struct{}{}
+	}()
+
 	running := inspectField(c, id, "State.Running")
-	c.Assert(running, checker.Equals, "true") // container should be running
+	c.Assert(running, checker.Equals, "true", check.Commentf("expected container to still be running"))
+
+	go func() {
+		dockerCmdWithResult("kill", id)
+	}()
+
+	select {
+	case <-ch:
+	case <-time.After(10 * time.Millisecond):
+		c.Fatal("timed out waiting for container to exit")
+	}
+
 }
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_build_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_build_test.go
index b8cf47269..f6d5fe23f 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_build_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_build_test.go
@@ -24,7 +24,6 @@ import (
 	"github.com/docker/docker/internal/test/fakestorage"
 	"github.com/docker/docker/internal/testutil"
 	"github.com/docker/docker/pkg/archive"
-	"github.com/docker/docker/pkg/system"
 	"github.com/go-check/check"
 	"github.com/moby/buildkit/frontend/dockerfile/command"
 	"github.com/opencontainers/go-digest"
@@ -656,7 +655,7 @@ func (s *DockerSuite) TestBuildCopyWildcard(c *check.C) {
 			"file2.txt":                     "test2",
 			"dir/nested_file":               "nested file",
 			"dir/nested_dir/nest_nest_file": "2 times nested",
-			"dirt":                          "dirty",
+			"dirt": "dirty",
 		}))
 	defer ctx.Close()
 
@@ -1047,7 +1046,7 @@ func (s *DockerSuite) TestBuildAddBadLinksVolume(c *check.C) {
 // Issue #5270 - ensure we throw a better error than "unexpected EOF"
 // when we can't access files in the context.
 func (s *DockerSuite) TestBuildWithInaccessibleFilesInContext(c *check.C) {
-	testRequires(c, DaemonIsLinux, UnixCli, testEnv.IsLocalDaemon) // test uses chown/chmod: not available on windows
+	testRequires(c, DaemonIsLinux, UnixCli, SameHostDaemon) // test uses chown/chmod: not available on windows
 
 	{
 		name := "testbuildinaccessiblefiles"
@@ -1510,7 +1509,7 @@ func (s *DockerSuite) TestBuildPATH(c *check.C) {
 }
 
 func (s *DockerSuite) TestBuildContextCleanup(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 
 	name := "testbuildcontextcleanup"
 	entries, err := ioutil.ReadDir(filepath.Join(testEnv.DaemonInfo.DockerRootDir, "tmp"))
@@ -1532,7 +1531,7 @@ func (s *DockerSuite) TestBuildContextCleanup(c *check.C) {
 }
 
 func (s *DockerSuite) TestBuildContextCleanupFailedBuild(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 
 	name := "testbuildcontextcleanup"
 	entries, err := ioutil.ReadDir(filepath.Join(testEnv.DaemonInfo.DockerRootDir, "tmp"))
@@ -3332,6 +3331,9 @@ func (s *DockerSuite) TestBuildVerifySingleQuoteFails(c *check.C) {
 	// it should barf on it.
 	name := "testbuildsinglequotefails"
 	expectedExitCode := 2
+	if testEnv.OSType == "windows" {
+		expectedExitCode = 127
+	}
 
 	buildImageSuccessfully(c, name, build.WithDockerfile(`FROM busybox
 		CMD [ '/bin/sh', '-c', 'echo hi' ]`))
@@ -3599,11 +3601,6 @@ func (s *DockerSuite) TestBuildSymlinkBreakout(c *check.C) {
 	name := "testbuildsymlinkbreakout"
 	tmpdir, err := ioutil.TempDir("", name)
 	c.Assert(err, check.IsNil)
-
-	// See https://github.com/moby/moby/pull/37770 for reason for next line.
-	tmpdir, err = system.GetLongPathName(tmpdir)
-	c.Assert(err, check.IsNil)
-
 	defer os.RemoveAll(tmpdir)
 	ctx := filepath.Join(tmpdir, "context")
 	if err := os.MkdirAll(ctx, 0755); err != nil {
@@ -3971,7 +3968,7 @@ func (s *DockerSuite) TestBuildEmptyStringVolume(c *check.C) {
 }
 
 func (s *DockerSuite) TestBuildContainerWithCgroupParent(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	cgroupParent := "test"
 	data, err := ioutil.ReadFile("/proc/self/cgroup")
@@ -6055,7 +6052,13 @@ FROM busybox
 WORKDIR /foo/bar
 `))
 	out, _ := dockerCmd(c, "inspect", "--format", "{{ json .Config.Cmd }}", image)
-	c.Assert(strings.TrimSpace(out), checker.Equals, `["sh"]`)
+
+	// The Windows busybox image has a blank `cmd`
+	lookingFor := `["sh"]`
+	if testEnv.OSType == "windows" {
+		lookingFor = "null"
+	}
+	c.Assert(strings.TrimSpace(out), checker.Equals, lookingFor)
 
 	image = "testworkdirlabelimagecmd"
 	buildImageSuccessfully(c, image, build.WithDockerfile(`
@@ -6065,7 +6068,7 @@ LABEL a=b
 `))
 
 	out, _ = dockerCmd(c, "inspect", "--format", "{{ json .Config.Cmd }}", image)
-	c.Assert(strings.TrimSpace(out), checker.Equals, `["sh"]`)
+	c.Assert(strings.TrimSpace(out), checker.Equals, lookingFor)
 }
 
 // Test case for 28902/28909
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_config_create_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_config_create_test.go
new file mode 100644
index 000000000..c777a7637
--- /dev/null
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_config_create_test.go
@@ -0,0 +1,33 @@
+// +build !windows
+
+package main
+
+import (
+	"io/ioutil"
+	"os"
+	"strings"
+
+	"github.com/docker/docker/integration-cli/checker"
+	"github.com/go-check/check"
+)
+
+func (s *DockerSwarmSuite) TestConfigCreateWithFile(c *check.C) {
+	d := s.AddDaemon(c, true, true)
+
+	testFile, err := ioutil.TempFile("", "configCreateTest")
+	c.Assert(err, checker.IsNil) // ensure temp file is created
+	defer os.Remove(testFile.Name())
+
+	testData := "TESTINGDATA"
+	_, err = testFile.Write([]byte(testData))
+	c.Assert(err, checker.IsNil) // ensure temp file is written
+
+	testName := "test_config"
+	out, err := d.Cmd("config", "create", testName, testFile.Name())
+	c.Assert(err, checker.IsNil, check.Commentf("%s", out))
+	c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
+
+	id := strings.TrimSpace(out)
+	config := d.GetConfig(c, id)
+	c.Assert(config.Spec.Name, checker.Equals, testName)
+}
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_cp_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_cp_test.go
index e74af64d2..b2826ab92 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_cp_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_cp_test.go
@@ -256,7 +256,7 @@ func (s *DockerSuite) TestCpFromSymlinkToDirectory(c *check.C) {
 // container.
 func (s *DockerSuite) TestCpToSymlinkToDirectory(c *check.C) {
 	testRequires(c, DaemonIsLinux)
-	testRequires(c, testEnv.IsLocalDaemon) // Requires local volume mount bind.
+	testRequires(c, SameHostDaemon) // Requires local volume mount bind.
 
 	testVol, err := ioutil.TempDir("", "test-cp-to-symlink-to-dir-")
 	c.Assert(err, checker.IsNil)
@@ -379,7 +379,7 @@ func (s *DockerSuite) TestCpSymlinkComponent(c *check.C) {
 
 // Check that cp with unprivileged user doesn't return any error
 func (s *DockerSuite) TestCpUnprivilegedUser(c *check.C) {
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
 	testRequires(c, UnixCli) // uses chmod/su: not available on windows
 
 	out, _ := dockerCmd(c, "run", "-d", "busybox", "/bin/sh", "-c", "touch "+cpTestName)
@@ -404,7 +404,7 @@ func (s *DockerSuite) TestCpUnprivilegedUser(c *check.C) {
 
 func (s *DockerSuite) TestCpSpecialFiles(c *check.C) {
 	testRequires(c, DaemonIsLinux)
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 
 	outDir, err := ioutil.TempDir("", "cp-test-special-files")
 	c.Assert(err, checker.IsNil)
@@ -453,7 +453,7 @@ func (s *DockerSuite) TestCpVolumePath(c *check.C) {
 	//  stat /tmp/cp-test-volumepath851508420/test gets permission denied for the user
 	testRequires(c, NotUserNamespace)
 	testRequires(c, DaemonIsLinux)
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 
 	tmpDir, err := ioutil.TempDir("", "cp-test-volumepath")
 	c.Assert(err, checker.IsNil)
@@ -560,7 +560,7 @@ func (s *DockerSuite) TestCpToStdout(c *check.C) {
 }
 
 func (s *DockerSuite) TestCpNameHasColon(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	out, _ := dockerCmd(c, "run", "-d", "busybox", "/bin/sh", "-c", "echo lololol > /te:s:t")
 
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_cp_to_container_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_cp_to_container_test.go
index 27d3edcc2..77567a3b9 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_cp_to_container_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_cp_to_container_test.go
@@ -23,7 +23,7 @@ func (s *DockerSuite) TestCpToSymlinkDestination(c *check.C) {
 	//  stat /tmp/test-cp-to-symlink-destination-262430901/vol3 gets permission denied for the user
 	testRequires(c, NotUserNamespace)
 	testRequires(c, DaemonIsLinux)
-	testRequires(c, testEnv.IsLocalDaemon) // Requires local volume mount bind.
+	testRequires(c, SameHostDaemon) // Requires local volume mount bind.
 
 	testVol := getTestDir(c, "test-cp-to-symlink-destination-")
 	defer os.RemoveAll(testVol)
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_cp_to_container_unix_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_cp_to_container_unix_test.go
index ef1ad7de3..8f830dcf9 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_cp_to_container_unix_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_cp_to_container_unix_test.go
@@ -15,7 +15,7 @@ import (
 )
 
 func (s *DockerSuite) TestCpToContainerWithPermissions(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	tmpDir := getTestDir(c, "test-cp-to-host-with-permissions")
 	defer os.RemoveAll(tmpDir)
@@ -39,7 +39,7 @@ func (s *DockerSuite) TestCpToContainerWithPermissions(c *check.C) {
 
 // Check ownership is root, both in non-userns and userns enabled modes
 func (s *DockerSuite) TestCpCheckDestOwnership(c *check.C) {
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
 	tmpVolDir := getTestDir(c, "test-cp-tmpvol")
 	containerID := makeTestContainer(c,
 		testContainerOptions{volumes: []string{fmt.Sprintf("%s:/tmpvol", tmpVolDir)}})
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_cp_utils_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_cp_utils_test.go
index 3b540ae3f..79a016f0c 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_cp_utils_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_cp_utils_test.go
@@ -291,7 +291,7 @@ func containerStartOutputEquals(c *check.C, containerID, contents string) (err e
 }
 
 func defaultVolumes(tmpDir string) []string {
-	if testEnv.IsLocalDaemon() {
+	if SameHostDaemon() {
 		return []string{
 			"/vol1",
 			fmt.Sprintf("%s:/vol2", tmpDir),
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_create_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_create_test.go
index dbdf92915..cb4de73c5 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_create_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_create_test.go
@@ -171,7 +171,7 @@ func (s *DockerSuite) TestCreateEchoStdout(c *check.C) {
 }
 
 func (s *DockerSuite) TestCreateVolumesCreated(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 	prefix, slash := getPrefixAndSlashFromDaemonPlatform()
 
 	name := "test_create_volume"
@@ -249,7 +249,7 @@ func (s *DockerSuite) TestCreateRM(c *check.C) {
 
 func (s *DockerSuite) TestCreateModeIpcContainer(c *check.C) {
 	// Uses Linux specific functionality (--ipc)
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
 
 	out, _ := dockerCmd(c, "create", "busybox")
 	id := strings.TrimSpace(out)
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_daemon_plugins_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_daemon_plugins_test.go
index 000981d00..9a11c6808 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_daemon_plugins_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_daemon_plugins_test.go
@@ -121,7 +121,7 @@ func (s *DockerDaemonSuite) TestDaemonShutdownLiveRestoreWithPlugins(c *check.C)
 
 // TestDaemonShutdownWithPlugins shuts down running plugins.
 func (s *DockerDaemonSuite) TestDaemonShutdownWithPlugins(c *check.C) {
-	testRequires(c, IsAmd64, Network, testEnv.IsLocalDaemon)
+	testRequires(c, IsAmd64, Network, SameHostDaemon)
 
 	s.d.Start(c)
 	if out, err := s.d.Cmd("plugin", "install", "--grant-all-permissions", pName); err != nil {
@@ -159,7 +159,7 @@ func (s *DockerDaemonSuite) TestDaemonShutdownWithPlugins(c *check.C) {
 
 // TestDaemonKillWithPlugins leaves plugins running.
 func (s *DockerDaemonSuite) TestDaemonKillWithPlugins(c *check.C) {
-	testRequires(c, IsAmd64, Network, testEnv.IsLocalDaemon)
+	testRequires(c, IsAmd64, Network, SameHostDaemon)
 
 	s.d.Start(c)
 	if out, err := s.d.Cmd("plugin", "install", "--grant-all-permissions", pName); err != nil {
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_daemon_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_daemon_test.go
index 179062256..d3cd5f167 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_daemon_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_daemon_test.go
@@ -413,7 +413,7 @@ func (s *DockerDaemonSuite) TestDaemonIPv6Enabled(c *check.C) {
 // that running containers are given a link-local and global IPv6 address
 func (s *DockerDaemonSuite) TestDaemonIPv6FixedCIDR(c *check.C) {
 	// IPv6 setup is messing with local bridge address.
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 	// Delete the docker0 bridge if its left around from previous daemon. It has to be recreated with
 	// ipv6 enabled
 	deleteInterface(c, "docker0")
@@ -440,7 +440,7 @@ func (s *DockerDaemonSuite) TestDaemonIPv6FixedCIDR(c *check.C) {
 // the running containers are given an IPv6 address derived from the MAC address and the ipv6 fixed CIDR
 func (s *DockerDaemonSuite) TestDaemonIPv6FixedCIDRAndMac(c *check.C) {
 	// IPv6 setup is messing with local bridge address.
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 	// Delete the docker0 bridge if its left around from previous daemon. It has to be recreated with
 	// ipv6 enabled
 	deleteInterface(c, "docker0")
@@ -458,7 +458,7 @@ func (s *DockerDaemonSuite) TestDaemonIPv6FixedCIDRAndMac(c *check.C) {
 // TestDaemonIPv6HostMode checks that when the running a container with
 // network=host the host ipv6 addresses are not removed
 func (s *DockerDaemonSuite) TestDaemonIPv6HostMode(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 	deleteInterface(c, "docker0")
 
 	s.d.StartWithBusybox(c, "--ipv6", "--fixed-cidr-v6=2001:db8:2::/64")
@@ -572,7 +572,7 @@ func (s *DockerDaemonSuite) TestDaemonExitOnFailure(c *check.C) {
 			c.Fatalf("Expected daemon not to start, got %v", err)
 		}
 		// look in the log and make sure we got the message that daemon is shutting down
-		icmd.RunCommand("grep", "failed to start daemon", s.d.LogFileName()).Assert(c, icmd.Success)
+		icmd.RunCommand("grep", "Error starting daemon", s.d.LogFileName()).Assert(c, icmd.Success)
 	} else {
 		//if we didn't get an error and the daemon is running, this is a failure
 		c.Fatal("Conflicting options should cause the daemon to error out with a failure")
@@ -822,7 +822,7 @@ func (s *DockerDaemonSuite) TestDaemonDefaultGatewayIPv4ExplicitOutsideContainer
 }
 
 func (s *DockerDaemonSuite) TestDaemonDefaultNetworkInvalidClusterConfig(c *check.C) {
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
 
 	// Start daemon without docker0 bridge
 	defaultNetworkBridge := "docker0"
@@ -1770,7 +1770,7 @@ func (s *DockerDaemonSuite) TestBridgeIPIsExcludedFromAllocatorPool(c *check.C)
 
 // Test daemon for no space left on device error
 func (s *DockerDaemonSuite) TestDaemonNoSpaceLeftOnDeviceError(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, Network)
+	testRequires(c, SameHostDaemon, DaemonIsLinux, Network)
 
 	testDir, err := ioutil.TempDir("", "no-space-left-on-device-test")
 	c.Assert(err, checker.IsNil)
@@ -2203,7 +2203,7 @@ func (s *DockerDaemonSuite) TestDaemonDebugLog(c *check.C) {
 }
 
 func (s *DockerDaemonSuite) TestDaemonDiscoveryBackendConfigReload(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	// daemon config file
 	daemonConfig := `{ "debug" : false }`
@@ -2274,7 +2274,7 @@ func (s *DockerDaemonSuite) TestDaemonMaxConcurrency(c *check.C) {
 
 // Test case for #20936, #22443
 func (s *DockerDaemonSuite) TestDaemonMaxConcurrencyWithConfigFile(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	// daemon config file
 	configFilePath := "test.json"
@@ -2315,7 +2315,7 @@ func (s *DockerDaemonSuite) TestDaemonMaxConcurrencyWithConfigFile(c *check.C) {
 
 // Test case for #20936, #22443
 func (s *DockerDaemonSuite) TestDaemonMaxConcurrencyWithConfigFileReload(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	// daemon config file
 	configFilePath := "test.json"
@@ -2387,7 +2387,7 @@ func (s *DockerDaemonSuite) TestBuildOnDisabledBridgeNetworkDaemon(c *check.C) {
 
 // Test case for #21976
 func (s *DockerDaemonSuite) TestDaemonDNSFlagsInHostMode(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	s.d.StartWithBusybox(c, "--dns", "1.2.3.4", "--dns-search", "example.com", "--dns-opt", "timeout:3")
 
@@ -2485,7 +2485,7 @@ func (s *DockerDaemonSuite) TestRunWithRuntimeFromConfigFile(c *check.C) {
 
 	content, err := s.d.ReadLogFile()
 	c.Assert(err, checker.IsNil)
-	c.Assert(string(content), checker.Contains, `file configuration validation failed: runtime name 'runc' is reserved`)
+	c.Assert(string(content), checker.Contains, `file configuration validation failed (runtime name 'runc' is reserved)`)
 
 	// Check that we can select a default runtime
 	config = `
@@ -2643,7 +2643,7 @@ func (s *DockerDaemonSuite) TestDaemonRestartSaveContainerExitCode(c *check.C) {
 }
 
 func (s *DockerDaemonSuite) TestDaemonWithUserlandProxyPath(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	dockerProxyPath, err := exec.LookPath("docker-proxy")
 	c.Assert(err, checker.IsNil)
@@ -2674,7 +2674,7 @@ func (s *DockerDaemonSuite) TestDaemonWithUserlandProxyPath(c *check.C) {
 
 // Test case for #22471
 func (s *DockerDaemonSuite) TestDaemonShutdownTimeout(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 	s.d.StartWithBusybox(c, "--shutdown-timeout=3")
 
 	_, err := s.d.Cmd("run", "-d", "busybox", "top")
@@ -2695,7 +2695,7 @@ func (s *DockerDaemonSuite) TestDaemonShutdownTimeout(c *check.C) {
 
 // Test case for #22471
 func (s *DockerDaemonSuite) TestDaemonShutdownTimeoutWithConfigFile(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 
 	// daemon config file
 	configFilePath := "test.json"
@@ -2757,7 +2757,7 @@ func (s *DockerDaemonSuite) TestExecWithUserAfterLiveRestore(c *check.C) {
 }
 
 func (s *DockerDaemonSuite) TestRemoveContainerAfterLiveRestore(c *check.C) {
-	testRequires(c, DaemonIsLinux, overlayFSSupported, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, overlayFSSupported, SameHostDaemon)
 	s.d.StartWithBusybox(c, "--live-restore", "--storage-driver", "overlay")
 	out, err := s.d.Cmd("run", "-d", "--name=top", "busybox", "top")
 	c.Assert(err, check.IsNil, check.Commentf("Output: %s", out))
@@ -2790,7 +2790,7 @@ func (s *DockerDaemonSuite) TestRemoveContainerAfterLiveRestore(c *check.C) {
 
 // #29598
 func (s *DockerDaemonSuite) TestRestartPolicyWithLiveRestore(c *check.C) {
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
 	s.d.StartWithBusybox(c, "--live-restore")
 
 	out, err := s.d.Cmd("run", "-d", "--restart", "always", "busybox", "top")
@@ -2903,6 +2903,67 @@ func (s *DockerDaemonSuite) TestShmSizeReload(c *check.C) {
 	c.Assert(strings.TrimSpace(out), check.Equals, fmt.Sprintf("%v", size))
 }
 
+// this is used to test both "private" and "shareable" daemon default ipc modes
+func testDaemonIpcPrivateShareable(d *daemon.Daemon, c *check.C, mustExist bool) {
+	name := "test-ipcmode"
+	_, err := d.Cmd("run", "-d", "--name", name, "busybox", "top")
+	c.Assert(err, checker.IsNil)
+
+	// get major:minor pair for /dev/shm from container's /proc/self/mountinfo
+	cmd := "awk '($5 == \"/dev/shm\") {printf $3}' /proc/self/mountinfo"
+	mm, err := d.Cmd("exec", "-i", name, "sh", "-c", cmd)
+	c.Assert(err, checker.IsNil)
+	c.Assert(mm, checker.Matches, "^[0-9]+:[0-9]+$")
+
+	exists, err := testIpcCheckDevExists(mm)
+	c.Assert(err, checker.IsNil)
+	c.Logf("[testDaemonIpcPrivateShareable] ipcdev: %v, exists: %v, mustExist: %v\n", mm, exists, mustExist)
+	c.Assert(exists, checker.Equals, mustExist)
+}
+
+// TestDaemonIpcModeShareable checks that --default-ipc-mode shareable works as intended.
+func (s *DockerDaemonSuite) TestDaemonIpcModeShareable(c *check.C) {
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
+
+	s.d.StartWithBusybox(c, "--default-ipc-mode", "shareable")
+	testDaemonIpcPrivateShareable(s.d, c, true)
+}
+
+// TestDaemonIpcModePrivate checks that --default-ipc-mode private works as intended.
+func (s *DockerDaemonSuite) TestDaemonIpcModePrivate(c *check.C) {
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
+
+	s.d.StartWithBusybox(c, "--default-ipc-mode", "private")
+	testDaemonIpcPrivateShareable(s.d, c, false)
+}
+
+// used to check if an IpcMode given in config works as intended
+func testDaemonIpcFromConfig(s *DockerDaemonSuite, c *check.C, mode string, mustExist bool) {
+	f, err := ioutil.TempFile("", "test-daemon-ipc-config")
+	c.Assert(err, checker.IsNil)
+	defer os.Remove(f.Name())
+
+	config := `{"default-ipc-mode": "` + mode + `"}`
+	_, err = f.WriteString(config)
+	c.Assert(f.Close(), checker.IsNil)
+	c.Assert(err, checker.IsNil)
+
+	s.d.StartWithBusybox(c, "--config-file", f.Name())
+	testDaemonIpcPrivateShareable(s.d, c, mustExist)
+}
+
+// TestDaemonIpcModePrivateFromConfig checks that "default-ipc-mode: private" config works as intended.
+func (s *DockerDaemonSuite) TestDaemonIpcModePrivateFromConfig(c *check.C) {
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
+	testDaemonIpcFromConfig(s, c, "private", false)
+}
+
+// TestDaemonIpcModeShareableFromConfig checks that "default-ipc-mode: shareable" config works as intended.
+func (s *DockerDaemonSuite) TestDaemonIpcModeShareableFromConfig(c *check.C) {
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
+	testDaemonIpcFromConfig(s, c, "shareable", true)
+}
+
 func testDaemonStartIpcMode(c *check.C, from, mode string, valid bool) {
 	d := daemon.New(c, dockerBinary, dockerdBinary, testdaemon.WithEnvironment(testEnv.Execution))
 	c.Logf("Checking IpcMode %s set from %s\n", mode, from)
@@ -2939,7 +3000,7 @@ func testDaemonStartIpcMode(c *check.C, from, mode string, valid bool) {
 // arguments for default IPC mode, and bails out with incorrect ones.
 // Both CLI option (--default-ipc-mode) and config parameter are tested.
 func (s *DockerDaemonSuite) TestDaemonStartWithIpcModes(c *check.C) {
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
 
 	ipcModes := []struct {
 		mode  string
@@ -3004,7 +3065,7 @@ func (s *DockerDaemonSuite) TestDaemonRestartIpcMode(c *check.C) {
 // TestFailedPluginRemove makes sure that a failed plugin remove does not block
 // the daemon from starting
 func (s *DockerDaemonSuite) TestFailedPluginRemove(c *check.C) {
-	testRequires(c, DaemonIsLinux, IsAmd64, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, IsAmd64, SameHostDaemon)
 	d := daemon.New(c, dockerBinary, dockerdBinary)
 	d.Start(c)
 	cli, err := client.NewClient(d.Sock(), api.DefaultVersion, nil, nil)
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_events_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_events_test.go
index b042faf91..8db120d03 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_events_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_events_test.go
@@ -458,7 +458,7 @@ func (s *DockerSuite) TestEventsResize(c *check.C) {
 	cID := strings.TrimSpace(out)
 	c.Assert(waitRun(cID), checker.IsNil)
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -564,7 +564,7 @@ func (s *DockerRegistrySuite) TestEventsImageFilterPush(c *check.C) {
 
 func (s *DockerSuite) TestEventsFilterType(c *check.C) {
 	// FIXME(vdemeester) fails on e2e run
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 	since := daemonUnixTime(c)
 	name := "labelfiltertest"
 	label := "io.docker.testing=image"
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_events_unix_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_events_unix_test.go
index 73e558672..92403e006 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_events_unix_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_events_unix_test.go
@@ -389,7 +389,7 @@ func (s *DockerSuite) TestEventsFilterNetworkID(c *check.C) {
 }
 
 func (s *DockerDaemonSuite) TestDaemonEvents(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	// daemon config file
 	configFilePath := "test.json"
@@ -458,7 +458,7 @@ func (s *DockerDaemonSuite) TestDaemonEvents(c *check.C) {
 }
 
 func (s *DockerDaemonSuite) TestDaemonEventsWithFilters(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	// daemon config file
 	configFilePath := "test.json"
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_exec_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_exec_test.go
index cdfd30704..72059c79e 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_exec_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_exec_test.go
@@ -86,7 +86,7 @@ func (s *DockerSuite) TestExecAfterContainerRestart(c *check.C) {
 
 func (s *DockerDaemonSuite) TestExecAfterDaemonRestart(c *check.C) {
 	// TODO Windows CI: Requires a little work to get this ported.
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
 	s.d.StartWithBusybox(c)
 
 	out, err := s.d.Cmd("run", "-d", "--name", "top", "-p", "80", "busybox:latest", "top")
@@ -359,7 +359,7 @@ func (s *DockerSuite) TestExecInspectID(c *check.C) {
 	}
 
 	// But we should still be able to query the execID
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -394,7 +394,7 @@ func (s *DockerSuite) TestLinksPingLinkedContainersOnRename(c *check.C) {
 
 func (s *DockerSuite) TestRunMutableNetworkFiles(c *check.C) {
 	// Not applicable on Windows to Windows CI.
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 	for _, fn := range []string{"resolv.conf", "hosts"} {
 		containers := cli.DockerCmd(c, "ps", "-q", "-a").Combined()
 		if containers != "" {
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_exec_unix_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_exec_unix_test.go
index 9c5843028..4c77df4f1 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_exec_unix_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_exec_unix_test.go
@@ -45,7 +45,7 @@ func (s *DockerSuite) TestExecInteractiveStdinClose(c *check.C) {
 }
 
 func (s *DockerSuite) TestExecTTY(c *check.C) {
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
 	dockerCmd(c, "run", "-d", "--name=test", "busybox", "sh", "-c", "echo hello > /foo && top")
 
 	cmd := exec.Command(dockerBinary, "exec", "-it", "test", "sh")
@@ -75,7 +75,7 @@ func (s *DockerSuite) TestExecTTY(c *check.C) {
 
 // Test the TERM env var is set when -t is provided on exec
 func (s *DockerSuite) TestExecWithTERM(c *check.C) {
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
 	out, _ := dockerCmd(c, "run", "-id", "busybox", "/bin/cat")
 	contID := strings.TrimSpace(out)
 	cmd := exec.Command(dockerBinary, "exec", "-t", contID, "sh", "-c", "if [ -z $TERM ]; then exit 1; else exit 0; fi")
@@ -87,7 +87,7 @@ func (s *DockerSuite) TestExecWithTERM(c *check.C) {
 // Test that the TERM env var is not set on exec when -t is not provided, even if it was set
 // on run
 func (s *DockerSuite) TestExecWithNoTERM(c *check.C) {
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
 	out, _ := dockerCmd(c, "run", "-itd", "busybox", "/bin/cat")
 	contID := strings.TrimSpace(out)
 	cmd := exec.Command(dockerBinary, "exec", contID, "sh", "-c", "if [ -z $TERM ]; then exit 0; else exit 1; fi")
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_export_import_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_export_import_test.go
new file mode 100644
index 000000000..d0dac9736
--- /dev/null
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_export_import_test.go
@@ -0,0 +1,34 @@
+package main
+
+import (
+	"os"
+	"strings"
+
+	"github.com/docker/docker/integration-cli/checker"
+	"github.com/go-check/check"
+	"gotest.tools/icmd"
+)
+
+// TODO: Move this test to docker/cli, as it is essentially the same test
+// as TestExportContainerAndImportImage except output to a file.
+// Used to test output flag in the export command
+func (s *DockerSuite) TestExportContainerWithOutputAndImportImage(c *check.C) {
+	testRequires(c, DaemonIsLinux)
+	containerID := "testexportcontainerwithoutputandimportimage"
+
+	dockerCmd(c, "run", "--name", containerID, "busybox", "true")
+	dockerCmd(c, "export", "--output=testexp.tar", containerID)
+	defer os.Remove("testexp.tar")
+
+	resultCat := icmd.RunCommand("cat", "testexp.tar")
+	resultCat.Assert(c, icmd.Success)
+
+	result := icmd.RunCmd(icmd.Cmd{
+		Command: []string{dockerBinary, "import", "-", "repo/testexp:v1"},
+		Stdin:   strings.NewReader(resultCat.Combined()),
+	})
+	result.Assert(c, icmd.Success)
+
+	cleanedImageID := strings.TrimSpace(result.Combined())
+	c.Assert(cleanedImageID, checker.Not(checker.Equals), "", check.Commentf("output should have been an image id"))
+}
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_external_volume_driver_unix_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_external_volume_driver_unix_test.go
index 063f49822..da8bb7e01 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_external_volume_driver_unix_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_external_volume_driver_unix_test.go
@@ -51,7 +51,7 @@ type DockerExternalVolumeSuite struct {
 }
 
 func (s *DockerExternalVolumeSuite) SetUpTest(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 	s.d = daemon.New(c, dockerBinary, dockerdBinary, testdaemon.WithEnvironment(testEnv.Execution))
 	s.ec = &eventCounter{}
 }
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_info_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_info_test.go
index e399d1477..65091029e 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_info_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_info_test.go
@@ -70,7 +70,7 @@ func (s *DockerSuite) TestInfoFormat(c *check.C) {
 // TestInfoDiscoveryBackend verifies that a daemon run with `--cluster-advertise` and
 // `--cluster-store` properly show the backend's endpoint in info output.
 func (s *DockerSuite) TestInfoDiscoveryBackend(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	d := daemon.New(c, dockerBinary, dockerdBinary, testdaemon.WithEnvironment(testEnv.Execution))
 	discoveryBackend := "consul://consuladdr:consulport/some/path"
@@ -87,7 +87,7 @@ func (s *DockerSuite) TestInfoDiscoveryBackend(c *check.C) {
 // TestInfoDiscoveryInvalidAdvertise verifies that a daemon run with
 // an invalid `--cluster-advertise` configuration
 func (s *DockerSuite) TestInfoDiscoveryInvalidAdvertise(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	d := daemon.New(c, dockerBinary, dockerdBinary, testdaemon.WithEnvironment(testEnv.Execution))
 	discoveryBackend := "consul://consuladdr:consulport/some/path"
@@ -104,7 +104,7 @@ func (s *DockerSuite) TestInfoDiscoveryInvalidAdvertise(c *check.C) {
 // TestInfoDiscoveryAdvertiseInterfaceName verifies that a daemon run with `--cluster-advertise`
 // configured with interface name properly show the advertise ip-address in info output.
 func (s *DockerSuite) TestInfoDiscoveryAdvertiseInterfaceName(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, Network, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, Network, DaemonIsLinux)
 
 	d := daemon.New(c, dockerBinary, dockerdBinary, testdaemon.WithEnvironment(testEnv.Execution))
 	discoveryBackend := "consul://consuladdr:consulport/some/path"
@@ -175,7 +175,7 @@ func (s *DockerSuite) TestInfoDisplaysStoppedContainers(c *check.C) {
 }
 
 func (s *DockerSuite) TestInfoDebug(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	d := daemon.New(c, dockerBinary, dockerdBinary, testdaemon.WithEnvironment(testEnv.Execution))
 	d.Start(c, "--debug")
@@ -193,7 +193,7 @@ func (s *DockerSuite) TestInfoDebug(c *check.C) {
 }
 
 func (s *DockerSuite) TestInsecureRegistries(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	registryCIDR := "192.168.1.0/24"
 	registryHost := "insecurehost.com:5000"
@@ -210,7 +210,7 @@ func (s *DockerSuite) TestInsecureRegistries(c *check.C) {
 }
 
 func (s *DockerDaemonSuite) TestRegistryMirrors(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	registryMirror1 := "https://192.168.1.2"
 	registryMirror2 := "http://registry.mirror.com:5000"
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_info_unix_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_info_unix_test.go
index 3ac1f9534..d55c05c4a 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_info_unix_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_info_unix_test.go
@@ -8,7 +8,7 @@ import (
 )
 
 func (s *DockerSuite) TestInfoSecurityOptions(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, seccompEnabled, Apparmor, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, seccompEnabled, Apparmor, DaemonIsLinux)
 
 	out, _ := dockerCmd(c, "info")
 	c.Assert(out, checker.Contains, "Security Options:\n apparmor\n seccomp\n  Profile: default\n")
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_links_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_links_test.go
index 3ddeb38b2..17b25d799 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_links_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_links_test.go
@@ -139,7 +139,7 @@ func (s *DockerSuite) TestLinksNotStartedParentNotFail(c *check.C) {
 
 func (s *DockerSuite) TestLinksHostsFilesInject(c *check.C) {
 	testRequires(c, DaemonIsLinux)
-	testRequires(c, testEnv.IsLocalDaemon, ExecSupport)
+	testRequires(c, SameHostDaemon, ExecSupport)
 
 	out, _ := dockerCmd(c, "run", "-itd", "--name", "one", "busybox", "top")
 	idOne := strings.TrimSpace(out)
@@ -157,7 +157,7 @@ func (s *DockerSuite) TestLinksHostsFilesInject(c *check.C) {
 
 func (s *DockerSuite) TestLinksUpdateOnRestart(c *check.C) {
 	testRequires(c, DaemonIsLinux)
-	testRequires(c, testEnv.IsLocalDaemon, ExecSupport)
+	testRequires(c, SameHostDaemon, ExecSupport)
 	dockerCmd(c, "run", "-d", "--name", "one", "busybox", "top")
 	out, _ := dockerCmd(c, "run", "-d", "--name", "two", "--link", "one:onetwo", "--link", "one:one", "busybox", "top")
 	id := strings.TrimSpace(string(out))
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_network_unix_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_network_unix_test.go
index 734e3ee88..d3d6256a7 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_network_unix_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_network_unix_test.go
@@ -590,7 +590,7 @@ func (s *DockerNetworkSuite) TestDockerNetworkConnectDisconnect(c *check.C) {
 }
 
 func (s *DockerNetworkSuite) TestDockerNetworkIPAMMultipleNetworks(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 	// test0 bridge network
 	dockerCmd(c, "network", "create", "--subnet=192.168.0.0/16", "test1")
 	assertNwIsAvailable(c, "test1")
@@ -631,7 +631,7 @@ func (s *DockerNetworkSuite) TestDockerNetworkIPAMMultipleNetworks(c *check.C) {
 }
 
 func (s *DockerNetworkSuite) TestDockerNetworkCustomIPAM(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 	// Create a bridge network using custom ipam driver
 	dockerCmd(c, "network", "create", "--ipam-driver", dummyIPAMDriver, "br0")
 	assertNwIsAvailable(c, "br0")
@@ -647,7 +647,7 @@ func (s *DockerNetworkSuite) TestDockerNetworkCustomIPAM(c *check.C) {
 }
 
 func (s *DockerNetworkSuite) TestDockerNetworkIPAMOptions(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 	// Create a bridge network using custom ipam driver and options
 	dockerCmd(c, "network", "create", "--ipam-driver", dummyIPAMDriver, "--ipam-opt", "opt1=drv1", "--ipam-opt", "opt2=drv2", "br0")
 	assertNwIsAvailable(c, "br0")
@@ -660,7 +660,7 @@ func (s *DockerNetworkSuite) TestDockerNetworkIPAMOptions(c *check.C) {
 }
 
 func (s *DockerNetworkSuite) TestDockerNetworkNullIPAMDriver(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 	// Create a network with null ipam driver
 	_, _, err := dockerCmdWithError("network", "create", "-d", dummyNetworkDriver, "--ipam-driver", "null", "test000")
 	c.Assert(err, check.IsNil)
@@ -766,7 +766,7 @@ func (s *DockerNetworkSuite) TestDockerNetworkIPAMInvalidCombinations(c *check.C
 }
 
 func (s *DockerNetworkSuite) TestDockerNetworkDriverOptions(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 	dockerCmd(c, "network", "create", "-d", dummyNetworkDriver, "-o", "opt1=drv1", "-o", "opt2=drv2", "testopt")
 	assertNwIsAvailable(c, "testopt")
 	gopts := remoteDriverNetworkRequest.Options[netlabel.GenericData]
@@ -950,7 +950,7 @@ func (s *DockerNetworkSuite) TestDockerNetworkLinkOnDefaultNetworkOnly(c *check.
 }
 
 func (s *DockerNetworkSuite) TestDockerNetworkOverlayPortMapping(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 	// Verify exposed ports are present in ps output when running a container on
 	// a network managed by a driver which does not provide the default gateway
 	// for the container
@@ -977,7 +977,7 @@ func (s *DockerNetworkSuite) TestDockerNetworkOverlayPortMapping(c *check.C) {
 }
 
 func (s *DockerNetworkSuite) TestDockerNetworkDriverUngracefulRestart(c *check.C) {
-	testRequires(c, DaemonIsLinux, NotUserNamespace, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, NotUserNamespace, SameHostDaemon)
 	dnd := "dnd"
 	did := "did"
 
@@ -1018,7 +1018,7 @@ func (s *DockerNetworkSuite) TestDockerNetworkDriverUngracefulRestart(c *check.C
 }
 
 func (s *DockerNetworkSuite) TestDockerNetworkMacInspect(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 	// Verify endpoint MAC address is correctly populated in container's network settings
 	nwn := "ov"
 	ctn := "bb"
@@ -1084,7 +1084,7 @@ func verifyContainerIsConnectedToNetworks(c *check.C, d *daemon.Daemon, cName st
 }
 
 func (s *DockerNetworkSuite) TestDockerNetworkMultipleNetworksGracefulDaemonRestart(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 	cName := "bb"
 	nwList := []string{"nw1", "nw2", "nw3"}
 
@@ -1103,7 +1103,7 @@ func (s *DockerNetworkSuite) TestDockerNetworkMultipleNetworksGracefulDaemonRest
 }
 
 func (s *DockerNetworkSuite) TestDockerNetworkMultipleNetworksUngracefulDaemonRestart(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 	cName := "cc"
 	nwList := []string{"nw1", "nw2", "nw3"}
 
@@ -1130,7 +1130,7 @@ func (s *DockerNetworkSuite) TestDockerNetworkRunNetByID(c *check.C) {
 }
 
 func (s *DockerNetworkSuite) TestDockerNetworkHostModeUngracefulDaemonRestart(c *check.C) {
-	testRequires(c, DaemonIsLinux, NotUserNamespace, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, NotUserNamespace, SameHostDaemon)
 	s.d.StartWithBusybox(c)
 
 	// Run a few containers on host network
@@ -1256,7 +1256,7 @@ func (s *DockerNetworkSuite) TestDockerNetworkRestartWithMultipleNetworks(c *che
 }
 
 func (s *DockerNetworkSuite) TestDockerNetworkConnectDisconnectToStoppedContainer(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 	dockerCmd(c, "network", "create", "test")
 	dockerCmd(c, "create", "--name=foo", "busybox", "top")
 	dockerCmd(c, "network", "connect", "test", "foo")
@@ -1785,7 +1785,7 @@ func (s *DockerNetworkSuite) TestDockerNetworkDisconnectFromBridge(c *check.C) {
 // TestConntrackFlowsLeak covers the failure scenario of ticket: https://github.com/docker/docker/issues/8795
 // Validates that conntrack is correctly cleaned once a container is destroyed
 func (s *DockerNetworkSuite) TestConntrackFlowsLeak(c *check.C) {
-	testRequires(c, IsAmd64, DaemonIsLinux, Network, testEnv.IsLocalDaemon)
+	testRequires(c, IsAmd64, DaemonIsLinux, Network, SameHostDaemon)
 
 	// Create a new network
 	cli.DockerCmd(c, "network", "create", "--subnet=192.168.10.0/24", "--gateway=192.168.10.1", "-o", "com.docker.network.bridge.host_binding_ipv4=192.168.10.1", "testbind")
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_plugins_logdriver_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_plugins_logdriver_test.go
index 5fbae2936..7d1ffcb63 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_plugins_logdriver_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_plugins_logdriver_test.go
@@ -35,7 +35,7 @@ func (s *DockerSuite) TestPluginLogDriverInfoList(c *check.C) {
 
 	dockerCmd(c, "plugin", "install", pluginName)
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_plugins_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_plugins_test.go
index 802a74527..2cc5bfe2f 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_plugins_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_plugins_test.go
@@ -440,7 +440,7 @@ enabled: false`, id, name)
 }
 
 func (s *DockerSuite) TestPluginUpgrade(c *check.C) {
-	testRequires(c, DaemonIsLinux, Network, testEnv.IsLocalDaemon, IsAmd64, NotUserNamespace)
+	testRequires(c, DaemonIsLinux, Network, SameHostDaemon, IsAmd64, NotUserNamespace)
 	plugin := "cpuguy83/docker-volume-driver-plugin-local:latest"
 	pluginV2 := "cpuguy83/docker-volume-driver-plugin-local:v2"
 
@@ -472,7 +472,7 @@ func (s *DockerSuite) TestPluginUpgrade(c *check.C) {
 }
 
 func (s *DockerSuite) TestPluginMetricsCollector(c *check.C) {
-	testRequires(c, DaemonIsLinux, Network, testEnv.IsLocalDaemon, IsAmd64)
+	testRequires(c, DaemonIsLinux, Network, SameHostDaemon, IsAmd64)
 	d := daemon.New(c, dockerBinary, dockerdBinary)
 	d.Start(c)
 	defer d.Stop(c)
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_proxy_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_proxy_test.go
index e57c9c2c7..52159aa9c 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_proxy_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_proxy_test.go
@@ -10,7 +10,7 @@ import (
 )
 
 func (s *DockerSuite) TestCLIProxyDisableProxyUnixSock(c *check.C) {
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
 
 	icmd.RunCmd(icmd.Cmd{
 		Command: []string{dockerBinary, "info"},
@@ -21,7 +21,7 @@ func (s *DockerSuite) TestCLIProxyDisableProxyUnixSock(c *check.C) {
 // Can't use localhost here since go has a special case to not use proxy if connecting to localhost
 // See https://golang.org/pkg/net/http/#ProxyFromEnvironment
 func (s *DockerDaemonSuite) TestCLIProxyProxyTCPSock(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 	// get the IP to use to connect since we can't use localhost
 	addrs, err := net.InterfaceAddrs()
 	c.Assert(err, checker.IsNil)
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_restart_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_restart_test.go
index 7df698170..791677e6e 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_restart_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_restart_test.go
@@ -76,7 +76,7 @@ func (s *DockerSuite) TestRestartWithVolumes(c *check.C) {
 }
 
 func (s *DockerSuite) TestRestartDisconnectedContainer(c *check.C) {
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon, NotUserNamespace, NotArm)
+	testRequires(c, DaemonIsLinux, SameHostDaemon, NotUserNamespace, NotArm)
 
 	// Run a container on the default bridge network
 	out, _ := dockerCmd(c, "run", "-d", "--name", "c0", "busybox", "top")
@@ -164,7 +164,7 @@ func (s *DockerSuite) TestRestartContainerwithGoodContainer(c *check.C) {
 }
 
 func (s *DockerSuite) TestRestartContainerSuccess(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 
 	out := runSleepingContainer(c, "-d", "--restart=always")
 	id := strings.TrimSpace(out)
@@ -191,7 +191,7 @@ func (s *DockerSuite) TestRestartContainerSuccess(c *check.C) {
 
 func (s *DockerSuite) TestRestartWithPolicyUserDefinedNetwork(c *check.C) {
 	// TODO Windows. This may be portable following HNS integration post TP5.
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon, NotUserNamespace, NotArm)
+	testRequires(c, DaemonIsLinux, SameHostDaemon, NotUserNamespace, NotArm)
 	dockerCmd(c, "network", "create", "-d", "bridge", "udNet")
 
 	dockerCmd(c, "run", "-d", "--net=udNet", "--name=first", "busybox", "top")
@@ -234,7 +234,7 @@ func (s *DockerSuite) TestRestartWithPolicyUserDefinedNetwork(c *check.C) {
 }
 
 func (s *DockerSuite) TestRestartPolicyAfterRestart(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 
 	out := runSleepingContainer(c, "-d", "--restart=always")
 	id := strings.TrimSpace(out)
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_run_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_run_test.go
index 81232a5d6..4f55c05ae 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_run_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_run_test.go
@@ -383,7 +383,7 @@ func (s *DockerSuite) TestRunCreateVolumesInSymlinkDir(c *check.C) {
 	)
 	// This test cannot run on a Windows daemon as
 	// Windows does not support symlinks inside a volume path
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 	name := "test-volume-symlink"
 
 	dir, err := ioutil.TempDir("", name)
@@ -427,7 +427,7 @@ func (s *DockerSuite) TestRunCreateVolumesInSymlinkDir2(c *check.C) {
 	)
 	// This test cannot run on a Windows daemon as
 	// Windows does not support symlinks inside a volume path
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 	name := "test-volume-symlink2"
 
 	if testEnv.OSType == "windows" {
@@ -494,7 +494,7 @@ func (s *DockerSuite) TestRunVolumesFromInReadWriteMode(c *check.C) {
 }
 
 func (s *DockerSuite) TestVolumesFromGetsProperMode(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 	prefix, slash := getPrefixAndSlashFromDaemonPlatform()
 	hostpath := RandomTmpDirPath("test", testEnv.OSType)
 	if err := os.MkdirAll(hostpath, 0755); err != nil {
@@ -525,7 +525,7 @@ func (s *DockerSuite) TestRunNoDupVolumes(c *check.C) {
 	someplace := ":/someplace"
 	if testEnv.OSType == "windows" {
 		// Windows requires that the source directory exists before calling HCS
-		testRequires(c, testEnv.IsLocalDaemon)
+		testRequires(c, SameHostDaemon)
 		someplace = `:c:\someplace`
 		if err := os.MkdirAll(path1, 0755); err != nil {
 			c.Fatalf("Failed to create %s: %q", path1, err)
@@ -1198,7 +1198,7 @@ func (s *DockerSuite) TestRunAddingOptionalDevicesInvalidMode(c *check.C) {
 
 func (s *DockerSuite) TestRunModeHostname(c *check.C) {
 	// Not applicable on Windows as Windows does not support -h
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, NotUserNamespace)
+	testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)
 
 	out, _ := dockerCmd(c, "run", "-h=testhostname", "busybox", "cat", "/etc/hostname")
 
@@ -1253,7 +1253,7 @@ func (s *DockerSuite) TestRunDisallowBindMountingRootToRoot(c *check.C) {
 // Verify that a container gets default DNS when only localhost resolvers exist
 func (s *DockerSuite) TestRunDNSDefaultOptions(c *check.C) {
 	// Not applicable on Windows as this is testing Unix specific functionality
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	// preserve original resolv.conf for restoring after test
 	origResolvConf, err := ioutil.ReadFile("/etc/resolv.conf")
@@ -1321,7 +1321,7 @@ func (s *DockerSuite) TestRunDNSRepeatOptions(c *check.C) {
 
 func (s *DockerSuite) TestRunDNSOptionsBasedOnHostResolvConf(c *check.C) {
 	// Not applicable on Windows as testing Unix specific functionality
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	origResolvConf, err := ioutil.ReadFile("/etc/resolv.conf")
 	if os.IsNotExist(err) {
@@ -1403,7 +1403,7 @@ func (s *DockerSuite) TestRunDNSOptionsBasedOnHostResolvConf(c *check.C) {
 // check if the container resolv.conf file has at least 0644 perm.
 func (s *DockerSuite) TestRunNonRootUserResolvName(c *check.C) {
 	// Not applicable on Windows as Windows does not support --user
-	testRequires(c, testEnv.IsLocalDaemon, Network, DaemonIsLinux, NotArm)
+	testRequires(c, SameHostDaemon, Network, DaemonIsLinux, NotArm)
 
 	dockerCmd(c, "run", "--name=testperm", "--user=nobody", "busybox", "nslookup", "apt.dockerproject.org")
 
@@ -1425,7 +1425,7 @@ func (s *DockerSuite) TestRunNonRootUserResolvName(c *check.C) {
 // uses the host's /etc/resolv.conf and does not have any dns options provided.
 func (s *DockerSuite) TestRunResolvconfUpdate(c *check.C) {
 	// Not applicable on Windows as testing unix specific functionality
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 	c.Skip("Unstable test, to be re-activated once #19937 is resolved")
 
 	tmpResolvConf := []byte("search pommesfrites.fr\nnameserver 12.34.56.78\n")
@@ -1880,7 +1880,7 @@ func (s *DockerSuite) TestRunEntrypoint(c *check.C) {
 }
 
 func (s *DockerSuite) TestRunBindMounts(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 	if testEnv.OSType == "linux" {
 		testRequires(c, DaemonIsLinux, NotUserNamespace)
 	}
@@ -2025,7 +2025,7 @@ func (s *DockerSuite) TestRunWithInvalidMacAddress(c *check.C) {
 
 func (s *DockerSuite) TestRunDeallocatePortOnMissingIptablesRule(c *check.C) {
 	// TODO Windows. Network settings are not propagated back to inspect.
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	out := cli.DockerCmd(c, "run", "-d", "-p", "23:23", "busybox", "top").Combined()
 
@@ -2043,7 +2043,7 @@ func (s *DockerSuite) TestRunPortInUse(c *check.C) {
 	// TODO Windows. The duplicate NAT message returned by Windows will be
 	// changing as is currently completely undecipherable. Does need modifying
 	// to run sh rather than top though as top isn't in Windows busybox.
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	port := "1234"
 	dockerCmd(c, "run", "-d", "-p", port+":80", "busybox", "top")
@@ -2081,7 +2081,7 @@ func (s *DockerSuite) TestRunAllocatePortInReservedRange(c *check.C) {
 // Regression test for #7792
 func (s *DockerSuite) TestRunMountOrdering(c *check.C) {
 	// TODO Windows: Post RS1. Windows does not support nested mounts.
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, NotUserNamespace)
+	testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)
 	prefix, _ := getPrefixAndSlashFromDaemonPlatform()
 
 	tmpDir, err := ioutil.TempDir("", "docker_nested_mount_test")
@@ -2126,7 +2126,7 @@ func (s *DockerSuite) TestRunMountOrdering(c *check.C) {
 // Regression test for https://github.com/docker/docker/issues/8259
 func (s *DockerSuite) TestRunReuseBindVolumeThatIsSymlink(c *check.C) {
 	// Not applicable on Windows as Windows does not support volumes
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, NotUserNamespace)
+	testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)
 	prefix, _ := getPrefixAndSlashFromDaemonPlatform()
 
 	tmpDir, err := ioutil.TempDir(os.TempDir(), "testlink")
@@ -2205,7 +2205,7 @@ func (s *DockerSuite) TestRunNoOutputFromPullInStdout(c *check.C) {
 }
 
 func (s *DockerSuite) TestRunVolumesCleanPaths(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 	prefix, slash := getPrefixAndSlashFromDaemonPlatform()
 	buildImageSuccessfully(c, "run_volumes_clean_paths", build.WithDockerfile(`FROM busybox
 		VOLUME `+prefix+`/foo/`))
@@ -2294,7 +2294,7 @@ func (s *DockerSuite) TestRunExposePort(c *check.C) {
 
 func (s *DockerSuite) TestRunModeIpcHost(c *check.C) {
 	// Not applicable on Windows as uses Unix-specific capabilities
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, NotUserNamespace)
+	testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)
 
 	hostIpc, err := os.Readlink("/proc/1/ns/ipc")
 	if err != nil {
@@ -2325,7 +2325,7 @@ func (s *DockerSuite) TestRunModeIpcContainerNotExists(c *check.C) {
 
 func (s *DockerSuite) TestRunModeIpcContainerNotRunning(c *check.C) {
 	// Not applicable on Windows as uses Unix-specific capabilities
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	out, _ := dockerCmd(c, "create", "busybox")
 
@@ -2338,7 +2338,7 @@ func (s *DockerSuite) TestRunModeIpcContainerNotRunning(c *check.C) {
 
 func (s *DockerSuite) TestRunModePIDContainer(c *check.C) {
 	// Not applicable on Windows as uses Unix-specific capabilities
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	out, _ := dockerCmd(c, "run", "-d", "busybox", "sh", "-c", "top")
 
@@ -2372,7 +2372,7 @@ func (s *DockerSuite) TestRunModePIDContainerNotExists(c *check.C) {
 
 func (s *DockerSuite) TestRunModePIDContainerNotRunning(c *check.C) {
 	// Not applicable on Windows as uses Unix-specific capabilities
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	out, _ := dockerCmd(c, "create", "busybox")
 
@@ -2385,7 +2385,7 @@ func (s *DockerSuite) TestRunModePIDContainerNotRunning(c *check.C) {
 
 func (s *DockerSuite) TestRunMountShmMqueueFromHost(c *check.C) {
 	// Not applicable on Windows as uses Unix-specific capabilities
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, NotUserNamespace)
+	testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)
 
 	dockerCmd(c, "run", "-d", "--name", "shmfromhost", "-v", "/dev/shm:/dev/shm", "-v", "/dev/mqueue:/dev/mqueue", "busybox", "sh", "-c", "echo -n test > /dev/shm/test && touch /dev/mqueue/toto && top")
 	defer os.Remove("/dev/mqueue/toto")
@@ -2409,7 +2409,7 @@ func (s *DockerSuite) TestRunMountShmMqueueFromHost(c *check.C) {
 
 func (s *DockerSuite) TestContainerNetworkMode(c *check.C) {
 	// Not applicable on Windows as uses Unix-specific capabilities
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	out, _ := dockerCmd(c, "run", "-d", "busybox", "top")
 	id := strings.TrimSpace(out)
@@ -2430,7 +2430,7 @@ func (s *DockerSuite) TestContainerNetworkMode(c *check.C) {
 
 func (s *DockerSuite) TestRunModePIDHost(c *check.C) {
 	// Not applicable on Windows as uses Unix-specific capabilities
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, NotUserNamespace)
+	testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)
 
 	hostPid, err := os.Readlink("/proc/1/ns/pid")
 	if err != nil {
@@ -2452,7 +2452,7 @@ func (s *DockerSuite) TestRunModePIDHost(c *check.C) {
 
 func (s *DockerSuite) TestRunModeUTSHost(c *check.C) {
 	// Not applicable on Windows as uses Unix-specific capabilities
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	hostUTS, err := os.Readlink("/proc/1/ns/uts")
 	if err != nil {
@@ -2477,7 +2477,7 @@ func (s *DockerSuite) TestRunModeUTSHost(c *check.C) {
 
 func (s *DockerSuite) TestRunTLSVerify(c *check.C) {
 	// Remote daemons use TLS and this test is not applicable when TLS is required.
-	testRequires(c, testEnv.IsLocalDaemon)
+	testRequires(c, SameHostDaemon)
 	if out, code, err := dockerCmdWithError("ps"); err != nil || code != 0 {
 		c.Fatalf("Should have worked: %v:\n%v", err, out)
 	}
@@ -2574,7 +2574,7 @@ func (s *DockerSuite) TestRunNonLocalMacAddress(c *check.C) {
 
 func (s *DockerSuite) TestRunNetHost(c *check.C) {
 	// Not applicable on Windows as uses Unix-specific capabilities
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, NotUserNamespace)
+	testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)
 
 	hostNet, err := os.Readlink("/proc/1/ns/net")
 	if err != nil {
@@ -2597,7 +2597,7 @@ func (s *DockerSuite) TestRunNetHost(c *check.C) {
 func (s *DockerSuite) TestRunNetHostTwiceSameName(c *check.C) {
 	// TODO Windows. As Windows networking evolves and converges towards
 	// CNM, this test may be possible to enable on Windows.
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, NotUserNamespace)
+	testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)
 
 	dockerCmd(c, "run", "--rm", "--name=thost", "--net=host", "busybox", "true")
 	dockerCmd(c, "run", "--rm", "--name=thost", "--net=host", "busybox", "true")
@@ -2605,7 +2605,7 @@ func (s *DockerSuite) TestRunNetHostTwiceSameName(c *check.C) {
 
 func (s *DockerSuite) TestRunNetContainerWhichHost(c *check.C) {
 	// Not applicable on Windows as uses Unix-specific capabilities
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, NotUserNamespace)
+	testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)
 
 	hostNet, err := os.Readlink("/proc/1/ns/net")
 	if err != nil {
@@ -3068,7 +3068,7 @@ func (s *DockerSuite) TestRunWriteFilteredProc(c *check.C) {
 
 func (s *DockerSuite) TestRunNetworkFilesBindMount(c *check.C) {
 	// Not applicable on Windows as uses Unix specific functionality
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	expected := "test123"
 
@@ -3092,7 +3092,7 @@ func (s *DockerSuite) TestRunNetworkFilesBindMount(c *check.C) {
 
 func (s *DockerSuite) TestRunNetworkFilesBindMountRO(c *check.C) {
 	// Not applicable on Windows as uses Unix specific functionality
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	filename := createTmpFile(c, "test123")
 	defer os.Remove(filename)
@@ -3114,7 +3114,7 @@ func (s *DockerSuite) TestRunNetworkFilesBindMountRO(c *check.C) {
 
 func (s *DockerSuite) TestRunNetworkFilesBindMountROFilesystem(c *check.C) {
 	// Not applicable on Windows as uses Unix specific functionality
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, UserNamespaceROMount)
+	testRequires(c, SameHostDaemon, DaemonIsLinux, UserNamespaceROMount)
 
 	filename := createTmpFile(c, "test123")
 	defer os.Remove(filename)
@@ -3143,7 +3143,7 @@ func (s *DockerSuite) TestRunNetworkFilesBindMountROFilesystem(c *check.C) {
 
 func (s *DockerSuite) TestPtraceContainerProcsFromHost(c *check.C) {
 	// Not applicable on Windows as uses Unix specific functionality
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
 
 	out, _ := dockerCmd(c, "run", "-d", "busybox", "top")
 	id := strings.TrimSpace(out)
@@ -3158,7 +3158,7 @@ func (s *DockerSuite) TestPtraceContainerProcsFromHost(c *check.C) {
 
 func (s *DockerSuite) TestAppArmorDeniesPtrace(c *check.C) {
 	// Not applicable on Windows as uses Unix specific functionality
-	testRequires(c, testEnv.IsLocalDaemon, Apparmor, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, Apparmor, DaemonIsLinux)
 
 	// Run through 'sh' so we are NOT pid 1. Pid 1 may be able to trace
 	// itself, but pid>1 should not be able to trace pid1.
@@ -3170,7 +3170,7 @@ func (s *DockerSuite) TestAppArmorDeniesPtrace(c *check.C) {
 
 func (s *DockerSuite) TestAppArmorTraceSelf(c *check.C) {
 	// Not applicable on Windows as uses Unix specific functionality
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon, Apparmor)
+	testRequires(c, DaemonIsLinux, SameHostDaemon, Apparmor)
 
 	_, exitCode, _ := dockerCmdWithError("run", "busybox", "readlink", "/proc/1/ns/net")
 	if exitCode != 0 {
@@ -3180,7 +3180,7 @@ func (s *DockerSuite) TestAppArmorTraceSelf(c *check.C) {
 
 func (s *DockerSuite) TestAppArmorDeniesChmodProc(c *check.C) {
 	// Not applicable on Windows as uses Unix specific functionality
-	testRequires(c, testEnv.IsLocalDaemon, Apparmor, DaemonIsLinux, NotUserNamespace)
+	testRequires(c, SameHostDaemon, Apparmor, DaemonIsLinux, NotUserNamespace)
 	_, exitCode, _ := dockerCmdWithError("run", "busybox", "chmod", "744", "/proc/cpuinfo")
 	if exitCode == 0 {
 		// If our test failed, attempt to repair the host system...
@@ -3771,7 +3771,7 @@ func (s *DockerSuite) TestRunWithOomScoreAdjInvalidRange(c *check.C) {
 func (s *DockerSuite) TestRunVolumesMountedAsShared(c *check.C) {
 	// Volume propagation is linux only. Also it creates directories for
 	// bind mounting, so needs to be same host.
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon, NotUserNamespace)
+	testRequires(c, DaemonIsLinux, SameHostDaemon, NotUserNamespace)
 
 	// Prepare a source directory to bind mount
 	tmpDir, err := ioutil.TempDir("", "volume-source")
@@ -3802,7 +3802,7 @@ func (s *DockerSuite) TestRunVolumesMountedAsShared(c *check.C) {
 func (s *DockerSuite) TestRunVolumesMountedAsSlave(c *check.C) {
 	// Volume propagation is linux only. Also it creates directories for
 	// bind mounting, so needs to be same host.
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon, NotUserNamespace)
+	testRequires(c, DaemonIsLinux, SameHostDaemon, NotUserNamespace)
 
 	// Prepare a source directory to bind mount
 	tmpDir, err := ioutil.TempDir("", "volume-source")
@@ -3893,7 +3893,7 @@ func (s *DockerSuite) TestRunNamedVolumesFromNotRemoved(c *check.C) {
 	cid, _ := dockerCmd(c, "run", "-d", "--name=parent", "-v", "test:"+prefix+"/foo", "-v", prefix+"/bar", "busybox", "true")
 	dockerCmd(c, "run", "--name=child", "--volumes-from=parent", "busybox", "true")
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
@@ -4164,14 +4164,14 @@ func (s *DockerSuite) TestRunCredentialSpecFailures(c *check.C) {
 // Note it won't actually do anything in CI configuration with the spec, but
 // it should not fail to run a container.
 func (s *DockerSuite) TestRunCredentialSpecWellFormed(c *check.C) {
-	testRequires(c, DaemonIsWindows, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsWindows, SameHostDaemon)
 	validCS := readFile(`fixtures\credentialspecs\valid.json`, c)
 	writeFile(filepath.Join(testEnv.DaemonInfo.DockerRootDir, `credentialspecs\valid.json`), validCS, c)
 	dockerCmd(c, "run", `--security-opt=credentialspec=file://valid.json`, "busybox", "true")
 }
 
 func (s *DockerSuite) TestRunDuplicateMount(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, NotUserNamespace)
+	testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)
 
 	tmpFile, err := ioutil.TempFile("", "touch-me")
 	c.Assert(err, checker.IsNil)
@@ -4307,7 +4307,7 @@ func (s *delayedReader) Read([]byte) (int, error) {
 
 // #28823 (originally #28639)
 func (s *DockerSuite) TestRunMountReadOnlyDevShm(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, NotUserNamespace)
+	testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)
 	emptyDir, err := ioutil.TempDir("", "test-read-only-dev-shm")
 	c.Assert(err, check.IsNil)
 	defer os.RemoveAll(emptyDir)
@@ -4319,7 +4319,7 @@ func (s *DockerSuite) TestRunMountReadOnlyDevShm(c *check.C) {
 }
 
 func (s *DockerSuite) TestRunMount(c *check.C) {
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon, NotUserNamespace)
+	testRequires(c, DaemonIsLinux, SameHostDaemon, NotUserNamespace)
 
 	// mnt1, mnt2, and testCatFooBar are commonly used in multiple test cases
 	tmpDir, err := ioutil.TempDir("", "mount")
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_run_unix_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_run_unix_test.go
index 6ed2ee9cc..5f782ee53 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_run_unix_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_run_unix_test.go
@@ -61,7 +61,7 @@ func (s *DockerSuite) TestRunRedirectStdout(c *check.C) {
 // Test recursive bind mount works by default
 func (s *DockerSuite) TestRunWithVolumesIsRecursive(c *check.C) {
 	// /tmp gets permission denied
-	testRequires(c, NotUserNamespace, testEnv.IsLocalDaemon)
+	testRequires(c, NotUserNamespace, SameHostDaemon)
 	tmpDir, err := ioutil.TempDir("", "docker_recursive_mount_test")
 	c.Assert(err, checker.IsNil)
 
@@ -497,7 +497,7 @@ func (s *DockerSuite) TestRunWithInvalidCpuPeriod(c *check.C) {
 }
 
 func (s *DockerSuite) TestRunWithKernelMemory(c *check.C) {
-	testRequires(c, DaemonIsLinux, kernelMemorySupport)
+	testRequires(c, kernelMemorySupport)
 
 	file := "/sys/fs/cgroup/memory/memory.kmem.limit_in_bytes"
 	cli.DockerCmd(c, "run", "--kernel-memory", "50M", "--name", "test1", "busybox", "cat", file).Assert(c, icmd.Expected{
@@ -510,7 +510,7 @@ func (s *DockerSuite) TestRunWithKernelMemory(c *check.C) {
 }
 
 func (s *DockerSuite) TestRunWithInvalidKernelMemory(c *check.C) {
-	testRequires(c, DaemonIsLinux, kernelMemorySupport)
+	testRequires(c, kernelMemorySupport)
 
 	out, _, err := dockerCmdWithError("run", "--kernel-memory", "2M", "busybox", "true")
 	c.Assert(err, check.NotNil)
@@ -680,7 +680,7 @@ func (s *DockerSuite) TestRunWithSwappinessInvalid(c *check.C) {
 }
 
 func (s *DockerSuite) TestRunWithMemoryReservation(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, memoryReservationSupport)
+	testRequires(c, SameHostDaemon, memoryReservationSupport)
 
 	file := "/sys/fs/cgroup/memory/memory.soft_limit_in_bytes"
 	out, _ := dockerCmd(c, "run", "--memory-reservation", "200M", "--name", "test", "busybox", "cat", file)
@@ -692,7 +692,7 @@ func (s *DockerSuite) TestRunWithMemoryReservation(c *check.C) {
 
 func (s *DockerSuite) TestRunWithMemoryReservationInvalid(c *check.C) {
 	testRequires(c, memoryLimitSupport)
-	testRequires(c, testEnv.IsLocalDaemon, memoryReservationSupport)
+	testRequires(c, SameHostDaemon, memoryReservationSupport)
 	out, _, err := dockerCmdWithError("run", "-m", "500M", "--memory-reservation", "800M", "busybox", "true")
 	c.Assert(err, check.NotNil)
 	expected := "Minimum memory limit can not be less than memory reservation limit"
@@ -727,7 +727,7 @@ func (s *DockerSuite) TestRunSwapLessThanMemoryLimit(c *check.C) {
 }
 
 func (s *DockerSuite) TestRunInvalidCpusetCpusFlagValue(c *check.C) {
-	testRequires(c, cgroupCpuset, testEnv.IsLocalDaemon)
+	testRequires(c, cgroupCpuset, SameHostDaemon)
 
 	sysInfo := sysinfo.New(true)
 	cpus, err := parsers.ParseUintList(sysInfo.Cpus)
@@ -921,7 +921,7 @@ func (s *DockerSuite) TestRunSysctls(c *check.C) {
 
 // TestRunSeccompProfileDenyUnshare checks that 'docker run --security-opt seccomp=/tmp/profile.json debian:jessie unshare' exits with operation not permitted.
 func (s *DockerSuite) TestRunSeccompProfileDenyUnshare(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, seccompEnabled, NotArm, Apparmor)
+	testRequires(c, SameHostDaemon, seccompEnabled, NotArm, Apparmor)
 	jsonData := `{
 	"defaultAction": "SCMP_ACT_ALLOW",
 	"syscalls": [
@@ -950,7 +950,7 @@ func (s *DockerSuite) TestRunSeccompProfileDenyUnshare(c *check.C) {
 
 // TestRunSeccompProfileDenyChmod checks that 'docker run --security-opt seccomp=/tmp/profile.json busybox chmod 400 /etc/hostname' exits with operation not permitted.
 func (s *DockerSuite) TestRunSeccompProfileDenyChmod(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, seccompEnabled)
+	testRequires(c, SameHostDaemon, seccompEnabled)
 	jsonData := `{
 	"defaultAction": "SCMP_ACT_ALLOW",
 	"syscalls": [
@@ -985,7 +985,7 @@ func (s *DockerSuite) TestRunSeccompProfileDenyChmod(c *check.C) {
 // TestRunSeccompProfileDenyUnshareUserns checks that 'docker run debian:jessie unshare --map-root-user --user sh -c whoami' with a specific profile to
 // deny unshare of a userns exits with operation not permitted.
 func (s *DockerSuite) TestRunSeccompProfileDenyUnshareUserns(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, seccompEnabled, NotArm, Apparmor)
+	testRequires(c, SameHostDaemon, seccompEnabled, NotArm, Apparmor)
 	// from sched.h
 	jsonData := fmt.Sprintf(`{
 	"defaultAction": "SCMP_ACT_ALLOW",
@@ -1023,7 +1023,7 @@ func (s *DockerSuite) TestRunSeccompProfileDenyUnshareUserns(c *check.C) {
 // TestRunSeccompProfileDenyCloneUserns checks that 'docker run syscall-test'
 // with a the default seccomp profile exits with operation not permitted.
 func (s *DockerSuite) TestRunSeccompProfileDenyCloneUserns(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, seccompEnabled)
+	testRequires(c, SameHostDaemon, seccompEnabled)
 	ensureSyscallTest(c)
 
 	icmd.RunCommand(dockerBinary, "run", "syscall-test", "userns-test", "id").Assert(c, icmd.Expected{
@@ -1035,7 +1035,7 @@ func (s *DockerSuite) TestRunSeccompProfileDenyCloneUserns(c *check.C) {
 // TestRunSeccompUnconfinedCloneUserns checks that
 // 'docker run --security-opt seccomp=unconfined syscall-test' allows creating a userns.
 func (s *DockerSuite) TestRunSeccompUnconfinedCloneUserns(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, seccompEnabled, UserNamespaceInKernel, NotUserNamespace, unprivilegedUsernsClone)
+	testRequires(c, SameHostDaemon, seccompEnabled, UserNamespaceInKernel, NotUserNamespace, unprivilegedUsernsClone)
 	ensureSyscallTest(c)
 
 	// make sure running w privileged is ok
@@ -1048,7 +1048,7 @@ func (s *DockerSuite) TestRunSeccompUnconfinedCloneUserns(c *check.C) {
 // TestRunSeccompAllowPrivCloneUserns checks that 'docker run --privileged syscall-test'
 // allows creating a userns.
 func (s *DockerSuite) TestRunSeccompAllowPrivCloneUserns(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, seccompEnabled, UserNamespaceInKernel, NotUserNamespace)
+	testRequires(c, SameHostDaemon, seccompEnabled, UserNamespaceInKernel, NotUserNamespace)
 	ensureSyscallTest(c)
 
 	// make sure running w privileged is ok
@@ -1060,7 +1060,7 @@ func (s *DockerSuite) TestRunSeccompAllowPrivCloneUserns(c *check.C) {
 // TestRunSeccompProfileAllow32Bit checks that 32 bit code can run on x86_64
 // with the default seccomp profile.
 func (s *DockerSuite) TestRunSeccompProfileAllow32Bit(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, seccompEnabled, IsAmd64)
+	testRequires(c, SameHostDaemon, seccompEnabled, IsAmd64)
 	ensureSyscallTest(c)
 
 	icmd.RunCommand(dockerBinary, "run", "syscall-test", "exit32-test").Assert(c, icmd.Success)
@@ -1068,14 +1068,14 @@ func (s *DockerSuite) TestRunSeccompProfileAllow32Bit(c *check.C) {
 
 // TestRunSeccompAllowSetrlimit checks that 'docker run debian:jessie ulimit -v 1048510' succeeds.
 func (s *DockerSuite) TestRunSeccompAllowSetrlimit(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, seccompEnabled)
+	testRequires(c, SameHostDaemon, seccompEnabled)
 
 	// ulimit uses setrlimit, so we want to make sure we don't break it
 	icmd.RunCommand(dockerBinary, "run", "debian:jessie", "bash", "-c", "ulimit -v 1048510").Assert(c, icmd.Success)
 }
 
 func (s *DockerSuite) TestRunSeccompDefaultProfileAcct(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, seccompEnabled, NotUserNamespace)
+	testRequires(c, SameHostDaemon, seccompEnabled, NotUserNamespace)
 	ensureSyscallTest(c)
 
 	out, _, err := dockerCmdWithError("run", "syscall-test", "acct-test")
@@ -1105,7 +1105,7 @@ func (s *DockerSuite) TestRunSeccompDefaultProfileAcct(c *check.C) {
 }
 
 func (s *DockerSuite) TestRunSeccompDefaultProfileNS(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, seccompEnabled, NotUserNamespace)
+	testRequires(c, SameHostDaemon, seccompEnabled, NotUserNamespace)
 	ensureSyscallTest(c)
 
 	out, _, err := dockerCmdWithError("run", "syscall-test", "ns-test", "echo", "hello0")
@@ -1140,9 +1140,9 @@ func (s *DockerSuite) TestRunSeccompDefaultProfileNS(c *check.C) {
 }
 
 // TestRunNoNewPrivSetuid checks that --security-opt='no-new-privileges=true' prevents
-// effective uid transitions on executing setuid binaries.
+// effective uid transtions on executing setuid binaries.
 func (s *DockerSuite) TestRunNoNewPrivSetuid(c *check.C) {
-	testRequires(c, DaemonIsLinux, NotUserNamespace, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, NotUserNamespace, SameHostDaemon)
 	ensureNNPTest(c)
 
 	// test that running a setuid binary results in no effective uid transition
@@ -1153,9 +1153,9 @@ func (s *DockerSuite) TestRunNoNewPrivSetuid(c *check.C) {
 }
 
 // TestLegacyRunNoNewPrivSetuid checks that --security-opt=no-new-privileges prevents
-// effective uid transitions on executing setuid binaries.
+// effective uid transtions on executing setuid binaries.
 func (s *DockerSuite) TestLegacyRunNoNewPrivSetuid(c *check.C) {
-	testRequires(c, DaemonIsLinux, NotUserNamespace, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, NotUserNamespace, SameHostDaemon)
 	ensureNNPTest(c)
 
 	// test that running a setuid binary results in no effective uid transition
@@ -1166,7 +1166,7 @@ func (s *DockerSuite) TestLegacyRunNoNewPrivSetuid(c *check.C) {
 }
 
 func (s *DockerSuite) TestUserNoEffectiveCapabilitiesChown(c *check.C) {
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
 	ensureSyscallTest(c)
 
 	// test that a root user has default capability CAP_CHOWN
@@ -1184,7 +1184,7 @@ func (s *DockerSuite) TestUserNoEffectiveCapabilitiesChown(c *check.C) {
 }
 
 func (s *DockerSuite) TestUserNoEffectiveCapabilitiesDacOverride(c *check.C) {
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
 	ensureSyscallTest(c)
 
 	// test that a root user has default capability CAP_DAC_OVERRIDE
@@ -1197,7 +1197,7 @@ func (s *DockerSuite) TestUserNoEffectiveCapabilitiesDacOverride(c *check.C) {
 }
 
 func (s *DockerSuite) TestUserNoEffectiveCapabilitiesFowner(c *check.C) {
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
 	ensureSyscallTest(c)
 
 	// test that a root user has default capability CAP_FOWNER
@@ -1213,7 +1213,7 @@ func (s *DockerSuite) TestUserNoEffectiveCapabilitiesFowner(c *check.C) {
 // TODO CAP_KILL
 
 func (s *DockerSuite) TestUserNoEffectiveCapabilitiesSetuid(c *check.C) {
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
 	ensureSyscallTest(c)
 
 	// test that a root user has default capability CAP_SETUID
@@ -1231,7 +1231,7 @@ func (s *DockerSuite) TestUserNoEffectiveCapabilitiesSetuid(c *check.C) {
 }
 
 func (s *DockerSuite) TestUserNoEffectiveCapabilitiesSetgid(c *check.C) {
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
 	ensureSyscallTest(c)
 
 	// test that a root user has default capability CAP_SETGID
@@ -1251,7 +1251,7 @@ func (s *DockerSuite) TestUserNoEffectiveCapabilitiesSetgid(c *check.C) {
 // TODO CAP_SETPCAP
 
 func (s *DockerSuite) TestUserNoEffectiveCapabilitiesNetBindService(c *check.C) {
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
 	ensureSyscallTest(c)
 
 	// test that a root user has default capability CAP_NET_BIND_SERVICE
@@ -1269,7 +1269,7 @@ func (s *DockerSuite) TestUserNoEffectiveCapabilitiesNetBindService(c *check.C)
 }
 
 func (s *DockerSuite) TestUserNoEffectiveCapabilitiesNetRaw(c *check.C) {
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
 	ensureSyscallTest(c)
 
 	// test that a root user has default capability CAP_NET_RAW
@@ -1287,7 +1287,7 @@ func (s *DockerSuite) TestUserNoEffectiveCapabilitiesNetRaw(c *check.C) {
 }
 
 func (s *DockerSuite) TestUserNoEffectiveCapabilitiesChroot(c *check.C) {
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
 	ensureSyscallTest(c)
 
 	// test that a root user has default capability CAP_SYS_CHROOT
@@ -1305,7 +1305,7 @@ func (s *DockerSuite) TestUserNoEffectiveCapabilitiesChroot(c *check.C) {
 }
 
 func (s *DockerSuite) TestUserNoEffectiveCapabilitiesMknod(c *check.C) {
-	testRequires(c, DaemonIsLinux, NotUserNamespace, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, NotUserNamespace, SameHostDaemon)
 	ensureSyscallTest(c)
 
 	// test that a root user has default capability CAP_MKNOD
@@ -1327,7 +1327,7 @@ func (s *DockerSuite) TestUserNoEffectiveCapabilitiesMknod(c *check.C) {
 // TODO CAP_SETFCAP
 
 func (s *DockerSuite) TestRunApparmorProcDirectory(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, Apparmor)
+	testRequires(c, SameHostDaemon, Apparmor)
 
 	// running w seccomp unconfined tests the apparmor profile
 	result := icmd.RunCommand(dockerBinary, "run", "--security-opt", "seccomp=unconfined", "busybox", "chmod", "777", "/proc/1/cgroup")
@@ -1346,7 +1346,7 @@ func (s *DockerSuite) TestRunApparmorProcDirectory(c *check.C) {
 // make sure the default profile can be successfully parsed (using unshare as it is
 // something which we know is blocked in the default profile)
 func (s *DockerSuite) TestRunSeccompWithDefaultProfile(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, seccompEnabled)
+	testRequires(c, SameHostDaemon, seccompEnabled)
 
 	out, _, err := dockerCmdWithError("run", "--security-opt", "seccomp=../profiles/seccomp/default.json", "debian:jessie", "unshare", "--map-root-user", "--user", "sh", "-c", "whoami")
 	c.Assert(err, checker.NotNil, check.Commentf("%s", out))
@@ -1355,7 +1355,7 @@ func (s *DockerSuite) TestRunSeccompWithDefaultProfile(c *check.C) {
 
 // TestRunDeviceSymlink checks run with device that follows symlink (#13840 and #22271)
 func (s *DockerSuite) TestRunDeviceSymlink(c *check.C) {
-	testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm, SameHostDaemon)
 	if _, err := os.Stat("/dev/zero"); err != nil {
 		c.Skip("Host does not have /dev/zero")
 	}
@@ -1404,7 +1404,7 @@ func (s *DockerSuite) TestRunDeviceSymlink(c *check.C) {
 
 // TestRunPIDsLimit makes sure the pids cgroup is set with --pids-limit
 func (s *DockerSuite) TestRunPIDsLimit(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, pidsLimit)
+	testRequires(c, SameHostDaemon, pidsLimit)
 
 	file := "/sys/fs/cgroup/pids/pids.max"
 	out, _ := dockerCmd(c, "run", "--name", "skittles", "--pids-limit", "4", "busybox", "cat", file)
@@ -1441,7 +1441,7 @@ func (s *DockerSuite) TestRunUserDeviceAllowed(c *check.C) {
 }
 
 func (s *DockerDaemonSuite) TestRunSeccompJSONNewFormat(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, seccompEnabled)
+	testRequires(c, SameHostDaemon, seccompEnabled)
 
 	s.d.StartWithBusybox(c)
 
@@ -1466,7 +1466,7 @@ func (s *DockerDaemonSuite) TestRunSeccompJSONNewFormat(c *check.C) {
 }
 
 func (s *DockerDaemonSuite) TestRunSeccompJSONNoNameAndNames(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, seccompEnabled)
+	testRequires(c, SameHostDaemon, seccompEnabled)
 
 	s.d.StartWithBusybox(c)
 
@@ -1492,7 +1492,7 @@ func (s *DockerDaemonSuite) TestRunSeccompJSONNoNameAndNames(c *check.C) {
 }
 
 func (s *DockerDaemonSuite) TestRunSeccompJSONNoArchAndArchMap(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, seccompEnabled)
+	testRequires(c, SameHostDaemon, seccompEnabled)
 
 	s.d.StartWithBusybox(c)
 
@@ -1529,7 +1529,7 @@ func (s *DockerDaemonSuite) TestRunSeccompJSONNoArchAndArchMap(c *check.C) {
 }
 
 func (s *DockerDaemonSuite) TestRunWithDaemonDefaultSeccompProfile(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, seccompEnabled)
+	testRequires(c, SameHostDaemon, seccompEnabled)
 
 	s.d.StartWithBusybox(c)
 
@@ -1568,7 +1568,7 @@ func (s *DockerSuite) TestRunWithNanoCPUs(c *check.C) {
 	out, _ := dockerCmd(c, "run", "--cpus", "0.5", "--name", "test", "busybox", "sh", "-c", fmt.Sprintf("cat %s && cat %s", file1, file2))
 	c.Assert(strings.TrimSpace(out), checker.Equals, "50000\n100000")
 
-	clt, err := client.NewClientWithOpts(client.FromEnv)
+	clt, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	inspect, err := clt.ContainerInspect(context.Background(), "test")
 	c.Assert(err, checker.IsNil)
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_save_load_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_save_load_test.go
index ba1fa2b8b..688eac684 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_save_load_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_save_load_test.go
@@ -332,7 +332,7 @@ func listTar(f io.Reader) ([]string, error) {
 func (s *DockerSuite) TestLoadZeroSizeLayer(c *check.C) {
 	// this will definitely not work if using remote daemon
 	// very weird test
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
 
 	dockerCmd(c, "load", "-i", "testdata/emptyLayer.tar")
 }
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_secret_create_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_secret_create_test.go
new file mode 100644
index 000000000..cf566f08a
--- /dev/null
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_secret_create_test.go
@@ -0,0 +1,95 @@
+// +build !windows
+
+package main
+
+import (
+	"io/ioutil"
+	"os"
+	"strings"
+
+	"github.com/docker/docker/api/types/swarm"
+	"github.com/docker/docker/integration-cli/checker"
+	"github.com/go-check/check"
+)
+
+// Test case for 28884
+func (s *DockerSwarmSuite) TestSecretCreateResolve(c *check.C) {
+	d := s.AddDaemon(c, true, true)
+
+	name := "test_secret"
+	id := d.CreateSecret(c, swarm.SecretSpec{
+		Annotations: swarm.Annotations{
+			Name: name,
+		},
+		Data: []byte("foo"),
+	})
+	c.Assert(id, checker.Not(checker.Equals), "", check.Commentf("secrets: %s", id))
+
+	fake := d.CreateSecret(c, swarm.SecretSpec{
+		Annotations: swarm.Annotations{
+			Name: id,
+		},
+		Data: []byte("fake foo"),
+	})
+	c.Assert(fake, checker.Not(checker.Equals), "", check.Commentf("secrets: %s", fake))
+
+	out, err := d.Cmd("secret", "ls")
+	c.Assert(err, checker.IsNil)
+	c.Assert(out, checker.Contains, name)
+	c.Assert(out, checker.Contains, fake)
+
+	out, err = d.Cmd("secret", "rm", id)
+	c.Assert(err, checker.IsNil)
+	c.Assert(out, checker.Contains, id)
+
+	// Fake one will remain
+	out, err = d.Cmd("secret", "ls")
+	c.Assert(err, checker.IsNil)
+	c.Assert(out, checker.Not(checker.Contains), name)
+	c.Assert(out, checker.Contains, fake)
+
+	// Remove based on name prefix of the fake one
+	// (which is the same as the ID of foo one) should not work
+	// as search is only done based on:
+	// - Full ID
+	// - Full Name
+	// - Partial ID (prefix)
+	out, err = d.Cmd("secret", "rm", id[:5])
+	c.Assert(err, checker.Not(checker.IsNil))
+	c.Assert(out, checker.Not(checker.Contains), id)
+	out, err = d.Cmd("secret", "ls")
+	c.Assert(err, checker.IsNil)
+	c.Assert(out, checker.Not(checker.Contains), name)
+	c.Assert(out, checker.Contains, fake)
+
+	// Remove based on ID prefix of the fake one should succeed
+	out, err = d.Cmd("secret", "rm", fake[:5])
+	c.Assert(err, checker.IsNil)
+	c.Assert(out, checker.Contains, fake[:5])
+	out, err = d.Cmd("secret", "ls")
+	c.Assert(err, checker.IsNil)
+	c.Assert(out, checker.Not(checker.Contains), name)
+	c.Assert(out, checker.Not(checker.Contains), id)
+	c.Assert(out, checker.Not(checker.Contains), fake)
+}
+
+func (s *DockerSwarmSuite) TestSecretCreateWithFile(c *check.C) {
+	d := s.AddDaemon(c, true, true)
+
+	testFile, err := ioutil.TempFile("", "secretCreateTest")
+	c.Assert(err, checker.IsNil, check.Commentf("failed to create temporary file"))
+	defer os.Remove(testFile.Name())
+
+	testData := "TESTINGDATA"
+	_, err = testFile.Write([]byte(testData))
+	c.Assert(err, checker.IsNil, check.Commentf("failed to write to temporary file"))
+
+	testName := "test_secret"
+	out, err := d.Cmd("secret", "create", testName, testFile.Name())
+	c.Assert(err, checker.IsNil)
+	c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "", check.Commentf("%s", out))
+
+	id := strings.TrimSpace(out)
+	secret := d.GetSecret(c, id)
+	c.Assert(secret.Spec.Name, checker.Equals, testName)
+}
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_service_update_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_service_update_test.go
new file mode 100644
index 000000000..c729860ec
--- /dev/null
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_service_update_test.go
@@ -0,0 +1,137 @@
+// +build !windows
+
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/docker/docker/api/types/swarm"
+	"github.com/docker/docker/integration-cli/checker"
+	"github.com/go-check/check"
+)
+
+func (s *DockerSwarmSuite) TestServiceUpdateLabel(c *check.C) {
+	d := s.AddDaemon(c, true, true)
+	out, err := d.Cmd("service", "create", "--detach", "--no-resolve-image", "--name=test", "busybox", "top")
+	c.Assert(err, checker.IsNil, check.Commentf("%s", out))
+	service := d.GetService(c, "test")
+	c.Assert(service.Spec.Labels, checker.HasLen, 0)
+
+	// add label to empty set
+	out, err = d.Cmd("service", "update", "--detach", "test", "--label-add", "foo=bar")
+	c.Assert(err, checker.IsNil, check.Commentf("%s", out))
+	service = d.GetService(c, "test")
+	c.Assert(service.Spec.Labels, checker.HasLen, 1)
+	c.Assert(service.Spec.Labels["foo"], checker.Equals, "bar")
+
+	// add label to non-empty set
+	out, err = d.Cmd("service", "update", "--detach", "test", "--label-add", "foo2=bar")
+	c.Assert(err, checker.IsNil, check.Commentf("%s", out))
+	service = d.GetService(c, "test")
+	c.Assert(service.Spec.Labels, checker.HasLen, 2)
+	c.Assert(service.Spec.Labels["foo2"], checker.Equals, "bar")
+
+	out, err = d.Cmd("service", "update", "--detach", "test", "--label-rm", "foo2")
+	c.Assert(err, checker.IsNil, check.Commentf("%s", out))
+	service = d.GetService(c, "test")
+	c.Assert(service.Spec.Labels, checker.HasLen, 1)
+	c.Assert(service.Spec.Labels["foo2"], checker.Equals, "")
+
+	out, err = d.Cmd("service", "update", "--detach", "test", "--label-rm", "foo")
+	c.Assert(err, checker.IsNil, check.Commentf("%s", out))
+	service = d.GetService(c, "test")
+	c.Assert(service.Spec.Labels, checker.HasLen, 0)
+	c.Assert(service.Spec.Labels["foo"], checker.Equals, "")
+
+	// now make sure we can add again
+	out, err = d.Cmd("service", "update", "--detach", "test", "--label-add", "foo=bar")
+	c.Assert(err, checker.IsNil, check.Commentf("%s", out))
+	service = d.GetService(c, "test")
+	c.Assert(service.Spec.Labels, checker.HasLen, 1)
+	c.Assert(service.Spec.Labels["foo"], checker.Equals, "bar")
+}
+
+func (s *DockerSwarmSuite) TestServiceUpdateSecrets(c *check.C) {
+	d := s.AddDaemon(c, true, true)
+	testName := "test_secret"
+	id := d.CreateSecret(c, swarm.SecretSpec{
+		Annotations: swarm.Annotations{
+			Name: testName,
+		},
+		Data: []byte("TESTINGDATA"),
+	})
+	c.Assert(id, checker.Not(checker.Equals), "", check.Commentf("secrets: %s", id))
+	testTarget := "testing"
+	serviceName := "test"
+
+	out, err := d.Cmd("service", "create", "--detach", "--no-resolve-image", "--name", serviceName, "busybox", "top")
+	c.Assert(err, checker.IsNil, check.Commentf("%s", out))
+
+	// add secret
+	out, err = d.Cmd("service", "update", "--detach", "test", "--secret-add", fmt.Sprintf("source=%s,target=%s", testName, testTarget))
+	c.Assert(err, checker.IsNil, check.Commentf("%s", out))
+
+	out, err = d.Cmd("service", "inspect", "--format", "{{ json .Spec.TaskTemplate.ContainerSpec.Secrets }}", serviceName)
+	c.Assert(err, checker.IsNil)
+
+	var refs []swarm.SecretReference
+	c.Assert(json.Unmarshal([]byte(out), &refs), checker.IsNil)
+	c.Assert(refs, checker.HasLen, 1)
+
+	c.Assert(refs[0].SecretName, checker.Equals, testName)
+	c.Assert(refs[0].File, checker.Not(checker.IsNil))
+	c.Assert(refs[0].File.Name, checker.Equals, testTarget)
+
+	// remove
+	out, err = d.Cmd("service", "update", "--detach", "test", "--secret-rm", testName)
+	c.Assert(err, checker.IsNil, check.Commentf("%s", out))
+
+	out, err = d.Cmd("service", "inspect", "--format", "{{ json .Spec.TaskTemplate.ContainerSpec.Secrets }}", serviceName)
+	c.Assert(err, checker.IsNil)
+
+	c.Assert(json.Unmarshal([]byte(out), &refs), checker.IsNil)
+	c.Assert(refs, checker.HasLen, 0)
+}
+
+func (s *DockerSwarmSuite) TestServiceUpdateConfigs(c *check.C) {
+	d := s.AddDaemon(c, true, true)
+	testName := "test_config"
+	id := d.CreateConfig(c, swarm.ConfigSpec{
+		Annotations: swarm.Annotations{
+			Name: testName,
+		},
+		Data: []byte("TESTINGDATA"),
+	})
+	c.Assert(id, checker.Not(checker.Equals), "", check.Commentf("configs: %s", id))
+	testTarget := "/testing"
+	serviceName := "test"
+
+	out, err := d.Cmd("service", "create", "--detach", "--no-resolve-image", "--name", serviceName, "busybox", "top")
+	c.Assert(err, checker.IsNil, check.Commentf("%s", out))
+
+	// add config
+	out, err = d.Cmd("service", "update", "--detach", "test", "--config-add", fmt.Sprintf("source=%s,target=%s", testName, testTarget))
+	c.Assert(err, checker.IsNil, check.Commentf("%s", out))
+
+	out, err = d.Cmd("service", "inspect", "--format", "{{ json .Spec.TaskTemplate.ContainerSpec.Configs }}", serviceName)
+	c.Assert(err, checker.IsNil)
+
+	var refs []swarm.ConfigReference
+	c.Assert(json.Unmarshal([]byte(out), &refs), checker.IsNil)
+	c.Assert(refs, checker.HasLen, 1)
+
+	c.Assert(refs[0].ConfigName, checker.Equals, testName)
+	c.Assert(refs[0].File, checker.Not(checker.IsNil))
+	c.Assert(refs[0].File.Name, checker.Equals, testTarget)
+
+	// remove
+	out, err = d.Cmd("service", "update", "--detach", "test", "--config-rm", testName)
+	c.Assert(err, checker.IsNil, check.Commentf("%s", out))
+
+	out, err = d.Cmd("service", "inspect", "--format", "{{ json .Spec.TaskTemplate.ContainerSpec.Configs }}", serviceName)
+	c.Assert(err, checker.IsNil)
+
+	c.Assert(json.Unmarshal([]byte(out), &refs), checker.IsNil)
+	c.Assert(refs, checker.HasLen, 0)
+}
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_start_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_start_test.go
index 303deddb2..cbe917bf4 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_start_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_start_test.go
@@ -190,11 +190,10 @@ func (s *DockerSuite) TestStartReturnCorrectExitCode(c *check.C) {
 	dockerCmd(c, "create", "--restart=on-failure:2", "--name", "withRestart", "busybox", "sh", "-c", "exit 11")
 	dockerCmd(c, "create", "--rm", "--name", "withRm", "busybox", "sh", "-c", "exit 12")
 
-	out, exitCode, err := dockerCmdWithError("start", "-a", "withRestart")
+	_, exitCode, err := dockerCmdWithError("start", "-a", "withRestart")
 	c.Assert(err, checker.NotNil)
-	c.Assert(exitCode, checker.Equals, 11, check.Commentf("out: %s", out))
-
-	out, exitCode, err = dockerCmdWithError("start", "-a", "withRm")
+	c.Assert(exitCode, checker.Equals, 11)
+	_, exitCode, err = dockerCmdWithError("start", "-a", "withRm")
 	c.Assert(err, checker.NotNil)
-	c.Assert(exitCode, checker.Equals, 12, check.Commentf("out: %s", out))
+	c.Assert(exitCode, checker.Equals, 12)
 }
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_swarm_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_swarm_test.go
index 80aa57107..f6fadcf99 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_swarm_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_swarm_test.go
@@ -13,7 +13,6 @@ import (
 	"net/http/httptest"
 	"os"
 	"path/filepath"
-	"runtime"
 	"strings"
 	"time"
 
@@ -164,7 +163,7 @@ func (s *DockerSwarmSuite) TestSwarmIncompatibleDaemon(c *check.C) {
 	c.Assert(err, checker.IsNil)
 	c.Assert(string(content), checker.Contains, "--live-restore daemon configuration is incompatible with swarm mode")
 	// restart for teardown
-	d.StartNode(c)
+	d.Start(c)
 }
 
 func (s *DockerSwarmSuite) TestSwarmServiceTemplatingHostname(c *check.C) {
@@ -331,7 +330,7 @@ func (s *DockerSwarmSuite) TestSwarmContainerAutoStart(c *check.C) {
 	c.Assert(err, checker.IsNil, check.Commentf("%s", out))
 	c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
 
-	d.RestartNode(c)
+	d.Restart(c)
 
 	out, err = d.Cmd("ps", "-q")
 	c.Assert(err, checker.IsNil, check.Commentf("%s", out))
@@ -345,21 +344,21 @@ func (s *DockerSwarmSuite) TestSwarmContainerEndpointOptions(c *check.C) {
 	c.Assert(err, checker.IsNil, check.Commentf("%s", out))
 	c.Assert(strings.TrimSpace(out), checker.Not(checker.Equals), "")
 
-	out, err = d.Cmd("run", "-d", "--net=foo", "--name=first", "--net-alias=first-alias", "busybox:glibc", "top")
+	_, err = d.Cmd("run", "-d", "--net=foo", "--name=first", "--net-alias=first-alias", "busybox:glibc", "top")
 	c.Assert(err, checker.IsNil, check.Commentf("%s", out))
 
-	out, err = d.Cmd("run", "-d", "--net=foo", "--name=second", "busybox:glibc", "top")
+	_, err = d.Cmd("run", "-d", "--net=foo", "--name=second", "busybox:glibc", "top")
 	c.Assert(err, checker.IsNil, check.Commentf("%s", out))
 
-	out, err = d.Cmd("run", "-d", "--net=foo", "--net-alias=third-alias", "busybox:glibc", "top")
+	_, err = d.Cmd("run", "-d", "--net=foo", "--net-alias=third-alias", "busybox:glibc", "top")
 	c.Assert(err, checker.IsNil, check.Commentf("%s", out))
 
 	// ping first container and its alias, also ping third and anonymous container by its alias
-	out, err = d.Cmd("exec", "second", "ping", "-c", "1", "first")
+	_, err = d.Cmd("exec", "second", "ping", "-c", "1", "first")
 	c.Assert(err, check.IsNil, check.Commentf("%s", out))
-	out, err = d.Cmd("exec", "second", "ping", "-c", "1", "first-alias")
+	_, err = d.Cmd("exec", "second", "ping", "-c", "1", "first-alias")
 	c.Assert(err, check.IsNil, check.Commentf("%s", out))
-	out, err = d.Cmd("exec", "second", "ping", "-c", "1", "third-alias")
+	_, err = d.Cmd("exec", "second", "ping", "-c", "1", "third-alias")
 	c.Assert(err, check.IsNil, check.Commentf("%s", out))
 }
 
@@ -402,7 +401,7 @@ func (s *DockerSwarmSuite) TestOverlayAttachable(c *check.C) {
 	c.Assert(err, checker.IsNil, check.Commentf("%s", out))
 	c.Assert(strings.TrimSpace(out), checker.Equals, "true")
 
-	// validate containers can attach to this overlay network
+	// validate containers can attache to this overlay network
 	out, err = d.Cmd("run", "-d", "--network", "ovnet", "--name", "c1", "busybox", "top")
 	c.Assert(err, checker.IsNil, check.Commentf("%s", out))
 
@@ -426,7 +425,8 @@ func (s *DockerSwarmSuite) TestOverlayAttachableOnSwarmLeave(c *check.C) {
 	c.Assert(err, checker.IsNil, check.Commentf("%s", out))
 
 	// Leave the swarm
-	c.Assert(d.SwarmLeave(true), checker.IsNil)
+	err = d.SwarmLeave(true)
+	c.Assert(err, checker.IsNil)
 
 	// Check the container is disconnected
 	out, err = d.Cmd("inspect", "c1", "--format", "{{.NetworkSettings.Networks."+nwName+"}}")
@@ -1009,11 +1009,11 @@ func checkKeyIsEncrypted(d *daemon.Daemon) func(*check.C) (interface{}, check.Co
 	}
 }
 
-func checkSwarmLockedToUnlocked(c *check.C, d *daemon.Daemon) {
+func checkSwarmLockedToUnlocked(c *check.C, d *daemon.Daemon, unlockKey string) {
 	// Wait for the PEM file to become unencrypted
 	waitAndAssert(c, defaultReconciliationTimeout, checkKeyIsEncrypted(d), checker.Equals, false)
 
-	d.RestartNode(c)
+	d.Restart(c)
 	c.Assert(getNodeStatus(c, d), checker.Equals, swarm.LocalNodeStateActive)
 }
 
@@ -1021,7 +1021,7 @@ func checkSwarmUnlockedToLocked(c *check.C, d *daemon.Daemon) {
 	// Wait for the PEM file to become encrypted
 	waitAndAssert(c, defaultReconciliationTimeout, checkKeyIsEncrypted(d), checker.Equals, true)
 
-	d.RestartNode(c)
+	d.Restart(c)
 	c.Assert(getNodeStatus(c, d), checker.Equals, swarm.LocalNodeStateLocked)
 }
 
@@ -1055,12 +1055,27 @@ func (s *DockerSwarmSuite) TestSwarmInitLocked(c *check.C) {
 
 	outs, err := d.Cmd("swarm", "init", "--autolock")
 	c.Assert(err, checker.IsNil, check.Commentf("%s", outs))
-	unlockKey := getUnlockKey(d, c, outs)
+
+	c.Assert(outs, checker.Contains, "docker swarm unlock")
+
+	var unlockKey string
+	for _, line := range strings.Split(outs, "\n") {
+		if strings.Contains(line, "SWMKEY") {
+			unlockKey = strings.TrimSpace(line)
+			break
+		}
+	}
+
+	c.Assert(unlockKey, checker.Not(checker.Equals), "")
+
+	outs, err = d.Cmd("swarm", "unlock-key", "-q")
+	c.Assert(err, checker.IsNil, check.Commentf("%s", outs))
+	c.Assert(outs, checker.Equals, unlockKey+"\n")
 
 	c.Assert(getNodeStatus(c, d), checker.Equals, swarm.LocalNodeStateActive)
 
 	// It starts off locked
-	d.RestartNode(c)
+	d.Restart(c)
 	c.Assert(getNodeStatus(c, d), checker.Equals, swarm.LocalNodeStateLocked)
 
 	cmd := d.Command("swarm", "unlock")
@@ -1085,7 +1100,7 @@ func (s *DockerSwarmSuite) TestSwarmInitLocked(c *check.C) {
 	outs, err = d.Cmd("swarm", "update", "--autolock=false")
 	c.Assert(err, checker.IsNil, check.Commentf("%s", outs))
 
-	checkSwarmLockedToUnlocked(c, d)
+	checkSwarmLockedToUnlocked(c, d, unlockKey)
 
 	outs, err = d.Cmd("node", "ls")
 	c.Assert(err, checker.IsNil, check.Commentf("%s", outs))
@@ -1099,7 +1114,7 @@ func (s *DockerSwarmSuite) TestSwarmLeaveLocked(c *check.C) {
 	c.Assert(err, checker.IsNil, check.Commentf("%s", outs))
 
 	// It starts off locked
-	d.RestartNode(c)
+	d.Restart(c, "--swarm-default-advertise-addr=lo")
 
 	info := d.SwarmInfo(c)
 	c.Assert(info.LocalNodeState, checker.Equals, swarm.LocalNodeStateLocked)
@@ -1131,7 +1146,7 @@ func (s *DockerSwarmSuite) TestSwarmLockUnlockCluster(c *check.C) {
 	d3 := s.AddDaemon(c, true, true)
 
 	// they start off unlocked
-	d2.RestartNode(c)
+	d2.Restart(c)
 	c.Assert(getNodeStatus(c, d2), checker.Equals, swarm.LocalNodeStateActive)
 
 	// stop this one so it does not get autolock info
@@ -1140,7 +1155,22 @@ func (s *DockerSwarmSuite) TestSwarmLockUnlockCluster(c *check.C) {
 	// enable autolock
 	outs, err := d1.Cmd("swarm", "update", "--autolock")
 	c.Assert(err, checker.IsNil, check.Commentf("%s", outs))
-	unlockKey := getUnlockKey(d1, c, outs)
+
+	c.Assert(outs, checker.Contains, "docker swarm unlock")
+
+	var unlockKey string
+	for _, line := range strings.Split(outs, "\n") {
+		if strings.Contains(line, "SWMKEY") {
+			unlockKey = strings.TrimSpace(line)
+			break
+		}
+	}
+
+	c.Assert(unlockKey, checker.Not(checker.Equals), "")
+
+	outs, err = d1.Cmd("swarm", "unlock-key", "-q")
+	c.Assert(err, checker.IsNil)
+	c.Assert(outs, checker.Equals, unlockKey+"\n")
 
 	// The ones that got the cluster update should be set to locked
 	for _, d := range []*daemon.Daemon{d1, d3} {
@@ -1153,7 +1183,7 @@ func (s *DockerSwarmSuite) TestSwarmLockUnlockCluster(c *check.C) {
 	}
 
 	// d2 never got the cluster update, so it is still set to unlocked
-	d2.StartNode(c)
+	d2.Start(c)
 	c.Assert(getNodeStatus(c, d2), checker.Equals, swarm.LocalNodeStateActive)
 
 	// d2 is now set to lock
@@ -1165,7 +1195,7 @@ func (s *DockerSwarmSuite) TestSwarmLockUnlockCluster(c *check.C) {
 
 	// the ones that got the update are now set to unlocked
 	for _, d := range []*daemon.Daemon{d1, d3} {
-		checkSwarmLockedToUnlocked(c, d)
+		checkSwarmLockedToUnlocked(c, d, unlockKey)
 	}
 
 	// d2 still locked
@@ -1178,11 +1208,11 @@ func (s *DockerSwarmSuite) TestSwarmLockUnlockCluster(c *check.C) {
 	c.Assert(getNodeStatus(c, d2), checker.Equals, swarm.LocalNodeStateActive)
 
 	// once it's caught up, d2 is set to not be locked
-	checkSwarmLockedToUnlocked(c, d2)
+	checkSwarmLockedToUnlocked(c, d2, unlockKey)
 
 	// managers who join now are never set to locked in the first place
 	d4 := s.AddDaemon(c, true, true)
-	d4.RestartNode(c)
+	d4.Restart(c)
 	c.Assert(getNodeStatus(c, d4), checker.Equals, swarm.LocalNodeStateActive)
 }
 
@@ -1192,11 +1222,26 @@ func (s *DockerSwarmSuite) TestSwarmJoinPromoteLocked(c *check.C) {
 	// enable autolock
 	outs, err := d1.Cmd("swarm", "update", "--autolock")
 	c.Assert(err, checker.IsNil, check.Commentf("out: %v", outs))
-	unlockKey := getUnlockKey(d1, c, outs)
+
+	c.Assert(outs, checker.Contains, "docker swarm unlock")
+
+	var unlockKey string
+	for _, line := range strings.Split(outs, "\n") {
+		if strings.Contains(line, "SWMKEY") {
+			unlockKey = strings.TrimSpace(line)
+			break
+		}
+	}
+
+	c.Assert(unlockKey, checker.Not(checker.Equals), "")
+
+	outs, err = d1.Cmd("swarm", "unlock-key", "-q")
+	c.Assert(err, checker.IsNil)
+	c.Assert(outs, checker.Equals, unlockKey+"\n")
 
 	// joined workers start off unlocked
 	d2 := s.AddDaemon(c, true, false)
-	d2.RestartNode(c)
+	d2.Restart(c)
 	c.Assert(getNodeStatus(c, d2), checker.Equals, swarm.LocalNodeStateActive)
 
 	// promote worker
@@ -1241,7 +1286,7 @@ func (s *DockerSwarmSuite) TestSwarmJoinPromoteLocked(c *check.C) {
 	}, checker.Equals, "swarm-worker")
 
 	// by now, it should *never* be locked on restart
-	d3.RestartNode(c)
+	d3.Restart(c)
 	c.Assert(getNodeStatus(c, d3), checker.Equals, swarm.LocalNodeStateActive)
 }
 
@@ -1250,7 +1295,22 @@ func (s *DockerSwarmSuite) TestSwarmRotateUnlockKey(c *check.C) {
 
 	outs, err := d.Cmd("swarm", "update", "--autolock")
 	c.Assert(err, checker.IsNil, check.Commentf("out: %v", outs))
-	unlockKey := getUnlockKey(d, c, outs)
+
+	c.Assert(outs, checker.Contains, "docker swarm unlock")
+
+	var unlockKey string
+	for _, line := range strings.Split(outs, "\n") {
+		if strings.Contains(line, "SWMKEY") {
+			unlockKey = strings.TrimSpace(line)
+			break
+		}
+	}
+
+	c.Assert(unlockKey, checker.Not(checker.Equals), "")
+
+	outs, err = d.Cmd("swarm", "unlock-key", "-q")
+	c.Assert(err, checker.IsNil)
+	c.Assert(outs, checker.Equals, unlockKey+"\n")
 
 	// Rotate multiple times
 	for i := 0; i != 3; i++ {
@@ -1261,7 +1321,7 @@ func (s *DockerSwarmSuite) TestSwarmRotateUnlockKey(c *check.C) {
 		c.Assert(newUnlockKey, checker.Not(checker.Equals), "")
 		c.Assert(newUnlockKey, checker.Not(checker.Equals), unlockKey)
 
-		d.RestartNode(c)
+		d.Restart(c)
 		c.Assert(getNodeStatus(c, d), checker.Equals, swarm.LocalNodeStateLocked)
 
 		outs, _ = d.Cmd("node", "ls")
@@ -1282,7 +1342,7 @@ func (s *DockerSwarmSuite) TestSwarmRotateUnlockKey(c *check.C) {
 
 			time.Sleep(3 * time.Second)
 
-			d.RestartNode(c)
+			d.Restart(c)
 
 			cmd = d.Command("swarm", "unlock")
 			cmd.Stdin = bytes.NewBufferString(unlockKey)
@@ -1314,20 +1374,28 @@ func (s *DockerSwarmSuite) TestSwarmRotateUnlockKey(c *check.C) {
 // This one keeps the leader up, and asserts that other manager nodes in the cluster also have their unlock
 // key rotated.
 func (s *DockerSwarmSuite) TestSwarmClusterRotateUnlockKey(c *check.C) {
-	if runtime.GOARCH == "s390x" {
-		c.Skip("Disabled on s390x")
-	}
-	if runtime.GOARCH == "ppc64le" {
-		c.Skip("Disabled on  ppc64le")
-	}
-
 	d1 := s.AddDaemon(c, true, true) // leader - don't restart this one, we don't want leader election delays
 	d2 := s.AddDaemon(c, true, true)
 	d3 := s.AddDaemon(c, true, true)
 
 	outs, err := d1.Cmd("swarm", "update", "--autolock")
 	c.Assert(err, checker.IsNil, check.Commentf("%s", outs))
-	unlockKey := getUnlockKey(d1, c, outs)
+
+	c.Assert(outs, checker.Contains, "docker swarm unlock")
+
+	var unlockKey string
+	for _, line := range strings.Split(outs, "\n") {
+		if strings.Contains(line, "SWMKEY") {
+			unlockKey = strings.TrimSpace(line)
+			break
+		}
+	}
+
+	c.Assert(unlockKey, checker.Not(checker.Equals), "")
+
+	outs, err = d1.Cmd("swarm", "unlock-key", "-q")
+	c.Assert(err, checker.IsNil, check.Commentf("%s", outs))
+	c.Assert(outs, checker.Equals, unlockKey+"\n")
 
 	// Rotate multiple times
 	for i := 0; i != 3; i++ {
@@ -1338,8 +1406,8 @@ func (s *DockerSwarmSuite) TestSwarmClusterRotateUnlockKey(c *check.C) {
 		c.Assert(newUnlockKey, checker.Not(checker.Equals), "")
 		c.Assert(newUnlockKey, checker.Not(checker.Equals), unlockKey)
 
-		d2.RestartNode(c)
-		d3.RestartNode(c)
+		d2.Restart(c)
+		d3.Restart(c)
 
 		for _, d := range []*daemon.Daemon{d2, d3} {
 			c.Assert(getNodeStatus(c, d), checker.Equals, swarm.LocalNodeStateLocked)
@@ -1362,7 +1430,7 @@ func (s *DockerSwarmSuite) TestSwarmClusterRotateUnlockKey(c *check.C) {
 
 				time.Sleep(3 * time.Second)
 
-				d.RestartNode(c)
+				d.Restart(c)
 
 				cmd = d.Command("swarm", "unlock")
 				cmd.Stdin = bytes.NewBufferString(unlockKey)
@@ -1394,13 +1462,21 @@ func (s *DockerSwarmSuite) TestSwarmClusterRotateUnlockKey(c *check.C) {
 func (s *DockerSwarmSuite) TestSwarmAlternateLockUnlock(c *check.C) {
 	d := s.AddDaemon(c, true, true)
 
+	var unlockKey string
 	for i := 0; i < 2; i++ {
 		// set to lock
 		outs, err := d.Cmd("swarm", "update", "--autolock")
 		c.Assert(err, checker.IsNil, check.Commentf("out: %v", outs))
 		c.Assert(outs, checker.Contains, "docker swarm unlock")
-		unlockKey := getUnlockKey(d, c, outs)
 
+		for _, line := range strings.Split(outs, "\n") {
+			if strings.Contains(line, "SWMKEY") {
+				unlockKey = strings.TrimSpace(line)
+				break
+			}
+		}
+
+		c.Assert(unlockKey, checker.Not(checker.Equals), "")
 		checkSwarmUnlockedToLocked(c, d)
 
 		cmd := d.Command("swarm", "unlock")
@@ -1412,7 +1488,7 @@ func (s *DockerSwarmSuite) TestSwarmAlternateLockUnlock(c *check.C) {
 		outs, err = d.Cmd("swarm", "update", "--autolock=false")
 		c.Assert(err, checker.IsNil, check.Commentf("out: %v", outs))
 
-		checkSwarmLockedToUnlocked(c, d)
+		checkSwarmLockedToUnlocked(c, d, unlockKey)
 	}
 }
 
@@ -1619,7 +1695,8 @@ func (s *DockerSwarmSuite) TestNetworkInspectWithDuplicateNames(c *check.C) {
 		Driver:         "bridge",
 	}
 
-	cli := d.NewClientT(c)
+	cli, err := d.NewClient()
+	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
 	n1, err := cli.NetworkCreate(context.Background(), name, options)
@@ -1654,7 +1731,7 @@ func (s *DockerSwarmSuite) TestNetworkInspectWithDuplicateNames(c *check.C) {
 	out, err = d.Cmd("network", "rm", n2.ID)
 	c.Assert(err, checker.IsNil, check.Commentf("%s", out))
 
-	// Duplicates with name but with different driver
+	// Dupliates with name but with different driver
 	options.Driver = "overlay"
 
 	n2, err = cli.NetworkCreate(context.Background(), name, options)
@@ -1988,16 +2065,3 @@ func (s *DockerSwarmSuite) TestSwarmClusterEventsConfig(c *check.C) {
 	// filtered by config
 	waitForEvent(c, d, t1, "-f type=config", "config remove "+id, defaultRetryCount)
 }
-
-func getUnlockKey(d *daemon.Daemon, c *check.C, autolockOutput string) string {
-	unlockKey, err := d.Cmd("swarm", "unlock-key", "-q")
-	c.Assert(err, checker.IsNil, check.Commentf("%s", unlockKey))
-	unlockKey = strings.TrimSuffix(unlockKey, "\n")
-
-	// Check that "docker swarm init --autolock" or "docker swarm update --autolock"
-	// contains all the expected strings, including the unlock key
-	c.Assert(autolockOutput, checker.Contains, "docker swarm unlock")
-	c.Assert(autolockOutput, checker.Contains, unlockKey)
-
-	return unlockKey
-}
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_update_unix_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_update_unix_test.go
index 7b4925a4a..1fb30f04d 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_update_unix_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_update_unix_test.go
@@ -309,7 +309,7 @@ func (s *DockerSuite) TestUpdateWithNanoCPUs(c *check.C) {
 	out, _ = dockerCmd(c, "exec", "top", "sh", "-c", fmt.Sprintf("cat %s && cat %s", file1, file2))
 	c.Assert(strings.TrimSpace(out), checker.Equals, "50000\n100000")
 
-	clt, err := client.NewClientWithOpts(client.FromEnv)
+	clt, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	inspect, err := clt.ContainerInspect(context.Background(), "top")
 	c.Assert(err, checker.IsNil)
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_userns_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_userns_test.go
index ede2d8f56..13d1f56dc 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_userns_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_userns_test.go
@@ -22,7 +22,7 @@ import (
 // 1. validate uid/gid maps are set properly
 // 2. verify that files created are owned by remapped root
 func (s *DockerDaemonSuite) TestDaemonUserNamespaceRootSetting(c *check.C) {
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon, UserNamespaceInKernel)
+	testRequires(c, DaemonIsLinux, SameHostDaemon, UserNamespaceInKernel)
 
 	s.d.StartWithBusybox(c, "--userns-remap", "default")
 
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_volume_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_volume_test.go
index dea1c2558..257ac8970 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_cli_volume_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_volume_test.go
@@ -404,7 +404,7 @@ func (s *DockerSuite) TestVolumeCLIRmForceUsage(c *check.C) {
 }
 
 func (s *DockerSuite) TestVolumeCLIRmForce(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	name := "test"
 	out, _ := dockerCmd(c, "volume", "create", name)
@@ -574,7 +574,7 @@ func (s *DockerSuite) TestDuplicateMountpointsForVolumesFromAndBind(c *check.C)
 
 // Test case (3) for 21845: duplicate targets for --volumes-from and `Mounts` (API only)
 func (s *DockerSuite) TestDuplicateMountpointsForVolumesFromAndMounts(c *check.C) {
-	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
+	testRequires(c, SameHostDaemon, DaemonIsLinux)
 
 	image := "vimage"
 	buildImageSuccessfully(c, image, build.WithDockerfile(`
@@ -600,7 +600,7 @@ func (s *DockerSuite) TestDuplicateMountpointsForVolumesFromAndMounts(c *check.C
 	err := os.MkdirAll("/tmp/data", 0755)
 	c.Assert(err, checker.IsNil)
 	// Mounts is available in API
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, checker.IsNil)
 	defer cli.Close()
 
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_cli_wait_test.go b/vendor/github.com/docker/docker/integration-cli/docker_cli_wait_test.go
new file mode 100644
index 000000000..669e54f1a
--- /dev/null
+++ b/vendor/github.com/docker/docker/integration-cli/docker_cli_wait_test.go
@@ -0,0 +1,98 @@
+package main
+
+import (
+	"bytes"
+	"os/exec"
+	"strings"
+	"time"
+
+	"github.com/docker/docker/integration-cli/checker"
+	"github.com/go-check/check"
+	"gotest.tools/icmd"
+)
+
+// non-blocking wait with 0 exit code
+func (s *DockerSuite) TestWaitNonBlockedExitZero(c *check.C) {
+	out, _ := dockerCmd(c, "run", "-d", "busybox", "sh", "-c", "true")
+	containerID := strings.TrimSpace(out)
+
+	err := waitInspect(containerID, "{{.State.Running}}", "false", 30*time.Second)
+	c.Assert(err, checker.IsNil) //Container should have stopped by now
+
+	out, _ = dockerCmd(c, "wait", containerID)
+	c.Assert(strings.TrimSpace(out), checker.Equals, "0", check.Commentf("failed to set up container, %v", out))
+
+}
+
+// blocking wait with 0 exit code
+func (s *DockerSuite) TestWaitBlockedExitZero(c *check.C) {
+	// Windows busybox does not support trap in this way, not sleep with sub-second
+	// granularity. It will always exit 0x40010004.
+	testRequires(c, DaemonIsLinux)
+	out, _ := dockerCmd(c, "run", "-d", "busybox", "/bin/sh", "-c", "trap 'exit 0' TERM; while true; do usleep 10; done")
+	containerID := strings.TrimSpace(out)
+
+	c.Assert(waitRun(containerID), checker.IsNil)
+
+	chWait := make(chan string)
+	go func() {
+		chWait <- ""
+		out := icmd.RunCommand(dockerBinary, "wait", containerID).Combined()
+		chWait <- out
+	}()
+
+	<-chWait // make sure the goroutine is started
+	time.Sleep(100 * time.Millisecond)
+	dockerCmd(c, "stop", containerID)
+
+	select {
+	case status := <-chWait:
+		c.Assert(strings.TrimSpace(status), checker.Equals, "0", check.Commentf("expected exit 0, got %s", status))
+	case <-time.After(2 * time.Second):
+		c.Fatal("timeout waiting for `docker wait` to exit")
+	}
+
+}
+
+// non-blocking wait with random exit code
+func (s *DockerSuite) TestWaitNonBlockedExitRandom(c *check.C) {
+	out, _ := dockerCmd(c, "run", "-d", "busybox", "sh", "-c", "exit 99")
+	containerID := strings.TrimSpace(out)
+
+	err := waitInspect(containerID, "{{.State.Running}}", "false", 30*time.Second)
+	c.Assert(err, checker.IsNil) //Container should have stopped by now
+	out, _ = dockerCmd(c, "wait", containerID)
+	c.Assert(strings.TrimSpace(out), checker.Equals, "99", check.Commentf("failed to set up container, %v", out))
+
+}
+
+// blocking wait with random exit code
+func (s *DockerSuite) TestWaitBlockedExitRandom(c *check.C) {
+	// Cannot run on Windows as trap in Windows busybox does not support trap in this way.
+	testRequires(c, DaemonIsLinux)
+	out, _ := dockerCmd(c, "run", "-d", "busybox", "/bin/sh", "-c", "trap 'exit 99' TERM; while true; do usleep 10; done")
+	containerID := strings.TrimSpace(out)
+	c.Assert(waitRun(containerID), checker.IsNil)
+
+	chWait := make(chan error)
+	waitCmd := exec.Command(dockerBinary, "wait", containerID)
+	waitCmdOut := bytes.NewBuffer(nil)
+	waitCmd.Stdout = waitCmdOut
+	c.Assert(waitCmd.Start(), checker.IsNil)
+	go func() {
+		chWait <- waitCmd.Wait()
+	}()
+
+	dockerCmd(c, "stop", containerID)
+
+	select {
+	case err := <-chWait:
+		c.Assert(err, checker.IsNil, check.Commentf(waitCmdOut.String()))
+		status, err := waitCmdOut.ReadString('\n')
+		c.Assert(err, checker.IsNil)
+		c.Assert(strings.TrimSpace(status), checker.Equals, "99", check.Commentf("expected exit 99, got %s", status))
+	case <-time.After(2 * time.Second):
+		waitCmd.Process.Kill()
+		c.Fatal("timeout waiting for `docker wait` to exit")
+	}
+}
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_hub_pull_suite_test.go b/vendor/github.com/docker/docker/integration-cli/docker_hub_pull_suite_test.go
index 34fddac98..125b8c10a 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_hub_pull_suite_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_hub_pull_suite_test.go
@@ -40,7 +40,7 @@ func newDockerHubPullSuite() *DockerHubPullSuite {
 
 // SetUpSuite starts the suite daemon.
 func (s *DockerHubPullSuite) SetUpSuite(c *check.C) {
-	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
+	testRequires(c, DaemonIsLinux, SameHostDaemon)
 	s.d = daemon.New(c, dockerBinary, dockerdBinary, testdaemon.WithEnvironment(testEnv.Execution))
 	s.d.Start(c)
 }
diff --git a/vendor/github.com/docker/docker/integration-cli/docker_utils_test.go b/vendor/github.com/docker/docker/integration-cli/docker_utils_test.go
index fa75f12e5..1c05bf5d0 100644
--- a/vendor/github.com/docker/docker/integration-cli/docker_utils_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/docker_utils_test.go
@@ -261,7 +261,7 @@ func daemonTime(c *check.C) time.Time {
 	if testEnv.IsLocalDaemon() {
 		return time.Now()
 	}
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	c.Assert(err, check.IsNil)
 	defer cli.Close()
 
@@ -373,7 +373,7 @@ func minimalBaseImage() string {
 }
 
 func getGoroutineNumber() (int, error) {
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	if err != nil {
 		return 0, err
 	}
@@ -419,12 +419,6 @@ func getErrorMessage(c *check.C, body []byte) string {
 }
 
 func waitAndAssert(c *check.C, timeout time.Duration, f checkF, checker check.Checker, args ...interface{}) {
-	t1 := time.Now()
-	defer func() {
-		t2 := time.Now()
-		c.Logf("waited for %v (out of %v)", t2.Sub(t1), timeout)
-	}()
-
 	after := time.After(timeout)
 	for {
 		v, comment := f(c)
diff --git a/vendor/github.com/docker/docker/integration-cli/requirements_test.go b/vendor/github.com/docker/docker/integration-cli/requirements_test.go
index 98220cfde..28be59cd2 100644
--- a/vendor/github.com/docker/docker/integration-cli/requirements_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/requirements_test.go
@@ -49,7 +49,7 @@ func MinimumAPIVersion(version string) func() bool {
 }
 
 func OnlyDefaultNetworks() bool {
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	if err != nil {
 		return false
 	}
@@ -60,6 +60,11 @@ func OnlyDefaultNetworks() bool {
 	return true
 }
 
+// Deprecated: use skip.If(t, !testEnv.DaemonInfo.ExperimentalBuild)
+func ExperimentalDaemon() bool {
+	return testEnv.DaemonInfo.ExperimentalBuild
+}
+
 func IsAmd64() bool {
 	return os.Getenv("DOCKER_ENGINE_GOARCH") == "amd64"
 }
@@ -76,6 +81,14 @@ func NotPpc64le() bool {
 	return ArchitectureIsNot("ppc64le")
 }
 
+func NotS390X() bool {
+	return ArchitectureIsNot("s390x")
+}
+
+func SameHostDaemon() bool {
+	return testEnv.IsLocalDaemon()
+}
+
 func UnixCli() bool {
 	return isUnixCli
 }
@@ -163,6 +176,13 @@ func IsPausable() bool {
 	return true
 }
 
+func NotPausable() bool {
+	if testEnv.OSType == "windows" {
+		return testEnv.DaemonInfo.Isolation == "process"
+	}
+	return false
+}
+
 func IsolationIs(expectedIsolation string) bool {
 	return testEnv.OSType == "windows" && string(testEnv.DaemonInfo.Isolation) == expectedIsolation
 }
@@ -175,7 +195,7 @@ func IsolationIsProcess() bool {
 	return IsolationIs("process")
 }
 
-// RegistryHosting returns whether the host can host a registry (v2) or not
+// RegistryHosting returns wether the host can host a registry (v2) or not
 func RegistryHosting() bool {
 	// for now registry binary is built only if we're running inside
 	// container through `make test`. Figure that out by testing if
diff --git a/vendor/github.com/docker/docker/integration-cli/requirements_unix_test.go b/vendor/github.com/docker/docker/integration-cli/requirements_unix_test.go
index cea1db1e6..7c594f7db 100644
--- a/vendor/github.com/docker/docker/integration-cli/requirements_unix_test.go
+++ b/vendor/github.com/docker/docker/integration-cli/requirements_unix_test.go
@@ -38,17 +38,6 @@ func pidsLimit() bool {
 }
 
 func kernelMemorySupport() bool {
-	// TODO remove this once kmem support in RHEL kernels is fixed. See https://github.com/opencontainers/runc/pull/1921
-	daemonV, err := kernel.ParseRelease(testEnv.DaemonInfo.KernelVersion)
-	if err != nil {
-		return false
-	}
-	requiredV := kernel.VersionInfo{Kernel: 3, Major: 10}
-	if kernel.CompareKernelVersion(*daemonV, requiredV) < 1 {
-		// On Kernel 3.10 and under, don't consider kernel memory to be supported,
-		// even if the kernel (and thus the daemon) reports it as being supported
-		return false
-	}
 	return testEnv.DaemonInfo.KernelMemory
 }
 
@@ -65,11 +54,11 @@ func swapMemorySupport() bool {
 }
 
 func memorySwappinessSupport() bool {
-	return testEnv.IsLocalDaemon() && SysInfo.MemorySwappiness
+	return SameHostDaemon() && SysInfo.MemorySwappiness
 }
 
 func blkioWeight() bool {
-	return testEnv.IsLocalDaemon() && SysInfo.BlkioWeight
+	return SameHostDaemon() && SysInfo.BlkioWeight
 }
 
 func cgroupCpuset() bool {
@@ -122,7 +111,7 @@ func overlay2Supported() bool {
 }
 
 func init() {
-	if testEnv.IsLocalDaemon() {
+	if SameHostDaemon() {
 		SysInfo = sysinfo.New(true)
 	}
 }
diff --git a/vendor/github.com/docker/docker/integration/build/build_session_test.go b/vendor/github.com/docker/docker/integration/build/build_session_test.go
index 51559cbe1..e1f5ae43b 100644
--- a/vendor/github.com/docker/docker/integration/build/build_session_test.go
+++ b/vendor/github.com/docker/docker/integration/build/build_session_test.go
@@ -27,7 +27,7 @@ func TestBuildWithSession(t *testing.T) {
 	d.StartWithBusybox(t)
 	defer d.Stop(t)
 
-	client := d.NewClientT(t)
+	client := testEnv.APIClient()
 
 	dockerfile := `
 		FROM busybox
diff --git a/vendor/github.com/docker/docker/integration/build/build_squash_test.go b/vendor/github.com/docker/docker/integration/build/build_squash_test.go
index 8326f2860..8acdec596 100644
--- a/vendor/github.com/docker/docker/integration/build/build_squash_test.go
+++ b/vendor/github.com/docker/docker/integration/build/build_squash_test.go
@@ -26,7 +26,7 @@ func TestBuildSquashParent(t *testing.T) {
 	d.StartWithBusybox(t)
 	defer d.Stop(t)
 
-	client := d.NewClientT(t)
+	client := testEnv.APIClient()
 
 	dockerfile := `
 		FROM busybox
diff --git a/vendor/github.com/docker/docker/integration/build/build_test.go b/vendor/github.com/docker/docker/integration/build/build_test.go
index fafba447f..9b91ee2a3 100644
--- a/vendor/github.com/docker/docker/integration/build/build_test.go
+++ b/vendor/github.com/docker/docker/integration/build/build_test.go
@@ -9,11 +9,13 @@ import (
 	"io/ioutil"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/docker/docker/api/types/versions"
 	"github.com/docker/docker/internal/test/fakecontext"
+	"github.com/docker/docker/internal/test/request"
 	"github.com/docker/docker/pkg/jsonmessage"
 	"gotest.tools/assert"
 	is "gotest.tools/assert/cmp"
@@ -23,7 +25,7 @@ import (
 func TestBuildWithRemoveAndForceRemove(t *testing.T) {
 	skip.If(t, testEnv.DaemonInfo.OSType == "windows", "FIXME")
 	defer setupTest(t)()
-
+	t.Parallel()
 	cases := []struct {
 		name                           string
 		dockerfile                     string
@@ -37,8 +39,8 @@ func TestBuildWithRemoveAndForceRemove(t *testing.T) {
 			RUN exit 0
 			RUN exit 0`,
 			numberOfIntermediateContainers: 2,
-			rm:                             false,
-			forceRm:                        false,
+			rm:      false,
+			forceRm: false,
 		},
 		{
 			name: "successful build with remove",
@@ -46,8 +48,8 @@ func TestBuildWithRemoveAndForceRemove(t *testing.T) {
 			RUN exit 0
 			RUN exit 0`,
 			numberOfIntermediateContainers: 0,
-			rm:                             true,
-			forceRm:                        false,
+			rm:      true,
+			forceRm: false,
 		},
 		{
 			name: "successful build with remove and force remove",
@@ -55,8 +57,8 @@ func TestBuildWithRemoveAndForceRemove(t *testing.T) {
 			RUN exit 0
 			RUN exit 0`,
 			numberOfIntermediateContainers: 0,
-			rm:                             true,
-			forceRm:                        true,
+			rm:      true,
+			forceRm: true,
 		},
 		{
 			name: "failed build with no removal",
@@ -64,8 +66,8 @@ func TestBuildWithRemoveAndForceRemove(t *testing.T) {
 			RUN exit 0
 			RUN exit 1`,
 			numberOfIntermediateContainers: 2,
-			rm:                             false,
-			forceRm:                        false,
+			rm:      false,
+			forceRm: false,
 		},
 		{
 			name: "failed build with remove",
@@ -73,8 +75,8 @@ func TestBuildWithRemoveAndForceRemove(t *testing.T) {
 			RUN exit 0
 			RUN exit 1`,
 			numberOfIntermediateContainers: 1,
-			rm:                             true,
-			forceRm:                        false,
+			rm:      true,
+			forceRm: false,
 		},
 		{
 			name: "failed build with remove and force remove",
@@ -82,12 +84,12 @@ func TestBuildWithRemoveAndForceRemove(t *testing.T) {
 			RUN exit 0
 			RUN exit 1`,
 			numberOfIntermediateContainers: 0,
-			rm:                             true,
-			forceRm:                        true,
+			rm:      true,
+			forceRm: true,
 		},
 	}
 
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
@@ -167,6 +169,12 @@ func TestBuildMultiStageParentConfig(t *testing.T) {
 	resp.Body.Close()
 	assert.NilError(t, err)
 
+	time.Sleep(30 * time.Second)
+
+	imgs, err := apiclient.ImageList(ctx, types.ImageListOptions{})
+	assert.NilError(t, err)
+	t.Log(imgs)
+
 	image, _, err := apiclient.ImageInspectWithRaw(ctx, "build1")
 	assert.NilError(t, err)
 
diff --git a/vendor/github.com/docker/docker/integration/config/config_test.go b/vendor/github.com/docker/docker/integration/config/config_test.go
index 480232d19..042f00e8d 100644
--- a/vendor/github.com/docker/docker/integration/config/config_test.go
+++ b/vendor/github.com/docker/docker/integration/config/config_test.go
@@ -269,7 +269,7 @@ func TestTemplatedConfig(t *testing.T) {
 
 	var tasks []swarmtypes.Task
 	waitAndAssert(t, 60*time.Second, func(t *testing.T) bool {
-		tasks = swarm.GetRunningTasks(t, client, serviceID)
+		tasks = swarm.GetRunningTasks(t, d, serviceID)
 		return len(tasks) > 0
 	})
 
diff --git a/vendor/github.com/docker/docker/integration/container/create_test.go b/vendor/github.com/docker/docker/integration/container/create_test.go
index 6b1c71a53..af65eeb68 100644
--- a/vendor/github.com/docker/docker/integration/container/create_test.go
+++ b/vendor/github.com/docker/docker/integration/container/create_test.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"net/http"
 	"strconv"
 	"testing"
 	"time"
@@ -12,7 +11,6 @@ import (
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/network"
-	"github.com/docker/docker/api/types/versions"
 	ctr "github.com/docker/docker/integration/internal/container"
 	"github.com/docker/docker/internal/test/request"
 	"github.com/docker/docker/oci"
@@ -24,7 +22,7 @@ import (
 
 func TestCreateFailsWhenIdentifierDoesNotExist(t *testing.T) {
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	testCases := []struct {
 		doc           string
@@ -65,7 +63,7 @@ func TestCreateFailsWhenIdentifierDoesNotExist(t *testing.T) {
 
 func TestCreateWithInvalidEnv(t *testing.T) {
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	testCases := []struct {
 		env           string
@@ -108,7 +106,7 @@ func TestCreateTmpfsMountsTarget(t *testing.T) {
 	skip.If(t, testEnv.DaemonInfo.OSType == "windows")
 
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	testCases := []struct {
 		target        string
@@ -150,7 +148,7 @@ func TestCreateWithCustomMaskedPaths(t *testing.T) {
 	skip.If(t, testEnv.DaemonInfo.OSType != "linux")
 
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	testCases := []struct {
@@ -229,7 +227,7 @@ func TestCreateWithCustomReadonlyPaths(t *testing.T) {
 	skip.If(t, testEnv.DaemonInfo.OSType != "linux")
 
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	testCases := []struct {
@@ -303,88 +301,3 @@ func TestCreateWithCustomReadonlyPaths(t *testing.T) {
 		checkInspect(t, ctx, name, tc.expected)
 	}
 }
-
-func TestCreateWithInvalidHealthcheckParams(t *testing.T) {
-	defer setupTest(t)()
-
-	testCases := []struct {
-		doc         string
-		interval    time.Duration
-		timeout     time.Duration
-		retries     int
-		startPeriod time.Duration
-		expectedErr string
-	}{
-		{
-			doc:         "test invalid Interval in Healthcheck: less than 0s",
-			interval:    -10 * time.Millisecond,
-			timeout:     time.Second,
-			retries:     1000,
-			expectedErr: fmt.Sprintf("Interval in Healthcheck cannot be less than %s", container.MinimumDuration),
-		},
-		{
-			doc:         "test invalid Interval in Healthcheck: larger than 0s but less than 1ms",
-			interval:    500 * time.Microsecond,
-			timeout:     time.Second,
-			retries:     1000,
-			expectedErr: fmt.Sprintf("Interval in Healthcheck cannot be less than %s", container.MinimumDuration),
-		},
-		{
-			doc:         "test invalid Timeout in Healthcheck: less than 1ms",
-			interval:    time.Second,
-			timeout:     -100 * time.Millisecond,
-			retries:     1000,
-			expectedErr: fmt.Sprintf("Timeout in Healthcheck cannot be less than %s", container.MinimumDuration),
-		},
-		{
-			doc:         "test invalid Retries in Healthcheck: less than 0",
-			interval:    time.Second,
-			timeout:     time.Second,
-			retries:     -10,
-			expectedErr: "Retries in Healthcheck cannot be negative",
-		},
-		{
-			doc:         "test invalid StartPeriod in Healthcheck: not 0 and less than 1ms",
-			interval:    time.Second,
-			timeout:     time.Second,
-			retries:     1000,
-			startPeriod: 100 * time.Microsecond,
-			expectedErr: fmt.Sprintf("StartPeriod in Healthcheck cannot be less than %s", container.MinimumDuration),
-		},
-	}
-
-	for i, tc := range testCases {
-		i := i
-		tc := tc
-		t.Run(tc.doc, func(t *testing.T) {
-			t.Parallel()
-			healthCheck := map[string]interface{}{
-				"Interval": tc.interval,
-				"Timeout":  tc.timeout,
-				"Retries":  tc.retries,
-			}
-			if tc.startPeriod != 0 {
-				healthCheck["StartPeriod"] = tc.startPeriod
-			}
-
-			config := map[string]interface{}{
-				"Image":       "busybox",
-				"Healthcheck": healthCheck,
-			}
-
-			res, body, err := request.Post("/containers/create?name="+fmt.Sprintf("test_%d_", i)+t.Name(), request.JSONBody(config))
-			assert.NilError(t, err)
-
-			if versions.LessThan(testEnv.DaemonAPIVersion(), "1.32") {
-				assert.Check(t, is.Equal(http.StatusInternalServerError, res.StatusCode))
-			} else {
-				assert.Check(t, is.Equal(http.StatusBadRequest, res.StatusCode))
-			}
-
-			buf, err := request.ReadBody(body)
-			assert.NilError(t, err)
-
-			assert.Check(t, is.Contains(string(buf), tc.expectedErr))
-		})
-	}
-}
diff --git a/vendor/github.com/docker/docker/integration/container/daemon_linux_test.go b/vendor/github.com/docker/docker/integration/container/daemon_linux_test.go
index a67641069..bd13e3093 100644
--- a/vendor/github.com/docker/docker/integration/container/daemon_linux_test.go
+++ b/vendor/github.com/docker/docker/integration/container/daemon_linux_test.go
@@ -29,23 +29,25 @@ import (
 func TestContainerStartOnDaemonRestart(t *testing.T) {
 	skip.If(t, testEnv.IsRemoteDaemon, "cannot start daemon on remote test run")
 	skip.If(t, testEnv.DaemonInfo.OSType == "windows")
+	skip.If(t, testEnv.IsRemoteDaemon(), "cannot start daemon on remote test run")
 	t.Parallel()
 
 	d := daemon.New(t)
 	d.StartWithBusybox(t, "--iptables=false")
 	defer d.Stop(t)
 
-	c := d.NewClientT(t)
+	client, err := d.NewClient()
+	assert.Check(t, err, "error creating client")
 
 	ctx := context.Background()
 
-	cID := container.Create(t, ctx, c)
-	defer c.ContainerRemove(ctx, cID, types.ContainerRemoveOptions{Force: true})
+	cID := container.Create(t, ctx, client)
+	defer client.ContainerRemove(ctx, cID, types.ContainerRemoveOptions{Force: true})
 
-	err := c.ContainerStart(ctx, cID, types.ContainerStartOptions{})
+	err = client.ContainerStart(ctx, cID, types.ContainerStartOptions{})
 	assert.Check(t, err, "error starting test container")
 
-	inspect, err := c.ContainerInspect(ctx, cID)
+	inspect, err := client.ContainerInspect(ctx, cID)
 	assert.Check(t, err, "error getting inspect data")
 
 	ppid := getContainerdShimPid(t, inspect)
@@ -61,7 +63,7 @@ func TestContainerStartOnDaemonRestart(t *testing.T) {
 
 	d.Start(t, "--iptables=false")
 
-	err = c.ContainerStart(ctx, cID, types.ContainerStartOptions{})
+	err = client.ContainerStart(ctx, cID, types.ContainerStartOptions{})
 	assert.Check(t, err, "failed to start test container")
 }
 
diff --git a/vendor/github.com/docker/docker/integration/container/diff_test.go b/vendor/github.com/docker/docker/integration/container/diff_test.go
index ac0bac9af..32ad94b93 100644
--- a/vendor/github.com/docker/docker/integration/container/diff_test.go
+++ b/vendor/github.com/docker/docker/integration/container/diff_test.go
@@ -7,6 +7,7 @@ import (
 
 	containertypes "github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/integration/internal/container"
+	"github.com/docker/docker/internal/test/request"
 	"github.com/docker/docker/pkg/archive"
 	"gotest.tools/assert"
 	"gotest.tools/poll"
@@ -16,7 +17,7 @@ import (
 func TestDiff(t *testing.T) {
 	skip.If(t, testEnv.OSType == "windows", "FIXME")
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	cID := container.Run(t, ctx, client, container.WithCmd("sh", "-c", `mkdir /foo; echo xyzzy > /foo/bar`))
diff --git a/vendor/github.com/docker/docker/integration/container/exec_test.go b/vendor/github.com/docker/docker/integration/container/exec_test.go
index 214987bba..20b1f3e8b 100644
--- a/vendor/github.com/docker/docker/integration/container/exec_test.go
+++ b/vendor/github.com/docker/docker/integration/container/exec_test.go
@@ -10,6 +10,7 @@ import (
 	"github.com/docker/docker/api/types/strslice"
 	"github.com/docker/docker/api/types/versions"
 	"github.com/docker/docker/integration/internal/container"
+	"github.com/docker/docker/internal/test/request"
 	"gotest.tools/assert"
 	is "gotest.tools/assert/cmp"
 	"gotest.tools/skip"
@@ -21,7 +22,7 @@ func TestExecWithCloseStdin(t *testing.T) {
 	defer setupTest(t)()
 
 	ctx := context.Background()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	// run top with detached mode
 	cID := container.Run(t, ctx, client)
@@ -88,7 +89,7 @@ func TestExec(t *testing.T) {
 	skip.If(t, testEnv.OSType == "windows", "FIXME. Probably needs to wait for container to be in running state.")
 	defer setupTest(t)()
 	ctx := context.Background()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	cID := container.Run(t, ctx, client, container.WithTty(true), container.WithWorkingDir("/root"))
 
diff --git a/vendor/github.com/docker/docker/integration/container/export_test.go b/vendor/github.com/docker/docker/integration/container/export_test.go
index 6727a67ed..ed3a33050 100644
--- a/vendor/github.com/docker/docker/integration/container/export_test.go
+++ b/vendor/github.com/docker/docker/integration/container/export_test.go
@@ -10,6 +10,7 @@ import (
 	"github.com/docker/docker/api/types/filters"
 	"github.com/docker/docker/integration/internal/container"
 	"github.com/docker/docker/internal/test/daemon"
+	"github.com/docker/docker/internal/test/request"
 	"github.com/docker/docker/pkg/jsonmessage"
 	"gotest.tools/assert"
 	is "gotest.tools/assert/cmp"
@@ -22,7 +23,7 @@ func TestExportContainerAndImportImage(t *testing.T) {
 	skip.If(t, testEnv.DaemonInfo.OSType == "windows")
 
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	cID := container.Run(t, ctx, client, container.WithCmd("true"))
@@ -58,19 +59,20 @@ func TestExportContainerAndImportImage(t *testing.T) {
 // condition, daemon restart is needed after container creation.
 func TestExportContainerAfterDaemonRestart(t *testing.T) {
 	skip.If(t, testEnv.DaemonInfo.OSType == "windows")
-	skip.If(t, testEnv.IsRemoteDaemon)
+	skip.If(t, testEnv.IsRemoteDaemon())
 
 	d := daemon.New(t)
-	c := d.NewClientT(t)
+	client, err := d.NewClient()
+	assert.NilError(t, err)
 
 	d.StartWithBusybox(t)
 	defer d.Stop(t)
 
 	ctx := context.Background()
-	ctrID := container.Create(t, ctx, c)
+	ctrID := container.Create(t, ctx, client)
 
 	d.Restart(t)
 
-	_, err := c.ContainerExport(ctx, ctrID)
+	_, err = client.ContainerExport(ctx, ctrID)
 	assert.NilError(t, err)
 }
diff --git a/vendor/github.com/docker/docker/integration/container/health_test.go b/vendor/github.com/docker/docker/integration/container/health_test.go
index f4117f562..b90e86e0c 100644
--- a/vendor/github.com/docker/docker/integration/container/health_test.go
+++ b/vendor/github.com/docker/docker/integration/container/health_test.go
@@ -9,6 +9,7 @@ import (
 	containertypes "github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/client"
 	"github.com/docker/docker/integration/internal/container"
+	"github.com/docker/docker/internal/test/request"
 	"gotest.tools/poll"
 	"gotest.tools/skip"
 )
@@ -19,7 +20,7 @@ func TestHealthCheckWorkdir(t *testing.T) {
 	skip.If(t, testEnv.OSType == "windows", "FIXME")
 	defer setupTest(t)()
 	ctx := context.Background()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	cID := container.Run(t, ctx, client, container.WithTty(true), container.WithWorkingDir("/foo"), func(c *container.TestContainerConfig) {
 		c.Config.Healthcheck = &containertypes.HealthConfig{
diff --git a/vendor/github.com/docker/docker/integration/container/ipcmode_linux_test.go b/vendor/github.com/docker/docker/integration/container/ipcmode_test.go
similarity index 57%
rename from vendor/github.com/docker/docker/integration/container/ipcmode_linux_test.go
rename to vendor/github.com/docker/docker/integration/container/ipcmode_test.go
index 49634ca73..b0ed84293 100644
--- a/vendor/github.com/docker/docker/integration/container/ipcmode_linux_test.go
+++ b/vendor/github.com/docker/docker/integration/container/ipcmode_test.go
@@ -3,7 +3,6 @@ package container // import "github.com/docker/docker/integration/container"
 import (
 	"bufio"
 	"context"
-	"io/ioutil"
 	"os"
 	"regexp"
 	"strings"
@@ -12,10 +11,9 @@ import (
 	"github.com/docker/docker/api/types"
 	containertypes "github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/integration/internal/container"
-	"github.com/docker/docker/internal/test/daemon"
+	"github.com/docker/docker/internal/test/request"
 	"gotest.tools/assert"
 	is "gotest.tools/assert/cmp"
-	"gotest.tools/fs"
 	"gotest.tools/skip"
 )
 
@@ -60,7 +58,7 @@ func testIpcNonePrivateShareable(t *testing.T, mode string, mustBeMounted bool,
 	hostCfg := containertypes.HostConfig{
 		IpcMode: containertypes.IpcMode(mode),
 	}
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	resp, err := client.ContainerCreate(ctx, &cfg, &hostCfg, nil, "")
@@ -92,7 +90,7 @@ func testIpcNonePrivateShareable(t *testing.T, mode string, mustBeMounted bool,
 // (--ipc none) works as expected. It makes sure there is no
 // /dev/shm mount inside the container.
 func TestIpcModeNone(t *testing.T) {
-	skip.If(t, testEnv.IsRemoteDaemon)
+	skip.If(t, testEnv.DaemonInfo.OSType != "linux" || testEnv.IsRemoteDaemon())
 
 	testIpcNonePrivateShareable(t, "none", false, false)
 }
@@ -102,7 +100,7 @@ func TestIpcModeNone(t *testing.T) {
 // of /dev/shm mount from the container, and makes sure there is no
 // such pair on the host.
 func TestIpcModePrivate(t *testing.T) {
-	skip.If(t, testEnv.IsRemoteDaemon)
+	skip.If(t, testEnv.DaemonInfo.OSType != "linux" || testEnv.IsRemoteDaemon())
 
 	testIpcNonePrivateShareable(t, "private", true, false)
 }
@@ -112,7 +110,7 @@ func TestIpcModePrivate(t *testing.T) {
 // of /dev/shm mount from the container, and makes sure such pair
 // also exists on the host.
 func TestIpcModeShareable(t *testing.T) {
-	skip.If(t, testEnv.IsRemoteDaemon)
+	skip.If(t, testEnv.DaemonInfo.OSType != "linux" || testEnv.IsRemoteDaemon())
 
 	testIpcNonePrivateShareable(t, "shareable", true, true)
 }
@@ -131,7 +129,7 @@ func testIpcContainer(t *testing.T, donorMode string, mustWork bool) {
 		IpcMode: containertypes.IpcMode(donorMode),
 	}
 	ctx := context.Background()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	// create and start the "donor" container
 	resp, err := client.ContainerCreate(ctx, &cfg, &hostCfg, nil, "")
@@ -175,120 +173,9 @@ func testIpcContainer(t *testing.T, donorMode string, mustWork bool) {
 // 1) a container created with --ipc container:ID can use IPC of another shareable container.
 // 2) a container created with --ipc container:ID can NOT use IPC of another private container.
 func TestAPIIpcModeShareableAndContainer(t *testing.T) {
-	skip.If(t, testEnv.IsRemoteDaemon)
+	skip.If(t, testEnv.DaemonInfo.OSType != "linux")
 
 	testIpcContainer(t, "shareable", true)
 
 	testIpcContainer(t, "private", false)
 }
-
-/* TestAPIIpcModeHost checks that a container created with --ipc host
- * can use IPC of the host system.
- */
-func TestAPIIpcModeHost(t *testing.T) {
-	skip.If(t, testEnv.IsRemoteDaemon)
-	skip.If(t, testEnv.IsUserNamespace)
-
-	cfg := containertypes.Config{
-		Image: "busybox",
-		Cmd:   []string{"top"},
-	}
-	hostCfg := containertypes.HostConfig{
-		IpcMode: containertypes.IpcMode("host"),
-	}
-	ctx := context.Background()
-
-	client := testEnv.APIClient()
-	resp, err := client.ContainerCreate(ctx, &cfg, &hostCfg, nil, "")
-	assert.NilError(t, err)
-	assert.Check(t, is.Equal(len(resp.Warnings), 0))
-	name := resp.ID
-
-	err = client.ContainerStart(ctx, name, types.ContainerStartOptions{})
-	assert.NilError(t, err)
-
-	// check that IPC is shared
-	// 1. create a file inside container
-	_, err = container.Exec(ctx, client, name, []string{"sh", "-c", "printf covfefe > /dev/shm/." + name})
-	assert.NilError(t, err)
-	// 2. check it's the same on the host
-	bytes, err := ioutil.ReadFile("/dev/shm/." + name)
-	assert.NilError(t, err)
-	assert.Check(t, is.Equal("covfefe", string(bytes)))
-	// 3. clean up
-	_, err = container.Exec(ctx, client, name, []string{"rm", "-f", "/dev/shm/." + name})
-	assert.NilError(t, err)
-}
-
-// testDaemonIpcPrivateShareable is a helper function to test "private" and "shareable" daemon default ipc modes.
-func testDaemonIpcPrivateShareable(t *testing.T, mustBeShared bool, arg ...string) {
-	defer setupTest(t)()
-
-	d := daemon.New(t)
-	d.StartWithBusybox(t, arg...)
-	defer d.Stop(t)
-
-	c := d.NewClientT(t)
-
-	cfg := containertypes.Config{
-		Image: "busybox",
-		Cmd:   []string{"top"},
-	}
-	ctx := context.Background()
-
-	resp, err := c.ContainerCreate(ctx, &cfg, &containertypes.HostConfig{}, nil, "")
-	assert.NilError(t, err)
-	assert.Check(t, is.Equal(len(resp.Warnings), 0))
-
-	err = c.ContainerStart(ctx, resp.ID, types.ContainerStartOptions{})
-	assert.NilError(t, err)
-
-	// get major:minor pair for /dev/shm from container's /proc/self/mountinfo
-	cmd := "awk '($5 == \"/dev/shm\") {printf $3}' /proc/self/mountinfo"
-	result, err := container.Exec(ctx, c, resp.ID, []string{"sh", "-c", cmd})
-	assert.NilError(t, err)
-	mm := result.Combined()
-	assert.Check(t, is.Equal(true, regexp.MustCompile("^[0-9]+:[0-9]+$").MatchString(mm)))
-
-	shared, err := testIpcCheckDevExists(mm)
-	assert.NilError(t, err)
-	t.Logf("[testDaemonIpcPrivateShareable] ipcdev: %v, shared: %v, mustBeShared: %v\n", mm, shared, mustBeShared)
-	assert.Check(t, is.Equal(shared, mustBeShared))
-}
-
-// TestDaemonIpcModeShareable checks that --default-ipc-mode shareable works as intended.
-func TestDaemonIpcModeShareable(t *testing.T) {
-	skip.If(t, testEnv.IsRemoteDaemon)
-
-	testDaemonIpcPrivateShareable(t, true, "--default-ipc-mode", "shareable")
-}
-
-// TestDaemonIpcModePrivate checks that --default-ipc-mode private works as intended.
-func TestDaemonIpcModePrivate(t *testing.T) {
-	skip.If(t, testEnv.IsRemoteDaemon)
-
-	testDaemonIpcPrivateShareable(t, false, "--default-ipc-mode", "private")
-}
-
-// used to check if an IpcMode given in config works as intended
-func testDaemonIpcFromConfig(t *testing.T, mode string, mustExist bool) {
-	config := `{"default-ipc-mode": "` + mode + `"}`
-	file := fs.NewFile(t, "test-daemon-ipc-config", fs.WithContent(config))
-	defer file.Remove()
-
-	testDaemonIpcPrivateShareable(t, mustExist, "--config-file", file.Path())
-}
-
-// TestDaemonIpcModePrivateFromConfig checks that "default-ipc-mode: private" config works as intended.
-func TestDaemonIpcModePrivateFromConfig(t *testing.T) {
-	skip.If(t, testEnv.IsRemoteDaemon)
-
-	testDaemonIpcFromConfig(t, "private", false)
-}
-
-// TestDaemonIpcModeShareableFromConfig checks that "default-ipc-mode: shareable" config works as intended.
-func TestDaemonIpcModeShareableFromConfig(t *testing.T) {
-	skip.If(t, testEnv.IsRemoteDaemon)
-
-	testDaemonIpcFromConfig(t, "shareable", true)
-}
diff --git a/vendor/github.com/docker/docker/integration/container/kill_test.go b/vendor/github.com/docker/docker/integration/container/kill_test.go
index 2c73026e1..0b51b5163 100644
--- a/vendor/github.com/docker/docker/integration/container/kill_test.go
+++ b/vendor/github.com/docker/docker/integration/container/kill_test.go
@@ -17,7 +17,7 @@ import (
 
 func TestKillContainerInvalidSignal(t *testing.T) {
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 	id := container.Run(t, ctx, client)
 
@@ -33,7 +33,7 @@ func TestKillContainerInvalidSignal(t *testing.T) {
 func TestKillContainer(t *testing.T) {
 	skip.If(t, testEnv.OSType == "windows", "TODO Windows: FIXME. No SIGWINCH")
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	testCases := []struct {
 		doc    string
@@ -73,7 +73,7 @@ func TestKillContainer(t *testing.T) {
 func TestKillWithStopSignalAndRestartPolicies(t *testing.T) {
 	skip.If(t, testEnv.OSType == "windows", "Windows only supports 1.25 or later")
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	testCases := []struct {
 		doc        string
@@ -114,7 +114,7 @@ func TestKillStoppedContainer(t *testing.T) {
 	skip.If(t, testEnv.OSType == "windows", "Windows only supports 1.25 or later")
 	defer setupTest(t)()
 	ctx := context.Background()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	id := container.Create(t, ctx, client)
 	err := client.ContainerKill(ctx, id, "SIGKILL")
 	assert.Assert(t, is.ErrorContains(err, ""))
@@ -154,7 +154,7 @@ func TestInspectOomKilledTrue(t *testing.T) {
 
 	defer setupTest(t)()
 	ctx := context.Background()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	cID := container.Run(t, ctx, client, container.WithCmd("sh", "-c", "x=a; while true; do x=$x$x$x$x; done"), func(c *container.TestContainerConfig) {
 		c.HostConfig.Resources.Memory = 32 * 1024 * 1024
@@ -172,7 +172,7 @@ func TestInspectOomKilledFalse(t *testing.T) {
 
 	defer setupTest(t)()
 	ctx := context.Background()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	cID := container.Run(t, ctx, client, container.WithCmd("sh", "-c", "echo hello world"))
 
diff --git a/vendor/github.com/docker/docker/integration/container/links_linux_test.go b/vendor/github.com/docker/docker/integration/container/links_linux_test.go
index 9a3c9d271..775bf6d36 100644
--- a/vendor/github.com/docker/docker/integration/container/links_linux_test.go
+++ b/vendor/github.com/docker/docker/integration/container/links_linux_test.go
@@ -9,19 +9,20 @@ import (
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/docker/docker/integration/internal/container"
+	"github.com/docker/docker/internal/test/request"
 	"gotest.tools/assert"
 	is "gotest.tools/assert/cmp"
 	"gotest.tools/skip"
 )
 
 func TestLinksEtcHostsContentMatch(t *testing.T) {
-	skip.If(t, testEnv.IsRemoteDaemon)
+	skip.If(t, testEnv.IsRemoteDaemon())
 
 	hosts, err := ioutil.ReadFile("/etc/hosts")
 	skip.If(t, os.IsNotExist(err))
 
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	cID := container.Run(t, ctx, client, container.WithNetworkMode("host"))
@@ -37,7 +38,7 @@ func TestLinksContainerNames(t *testing.T) {
 	skip.If(t, testEnv.DaemonInfo.OSType == "windows")
 
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	containerA := "first_" + t.Name()
diff --git a/vendor/github.com/docker/docker/integration/container/logs_test.go b/vendor/github.com/docker/docker/integration/container/logs_test.go
index 0a3e83113..68fbe13a7 100644
--- a/vendor/github.com/docker/docker/integration/container/logs_test.go
+++ b/vendor/github.com/docker/docker/integration/container/logs_test.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/integration/internal/container"
+	"github.com/docker/docker/internal/test/request"
 	"github.com/docker/docker/pkg/stdcopy"
 	"gotest.tools/assert"
 	"gotest.tools/skip"
@@ -16,9 +17,9 @@ import (
 // Makes sure that when following we don't get an EOF error when there are no logs
 func TestLogsFollowTailEmpty(t *testing.T) {
 	// FIXME(vdemeester) fails on a e2e run on linux...
-	skip.If(t, testEnv.IsRemoteDaemon)
+	skip.If(t, testEnv.IsRemoteDaemon())
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	id := container.Run(t, ctx, client, container.WithCmd("sleep", "100000"))
diff --git a/vendor/github.com/docker/docker/integration/container/mounts_linux_test.go b/vendor/github.com/docker/docker/integration/container/mounts_linux_test.go
index 0148f508d..8e7e663fd 100644
--- a/vendor/github.com/docker/docker/integration/container/mounts_linux_test.go
+++ b/vendor/github.com/docker/docker/integration/container/mounts_linux_test.go
@@ -5,27 +5,23 @@ import (
 	"fmt"
 	"path/filepath"
 	"testing"
-	"time"
 
 	"github.com/docker/docker/api/types"
-	containertypes "github.com/docker/docker/api/types/container"
-	mounttypes "github.com/docker/docker/api/types/mount"
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/mount"
 	"github.com/docker/docker/api/types/network"
-	"github.com/docker/docker/api/types/versions"
 	"github.com/docker/docker/client"
-	"github.com/docker/docker/integration/internal/container"
-	"github.com/docker/docker/pkg/mount"
+	"github.com/docker/docker/internal/test/request"
 	"github.com/docker/docker/pkg/system"
 	"gotest.tools/assert"
 	is "gotest.tools/assert/cmp"
 	"gotest.tools/fs"
-	"gotest.tools/poll"
 	"gotest.tools/skip"
 )
 
 func TestContainerNetworkMountsNoChown(t *testing.T) {
 	// chown only applies to Linux bind mounted volumes; must be same host to verify
-	skip.If(t, testEnv.IsRemoteDaemon)
+	skip.If(t, testEnv.DaemonInfo.OSType == "windows" || testEnv.IsRemoteDaemon())
 
 	defer setupTest(t)()
 
@@ -36,11 +32,11 @@ func TestContainerNetworkMountsNoChown(t *testing.T) {
 
 	tmpNWFileMount := tmpDir.Join("nwfile")
 
-	config := containertypes.Config{
+	config := container.Config{
 		Image: "busybox",
 	}
-	hostConfig := containertypes.HostConfig{
-		Mounts: []mounttypes.Mount{
+	hostConfig := container.HostConfig{
+		Mounts: []mount.Mount{
 			{
 				Type:   "bind",
 				Source: tmpNWFileMount,
@@ -59,7 +55,7 @@ func TestContainerNetworkMountsNoChown(t *testing.T) {
 		},
 	}
 
-	cli, err := client.NewClientWithOpts(client.FromEnv)
+	cli, err := client.NewEnvClient()
 	assert.NilError(t, err)
 	defer cli.Close()
 
@@ -85,10 +81,10 @@ func TestContainerNetworkMountsNoChown(t *testing.T) {
 }
 
 func TestMountDaemonRoot(t *testing.T) {
-	skip.If(t, testEnv.IsRemoteDaemon)
+	skip.If(t, testEnv.DaemonInfo.OSType == "windows" || testEnv.IsRemoteDaemon())
+	t.Parallel()
 
-	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 	info, err := client.Info(ctx)
 	if err != nil {
@@ -97,39 +93,39 @@ func TestMountDaemonRoot(t *testing.T) {
 
 	for _, test := range []struct {
 		desc        string
-		propagation mounttypes.Propagation
-		expected    mounttypes.Propagation
+		propagation mount.Propagation
+		expected    mount.Propagation
 	}{
 		{
 			desc:        "default",
 			propagation: "",
-			expected:    mounttypes.PropagationRSlave,
+			expected:    mount.PropagationRSlave,
 		},
 		{
 			desc:        "private",
-			propagation: mounttypes.PropagationPrivate,
+			propagation: mount.PropagationPrivate,
 		},
 		{
 			desc:        "rprivate",
-			propagation: mounttypes.PropagationRPrivate,
+			propagation: mount.PropagationRPrivate,
 		},
 		{
 			desc:        "slave",
-			propagation: mounttypes.PropagationSlave,
+			propagation: mount.PropagationSlave,
 		},
 		{
 			desc:        "rslave",
-			propagation: mounttypes.PropagationRSlave,
-			expected:    mounttypes.PropagationRSlave,
+			propagation: mount.PropagationRSlave,
+			expected:    mount.PropagationRSlave,
 		},
 		{
 			desc:        "shared",
-			propagation: mounttypes.PropagationShared,
+			propagation: mount.PropagationShared,
 		},
 		{
 			desc:        "rshared",
-			propagation: mounttypes.PropagationRShared,
-			expected:    mounttypes.PropagationRShared,
+			propagation: mount.PropagationRShared,
+			expected:    mount.PropagationRShared,
 		},
 	} {
 		t.Run(test.desc, func(t *testing.T) {
@@ -143,26 +139,26 @@ func TestMountDaemonRoot(t *testing.T) {
 			bindSpecRoot := info.DockerRootDir + ":" + "/foo" + propagationSpec
 			bindSpecSub := filepath.Join(info.DockerRootDir, "containers") + ":/foo" + propagationSpec
 
-			for name, hc := range map[string]*containertypes.HostConfig{
+			for name, hc := range map[string]*container.HostConfig{
 				"bind root":    {Binds: []string{bindSpecRoot}},
 				"bind subpath": {Binds: []string{bindSpecSub}},
 				"mount root": {
-					Mounts: []mounttypes.Mount{
+					Mounts: []mount.Mount{
 						{
-							Type:        mounttypes.TypeBind,
+							Type:        mount.TypeBind,
 							Source:      info.DockerRootDir,
 							Target:      "/foo",
-							BindOptions: &mounttypes.BindOptions{Propagation: test.propagation},
+							BindOptions: &mount.BindOptions{Propagation: test.propagation},
 						},
 					},
 				},
 				"mount subpath": {
-					Mounts: []mounttypes.Mount{
+					Mounts: []mount.Mount{
 						{
-							Type:        mounttypes.TypeBind,
+							Type:        mount.TypeBind,
 							Source:      filepath.Join(info.DockerRootDir, "containers"),
 							Target:      "/foo",
-							BindOptions: &mounttypes.BindOptions{Propagation: test.propagation},
+							BindOptions: &mount.BindOptions{Propagation: test.propagation},
 						},
 					},
 				},
@@ -171,7 +167,7 @@ func TestMountDaemonRoot(t *testing.T) {
 					hc := hc
 					t.Parallel()
 
-					c, err := client.ContainerCreate(ctx, &containertypes.Config{
+					c, err := client.ContainerCreate(ctx, &container.Config{
 						Image: "busybox",
 						Cmd:   []string{"true"},
 					}, hc, nil, "")
@@ -210,58 +206,3 @@ func TestMountDaemonRoot(t *testing.T) {
 		})
 	}
 }
-
-func TestContainerBindMountNonRecursive(t *testing.T) {
-	skip.If(t, testEnv.IsRemoteDaemon)
-	skip.If(t, versions.LessThan(testEnv.DaemonAPIVersion(), "1.40"), "BindOptions.NonRecursive requires API v1.40")
-
-	defer setupTest(t)()
-
-	tmpDir1 := fs.NewDir(t, "tmpdir1", fs.WithMode(0755),
-		fs.WithDir("mnt", fs.WithMode(0755)))
-	defer tmpDir1.Remove()
-	tmpDir1Mnt := filepath.Join(tmpDir1.Path(), "mnt")
-	tmpDir2 := fs.NewDir(t, "tmpdir2", fs.WithMode(0755),
-		fs.WithFile("file", "should not be visible when NonRecursive", fs.WithMode(0644)))
-	defer tmpDir2.Remove()
-
-	err := mount.Mount(tmpDir2.Path(), tmpDir1Mnt, "none", "bind,ro")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer func() {
-		if err := mount.Unmount(tmpDir1Mnt); err != nil {
-			t.Fatal(err)
-		}
-	}()
-
-	// implicit is recursive (NonRecursive: false)
-	implicit := mounttypes.Mount{
-		Type:     "bind",
-		Source:   tmpDir1.Path(),
-		Target:   "/foo",
-		ReadOnly: true,
-	}
-	recursive := implicit
-	recursive.BindOptions = &mounttypes.BindOptions{
-		NonRecursive: false,
-	}
-	recursiveVerifier := []string{"test", "-f", "/foo/mnt/file"}
-	nonRecursive := implicit
-	nonRecursive.BindOptions = &mounttypes.BindOptions{
-		NonRecursive: true,
-	}
-	nonRecursiveVerifier := []string{"test", "!", "-f", "/foo/mnt/file"}
-
-	ctx := context.Background()
-	client := testEnv.APIClient()
-	containers := []string{
-		container.Run(t, ctx, client, container.WithMount(implicit), container.WithCmd(recursiveVerifier...)),
-		container.Run(t, ctx, client, container.WithMount(recursive), container.WithCmd(recursiveVerifier...)),
-		container.Run(t, ctx, client, container.WithMount(nonRecursive), container.WithCmd(nonRecursiveVerifier...)),
-	}
-
-	for _, c := range containers {
-		poll.WaitOn(t, container.IsSuccessful(ctx, client, c), poll.WithDelay(100*time.Millisecond))
-	}
-}
diff --git a/vendor/github.com/docker/docker/integration/container/nat_test.go b/vendor/github.com/docker/docker/integration/container/nat_test.go
index 3e8144615..caaaf10fd 100644
--- a/vendor/github.com/docker/docker/integration/container/nat_test.go
+++ b/vendor/github.com/docker/docker/integration/container/nat_test.go
@@ -13,6 +13,7 @@ import (
 
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/integration/internal/container"
+	"github.com/docker/docker/internal/test/request"
 	"github.com/docker/go-connections/nat"
 	"gotest.tools/assert"
 	is "gotest.tools/assert/cmp"
@@ -21,8 +22,7 @@ import (
 )
 
 func TestNetworkNat(t *testing.T) {
-	skip.If(t, testEnv.OSType == "windows", "FIXME")
-	skip.If(t, testEnv.IsRemoteDaemon)
+	skip.If(t, testEnv.IsRemoteDaemon())
 
 	defer setupTest(t)()
 
@@ -41,7 +41,7 @@ func TestNetworkNat(t *testing.T) {
 
 func TestNetworkLocalhostTCPNat(t *testing.T) {
 	skip.If(t, testEnv.DaemonInfo.OSType == "windows", "FIXME")
-	skip.If(t, testEnv.IsRemoteDaemon)
+	skip.If(t, testEnv.IsRemoteDaemon())
 
 	defer setupTest(t)()
 
@@ -58,8 +58,7 @@ func TestNetworkLocalhostTCPNat(t *testing.T) {
 }
 
 func TestNetworkLoopbackNat(t *testing.T) {
-	skip.If(t, testEnv.OSType == "windows", "FIXME")
-	skip.If(t, testEnv.IsRemoteDaemon)
+	skip.If(t, testEnv.IsRemoteDaemon())
 
 	defer setupTest(t)()
 
@@ -68,7 +67,7 @@ func TestNetworkLoopbackNat(t *testing.T) {
 
 	endpoint := getExternalAddress(t)
 
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	cID := container.Run(t, ctx, client, container.WithCmd("sh", "-c", fmt.Sprintf("stty raw && nc -w 5 %s 8080", endpoint.String())), container.WithTty(true), container.WithNetworkMode("container:"+serverContainerID))
@@ -89,8 +88,7 @@ func TestNetworkLoopbackNat(t *testing.T) {
 }
 
 func startServerContainer(t *testing.T, msg string, port int) string {
-	t.Helper()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	cID := container.Run(t, ctx, client, container.WithName("server-"+t.Name()), container.WithCmd("sh", "-c", fmt.Sprintf("echo %q | nc -lp %d", msg, port)), container.WithExposedPorts(fmt.Sprintf("%d/tcp", port)), func(c *container.TestContainerConfig) {
@@ -109,7 +107,7 @@ func startServerContainer(t *testing.T, msg string, port int) string {
 }
 
 func getExternalAddress(t *testing.T) net.IP {
-	t.Helper()
+	skip.If(t, testEnv.OSType == "windows", "FIXME")
 	iface, err := net.InterfaceByName("eth0")
 	skip.If(t, err != nil, "Test not running with `make test-integration`. Interface eth0 not found: %s", err)
 
diff --git a/vendor/github.com/docker/docker/integration/container/pause_test.go b/vendor/github.com/docker/docker/integration/container/pause_test.go
index 875841d5e..0905b95a8 100644
--- a/vendor/github.com/docker/docker/integration/container/pause_test.go
+++ b/vendor/github.com/docker/docker/integration/container/pause_test.go
@@ -22,7 +22,7 @@ func TestPause(t *testing.T) {
 	skip.If(t, testEnv.DaemonInfo.OSType == "windows" && testEnv.DaemonInfo.Isolation == "process")
 
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	cID := container.Run(t, ctx, client)
@@ -54,7 +54,7 @@ func TestPauseFailsOnWindowsServerContainers(t *testing.T) {
 	skip.If(t, testEnv.DaemonInfo.OSType != "windows" || testEnv.DaemonInfo.Isolation != "process")
 
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	cID := container.Run(t, ctx, client)
@@ -68,7 +68,7 @@ func TestPauseStopPausedContainer(t *testing.T) {
 	skip.If(t, testEnv.DaemonInfo.OSType == "windows")
 	skip.If(t, versions.LessThan(testEnv.DaemonAPIVersion(), "1.31"), "broken in earlier versions")
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	cID := container.Run(t, ctx, client)
diff --git a/vendor/github.com/docker/docker/integration/container/ps_test.go b/vendor/github.com/docker/docker/integration/container/ps_test.go
index 93721bc08..4ae07043a 100644
--- a/vendor/github.com/docker/docker/integration/container/ps_test.go
+++ b/vendor/github.com/docker/docker/integration/container/ps_test.go
@@ -7,13 +7,14 @@ import (
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/docker/docker/integration/internal/container"
+	"github.com/docker/docker/internal/test/request"
 	"gotest.tools/assert"
 	is "gotest.tools/assert/cmp"
 )
 
 func TestPsFilter(t *testing.T) {
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	prev := container.Create(t, ctx, client)
diff --git a/vendor/github.com/docker/docker/integration/container/remove_test.go b/vendor/github.com/docker/docker/integration/container/remove_test.go
index 027c92001..5de13f22a 100644
--- a/vendor/github.com/docker/docker/integration/container/remove_test.go
+++ b/vendor/github.com/docker/docker/integration/container/remove_test.go
@@ -9,6 +9,7 @@ import (
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/docker/docker/integration/internal/container"
+	"github.com/docker/docker/internal/test/request"
 	"gotest.tools/assert"
 	is "gotest.tools/assert/cmp"
 	"gotest.tools/fs"
@@ -25,11 +26,11 @@ func getPrefixAndSlashFromDaemonPlatform() (prefix, slash string) {
 
 // Test case for #5244: `docker rm` fails if bind dir doesn't exist anymore
 func TestRemoveContainerWithRemovedVolume(t *testing.T) {
-	skip.If(t, testEnv.IsRemoteDaemon)
+	skip.If(t, testEnv.IsRemoteDaemon())
 
 	defer setupTest(t)()
 	ctx := context.Background()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	prefix, slash := getPrefixAndSlashFromDaemonPlatform()
 
@@ -55,7 +56,7 @@ func TestRemoveContainerWithRemovedVolume(t *testing.T) {
 func TestRemoveContainerWithVolume(t *testing.T) {
 	defer setupTest(t)()
 	ctx := context.Background()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	prefix, slash := getPrefixAndSlashFromDaemonPlatform()
 
@@ -80,7 +81,7 @@ func TestRemoveContainerWithVolume(t *testing.T) {
 func TestRemoveContainerRunning(t *testing.T) {
 	defer setupTest(t)()
 	ctx := context.Background()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	cID := container.Run(t, ctx, client)
 
@@ -91,7 +92,7 @@ func TestRemoveContainerRunning(t *testing.T) {
 func TestRemoveContainerForceRemoveRunning(t *testing.T) {
 	defer setupTest(t)()
 	ctx := context.Background()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	cID := container.Run(t, ctx, client)
 
@@ -104,7 +105,7 @@ func TestRemoveContainerForceRemoveRunning(t *testing.T) {
 func TestRemoveInvalidContainer(t *testing.T) {
 	defer setupTest(t)()
 	ctx := context.Background()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	err := client.ContainerRemove(ctx, "unknown", types.ContainerRemoveOptions{})
 	assert.Check(t, is.ErrorContains(err, "No such container"))
diff --git a/vendor/github.com/docker/docker/integration/container/rename_test.go b/vendor/github.com/docker/docker/integration/container/rename_test.go
index e2334feb4..5c98608a8 100644
--- a/vendor/github.com/docker/docker/integration/container/rename_test.go
+++ b/vendor/github.com/docker/docker/integration/container/rename_test.go
@@ -10,6 +10,7 @@ import (
 	"github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/api/types/versions"
 	"github.com/docker/docker/integration/internal/container"
+	"github.com/docker/docker/internal/test/request"
 	"github.com/docker/docker/pkg/stringid"
 	"gotest.tools/assert"
 	is "gotest.tools/assert/cmp"
@@ -26,7 +27,7 @@ func TestRenameLinkedContainer(t *testing.T) {
 	skip.If(t, testEnv.OSType == "windows", "FIXME")
 	defer setupTest(t)()
 	ctx := context.Background()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	aName := "a0" + t.Name()
 	bName := "b0" + t.Name()
@@ -51,7 +52,7 @@ func TestRenameLinkedContainer(t *testing.T) {
 func TestRenameStoppedContainer(t *testing.T) {
 	defer setupTest(t)()
 	ctx := context.Background()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	oldName := "first_name" + t.Name()
 	cID := container.Run(t, ctx, client, container.WithName(oldName), container.WithCmd("sh"))
@@ -73,7 +74,7 @@ func TestRenameStoppedContainer(t *testing.T) {
 func TestRenameRunningContainerAndReuse(t *testing.T) {
 	defer setupTest(t)()
 	ctx := context.Background()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	oldName := "first_name" + t.Name()
 	cID := container.Run(t, ctx, client, container.WithName(oldName))
@@ -101,7 +102,7 @@ func TestRenameRunningContainerAndReuse(t *testing.T) {
 func TestRenameInvalidName(t *testing.T) {
 	defer setupTest(t)()
 	ctx := context.Background()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	oldName := "first_name" + t.Name()
 	cID := container.Run(t, ctx, client, container.WithName(oldName))
@@ -126,7 +127,7 @@ func TestRenameAnonymousContainer(t *testing.T) {
 	skip.If(t, testEnv.OSType == "windows", "FIXME")
 	defer setupTest(t)()
 	ctx := context.Background()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	networkName := "network1" + t.Name()
 	_, err := client.NetworkCreate(ctx, networkName, types.NetworkCreate{})
@@ -165,14 +166,14 @@ func TestRenameAnonymousContainer(t *testing.T) {
 
 	inspect, err := client.ContainerInspect(ctx, cID)
 	assert.NilError(t, err)
-	assert.Check(t, is.Equal(0, inspect.State.ExitCode), "container %s exited with the wrong exitcode: %s", cID, inspect.State.Error)
+	assert.Check(t, is.Equal(0, inspect.State.ExitCode), "container %s exited with the wrong exitcode: %+v", cID, inspect)
 }
 
 // TODO: should be a unit test
 func TestRenameContainerWithSameName(t *testing.T) {
 	defer setupTest(t)()
 	ctx := context.Background()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	oldName := "old" + t.Name()
 	cID := container.Run(t, ctx, client, container.WithName(oldName))
@@ -190,12 +191,12 @@ func TestRenameContainerWithSameName(t *testing.T) {
 // of the linked container should be updated so that the other
 // container could still reference to the container that is renamed.
 func TestRenameContainerWithLinkedContainer(t *testing.T) {
-	skip.If(t, testEnv.IsRemoteDaemon)
+	skip.If(t, testEnv.IsRemoteDaemon())
 	skip.If(t, testEnv.OSType == "windows", "FIXME")
 
 	defer setupTest(t)()
 	ctx := context.Background()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	db1Name := "db1" + t.Name()
 	db1ID := container.Run(t, ctx, client, container.WithName(db1Name))
diff --git a/vendor/github.com/docker/docker/integration/container/resize_test.go b/vendor/github.com/docker/docker/integration/container/resize_test.go
index 8d2ee7d1f..461ef14df 100644
--- a/vendor/github.com/docker/docker/integration/container/resize_test.go
+++ b/vendor/github.com/docker/docker/integration/container/resize_test.go
@@ -9,6 +9,7 @@ import (
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/versions"
 	"github.com/docker/docker/integration/internal/container"
+	"github.com/docker/docker/internal/test/request"
 	req "github.com/docker/docker/internal/test/request"
 	"gotest.tools/assert"
 	is "gotest.tools/assert/cmp"
@@ -19,7 +20,7 @@ import (
 func TestResize(t *testing.T) {
 	skip.If(t, testEnv.OSType == "windows", "FIXME")
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	cID := container.Run(t, ctx, client)
@@ -37,7 +38,7 @@ func TestResizeWithInvalidSize(t *testing.T) {
 	skip.If(t, versions.LessThan(testEnv.DaemonAPIVersion(), "1.32"), "broken in earlier versions")
 	skip.If(t, testEnv.OSType == "windows", "FIXME")
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	cID := container.Run(t, ctx, client)
@@ -52,7 +53,7 @@ func TestResizeWithInvalidSize(t *testing.T) {
 
 func TestResizeWhenContainerNotStarted(t *testing.T) {
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	cID := container.Run(t, ctx, client, container.WithCmd("echo"))
diff --git a/vendor/github.com/docker/docker/integration/container/restart_test.go b/vendor/github.com/docker/docker/integration/container/restart_test.go
index 3da30c0f3..64b076410 100644
--- a/vendor/github.com/docker/docker/integration/container/restart_test.go
+++ b/vendor/github.com/docker/docker/integration/container/restart_test.go
@@ -26,7 +26,7 @@ func TestDaemonRestartKillContainers(t *testing.T) {
 		xStart              bool
 	}
 
-	for _, tc := range []testCase{
+	for _, c := range []testCase{
 		{
 			desc:                "container without restart policy",
 			config:              &container.Config{Image: "busybox", Cmd: []string{"top"}},
@@ -57,15 +57,16 @@ func TestDaemonRestartKillContainers(t *testing.T) {
 					d.Stop(t)
 				},
 			} {
-				t.Run(fmt.Sprintf("live-restore=%v/%s/%s", liveRestoreEnabled, tc.desc, fnName), func(t *testing.T) {
-					c := tc
+				t.Run(fmt.Sprintf("live-restore=%v/%s/%s", liveRestoreEnabled, c.desc, fnName), func(t *testing.T) {
+					c := c
 					liveRestoreEnabled := liveRestoreEnabled
 					stopDaemon := stopDaemon
 
 					t.Parallel()
 
 					d := daemon.New(t)
-					client := d.NewClientT(t)
+					client, err := d.NewClient()
+					assert.NilError(t, err)
 
 					args := []string{"--iptables=false"}
 					if liveRestoreEnabled {
diff --git a/vendor/github.com/docker/docker/integration/container/run_linux_test.go b/vendor/github.com/docker/docker/integration/container/run_linux_test.go
deleted file mode 100644
index dfdde57ca..000000000
--- a/vendor/github.com/docker/docker/integration/container/run_linux_test.go
+++ /dev/null
@@ -1,91 +0,0 @@
-package container // import "github.com/docker/docker/integration/container"
-
-import (
-	"context"
-	"strconv"
-	"strings"
-	"testing"
-	"time"
-
-	containertypes "github.com/docker/docker/api/types/container"
-	"github.com/docker/docker/api/types/versions"
-	"github.com/docker/docker/integration/internal/container"
-	"gotest.tools/assert"
-	is "gotest.tools/assert/cmp"
-	"gotest.tools/poll"
-	"gotest.tools/skip"
-)
-
-func TestKernelTCPMemory(t *testing.T) {
-	skip.If(t, testEnv.DaemonInfo.OSType != "linux")
-	skip.If(t, versions.LessThan(testEnv.DaemonAPIVersion(), "1.40"), "skip test from new feature")
-	skip.If(t, !testEnv.DaemonInfo.KernelMemoryTCP)
-
-	defer setupTest(t)()
-	client := testEnv.APIClient()
-	ctx := context.Background()
-
-	const (
-		kernelMemoryTCP int64 = 200 * 1024 * 1024
-	)
-
-	cID := container.Run(t, ctx, client, func(c *container.TestContainerConfig) {
-		c.HostConfig.Resources = containertypes.Resources{
-			KernelMemoryTCP: kernelMemoryTCP,
-		}
-	})
-
-	poll.WaitOn(t, container.IsInState(ctx, client, cID, "running"), poll.WithDelay(100*time.Millisecond))
-
-	inspect, err := client.ContainerInspect(ctx, cID)
-	assert.NilError(t, err)
-	assert.Check(t, is.Equal(kernelMemoryTCP, inspect.HostConfig.KernelMemoryTCP))
-
-	res, err := container.Exec(ctx, client, cID,
-		[]string{"cat", "/sys/fs/cgroup/memory/memory.kmem.tcp.limit_in_bytes"})
-	assert.NilError(t, err)
-	assert.Assert(t, is.Len(res.Stderr(), 0))
-	assert.Equal(t, 0, res.ExitCode)
-	assert.Check(t, is.Equal(strconv.FormatInt(kernelMemoryTCP, 10), strings.TrimSpace(res.Stdout())))
-}
-
-func TestNISDomainname(t *testing.T) {
-	skip.If(t, testEnv.DaemonInfo.OSType != "linux")
-
-	defer setupTest(t)()
-	client := testEnv.APIClient()
-	ctx := context.Background()
-
-	const (
-		hostname   = "foobar"
-		domainname = "baz.cyphar.com"
-	)
-
-	cID := container.Run(t, ctx, client, func(c *container.TestContainerConfig) {
-		c.Config.Hostname = hostname
-		c.Config.Domainname = domainname
-	})
-
-	poll.WaitOn(t, container.IsInState(ctx, client, cID, "running"), poll.WithDelay(100*time.Millisecond))
-
-	inspect, err := client.ContainerInspect(ctx, cID)
-	assert.NilError(t, err)
-	assert.Check(t, is.Equal(hostname, inspect.Config.Hostname))
-	assert.Check(t, is.Equal(domainname, inspect.Config.Domainname))
-
-	// Check hostname.
-	res, err := container.Exec(ctx, client, cID,
-		[]string{"cat", "/proc/sys/kernel/hostname"})
-	assert.NilError(t, err)
-	assert.Assert(t, is.Len(res.Stderr(), 0))
-	assert.Equal(t, 0, res.ExitCode)
-	assert.Check(t, is.Equal(hostname, strings.TrimSpace(res.Stdout())))
-
-	// Check domainname.
-	res, err = container.Exec(ctx, client, cID,
-		[]string{"cat", "/proc/sys/kernel/domainname"})
-	assert.NilError(t, err)
-	assert.Assert(t, is.Len(res.Stderr(), 0))
-	assert.Equal(t, 0, res.ExitCode)
-	assert.Check(t, is.Equal(domainname, strings.TrimSpace(res.Stdout())))
-}
diff --git a/vendor/github.com/docker/docker/integration/container/stats_test.go b/vendor/github.com/docker/docker/integration/container/stats_test.go
index 8472cc9fd..6493a3057 100644
--- a/vendor/github.com/docker/docker/integration/container/stats_test.go
+++ b/vendor/github.com/docker/docker/integration/container/stats_test.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/integration/internal/container"
+	"github.com/docker/docker/internal/test/request"
 	"gotest.tools/assert"
 	is "gotest.tools/assert/cmp"
 	"gotest.tools/poll"
@@ -19,7 +20,7 @@ func TestStats(t *testing.T) {
 	skip.If(t, !testEnv.DaemonInfo.MemoryLimit)
 
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	info, err := client.Info(ctx)
diff --git a/vendor/github.com/docker/docker/integration/container/stop_linux_test.go b/vendor/github.com/docker/docker/integration/container/stop_linux_test.go
index 552706c25..92db0de41 100644
--- a/vendor/github.com/docker/docker/integration/container/stop_linux_test.go
+++ b/vendor/github.com/docker/docker/integration/container/stop_linux_test.go
@@ -10,6 +10,7 @@ import (
 
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/integration/internal/container"
+	"github.com/docker/docker/internal/test/request"
 	"gotest.tools/assert"
 	"gotest.tools/icmd"
 	"gotest.tools/poll"
@@ -21,7 +22,7 @@ import (
 // waiting is not limited (issue #35311).
 func TestStopContainerWithTimeout(t *testing.T) {
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	testCmd := container.WithCmd("sh", "-c", "sleep 2 && exit 42")
@@ -72,10 +73,10 @@ func TestStopContainerWithTimeout(t *testing.T) {
 
 func TestDeleteDevicemapper(t *testing.T) {
 	skip.If(t, testEnv.DaemonInfo.Driver != "devicemapper")
-	skip.If(t, testEnv.IsRemoteDaemon)
+	skip.If(t, testEnv.IsRemoteDaemon, "cannot start daemon on remote test run")
 
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	id := container.Run(t, ctx, client, container.WithName("foo-"+t.Name()), container.WithCmd("echo"))
diff --git a/vendor/github.com/docker/docker/integration/container/stop_test.go b/vendor/github.com/docker/docker/integration/container/stop_test.go
index 43d729b7b..03e76b054 100644
--- a/vendor/github.com/docker/docker/integration/container/stop_test.go
+++ b/vendor/github.com/docker/docker/integration/container/stop_test.go
@@ -6,13 +6,14 @@ import (
 	"time"
 
 	"github.com/docker/docker/integration/internal/container"
+	"github.com/docker/docker/internal/test/request"
 	"gotest.tools/assert"
 	"gotest.tools/poll"
 )
 
 func TestStopContainerWithRestartPolicyAlways(t *testing.T) {
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	names := []string{"verifyRestart1-" + t.Name(), "verifyRestart2-" + t.Name()}
diff --git a/vendor/github.com/docker/docker/integration/container/stop_windows_test.go b/vendor/github.com/docker/docker/integration/container/stop_windows_test.go
index 2dd5a93ba..0992f62bc 100644
--- a/vendor/github.com/docker/docker/integration/container/stop_windows_test.go
+++ b/vendor/github.com/docker/docker/integration/container/stop_windows_test.go
@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"github.com/docker/docker/integration/internal/container"
+	"github.com/docker/docker/internal/test/request"
 	"gotest.tools/assert"
 	"gotest.tools/poll"
 	"gotest.tools/skip"
@@ -18,7 +19,7 @@ import (
 func TestStopContainerWithTimeout(t *testing.T) {
 	skip.If(t, testEnv.OSType == "windows")
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	testCmd := container.WithCmd("sh", "-c", "sleep 2 && exit 42")
diff --git a/vendor/github.com/docker/docker/integration/container/update_linux_test.go b/vendor/github.com/docker/docker/integration/container/update_linux_test.go
index 5c37bce76..7ebe64e7e 100644
--- a/vendor/github.com/docker/docker/integration/container/update_linux_test.go
+++ b/vendor/github.com/docker/docker/integration/container/update_linux_test.go
@@ -9,6 +9,7 @@ import (
 
 	containertypes "github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/integration/internal/container"
+	"github.com/docker/docker/internal/test/request"
 	"gotest.tools/assert"
 	is "gotest.tools/assert/cmp"
 	"gotest.tools/poll"
@@ -21,7 +22,7 @@ func TestUpdateMemory(t *testing.T) {
 	skip.If(t, !testEnv.DaemonInfo.SwapLimit)
 
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	cID := container.Run(t, ctx, client, func(c *container.TestContainerConfig) {
@@ -66,8 +67,10 @@ func TestUpdateMemory(t *testing.T) {
 }
 
 func TestUpdateCPUQuota(t *testing.T) {
+	t.Parallel()
+
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	cID := container.Run(t, ctx, client)
diff --git a/vendor/github.com/docker/docker/integration/container/update_test.go b/vendor/github.com/docker/docker/integration/container/update_test.go
index 6a136a707..0e32184d2 100644
--- a/vendor/github.com/docker/docker/integration/container/update_test.go
+++ b/vendor/github.com/docker/docker/integration/container/update_test.go
@@ -7,6 +7,7 @@ import (
 
 	containertypes "github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/integration/internal/container"
+	"github.com/docker/docker/internal/test/request"
 	"gotest.tools/assert"
 	is "gotest.tools/assert/cmp"
 	"gotest.tools/poll"
@@ -14,7 +15,7 @@ import (
 
 func TestUpdateRestartPolicy(t *testing.T) {
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	cID := container.Run(t, ctx, client, container.WithCmd("sh", "-c", "sleep 1 && false"), func(c *container.TestContainerConfig) {
@@ -47,7 +48,7 @@ func TestUpdateRestartPolicy(t *testing.T) {
 
 func TestUpdateRestartWithAutoRemove(t *testing.T) {
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	cID := container.Run(t, ctx, client, func(c *container.TestContainerConfig) {
diff --git a/vendor/github.com/docker/docker/integration/container/wait_test.go b/vendor/github.com/docker/docker/integration/container/wait_test.go
deleted file mode 100644
index 09edcabf1..000000000
--- a/vendor/github.com/docker/docker/integration/container/wait_test.go
+++ /dev/null
@@ -1,102 +0,0 @@
-package container // import "github.com/docker/docker/integration/container"
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/docker/docker/integration/internal/container"
-	"github.com/docker/docker/internal/test/request"
-	"gotest.tools/assert"
-	is "gotest.tools/assert/cmp"
-	"gotest.tools/poll"
-	"gotest.tools/skip"
-)
-
-func TestWaitNonBlocked(t *testing.T) {
-	defer setupTest(t)()
-	cli := request.NewAPIClient(t)
-
-	testCases := []struct {
-		doc          string
-		cmd          string
-		expectedCode int64
-	}{
-		{
-			doc:          "wait-nonblocking-exit-0",
-			cmd:          "exit 0",
-			expectedCode: 0,
-		},
-		{
-			doc:          "wait-nonblocking-exit-random",
-			cmd:          "exit 99",
-			expectedCode: 99,
-		},
-	}
-
-	for _, tc := range testCases {
-		tc := tc
-		t.Run(tc.doc, func(t *testing.T) {
-			t.Parallel()
-			ctx := context.Background()
-			containerID := container.Run(t, ctx, cli, container.WithCmd("sh", "-c", tc.cmd))
-			poll.WaitOn(t, container.IsInState(ctx, cli, containerID, "exited"), poll.WithTimeout(30*time.Second), poll.WithDelay(100*time.Millisecond))
-
-			waitresC, errC := cli.ContainerWait(ctx, containerID, "")
-			select {
-			case err := <-errC:
-				assert.NilError(t, err)
-			case waitres := <-waitresC:
-				assert.Check(t, is.Equal(tc.expectedCode, waitres.StatusCode))
-			}
-		})
-	}
-}
-
-func TestWaitBlocked(t *testing.T) {
-	// Windows busybox does not support trap in this way, not sleep with sub-second
-	// granularity. It will always exit 0x40010004.
-	skip.If(t, testEnv.DaemonInfo.OSType != "linux")
-	defer setupTest(t)()
-	cli := request.NewAPIClient(t)
-
-	testCases := []struct {
-		doc          string
-		cmd          string
-		expectedCode int64
-	}{
-		{
-			doc:          "test-wait-blocked-exit-zero",
-			cmd:          "trap 'exit 0' TERM; while true; do usleep 10; done",
-			expectedCode: 0,
-		},
-		{
-			doc:          "test-wait-blocked-exit-random",
-			cmd:          "trap 'exit 99' TERM; while true; do usleep 10; done",
-			expectedCode: 99,
-		},
-	}
-	for _, tc := range testCases {
-		tc := tc
-		t.Run(tc.doc, func(t *testing.T) {
-			t.Parallel()
-			ctx := context.Background()
-			containerID := container.Run(t, ctx, cli, container.WithCmd("sh", "-c", tc.cmd))
-			poll.WaitOn(t, container.IsInState(ctx, cli, containerID, "running"), poll.WithTimeout(30*time.Second), poll.WithDelay(100*time.Millisecond))
-
-			waitresC, errC := cli.ContainerWait(ctx, containerID, "")
-
-			err := cli.ContainerStop(ctx, containerID, nil)
-			assert.NilError(t, err)
-
-			select {
-			case err := <-errC:
-				assert.NilError(t, err)
-			case waitres := <-waitresC:
-				assert.Check(t, is.Equal(tc.expectedCode, waitres.StatusCode))
-			case <-time.After(2 * time.Second):
-				t.Fatal("timeout waiting for `docker wait`")
-			}
-		})
-	}
-}
diff --git a/vendor/github.com/docker/docker/integration/image/commit_test.go b/vendor/github.com/docker/docker/integration/image/commit_test.go
index 996f3716a..ad3f89ec7 100644
--- a/vendor/github.com/docker/docker/integration/image/commit_test.go
+++ b/vendor/github.com/docker/docker/integration/image/commit_test.go
@@ -7,6 +7,7 @@ import (
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/versions"
 	"github.com/docker/docker/integration/internal/container"
+	"github.com/docker/docker/internal/test/request"
 	"gotest.tools/assert"
 	is "gotest.tools/assert/cmp"
 	"gotest.tools/skip"
@@ -16,7 +17,7 @@ func TestCommitInheritsEnv(t *testing.T) {
 	skip.If(t, versions.LessThan(testEnv.DaemonAPIVersion(), "1.36"), "broken in earlier versions")
 	skip.If(t, testEnv.DaemonInfo.OSType == "windows", "FIXME")
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	cID1 := container.Create(t, ctx, client)
diff --git a/vendor/github.com/docker/docker/integration/image/import_test.go b/vendor/github.com/docker/docker/integration/image/import_test.go
index 6198c2048..2e2fdf719 100644
--- a/vendor/github.com/docker/docker/integration/image/import_test.go
+++ b/vendor/github.com/docker/docker/integration/image/import_test.go
@@ -9,24 +9,17 @@ import (
 	"testing"
 
 	"github.com/docker/docker/api/types"
-	"github.com/docker/docker/internal/test/daemon"
+	"github.com/docker/docker/internal/test/request"
 	"github.com/docker/docker/internal/testutil"
 	"gotest.tools/skip"
 )
 
 // Ensure we don't regress on CVE-2017-14992.
 func TestImportExtremelyLargeImageWorks(t *testing.T) {
-	skip.If(t, testEnv.IsRemoteDaemon, "cannot run daemon when remote daemon")
 	skip.If(t, runtime.GOARCH == "arm64", "effective test will be time out")
 	skip.If(t, testEnv.OSType == "windows", "TODO enable on windows")
-	t.Parallel()
 
-	// Spin up a new daemon, so that we can run this test in parallel (it's a slow test)
-	d := daemon.New(t)
-	d.Start(t)
-	defer d.Stop(t)
-
-	client := d.NewClientT(t)
+	client := request.NewAPIClient(t)
 
 	// Construct an empty tar archive with about 8GB of junk padding at the
 	// end. This should not cause any crashes (the padding should be mostly
diff --git a/vendor/github.com/docker/docker/integration/image/list_test.go b/vendor/github.com/docker/docker/integration/image/list_test.go
deleted file mode 100644
index 5b381d16c..000000000
--- a/vendor/github.com/docker/docker/integration/image/list_test.go
+++ /dev/null
@@ -1,49 +0,0 @@
-package image // import "github.com/docker/docker/integration/image"
-
-import (
-	"context"
-	"testing"
-
-	"github.com/docker/docker/api/types"
-	"github.com/docker/docker/api/types/filters"
-	"gotest.tools/assert"
-	is "gotest.tools/assert/cmp"
-)
-
-// Regression : #38171
-func TestImagesFilterMultiReference(t *testing.T) {
-	defer setupTest(t)()
-	client := testEnv.APIClient()
-	ctx := context.Background()
-
-	name := "images_filter_multi_reference"
-	repoTags := []string{
-		name + ":v1",
-		name + ":v2",
-		name + ":v3",
-		name + ":v4",
-	}
-
-	for _, repoTag := range repoTags {
-		err := client.ImageTag(ctx, "busybox:latest", repoTag)
-		assert.NilError(t, err)
-	}
-
-	filter := filters.NewArgs()
-	filter.Add("reference", repoTags[0])
-	filter.Add("reference", repoTags[1])
-	filter.Add("reference", repoTags[2])
-	options := types.ImageListOptions{
-		All:     false,
-		Filters: filter,
-	}
-	images, err := client.ImageList(ctx, options)
-	assert.NilError(t, err)
-
-	assert.Check(t, is.Equal(len(images[0].RepoTags), 3))
-	for _, repoTag := range images[0].RepoTags {
-		if repoTag != repoTags[0] && repoTag != repoTags[1] && repoTag != repoTags[2] {
-			t.Errorf("list images doesn't match any repoTag we expected, repoTag: %s", repoTag)
-		}
-	}
-}
diff --git a/vendor/github.com/docker/docker/integration/image/remove_test.go b/vendor/github.com/docker/docker/integration/image/remove_test.go
index 68ef9aa1e..76d73a713 100644
--- a/vendor/github.com/docker/docker/integration/image/remove_test.go
+++ b/vendor/github.com/docker/docker/integration/image/remove_test.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/integration/internal/container"
+	"github.com/docker/docker/internal/test/request"
 	"gotest.tools/assert"
 	is "gotest.tools/assert/cmp"
 	"gotest.tools/skip"
@@ -15,7 +16,7 @@ func TestRemoveImageOrphaning(t *testing.T) {
 	skip.If(t, testEnv.DaemonInfo.OSType == "windows", "FIXME")
 	defer setupTest(t)()
 	ctx := context.Background()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	img := "test-container-orphaning"
 
diff --git a/vendor/github.com/docker/docker/integration/image/tag_test.go b/vendor/github.com/docker/docker/integration/image/tag_test.go
index d237c4805..f3eb9eb7d 100644
--- a/vendor/github.com/docker/docker/integration/image/tag_test.go
+++ b/vendor/github.com/docker/docker/integration/image/tag_test.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"testing"
 
+	"github.com/docker/docker/internal/test/request"
 	"github.com/docker/docker/internal/testutil"
 	"gotest.tools/assert"
 	is "gotest.tools/assert/cmp"
@@ -14,7 +15,7 @@ import (
 // tagging a named image in a new unprefixed repo should work
 func TestTagUnprefixedRepoByNameOrName(t *testing.T) {
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	// By name
@@ -32,7 +33,7 @@ func TestTagUnprefixedRepoByNameOrName(t *testing.T) {
 // TODO (yongtang): Migrate to unit tests
 func TestTagInvalidReference(t *testing.T) {
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	invalidRepos := []string{"fo$z$", "Foo@3cc", "Foo$3", "Foo*3", "Fo^3", "Foo!3", "F)xcz(", "fo%asd", "FOO/bar"}
@@ -71,7 +72,7 @@ func TestTagInvalidReference(t *testing.T) {
 // ensure we allow the use of valid tags
 func TestTagValidPrefixedRepo(t *testing.T) {
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	validRepos := []string{"fooo/bar", "fooaa/test", "foooo:t", "HOSTNAME.DOMAIN.COM:443/foo/bar"}
@@ -85,7 +86,7 @@ func TestTagValidPrefixedRepo(t *testing.T) {
 // tag an image with an existed tag name without -f option should work
 func TestTagExistedNameWithoutForce(t *testing.T) {
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	err := client.ImageTag(ctx, "busybox:latest", "busybox:test")
@@ -97,7 +98,7 @@ func TestTagExistedNameWithoutForce(t *testing.T) {
 func TestTagOfficialNames(t *testing.T) {
 	skip.If(t, testEnv.OSType == "windows")
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	names := []string{
@@ -127,7 +128,7 @@ func TestTagOfficialNames(t *testing.T) {
 // ensure tags can not match digests
 func TestTagMatchesDigest(t *testing.T) {
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	digest := "busybox@sha256:abcdef76720241213f5303bda7704ec4c2ef75613173910a56fb1b6e20251507"
diff --git a/vendor/github.com/docker/docker/integration/internal/container/ops.go b/vendor/github.com/docker/docker/integration/internal/container/ops.go
index 3825981b6..df5598b62 100644
--- a/vendor/github.com/docker/docker/integration/internal/container/ops.go
+++ b/vendor/github.com/docker/docker/integration/internal/container/ops.go
@@ -4,7 +4,6 @@ import (
 	"fmt"
 
 	containertypes "github.com/docker/docker/api/types/container"
-	mounttypes "github.com/docker/docker/api/types/mount"
 	networktypes "github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/api/types/strslice"
 	"github.com/docker/go-connections/nat"
@@ -69,13 +68,6 @@ func WithWorkingDir(dir string) func(*TestContainerConfig) {
 	}
 }
 
-// WithMount adds an mount
-func WithMount(m mounttypes.Mount) func(*TestContainerConfig) {
-	return func(c *TestContainerConfig) {
-		c.HostConfig.Mounts = append(c.HostConfig.Mounts, m)
-	}
-}
-
 // WithVolume sets the volume of the container
 func WithVolume(name string) func(*TestContainerConfig) {
 	return func(c *TestContainerConfig) {
diff --git a/vendor/github.com/docker/docker/integration/internal/container/states.go b/vendor/github.com/docker/docker/integration/internal/container/states.go
index 239715918..088407deb 100644
--- a/vendor/github.com/docker/docker/integration/internal/container/states.go
+++ b/vendor/github.com/docker/docker/integration/internal/container/states.go
@@ -5,7 +5,6 @@ import (
 	"strings"
 
 	"github.com/docker/docker/client"
-	"github.com/pkg/errors"
 	"gotest.tools/poll"
 )
 
@@ -40,20 +39,3 @@ func IsInState(ctx context.Context, client client.APIClient, containerID string,
 		return poll.Continue("waiting for container to be one of (%s), currently %s", strings.Join(state, ", "), inspect.State.Status)
 	}
 }
-
-// IsSuccessful verifies state.Status == "exited" && state.ExitCode == 0
-func IsSuccessful(ctx context.Context, client client.APIClient, containerID string) func(log poll.LogT) poll.Result {
-	return func(log poll.LogT) poll.Result {
-		inspect, err := client.ContainerInspect(ctx, containerID)
-		if err != nil {
-			return poll.Error(err)
-		}
-		if inspect.State.Status == "exited" {
-			if inspect.State.ExitCode == 0 {
-				return poll.Success()
-			}
-			return poll.Error(errors.Errorf("expected exit code 0, got %d", inspect.State.ExitCode))
-		}
-		return poll.Continue("waiting for container to be \"exited\", currently %s", inspect.State.Status)
-	}
-}
diff --git a/vendor/github.com/docker/docker/integration/internal/network/states.go b/vendor/github.com/docker/docker/integration/internal/network/states.go
deleted file mode 100644
index 1f00e0b80..000000000
--- a/vendor/github.com/docker/docker/integration/internal/network/states.go
+++ /dev/null
@@ -1,20 +0,0 @@
-package network
-
-import (
-	"context"
-
-	"github.com/docker/docker/api/types"
-	"github.com/docker/docker/client"
-	"gotest.tools/poll"
-)
-
-// IsRemoved verifies the network is removed.
-func IsRemoved(ctx context.Context, client client.NetworkAPIClient, networkID string) func(log poll.LogT) poll.Result {
-	return func(log poll.LogT) poll.Result {
-		_, err := client.NetworkInspect(ctx, networkID, types.NetworkInspectOptions{})
-		if err == nil {
-			return poll.Continue("waiting for network %s to be removed", networkID)
-		}
-		return poll.Success()
-	}
-}
diff --git a/vendor/github.com/docker/docker/integration/internal/swarm/service.go b/vendor/github.com/docker/docker/integration/internal/swarm/service.go
index c1f472c46..5b9c5a97a 100644
--- a/vendor/github.com/docker/docker/integration/internal/swarm/service.go
+++ b/vendor/github.com/docker/docker/integration/internal/swarm/service.go
@@ -9,7 +9,6 @@ import (
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/filters"
 	swarmtypes "github.com/docker/docker/api/types/swarm"
-	"github.com/docker/docker/client"
 	"github.com/docker/docker/internal/test/daemon"
 	"github.com/docker/docker/internal/test/environment"
 	"gotest.tools/assert"
@@ -67,27 +66,24 @@ type ServiceSpecOpt func(*swarmtypes.ServiceSpec)
 // CreateService creates a service on the passed in swarm daemon.
 func CreateService(t *testing.T, d *daemon.Daemon, opts ...ServiceSpecOpt) string {
 	t.Helper()
+	spec := defaultServiceSpec()
+	for _, o := range opts {
+		o(&spec)
+	}
 
 	client := d.NewClientT(t)
 	defer client.Close()
 
-	spec := CreateServiceSpec(t, opts...)
 	resp, err := client.ServiceCreate(context.Background(), spec, types.ServiceCreateOptions{})
 	assert.NilError(t, err, "error creating service")
 	return resp.ID
 }
 
-// CreateServiceSpec creates a default service-spec, and applies the provided options
-func CreateServiceSpec(t *testing.T, opts ...ServiceSpecOpt) swarmtypes.ServiceSpec {
-	t.Helper()
+func defaultServiceSpec() swarmtypes.ServiceSpec {
 	var spec swarmtypes.ServiceSpec
 	ServiceWithImage("busybox:latest")(&spec)
 	ServiceWithCommand([]string{"/bin/top"})(&spec)
 	ServiceWithReplicas(1)(&spec)
-
-	for _, o := range opts {
-		o(&spec)
-	}
 	return spec
 }
 
@@ -142,14 +138,6 @@ func ServiceWithReplicas(n uint64) ServiceSpecOpt {
 	}
 }
 
-// ServiceWithMaxReplicas sets the max replicas for the service
-func ServiceWithMaxReplicas(n uint64) ServiceSpecOpt {
-	return func(spec *swarmtypes.ServiceSpec) {
-		ensurePlacement(spec)
-		spec.TaskTemplate.Placement.MaxReplicas = n
-	}
-}
-
 // ServiceWithName sets the name of the service
 func ServiceWithName(name string) ServiceSpecOpt {
 	return func(spec *swarmtypes.ServiceSpec) {
@@ -172,25 +160,20 @@ func ServiceWithEndpoint(endpoint *swarmtypes.EndpointSpec) ServiceSpecOpt {
 	}
 }
 
-// ServiceWithSysctls sets the Sysctls option of the service's ContainerSpec.
-func ServiceWithSysctls(sysctls map[string]string) ServiceSpecOpt {
-	return func(spec *swarmtypes.ServiceSpec) {
-		ensureContainerSpec(spec)
-		spec.TaskTemplate.ContainerSpec.Sysctls = sysctls
-	}
-}
-
 // GetRunningTasks gets the list of running tasks for a service
-func GetRunningTasks(t *testing.T, c client.ServiceAPIClient, serviceID string) []swarmtypes.Task {
+func GetRunningTasks(t *testing.T, d *daemon.Daemon, serviceID string) []swarmtypes.Task {
 	t.Helper()
+	client := d.NewClientT(t)
+	defer client.Close()
 
-	tasks, err := c.TaskList(context.Background(), types.TaskListOptions{
-		Filters: filters.NewArgs(
-			filters.Arg("service", serviceID),
-			filters.Arg("desired-state", "running"),
-		),
-	})
+	filterArgs := filters.NewArgs()
+	filterArgs.Add("desired-state", "running")
+	filterArgs.Add("service", serviceID)
 
+	options := types.TaskListOptions{
+		Filters: filterArgs,
+	}
+	tasks, err := client.TaskList(context.Background(), options)
 	assert.NilError(t, err)
 	return tasks
 }
@@ -216,9 +199,3 @@ func ensureContainerSpec(spec *swarmtypes.ServiceSpec) {
 		spec.TaskTemplate.ContainerSpec = &swarmtypes.ContainerSpec{}
 	}
 }
-
-func ensurePlacement(spec *swarmtypes.ServiceSpec) {
-	if spec.TaskTemplate.Placement == nil {
-		spec.TaskTemplate.Placement = &swarmtypes.Placement{}
-	}
-}
diff --git a/vendor/github.com/docker/docker/integration/network/delete_test.go b/vendor/github.com/docker/docker/integration/network/delete_test.go
index 5989eba16..f9ab91986 100644
--- a/vendor/github.com/docker/docker/integration/network/delete_test.go
+++ b/vendor/github.com/docker/docker/integration/network/delete_test.go
@@ -6,8 +6,8 @@ import (
 
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/versions"
-	dclient "github.com/docker/docker/client"
 	"github.com/docker/docker/integration/internal/network"
+	"github.com/docker/docker/internal/test/request"
 	"gotest.tools/assert"
 	is "gotest.tools/assert/cmp"
 	"gotest.tools/skip"
@@ -27,7 +27,10 @@ func containsNetwork(nws []types.NetworkResource, networkID string) bool {
 // first network's ID as name.
 //
 // After successful creation, properties of all three networks is returned
-func createAmbiguousNetworks(t *testing.T, ctx context.Context, client dclient.APIClient) (string, string, string) { // nolint: golint
+func createAmbiguousNetworks(t *testing.T) (string, string, string) {
+	client := request.NewAPIClient(t)
+	ctx := context.Background()
+
 	testNet := network.CreateNoError(t, ctx, client, "testNet")
 	idPrefixNet := network.CreateNoError(t, ctx, client, testNet[:12])
 	fullIDNet := network.CreateNoError(t, ctx, client, testNet)
@@ -45,7 +48,7 @@ func createAmbiguousNetworks(t *testing.T, ctx context.Context, client dclient.A
 func TestNetworkCreateDelete(t *testing.T) {
 	skip.If(t, testEnv.DaemonInfo.OSType != "linux")
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	netName := "testnetwork_" + t.Name()
@@ -68,9 +71,9 @@ func TestDockerNetworkDeletePreferID(t *testing.T) {
 	skip.If(t, testEnv.OSType == "windows",
 		"FIXME. Windows doesn't run DinD and uses networks shared between control daemon and daemon under test")
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
-	testNet, idPrefixNet, fullIDNet := createAmbiguousNetworks(t, ctx, client)
+	testNet, idPrefixNet, fullIDNet := createAmbiguousNetworks(t)
 
 	// Delete the network using a prefix of the first network's ID as name.
 	// This should the network name with the id-prefix, not the original network.
diff --git a/vendor/github.com/docker/docker/integration/network/inspect_test.go b/vendor/github.com/docker/docker/integration/network/inspect_test.go
index 12ea884f2..1e9ad9486 100644
--- a/vendor/github.com/docker/docker/integration/network/inspect_test.go
+++ b/vendor/github.com/docker/docker/integration/network/inspect_test.go
@@ -91,7 +91,7 @@ func TestInspectNetwork(t *testing.T) {
 	err = client.NetworkRemove(context.Background(), overlayID)
 	assert.NilError(t, err)
 
-	poll.WaitOn(t, network.IsRemoved(context.Background(), client, overlayID), poll.WithTimeout(1*time.Minute), poll.WithDelay(10*time.Second))
+	poll.WaitOn(t, networkIsRemoved(client, overlayID), poll.WithTimeout(1*time.Minute), poll.WithDelay(10*time.Second))
 }
 
 func serviceRunningTasksCount(client client.ServiceAPIClient, serviceID string, instances uint64) func(log poll.LogT) poll.Result {
@@ -117,6 +117,16 @@ func serviceRunningTasksCount(client client.ServiceAPIClient, serviceID string,
 	}
 }
 
+func networkIsRemoved(client client.NetworkAPIClient, networkID string) func(log poll.LogT) poll.Result {
+	return func(log poll.LogT) poll.Result {
+		_, err := client.NetworkInspect(context.Background(), networkID, types.NetworkInspectOptions{})
+		if err == nil {
+			return poll.Continue("waiting for network %s to be removed", networkID)
+		}
+		return poll.Success()
+	}
+}
+
 func serviceIsRemoved(client client.ServiceAPIClient, serviceID string) func(log poll.LogT) poll.Result {
 	return func(log poll.LogT) poll.Result {
 		filter := filters.NewArgs()
diff --git a/vendor/github.com/docker/docker/integration/network/ipvlan/ipvlan_test.go b/vendor/github.com/docker/docker/integration/network/ipvlan/ipvlan_test.go
index 9b98ace41..b14649429 100644
--- a/vendor/github.com/docker/docker/integration/network/ipvlan/ipvlan_test.go
+++ b/vendor/github.com/docker/docker/integration/network/ipvlan/ipvlan_test.go
@@ -20,7 +20,7 @@ import (
 func TestDockerNetworkIpvlanPersistance(t *testing.T) {
 	// verify the driver automatically provisions the 802.1q link (di-dummy0.70)
 	skip.If(t, testEnv.DaemonInfo.OSType == "windows")
-	skip.If(t, testEnv.IsRemoteDaemon)
+	skip.If(t, testEnv.IsRemoteDaemon())
 	skip.If(t, !ipvlanKernelSupport(), "Kernel doesn't support ipvlan")
 
 	d := daemon.New(t, daemon.WithExperimental)
@@ -32,23 +32,24 @@ func TestDockerNetworkIpvlanPersistance(t *testing.T) {
 	n.CreateMasterDummy(t, master)
 	defer n.DeleteInterface(t, master)
 
-	c := d.NewClientT(t)
+	client, err := d.NewClient()
+	assert.NilError(t, err)
 
 	// create a network specifying the desired sub-interface name
 	netName := "di-persist"
-	net.CreateNoError(t, context.Background(), c, netName,
+	net.CreateNoError(t, context.Background(), client, netName,
 		net.WithIPvlan("di-dummy0.70", ""),
 	)
 
-	assert.Check(t, n.IsNetworkAvailable(c, netName))
+	assert.Check(t, n.IsNetworkAvailable(client, netName))
 	// Restart docker daemon to test the config has persisted to disk
 	d.Restart(t)
-	assert.Check(t, n.IsNetworkAvailable(c, netName))
+	assert.Check(t, n.IsNetworkAvailable(client, netName))
 }
 
 func TestDockerNetworkIpvlan(t *testing.T) {
 	skip.If(t, testEnv.DaemonInfo.OSType == "windows")
-	skip.If(t, testEnv.IsRemoteDaemon)
+	skip.If(t, testEnv.IsRemoteDaemon())
 	skip.If(t, !ipvlanKernelSupport(), "Kernel doesn't support ipvlan")
 
 	for _, tc := range []struct {
@@ -86,9 +87,11 @@ func TestDockerNetworkIpvlan(t *testing.T) {
 	} {
 		d := daemon.New(t, daemon.WithExperimental)
 		d.StartWithBusybox(t)
-		c := d.NewClientT(t)
 
-		t.Run(tc.name, tc.test(c))
+		client, err := d.NewClient()
+		assert.NilError(t, err)
+
+		t.Run(tc.name, tc.test(client))
 
 		d.Stop(t)
 		// FIXME(vdemeester) clean network
diff --git a/vendor/github.com/docker/docker/integration/network/macvlan/macvlan_test.go b/vendor/github.com/docker/docker/integration/network/macvlan/macvlan_test.go
index 164dc4d0d..a81b9014b 100644
--- a/vendor/github.com/docker/docker/integration/network/macvlan/macvlan_test.go
+++ b/vendor/github.com/docker/docker/integration/network/macvlan/macvlan_test.go
@@ -19,7 +19,7 @@ import (
 
 func TestDockerNetworkMacvlanPersistance(t *testing.T) {
 	// verify the driver automatically provisions the 802.1q link (dm-dummy0.60)
-	skip.If(t, testEnv.IsRemoteDaemon)
+	skip.If(t, testEnv.IsRemoteDaemon())
 	skip.If(t, !macvlanKernelSupport(), "Kernel doesn't support macvlan")
 
 	d := daemon.New(t)
@@ -30,19 +30,20 @@ func TestDockerNetworkMacvlanPersistance(t *testing.T) {
 	n.CreateMasterDummy(t, master)
 	defer n.DeleteInterface(t, master)
 
-	c := d.NewClientT(t)
+	client, err := d.NewClient()
+	assert.NilError(t, err)
 
 	netName := "dm-persist"
-	net.CreateNoError(t, context.Background(), c, netName,
+	net.CreateNoError(t, context.Background(), client, netName,
 		net.WithMacvlan("dm-dummy0.60"),
 	)
-	assert.Check(t, n.IsNetworkAvailable(c, netName))
+	assert.Check(t, n.IsNetworkAvailable(client, netName))
 	d.Restart(t)
-	assert.Check(t, n.IsNetworkAvailable(c, netName))
+	assert.Check(t, n.IsNetworkAvailable(client, netName))
 }
 
 func TestDockerNetworkMacvlan(t *testing.T) {
-	skip.If(t, testEnv.IsRemoteDaemon)
+	skip.If(t, testEnv.IsRemoteDaemon())
 	skip.If(t, !macvlanKernelSupport(), "Kernel doesn't support macvlan")
 
 	for _, tc := range []struct {
@@ -68,9 +69,11 @@ func TestDockerNetworkMacvlan(t *testing.T) {
 	} {
 		d := daemon.New(t)
 		d.StartWithBusybox(t)
-		c := d.NewClientT(t)
 
-		t.Run(tc.name, tc.test(c))
+		client, err := d.NewClient()
+		assert.NilError(t, err)
+
+		t.Run(tc.name, tc.test(client))
 
 		d.Stop(t)
 		// FIXME(vdemeester) clean network
diff --git a/vendor/github.com/docker/docker/integration/network/network_test.go b/vendor/github.com/docker/docker/integration/network/network_test.go
index 94236b761..5f62550f0 100644
--- a/vendor/github.com/docker/docker/integration/network/network_test.go
+++ b/vendor/github.com/docker/docker/integration/network/network_test.go
@@ -26,20 +26,21 @@ func TestRunContainerWithBridgeNone(t *testing.T) {
 	d.StartWithBusybox(t, "-b", "none")
 	defer d.Stop(t)
 
-	c := d.NewClientT(t)
-	ctx := context.Background()
+	client, err := d.NewClient()
+	assert.Check(t, err, "error creating client")
 
-	id1 := container.Run(t, ctx, c)
-	defer c.ContainerRemove(ctx, id1, types.ContainerRemoveOptions{Force: true})
+	ctx := context.Background()
+	id1 := container.Run(t, ctx, client)
+	defer client.ContainerRemove(ctx, id1, types.ContainerRemoveOptions{Force: true})
 
-	result, err := container.Exec(ctx, c, id1, []string{"ip", "l"})
+	result, err := container.Exec(ctx, client, id1, []string{"ip", "l"})
 	assert.NilError(t, err)
 	assert.Check(t, is.Equal(false, strings.Contains(result.Combined(), "eth0")), "There shouldn't be eth0 in container in default(bridge) mode when bridge network is disabled")
 
-	id2 := container.Run(t, ctx, c, container.WithNetworkMode("bridge"))
-	defer c.ContainerRemove(ctx, id2, types.ContainerRemoveOptions{Force: true})
+	id2 := container.Run(t, ctx, client, container.WithNetworkMode("bridge"))
+	defer client.ContainerRemove(ctx, id2, types.ContainerRemoveOptions{Force: true})
 
-	result, err = container.Exec(ctx, c, id2, []string{"ip", "l"})
+	result, err = container.Exec(ctx, client, id2, []string{"ip", "l"})
 	assert.NilError(t, err)
 	assert.Check(t, is.Equal(false, strings.Contains(result.Combined(), "eth0")), "There shouldn't be eth0 in container in bridge mode when bridge network is disabled")
 
@@ -50,10 +51,10 @@ func TestRunContainerWithBridgeNone(t *testing.T) {
 	err = cmd.Run()
 	assert.NilError(t, err, "Failed to get current process network namespace: %+v", err)
 
-	id3 := container.Run(t, ctx, c, container.WithNetworkMode("host"))
-	defer c.ContainerRemove(ctx, id3, types.ContainerRemoveOptions{Force: true})
+	id3 := container.Run(t, ctx, client, container.WithNetworkMode("host"))
+	defer client.ContainerRemove(ctx, id3, types.ContainerRemoveOptions{Force: true})
 
-	result, err = container.Exec(ctx, c, id3, []string{"sh", "-c", nsCommand})
+	result, err = container.Exec(ctx, client, id3, []string{"sh", "-c", nsCommand})
 	assert.NilError(t, err)
 	assert.Check(t, is.Equal(stdout.String(), result.Combined()), "The network namspace of container should be the same with host when --net=host and bridge network is disabled")
 }
diff --git a/vendor/github.com/docker/docker/integration/network/service_test.go b/vendor/github.com/docker/docker/integration/network/service_test.go
index 3a24d7fa1..4762b577a 100644
--- a/vendor/github.com/docker/docker/integration/network/service_test.go
+++ b/vendor/github.com/docker/docker/integration/network/service_test.go
@@ -27,21 +27,20 @@ func delInterface(t *testing.T, ifName string) {
 
 func TestDaemonRestartWithLiveRestore(t *testing.T) {
 	skip.If(t, testEnv.OSType == "windows")
-	skip.If(t, testEnv.IsRemoteDaemon)
+	skip.If(t, testEnv.IsRemoteDaemon())
 	skip.If(t, versions.LessThan(testEnv.DaemonAPIVersion(), "1.38"), "skip test from new feature")
 	d := daemon.New(t)
 	defer d.Stop(t)
 	d.Start(t)
-	d.Restart(t,
-		"--live-restore=true",
+	d.Restart(t, "--live-restore=true",
 		"--default-address-pool", "base=175.30.0.0/16,size=16",
-		"--default-address-pool", "base=175.33.0.0/16,size=24",
-	)
+		"--default-address-pool", "base=175.33.0.0/16,size=24")
 
 	// Verify bridge network's subnet
-	c := d.NewClientT(t)
-	defer c.Close()
-	out, err := c.NetworkInspect(context.Background(), "bridge", types.NetworkInspectOptions{})
+	cli, err := d.NewClient()
+	assert.Assert(t, err)
+	defer cli.Close()
+	out, err := cli.NetworkInspect(context.Background(), "bridge", types.NetworkInspectOptions{})
 	assert.NilError(t, err)
 	// Make sure docker0 doesn't get override with new IP in live restore case
 	assert.Equal(t, out.IPAM.Config[0].Subnet, "172.18.0.0/16")
@@ -50,7 +49,7 @@ func TestDaemonRestartWithLiveRestore(t *testing.T) {
 func TestDaemonDefaultNetworkPools(t *testing.T) {
 	skip.If(t, testEnv.OSType == "windows")
 	// Remove docker0 bridge and the start daemon defining the predefined address pools
-	skip.If(t, testEnv.IsRemoteDaemon)
+	skip.If(t, testEnv.IsRemoteDaemon())
 	skip.If(t, versions.LessThan(testEnv.DaemonAPIVersion(), "1.38"), "skip test from new feature")
 	defaultNetworkBridge := "docker0"
 	delInterface(t, defaultNetworkBridge)
@@ -58,32 +57,31 @@ func TestDaemonDefaultNetworkPools(t *testing.T) {
 	defer d.Stop(t)
 	d.Start(t,
 		"--default-address-pool", "base=175.30.0.0/16,size=16",
-		"--default-address-pool", "base=175.33.0.0/16,size=24",
-	)
-
-	c := d.NewClientT(t)
-	defer c.Close()
+		"--default-address-pool", "base=175.33.0.0/16,size=24")
 
 	// Verify bridge network's subnet
-	out, err := c.NetworkInspect(context.Background(), "bridge", types.NetworkInspectOptions{})
+	cli, err := d.NewClient()
+	assert.Assert(t, err)
+	defer cli.Close()
+	out, err := cli.NetworkInspect(context.Background(), "bridge", types.NetworkInspectOptions{})
 	assert.NilError(t, err)
 	assert.Equal(t, out.IPAM.Config[0].Subnet, "175.30.0.0/16")
 
 	// Create a bridge network and verify its subnet is the second default pool
 	name := "elango" + t.Name()
-	network.CreateNoError(t, context.Background(), c, name,
+	network.CreateNoError(t, context.Background(), cli, name,
 		network.WithDriver("bridge"),
 	)
-	out, err = c.NetworkInspect(context.Background(), name, types.NetworkInspectOptions{})
+	out, err = cli.NetworkInspect(context.Background(), name, types.NetworkInspectOptions{})
 	assert.NilError(t, err)
 	assert.Equal(t, out.IPAM.Config[0].Subnet, "175.33.0.0/24")
 
 	// Create a bridge network and verify its subnet is the third default pool
 	name = "saanvi" + t.Name()
-	network.CreateNoError(t, context.Background(), c, name,
+	network.CreateNoError(t, context.Background(), cli, name,
 		network.WithDriver("bridge"),
 	)
-	out, err = c.NetworkInspect(context.Background(), name, types.NetworkInspectOptions{})
+	out, err = cli.NetworkInspect(context.Background(), name, types.NetworkInspectOptions{})
 	assert.NilError(t, err)
 	assert.Equal(t, out.IPAM.Config[0].Subnet, "175.33.1.0/24")
 	delInterface(t, defaultNetworkBridge)
@@ -92,23 +90,23 @@ func TestDaemonDefaultNetworkPools(t *testing.T) {
 
 func TestDaemonRestartWithExistingNetwork(t *testing.T) {
 	skip.If(t, testEnv.OSType == "windows")
-	skip.If(t, testEnv.IsRemoteDaemon)
+	skip.If(t, testEnv.IsRemoteDaemon())
 	skip.If(t, versions.LessThan(testEnv.DaemonAPIVersion(), "1.38"), "skip test from new feature")
 	defaultNetworkBridge := "docker0"
 	d := daemon.New(t)
 	d.Start(t)
 	defer d.Stop(t)
-	c := d.NewClientT(t)
-	defer c.Close()
+	// Verify bridge network's subnet
+	cli, err := d.NewClient()
+	assert.Assert(t, err)
+	defer cli.Close()
 
 	// Create a bridge network
 	name := "elango" + t.Name()
-	network.CreateNoError(t, context.Background(), c, name,
+	network.CreateNoError(t, context.Background(), cli, name,
 		network.WithDriver("bridge"),
 	)
-
-	// Verify bridge network's subnet
-	out, err := c.NetworkInspect(context.Background(), name, types.NetworkInspectOptions{})
+	out, err := cli.NetworkInspect(context.Background(), name, types.NetworkInspectOptions{})
 	assert.NilError(t, err)
 	networkip := out.IPAM.Config[0].Subnet
 
@@ -117,7 +115,7 @@ func TestDaemonRestartWithExistingNetwork(t *testing.T) {
 		"--default-address-pool", "base=175.30.0.0/16,size=16",
 		"--default-address-pool", "base=175.33.0.0/16,size=24")
 
-	out1, err := c.NetworkInspect(context.Background(), name, types.NetworkInspectOptions{})
+	out1, err := cli.NetworkInspect(context.Background(), name, types.NetworkInspectOptions{})
 	assert.NilError(t, err)
 	assert.Equal(t, out1.IPAM.Config[0].Subnet, networkip)
 	delInterface(t, defaultNetworkBridge)
@@ -125,47 +123,46 @@ func TestDaemonRestartWithExistingNetwork(t *testing.T) {
 
 func TestDaemonRestartWithExistingNetworkWithDefaultPoolRange(t *testing.T) {
 	skip.If(t, testEnv.OSType == "windows")
-	skip.If(t, testEnv.IsRemoteDaemon)
+	skip.If(t, testEnv.IsRemoteDaemon())
 	skip.If(t, versions.LessThan(testEnv.DaemonAPIVersion(), "1.38"), "skip test from new feature")
 	defaultNetworkBridge := "docker0"
 	d := daemon.New(t)
 	d.Start(t)
 	defer d.Stop(t)
-	c := d.NewClientT(t)
-	defer c.Close()
+	// Verify bridge network's subnet
+	cli, err := d.NewClient()
+	assert.Assert(t, err)
+	defer cli.Close()
 
 	// Create a bridge network
 	name := "elango" + t.Name()
-	network.CreateNoError(t, context.Background(), c, name,
+	network.CreateNoError(t, context.Background(), cli, name,
 		network.WithDriver("bridge"),
 	)
-
-	// Verify bridge network's subnet
-	out, err := c.NetworkInspect(context.Background(), name, types.NetworkInspectOptions{})
+	out, err := cli.NetworkInspect(context.Background(), name, types.NetworkInspectOptions{})
 	assert.NilError(t, err)
 	networkip := out.IPAM.Config[0].Subnet
 
 	// Create a bridge network
 	name = "sthira" + t.Name()
-	network.CreateNoError(t, context.Background(), c, name,
+	network.CreateNoError(t, context.Background(), cli, name,
 		network.WithDriver("bridge"),
 	)
-	out, err = c.NetworkInspect(context.Background(), name, types.NetworkInspectOptions{})
+	out, err = cli.NetworkInspect(context.Background(), name, types.NetworkInspectOptions{})
 	assert.NilError(t, err)
 	networkip2 := out.IPAM.Config[0].Subnet
 
 	// Restart daemon with default address pool option
 	d.Restart(t,
 		"--default-address-pool", "base=175.18.0.0/16,size=16",
-		"--default-address-pool", "base=175.19.0.0/16,size=24",
-	)
+		"--default-address-pool", "base=175.19.0.0/16,size=24")
 
 	// Create a bridge network
 	name = "saanvi" + t.Name()
-	network.CreateNoError(t, context.Background(), c, name,
+	network.CreateNoError(t, context.Background(), cli, name,
 		network.WithDriver("bridge"),
 	)
-	out1, err := c.NetworkInspect(context.Background(), name, types.NetworkInspectOptions{})
+	out1, err := cli.NetworkInspect(context.Background(), name, types.NetworkInspectOptions{})
 	assert.NilError(t, err)
 
 	assert.Check(t, out1.IPAM.Config[0].Subnet != networkip)
@@ -175,22 +172,20 @@ func TestDaemonRestartWithExistingNetworkWithDefaultPoolRange(t *testing.T) {
 
 func TestDaemonWithBipAndDefaultNetworkPool(t *testing.T) {
 	skip.If(t, testEnv.OSType == "windows")
-	skip.If(t, testEnv.IsRemoteDaemon)
+	skip.If(t, testEnv.IsRemoteDaemon())
 	skip.If(t, versions.LessThan(testEnv.DaemonAPIVersion(), "1.38"), "skip test from new feature")
 	defaultNetworkBridge := "docker0"
 	d := daemon.New(t)
 	defer d.Stop(t)
-	d.Start(t,
-		"--bip=172.60.0.1/16",
+	d.Start(t, "--bip=172.60.0.1/16",
 		"--default-address-pool", "base=175.30.0.0/16,size=16",
-		"--default-address-pool", "base=175.33.0.0/16,size=24",
-	)
-
-	c := d.NewClientT(t)
-	defer c.Close()
+		"--default-address-pool", "base=175.33.0.0/16,size=24")
 
 	// Verify bridge network's subnet
-	out, err := c.NetworkInspect(context.Background(), "bridge", types.NetworkInspectOptions{})
+	cli, err := d.NewClient()
+	assert.Assert(t, err)
+	defer cli.Close()
+	out, err := cli.NetworkInspect(context.Background(), "bridge", types.NetworkInspectOptions{})
 	assert.NilError(t, err)
 	// Make sure BIP IP doesn't get override with new default address pool .
 	assert.Equal(t, out.IPAM.Config[0].Subnet, "172.60.0.1/16")
@@ -202,8 +197,8 @@ func TestServiceWithPredefinedNetwork(t *testing.T) {
 	defer setupTest(t)()
 	d := swarm.NewSwarm(t, testEnv)
 	defer d.Stop(t)
-	c := d.NewClientT(t)
-	defer c.Close()
+	client := d.NewClientT(t)
+	defer client.Close()
 
 	hostName := "host"
 	var instances uint64 = 1
@@ -215,12 +210,12 @@ func TestServiceWithPredefinedNetwork(t *testing.T) {
 		swarm.ServiceWithNetwork(hostName),
 	)
 
-	poll.WaitOn(t, serviceRunningCount(c, serviceID, instances), swarm.ServicePoll)
+	poll.WaitOn(t, serviceRunningCount(client, serviceID, instances), swarm.ServicePoll)
 
-	_, _, err := c.ServiceInspectWithRaw(context.Background(), serviceID, types.ServiceInspectOptions{})
+	_, _, err := client.ServiceInspectWithRaw(context.Background(), serviceID, types.ServiceInspectOptions{})
 	assert.NilError(t, err)
 
-	err = c.ServiceRemove(context.Background(), serviceID)
+	err = client.ServiceRemove(context.Background(), serviceID)
 	assert.NilError(t, err)
 }
 
@@ -231,10 +226,10 @@ func TestServiceRemoveKeepsIngressNetwork(t *testing.T) {
 	defer setupTest(t)()
 	d := swarm.NewSwarm(t, testEnv)
 	defer d.Stop(t)
-	c := d.NewClientT(t)
-	defer c.Close()
+	client := d.NewClientT(t)
+	defer client.Close()
 
-	poll.WaitOn(t, swarmIngressReady(c), swarm.NetworkPoll)
+	poll.WaitOn(t, swarmIngressReady(client), swarm.NetworkPoll)
 
 	var instances uint64 = 1
 
@@ -252,20 +247,20 @@ func TestServiceRemoveKeepsIngressNetwork(t *testing.T) {
 		}),
 	)
 
-	poll.WaitOn(t, serviceRunningCount(c, serviceID, instances), swarm.ServicePoll)
+	poll.WaitOn(t, serviceRunningCount(client, serviceID, instances), swarm.ServicePoll)
 
-	_, _, err := c.ServiceInspectWithRaw(context.Background(), serviceID, types.ServiceInspectOptions{})
+	_, _, err := client.ServiceInspectWithRaw(context.Background(), serviceID, types.ServiceInspectOptions{})
 	assert.NilError(t, err)
 
-	err = c.ServiceRemove(context.Background(), serviceID)
+	err = client.ServiceRemove(context.Background(), serviceID)
 	assert.NilError(t, err)
 
-	poll.WaitOn(t, serviceIsRemoved(c, serviceID), swarm.ServicePoll)
-	poll.WaitOn(t, noServices(c), swarm.ServicePoll)
+	poll.WaitOn(t, serviceIsRemoved(client, serviceID), swarm.ServicePoll)
+	poll.WaitOn(t, noServices(client), swarm.ServicePoll)
 
 	// Ensure that "ingress" is not removed or corrupted
 	time.Sleep(10 * time.Second)
-	netInfo, err := c.NetworkInspect(context.Background(), ingressNet, types.NetworkInspectOptions{
+	netInfo, err := client.NetworkInspect(context.Background(), ingressNet, types.NetworkInspectOptions{
 		Verbose: true,
 		Scope:   "swarm",
 	})
@@ -326,65 +321,6 @@ func noServices(client client.ServiceAPIClient) func(log poll.LogT) poll.Result
 	}
 }
 
-func TestServiceWithDataPathPortInit(t *testing.T) {
-	skip.If(t, testEnv.OSType == "windows")
-	skip.If(t, versions.LessThan(testEnv.DaemonAPIVersion(), "1.40"), "DataPathPort was added in API v1.40")
-	defer setupTest(t)()
-	var ops = []func(*daemon.Daemon){}
-	var datapathPort uint32 = 7777
-	ops = append(ops, daemon.WithSwarmDataPathPort(datapathPort))
-	d := swarm.NewSwarm(t, testEnv, ops...)
-
-	c := d.NewClientT(t)
-	defer c.Close()
-
-	// Create a overlay network
-	name := "saanvisthira" + t.Name()
-	network.CreateNoError(t, context.Background(), c, name,
-		network.WithDriver("overlay"))
-
-	var instances uint64 = 1
-	serviceID := swarm.CreateService(t, d,
-		swarm.ServiceWithReplicas(instances),
-		swarm.ServiceWithNetwork(name),
-	)
-
-	poll.WaitOn(t, serviceRunningCount(c, serviceID, instances), swarm.ServicePoll)
-
-	info := d.Info(t)
-	assert.Equal(t, info.Swarm.Cluster.DataPathPort, datapathPort)
-	err := c.ServiceRemove(context.Background(), serviceID)
-	assert.NilError(t, err)
-	d.SwarmLeave(true)
-	d.Stop(t)
-
-	// Clean up , set it back to original one to make sure other tests don't fail
-	// call without datapath port option.
-	ops = []func(*daemon.Daemon){}
-	d = swarm.NewSwarm(t, testEnv, ops...)
-	c = d.NewClientT(t)
-
-	// Create a overlay network
-	name = "saanvisthira" + t.Name()
-	network.CreateNoError(t, context.Background(), c, name,
-		network.WithDriver("overlay"))
-
-	serviceID = swarm.CreateService(t, d,
-		swarm.ServiceWithReplicas(instances),
-		swarm.ServiceWithNetwork(name),
-	)
-
-	poll.WaitOn(t, serviceRunningCount(c, serviceID, instances), swarm.ServicePoll)
-
-	info = d.Info(t)
-	var defaultDataPathPort uint32 = 4789
-	assert.Equal(t, info.Swarm.Cluster.DataPathPort, defaultDataPathPort)
-	err = c.ServiceRemove(context.Background(), serviceID)
-	assert.NilError(t, err)
-	d.SwarmLeave(true)
-	defer d.Stop(t)
-}
-
 func TestServiceWithDefaultAddressPoolInit(t *testing.T) {
 	skip.If(t, testEnv.OSType == "windows")
 	defer setupTest(t)()
diff --git a/vendor/github.com/docker/docker/integration/plugin/authz/authz_plugin_test.go b/vendor/github.com/docker/docker/integration/plugin/authz/authz_plugin_test.go
index 5408505ac..d0f5d8a78 100644
--- a/vendor/github.com/docker/docker/integration/plugin/authz/authz_plugin_test.go
+++ b/vendor/github.com/docker/docker/integration/plugin/authz/authz_plugin_test.go
@@ -26,7 +26,6 @@ import (
 	"github.com/docker/docker/pkg/archive"
 	"github.com/docker/docker/pkg/authorization"
 	"gotest.tools/assert"
-	"gotest.tools/poll"
 	"gotest.tools/skip"
 )
 
@@ -88,16 +87,18 @@ func TestAuthZPluginAllowRequest(t *testing.T) {
 	ctrl.resRes.Allow = true
 	d.StartWithBusybox(t, "--authorization-plugin="+testAuthZPlugin)
 
-	c := d.NewClientT(t)
+	client, err := d.NewClient()
+	assert.NilError(t, err)
+
 	ctx := context.Background()
 
 	// Ensure command successful
-	cID := container.Run(t, ctx, c)
+	cID := container.Run(t, ctx, client)
 
 	assertURIRecorded(t, ctrl.requestsURIs, "/containers/create")
 	assertURIRecorded(t, ctrl.requestsURIs, fmt.Sprintf("/containers/%s/start", cID))
 
-	_, err := c.ServerVersion(ctx)
+	_, err = client.ServerVersion(ctx)
 	assert.NilError(t, err)
 	assert.Equal(t, 1, ctrl.versionReqCount)
 	assert.Equal(t, 1, ctrl.versionResCount)
@@ -125,10 +126,10 @@ func TestAuthZPluginTLS(t *testing.T) {
 	ctrl.reqRes.Allow = true
 	ctrl.resRes.Allow = true
 
-	c, err := newTLSAPIClient(testDaemonHTTPSAddr, cacertPath, clientCertPath, clientKeyPath)
+	client, err := newTLSAPIClient(testDaemonHTTPSAddr, cacertPath, clientCertPath, clientKeyPath)
 	assert.NilError(t, err)
 
-	_, err = c.ServerVersion(context.Background())
+	_, err = client.ServerVersion(context.Background())
 	assert.NilError(t, err)
 
 	assert.Equal(t, "client", ctrl.reqUser)
@@ -142,7 +143,7 @@ func newTLSAPIClient(host, cacertPath, certPath, keyPath string) (client.APIClie
 	}
 	return client.NewClientWithOpts(
 		client.WithTLSClientConfig(cacertPath, certPath, keyPath),
-		client.WithDialContext(dialer.DialContext),
+		client.WithDialer(dialer),
 		client.WithHost(host))
 }
 
@@ -152,10 +153,11 @@ func TestAuthZPluginDenyRequest(t *testing.T) {
 	ctrl.reqRes.Allow = false
 	ctrl.reqRes.Msg = unauthorizedMessage
 
-	c := d.NewClientT(t)
+	client, err := d.NewClient()
+	assert.NilError(t, err)
 
 	// Ensure command is blocked
-	_, err := c.ServerVersion(context.Background())
+	_, err = client.ServerVersion(context.Background())
 	assert.Assert(t, err != nil)
 	assert.Equal(t, 1, ctrl.versionReqCount)
 	assert.Equal(t, 0, ctrl.versionResCount)
@@ -177,10 +179,10 @@ func TestAuthZPluginAPIDenyResponse(t *testing.T) {
 
 	conn, err := net.DialTimeout(daemonURL.Scheme, daemonURL.Path, time.Second*10)
 	assert.NilError(t, err)
-	c := httputil.NewClientConn(conn, nil)
+	client := httputil.NewClientConn(conn, nil)
 	req, err := http.NewRequest("GET", "/version", nil)
 	assert.NilError(t, err)
-	resp, err := c.Do(req)
+	resp, err := client.Do(req)
 
 	assert.NilError(t, err)
 	assert.DeepEqual(t, http.StatusForbidden, resp.StatusCode)
@@ -193,10 +195,11 @@ func TestAuthZPluginDenyResponse(t *testing.T) {
 	ctrl.resRes.Allow = false
 	ctrl.resRes.Msg = unauthorizedMessage
 
-	c := d.NewClientT(t)
+	client, err := d.NewClient()
+	assert.NilError(t, err)
 
 	// Ensure command is blocked
-	_, err := c.ServerVersion(context.Background())
+	_, err = client.ServerVersion(context.Background())
 	assert.Assert(t, err != nil)
 	assert.Equal(t, 1, ctrl.versionReqCount)
 	assert.Equal(t, 1, ctrl.versionResCount)
@@ -216,16 +219,29 @@ func TestAuthZPluginAllowEventStream(t *testing.T) {
 	ctrl.resRes.Allow = true
 	d.StartWithBusybox(t, "--authorization-plugin="+testAuthZPlugin)
 
-	c := d.NewClientT(t)
+	client, err := d.NewClient()
+	assert.NilError(t, err)
+
 	ctx := context.Background()
 
-	startTime := strconv.FormatInt(systemTime(t, c, testEnv).Unix(), 10)
-	events, errs, cancel := systemEventsSince(c, startTime)
+	startTime := strconv.FormatInt(systemTime(t, client, testEnv).Unix(), 10)
+	events, errs, cancel := systemEventsSince(client, startTime)
 	defer cancel()
 
 	// Create a container and wait for the creation events
-	cID := container.Run(t, ctx, c)
-	poll.WaitOn(t, container.IsInState(ctx, c, cID, "running"))
+	cID := container.Run(t, ctx, client)
+
+	for i := 0; i < 100; i++ {
+		c, err := client.ContainerInspect(ctx, cID)
+		assert.NilError(t, err)
+		if c.State.Running {
+			break
+		}
+		if i == 99 {
+			t.Fatal("Container didn't run within 10s")
+		}
+		time.Sleep(100 * time.Millisecond)
+	}
 
 	created := false
 	started := false
@@ -288,10 +304,11 @@ func TestAuthZPluginErrorResponse(t *testing.T) {
 	ctrl.reqRes.Allow = true
 	ctrl.resRes.Err = errorMessage
 
-	c := d.NewClientT(t)
+	client, err := d.NewClient()
+	assert.NilError(t, err)
 
 	// Ensure command is blocked
-	_, err := c.ServerVersion(context.Background())
+	_, err = client.ServerVersion(context.Background())
 	assert.Assert(t, err != nil)
 	assert.Equal(t, fmt.Sprintf("Error response from daemon: plugin %s failed with error: %s: %s", testAuthZPlugin, authorization.AuthZApiResponse, errorMessage), err.Error())
 }
@@ -301,10 +318,11 @@ func TestAuthZPluginErrorRequest(t *testing.T) {
 	d.Start(t, "--authorization-plugin="+testAuthZPlugin)
 	ctrl.reqRes.Err = errorMessage
 
-	c := d.NewClientT(t)
+	client, err := d.NewClient()
+	assert.NilError(t, err)
 
 	// Ensure command is blocked
-	_, err := c.ServerVersion(context.Background())
+	_, err = client.ServerVersion(context.Background())
 	assert.Assert(t, err != nil)
 	assert.Equal(t, fmt.Sprintf("Error response from daemon: plugin %s failed with error: %s: %s", testAuthZPlugin, authorization.AuthZApiRequest, errorMessage), err.Error())
 }
@@ -316,9 +334,10 @@ func TestAuthZPluginEnsureNoDuplicatePluginRegistration(t *testing.T) {
 	ctrl.reqRes.Allow = true
 	ctrl.resRes.Allow = true
 
-	c := d.NewClientT(t)
+	client, err := d.NewClient()
+	assert.NilError(t, err)
 
-	_, err := c.ServerVersion(context.Background())
+	_, err = client.ServerVersion(context.Background())
 	assert.NilError(t, err)
 
 	// assert plugin is only called once..
@@ -332,7 +351,9 @@ func TestAuthZPluginEnsureLoadImportWorking(t *testing.T) {
 	ctrl.resRes.Allow = true
 	d.StartWithBusybox(t, "--authorization-plugin="+testAuthZPlugin, "--authorization-plugin="+testAuthZPlugin)
 
-	c := d.NewClientT(t)
+	client, err := d.NewClient()
+	assert.NilError(t, err)
+
 	ctx := context.Background()
 
 	tmp, err := ioutil.TempDir("", "test-authz-load-import")
@@ -341,16 +362,16 @@ func TestAuthZPluginEnsureLoadImportWorking(t *testing.T) {
 
 	savedImagePath := filepath.Join(tmp, "save.tar")
 
-	err = imageSave(c, savedImagePath, "busybox")
+	err = imageSave(client, savedImagePath, "busybox")
 	assert.NilError(t, err)
-	err = imageLoad(c, savedImagePath)
+	err = imageLoad(client, savedImagePath)
 	assert.NilError(t, err)
 
 	exportedImagePath := filepath.Join(tmp, "export.tar")
 
-	cID := container.Run(t, ctx, c)
+	cID := container.Run(t, ctx, client)
 
-	responseReader, err := c.ContainerExport(context.Background(), cID)
+	responseReader, err := client.ContainerExport(context.Background(), cID)
 	assert.NilError(t, err)
 	defer responseReader.Close()
 	file, err := os.Create(exportedImagePath)
@@ -359,7 +380,7 @@ func TestAuthZPluginEnsureLoadImportWorking(t *testing.T) {
 	_, err = io.Copy(file, responseReader)
 	assert.NilError(t, err)
 
-	err = imageImport(c, exportedImagePath)
+	err = imageImport(client, exportedImagePath)
 	assert.NilError(t, err)
 }
 
@@ -385,11 +406,12 @@ func TestAuthzPluginEnsureContainerCopyToFrom(t *testing.T) {
 		written += n
 	}
 
-	c := d.NewClientT(t)
 	ctx := context.Background()
+	client, err := d.NewClient()
+	assert.Assert(t, err)
 
-	cID := container.Run(t, ctx, c)
-	defer c.ContainerRemove(ctx, cID, types.ContainerRemoveOptions{Force: true})
+	cID := container.Run(t, ctx, client)
+	defer client.ContainerRemove(ctx, cID, types.ContainerRemoveOptions{Force: true})
 
 	_, err = f.Seek(0, io.SeekStart)
 	assert.Assert(t, err)
@@ -403,10 +425,10 @@ func TestAuthzPluginEnsureContainerCopyToFrom(t *testing.T) {
 	dstDir, preparedArchive, err := archive.PrepareArchiveCopy(srcArchive, srcInfo, archive.CopyInfo{Path: "/test"})
 	assert.Assert(t, err)
 
-	err = c.CopyToContainer(ctx, cID, dstDir, preparedArchive, types.CopyToContainerOptions{})
+	err = client.CopyToContainer(ctx, cID, dstDir, preparedArchive, types.CopyToContainerOptions{})
 	assert.Assert(t, err)
 
-	rdr, _, err := c.CopyFromContainer(ctx, cID, "/test")
+	rdr, _, err := client.CopyFromContainer(ctx, cID, "/test")
 	assert.Assert(t, err)
 	_, err = io.Copy(ioutil.Discard, rdr)
 	assert.Assert(t, err)
diff --git a/vendor/github.com/docker/docker/integration/plugin/authz/authz_plugin_v2_test.go b/vendor/github.com/docker/docker/integration/plugin/authz/authz_plugin_v2_test.go
index 6b44108ec..6b5115146 100644
--- a/vendor/github.com/docker/docker/integration/plugin/authz/authz_plugin_v2_test.go
+++ b/vendor/github.com/docker/docker/integration/plugin/authz/authz_plugin_v2_test.go
@@ -43,11 +43,13 @@ func TestAuthZPluginV2AllowNonVolumeRequest(t *testing.T) {
 	skip.If(t, os.Getenv("DOCKER_ENGINE_GOARCH") != "amd64")
 	defer setupTestV2(t)()
 
-	c := d.NewClientT(t)
+	client, err := d.NewClient()
+	assert.NilError(t, err)
+
 	ctx := context.Background()
 
 	// Install authz plugin
-	err := pluginInstallGrantAllPermissions(c, authzPluginNameWithTag)
+	err = pluginInstallGrantAllPermissions(client, authzPluginNameWithTag)
 	assert.NilError(t, err)
 	// start the daemon with the plugin and load busybox, --net=none build fails otherwise
 	// because it needs to pull busybox
@@ -55,9 +57,9 @@ func TestAuthZPluginV2AllowNonVolumeRequest(t *testing.T) {
 	d.LoadBusybox(t)
 
 	// Ensure docker run command and accompanying docker ps are successful
-	cID := container.Run(t, ctx, c)
+	cID := container.Run(t, ctx, client)
 
-	_, err = c.ContainerInspect(ctx, cID)
+	_, err = client.ContainerInspect(ctx, cID)
 	assert.NilError(t, err)
 }
 
@@ -65,25 +67,26 @@ func TestAuthZPluginV2Disable(t *testing.T) {
 	skip.If(t, os.Getenv("DOCKER_ENGINE_GOARCH") != "amd64")
 	defer setupTestV2(t)()
 
-	c := d.NewClientT(t)
+	client, err := d.NewClient()
+	assert.NilError(t, err)
 
 	// Install authz plugin
-	err := pluginInstallGrantAllPermissions(c, authzPluginNameWithTag)
+	err = pluginInstallGrantAllPermissions(client, authzPluginNameWithTag)
 	assert.NilError(t, err)
 
 	d.Restart(t, "--authorization-plugin="+authzPluginNameWithTag)
 	d.LoadBusybox(t)
 
-	_, err = c.VolumeCreate(context.Background(), volumetypes.VolumeCreateBody{Driver: "local"})
+	_, err = client.VolumeCreate(context.Background(), volumetypes.VolumeCreateBody{Driver: "local"})
 	assert.Assert(t, err != nil)
 	assert.Assert(t, strings.Contains(err.Error(), fmt.Sprintf("Error response from daemon: plugin %s failed with error:", authzPluginNameWithTag)))
 
 	// disable the plugin
-	err = c.PluginDisable(context.Background(), authzPluginNameWithTag, types.PluginDisableOptions{})
+	err = client.PluginDisable(context.Background(), authzPluginNameWithTag, types.PluginDisableOptions{})
 	assert.NilError(t, err)
 
 	// now test to see if the docker api works.
-	_, err = c.VolumeCreate(context.Background(), volumetypes.VolumeCreateBody{Driver: "local"})
+	_, err = client.VolumeCreate(context.Background(), volumetypes.VolumeCreateBody{Driver: "local"})
 	assert.NilError(t, err)
 }
 
@@ -91,33 +94,34 @@ func TestAuthZPluginV2RejectVolumeRequests(t *testing.T) {
 	skip.If(t, os.Getenv("DOCKER_ENGINE_GOARCH") != "amd64")
 	defer setupTestV2(t)()
 
-	c := d.NewClientT(t)
+	client, err := d.NewClient()
+	assert.NilError(t, err)
 
 	// Install authz plugin
-	err := pluginInstallGrantAllPermissions(c, authzPluginNameWithTag)
+	err = pluginInstallGrantAllPermissions(client, authzPluginNameWithTag)
 	assert.NilError(t, err)
 
 	// restart the daemon with the plugin
 	d.Restart(t, "--authorization-plugin="+authzPluginNameWithTag)
 
-	_, err = c.VolumeCreate(context.Background(), volumetypes.VolumeCreateBody{Driver: "local"})
+	_, err = client.VolumeCreate(context.Background(), volumetypes.VolumeCreateBody{Driver: "local"})
 	assert.Assert(t, err != nil)
 	assert.Assert(t, strings.Contains(err.Error(), fmt.Sprintf("Error response from daemon: plugin %s failed with error:", authzPluginNameWithTag)))
 
-	_, err = c.VolumeList(context.Background(), filters.Args{})
+	_, err = client.VolumeList(context.Background(), filters.Args{})
 	assert.Assert(t, err != nil)
 	assert.Assert(t, strings.Contains(err.Error(), fmt.Sprintf("Error response from daemon: plugin %s failed with error:", authzPluginNameWithTag)))
 
 	// The plugin will block the command before it can determine the volume does not exist
-	err = c.VolumeRemove(context.Background(), "test", false)
+	err = client.VolumeRemove(context.Background(), "test", false)
 	assert.Assert(t, err != nil)
 	assert.Assert(t, strings.Contains(err.Error(), fmt.Sprintf("Error response from daemon: plugin %s failed with error:", authzPluginNameWithTag)))
 
-	_, err = c.VolumeInspect(context.Background(), "test")
+	_, err = client.VolumeInspect(context.Background(), "test")
 	assert.Assert(t, err != nil)
 	assert.Assert(t, strings.Contains(err.Error(), fmt.Sprintf("Error response from daemon: plugin %s failed with error:", authzPluginNameWithTag)))
 
-	_, err = c.VolumesPrune(context.Background(), filters.Args{})
+	_, err = client.VolumesPrune(context.Background(), filters.Args{})
 	assert.Assert(t, err != nil)
 	assert.Assert(t, strings.Contains(err.Error(), fmt.Sprintf("Error response from daemon: plugin %s failed with error:", authzPluginNameWithTag)))
 }
@@ -126,10 +130,11 @@ func TestAuthZPluginV2BadManifestFailsDaemonStart(t *testing.T) {
 	skip.If(t, os.Getenv("DOCKER_ENGINE_GOARCH") != "amd64")
 	defer setupTestV2(t)()
 
-	c := d.NewClientT(t)
+	client, err := d.NewClient()
+	assert.NilError(t, err)
 
 	// Install authz plugin with bad manifest
-	err := pluginInstallGrantAllPermissions(c, authzPluginBadManifestName)
+	err = pluginInstallGrantAllPermissions(client, authzPluginBadManifestName)
 	assert.NilError(t, err)
 
 	// start the daemon with the plugin, it will error
diff --git a/vendor/github.com/docker/docker/integration/plugin/logging/helpers_test.go b/vendor/github.com/docker/docker/integration/plugin/logging/helpers_test.go
index 128bf7d73..dbdd36b90 100644
--- a/vendor/github.com/docker/docker/integration/plugin/logging/helpers_test.go
+++ b/vendor/github.com/docker/docker/integration/plugin/logging/helpers_test.go
@@ -31,7 +31,7 @@ func ensurePlugin(t *testing.T, name string) string {
 	}
 
 	cmd := exec.Command(goBin, "build", "-o", installPath, "./"+filepath.Join("cmd", name))
-	cmd.Env = append(os.Environ(), "CGO_ENABLED=0")
+	cmd.Env = append(cmd.Env, "CGO_ENABLED=0")
 	if out, err := cmd.CombinedOutput(); err != nil {
 		t.Fatal(errors.Wrapf(err, "error building basic plugin bin: %s", string(out)))
 	}
diff --git a/vendor/github.com/docker/docker/integration/plugin/logging/logging_linux_test.go b/vendor/github.com/docker/docker/integration/plugin/logging/logging_linux_test.go
index eadc52450..3921fa6e6 100644
--- a/vendor/github.com/docker/docker/integration/plugin/logging/logging_linux_test.go
+++ b/vendor/github.com/docker/docker/integration/plugin/logging/logging_linux_test.go
@@ -16,7 +16,7 @@ import (
 )
 
 func TestContinueAfterPluginCrash(t *testing.T) {
-	skip.If(t, testEnv.IsRemoteDaemon, "test requires daemon on the same host")
+	skip.If(t, testEnv.IsRemoteDaemon(), "test requires daemon on the same host")
 	t.Parallel()
 
 	d := daemon.New(t)
diff --git a/vendor/github.com/docker/docker/integration/plugin/logging/validation_test.go b/vendor/github.com/docker/docker/integration/plugin/logging/validation_test.go
index dfa50132d..200eb9875 100644
--- a/vendor/github.com/docker/docker/integration/plugin/logging/validation_test.go
+++ b/vendor/github.com/docker/docker/integration/plugin/logging/validation_test.go
@@ -24,13 +24,14 @@ func TestDaemonStartWithLogOpt(t *testing.T) {
 	d.Start(t, "--iptables=false")
 	defer d.Stop(t)
 
-	c := d.NewClientT(t)
+	client, err := d.NewClient()
+	assert.Check(t, err)
 	ctx := context.Background()
 
-	createPlugin(t, c, "test", "dummy", asLogDriver)
-	err := c.PluginEnable(ctx, "test", types.PluginEnableOptions{Timeout: 30})
+	createPlugin(t, client, "test", "dummy", asLogDriver)
+	err = client.PluginEnable(ctx, "test", types.PluginEnableOptions{Timeout: 30})
 	assert.Check(t, err)
-	defer c.PluginRemove(ctx, "test", types.PluginRemoveOptions{Force: true})
+	defer client.PluginRemove(ctx, "test", types.PluginRemoveOptions{Force: true})
 
 	d.Stop(t)
 	d.Start(t, "--iptables=false", "--log-driver=test", "--log-opt=foo=bar")
diff --git a/vendor/github.com/docker/docker/integration/plugin/volumes/helpers_test.go b/vendor/github.com/docker/docker/integration/plugin/volumes/helpers_test.go
index 53e671b50..36aafd59c 100644
--- a/vendor/github.com/docker/docker/integration/plugin/volumes/helpers_test.go
+++ b/vendor/github.com/docker/docker/integration/plugin/volumes/helpers_test.go
@@ -37,7 +37,7 @@ func ensurePlugin(t *testing.T, name string) string {
 	}
 
 	cmd := exec.Command(goBin, "build", "-o", installPath, "./"+filepath.Join("cmd", name))
-	cmd.Env = append(os.Environ(), "CGO_ENABLED=0")
+	cmd.Env = append(cmd.Env, "CGO_ENABLED=0")
 	if out, err := cmd.CombinedOutput(); err != nil {
 		t.Fatal(errors.Wrapf(err, "error building basic plugin bin: %s", string(out)))
 	}
diff --git a/vendor/github.com/docker/docker/integration/plugin/volumes/mounts_test.go b/vendor/github.com/docker/docker/integration/plugin/volumes/mounts_test.go
index e648ef6f1..fb4b492c3 100644
--- a/vendor/github.com/docker/docker/integration/plugin/volumes/mounts_test.go
+++ b/vendor/github.com/docker/docker/integration/plugin/volumes/mounts_test.go
@@ -24,14 +24,15 @@ func TestPluginWithDevMounts(t *testing.T) {
 	d.Start(t, "--iptables=false")
 	defer d.Stop(t)
 
-	c := d.NewClientT(t)
+	client, err := d.NewClient()
+	assert.Assert(t, err)
 	ctx := context.Background()
 
 	testDir, err := ioutil.TempDir("", "test-dir")
 	assert.Assert(t, err)
 	defer os.RemoveAll(testDir)
 
-	createPlugin(t, c, "test", "dummy", asVolumeDriver, func(c *plugin.Config) {
+	createPlugin(t, client, "test", "dummy", asVolumeDriver, func(c *plugin.Config) {
 		root := "/"
 		dev := "/dev"
 		mounts := []types.PluginMount{
@@ -45,14 +46,14 @@ func TestPluginWithDevMounts(t *testing.T) {
 		c.IpcHost = true
 	})
 
-	err = c.PluginEnable(ctx, "test", types.PluginEnableOptions{Timeout: 30})
+	err = client.PluginEnable(ctx, "test", types.PluginEnableOptions{Timeout: 30})
 	assert.Assert(t, err)
 	defer func() {
-		err := c.PluginRemove(ctx, "test", types.PluginRemoveOptions{Force: true})
+		err := client.PluginRemove(ctx, "test", types.PluginRemoveOptions{Force: true})
 		assert.Check(t, err)
 	}()
 
-	p, _, err := c.PluginInspectWithRaw(ctx, "test")
+	p, _, err := client.PluginInspectWithRaw(ctx, "test")
 	assert.Assert(t, err)
 	assert.Assert(t, p.Enabled)
 }
diff --git a/vendor/github.com/docker/docker/integration/secret/secret_test.go b/vendor/github.com/docker/docker/integration/secret/secret_test.go
index af3a75b9c..e0327b023 100644
--- a/vendor/github.com/docker/docker/integration/secret/secret_test.go
+++ b/vendor/github.com/docker/docker/integration/secret/secret_test.go
@@ -62,10 +62,19 @@ func TestSecretList(t *testing.T) {
 	// create secret test1
 	secret1ID := createSecret(ctx, t, client, testName1, []byte("TESTINGDATA1"), map[string]string{"type": "production"})
 
+	names := func(entries []swarmtypes.Secret) []string {
+		var values []string
+		for _, entry := range entries {
+			values = append(values, entry.Spec.Name)
+		}
+		sort.Strings(values)
+		return values
+	}
+
 	// test by `secret ls`
 	entries, err := client.SecretList(ctx, types.SecretListOptions{})
 	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(secretNamesFromList(entries), testNames))
+	assert.Check(t, is.DeepEqual(names(entries), testNames))
 
 	testCases := []struct {
 		filters  filters.Args
@@ -100,7 +109,7 @@ func TestSecretList(t *testing.T) {
 			Filters: tc.filters,
 		})
 		assert.NilError(t, err)
-		assert.Check(t, is.DeepEqual(secretNamesFromList(entries), tc.expected))
+		assert.Check(t, is.DeepEqual(names(entries), tc.expected))
 
 	}
 }
@@ -303,7 +312,7 @@ func TestTemplatedSecret(t *testing.T) {
 
 	var tasks []swarmtypes.Task
 	waitAndAssert(t, 60*time.Second, func(t *testing.T) bool {
-		tasks = swarm.GetRunningTasks(t, client, serviceID)
+		tasks = swarm.GetRunningTasks(t, d, serviceID)
 		return len(tasks) > 0
 	})
 
@@ -334,56 +343,6 @@ func TestTemplatedSecret(t *testing.T) {
 	assertAttachedStream(t, attach, "tmpfs on /run/secrets/templated_secret type tmpfs")
 }
 
-// Test case for 28884
-func TestSecretCreateResolve(t *testing.T) {
-	skip.If(t, testEnv.DaemonInfo.OSType != "linux")
-
-	defer setupTest(t)()
-	d := swarm.NewSwarm(t, testEnv)
-	defer d.Stop(t)
-	client := d.NewClientT(t)
-	defer client.Close()
-
-	ctx := context.Background()
-
-	testName := "test_secret_" + t.Name()
-	secretID := createSecret(ctx, t, client, testName, []byte("foo"), nil)
-
-	fakeName := secretID
-	fakeID := createSecret(ctx, t, client, fakeName, []byte("fake foo"), nil)
-
-	entries, err := client.SecretList(ctx, types.SecretListOptions{})
-	assert.NilError(t, err)
-	assert.Check(t, is.Contains(secretNamesFromList(entries), testName))
-	assert.Check(t, is.Contains(secretNamesFromList(entries), fakeName))
-
-	err = client.SecretRemove(ctx, secretID)
-	assert.NilError(t, err)
-
-	// Fake one will remain
-	entries, err = client.SecretList(ctx, types.SecretListOptions{})
-	assert.NilError(t, err)
-	assert.Assert(t, is.DeepEqual(secretNamesFromList(entries), []string{fakeName}))
-
-	// Remove based on name prefix of the fake one should not work
-	// as search is only done based on:
-	// - Full ID
-	// - Full Name
-	// - Partial ID (prefix)
-	err = client.SecretRemove(ctx, fakeName[:5])
-	assert.Assert(t, nil != err)
-	entries, err = client.SecretList(ctx, types.SecretListOptions{})
-	assert.NilError(t, err)
-	assert.Assert(t, is.DeepEqual(secretNamesFromList(entries), []string{fakeName}))
-
-	// Remove based on ID prefix of the fake one should succeed
-	err = client.SecretRemove(ctx, fakeID[:5])
-	assert.NilError(t, err)
-	entries, err = client.SecretList(ctx, types.SecretListOptions{})
-	assert.NilError(t, err)
-	assert.Assert(t, is.Equal(0, len(entries)))
-}
-
 func assertAttachedStream(t *testing.T, attach types.HijackedResponse, expect string) {
 	buf := bytes.NewBuffer(nil)
 	_, err := stdcopy.StdCopy(buf, buf, attach.Reader)
@@ -406,12 +365,3 @@ func waitAndAssert(t *testing.T, timeout time.Duration, f func(*testing.T) bool)
 		time.Sleep(100 * time.Millisecond)
 	}
 }
-
-func secretNamesFromList(entries []swarmtypes.Secret) []string {
-	var values []string
-	for _, entry := range entries {
-		values = append(values, entry.Spec.Name)
-	}
-	sort.Strings(values)
-	return values
-}
diff --git a/vendor/github.com/docker/docker/integration/service/create_test.go b/vendor/github.com/docker/docker/integration/service/create_test.go
index 870353718..1d15be176 100644
--- a/vendor/github.com/docker/docker/integration/service/create_test.go
+++ b/vendor/github.com/docker/docker/integration/service/create_test.go
@@ -4,19 +4,16 @@ import (
 	"context"
 	"fmt"
 	"io/ioutil"
-	"net/http"
 	"testing"
 	"time"
 
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/filters"
 	swarmtypes "github.com/docker/docker/api/types/swarm"
-	"github.com/docker/docker/api/types/versions"
 	"github.com/docker/docker/client"
 	"github.com/docker/docker/integration/internal/network"
 	"github.com/docker/docker/integration/internal/swarm"
 	"github.com/docker/docker/internal/test/daemon"
-	"github.com/docker/docker/internal/test/request"
 	"gotest.tools/assert"
 	is "gotest.tools/assert/cmp"
 	"gotest.tools/poll"
@@ -122,55 +119,7 @@ func TestCreateServiceMultipleTimes(t *testing.T) {
 	err = client.NetworkRemove(context.Background(), overlayID)
 	assert.NilError(t, err)
 
-	poll.WaitOn(t, network.IsRemoved(context.Background(), client, overlayID), poll.WithTimeout(1*time.Minute), poll.WithDelay(10*time.Second))
-}
-
-func TestCreateServiceConflict(t *testing.T) {
-	skip.If(t, testEnv.DaemonInfo.OSType == "windows")
-	defer setupTest(t)()
-	d := swarm.NewSwarm(t, testEnv)
-	defer d.Stop(t)
-
-	serviceName := "TestService_" + t.Name()
-	serviceSpec := []swarm.ServiceSpecOpt{
-		swarm.ServiceWithName(serviceName),
-	}
-
-	swarm.CreateService(t, d, serviceSpec...)
-
-	spec := swarm.CreateServiceSpec(t, serviceSpec...)
-	res, body, err := request.Post(
-		"/services/create",
-		request.Host(d.Sock()),
-		request.JSONBody(spec),
-		request.JSON,
-	)
-	assert.NilError(t, err)
-	assert.Equal(t, res.StatusCode, http.StatusConflict)
-
-	buf, err := request.ReadBody(body)
-	assert.NilError(t, err)
-	assert.Check(t, is.Contains(string(buf), "service "+serviceName+" already exists"))
-}
-
-func TestCreateServiceMaxReplicas(t *testing.T) {
-	defer setupTest(t)()
-	d := swarm.NewSwarm(t, testEnv)
-	defer d.Stop(t)
-	client := d.NewClientT(t)
-	defer client.Close()
-
-	var maxReplicas uint64 = 2
-	serviceSpec := []swarm.ServiceSpecOpt{
-		swarm.ServiceWithReplicas(maxReplicas),
-		swarm.ServiceWithMaxReplicas(maxReplicas),
-	}
-
-	serviceID := swarm.CreateService(t, d, serviceSpec...)
-	poll.WaitOn(t, serviceRunningTasksCount(client, serviceID, maxReplicas), swarm.ServicePoll)
-
-	_, _, err := client.ServiceInspectWithRaw(context.Background(), serviceID, types.ServiceInspectOptions{})
-	assert.NilError(t, err)
+	poll.WaitOn(t, networkIsRemoved(client, overlayID), poll.WithTimeout(1*time.Minute), poll.WithDelay(10*time.Second))
 }
 
 func TestCreateWithDuplicateNetworkNames(t *testing.T) {
@@ -189,7 +138,7 @@ func TestCreateWithDuplicateNetworkNames(t *testing.T) {
 		network.WithDriver("bridge"),
 	)
 
-	// Duplicates with name but with different driver
+	// Dupliates with name but with different driver
 	n3 := network.CreateNoError(t, context.Background(), client, name,
 		network.WithDriver("overlay"),
 	)
@@ -228,9 +177,9 @@ func TestCreateWithDuplicateNetworkNames(t *testing.T) {
 	assert.NilError(t, err)
 
 	// Make sure networks have been destroyed.
-	poll.WaitOn(t, network.IsRemoved(context.Background(), client, n3), poll.WithTimeout(1*time.Minute), poll.WithDelay(10*time.Second))
-	poll.WaitOn(t, network.IsRemoved(context.Background(), client, n2), poll.WithTimeout(1*time.Minute), poll.WithDelay(10*time.Second))
-	poll.WaitOn(t, network.IsRemoved(context.Background(), client, n1), poll.WithTimeout(1*time.Minute), poll.WithDelay(10*time.Second))
+	poll.WaitOn(t, networkIsRemoved(client, n3), poll.WithTimeout(1*time.Minute), poll.WithDelay(10*time.Second))
+	poll.WaitOn(t, networkIsRemoved(client, n2), poll.WithTimeout(1*time.Minute), poll.WithDelay(10*time.Second))
+	poll.WaitOn(t, networkIsRemoved(client, n1), poll.WithTimeout(1*time.Minute), poll.WithDelay(10*time.Second))
 }
 
 func TestCreateServiceSecretFileMode(t *testing.T) {
@@ -365,101 +314,6 @@ func TestCreateServiceConfigFileMode(t *testing.T) {
 	assert.NilError(t, err)
 }
 
-// TestServiceCreateSysctls tests that a service created with sysctl options in
-// the ContainerSpec correctly applies those options.
-//
-// To test this, we're going to create a service with the sysctl option
-//
-//   {"net.ipv4.ip_nonlocal_bind": "0"}
-//
-// We'll get the service's tasks to get the container ID, and then we'll
-// inspect the container. If the output of the container inspect contains the
-// sysctl option with the correct value, we can assume that the sysctl has been
-// plumbed correctly.
-//
-// Next, we'll remove that service and create a new service with that option
-// set to 1. This means that no matter what the default is, we can be confident
-// that the sysctl option is applying as intended.
-//
-// Additionally, we'll do service and task inspects to verify that the inspect
-// output includes the desired sysctl option.
-//
-// We're using net.ipv4.ip_nonlocal_bind because it's something that I'm fairly
-// confident won't be modified by the container runtime, and won't blow
-// anything up in the test environment
-func TestCreateServiceSysctls(t *testing.T) {
-	skip.If(
-		t, versions.LessThan(testEnv.DaemonAPIVersion(), "1.40"),
-		"setting service sysctls is unsupported before api v1.40",
-	)
-
-	defer setupTest(t)()
-	d := swarm.NewSwarm(t, testEnv)
-	defer d.Stop(t)
-	client := d.NewClientT(t)
-	defer client.Close()
-
-	ctx := context.Background()
-
-	// run thie block twice, so that no matter what the default value of
-	// net.ipv4.ip_nonlocal_bind is, we can verify that setting the sysctl
-	// options works
-	for _, expected := range []string{"0", "1"} {
-
-		// store the map we're going to be using everywhere.
-		expectedSysctls := map[string]string{"net.ipv4.ip_nonlocal_bind": expected}
-
-		// Create the service with the sysctl options
-		var instances uint64 = 1
-		serviceID := swarm.CreateService(t, d,
-			swarm.ServiceWithSysctls(expectedSysctls),
-		)
-
-		// wait for the service to converge to 1 running task as expected
-		poll.WaitOn(t, serviceRunningTasksCount(client, serviceID, instances))
-
-		// we're going to check 3 things:
-		//
-		//   1. Does the container, when inspected, have the sysctl option set?
-		//   2. Does the task have the sysctl in the spec?
-		//   3. Does the service have the sysctl in the spec?
-		//
-		// if all 3 of these things are true, we know that the sysctl has been
-		// plumbed correctly through the engine.
-		//
-		// We don't actually have to get inside the container and check its
-		// logs or anything. If we see the sysctl set on the container inspect,
-		// we know that the sysctl is plumbed correctly. everything below that
-		// level has been tested elsewhere. (thanks @thaJeztah, because an
-		// earlier version of this test had to get container logs and was much
-		// more complex)
-
-		// get all of the tasks of the service, so we can get the container
-		filter := filters.NewArgs()
-		filter.Add("service", serviceID)
-		tasks, err := client.TaskList(ctx, types.TaskListOptions{
-			Filters: filter,
-		})
-		assert.NilError(t, err)
-		assert.Check(t, is.Equal(len(tasks), 1))
-
-		// verify that the container has the sysctl option set
-		ctnr, err := client.ContainerInspect(ctx, tasks[0].Status.ContainerStatus.ContainerID)
-		assert.NilError(t, err)
-		assert.DeepEqual(t, ctnr.HostConfig.Sysctls, expectedSysctls)
-
-		// verify that the task has the sysctl option set in the task object
-		assert.DeepEqual(t, tasks[0].Spec.ContainerSpec.Sysctls, expectedSysctls)
-
-		// verify that the service also has the sysctl set in the spec.
-		service, _, err := client.ServiceInspectWithRaw(ctx, serviceID, types.ServiceInspectOptions{})
-		assert.NilError(t, err)
-		assert.DeepEqual(t,
-			service.Spec.TaskTemplate.ContainerSpec.Sysctls, expectedSysctls,
-		)
-	}
-}
-
 func serviceRunningTasksCount(client client.ServiceAPIClient, serviceID string, instances uint64) func(log poll.LogT) poll.Result {
 	return func(log poll.LogT) poll.Result {
 		filter := filters.NewArgs()
@@ -513,3 +367,13 @@ func serviceIsRemoved(client client.ServiceAPIClient, serviceID string) func(log
 		return poll.Success()
 	}
 }
+
+func networkIsRemoved(client client.NetworkAPIClient, networkID string) func(log poll.LogT) poll.Result {
+	return func(log poll.LogT) poll.Result {
+		_, err := client.NetworkInspect(context.Background(), networkID, types.NetworkInspectOptions{})
+		if err == nil {
+			return poll.Continue("waiting for network %s to be removed", networkID)
+		}
+		return poll.Success()
+	}
+}
diff --git a/vendor/github.com/docker/docker/integration/service/inspect_test.go b/vendor/github.com/docker/docker/integration/service/inspect_test.go
index c79751f93..33e90938b 100644
--- a/vendor/github.com/docker/docker/integration/service/inspect_test.go
+++ b/vendor/github.com/docker/docker/integration/service/inspect_test.go
@@ -19,7 +19,7 @@ import (
 )
 
 func TestInspect(t *testing.T) {
-	skip.If(t, testEnv.IsRemoteDaemon)
+	skip.If(t, testEnv.IsRemoteDaemon())
 	skip.If(t, testEnv.DaemonInfo.OSType == "windows")
 	defer setupTest(t)()
 	d := swarm.NewSwarm(t, testEnv)
diff --git a/vendor/github.com/docker/docker/integration/service/update_test.go b/vendor/github.com/docker/docker/integration/service/update_test.go
deleted file mode 100644
index 4c1b94f8c..000000000
--- a/vendor/github.com/docker/docker/integration/service/update_test.go
+++ /dev/null
@@ -1,233 +0,0 @@
-package service // import "github.com/docker/docker/integration/service"
-
-import (
-	"context"
-	"testing"
-
-	"github.com/docker/docker/api/types"
-	swarmtypes "github.com/docker/docker/api/types/swarm"
-	"github.com/docker/docker/client"
-	"github.com/docker/docker/integration/internal/swarm"
-	"gotest.tools/assert"
-	is "gotest.tools/assert/cmp"
-	"gotest.tools/poll"
-	"gotest.tools/skip"
-)
-
-func TestServiceUpdateLabel(t *testing.T) {
-	skip.If(t, testEnv.DaemonInfo.OSType != "linux")
-	defer setupTest(t)()
-	d := swarm.NewSwarm(t, testEnv)
-	defer d.Stop(t)
-	cli := d.NewClientT(t)
-	defer cli.Close()
-
-	ctx := context.Background()
-	serviceName := "TestService_" + t.Name()
-	serviceID := swarm.CreateService(t, d, swarm.ServiceWithName(serviceName))
-	service := getService(t, cli, serviceID)
-	assert.Check(t, is.DeepEqual(service.Spec.Labels, map[string]string{}))
-
-	// add label to empty set
-	service.Spec.Labels["foo"] = "bar"
-	_, err := cli.ServiceUpdate(ctx, serviceID, service.Version, service.Spec, types.ServiceUpdateOptions{})
-	assert.NilError(t, err)
-	poll.WaitOn(t, serviceSpecIsUpdated(cli, serviceID, service.Version.Index), swarm.ServicePoll)
-	service = getService(t, cli, serviceID)
-	assert.Check(t, is.DeepEqual(service.Spec.Labels, map[string]string{"foo": "bar"}))
-
-	// add label to non-empty set
-	service.Spec.Labels["foo2"] = "bar"
-	_, err = cli.ServiceUpdate(ctx, serviceID, service.Version, service.Spec, types.ServiceUpdateOptions{})
-	assert.NilError(t, err)
-	poll.WaitOn(t, serviceSpecIsUpdated(cli, serviceID, service.Version.Index), swarm.ServicePoll)
-	service = getService(t, cli, serviceID)
-	assert.Check(t, is.DeepEqual(service.Spec.Labels, map[string]string{"foo": "bar", "foo2": "bar"}))
-
-	delete(service.Spec.Labels, "foo2")
-	_, err = cli.ServiceUpdate(ctx, serviceID, service.Version, service.Spec, types.ServiceUpdateOptions{})
-	assert.NilError(t, err)
-	poll.WaitOn(t, serviceSpecIsUpdated(cli, serviceID, service.Version.Index), swarm.ServicePoll)
-	service = getService(t, cli, serviceID)
-	assert.Check(t, is.DeepEqual(service.Spec.Labels, map[string]string{"foo": "bar"}))
-
-	delete(service.Spec.Labels, "foo")
-	_, err = cli.ServiceUpdate(ctx, serviceID, service.Version, service.Spec, types.ServiceUpdateOptions{})
-	assert.NilError(t, err)
-	poll.WaitOn(t, serviceSpecIsUpdated(cli, serviceID, service.Version.Index), swarm.ServicePoll)
-	service = getService(t, cli, serviceID)
-	assert.Check(t, is.DeepEqual(service.Spec.Labels, map[string]string{}))
-
-	// now make sure we can add again
-	service.Spec.Labels["foo"] = "bar"
-	_, err = cli.ServiceUpdate(ctx, serviceID, service.Version, service.Spec, types.ServiceUpdateOptions{})
-	assert.NilError(t, err)
-	poll.WaitOn(t, serviceSpecIsUpdated(cli, serviceID, service.Version.Index), swarm.ServicePoll)
-	service = getService(t, cli, serviceID)
-	assert.Check(t, is.DeepEqual(service.Spec.Labels, map[string]string{"foo": "bar"}))
-
-	err = cli.ServiceRemove(context.Background(), serviceID)
-	assert.NilError(t, err)
-}
-
-func TestServiceUpdateSecrets(t *testing.T) {
-	skip.If(t, testEnv.DaemonInfo.OSType != "linux")
-	defer setupTest(t)()
-	d := swarm.NewSwarm(t, testEnv)
-	defer d.Stop(t)
-	cli := d.NewClientT(t)
-	defer cli.Close()
-
-	ctx := context.Background()
-	secretName := "TestSecret_" + t.Name()
-	secretTarget := "targetName"
-	resp, err := cli.SecretCreate(ctx, swarmtypes.SecretSpec{
-		Annotations: swarmtypes.Annotations{
-			Name: secretName,
-		},
-		Data: []byte("TESTINGDATA"),
-	})
-	assert.NilError(t, err)
-	assert.Check(t, resp.ID != "")
-
-	serviceName := "TestService_" + t.Name()
-	serviceID := swarm.CreateService(t, d, swarm.ServiceWithName(serviceName))
-	service := getService(t, cli, serviceID)
-
-	// add secret
-	service.Spec.TaskTemplate.ContainerSpec.Secrets = append(service.Spec.TaskTemplate.ContainerSpec.Secrets,
-		&swarmtypes.SecretReference{
-			File: &swarmtypes.SecretReferenceFileTarget{
-				Name: secretTarget,
-				UID:  "0",
-				GID:  "0",
-				Mode: 0600,
-			},
-			SecretID:   resp.ID,
-			SecretName: secretName,
-		},
-	)
-	_, err = cli.ServiceUpdate(ctx, serviceID, service.Version, service.Spec, types.ServiceUpdateOptions{})
-	assert.NilError(t, err)
-	poll.WaitOn(t, serviceIsUpdated(cli, serviceID), swarm.ServicePoll)
-
-	service = getService(t, cli, serviceID)
-	secrets := service.Spec.TaskTemplate.ContainerSpec.Secrets
-	assert.Assert(t, is.Equal(1, len(secrets)))
-
-	secret := *secrets[0]
-	assert.Check(t, is.Equal(secretName, secret.SecretName))
-	assert.Check(t, nil != secret.File)
-	assert.Check(t, is.Equal(secretTarget, secret.File.Name))
-
-	// remove
-	service.Spec.TaskTemplate.ContainerSpec.Secrets = []*swarmtypes.SecretReference{}
-	_, err = cli.ServiceUpdate(ctx, serviceID, service.Version, service.Spec, types.ServiceUpdateOptions{})
-	assert.NilError(t, err)
-	poll.WaitOn(t, serviceIsUpdated(cli, serviceID), swarm.ServicePoll)
-	service = getService(t, cli, serviceID)
-	assert.Check(t, is.Equal(0, len(service.Spec.TaskTemplate.ContainerSpec.Secrets)))
-
-	err = cli.ServiceRemove(context.Background(), serviceID)
-	assert.NilError(t, err)
-}
-
-func TestServiceUpdateConfigs(t *testing.T) {
-	skip.If(t, testEnv.DaemonInfo.OSType != "linux")
-	defer setupTest(t)()
-	d := swarm.NewSwarm(t, testEnv)
-	defer d.Stop(t)
-	cli := d.NewClientT(t)
-	defer cli.Close()
-
-	ctx := context.Background()
-	configName := "TestConfig_" + t.Name()
-	configTarget := "targetName"
-	resp, err := cli.ConfigCreate(ctx, swarmtypes.ConfigSpec{
-		Annotations: swarmtypes.Annotations{
-			Name: configName,
-		},
-		Data: []byte("TESTINGDATA"),
-	})
-	assert.NilError(t, err)
-	assert.Check(t, resp.ID != "")
-
-	serviceName := "TestService_" + t.Name()
-	serviceID := swarm.CreateService(t, d, swarm.ServiceWithName(serviceName))
-	service := getService(t, cli, serviceID)
-
-	// add config
-	service.Spec.TaskTemplate.ContainerSpec.Configs = append(service.Spec.TaskTemplate.ContainerSpec.Configs,
-		&swarmtypes.ConfigReference{
-			File: &swarmtypes.ConfigReferenceFileTarget{
-				Name: configTarget,
-				UID:  "0",
-				GID:  "0",
-				Mode: 0600,
-			},
-			ConfigID:   resp.ID,
-			ConfigName: configName,
-		},
-	)
-	_, err = cli.ServiceUpdate(ctx, serviceID, service.Version, service.Spec, types.ServiceUpdateOptions{})
-	assert.NilError(t, err)
-	poll.WaitOn(t, serviceIsUpdated(cli, serviceID), swarm.ServicePoll)
-
-	service = getService(t, cli, serviceID)
-	configs := service.Spec.TaskTemplate.ContainerSpec.Configs
-	assert.Assert(t, is.Equal(1, len(configs)))
-
-	config := *configs[0]
-	assert.Check(t, is.Equal(configName, config.ConfigName))
-	assert.Check(t, nil != config.File)
-	assert.Check(t, is.Equal(configTarget, config.File.Name))
-
-	// remove
-	service.Spec.TaskTemplate.ContainerSpec.Configs = []*swarmtypes.ConfigReference{}
-	_, err = cli.ServiceUpdate(ctx, serviceID, service.Version, service.Spec, types.ServiceUpdateOptions{})
-	assert.NilError(t, err)
-	poll.WaitOn(t, serviceIsUpdated(cli, serviceID), swarm.ServicePoll)
-	service = getService(t, cli, serviceID)
-	assert.Check(t, is.Equal(0, len(service.Spec.TaskTemplate.ContainerSpec.Configs)))
-
-	err = cli.ServiceRemove(context.Background(), serviceID)
-	assert.NilError(t, err)
-}
-
-func getService(t *testing.T, cli client.ServiceAPIClient, serviceID string) swarmtypes.Service {
-	t.Helper()
-	service, _, err := cli.ServiceInspectWithRaw(context.Background(), serviceID, types.ServiceInspectOptions{})
-	assert.NilError(t, err)
-	return service
-}
-
-func serviceIsUpdated(client client.ServiceAPIClient, serviceID string) func(log poll.LogT) poll.Result {
-	return func(log poll.LogT) poll.Result {
-		service, _, err := client.ServiceInspectWithRaw(context.Background(), serviceID, types.ServiceInspectOptions{})
-		switch {
-		case err != nil:
-			return poll.Error(err)
-		case service.UpdateStatus != nil && service.UpdateStatus.State == swarmtypes.UpdateStateCompleted:
-			return poll.Success()
-		default:
-			if service.UpdateStatus != nil {
-				return poll.Continue("waiting for service %s to be updated, state: %s, message: %s", serviceID, service.UpdateStatus.State, service.UpdateStatus.Message)
-			}
-			return poll.Continue("waiting for service %s to be updated", serviceID)
-		}
-	}
-}
-
-func serviceSpecIsUpdated(client client.ServiceAPIClient, serviceID string, serviceOldVersion uint64) func(log poll.LogT) poll.Result {
-	return func(log poll.LogT) poll.Result {
-		service, _, err := client.ServiceInspectWithRaw(context.Background(), serviceID, types.ServiceInspectOptions{})
-		switch {
-		case err != nil:
-			return poll.Error(err)
-		case service.Version.Index > serviceOldVersion:
-			return poll.Success()
-		default:
-			return poll.Continue("waiting for service %s to be updated", serviceID)
-		}
-	}
-}
diff --git a/vendor/github.com/docker/docker/integration/system/cgroupdriver_systemd_test.go b/vendor/github.com/docker/docker/integration/system/cgroupdriver_systemd_test.go
index 5ab1ff319..b955dd302 100644
--- a/vendor/github.com/docker/docker/integration/system/cgroupdriver_systemd_test.go
+++ b/vendor/github.com/docker/docker/integration/system/cgroupdriver_systemd_test.go
@@ -36,23 +36,23 @@ func TestCgroupDriverSystemdMemoryLimit(t *testing.T) {
 	}
 
 	d := daemon.New(t)
-	c := d.NewClientT(t)
-
+	client, err := d.NewClient()
+	assert.NilError(t, err)
 	d.StartWithBusybox(t, "--exec-opt", "native.cgroupdriver=systemd", "--iptables=false")
 	defer d.Stop(t)
 
 	const mem = 64 * 1024 * 1024 // 64 MB
 
 	ctx := context.Background()
-	ctrID := container.Create(t, ctx, c, func(ctr *container.TestContainerConfig) {
-		ctr.HostConfig.Resources.Memory = mem
+	ctrID := container.Create(t, ctx, client, func(c *container.TestContainerConfig) {
+		c.HostConfig.Resources.Memory = mem
 	})
-	defer c.ContainerRemove(ctx, ctrID, types.ContainerRemoveOptions{Force: true})
+	defer client.ContainerRemove(ctx, ctrID, types.ContainerRemoveOptions{Force: true})
 
-	err := c.ContainerStart(ctx, ctrID, types.ContainerStartOptions{})
+	err = client.ContainerStart(ctx, ctrID, types.ContainerStartOptions{})
 	assert.NilError(t, err)
 
-	s, err := c.ContainerInspect(ctx, ctrID)
+	s, err := client.ContainerInspect(ctx, ctrID)
 	assert.NilError(t, err)
 	assert.Equal(t, s.HostConfig.Memory, mem)
 }
diff --git a/vendor/github.com/docker/docker/integration/system/event_test.go b/vendor/github.com/docker/docker/integration/system/event_test.go
index 4d47c7944..60d10407f 100644
--- a/vendor/github.com/docker/docker/integration/system/event_test.go
+++ b/vendor/github.com/docker/docker/integration/system/event_test.go
@@ -28,7 +28,7 @@ func TestEventsExecDie(t *testing.T) {
 	skip.If(t, testEnv.OSType == "windows", "FIXME. Suspect may need to wait until container is running before exec")
 	defer setupTest(t)()
 	ctx := context.Background()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	cID := container.Run(t, ctx, client)
 
@@ -78,7 +78,7 @@ func TestEventsBackwardsCompatible(t *testing.T) {
 	skip.If(t, testEnv.OSType == "windows", "Windows doesn't support back-compat messages")
 	defer setupTest(t)()
 	ctx := context.Background()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	since := request.DaemonTime(ctx, t, client, testEnv)
 	ts := strconv.FormatInt(since.Unix(), 10)
diff --git a/vendor/github.com/docker/docker/integration/system/info_linux_test.go b/vendor/github.com/docker/docker/integration/system/info_linux_test.go
index cb0448e55..50fa9874b 100644
--- a/vendor/github.com/docker/docker/integration/system/info_linux_test.go
+++ b/vendor/github.com/docker/docker/integration/system/info_linux_test.go
@@ -7,25 +7,28 @@ import (
 	"net/http"
 	"testing"
 
+	"github.com/docker/docker/internal/test/request"
 	req "github.com/docker/docker/internal/test/request"
 	"gotest.tools/assert"
 	is "gotest.tools/assert/cmp"
 )
 
 func TestInfoBinaryCommits(t *testing.T) {
-	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	info, err := client.Info(context.Background())
 	assert.NilError(t, err)
 
 	assert.Check(t, "N/A" != info.ContainerdCommit.ID)
+	assert.Check(t, is.Equal(testEnv.DaemonInfo.ContainerdCommit.Expected, info.ContainerdCommit.Expected))
 	assert.Check(t, is.Equal(info.ContainerdCommit.Expected, info.ContainerdCommit.ID))
 
 	assert.Check(t, "N/A" != info.InitCommit.ID)
+	assert.Check(t, is.Equal(testEnv.DaemonInfo.InitCommit.Expected, info.InitCommit.Expected))
 	assert.Check(t, is.Equal(info.InitCommit.Expected, info.InitCommit.ID))
 
 	assert.Check(t, "N/A" != info.RuncCommit.ID)
+	assert.Check(t, is.Equal(testEnv.DaemonInfo.RuncCommit.Expected, info.RuncCommit.Expected))
 	assert.Check(t, is.Equal(info.RuncCommit.Expected, info.RuncCommit.ID))
 }
 
diff --git a/vendor/github.com/docker/docker/integration/system/info_test.go b/vendor/github.com/docker/docker/integration/system/info_test.go
index 813036198..2051062d7 100644
--- a/vendor/github.com/docker/docker/integration/system/info_test.go
+++ b/vendor/github.com/docker/docker/integration/system/info_test.go
@@ -6,14 +6,14 @@ import (
 	"testing"
 
 	"github.com/docker/docker/internal/test/daemon"
+	"github.com/docker/docker/internal/test/request"
 	"gotest.tools/assert"
 	is "gotest.tools/assert/cmp"
 	"gotest.tools/skip"
 )
 
 func TestInfoAPI(t *testing.T) {
-	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	info, err := client.Info(context.Background())
 	assert.NilError(t, err)
@@ -44,15 +44,16 @@ func TestInfoAPI(t *testing.T) {
 }
 
 func TestInfoAPIWarnings(t *testing.T) {
-	skip.If(t, testEnv.IsRemoteDaemon, "cannot run daemon when remote daemon")
 	skip.If(t, testEnv.DaemonInfo.OSType == "windows", "FIXME")
 	d := daemon.New(t)
-	c := d.NewClientT(t)
+
+	client, err := d.NewClient()
+	assert.NilError(t, err)
 
 	d.StartWithBusybox(t, "-H=0.0.0.0:23756", "-H="+d.Sock())
 	defer d.Stop(t)
 
-	info, err := c.Info(context.Background())
+	info, err := client.Info(context.Background())
 	assert.NilError(t, err)
 
 	stringsToCheck := []string{
diff --git a/vendor/github.com/docker/docker/integration/system/login_test.go b/vendor/github.com/docker/docker/integration/system/login_test.go
index 819b7ee7f..ad1a8756d 100644
--- a/vendor/github.com/docker/docker/integration/system/login_test.go
+++ b/vendor/github.com/docker/docker/integration/system/login_test.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/integration/internal/requirement"
+	"github.com/docker/docker/internal/test/request"
 	"gotest.tools/assert"
 	is "gotest.tools/assert/cmp"
 	"gotest.tools/skip"
@@ -15,8 +16,7 @@ import (
 func TestLoginFailsWithBadCredentials(t *testing.T) {
 	skip.If(t, !requirement.HasHubConnectivity(t))
 
-	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	config := types.AuthConfig{
 		Username: "no-user",
diff --git a/vendor/github.com/docker/docker/integration/system/version_test.go b/vendor/github.com/docker/docker/integration/system/version_test.go
index 2f8d06bb3..8904c09b2 100644
--- a/vendor/github.com/docker/docker/integration/system/version_test.go
+++ b/vendor/github.com/docker/docker/integration/system/version_test.go
@@ -4,13 +4,13 @@ import (
 	"context"
 	"testing"
 
+	"github.com/docker/docker/internal/test/request"
 	"gotest.tools/assert"
 	is "gotest.tools/assert/cmp"
 )
 
 func TestVersion(t *testing.T) {
-	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 
 	version, err := client.ServerVersion(context.Background())
 	assert.NilError(t, err)
diff --git a/vendor/github.com/docker/docker/integration/volume/volume_test.go b/vendor/github.com/docker/docker/integration/volume/volume_test.go
index 4ee109e67..f29e3669d 100644
--- a/vendor/github.com/docker/docker/integration/volume/volume_test.go
+++ b/vendor/github.com/docker/docker/integration/volume/volume_test.go
@@ -22,7 +22,7 @@ import (
 func TestVolumesCreateAndList(t *testing.T) {
 	skip.If(t, testEnv.IsRemoteDaemon, "cannot run daemon when remote daemon")
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	name := t.Name()
@@ -52,7 +52,7 @@ func TestVolumesCreateAndList(t *testing.T) {
 func TestVolumesRemove(t *testing.T) {
 	skip.If(t, testEnv.OSType == "windows", "FIXME")
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	prefix, slash := getPrefixAndSlashFromDaemonPlatform()
@@ -78,7 +78,7 @@ func TestVolumesRemove(t *testing.T) {
 func TestVolumesInspect(t *testing.T) {
 	skip.If(t, testEnv.IsRemoteDaemon, "cannot run daemon when remote daemon")
 	defer setupTest(t)()
-	client := testEnv.APIClient()
+	client := request.NewAPIClient(t)
 	ctx := context.Background()
 
 	now := time.Now()
diff --git a/vendor/github.com/docker/docker/internal/test/daemon/daemon.go b/vendor/github.com/docker/docker/internal/test/daemon/daemon.go
index 90ec525be..4f56dff9b 100644
--- a/vendor/github.com/docker/docker/internal/test/daemon/daemon.go
+++ b/vendor/github.com/docker/docker/internal/test/daemon/daemon.go
@@ -76,7 +76,6 @@ type Daemon struct {
 	SwarmPort       int // FIXME(vdemeester) should probably not be exported
 	DefaultAddrPool []string
 	SubnetSize      uint32
-	DataPathPort    uint32
 	// cached information
 	CachedInfo types.Info
 }
@@ -113,13 +112,12 @@ func New(t testingT, ops ...func(*Daemon)) *Daemon {
 		}
 	}
 	d := &Daemon{
-		id:            id,
-		Folder:        daemonFolder,
-		Root:          daemonRoot,
-		storageDriver: storageDriver,
-		userlandProxy: userlandProxy,
-		// dxr stands for docker-execroot (shortened for avoiding unix(7) path length limitation)
-		execRoot:        filepath.Join(os.TempDir(), "dxr", id),
+		id:              id,
+		Folder:          daemonFolder,
+		Root:            daemonRoot,
+		storageDriver:   storageDriver,
+		userlandProxy:   userlandProxy,
+		execRoot:        filepath.Join(os.TempDir(), "docker-execroot", id),
 		dockerdBinary:   defaultDockerdBinary,
 		swarmListenAddr: defaultSwarmListenAddr,
 		SwarmPort:       DefaultSwarmPort,
@@ -204,7 +202,7 @@ func (d *Daemon) Start(t testingT, args ...string) {
 		ht.Helper()
 	}
 	if err := d.StartWithError(args...); err != nil {
-		t.Fatalf("failed to start daemon with arguments %v : %v", args, err)
+		t.Fatalf("Error starting daemon with arguments %v : %v", args, err)
 	}
 }
 
@@ -286,10 +284,7 @@ func (d *Daemon) StartWithLogFile(out *os.File, providedArgs ...string) error {
 
 	d.Wait = wait
 
-	ticker := time.NewTicker(500 * time.Millisecond)
-	defer ticker.Stop()
-	tick := ticker.C
-
+	tick := time.Tick(500 * time.Millisecond)
 	// make sure daemon is ready to receive requests
 	startTime := time.Now().Unix()
 	for {
@@ -427,9 +422,7 @@ func (d *Daemon) StopWithError() error {
 	}()
 
 	i := 1
-	ticker := time.NewTicker(time.Second)
-	defer ticker.Stop()
-	tick := ticker.C
+	tick := time.Tick(time.Second)
 
 	if err := d.cmd.Process.Signal(os.Interrupt); err != nil {
 		if strings.Contains(err.Error(), "os: process already finished") {
@@ -559,7 +552,7 @@ func (d *Daemon) LoadBusybox(t assert.TestingT) {
 	if ht, ok := t.(test.HelperT); ok {
 		ht.Helper()
 	}
-	clientHost, err := client.NewClientWithOpts(client.FromEnv)
+	clientHost, err := client.NewEnvClient()
 	assert.NilError(t, err, "failed to create client")
 	defer clientHost.Close()
 
@@ -568,10 +561,11 @@ func (d *Daemon) LoadBusybox(t assert.TestingT) {
 	assert.NilError(t, err, "failed to download busybox")
 	defer reader.Close()
 
-	c := d.NewClientT(t)
-	defer c.Close()
+	client, err := d.NewClient()
+	assert.NilError(t, err, "failed to create client")
+	defer client.Close()
 
-	resp, err := c.ImageLoad(ctx, reader, true)
+	resp, err := client.ImageLoad(ctx, reader, true)
 	assert.NilError(t, err, "failed to load busybox")
 	defer resp.Body.Close()
 }
@@ -631,7 +625,7 @@ func (d *Daemon) queryRootDir() (string, error) {
 		return "", err
 	}
 
-	c := &http.Client{
+	client := &http.Client{
 		Transport: clientConfig.transport,
 	}
 
@@ -643,7 +637,7 @@ func (d *Daemon) queryRootDir() (string, error) {
 	req.URL.Host = clientConfig.addr
 	req.URL.Scheme = clientConfig.scheme
 
-	resp, err := c.Do(req)
+	resp, err := client.Do(req)
 	if err != nil {
 		return "", err
 	}
@@ -671,8 +665,9 @@ func (d *Daemon) Info(t assert.TestingT) types.Info {
 	if ht, ok := t.(test.HelperT); ok {
 		ht.Helper()
 	}
-	c := d.NewClientT(t)
-	info, err := c.Info(context.Background())
+	apiclient, err := d.NewClient()
+	assert.NilError(t, err)
+	info, err := apiclient.Info(context.Background())
 	assert.NilError(t, err)
 	return info
 }
diff --git a/vendor/github.com/docker/docker/internal/test/daemon/daemon_unix.go b/vendor/github.com/docker/docker/internal/test/daemon/daemon_unix.go
index eb604fec7..9dd9e36f0 100644
--- a/vendor/github.com/docker/docker/internal/test/daemon/daemon_unix.go
+++ b/vendor/github.com/docker/docker/internal/test/daemon/daemon_unix.go
@@ -21,7 +21,7 @@ func cleanupNetworkNamespace(t testingT, execRoot string) {
 	// new exec root.
 	netnsPath := filepath.Join(execRoot, "netns")
 	filepath.Walk(netnsPath, func(path string, info os.FileInfo, err error) error {
-		if err := unix.Unmount(path, unix.MNT_DETACH); err != nil && err != unix.EINVAL && err != unix.ENOENT {
+		if err := unix.Unmount(path, unix.MNT_FORCE); err != nil {
 			t.Logf("unmount of %s failed: %v", path, err)
 		}
 		os.Remove(path)
diff --git a/vendor/github.com/docker/docker/internal/test/daemon/node.go b/vendor/github.com/docker/docker/internal/test/daemon/node.go
index 33dd36542..d9263a7f2 100644
--- a/vendor/github.com/docker/docker/internal/test/daemon/node.go
+++ b/vendor/github.com/docker/docker/internal/test/daemon/node.go
@@ -23,7 +23,7 @@ func (d *Daemon) GetNode(t assert.TestingT, id string) *swarm.Node {
 	defer cli.Close()
 
 	node, _, err := cli.NodeInspectWithRaw(context.Background(), id)
-	assert.NilError(t, err, "[%s] (*Daemon).GetNode: NodeInspectWithRaw(%q) failed", d.id, id)
+	assert.NilError(t, err)
 	assert.Check(t, node.ID == id)
 	return &node
 }
diff --git a/vendor/github.com/docker/docker/internal/test/daemon/ops.go b/vendor/github.com/docker/docker/internal/test/daemon/ops.go
index ff8cd8894..4154a7797 100644
--- a/vendor/github.com/docker/docker/internal/test/daemon/ops.go
+++ b/vendor/github.com/docker/docker/internal/test/daemon/ops.go
@@ -48,13 +48,6 @@ func WithSwarmDefaultAddrPoolSubnetSize(subnetSize uint32) func(*Daemon) {
 	}
 }
 
-// WithSwarmDataPathPort sets the  swarm datapath port to use for swarm mode
-func WithSwarmDataPathPort(datapathPort uint32) func(*Daemon) {
-	return func(d *Daemon) {
-		d.DataPathPort = datapathPort
-	}
-}
-
 // WithEnvironment sets options from internal/test/environment.Execution struct
 func WithEnvironment(e environment.Execution) func(*Daemon) {
 	return func(d *Daemon) {
diff --git a/vendor/github.com/docker/docker/internal/test/daemon/swarm.go b/vendor/github.com/docker/docker/internal/test/daemon/swarm.go
index e500fe0fd..ae6a62c9e 100644
--- a/vendor/github.com/docker/docker/internal/test/daemon/swarm.go
+++ b/vendor/github.com/docker/docker/internal/test/daemon/swarm.go
@@ -16,38 +16,26 @@ const (
 	defaultSwarmListenAddr = "0.0.0.0"
 )
 
-var (
-	startArgs = []string{"--iptables=false", "--swarm-default-advertise-addr=lo"}
-)
-
-// StartNode starts daemon to be used as a swarm node
-func (d *Daemon) StartNode(t testingT) {
-	if ht, ok := t.(test.HelperT); ok {
-		ht.Helper()
-	}
-	// avoid networking conflicts
-	d.StartWithBusybox(t, startArgs...)
-}
-
-// RestartNode restarts a daemon to be used as a swarm node
-func (d *Daemon) RestartNode(t testingT) {
+// StartAndSwarmInit starts the daemon (with busybox) and init the swarm
+func (d *Daemon) StartAndSwarmInit(t testingT) {
 	if ht, ok := t.(test.HelperT); ok {
 		ht.Helper()
 	}
 	// avoid networking conflicts
-	d.Stop(t)
-	d.StartWithBusybox(t, startArgs...)
-}
+	args := []string{"--iptables=false", "--swarm-default-advertise-addr=lo"}
+	d.StartWithBusybox(t, args...)
 
-// StartAndSwarmInit starts the daemon (with busybox) and init the swarm
-func (d *Daemon) StartAndSwarmInit(t testingT) {
-	d.StartNode(t)
 	d.SwarmInit(t, swarm.InitRequest{})
 }
 
 // StartAndSwarmJoin starts the daemon (with busybox) and join the specified swarm as worker or manager
 func (d *Daemon) StartAndSwarmJoin(t testingT, leader *Daemon, manager bool) {
-	d.StartNode(t)
+	if ht, ok := t.(test.HelperT); ok {
+		ht.Helper()
+	}
+	// avoid networking conflicts
+	args := []string{"--iptables=false", "--swarm-default-advertise-addr=lo"}
+	d.StartWithBusybox(t, args...)
 
 	tokens := leader.JoinTokens(t)
 	token := tokens.Worker
@@ -85,9 +73,6 @@ func (d *Daemon) SwarmInit(t assert.TestingT, req swarm.InitRequest) {
 		req.DefaultAddrPool = d.DefaultAddrPool
 		req.SubnetSize = d.SubnetSize
 	}
-	if d.DataPathPort > 0 {
-		req.DataPathPort = d.DataPathPort
-	}
 	cli := d.NewClientT(t)
 	defer cli.Close()
 	_, err := cli.SwarmInit(context.Background(), req)
diff --git a/vendor/github.com/docker/docker/internal/test/environment/environment.go b/vendor/github.com/docker/docker/internal/test/environment/environment.go
index 5538d2097..74c8e2ce0 100644
--- a/vendor/github.com/docker/docker/internal/test/environment/environment.go
+++ b/vendor/github.com/docker/docker/internal/test/environment/environment.go
@@ -145,12 +145,6 @@ func (e *Execution) APIClient() client.APIClient {
 	return e.client
 }
 
-// IsUserNamespace returns whether the user namespace remapping is enabled
-func (e *Execution) IsUserNamespace() bool {
-	root := os.Getenv("DOCKER_REMAP_ROOT")
-	return root != ""
-}
-
 // EnsureFrozenImagesLinux loads frozen test images into the daemon
 // if they aren't already loaded
 func EnsureFrozenImagesLinux(testEnv *Execution) error {
diff --git a/vendor/github.com/docker/docker/internal/test/fakestorage/storage.go b/vendor/github.com/docker/docker/internal/test/fakestorage/storage.go
index 77d6e2fcb..b091cbc3f 100644
--- a/vendor/github.com/docker/docker/internal/test/fakestorage/storage.go
+++ b/vendor/github.com/docker/docker/internal/test/fakestorage/storage.go
@@ -66,7 +66,7 @@ func New(t testingT, dir string, modifiers ...func(*fakecontext.Fake) error) Fak
 	ctx := fakecontext.New(t, dir, modifiers...)
 	switch {
 	case testEnv.IsRemoteDaemon() && strings.HasPrefix(request.DaemonHost(), "unix:///"):
-		t.Skip("e2e run : daemon is remote but docker host points to a unix socket")
+		t.Skip(fmt.Sprintf("e2e run : daemon is remote but docker host points to a unix socket"))
 	case testEnv.IsLocalDaemon():
 		return newLocalFakeStorage(ctx)
 	default:
diff --git a/vendor/github.com/docker/docker/internal/test/fixtures/plugin/plugin.go b/vendor/github.com/docker/docker/internal/test/fixtures/plugin/plugin.go
index 1af658426..523a261ad 100644
--- a/vendor/github.com/docker/docker/internal/test/fixtures/plugin/plugin.go
+++ b/vendor/github.com/docker/docker/internal/test/fixtures/plugin/plugin.go
@@ -17,7 +17,7 @@ import (
 	"github.com/pkg/errors"
 )
 
-// CreateOpt is passed used to change the default plugin config before
+// CreateOpt is is passed used to change the default plugin config before
 // creating it
 type CreateOpt func(*Config)
 
@@ -208,7 +208,7 @@ func ensureBasicPluginBin() (string, error) {
 	installPath := filepath.Join(os.Getenv("GOPATH"), "bin", name)
 	sourcePath := filepath.Join("github.com", "docker", "docker", "internal", "test", "fixtures", "plugin", "basic")
 	cmd := exec.Command(goBin, "build", "-o", installPath, sourcePath)
-	cmd.Env = append(os.Environ(), "CGO_ENABLED=0")
+	cmd.Env = append(cmd.Env, "GOPATH="+os.Getenv("GOPATH"), "CGO_ENABLED=0")
 	if out, err := cmd.CombinedOutput(); err != nil {
 		return "", errors.Wrapf(err, "error building basic plugin bin: %s", string(out))
 	}
diff --git a/vendor/github.com/docker/docker/layer/layer_store.go b/vendor/github.com/docker/docker/layer/layer_store.go
index 1601465c0..bc3e8719f 100644
--- a/vendor/github.com/docker/docker/layer/layer_store.go
+++ b/vendor/github.com/docker/docker/layer/layer_store.go
@@ -253,14 +253,13 @@ func (ls *layerStore) applyTar(tx *fileMetadataTransaction, ts io.Reader, parent
 	}
 
 	applySize, err := ls.driver.ApplyDiff(layer.cacheID, parent, rdr)
-	// discard trailing data but ensure metadata is picked up to reconstruct stream
-	// unconditionally call io.Copy here before checking err to ensure the resources
-	// allocated by NewInputTarStream above are always released
-	io.Copy(ioutil.Discard, rdr) // ignore error as reader may be closed
 	if err != nil {
 		return err
 	}
 
+	// Discard trailing data but ensure metadata is picked up to reconstruct stream
+	io.Copy(ioutil.Discard, rdr) // ignore error as reader may be closed
+
 	layer.size = applySize
 	layer.diffID = DiffID(digester.Digest())
 
diff --git a/vendor/github.com/docker/docker/layer/layer_windows.go b/vendor/github.com/docker/docker/layer/layer_windows.go
index 3d079a9af..25ef26afc 100644
--- a/vendor/github.com/docker/docker/layer/layer_windows.go
+++ b/vendor/github.com/docker/docker/layer/layer_windows.go
@@ -7,7 +7,7 @@ import (
 // Getter is an interface to get the path to a layer on the host.
 type Getter interface {
 	// GetLayerPath gets the path for the layer. This is different from Get()
-	// since that returns an interface to account for unmountable layers.
+	// since that returns an interface to account for umountable layers.
 	GetLayerPath(id string) (string, error)
 }
 
diff --git a/vendor/github.com/docker/docker/libcontainerd/client_local_windows.go b/vendor/github.com/docker/docker/libcontainerd/client_local_windows.go
index 3eab7c604..cd5ea962a 100644
--- a/vendor/github.com/docker/docker/libcontainerd/client_local_windows.go
+++ b/vendor/github.com/docker/docker/libcontainerd/client_local_windows.go
@@ -168,9 +168,9 @@ func (c *client) Create(_ context.Context, id string, spec *specs.Spec, runtimeO
 func (c *client) createWindows(id string, spec *specs.Spec, runtimeOptions interface{}) error {
 	logger := c.logger.WithField("container", id)
 	configuration := &hcsshim.ContainerConfig{
-		SystemType:              "Container",
-		Name:                    id,
-		Owner:                   defaultOwner,
+		SystemType: "Container",
+		Name:       id,
+		Owner:      defaultOwner,
 		IgnoreFlushesDuringBoot: spec.Windows.IgnoreFlushesDuringBoot,
 		HostName:                spec.Hostname,
 		HvPartition:             false,
@@ -326,19 +326,6 @@ func (c *client) createWindows(id string, spec *specs.Spec, runtimeOptions inter
 	}
 	configuration.MappedPipes = mps
 
-	if len(spec.Windows.Devices) > 0 {
-		// Add any device assignments
-		if configuration.HvPartition {
-			return errors.New("device assignment is not supported for HyperV containers")
-		}
-		if system.GetOSVersion().Build < 17763 { // RS5
-			return errors.New("device assignment requires Windows builds RS5 (17763+) or later")
-		}
-		for _, d := range spec.Windows.Devices {
-			configuration.AssignedDevices = append(configuration.AssignedDevices, hcsshim.AssignedDevice{InterfaceClassGUID: d.ID})
-		}
-	}
-
 	hcsContainer, err := hcsshim.CreateContainer(id, configuration)
 	if err != nil {
 		return err
@@ -390,11 +377,11 @@ func (c *client) createLinux(id string, spec *specs.Spec, runtimeOptions interfa
 	}
 
 	configuration := &hcsshim.ContainerConfig{
-		HvPartition:                 true,
-		Name:                        id,
-		SystemType:                  "container",
-		ContainerType:               "linux",
-		Owner:                       defaultOwner,
+		HvPartition:   true,
+		Name:          id,
+		SystemType:    "container",
+		ContainerType: "linux",
+		Owner:         defaultOwner,
 		TerminateOnLastHandleClosed: true,
 	}
 
diff --git a/vendor/github.com/docker/docker/libcontainerd/supervisor/remote_daemon.go b/vendor/github.com/docker/docker/libcontainerd/supervisor/remote_daemon.go
index 2acca6f33..439162de7 100644
--- a/vendor/github.com/docker/docker/libcontainerd/supervisor/remote_daemon.go
+++ b/vendor/github.com/docker/docker/libcontainerd/supervisor/remote_daemon.go
@@ -281,7 +281,7 @@ func (r *remote) monitorDaemon(ctx context.Context) {
 				continue
 			}
 
-			client, err = containerd.New(r.GRPC.Address, containerd.WithTimeout(60*time.Second))
+			client, err = containerd.New(r.GRPC.Address)
 			if err != nil {
 				r.logger.WithError(err).Error("failed connecting to containerd")
 				delay = time.After(100 * time.Millisecond)
diff --git a/vendor/github.com/docker/docker/migrate/v1/migratev1.go b/vendor/github.com/docker/docker/migrate/v1/migratev1.go
new file mode 100644
index 000000000..9cd759a3b
--- /dev/null
+++ b/vendor/github.com/docker/docker/migrate/v1/migratev1.go
@@ -0,0 +1,501 @@
+package v1 // import "github.com/docker/docker/migrate/v1"
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strconv"
+	"sync"
+	"time"
+
+	"github.com/docker/distribution/reference"
+	"github.com/docker/docker/distribution/metadata"
+	"github.com/docker/docker/image"
+	imagev1 "github.com/docker/docker/image/v1"
+	"github.com/docker/docker/layer"
+	"github.com/docker/docker/pkg/ioutils"
+	refstore "github.com/docker/docker/reference"
+	"github.com/opencontainers/go-digest"
+	"github.com/sirupsen/logrus"
+)
+
+type graphIDRegistrar interface {
+	RegisterByGraphID(string, layer.ChainID, layer.DiffID, string, int64) (layer.Layer, error)
+	Release(layer.Layer) ([]layer.Metadata, error)
+}
+
+type graphIDMounter interface {
+	CreateRWLayerByGraphID(string, string, layer.ChainID) error
+}
+
+type checksumCalculator interface {
+	ChecksumForGraphID(id, parent, oldTarDataPath, newTarDataPath string) (diffID layer.DiffID, size int64, err error)
+}
+
+const (
+	graphDirName                 = "graph"
+	tarDataFileName              = "tar-data.json.gz"
+	migrationFileName            = ".migration-v1-images.json"
+	migrationTagsFileName        = ".migration-v1-tags"
+	migrationDiffIDFileName      = ".migration-diffid"
+	migrationSizeFileName        = ".migration-size"
+	migrationTarDataFileName     = ".migration-tardata"
+	containersDirName            = "containers"
+	configFileNameLegacy         = "config.json"
+	configFileName               = "config.v2.json"
+	repositoriesFilePrefixLegacy = "repositories-"
+)
+
+var (
+	errUnsupported = errors.New("migration is not supported")
+)
+
+// Migrate takes an old graph directory and transforms the metadata into the
+// new format.
+func Migrate(root, driverName string, ls layer.Store, is image.Store, rs refstore.Store, ms metadata.Store) error {
+	graphDir := filepath.Join(root, graphDirName)
+	if _, err := os.Lstat(graphDir); os.IsNotExist(err) {
+		return nil
+	}
+
+	mappings, err := restoreMappings(root)
+	if err != nil {
+		return err
+	}
+
+	if cc, ok := ls.(checksumCalculator); ok {
+		CalculateLayerChecksums(root, cc, mappings)
+	}
+
+	if registrar, ok := ls.(graphIDRegistrar); !ok {
+		return errUnsupported
+	} else if err := migrateImages(root, registrar, is, ms, mappings); err != nil {
+		return err
+	}
+
+	err = saveMappings(root, mappings)
+	if err != nil {
+		return err
+	}
+
+	if mounter, ok := ls.(graphIDMounter); !ok {
+		return errUnsupported
+	} else if err := migrateContainers(root, mounter, is, mappings); err != nil {
+		return err
+	}
+
+	return migrateRefs(root, driverName, rs, mappings)
+}
+
+// CalculateLayerChecksums walks an old graph directory and calculates checksums
+// for each layer. These checksums are later used for migration.
+func CalculateLayerChecksums(root string, ls checksumCalculator, mappings map[string]image.ID) {
+	graphDir := filepath.Join(root, graphDirName)
+	// spawn some extra workers also for maximum performance because the process is bounded by both cpu and io
+	workers := runtime.NumCPU() * 3
+	workQueue := make(chan string, workers)
+
+	wg := sync.WaitGroup{}
+
+	for i := 0; i < workers; i++ {
+		wg.Add(1)
+		go func() {
+			for id := range workQueue {
+				start := time.Now()
+				if err := calculateLayerChecksum(graphDir, id, ls); err != nil {
+					logrus.Errorf("could not calculate checksum for %q, %q", id, err)
+				}
+				elapsed := time.Since(start)
+				logrus.Debugf("layer %s took %.2f seconds", id, elapsed.Seconds())
+			}
+			wg.Done()
+		}()
+	}
+
+	dir, err := ioutil.ReadDir(graphDir)
+	if err != nil {
+		logrus.Errorf("could not read directory %q", graphDir)
+		return
+	}
+	for _, v := range dir {
+		v1ID := v.Name()
+		if err := imagev1.ValidateID(v1ID); err != nil {
+			continue
+		}
+		if _, ok := mappings[v1ID]; ok { // support old migrations without helper files
+			continue
+		}
+		workQueue <- v1ID
+	}
+	close(workQueue)
+	wg.Wait()
+}
+
+func calculateLayerChecksum(graphDir, id string, ls checksumCalculator) error {
+	diffIDFile := filepath.Join(graphDir, id, migrationDiffIDFileName)
+	if _, err := os.Lstat(diffIDFile); err == nil {
+		return nil
+	} else if !os.IsNotExist(err) {
+		return err
+	}
+
+	parent, err := getParent(filepath.Join(graphDir, id))
+	if err != nil {
+		return err
+	}
+
+	diffID, size, err := ls.ChecksumForGraphID(id, parent, filepath.Join(graphDir, id, tarDataFileName), filepath.Join(graphDir, id, migrationTarDataFileName))
+	if err != nil {
+		return err
+	}
+
+	if err := ioutil.WriteFile(filepath.Join(graphDir, id, migrationSizeFileName), []byte(strconv.Itoa(int(size))), 0600); err != nil {
+		return err
+	}
+
+	if err := ioutils.AtomicWriteFile(filepath.Join(graphDir, id, migrationDiffIDFileName), []byte(diffID), 0600); err != nil {
+		return err
+	}
+
+	logrus.Infof("calculated checksum for layer %s: %s", id, diffID)
+	return nil
+}
+
+func restoreMappings(root string) (map[string]image.ID, error) {
+	mappings := make(map[string]image.ID)
+
+	mfile := filepath.Join(root, migrationFileName)
+	f, err := os.Open(mfile)
+	if err != nil && !os.IsNotExist(err) {
+		return nil, err
+	} else if err == nil {
+		err := json.NewDecoder(f).Decode(&mappings)
+		if err != nil {
+			f.Close()
+			return nil, err
+		}
+		f.Close()
+	}
+
+	return mappings, nil
+}
+
+func saveMappings(root string, mappings map[string]image.ID) error {
+	mfile := filepath.Join(root, migrationFileName)
+	f, err := os.OpenFile(mfile, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	return json.NewEncoder(f).Encode(mappings)
+}
+
+func migrateImages(root string, ls graphIDRegistrar, is image.Store, ms metadata.Store, mappings map[string]image.ID) error {
+	graphDir := filepath.Join(root, graphDirName)
+
+	dir, err := ioutil.ReadDir(graphDir)
+	if err != nil {
+		return err
+	}
+	for _, v := range dir {
+		v1ID := v.Name()
+		if err := imagev1.ValidateID(v1ID); err != nil {
+			continue
+		}
+		if _, exists := mappings[v1ID]; exists {
+			continue
+		}
+		if err := migrateImage(v1ID, root, ls, is, ms, mappings); err != nil {
+			continue
+		}
+	}
+
+	return nil
+}
+
+func migrateContainers(root string, ls graphIDMounter, is image.Store, imageMappings map[string]image.ID) error {
+	containersDir := filepath.Join(root, containersDirName)
+	dir, err := ioutil.ReadDir(containersDir)
+	if err != nil {
+		return err
+	}
+	for _, v := range dir {
+		id := v.Name()
+
+		if _, err := os.Stat(filepath.Join(containersDir, id, configFileName)); err == nil {
+			continue
+		}
+
+		containerJSON, err := ioutil.ReadFile(filepath.Join(containersDir, id, configFileNameLegacy))
+		if err != nil {
+			logrus.Errorf("migrate container error: %v", err)
+			continue
+		}
+
+		var c map[string]*json.RawMessage
+		if err := json.Unmarshal(containerJSON, &c); err != nil {
+			logrus.Errorf("migrate container error: %v", err)
+			continue
+		}
+
+		imageStrJSON, ok := c["Image"]
+		if !ok {
+			return fmt.Errorf("invalid container configuration for %v", id)
+		}
+
+		var image string
+		if err := json.Unmarshal([]byte(*imageStrJSON), &image); err != nil {
+			logrus.Errorf("migrate container error: %v", err)
+			continue
+		}
+
+		imageID, ok := imageMappings[image]
+		if !ok {
+			logrus.Errorf("image not migrated %v", imageID) // non-fatal error
+			continue
+		}
+
+		c["Image"] = rawJSON(imageID)
+
+		containerJSON, err = json.Marshal(c)
+		if err != nil {
+			return err
+		}
+
+		if err := ioutil.WriteFile(filepath.Join(containersDir, id, configFileName), containerJSON, 0600); err != nil {
+			return err
+		}
+
+		img, err := is.Get(imageID)
+		if err != nil {
+			return err
+		}
+
+		if err := ls.CreateRWLayerByGraphID(id, id, img.RootFS.ChainID()); err != nil {
+			logrus.Errorf("migrate container error: %v", err)
+			continue
+		}
+
+		logrus.Infof("migrated container %s to point to %s", id, imageID)
+
+	}
+	return nil
+}
+
+type refAdder interface {
+	AddTag(ref reference.Named, id digest.Digest, force bool) error
+	AddDigest(ref reference.Canonical, id digest.Digest, force bool) error
+}
+
+func migrateRefs(root, driverName string, rs refAdder, mappings map[string]image.ID) error {
+	migrationFile := filepath.Join(root, migrationTagsFileName)
+	if _, err := os.Lstat(migrationFile); !os.IsNotExist(err) {
+		return err
+	}
+
+	type repositories struct {
+		Repositories map[string]map[string]string
+	}
+
+	var repos repositories
+
+	f, err := os.Open(filepath.Join(root, repositoriesFilePrefixLegacy+driverName))
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+	defer f.Close()
+	if err := json.NewDecoder(f).Decode(&repos); err != nil {
+		return err
+	}
+
+	for name, repo := range repos.Repositories {
+		for tag, id := range repo {
+			if strongID, exists := mappings[id]; exists {
+				ref, err := reference.ParseNormalizedNamed(name)
+				if err != nil {
+					logrus.Errorf("migrate tags: invalid name %q, %q", name, err)
+					continue
+				}
+				if !reference.IsNameOnly(ref) {
+					logrus.Errorf("migrate tags: invalid name %q, unexpected tag or digest", name)
+					continue
+				}
+				if dgst, err := digest.Parse(tag); err == nil {
+					canonical, err := reference.WithDigest(reference.TrimNamed(ref), dgst)
+					if err != nil {
+						logrus.Errorf("migrate tags: invalid digest %q, %q", dgst, err)
+						continue
+					}
+					if err := rs.AddDigest(canonical, strongID.Digest(), false); err != nil {
+						logrus.Errorf("can't migrate digest %q for %q, err: %q", reference.FamiliarString(ref), strongID, err)
+					}
+				} else {
+					tagRef, err := reference.WithTag(ref, tag)
+					if err != nil {
+						logrus.Errorf("migrate tags: invalid tag %q, %q", tag, err)
+						continue
+					}
+					if err := rs.AddTag(tagRef, strongID.Digest(), false); err != nil {
+						logrus.Errorf("can't migrate tag %q for %q, err: %q", reference.FamiliarString(ref), strongID, err)
+					}
+				}
+				logrus.Infof("migrated tag %s:%s to point to %s", name, tag, strongID)
+			}
+		}
+	}
+
+	mf, err := os.Create(migrationFile)
+	if err != nil {
+		return err
+	}
+	mf.Close()
+
+	return nil
+}
+
+func getParent(confDir string) (string, error) {
+	jsonFile := filepath.Join(confDir, "json")
+	imageJSON, err := ioutil.ReadFile(jsonFile)
+	if err != nil {
+		return "", err
+	}
+	var parent struct {
+		Parent   string
+		ParentID digest.Digest `json:"parent_id"`
+	}
+	if err := json.Unmarshal(imageJSON, &parent); err != nil {
+		return "", err
+	}
+	if parent.Parent == "" && parent.ParentID != "" { // v1.9
+		parent.Parent = parent.ParentID.Hex()
+	}
+	// compatibilityID for parent
+	parentCompatibilityID, err := ioutil.ReadFile(filepath.Join(confDir, "parent"))
+	if err == nil && len(parentCompatibilityID) > 0 {
+		parent.Parent = string(parentCompatibilityID)
+	}
+	return parent.Parent, nil
+}
+
+func migrateImage(id, root string, ls graphIDRegistrar, is image.Store, ms metadata.Store, mappings map[string]image.ID) (err error) {
+	defer func() {
+		if err != nil {
+			logrus.Errorf("migration failed for %v, err: %v", id, err)
+		}
+	}()
+
+	parent, err := getParent(filepath.Join(root, graphDirName, id))
+	if err != nil {
+		return err
+	}
+
+	var parentID image.ID
+	if parent != "" {
+		var exists bool
+		if parentID, exists = mappings[parent]; !exists {
+			if err := migrateImage(parent, root, ls, is, ms, mappings); err != nil {
+				// todo: fail or allow broken chains?
+				return err
+			}
+			parentID = mappings[parent]
+		}
+	}
+
+	rootFS := image.NewRootFS()
+	var history []image.History
+
+	if parentID != "" {
+		parentImg, err := is.Get(parentID)
+		if err != nil {
+			return err
+		}
+
+		rootFS = parentImg.RootFS
+		history = parentImg.History
+	}
+
+	diffIDData, err := ioutil.ReadFile(filepath.Join(root, graphDirName, id, migrationDiffIDFileName))
+	if err != nil {
+		return err
+	}
+	diffID, err := digest.Parse(string(diffIDData))
+	if err != nil {
+		return err
+	}
+
+	sizeStr, err := ioutil.ReadFile(filepath.Join(root, graphDirName, id, migrationSizeFileName))
+	if err != nil {
+		return err
+	}
+	size, err := strconv.ParseInt(string(sizeStr), 10, 64)
+	if err != nil {
+		return err
+	}
+
+	layer, err := ls.RegisterByGraphID(id, rootFS.ChainID(), layer.DiffID(diffID), filepath.Join(root, graphDirName, id, migrationTarDataFileName), size)
+	if err != nil {
+		return err
+	}
+	logrus.Infof("migrated layer %s to %s", id, layer.DiffID())
+
+	jsonFile := filepath.Join(root, graphDirName, id, "json")
+	imageJSON, err := ioutil.ReadFile(jsonFile)
+	if err != nil {
+		return err
+	}
+
+	h, err := imagev1.HistoryFromConfig(imageJSON, false)
+	if err != nil {
+		return err
+	}
+	history = append(history, h)
+
+	rootFS.Append(layer.DiffID())
+
+	config, err := imagev1.MakeConfigFromV1Config(imageJSON, rootFS, history)
+	if err != nil {
+		return err
+	}
+	strongID, err := is.Create(config)
+	if err != nil {
+		return err
+	}
+	logrus.Infof("migrated image %s to %s", id, strongID)
+
+	if parentID != "" {
+		if err := is.SetParent(strongID, parentID); err != nil {
+			return err
+		}
+	}
+
+	checksum, err := ioutil.ReadFile(filepath.Join(root, graphDirName, id, "checksum"))
+	if err == nil { // best effort
+		dgst, err := digest.Parse(string(checksum))
+		if err == nil {
+			V2MetadataService := metadata.NewV2MetadataService(ms)
+			V2MetadataService.Add(layer.DiffID(), metadata.V2Metadata{Digest: dgst})
+		}
+	}
+	_, err = ls.Release(layer)
+	if err != nil {
+		return err
+	}
+
+	mappings[id] = strongID
+	return
+}
+
+func rawJSON(value interface{}) *json.RawMessage {
+	jsonval, err := json.Marshal(value)
+	if err != nil {
+		return nil
+	}
+	return (*json.RawMessage)(&jsonval)
+}
diff --git a/vendor/github.com/docker/docker/migrate/v1/migratev1_test.go b/vendor/github.com/docker/docker/migrate/v1/migratev1_test.go
new file mode 100644
index 000000000..09cdac82d
--- /dev/null
+++ b/vendor/github.com/docker/docker/migrate/v1/migratev1_test.go
@@ -0,0 +1,437 @@
+package v1 // import "github.com/docker/docker/migrate/v1"
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"reflect"
+	"runtime"
+	"testing"
+
+	"github.com/docker/distribution/reference"
+	"github.com/docker/docker/distribution/metadata"
+	"github.com/docker/docker/image"
+	"github.com/docker/docker/layer"
+	"github.com/opencontainers/go-digest"
+)
+
+func TestMigrateRefs(t *testing.T) {
+	tmpdir, err := ioutil.TempDir("", "migrate-tags")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(tmpdir)
+
+	ioutil.WriteFile(filepath.Join(tmpdir, "repositories-generic"), []byte(`{"Repositories":{"busybox":{"latest":"b3ca410aa2c115c05969a7b2c8cf8a9fcf62c1340ed6a601c9ee50df337ec108","sha256:16a2a52884c2a9481ed267c2d46483eac7693b813a63132368ab098a71303f8a":"b3ca410aa2c115c05969a7b2c8cf8a9fcf62c1340ed6a601c9ee50df337ec108"},"registry":{"2":"5d165b8e4b203685301c815e95663231691d383fd5e3d3185d1ce3f8dddead3d","latest":"8d5547a9f329b1d3f93198cd661fb5117e5a96b721c5cf9a2c389e7dd4877128"}}}`), 0600)
+
+	ta := &mockTagAdder{}
+	err = migrateRefs(tmpdir, "generic", ta, map[string]image.ID{
+		"5d165b8e4b203685301c815e95663231691d383fd5e3d3185d1ce3f8dddead3d": image.ID("sha256:2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae"),
+		"b3ca410aa2c115c05969a7b2c8cf8a9fcf62c1340ed6a601c9ee50df337ec108": image.ID("sha256:fcde2b2edba56bf408601fb721fe9b5c338d10ee429ea04fae5511b68fbf8fb9"),
+		"abcdef3434c115c05969a7b2c8cf8a9fcf62c1340ed6a601c9ee50df337ec108": image.ID("sha256:56434342345ae68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae"),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expected := map[string]string{
+		"docker.io/library/busybox:latest":                                                                  "sha256:fcde2b2edba56bf408601fb721fe9b5c338d10ee429ea04fae5511b68fbf8fb9",
+		"docker.io/library/busybox@sha256:16a2a52884c2a9481ed267c2d46483eac7693b813a63132368ab098a71303f8a": "sha256:fcde2b2edba56bf408601fb721fe9b5c338d10ee429ea04fae5511b68fbf8fb9",
+		"docker.io/library/registry:2":                                                                      "sha256:2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae",
+	}
+
+	if !reflect.DeepEqual(expected, ta.refs) {
+		t.Fatalf("Invalid migrated tags: expected %q, got %q", expected, ta.refs)
+	}
+
+	// second migration is no-op
+	ioutil.WriteFile(filepath.Join(tmpdir, "repositories-generic"), []byte(`{"Repositories":{"busybox":{"latest":"b3ca410aa2c115c05969a7b2c8cf8a9fcf62c1340ed6a601c9ee50df337ec108"`), 0600)
+	err = migrateRefs(tmpdir, "generic", ta, map[string]image.ID{
+		"b3ca410aa2c115c05969a7b2c8cf8a9fcf62c1340ed6a601c9ee50df337ec108": image.ID("sha256:fcde2b2edba56bf408601fb721fe9b5c338d10ee429ea04fae5511b68fbf8fb9"),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(expected, ta.refs) {
+		t.Fatalf("Invalid migrated tags: expected %q, got %q", expected, ta.refs)
+	}
+}
+
+func TestMigrateContainers(t *testing.T) {
+	// TODO Windows: Figure out why this is failing
+	if runtime.GOOS == "windows" {
+		t.Skip("Failing on Windows")
+	}
+	if runtime.GOARCH != "amd64" {
+		t.Skip("Test tailored to amd64 architecture")
+	}
+	tmpdir, err := ioutil.TempDir("", "migrate-containers")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(tmpdir)
+
+	err = addContainer(tmpdir, `{"State":{"Running":false,"Paused":false,"Restarting":false,"OOMKilled":false,"Dead":false,"Pid":0,"ExitCode":0,"Error":"","StartedAt":"2015-11-10T21:42:40.604267436Z","FinishedAt":"2015-11-10T21:42:41.869265487Z"},"ID":"f780ee3f80e66e9b432a57049597118a66aab8932be88e5628d4c824edbee37c","Created":"2015-11-10T21:42:40.433831551Z","Path":"sh","Args":[],"Config":{"Hostname":"f780ee3f80e6","Domainname":"","User":"","AttachStdin":true,"AttachStdout":true,"AttachStderr":true,"Tty":true,"OpenStdin":true,"StdinOnce":true,"Env":null,"Cmd":["sh"],"Image":"busybox","Volumes":null,"WorkingDir":"","Entrypoint":null,"OnBuild":null,"Labels":{}},"Image":"2c5ac3f849df8627fcf2822727f87c57f38b7129d3604fbc11d861fe856ff093","NetworkSettings":{"Bridge":"","EndpointID":"","Gateway":"","GlobalIPv6Address":"","GlobalIPv6PrefixLen":0,"HairpinMode":false,"IPAddress":"","IPPrefixLen":0,"IPv6Gateway":"","LinkLocalIPv6Address":"","LinkLocalIPv6PrefixLen":0,"MacAddress":"","NetworkID":"","PortMapping":null,"Ports":null,"SandboxKey":"","SecondaryIPAddresses":null,"SecondaryIPv6Addresses":null},"ResolvConfPath":"/var/lib/docker/containers/f780ee3f80e66e9b432a57049597118a66aab8932be88e5628d4c824edbee37c/resolv.conf","HostnamePath":"/var/lib/docker/containers/f780ee3f80e66e9b432a57049597118a66aab8932be88e5628d4c824edbee37c/hostname","HostsPath":"/var/lib/docker/containers/f780ee3f80e66e9b432a57049597118a66aab8932be88e5628d4c824edbee37c/hosts","LogPath":"/var/lib/docker/containers/f780ee3f80e66e9b432a57049597118a66aab8932be88e5628d4c824edbee37c/f780ee3f80e66e9b432a57049597118a66aab8932be88e5628d4c824edbee37c-json.log","Name":"/determined_euclid","Driver":"overlay","ExecDriver":"native-0.2","MountLabel":"","ProcessLabel":"","RestartCount":0,"UpdateDns":false,"HasBeenStartedBefore":false,"MountPoints":{},"Volumes":{},"VolumesRW":{},"AppArmorProfile":""}`)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// container with invalid image
+	err = addContainer(tmpdir, `{"State":{"Running":false,"Paused":false,"Restarting":false,"OOMKilled":false,"Dead":false,"Pid":0,"ExitCode":0,"Error":"","StartedAt":"2015-11-10T21:42:40.604267436Z","FinishedAt":"2015-11-10T21:42:41.869265487Z"},"ID":"e780ee3f80e66e9b432a57049597118a66aab8932be88e5628d4c824edbee37c","Created":"2015-11-10T21:42:40.433831551Z","Path":"sh","Args":[],"Config":{"Hostname":"f780ee3f80e6","Domainname":"","User":"","AttachStdin":true,"AttachStdout":true,"AttachStderr":true,"Tty":true,"OpenStdin":true,"StdinOnce":true,"Env":null,"Cmd":["sh"],"Image":"busybox","Volumes":null,"WorkingDir":"","Entrypoint":null,"OnBuild":null,"Labels":{}},"Image":"4c5ac3f849df8627fcf2822727f87c57f38b7129d3604fbc11d861fe856ff093","NetworkSettings":{"Bridge":"","EndpointID":"","Gateway":"","GlobalIPv6Address":"","GlobalIPv6PrefixLen":0,"HairpinMode":false,"IPAddress":"","IPPrefixLen":0,"IPv6Gateway":"","LinkLocalIPv6Address":"","LinkLocalIPv6PrefixLen":0,"MacAddress":"","NetworkID":"","PortMapping":null,"Ports":null,"SandboxKey":"","SecondaryIPAddresses":null,"SecondaryIPv6Addresses":null},"ResolvConfPath":"/var/lib/docker/containers/f780ee3f80e66e9b432a57049597118a66aab8932be88e5628d4c824edbee37c/resolv.conf","HostnamePath":"/var/lib/docker/containers/f780ee3f80e66e9b432a57049597118a66aab8932be88e5628d4c824edbee37c/hostname","HostsPath":"/var/lib/docker/containers/f780ee3f80e66e9b432a57049597118a66aab8932be88e5628d4c824edbee37c/hosts","LogPath":"/var/lib/docker/containers/f780ee3f80e66e9b432a57049597118a66aab8932be88e5628d4c824edbee37c/f780ee3f80e66e9b432a57049597118a66aab8932be88e5628d4c824edbee37c-json.log","Name":"/determined_euclid","Driver":"overlay","ExecDriver":"native-0.2","MountLabel":"","ProcessLabel":"","RestartCount":0,"UpdateDns":false,"HasBeenStartedBefore":false,"MountPoints":{},"Volumes":{},"VolumesRW":{},"AppArmorProfile":""}`)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ifs, err := image.NewFSStoreBackend(filepath.Join(tmpdir, "imagedb"))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ls := &mockMounter{}
+	mmMap := make(map[string]image.LayerGetReleaser)
+	mmMap[runtime.GOOS] = ls
+	is, err := image.NewImageStore(ifs, mmMap)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	imgID, err := is.Create([]byte(`{"architecture":"amd64","config":{"AttachStdin":false,"AttachStdout":false,"AttachStderr":false,"Cmd":["sh"],"Entrypoint":null,"Env":null,"Hostname":"23304fc829f9","Image":"d1592a710ac323612bd786fa8ac20727c58d8a67847e5a65177c594f43919498","Labels":null,"OnBuild":null,"OpenStdin":false,"StdinOnce":false,"Tty":false,"Volumes":null,"WorkingDir":"","Domainname":"","User":""},"container":"349b014153779e30093d94f6df2a43c7a0a164e05aa207389917b540add39b51","container_config":{"AttachStdin":false,"AttachStdout":false,"AttachStderr":false,"Cmd":["/bin/sh","-c","#(nop) CMD [\"sh\"]"],"Entrypoint":null,"Env":null,"Hostname":"23304fc829f9","Image":"d1592a710ac323612bd786fa8ac20727c58d8a67847e5a65177c594f43919498","Labels":null,"OnBuild":null,"OpenStdin":false,"StdinOnce":false,"Tty":false,"Volumes":null,"WorkingDir":"","Domainname":"","User":""},"created":"2015-10-31T22:22:55.613815829Z","docker_version":"1.8.2","history":[{"created":"2015-10-31T22:22:54.690851953Z","created_by":"/bin/sh -c #(nop) ADD file:a3bc1e842b69636f9df5256c49c5374fb4eef1e281fe3f282c65fb853ee171c5 in /"},{"created":"2015-10-31T22:22:55.613815829Z","created_by":"/bin/sh -c #(nop) CMD [\"sh\"]"}],"os":"linux","rootfs":{"type":"layers","diff_ids":["sha256:c6f988f4874bb0add23a778f753c65efe992244e148a1d2ec2a8b664fb66bbd1","sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef"]}}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = migrateContainers(tmpdir, ls, is, map[string]image.ID{
+		"2c5ac3f849df8627fcf2822727f87c57f38b7129d3604fbc11d861fe856ff093": imgID,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expected := []mountInfo{{
+		"f780ee3f80e66e9b432a57049597118a66aab8932be88e5628d4c824edbee37c",
+		"f780ee3f80e66e9b432a57049597118a66aab8932be88e5628d4c824edbee37c",
+		"sha256:c3191d32a37d7159b2e30830937d2e30268ad6c375a773a8994911a3aba9b93f",
+	}}
+	if !reflect.DeepEqual(expected, ls.mounts) {
+		t.Fatalf("invalid mounts: expected %q, got %q", expected, ls.mounts)
+	}
+
+	if actual, expected := ls.count, 0; actual != expected {
+		t.Fatalf("invalid active mounts: expected %d, got %d", expected, actual)
+	}
+
+	config2, err := ioutil.ReadFile(filepath.Join(tmpdir, "containers", "f780ee3f80e66e9b432a57049597118a66aab8932be88e5628d4c824edbee37c", "config.v2.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var config struct{ Image string }
+	err = json.Unmarshal(config2, &config)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if actual, expected := config.Image, string(imgID); actual != expected {
+		t.Fatalf("invalid image pointer in migrated config: expected %q, got %q", expected, actual)
+	}
+
+}
+
+func TestMigrateImages(t *testing.T) {
+	// TODO Windows: Figure out why this is failing
+	if runtime.GOOS == "windows" {
+		t.Skip("Failing on Windows")
+	}
+	if runtime.GOARCH != "amd64" {
+		t.Skip("Test tailored to amd64 architecture")
+	}
+	tmpdir, err := ioutil.TempDir("", "migrate-images")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(tmpdir)
+
+	// busybox from 1.9
+	id1, err := addImage(tmpdir, `{"architecture":"amd64","config":{"Hostname":"23304fc829f9","Domainname":"","User":"","AttachStdin":false,"AttachStdout":false,"AttachStderr":false,"Tty":false,"OpenStdin":false,"StdinOnce":false,"Env":null,"Cmd":null,"Image":"","Volumes":null,"WorkingDir":"","Entrypoint":null,"OnBuild":null,"Labels":null},"container":"23304fc829f9b9349416f6eb1afec162907eba3a328f51d53a17f8986f865d65","container_config":{"Hostname":"23304fc829f9","Domainname":"","User":"","AttachStdin":false,"AttachStdout":false,"AttachStderr":false,"Tty":false,"OpenStdin":false,"StdinOnce":false,"Env":null,"Cmd":["/bin/sh","-c","#(nop) ADD file:a3bc1e842b69636f9df5256c49c5374fb4eef1e281fe3f282c65fb853ee171c5 in /"],"Image":"","Volumes":null,"WorkingDir":"","Entrypoint":null,"OnBuild":null,"Labels":null},"created":"2015-10-31T22:22:54.690851953Z","docker_version":"1.8.2","layer_id":"sha256:55dc925c23d1ed82551fd018c27ac3ee731377b6bad3963a2a4e76e753d70e57","os":"linux"}`, "", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	id2, err := addImage(tmpdir, `{"architecture":"amd64","config":{"Hostname":"23304fc829f9","Domainname":"","User":"","AttachStdin":false,"AttachStdout":false,"AttachStderr":false,"Tty":false,"OpenStdin":false,"StdinOnce":false,"Env":null,"Cmd":["sh"],"Image":"d1592a710ac323612bd786fa8ac20727c58d8a67847e5a65177c594f43919498","Volumes":null,"WorkingDir":"","Entrypoint":null,"OnBuild":null,"Labels":null},"container":"349b014153779e30093d94f6df2a43c7a0a164e05aa207389917b540add39b51","container_config":{"Hostname":"23304fc829f9","Domainname":"","User":"","AttachStdin":false,"AttachStdout":false,"AttachStderr":false,"Tty":false,"OpenStdin":false,"StdinOnce":false,"Env":null,"Cmd":["/bin/sh","-c","#(nop) CMD [\"sh\"]"],"Image":"d1592a710ac323612bd786fa8ac20727c58d8a67847e5a65177c594f43919498","Volumes":null,"WorkingDir":"","Entrypoint":null,"OnBuild":null,"Labels":null},"created":"2015-10-31T22:22:55.613815829Z","docker_version":"1.8.2","layer_id":"sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4","os":"linux","parent_id":"sha256:039b63dd2cbaa10d6015ea574392530571ed8d7b174090f032211285a71881d0"}`, id1, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ifs, err := image.NewFSStoreBackend(filepath.Join(tmpdir, "imagedb"))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ls := &mockRegistrar{}
+	mrMap := make(map[string]image.LayerGetReleaser)
+	mrMap[runtime.GOOS] = ls
+	is, err := image.NewImageStore(ifs, mrMap)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ms, err := metadata.NewFSMetadataStore(filepath.Join(tmpdir, "distribution"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	mappings := make(map[string]image.ID)
+
+	err = migrateImages(tmpdir, ls, is, ms, mappings)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expected := map[string]image.ID{
+		id1: image.ID("sha256:ca406eaf9c26898414ff5b7b3a023c33310759d6203be0663dbf1b3a712f432d"),
+		id2: image.ID("sha256:a488bec94bb96b26a968f913d25ef7d8d204d727ca328b52b4b059c7d03260b6"),
+	}
+
+	if !reflect.DeepEqual(mappings, expected) {
+		t.Fatalf("invalid image mappings: expected %q, got %q", expected, mappings)
+	}
+
+	if actual, expected := ls.count, 2; actual != expected {
+		t.Fatalf("invalid register count: expected %q, got %q", expected, actual)
+	}
+	ls.count = 0
+
+	// next images are busybox from 1.8.2
+	_, err = addImage(tmpdir, `{"id":"17583c7dd0dae6244203b8029733bdb7d17fccbb2b5d93e2b24cf48b8bfd06e2","parent":"d1592a710ac323612bd786fa8ac20727c58d8a67847e5a65177c594f43919498","created":"2015-10-31T22:22:55.613815829Z","container":"349b014153779e30093d94f6df2a43c7a0a164e05aa207389917b540add39b51","container_config":{"Hostname":"23304fc829f9","Domainname":"","User":"","AttachStdin":false,"AttachStdout":false,"AttachStderr":false,"ExposedPorts":null,"PublishService":"","Tty":false,"OpenStdin":false,"StdinOnce":false,"Env":null,"Cmd":["/bin/sh","-c","#(nop) CMD [\"sh\"]"],"Image":"d1592a710ac323612bd786fa8ac20727c58d8a67847e5a65177c594f43919498","Volumes":null,"VolumeDriver":"","WorkingDir":"","Entrypoint":null,"NetworkDisabled":false,"MacAddress":"","OnBuild":null,"Labels":null},"docker_version":"1.8.2","config":{"Hostname":"23304fc829f9","Domainname":"","User":"","AttachStdin":false,"AttachStdout":false,"AttachStderr":false,"ExposedPorts":null,"PublishService":"","Tty":false,"OpenStdin":false,"StdinOnce":false,"Env":null,"Cmd":["sh"],"Image":"d1592a710ac323612bd786fa8ac20727c58d8a67847e5a65177c594f43919498","Volumes":null,"VolumeDriver":"","WorkingDir":"","Entrypoint":null,"NetworkDisabled":false,"MacAddress":"","OnBuild":null,"Labels":null},"architecture":"amd64","os":"linux","Size":0}`, "", "sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	_, err = addImage(tmpdir, `{"id":"d1592a710ac323612bd786fa8ac20727c58d8a67847e5a65177c594f43919498","created":"2015-10-31T22:22:54.690851953Z","container":"23304fc829f9b9349416f6eb1afec162907eba3a328f51d53a17f8986f865d65","container_config":{"Hostname":"23304fc829f9","Domainname":"","User":"","AttachStdin":false,"AttachStdout":false,"AttachStderr":false,"ExposedPorts":null,"PublishService":"","Tty":false,"OpenStdin":false,"StdinOnce":false,"Env":null,"Cmd":["/bin/sh","-c","#(nop) ADD file:a3bc1e842b69636f9df5256c49c5374fb4eef1e281fe3f282c65fb853ee171c5 in /"],"Image":"","Volumes":null,"VolumeDriver":"","WorkingDir":"","Entrypoint":null,"NetworkDisabled":false,"MacAddress":"","OnBuild":null,"Labels":null},"docker_version":"1.8.2","config":{"Hostname":"23304fc829f9","Domainname":"","User":"","AttachStdin":false,"AttachStdout":false,"AttachStderr":false,"ExposedPorts":null,"PublishService":"","Tty":false,"OpenStdin":false,"StdinOnce":false,"Env":null,"Cmd":null,"Image":"","Volumes":null,"VolumeDriver":"","WorkingDir":"","Entrypoint":null,"NetworkDisabled":false,"MacAddress":"","OnBuild":null,"Labels":null},"architecture":"amd64","os":"linux","Size":1108935}`, "", "sha256:55dc925c23d1ed82551fd018c27ac3ee731377b6bad3963a2a4e76e753d70e57")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = migrateImages(tmpdir, ls, is, ms, mappings)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expected["d1592a710ac323612bd786fa8ac20727c58d8a67847e5a65177c594f43919498"] = image.ID("sha256:c091bb33854e57e6902b74c08719856d30b5593c7db6143b2b48376b8a588395")
+	expected["17583c7dd0dae6244203b8029733bdb7d17fccbb2b5d93e2b24cf48b8bfd06e2"] = image.ID("sha256:d963020e755ff2715b936065949472c1f8a6300144b922992a1a421999e71f07")
+
+	if actual, expected := ls.count, 2; actual != expected {
+		t.Fatalf("invalid register count: expected %q, got %q", expected, actual)
+	}
+
+	v2MetadataService := metadata.NewV2MetadataService(ms)
+	receivedMetadata, err := v2MetadataService.GetMetadata(layer.EmptyLayer.DiffID())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expectedMetadata := []metadata.V2Metadata{
+		{Digest: digest.Digest("sha256:55dc925c23d1ed82551fd018c27ac3ee731377b6bad3963a2a4e76e753d70e57")},
+		{Digest: digest.Digest("sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4")},
+	}
+
+	if !reflect.DeepEqual(expectedMetadata, receivedMetadata) {
+		t.Fatalf("invalid metadata: expected %q, got %q", expectedMetadata, receivedMetadata)
+	}
+
+}
+
+func TestMigrateUnsupported(t *testing.T) {
+	tmpdir, err := ioutil.TempDir("", "migrate-empty")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(tmpdir)
+
+	err = os.MkdirAll(filepath.Join(tmpdir, "graph"), 0700)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = Migrate(tmpdir, "generic", nil, nil, nil, nil)
+	if err != errUnsupported {
+		t.Fatalf("expected unsupported error, got %q", err)
+	}
+}
+
+func TestMigrateEmptyDir(t *testing.T) {
+	tmpdir, err := ioutil.TempDir("", "migrate-empty")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(tmpdir)
+
+	err = Migrate(tmpdir, "generic", nil, nil, nil, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func addImage(dest, jsonConfig, parent, checksum string) (string, error) {
+	var config struct{ ID string }
+	if err := json.Unmarshal([]byte(jsonConfig), &config); err != nil {
+		return "", err
+	}
+	if config.ID == "" {
+		b := make([]byte, 32)
+		rand.Read(b)
+		config.ID = hex.EncodeToString(b)
+	}
+	contDir := filepath.Join(dest, "graph", config.ID)
+	if err := os.MkdirAll(contDir, 0700); err != nil {
+		return "", err
+	}
+	if err := ioutil.WriteFile(filepath.Join(contDir, "json"), []byte(jsonConfig), 0600); err != nil {
+		return "", err
+	}
+	if checksum != "" {
+		if err := ioutil.WriteFile(filepath.Join(contDir, "checksum"), []byte(checksum), 0600); err != nil {
+			return "", err
+		}
+	}
+	if err := ioutil.WriteFile(filepath.Join(contDir, ".migration-diffid"), []byte(layer.EmptyLayer.DiffID()), 0600); err != nil {
+		return "", err
+	}
+	if err := ioutil.WriteFile(filepath.Join(contDir, ".migration-size"), []byte("0"), 0600); err != nil {
+		return "", err
+	}
+	if parent != "" {
+		if err := ioutil.WriteFile(filepath.Join(contDir, "parent"), []byte(parent), 0600); err != nil {
+			return "", err
+		}
+	}
+	if checksum != "" {
+		if err := ioutil.WriteFile(filepath.Join(contDir, "checksum"), []byte(checksum), 0600); err != nil {
+			return "", err
+		}
+	}
+	return config.ID, nil
+}
+
+func addContainer(dest, jsonConfig string) error {
+	var config struct{ ID string }
+	if err := json.Unmarshal([]byte(jsonConfig), &config); err != nil {
+		return err
+	}
+	contDir := filepath.Join(dest, "containers", config.ID)
+	if err := os.MkdirAll(contDir, 0700); err != nil {
+		return err
+	}
+	return ioutil.WriteFile(filepath.Join(contDir, "config.json"), []byte(jsonConfig), 0600)
+}
+
+type mockTagAdder struct {
+	refs map[string]string
+}
+
+func (t *mockTagAdder) AddTag(ref reference.Named, id digest.Digest, force bool) error {
+	if t.refs == nil {
+		t.refs = make(map[string]string)
+	}
+	t.refs[ref.String()] = id.String()
+	return nil
+}
+func (t *mockTagAdder) AddDigest(ref reference.Canonical, id digest.Digest, force bool) error {
+	return t.AddTag(ref, id, force)
+}
+
+type mockRegistrar struct {
+	layers map[layer.ChainID]*mockLayer
+	count  int
+}
+
+func (r *mockRegistrar) RegisterByGraphID(graphID string, parent layer.ChainID, diffID layer.DiffID, tarDataFile string, size int64) (layer.Layer, error) {
+	r.count++
+	l := &mockLayer{}
+	if parent != "" {
+		p, exists := r.layers[parent]
+		if !exists {
+			return nil, fmt.Errorf("invalid parent %q", parent)
+		}
+		l.parent = p
+		l.diffIDs = append(l.diffIDs, p.diffIDs...)
+	}
+	l.diffIDs = append(l.diffIDs, diffID)
+	if r.layers == nil {
+		r.layers = make(map[layer.ChainID]*mockLayer)
+	}
+	r.layers[l.ChainID()] = l
+	return l, nil
+}
+func (r *mockRegistrar) Release(l layer.Layer) ([]layer.Metadata, error) {
+	return nil, nil
+}
+func (r *mockRegistrar) Get(layer.ChainID) (layer.Layer, error) {
+	return nil, nil
+}
+
+type mountInfo struct {
+	name, graphID, parent string
+}
+type mockMounter struct {
+	mounts []mountInfo
+	count  int
+}
+
+func (r *mockMounter) CreateRWLayerByGraphID(name string, graphID string, parent layer.ChainID) error {
+	r.mounts = append(r.mounts, mountInfo{name, graphID, string(parent)})
+	return nil
+}
+func (r *mockMounter) Unmount(string) error {
+	r.count--
+	return nil
+}
+func (r *mockMounter) Get(layer.ChainID) (layer.Layer, error) {
+	return nil, nil
+}
+
+func (r *mockMounter) Release(layer.Layer) ([]layer.Metadata, error) {
+	return nil, nil
+}
+
+type mockLayer struct {
+	diffIDs []layer.DiffID
+	parent  *mockLayer
+}
+
+func (l *mockLayer) TarStream() (io.ReadCloser, error) {
+	return nil, nil
+}
+func (l *mockLayer) TarStreamFrom(layer.ChainID) (io.ReadCloser, error) {
+	return nil, nil
+}
+
+func (l *mockLayer) ChainID() layer.ChainID {
+	return layer.CreateChainID(l.diffIDs)
+}
+
+func (l *mockLayer) DiffID() layer.DiffID {
+	return l.diffIDs[len(l.diffIDs)-1]
+}
+
+func (l *mockLayer) Parent() layer.Layer {
+	if l.parent == nil {
+		return nil
+	}
+	return l.parent
+}
+
+func (l *mockLayer) Size() (int64, error) {
+	return 0, nil
+}
+
+func (l *mockLayer) DiffSize() (int64, error) {
+	return 0, nil
+}
+
+func (l *mockLayer) Metadata() (map[string]string, error) {
+	return nil, nil
+}
diff --git a/vendor/github.com/docker/docker/opts/hosts_test.go b/vendor/github.com/docker/docker/opts/hosts_test.go
index e46326a5b..cd8c3f91f 100644
--- a/vendor/github.com/docker/docker/opts/hosts_test.go
+++ b/vendor/github.com/docker/docker/opts/hosts_test.go
@@ -69,18 +69,18 @@ func TestParseDockerDaemonHost(t *testing.T) {
 		"[::1]:5555/path":             "tcp://[::1]:5555/path",
 		"[0:0:0:0:0:0:0:1]:":          "tcp://[0:0:0:0:0:0:0:1]:2375",
 		"[0:0:0:0:0:0:0:1]:5555/path": "tcp://[0:0:0:0:0:0:0:1]:5555/path",
-		":6666":                       fmt.Sprintf("tcp://%s:6666", DefaultHTTPHost),
-		":6666/path":                  fmt.Sprintf("tcp://%s:6666/path", DefaultHTTPHost),
-		"tcp://":                      DefaultTCPHost,
-		"tcp://:7777":                 fmt.Sprintf("tcp://%s:7777", DefaultHTTPHost),
-		"tcp://:7777/path":            fmt.Sprintf("tcp://%s:7777/path", DefaultHTTPHost),
-		"unix:///run/docker.sock":     "unix:///run/docker.sock",
-		"unix://":                     "unix://" + DefaultUnixSocket,
-		"fd://":                       "fd://",
-		"fd://something":              "fd://something",
-		"localhost:":                  "tcp://localhost:2375",
-		"localhost:5555":              "tcp://localhost:5555",
-		"localhost:5555/path":         "tcp://localhost:5555/path",
+		":6666":                   fmt.Sprintf("tcp://%s:6666", DefaultHTTPHost),
+		":6666/path":              fmt.Sprintf("tcp://%s:6666/path", DefaultHTTPHost),
+		"tcp://":                  DefaultTCPHost,
+		"tcp://:7777":             fmt.Sprintf("tcp://%s:7777", DefaultHTTPHost),
+		"tcp://:7777/path":        fmt.Sprintf("tcp://%s:7777/path", DefaultHTTPHost),
+		"unix:///run/docker.sock": "unix:///run/docker.sock",
+		"unix://":                 "unix://" + DefaultUnixSocket,
+		"fd://":                   "fd://",
+		"fd://something":          "fd://something",
+		"localhost:":              "tcp://localhost:2375",
+		"localhost:5555":          "tcp://localhost:5555",
+		"localhost:5555/path":     "tcp://localhost:5555/path",
 	}
 	for invalidAddr, expectedError := range invalids {
 		if addr, err := parseDaemonHost(invalidAddr); err == nil || err.Error() != expectedError {
diff --git a/vendor/github.com/docker/docker/pkg/archive/archive.go b/vendor/github.com/docker/docker/pkg/archive/archive.go
index bb623fa85..070dccb75 100644
--- a/vendor/github.com/docker/docker/pkg/archive/archive.go
+++ b/vendor/github.com/docker/docker/pkg/archive/archive.go
@@ -660,13 +660,11 @@ func createTarFile(path, extractDir string, hdr *tar.Header, reader io.Reader, L
 	var errors []string
 	for key, value := range hdr.Xattrs {
 		if err := system.Lsetxattr(path, key, []byte(value), 0); err != nil {
-			if err == syscall.ENOTSUP || err == syscall.EPERM {
+			if err == syscall.ENOTSUP {
 				// We ignore errors here because not all graphdrivers support
 				// xattrs *cough* old versions of AUFS *cough*. However only
 				// ENOTSUP should be emitted in that case, otherwise we still
 				// bail.
-				// EPERM occurs if modifying xattrs is not allowed. This can
-				// happen when running in userns with restrictions (ChromeOS).
 				errors = append(errors, err.Error())
 				continue
 			}
@@ -745,7 +743,7 @@ func TarWithOptions(srcPath string, options *TarOptions) (io.ReadCloser, error)
 			compressWriter,
 			options.ChownOpts,
 		)
-		ta.WhiteoutConverter = getWhiteoutConverter(options.WhiteoutFormat, options.InUserNS)
+		ta.WhiteoutConverter = getWhiteoutConverter(options.WhiteoutFormat)
 
 		defer func() {
 			// Make sure to check the error on Close.
@@ -903,7 +901,7 @@ func Unpack(decompressedArchive io.Reader, dest string, options *TarOptions) err
 	var dirs []*tar.Header
 	idMapping := idtools.NewIDMappingsFromMaps(options.UIDMaps, options.GIDMaps)
 	rootIDs := idMapping.RootPair()
-	whiteoutConverter := getWhiteoutConverter(options.WhiteoutFormat, options.InUserNS)
+	whiteoutConverter := getWhiteoutConverter(options.WhiteoutFormat)
 
 	// Iterate through the files in the archive.
 loop:
diff --git a/vendor/github.com/docker/docker/pkg/archive/archive_linux.go b/vendor/github.com/docker/docker/pkg/archive/archive_linux.go
index 0601f7b0d..970d4d068 100644
--- a/vendor/github.com/docker/docker/pkg/archive/archive_linux.go
+++ b/vendor/github.com/docker/docker/pkg/archive/archive_linux.go
@@ -2,29 +2,22 @@ package archive // import "github.com/docker/docker/pkg/archive"
 
 import (
 	"archive/tar"
-	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
-	"syscall"
 
-	"github.com/containerd/continuity/fs"
 	"github.com/docker/docker/pkg/system"
-	"github.com/pkg/errors"
 	"golang.org/x/sys/unix"
 )
 
-func getWhiteoutConverter(format WhiteoutFormat, inUserNS bool) tarWhiteoutConverter {
+func getWhiteoutConverter(format WhiteoutFormat) tarWhiteoutConverter {
 	if format == OverlayWhiteoutFormat {
-		return overlayWhiteoutConverter{inUserNS: inUserNS}
+		return overlayWhiteoutConverter{}
 	}
 	return nil
 }
 
-type overlayWhiteoutConverter struct {
-	inUserNS bool
-}
+type overlayWhiteoutConverter struct{}
 
 func (overlayWhiteoutConverter) ConvertWrite(hdr *tar.Header, path string, fi os.FileInfo) (wo *tar.Header, err error) {
 	// convert whiteouts to AUFS format
@@ -68,22 +61,13 @@ func (overlayWhiteoutConverter) ConvertWrite(hdr *tar.Header, path string, fi os
 	return
 }
 
-func (c overlayWhiteoutConverter) ConvertRead(hdr *tar.Header, path string) (bool, error) {
+func (overlayWhiteoutConverter) ConvertRead(hdr *tar.Header, path string) (bool, error) {
 	base := filepath.Base(path)
 	dir := filepath.Dir(path)
 
 	// if a directory is marked as opaque by the AUFS special file, we need to translate that to overlay
 	if base == WhiteoutOpaqueDir {
 		err := unix.Setxattr(dir, "trusted.overlay.opaque", []byte{'y'}, 0)
-		if err != nil {
-			if c.inUserNS {
-				if err = replaceDirWithOverlayOpaque(dir); err != nil {
-					return false, errors.Wrapf(err, "replaceDirWithOverlayOpaque(%q) failed", dir)
-				}
-			} else {
-				return false, errors.Wrapf(err, "setxattr(%q, trusted.overlay.opaque=y)", dir)
-			}
-		}
 		// don't write the file itself
 		return false, err
 	}
@@ -94,19 +78,7 @@ func (c overlayWhiteoutConverter) ConvertRead(hdr *tar.Header, path string) (boo
 		originalPath := filepath.Join(dir, originalBase)
 
 		if err := unix.Mknod(originalPath, unix.S_IFCHR, 0); err != nil {
-			if c.inUserNS {
-				// Ubuntu and a few distros support overlayfs in userns.
-				//
-				// Although we can't call mknod directly in userns (at least on bionic kernel 4.15),
-				// we can still create 0,0 char device using mknodChar0Overlay().
-				//
-				// NOTE: we don't need this hack for the containerd snapshotter+unpack model.
-				if err := mknodChar0Overlay(originalPath); err != nil {
-					return false, errors.Wrapf(err, "failed to mknodChar0UserNS(%q)", originalPath)
-				}
-			} else {
-				return false, errors.Wrapf(err, "failed to mknod(%q, S_IFCHR, 0)", originalPath)
-			}
+			return false, err
 		}
 		if err := os.Chown(originalPath, hdr.Uid, hdr.Gid); err != nil {
 			return false, err
@@ -118,144 +90,3 @@ func (c overlayWhiteoutConverter) ConvertRead(hdr *tar.Header, path string) (boo
 
 	return true, nil
 }
-
-// mknodChar0Overlay creates 0,0 char device by mounting overlayfs and unlinking.
-// This function can be used for creating 0,0 char device in userns on Ubuntu.
-//
-// Steps:
-// * Mkdir lower,upper,merged,work
-// * Create lower/dummy
-// * Mount overlayfs
-// * Unlink merged/dummy
-// * Unmount overlayfs
-// * Make sure a 0,0 char device is created as upper/dummy
-// * Rename upper/dummy to cleansedOriginalPath
-func mknodChar0Overlay(cleansedOriginalPath string) error {
-	dir := filepath.Dir(cleansedOriginalPath)
-	tmp, err := ioutil.TempDir(dir, "mc0o")
-	if err != nil {
-		return errors.Wrapf(err, "failed to create a tmp directory under %s", dir)
-	}
-	defer os.RemoveAll(tmp)
-	lower := filepath.Join(tmp, "l")
-	upper := filepath.Join(tmp, "u")
-	work := filepath.Join(tmp, "w")
-	merged := filepath.Join(tmp, "m")
-	for _, s := range []string{lower, upper, work, merged} {
-		if err := os.MkdirAll(s, 0700); err != nil {
-			return errors.Wrapf(err, "failed to mkdir %s", s)
-		}
-	}
-	dummyBase := "d"
-	lowerDummy := filepath.Join(lower, dummyBase)
-	if err := ioutil.WriteFile(lowerDummy, []byte{}, 0600); err != nil {
-		return errors.Wrapf(err, "failed to create a dummy lower file %s", lowerDummy)
-	}
-	mOpts := fmt.Sprintf("lowerdir=%s,upperdir=%s,workdir=%s", lower, upper, work)
-	// docker/pkg/mount.Mount() requires procfs to be mounted. So we use syscall.Mount() directly instead.
-	if err := syscall.Mount("overlay", merged, "overlay", uintptr(0), mOpts); err != nil {
-		return errors.Wrapf(err, "failed to mount overlay (%s) on %s", mOpts, merged)
-	}
-	mergedDummy := filepath.Join(merged, dummyBase)
-	if err := os.Remove(mergedDummy); err != nil {
-		syscall.Unmount(merged, 0)
-		return errors.Wrapf(err, "failed to unlink %s", mergedDummy)
-	}
-	if err := syscall.Unmount(merged, 0); err != nil {
-		return errors.Wrapf(err, "failed to unmount %s", merged)
-	}
-	upperDummy := filepath.Join(upper, dummyBase)
-	if err := isChar0(upperDummy); err != nil {
-		return err
-	}
-	if err := os.Rename(upperDummy, cleansedOriginalPath); err != nil {
-		return errors.Wrapf(err, "failed to rename %s to %s", upperDummy, cleansedOriginalPath)
-	}
-	return nil
-}
-
-func isChar0(path string) error {
-	osStat, err := os.Stat(path)
-	if err != nil {
-		return errors.Wrapf(err, "failed to stat %s", path)
-	}
-	st, ok := osStat.Sys().(*syscall.Stat_t)
-	if !ok {
-		return errors.Errorf("got unsupported stat for %s", path)
-	}
-	if os.FileMode(st.Mode)&syscall.S_IFMT != syscall.S_IFCHR {
-		return errors.Errorf("%s is not a character device, got mode=%d", path, st.Mode)
-	}
-	if st.Rdev != 0 {
-		return errors.Errorf("%s is not a 0,0 character device, got Rdev=%d", path, st.Rdev)
-	}
-	return nil
-}
-
-// replaceDirWithOverlayOpaque replaces path with a new directory with trusted.overlay.opaque
-// xattr. The contents of the directory are preserved.
-func replaceDirWithOverlayOpaque(path string) error {
-	if path == "/" {
-		return errors.New("replaceDirWithOverlayOpaque: path must not be \"/\"")
-	}
-	dir := filepath.Dir(path)
-	tmp, err := ioutil.TempDir(dir, "rdwoo")
-	if err != nil {
-		return errors.Wrapf(err, "failed to create a tmp directory under %s", dir)
-	}
-	defer os.RemoveAll(tmp)
-	// newPath is a new empty directory crafted with trusted.overlay.opaque xattr.
-	// we copy the content of path into newPath, remove path, and rename newPath to path.
-	newPath, err := createDirWithOverlayOpaque(tmp)
-	if err != nil {
-		return errors.Wrapf(err, "createDirWithOverlayOpaque(%q) failed", tmp)
-	}
-	if err := fs.CopyDir(newPath, path); err != nil {
-		return errors.Wrapf(err, "CopyDir(%q, %q) failed", newPath, path)
-	}
-	if err := os.RemoveAll(path); err != nil {
-		return err
-	}
-	return os.Rename(newPath, path)
-}
-
-// createDirWithOverlayOpaque creates a directory with trusted.overlay.opaque xattr,
-// without calling setxattr, so as to allow creating opaque dir in userns on Ubuntu.
-func createDirWithOverlayOpaque(tmp string) (string, error) {
-	lower := filepath.Join(tmp, "l")
-	upper := filepath.Join(tmp, "u")
-	work := filepath.Join(tmp, "w")
-	merged := filepath.Join(tmp, "m")
-	for _, s := range []string{lower, upper, work, merged} {
-		if err := os.MkdirAll(s, 0700); err != nil {
-			return "", errors.Wrapf(err, "failed to mkdir %s", s)
-		}
-	}
-	dummyBase := "d"
-	lowerDummy := filepath.Join(lower, dummyBase)
-	if err := os.MkdirAll(lowerDummy, 0700); err != nil {
-		return "", errors.Wrapf(err, "failed to create a dummy lower directory %s", lowerDummy)
-	}
-	mOpts := fmt.Sprintf("lowerdir=%s,upperdir=%s,workdir=%s", lower, upper, work)
-	// docker/pkg/mount.Mount() requires procfs to be mounted. So we use syscall.Mount() directly instead.
-	if err := syscall.Mount("overlay", merged, "overlay", uintptr(0), mOpts); err != nil {
-		return "", errors.Wrapf(err, "failed to mount overlay (%s) on %s", mOpts, merged)
-	}
-	mergedDummy := filepath.Join(merged, dummyBase)
-	if err := os.Remove(mergedDummy); err != nil {
-		syscall.Unmount(merged, 0)
-		return "", errors.Wrapf(err, "failed to rmdir %s", mergedDummy)
-	}
-	// upperDummy becomes a 0,0-char device file here
-	if err := os.Mkdir(mergedDummy, 0700); err != nil {
-		syscall.Unmount(merged, 0)
-		return "", errors.Wrapf(err, "failed to mkdir %s", mergedDummy)
-	}
-	// upperDummy becomes a directory with trusted.overlay.opaque xattr
-	// (but can't be verified in userns)
-	if err := syscall.Unmount(merged, 0); err != nil {
-		return "", errors.Wrapf(err, "failed to unmount %s", merged)
-	}
-	upperDummy := filepath.Join(upper, dummyBase)
-	return upperDummy, nil
-}
diff --git a/vendor/github.com/docker/docker/pkg/archive/archive_linux_test.go b/vendor/github.com/docker/docker/pkg/archive/archive_linux_test.go
index 8fdcb34b5..9422269df 100644
--- a/vendor/github.com/docker/docker/pkg/archive/archive_linux_test.go
+++ b/vendor/github.com/docker/docker/pkg/archive/archive_linux_test.go
@@ -1,18 +1,13 @@
 package archive // import "github.com/docker/docker/pkg/archive"
 
 import (
-	"fmt"
 	"io/ioutil"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"syscall"
 	"testing"
 
-	"github.com/docker/docker/pkg/reexec"
 	"github.com/docker/docker/pkg/system"
-	rsystem "github.com/opencontainers/runc/libcontainer/system"
-	"github.com/pkg/errors"
 	"golang.org/x/sys/unix"
 	"gotest.tools/assert"
 	"gotest.tools/skip"
@@ -29,7 +24,6 @@ import (
 //     └── f1 # whiteout, 0644
 func setupOverlayTestDir(t *testing.T, src string) {
 	skip.If(t, os.Getuid() != 0, "skipping test that requires root")
-	skip.If(t, rsystem.RunningInUserNS(), "skipping test that requires initial userns (trusted.overlay.opaque xattr cannot be set in userns, even with Ubuntu kernel)")
 	// Create opaque directory containing single file and permission 0700
 	err := os.Mkdir(filepath.Join(src, "d1"), 0700)
 	assert.NilError(t, err)
@@ -166,129 +160,3 @@ func TestOverlayTarAUFSUntar(t *testing.T) {
 	checkFileMode(t, filepath.Join(dst, "d2", "f1"), 0660)
 	checkFileMode(t, filepath.Join(dst, "d3", WhiteoutPrefix+"f1"), 0600)
 }
-
-func unshareCmd(cmd *exec.Cmd) {
-	cmd.SysProcAttr = &syscall.SysProcAttr{
-		Cloneflags: syscall.CLONE_NEWUSER | syscall.CLONE_NEWNS,
-		UidMappings: []syscall.SysProcIDMap{
-			{
-				ContainerID: 0,
-				HostID:      os.Geteuid(),
-				Size:        1,
-			},
-		},
-		GidMappings: []syscall.SysProcIDMap{
-			{
-				ContainerID: 0,
-				HostID:      os.Getegid(),
-				Size:        1,
-			},
-		},
-	}
-}
-
-const (
-	reexecSupportsUserNSOverlay = "docker-test-supports-userns-overlay"
-	reexecMknodChar0            = "docker-test-userns-mknod-char0"
-	reexecSetOpaque             = "docker-test-userns-set-opaque"
-)
-
-func supportsOverlay(dir string) error {
-	lower := filepath.Join(dir, "l")
-	upper := filepath.Join(dir, "u")
-	work := filepath.Join(dir, "w")
-	merged := filepath.Join(dir, "m")
-	for _, s := range []string{lower, upper, work, merged} {
-		if err := os.MkdirAll(s, 0700); err != nil {
-			return err
-		}
-	}
-	mOpts := fmt.Sprintf("lowerdir=%s,upperdir=%s,workdir=%s", lower, upper, work)
-	if err := syscall.Mount("overlay", merged, "overlay", uintptr(0), mOpts); err != nil {
-		return errors.Wrapf(err, "failed to mount overlay (%s) on %s", mOpts, merged)
-	}
-	if err := syscall.Unmount(merged, 0); err != nil {
-		return errors.Wrapf(err, "failed to unmount %s", merged)
-	}
-	return nil
-}
-
-// supportsUserNSOverlay returns nil error if overlay is supported in userns.
-// Only Ubuntu and a few distros support overlay in userns (by patching the kernel).
-// https://lists.ubuntu.com/archives/kernel-team/2014-February/038091.html
-// As of kernel 4.19, the patch is not merged to the upstream.
-func supportsUserNSOverlay() error {
-	tmp, err := ioutil.TempDir("", "docker-test-supports-userns-overlay")
-	if err != nil {
-		return err
-	}
-	defer os.RemoveAll(tmp)
-	cmd := reexec.Command(reexecSupportsUserNSOverlay, tmp)
-	unshareCmd(cmd)
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		return errors.Wrapf(err, "output: %q", string(out))
-	}
-	return nil
-}
-
-// isOpaque returns nil error if the dir has trusted.overlay.opaque=y.
-// isOpaque needs to be called in the initial userns.
-func isOpaque(dir string) error {
-	xattrOpaque, err := system.Lgetxattr(dir, "trusted.overlay.opaque")
-	if err != nil {
-		return errors.Wrapf(err, "failed to read opaque flag of %s", dir)
-	}
-	if string(xattrOpaque) != "y" {
-		return errors.Errorf("expected \"y\", got %q", string(xattrOpaque))
-	}
-	return nil
-}
-
-func TestReexecUserNSOverlayWhiteoutConverter(t *testing.T) {
-	skip.If(t, os.Getuid() != 0, "skipping test that requires root")
-	skip.If(t, rsystem.RunningInUserNS(), "skipping test that requires initial userns")
-	if err := supportsUserNSOverlay(); err != nil {
-		t.Skipf("skipping test that requires kernel support for overlay-in-userns: %v", err)
-	}
-	tmp, err := ioutil.TempDir("", "docker-test-userns-overlay")
-	assert.NilError(t, err)
-	defer os.RemoveAll(tmp)
-
-	char0 := filepath.Join(tmp, "char0")
-	cmd := reexec.Command(reexecMknodChar0, char0)
-	unshareCmd(cmd)
-	out, err := cmd.CombinedOutput()
-	assert.NilError(t, err, string(out))
-	assert.NilError(t, isChar0(char0))
-
-	opaqueDir := filepath.Join(tmp, "opaquedir")
-	err = os.MkdirAll(opaqueDir, 0755)
-	assert.NilError(t, err, string(out))
-	cmd = reexec.Command(reexecSetOpaque, opaqueDir)
-	unshareCmd(cmd)
-	out, err = cmd.CombinedOutput()
-	assert.NilError(t, err, string(out))
-	assert.NilError(t, isOpaque(opaqueDir))
-}
-
-func init() {
-	reexec.Register(reexecSupportsUserNSOverlay, func() {
-		if err := supportsOverlay(os.Args[1]); err != nil {
-			panic(err)
-		}
-	})
-	reexec.Register(reexecMknodChar0, func() {
-		if err := mknodChar0Overlay(os.Args[1]); err != nil {
-			panic(err)
-		}
-	})
-	reexec.Register(reexecSetOpaque, func() {
-		if err := replaceDirWithOverlayOpaque(os.Args[1]); err != nil {
-			panic(err)
-		}
-	})
-	if reexec.Init() {
-		os.Exit(0)
-	}
-}
diff --git a/vendor/github.com/docker/docker/pkg/archive/archive_other.go b/vendor/github.com/docker/docker/pkg/archive/archive_other.go
index 65a73354c..462dfc632 100644
--- a/vendor/github.com/docker/docker/pkg/archive/archive_other.go
+++ b/vendor/github.com/docker/docker/pkg/archive/archive_other.go
@@ -2,6 +2,6 @@
 
 package archive // import "github.com/docker/docker/pkg/archive"
 
-func getWhiteoutConverter(format WhiteoutFormat, inUserNS bool) tarWhiteoutConverter {
+func getWhiteoutConverter(format WhiteoutFormat) tarWhiteoutConverter {
 	return nil
 }
diff --git a/vendor/github.com/docker/docker/pkg/archive/archive_test.go b/vendor/github.com/docker/docker/pkg/archive/archive_test.go
index b49ad6723..b448bac49 100644
--- a/vendor/github.com/docker/docker/pkg/archive/archive_test.go
+++ b/vendor/github.com/docker/docker/pkg/archive/archive_test.go
@@ -18,7 +18,6 @@ import (
 
 	"github.com/docker/docker/pkg/idtools"
 	"github.com/docker/docker/pkg/ioutils"
-	rsystem "github.com/opencontainers/runc/libcontainer/system"
 	"gotest.tools/assert"
 	is "gotest.tools/assert/cmp"
 	"gotest.tools/skip"
@@ -306,7 +305,7 @@ func TestUntarPathWithInvalidSrc(t *testing.T) {
 }
 
 func TestUntarPath(t *testing.T) {
-	skip.If(t, runtime.GOOS != "windows" && os.Getuid() != 0, "skipping test that requires root")
+	skip.If(t, os.Getuid() != 0, "skipping test that requires root")
 	tmpFolder, err := ioutil.TempDir("", "docker-archive-test")
 	assert.NilError(t, err)
 	defer os.RemoveAll(tmpFolder)
@@ -437,7 +436,7 @@ func TestCopyWithTarInvalidSrc(t *testing.T) {
 }
 
 func TestCopyWithTarInexistentDestWillCreateIt(t *testing.T) {
-	skip.If(t, runtime.GOOS != "windows" && os.Getuid() != 0, "skipping test that requires root")
+	skip.If(t, os.Getuid() != 0, "skipping test that requires root")
 	tempFolder, err := ioutil.TempDir("", "docker-archive-test")
 	if err != nil {
 		t.Fatal(nil)
@@ -609,6 +608,10 @@ func TestCopyFileWithTarSrcFile(t *testing.T) {
 }
 
 func TestTarFiles(t *testing.T) {
+	// TODO Windows: Figure out how to port this test.
+	if runtime.GOOS == "windows" {
+		t.Skip("Failing on Windows")
+	}
 	// try without hardlinks
 	if err := checkNoChanges(1000, false); err != nil {
 		t.Fatal(err)
@@ -687,6 +690,10 @@ func tarUntar(t *testing.T, origin string, options *TarOptions) ([]Change, error
 }
 
 func TestTarUntar(t *testing.T) {
+	// TODO Windows: Figure out how to fix this test.
+	if runtime.GOOS == "windows" {
+		t.Skip("Failing on Windows")
+	}
 	origin, err := ioutil.TempDir("", "docker-test-untar-origin")
 	if err != nil {
 		t.Fatal(err)
@@ -715,7 +722,7 @@ func TestTarUntar(t *testing.T) {
 			t.Fatalf("Error tar/untar for compression %s: %s", c.Extension(), err)
 		}
 
-		if len(changes) != 1 || changes[0].Path != string(filepath.Separator)+"3" {
+		if len(changes) != 1 || changes[0].Path != "/3" {
 			t.Fatalf("Unexpected differences after tarUntar: %v", changes)
 		}
 	}
@@ -773,6 +780,10 @@ func TestTarWithOptionsChownOptsAlwaysOverridesIdPair(t *testing.T) {
 }
 
 func TestTarWithOptions(t *testing.T) {
+	// TODO Windows: Figure out how to fix this test.
+	if runtime.GOOS == "windows" {
+		t.Skip("Failing on Windows")
+	}
 	origin, err := ioutil.TempDir("", "docker-test-untar-origin")
 	if err != nil {
 		t.Fatal(err)
@@ -931,6 +942,10 @@ func BenchmarkTarUntarWithLinks(b *testing.B) {
 }
 
 func TestUntarInvalidFilenames(t *testing.T) {
+	// TODO Windows: Figure out how to fix this test.
+	if runtime.GOOS == "windows" {
+		t.Skip("Passes but hits breakoutError: platform and architecture is not supported")
+	}
 	for i, headers := range [][]*tar.Header{
 		{
 			{
@@ -955,7 +970,9 @@ func TestUntarInvalidFilenames(t *testing.T) {
 }
 
 func TestUntarHardlinkToSymlink(t *testing.T) {
-	skip.If(t, runtime.GOOS != "windows" && os.Getuid() != 0, "skipping test that requires root")
+	// TODO Windows. There may be a way of running this, but turning off for now
+	skip.If(t, runtime.GOOS == "windows", "hardlinks on Windows")
+	skip.If(t, os.Getuid() != 0, "skipping test that requires root")
 	for i, headers := range [][]*tar.Header{
 		{
 			{
@@ -984,6 +1001,10 @@ func TestUntarHardlinkToSymlink(t *testing.T) {
 }
 
 func TestUntarInvalidHardlink(t *testing.T) {
+	// TODO Windows. There may be a way of running this, but turning off for now
+	if runtime.GOOS == "windows" {
+		t.Skip("hardlinks on Windows")
+	}
 	for i, headers := range [][]*tar.Header{
 		{ // try reading victim/hello (../)
 			{
@@ -1064,6 +1085,10 @@ func TestUntarInvalidHardlink(t *testing.T) {
 }
 
 func TestUntarInvalidSymlink(t *testing.T) {
+	// TODO Windows. There may be a way of running this, but turning off for now
+	if runtime.GOOS == "windows" {
+		t.Skip("hardlinks on Windows")
+	}
 	for i, headers := range [][]*tar.Header{
 		{ // try reading victim/hello (../)
 			{
@@ -1229,8 +1254,7 @@ func TestReplaceFileTarWrapper(t *testing.T) {
 // TestPrefixHeaderReadable tests that files that could be created with the
 // version of this package that was built with <=go17 are still readable.
 func TestPrefixHeaderReadable(t *testing.T) {
-	skip.If(t, runtime.GOOS != "windows" && os.Getuid() != 0, "skipping test that requires root")
-	skip.If(t, rsystem.RunningInUserNS(), "skipping test that requires more than 010000000 UIDs, which is unlikely to be satisfied when running in userns")
+	skip.If(t, os.Getuid() != 0, "skipping test that requires root")
 	// https://gist.github.com/stevvooe/e2a790ad4e97425896206c0816e1a882#file-out-go
 	var testFile = []byte("\x1f\x8b\x08\x08\x44\x21\x68\x59\x00\x03\x74\x2e\x74\x61\x72\x00\x4b\xcb\xcf\x67\xa0\x35\x30\x80\x00\x86\x06\x10\x47\x01\xc1\x37\x40\x00\x54\xb6\xb1\xa1\xa9\x99\x09\x48\x25\x1d\x40\x69\x71\x49\x62\x91\x02\xe5\x76\xa1\x79\x84\x21\x91\xd6\x80\x72\xaf\x8f\x82\x51\x30\x0a\x46\x36\x00\x00\xf0\x1c\x1e\x95\x00\x06\x00\x00")
 
@@ -1288,7 +1312,7 @@ func appendModifier(path string, header *tar.Header, content io.Reader) (*tar.He
 }
 
 func readFileFromArchive(t *testing.T, archive io.ReadCloser, name string, expectedCount int, doc string) string {
-	skip.If(t, runtime.GOOS != "windows" && os.Getuid() != 0, "skipping test that requires root")
+	skip.If(t, os.Getuid() != 0, "skipping test that requires root")
 	destDir, err := ioutil.TempDir("", "docker-test-destDir")
 	assert.NilError(t, err)
 	defer os.RemoveAll(destDir)
diff --git a/vendor/github.com/docker/docker/pkg/archive/archive_unix_test.go b/vendor/github.com/docker/docker/pkg/archive/archive_unix_test.go
index 6119133f8..83deab084 100644
--- a/vendor/github.com/docker/docker/pkg/archive/archive_unix_test.go
+++ b/vendor/github.com/docker/docker/pkg/archive/archive_unix_test.go
@@ -7,14 +7,12 @@ import (
 	"fmt"
 	"io/ioutil"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"strings"
 	"syscall"
 	"testing"
 
 	"github.com/docker/docker/pkg/system"
-	rsystem "github.com/opencontainers/runc/libcontainer/system"
 	"golang.org/x/sys/unix"
 	"gotest.tools/assert"
 	is "gotest.tools/assert/cmp"
@@ -183,7 +181,6 @@ func getInode(path string) (uint64, error) {
 
 func TestTarWithBlockCharFifo(t *testing.T) {
 	skip.If(t, os.Getuid() != 0, "skipping test that requires root")
-	skip.If(t, rsystem.RunningInUserNS(), "skipping test that requires initial userns")
 	origin, err := ioutil.TempDir("", "docker-test-tar-hardlink")
 	assert.NilError(t, err)
 
@@ -225,13 +222,6 @@ func TestTarWithBlockCharFifo(t *testing.T) {
 // TestTarUntarWithXattr is Unix as Lsetxattr is not supported on Windows
 func TestTarUntarWithXattr(t *testing.T) {
 	skip.If(t, os.Getuid() != 0, "skipping test that requires root")
-	if _, err := exec.LookPath("setcap"); err != nil {
-		t.Skip("setcap not installed")
-	}
-	if _, err := exec.LookPath("getcap"); err != nil {
-		t.Skip("getcap not installed")
-	}
-
 	origin, err := ioutil.TempDir("", "docker-test-untar-origin")
 	assert.NilError(t, err)
 	defer os.RemoveAll(origin)
@@ -242,9 +232,8 @@ func TestTarUntarWithXattr(t *testing.T) {
 	assert.NilError(t, err)
 	err = ioutil.WriteFile(filepath.Join(origin, "3"), []byte("will be ignored"), 0700)
 	assert.NilError(t, err)
-	// there is no known Go implementation of setcap/getcap with support for v3 file capability
-	out, err := exec.Command("setcap", "cap_block_suspend+ep", filepath.Join(origin, "2")).CombinedOutput()
-	assert.NilError(t, err, string(out))
+	err = system.Lsetxattr(filepath.Join(origin, "2"), "security.capability", []byte{0x00}, 0)
+	assert.NilError(t, err)
 
 	for _, c := range []Compression{
 		Uncompressed,
@@ -262,9 +251,10 @@ func TestTarUntarWithXattr(t *testing.T) {
 		if len(changes) != 1 || changes[0].Path != "/3" {
 			t.Fatalf("Unexpected differences after tarUntar: %v", changes)
 		}
-		out, err := exec.Command("getcap", filepath.Join(origin, "2")).CombinedOutput()
-		assert.NilError(t, err, string(out))
-		assert.Check(t, is.Contains(string(out), "= cap_block_suspend+ep"), "untar should have kept the 'security.capability' xattr")
+		capability, _ := system.Lgetxattr(filepath.Join(origin, "2"), "security.capability")
+		if capability == nil && capability[0] != 0x00 {
+			t.Fatalf("Untar should have kept the 'security.capability' xattr.")
+		}
 	}
 }
 
diff --git a/vendor/github.com/docker/docker/pkg/archive/changes.go b/vendor/github.com/docker/docker/pkg/archive/changes.go
index aedb91b03..43734db5b 100644
--- a/vendor/github.com/docker/docker/pkg/archive/changes.go
+++ b/vendor/github.com/docker/docker/pkg/archive/changes.go
@@ -63,16 +63,12 @@ func (c changesByPath) Less(i, j int) bool { return c[i].Path < c[j].Path }
 func (c changesByPath) Len() int           { return len(c) }
 func (c changesByPath) Swap(i, j int)      { c[j], c[i] = c[i], c[j] }
 
-// Gnu tar doesn't have sub-second mtime precision. The go tar
-// writer (1.10+) does when using PAX format, but we round times to seconds
-// to ensure archives have the same hashes for backwards compatibility.
-// See https://github.com/moby/moby/pull/35739/commits/fb170206ba12752214630b269a40ac7be6115ed4.
-//
-// Non-sub-second is problematic when we apply changes via tar
-// files. We handle this by comparing for exact times, *or* same
+// Gnu tar and the go tar writer don't have sub-second mtime
+// precision, which is problematic when we apply changes via tar
+// files, we handle this by comparing for exact times, *or* same
 // second count and either a or b having exactly 0 nanoseconds
 func sameFsTime(a, b time.Time) bool {
-	return a.Equal(b) ||
+	return a == b ||
 		(a.Unix() == b.Unix() &&
 			(a.Nanosecond() == 0 || b.Nanosecond() == 0))
 }
diff --git a/vendor/github.com/docker/docker/pkg/archive/changes_test.go b/vendor/github.com/docker/docker/pkg/archive/changes_test.go
index a5c00b87c..f2527cd93 100644
--- a/vendor/github.com/docker/docker/pkg/archive/changes_test.go
+++ b/vendor/github.com/docker/docker/pkg/archive/changes_test.go
@@ -5,10 +5,8 @@ import (
 	"os"
 	"os/exec"
 	"path"
-	"path/filepath"
 	"runtime"
 	"sort"
-	"syscall"
 	"testing"
 	"time"
 
@@ -25,24 +23,7 @@ func max(x, y int) int {
 }
 
 func copyDir(src, dst string) error {
-	if runtime.GOOS != "windows" {
-		return exec.Command("cp", "-a", src, dst).Run()
-	}
-
-	// Could have used xcopy src dst /E /I /H /Y /B. However, xcopy has the
-	// unfortunate side effect of not preserving timestamps of newly created
-	// directories in the target directory, so we don't get accurate changes.
-	// Use robocopy instead. Note this isn't available in microsoft/nanoserver.
-	// But it has gotchas. See https://weblogs.sqlteam.com/robv/archive/2010/02/17/61106.aspx
-	err := exec.Command("robocopy", filepath.FromSlash(src), filepath.FromSlash(dst), "/SL", "/COPYALL", "/MIR").Run()
-	if exiterr, ok := err.(*exec.ExitError); ok {
-		if status, ok := exiterr.Sys().(syscall.WaitStatus); ok {
-			if status.ExitStatus()&24 == 0 {
-				return nil
-			}
-		}
-	}
-	return err
+	return exec.Command("cp", "-a", src, dst).Run()
 }
 
 type FileType uint32
@@ -132,6 +113,11 @@ func TestChangeString(t *testing.T) {
 }
 
 func TestChangesWithNoChanges(t *testing.T) {
+	// TODO Windows. There may be a way of running this, but turning off for now
+	// as createSampleDir uses symlinks.
+	if runtime.GOOS == "windows" {
+		t.Skip("symlinks on Windows")
+	}
 	rwLayer, err := ioutil.TempDir("", "docker-changes-test")
 	assert.NilError(t, err)
 	defer os.RemoveAll(rwLayer)
@@ -147,6 +133,11 @@ func TestChangesWithNoChanges(t *testing.T) {
 }
 
 func TestChangesWithChanges(t *testing.T) {
+	// TODO Windows. There may be a way of running this, but turning off for now
+	// as createSampleDir uses symlinks.
+	if runtime.GOOS == "windows" {
+		t.Skip("symlinks on Windows")
+	}
 	// Mock the readonly layer
 	layer, err := ioutil.TempDir("", "docker-changes-test-layer")
 	assert.NilError(t, err)
@@ -176,20 +167,21 @@ func TestChangesWithChanges(t *testing.T) {
 	assert.NilError(t, err)
 
 	expectedChanges := []Change{
-		{filepath.FromSlash("/dir1"), ChangeModify},
-		{filepath.FromSlash("/dir1/file1-1"), ChangeModify},
-		{filepath.FromSlash("/dir1/file1-2"), ChangeDelete},
-		{filepath.FromSlash("/dir1/subfolder"), ChangeModify},
-		{filepath.FromSlash("/dir1/subfolder/newFile"), ChangeAdd},
+		{"/dir1", ChangeModify},
+		{"/dir1/file1-1", ChangeModify},
+		{"/dir1/file1-2", ChangeDelete},
+		{"/dir1/subfolder", ChangeModify},
+		{"/dir1/subfolder/newFile", ChangeAdd},
 	}
 	checkChanges(expectedChanges, changes, t)
 }
 
 // See https://github.com/docker/docker/pull/13590
 func TestChangesWithChangesGH13590(t *testing.T) {
-	// TODO Windows. Needs further investigation to identify the failure
+	// TODO Windows. There may be a way of running this, but turning off for now
+	// as createSampleDir uses symlinks.
 	if runtime.GOOS == "windows" {
-		t.Skip("needs more investigation")
+		t.Skip("symlinks on Windows")
 	}
 	baseLayer, err := ioutil.TempDir("", "docker-changes-test.")
 	assert.NilError(t, err)
@@ -246,6 +238,11 @@ func TestChangesWithChangesGH13590(t *testing.T) {
 
 // Create a directory, copy it, make sure we report no changes between the two
 func TestChangesDirsEmpty(t *testing.T) {
+	// TODO Windows. There may be a way of running this, but turning off for now
+	// as createSampleDir uses symlinks.
+	if runtime.GOOS == "windows" {
+		t.Skip("symlinks on Windows")
+	}
 	src, err := ioutil.TempDir("", "docker-changes-test")
 	assert.NilError(t, err)
 	defer os.RemoveAll(src)
@@ -328,6 +325,11 @@ func mutateSampleDir(t *testing.T, root string) {
 }
 
 func TestChangesDirsMutated(t *testing.T) {
+	// TODO Windows. There may be a way of running this, but turning off for now
+	// as createSampleDir uses symlinks.
+	if runtime.GOOS == "windows" {
+		t.Skip("symlinks on Windows")
+	}
 	src, err := ioutil.TempDir("", "docker-changes-test")
 	assert.NilError(t, err)
 	createSampleDir(t, src)
@@ -345,37 +347,20 @@ func TestChangesDirsMutated(t *testing.T) {
 	sort.Sort(changesByPath(changes))
 
 	expectedChanges := []Change{
-		{filepath.FromSlash("/dir1"), ChangeDelete},
-		{filepath.FromSlash("/dir2"), ChangeModify},
+		{"/dir1", ChangeDelete},
+		{"/dir2", ChangeModify},
+		{"/dirnew", ChangeAdd},
+		{"/file1", ChangeDelete},
+		{"/file2", ChangeModify},
+		{"/file3", ChangeModify},
+		{"/file4", ChangeModify},
+		{"/file5", ChangeModify},
+		{"/filenew", ChangeAdd},
+		{"/symlink1", ChangeDelete},
+		{"/symlink2", ChangeModify},
+		{"/symlinknew", ChangeAdd},
 	}
 
-	// Note there is slight difference between the Linux and Windows
-	// implementations here. Due to https://github.com/moby/moby/issues/9874,
-	// and the fix at https://github.com/moby/moby/pull/11422, Linux does not
-	// consider a change to the directory time as a change. Windows on NTFS
-	// does. See https://github.com/moby/moby/pull/37982 for more information.
-	//
-	// Note also: https://github.com/moby/moby/pull/37982#discussion_r223523114
-	// that differences are ordered in the way the test is currently written, hence
-	// this is in the middle of the list of changes rather than at the start or
-	// end. Potentially can be addressed later.
-	if runtime.GOOS == "windows" {
-		expectedChanges = append(expectedChanges, Change{filepath.FromSlash("/dir3"), ChangeModify})
-	}
-
-	expectedChanges = append(expectedChanges, []Change{
-		{filepath.FromSlash("/dirnew"), ChangeAdd},
-		{filepath.FromSlash("/file1"), ChangeDelete},
-		{filepath.FromSlash("/file2"), ChangeModify},
-		{filepath.FromSlash("/file3"), ChangeModify},
-		{filepath.FromSlash("/file4"), ChangeModify},
-		{filepath.FromSlash("/file5"), ChangeModify},
-		{filepath.FromSlash("/filenew"), ChangeAdd},
-		{filepath.FromSlash("/symlink1"), ChangeDelete},
-		{filepath.FromSlash("/symlink2"), ChangeModify},
-		{filepath.FromSlash("/symlinknew"), ChangeAdd},
-	}...)
-
 	for i := 0; i < max(len(changes), len(expectedChanges)); i++ {
 		if i >= len(expectedChanges) {
 			t.Fatalf("unexpected change %s\n", changes[i].String())
@@ -388,7 +373,7 @@ func TestChangesDirsMutated(t *testing.T) {
 				t.Fatalf("Wrong change for %s, expected %s, got %s\n", changes[i].Path, changes[i].String(), expectedChanges[i].String())
 			}
 		} else if changes[i].Path < expectedChanges[i].Path {
-			t.Fatalf("unexpected change %q %q\n", changes[i].String(), expectedChanges[i].Path)
+			t.Fatalf("unexpected change %s\n", changes[i].String())
 		} else {
 			t.Fatalf("no change for expected change %s != %s\n", expectedChanges[i].String(), changes[i].String())
 		}
@@ -396,13 +381,10 @@ func TestChangesDirsMutated(t *testing.T) {
 }
 
 func TestApplyLayer(t *testing.T) {
-	// TODO Windows. This is very close to working, but it fails with changes
-	// to \symlinknew and \symlink2. The destination has an updated
-	// Access/Modify/Change/Birth date to the source (~3/100th sec different).
-	// Needs further investigation as to why, but I currently believe this is
-	// just the way NTFS works. I don't think it's a bug in this test or archive.
+	// TODO Windows. There may be a way of running this, but turning off for now
+	// as createSampleDir uses symlinks.
 	if runtime.GOOS == "windows" {
-		t.Skip("needs further investigation")
+		t.Skip("symlinks on Windows")
 	}
 	src, err := ioutil.TempDir("", "docker-changes-test")
 	assert.NilError(t, err)
@@ -435,10 +417,10 @@ func TestApplyLayer(t *testing.T) {
 }
 
 func TestChangesSizeWithHardlinks(t *testing.T) {
-	// TODO Windows. Needs further investigation. Likely in ChangeSizes not
-	// coping correctly with hardlinks on Windows.
+	// TODO Windows. There may be a way of running this, but turning off for now
+	// as createSampleDir uses symlinks.
 	if runtime.GOOS == "windows" {
-		t.Skip("needs further investigation")
+		t.Skip("hardlinks on Windows")
 	}
 	srcDir, err := ioutil.TempDir("", "docker-test-srcDir")
 	assert.NilError(t, err)
@@ -499,7 +481,7 @@ func TestChangesSize(t *testing.T) {
 }
 
 func checkChanges(expectedChanges, changes []Change, t *testing.T) {
-	skip.If(t, runtime.GOOS != "windows" && os.Getuid() != 0, "skipping test that requires root")
+	skip.If(t, os.Getuid() != 0, "skipping test that requires root")
 	sort.Sort(changesByPath(expectedChanges))
 	sort.Sort(changesByPath(changes))
 	for i := 0; i < max(len(changes), len(expectedChanges)); i++ {
diff --git a/vendor/github.com/docker/docker/pkg/archive/changes_unix.go b/vendor/github.com/docker/docker/pkg/archive/changes_unix.go
index 06217b716..c06a209d8 100644
--- a/vendor/github.com/docker/docker/pkg/archive/changes_unix.go
+++ b/vendor/github.com/docker/docker/pkg/archive/changes_unix.go
@@ -16,13 +16,7 @@ func statDifferent(oldStat *system.StatT, newStat *system.StatT) bool {
 		oldStat.UID() != newStat.UID() ||
 		oldStat.GID() != newStat.GID() ||
 		oldStat.Rdev() != newStat.Rdev() ||
-		// Don't look at size or modification time for dirs, its not a good
-		// measure of change. See https://github.com/moby/moby/issues/9874
-		// for a description of the issue with modification time, and
-		// https://github.com/moby/moby/pull/11422 for the change.
-		// (Note that in the Windows implementation of this function,
-		// modification time IS taken as a change). See
-		// https://github.com/moby/moby/pull/37982 for more information.
+		// Don't look at size for dirs, its not a good measure of change
 		(oldStat.Mode()&unix.S_IFDIR != unix.S_IFDIR &&
 			(!sameFsTimeSpec(oldStat.Mtim(), newStat.Mtim()) || (oldStat.Size() != newStat.Size()))) {
 		return true
diff --git a/vendor/github.com/docker/docker/pkg/archive/changes_windows.go b/vendor/github.com/docker/docker/pkg/archive/changes_windows.go
index 9906685e4..6555c0136 100644
--- a/vendor/github.com/docker/docker/pkg/archive/changes_windows.go
+++ b/vendor/github.com/docker/docker/pkg/archive/changes_windows.go
@@ -7,13 +7,9 @@ import (
 )
 
 func statDifferent(oldStat *system.StatT, newStat *system.StatT) bool {
-	// Note there is slight difference between the Linux and Windows
-	// implementations here. Due to https://github.com/moby/moby/issues/9874,
-	// and the fix at https://github.com/moby/moby/pull/11422, Linux does not
-	// consider a change to the directory time as a change. Windows on NTFS
-	// does. See https://github.com/moby/moby/pull/37982 for more information.
 
-	if !sameFsTime(oldStat.Mtim(), newStat.Mtim()) ||
+	// Don't look at size for dirs, its not a good measure of change
+	if oldStat.Mtim() != newStat.Mtim() ||
 		oldStat.Mode() != newStat.Mode() ||
 		oldStat.Size() != newStat.Size() && !oldStat.Mode().IsDir() {
 		return true
diff --git a/vendor/github.com/docker/docker/pkg/archive/diff.go b/vendor/github.com/docker/docker/pkg/archive/diff.go
index 146e21fe1..6883ba132 100644
--- a/vendor/github.com/docker/docker/pkg/archive/diff.go
+++ b/vendor/github.com/docker/docker/pkg/archive/diff.go
@@ -240,13 +240,11 @@ func applyLayerHandler(dest string, layer io.Reader, options *TarOptions, decomp
 	dest = filepath.Clean(dest)
 
 	// We need to be able to set any perms
-	if runtime.GOOS != "windows" {
-		oldmask, err := system.Umask(0)
-		if err != nil {
-			return 0, err
-		}
-		defer system.Umask(oldmask)
+	oldmask, err := system.Umask(0)
+	if err != nil {
+		return 0, err
 	}
+	defer system.Umask(oldmask) // ignore err, ErrNotSupportedPlatform
 
 	if decompress {
 		decompLayer, err := DecompressStream(layer)
diff --git a/vendor/github.com/docker/docker/pkg/archive/diff_test.go b/vendor/github.com/docker/docker/pkg/archive/diff_test.go
index 1d3f16612..19f2555e1 100644
--- a/vendor/github.com/docker/docker/pkg/archive/diff_test.go
+++ b/vendor/github.com/docker/docker/pkg/archive/diff_test.go
@@ -7,12 +7,17 @@ import (
 	"os"
 	"path/filepath"
 	"reflect"
+	"runtime"
 	"testing"
 
 	"github.com/docker/docker/pkg/ioutils"
 )
 
 func TestApplyLayerInvalidFilenames(t *testing.T) {
+	// TODO Windows: Figure out how to fix this test.
+	if runtime.GOOS == "windows" {
+		t.Skip("Passes but hits breakoutError: platform and architecture is not supported")
+	}
 	for i, headers := range [][]*tar.Header{
 		{
 			{
@@ -37,6 +42,9 @@ func TestApplyLayerInvalidFilenames(t *testing.T) {
 }
 
 func TestApplyLayerInvalidHardlink(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("TypeLink support on Windows")
+	}
 	for i, headers := range [][]*tar.Header{
 		{ // try reading victim/hello (../)
 			{
@@ -117,6 +125,9 @@ func TestApplyLayerInvalidHardlink(t *testing.T) {
 }
 
 func TestApplyLayerInvalidSymlink(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("TypeSymLink support on Windows")
+	}
 	for i, headers := range [][]*tar.Header{
 		{ // try reading victim/hello (../)
 			{
@@ -197,6 +208,11 @@ func TestApplyLayerInvalidSymlink(t *testing.T) {
 }
 
 func TestApplyLayerWhiteouts(t *testing.T) {
+	// TODO Windows: Figure out why this test fails
+	if runtime.GOOS == "windows" {
+		t.Skip("Failing on Windows")
+	}
+
 	wd, err := ioutil.TempDir("", "graphdriver-test-whiteouts")
 	if err != nil {
 		return
@@ -323,9 +339,7 @@ func makeTestLayer(paths []string) (rc io.ReadCloser, err error) {
 		}
 	}()
 	for _, p := range paths {
-		// Source files are always in Unix format. But we use filepath on
-		// creation to be platform agnostic.
-		if p[len(p)-1] == '/' {
+		if p[len(p)-1] == filepath.Separator {
 			if err = os.MkdirAll(filepath.Join(tmpDir, p), 0700); err != nil {
 				return
 			}
@@ -360,10 +374,9 @@ func readDirContents(root string) ([]string, error) {
 			return err
 		}
 		if info.IsDir() {
-			rel = rel + string(filepath.Separator)
+			rel = rel + "/"
 		}
-		// Append in Unix semantics
-		files = append(files, filepath.ToSlash(rel))
+		files = append(files, rel)
 		return nil
 	})
 	if err != nil {
diff --git a/vendor/github.com/docker/docker/pkg/authorization/api_test.go b/vendor/github.com/docker/docker/pkg/authorization/api_test.go
index 9d51e9e66..ff364fd0b 100644
--- a/vendor/github.com/docker/docker/pkg/authorization/api_test.go
+++ b/vendor/github.com/docker/docker/pkg/authorization/api_test.go
@@ -17,7 +17,7 @@ import (
 
 func TestPeerCertificateMarshalJSON(t *testing.T) {
 	template := &x509.Certificate{
-		IsCA:                  true,
+		IsCA: true,
 		BasicConstraintsValid: true,
 		SubjectKeyId:          []byte{1, 2, 3},
 		SerialNumber:          big.NewInt(1234),
diff --git a/vendor/github.com/docker/docker/pkg/authorization/authz.go b/vendor/github.com/docker/docker/pkg/authorization/authz.go
index a1edbcd89..f504b13d7 100644
--- a/vendor/github.com/docker/docker/pkg/authorization/authz.go
+++ b/vendor/github.com/docker/docker/pkg/authorization/authz.go
@@ -7,6 +7,8 @@ import (
 	"io"
 	"mime"
 	"net/http"
+	"net/url"
+	"regexp"
 	"strings"
 
 	"github.com/docker/docker/pkg/ioutils"
@@ -52,10 +54,23 @@ type Ctx struct {
 	authReq *Request
 }
 
+func isChunked(r *http.Request) bool {
+	//RFC 7230 specifies that content length is to be ignored if Transfer-Encoding is chunked
+	if strings.EqualFold(r.Header.Get("Transfer-Encoding"), "chunked") {
+		return true
+	}
+	for _, v := range r.TransferEncoding {
+		if strings.EqualFold(v, "chunked") {
+			return true
+		}
+	}
+	return false
+}
+
 // AuthZRequest authorized the request to the docker daemon using authZ plugins
 func (ctx *Ctx) AuthZRequest(w http.ResponseWriter, r *http.Request) error {
 	var body []byte
-	if sendBody(ctx.requestURI, r.Header) && r.ContentLength > 0 && r.ContentLength < maxBodySize {
+	if sendBody(ctx.requestURI, r.Header) && (r.ContentLength > 0 || isChunked(r)) && r.ContentLength < maxBodySize {
 		var err error
 		body, r.Body, err = drainBody(r.Body)
 		if err != nil {
@@ -108,7 +123,6 @@ func (ctx *Ctx) AuthZResponse(rm ResponseModifier, r *http.Request) error {
 	if sendBody(ctx.requestURI, rm.Header()) {
 		ctx.authReq.ResponseBody = rm.RawBody()
 	}
-
 	for _, plugin := range ctx.plugins {
 		logrus.Debugf("AuthZ response using plugin %s", plugin.Name())
 
@@ -146,10 +160,26 @@ func drainBody(body io.ReadCloser) ([]byte, io.ReadCloser, error) {
 	return nil, newBody, err
 }
 
+func isAuthEndpoint(urlPath string) (bool, error) {
+	// eg www.test.com/v1.24/auth/optional?optional1=something&optional2=something (version optional)
+	matched, err := regexp.MatchString(`^[^\/]*\/(v\d[\d\.]*\/)?auth.*`, urlPath)
+	if err != nil {
+		return false, err
+	}
+	return matched, nil
+}
+
 // sendBody returns true when request/response body should be sent to AuthZPlugin
-func sendBody(url string, header http.Header) bool {
+func sendBody(inURL string, header http.Header) bool {
+	u, err := url.Parse(inURL)
+	// Assume no if the URL cannot be parsed - an empty request will still be forwarded to the plugin and should be rejected
+	if err != nil {
+		return false
+	}
+
 	// Skip body for auth endpoint
-	if strings.HasSuffix(url, "/auth") {
+	isAuth, err := isAuthEndpoint(u.Path)
+	if isAuth || err != nil {
 		return false
 	}
 
diff --git a/vendor/github.com/docker/docker/pkg/authorization/authz_unix_test.go b/vendor/github.com/docker/docker/pkg/authorization/authz_unix_test.go
index c38b5e156..8f45d3ac9 100644
--- a/vendor/github.com/docker/docker/pkg/authorization/authz_unix_test.go
+++ b/vendor/github.com/docker/docker/pkg/authorization/authz_unix_test.go
@@ -144,7 +144,7 @@ func TestDrainBody(t *testing.T) {
 		length             int // length is the message length send to drainBody
 		expectedBodyLength int // expectedBodyLength is the expected body length after drainBody is called
 	}{
-		{10, 10},                           // Small message size
+		{10, 10}, // Small message size
 		{maxBodySize - 1, maxBodySize - 1}, // Max message size
 		{maxBodySize * 2, 0},               // Large message size (skip copying body)
 
@@ -174,8 +174,8 @@ func TestDrainBody(t *testing.T) {
 
 func TestSendBody(t *testing.T) {
 	var (
-		url       = "nothing.com"
 		testcases = []struct {
+			url         string
 			contentType string
 			expected    bool
 		}{
@@ -219,15 +219,93 @@ func TestSendBody(t *testing.T) {
 				contentType: "",
 				expected:    false,
 			},
+			{
+				url:         "nothing.com/auth",
+				contentType: "",
+				expected:    false,
+			},
+			{
+				url:         "nothing.com/auth",
+				contentType: "application/json;charset=UTF8",
+				expected:    false,
+			},
+			{
+				url:         "nothing.com/auth?p1=test",
+				contentType: "application/json;charset=UTF8",
+				expected:    false,
+			},
+			{
+				url:         "nothing.com/test?p1=/auth",
+				contentType: "application/json;charset=UTF8",
+				expected:    true,
+			},
+			{
+				url:         "nothing.com/something/auth",
+				contentType: "application/json;charset=UTF8",
+				expected:    true,
+			},
+			{
+				url:         "nothing.com/auth/test",
+				contentType: "application/json;charset=UTF8",
+				expected:    false,
+			},
+			{
+				url:         "nothing.com/v1.24/auth/test",
+				contentType: "application/json;charset=UTF8",
+				expected:    false,
+			},
+			{
+				url:         "nothing.com/v1/auth/test",
+				contentType: "application/json;charset=UTF8",
+				expected:    false,
+			},
+			{
+				url:         "www.nothing.com/v1.24/auth/test",
+				contentType: "application/json;charset=UTF8",
+				expected:    false,
+			},
+			{
+				url:         "https://www.nothing.com/v1.24/auth/test",
+				contentType: "application/json;charset=UTF8",
+				expected:    false,
+			},
+			{
+				url:         "http://nothing.com/v1.24/auth/test",
+				contentType: "application/json;charset=UTF8",
+				expected:    false,
+			},
+			{
+				url:         "www.nothing.com/test?p1=/auth",
+				contentType: "application/json;charset=UTF8",
+				expected:    true,
+			},
+			{
+				url:         "http://www.nothing.com/test?p1=/auth",
+				contentType: "application/json;charset=UTF8",
+				expected:    true,
+			},
+			{
+				url:         "www.nothing.com/something/auth",
+				contentType: "application/json;charset=UTF8",
+				expected:    true,
+			},
+			{
+				url:         "https://www.nothing.com/something/auth",
+				contentType: "application/json;charset=UTF8",
+				expected:    true,
+			},
 		}
 	)
 
 	for _, testcase := range testcases {
 		header := http.Header{}
 		header.Set("Content-Type", testcase.contentType)
+		if testcase.url == "" {
+			testcase.url = "nothing.com"
+		}
 
-		if b := sendBody(url, header); b != testcase.expected {
-			t.Fatalf("Unexpected Content-Type; Expected: %t, Actual: %t", testcase.expected, b)
+		if b := sendBody(testcase.url, header); b != testcase.expected {
+			t.Fatalf("sendBody failed: url: %s, content-type: %s; Expected: %t, Actual: %t", testcase.url, testcase.contentType, testcase.expected, b)
 		}
 	}
 }
diff --git a/vendor/github.com/docker/docker/pkg/fileutils/fileutils.go b/vendor/github.com/docker/docker/pkg/fileutils/fileutils.go
index 34f1c726f..28cad499a 100644
--- a/vendor/github.com/docker/docker/pkg/fileutils/fileutils.go
+++ b/vendor/github.com/docker/docker/pkg/fileutils/fileutils.go
@@ -106,7 +106,7 @@ func (pm *PatternMatcher) Patterns() []*Pattern {
 	return pm.patterns
 }
 
-// Pattern defines a single regexp used to filter file paths.
+// Pattern defines a single regexp used used to filter file paths.
 type Pattern struct {
 	cleanedPattern string
 	dirs           []string
diff --git a/vendor/github.com/docker/docker/pkg/mount/mount.go b/vendor/github.com/docker/docker/pkg/mount/mount.go
index 4afd63c42..874aff654 100644
--- a/vendor/github.com/docker/docker/pkg/mount/mount.go
+++ b/vendor/github.com/docker/docker/pkg/mount/mount.go
@@ -2,46 +2,12 @@ package mount // import "github.com/docker/docker/pkg/mount"
 
 import (
 	"sort"
-	"strconv"
 	"strings"
+	"syscall"
 
 	"github.com/sirupsen/logrus"
 )
 
-// mountError records an error from mount or unmount operation
-type mountError struct {
-	op             string
-	source, target string
-	flags          uintptr
-	data           string
-	err            error
-}
-
-func (e *mountError) Error() string {
-	out := e.op + " "
-
-	if e.source != "" {
-		out += e.source + ":" + e.target
-	} else {
-		out += e.target
-	}
-
-	if e.flags != uintptr(0) {
-		out += ", flags: 0x" + strconv.FormatUint(uint64(e.flags), 16)
-	}
-	if e.data != "" {
-		out += ", data: " + e.data
-	}
-
-	out += ": " + e.err.Error()
-	return out
-}
-
-// Cause returns the underlying cause of the error
-func (e *mountError) Cause() error {
-	return e.err
-}
-
 // FilterFunc is a type defining a callback function
 // to filter out unwanted entries. It takes a pointer
 // to an Info struct (not fully populated, currently
@@ -123,7 +89,12 @@ func ForceMount(device, target, mType, options string) error {
 // Unmount lazily unmounts a filesystem on supported platforms, otherwise
 // does a normal unmount.
 func Unmount(target string) error {
-	return unmount(target, mntDetach)
+	err := unmount(target, mntDetach)
+	if err == syscall.EINVAL {
+		// ignore "not mounted" error
+		err = nil
+	}
+	return err
 }
 
 // RecursiveUnmount unmounts the target and all mounts underneath, starting with
@@ -143,14 +114,25 @@ func RecursiveUnmount(target string) error {
 		logrus.Debugf("Trying to unmount %s", m.Mountpoint)
 		err = unmount(m.Mountpoint, mntDetach)
 		if err != nil {
-			if i == len(mounts)-1 { // last mount
+			// If the error is EINVAL either this whole package is wrong (invalid flags passed to unmount(2)) or this is
+			// not a mountpoint (which is ok in this case).
+			// Meanwhile calling `Mounted()` is very expensive.
+			//
+			// We've purposefully used `syscall.EINVAL` here instead of `unix.EINVAL` to avoid platform branching
+			// Since `EINVAL` is defined for both Windows and Linux in the `syscall` package (and other platforms),
+			//   this is nicer than defining a custom value that we can refer to in each platform file.
+			if err == syscall.EINVAL {
+				continue
+			}
+			if i == len(mounts)-1 {
 				if mounted, e := Mounted(m.Mountpoint); e != nil || mounted {
 					return err
 				}
-			} else {
-				// This is some submount, we can ignore this error for now, the final unmount will fail if this is a real problem
-				logrus.WithError(err).Warnf("Failed to unmount submount %s", m.Mountpoint)
+				continue
 			}
+			// This is some submount, we can ignore this error for now, the final unmount will fail if this is a real problem
+			logrus.WithError(err).Warnf("Failed to unmount submount %s", m.Mountpoint)
+			continue
 		}
 
 		logrus.Debugf("Unmounted %s", m.Mountpoint)
diff --git a/vendor/github.com/docker/docker/pkg/mount/mounter_freebsd.go b/vendor/github.com/docker/docker/pkg/mount/mounter_freebsd.go
index 09ad36060..b6ab83a23 100644
--- a/vendor/github.com/docker/docker/pkg/mount/mounter_freebsd.go
+++ b/vendor/github.com/docker/docker/pkg/mount/mounter_freebsd.go
@@ -11,9 +11,11 @@ package mount // import "github.com/docker/docker/pkg/mount"
 import "C"
 
 import (
+	"fmt"
 	"strings"
-	"syscall"
 	"unsafe"
+
+	"golang.org/x/sys/unix"
 )
 
 func allocateIOVecs(options []string) []C.struct_iovec {
@@ -47,13 +49,12 @@ func mount(device, target, mType string, flag uintptr, data string) error {
 	}
 
 	if errno := C.nmount(&rawOptions[0], C.uint(len(options)), C.int(flag)); errno != 0 {
-		return &mountError{
-			op:     "mount",
-			source: device,
-			target: target,
-			flags:  flag,
-			err:    syscall.Errno(errno),
-		}
+		reason := C.GoString(C.strerror(*C.__error()))
+		return fmt.Errorf("Failed to call nmount: %s", reason)
 	}
 	return nil
 }
+
+func unmount(target string, flag int) error {
+	return unix.Unmount(target, flag)
+}
diff --git a/vendor/github.com/docker/docker/pkg/mount/mounter_linux.go b/vendor/github.com/docker/docker/pkg/mount/mounter_linux.go
index a0a1ad236..631daf10a 100644
--- a/vendor/github.com/docker/docker/pkg/mount/mounter_linux.go
+++ b/vendor/github.com/docker/docker/pkg/mount/mounter_linux.go
@@ -33,41 +33,25 @@ func mount(device, target, mType string, flags uintptr, data string) error {
 		// Initial call applying all non-propagation flags for mount
 		// or remount with changed data
 		if err := unix.Mount(device, target, mType, oflags, data); err != nil {
-			return &mountError{
-				op:     "mount",
-				source: device,
-				target: target,
-				flags:  oflags,
-				data:   data,
-				err:    err,
-			}
+			return err
 		}
 	}
 
 	if flags&ptypes != 0 {
 		// Change the propagation type.
 		if err := unix.Mount("", target, "", flags&pflags, ""); err != nil {
-			return &mountError{
-				op:     "remount",
-				target: target,
-				flags:  flags & pflags,
-				err:    err,
-			}
+			return err
 		}
 	}
 
 	if oflags&broflags == broflags {
 		// Remount the bind to apply read only.
-		if err := unix.Mount("", target, "", oflags|unix.MS_REMOUNT, ""); err != nil {
-			return &mountError{
-				op:     "remount-ro",
-				target: target,
-				flags:  oflags | unix.MS_REMOUNT,
-				err:    err,
-			}
-
-		}
+		return unix.Mount("", target, "", oflags|unix.MS_REMOUNT, "")
 	}
 
 	return nil
 }
+
+func unmount(target string, flag int) error {
+	return unix.Unmount(target, flag)
+}
diff --git a/vendor/github.com/docker/docker/pkg/mount/mounter_unsupported.go b/vendor/github.com/docker/docker/pkg/mount/mounter_unsupported.go
index c3e5aec27..1428dffa5 100644
--- a/vendor/github.com/docker/docker/pkg/mount/mounter_unsupported.go
+++ b/vendor/github.com/docker/docker/pkg/mount/mounter_unsupported.go
@@ -5,3 +5,7 @@ package mount // import "github.com/docker/docker/pkg/mount"
 func mount(device, target, mType string, flag uintptr, data string) error {
 	panic("Not implemented")
 }
+
+func unmount(target string, flag int) error {
+	panic("Not implemented")
+}
diff --git a/vendor/github.com/docker/docker/pkg/mount/sharedsubtree_linux_test.go b/vendor/github.com/docker/docker/pkg/mount/sharedsubtree_linux_test.go
index 7a37f6609..019514491 100644
--- a/vendor/github.com/docker/docker/pkg/mount/sharedsubtree_linux_test.go
+++ b/vendor/github.com/docker/docker/pkg/mount/sharedsubtree_linux_test.go
@@ -7,7 +7,6 @@ import (
 	"path"
 	"testing"
 
-	"github.com/pkg/errors"
 	"golang.org/x/sys/unix"
 )
 
@@ -327,7 +326,7 @@ func TestSubtreeUnbindable(t *testing.T) {
 	}()
 
 	// then attempt to mount it to target. It should fail
-	if err := Mount(sourceDir, targetDir, "none", "bind,rw"); err != nil && errors.Cause(err) != unix.EINVAL {
+	if err := Mount(sourceDir, targetDir, "none", "bind,rw"); err != nil && err != unix.EINVAL {
 		t.Fatal(err)
 	} else if err == nil {
 		t.Fatalf("%q should not have been bindable", sourceDir)
diff --git a/vendor/github.com/docker/docker/pkg/mount/unmount_unix.go b/vendor/github.com/docker/docker/pkg/mount/unmount_unix.go
deleted file mode 100644
index 4be427685..000000000
--- a/vendor/github.com/docker/docker/pkg/mount/unmount_unix.go
+++ /dev/null
@@ -1,22 +0,0 @@
-// +build !windows
-
-package mount // import "github.com/docker/docker/pkg/mount"
-
-import "golang.org/x/sys/unix"
-
-func unmount(target string, flags int) error {
-	err := unix.Unmount(target, flags)
-	if err == nil || err == unix.EINVAL {
-		// Ignore "not mounted" error here. Note the same error
-		// can be returned if flags are invalid, so this code
-		// assumes that the flags value is always correct.
-		return nil
-	}
-
-	return &mountError{
-		op:     "umount",
-		target: target,
-		flags:  uintptr(flags),
-		err:    err,
-	}
-}
diff --git a/vendor/github.com/docker/docker/pkg/mount/unmount_unsupported.go b/vendor/github.com/docker/docker/pkg/mount/unmount_unsupported.go
deleted file mode 100644
index a88ad3577..000000000
--- a/vendor/github.com/docker/docker/pkg/mount/unmount_unsupported.go
+++ /dev/null
@@ -1,7 +0,0 @@
-// +build windows
-
-package mount // import "github.com/docker/docker/pkg/mount"
-
-func unmount(target string, flag int) error {
-	panic("Not implemented")
-}
diff --git a/vendor/github.com/docker/docker/pkg/namesgenerator/names-generator.go b/vendor/github.com/docker/docker/pkg/namesgenerator/names-generator.go
index 15561805d..8d19caa0d 100644
--- a/vendor/github.com/docker/docker/pkg/namesgenerator/names-generator.go
+++ b/vendor/github.com/docker/docker/pkg/namesgenerator/names-generator.go
@@ -15,19 +15,15 @@ var (
 		"angry",
 		"awesome",
 		"blissful",
-		"bold",
 		"boring",
 		"brave",
-		"charming",
 		"clever",
 		"cocky",
-		"cool",
 		"compassionate",
 		"competent",
 		"condescending",
 		"confident",
 		"cranky",
-		"crazy",
 		"dazzling",
 		"determined",
 		"distracted",
@@ -63,7 +59,6 @@ var (
 		"laughing",
 		"loving",
 		"lucid",
-		"magical",
 		"mystifying",
 		"modest",
 		"musing",
@@ -92,7 +87,6 @@ var (
 		"stoic",
 		"stupefied",
 		"suspicious",
-		"sweet",
 		"tender",
 		"thirsty",
 		"trusting",
@@ -172,9 +166,6 @@ var (
 		// Bhaskara II - Ancient Indian mathematician-astronomer whose work on calculus predates Newton and Leibniz by over half a millennium - https://en.wikipedia.org/wiki/Bh%C4%81skara_II#Calculus
 		"bhaskara",
 
-		// Sue Black - British computer scientist and campaigner. She has been instrumental in saving Bletchley Park, the site of World War II codebreaking - https://en.wikipedia.org/wiki/Sue_Black_(computer_scientist)
-		"black",
-
 		// Elizabeth Helen Blackburn - Australian-American Nobel laureate; best known for co-discovering telomerase. https://en.wikipedia.org/wiki/Elizabeth_Blackburn
 		"blackburn",
 
@@ -214,9 +205,6 @@ var (
 		// Dame Susan Jocelyn Bell Burnell - Northern Irish astrophysicist who discovered radio pulsars and was the first to analyse them. https://en.wikipedia.org/wiki/Jocelyn_Bell_Burnell
 		"burnell",
 
-		// Annie Jump Cannon - pioneering female astronomer who classified hundreds of thousands of stars and created the system we use to understand stars today. https://en.wikipedia.org/wiki/Annie_Jump_Cannon
-		"cannon",
-
 		// Rachel Carson - American marine biologist and conservationist, her book Silent Spring and other writings are credited with advancing the global environmental movement. https://en.wikipedia.org/wiki/Rachel_Carson
 		"carson",
 
@@ -324,9 +312,6 @@ var (
 		// Leonhard Euler invented large parts of modern mathematics. https://de.wikipedia.org/wiki/Leonhard_Euler
 		"euler",
 
-		// Michael Faraday - British scientist who contributed to the study of electromagnetism and electrochemistry. https://en.wikipedia.org/wiki/Michael_Faraday
-		"faraday",
-
 		// Horst Feistel - German-born American cryptographer who was one of the earliest non-government researchers to study the design and theory of block ciphers. Co-developer of DES and Lucifer. Feistel networks, a symmetric structure used in the construction of block ciphers are named after him. https://en.wikipedia.org/wiki/Horst_Feistel
 		"feistel",
 
@@ -378,9 +363,6 @@ var (
 		// Jane Goodall - British primatologist, ethologist, and anthropologist who is considered to be the world's foremost expert on chimpanzees - https://en.wikipedia.org/wiki/Jane_Goodall
 		"goodall",
 
-		// Stephen Jay Gould was was an American paleontologist, evolutionary biologist, and historian of science. He is most famous for the theory of punctuated equilibrium - https://en.wikipedia.org/wiki/Stephen_Jay_Gould
-		"gould",
-
 		// Carolyn Widney Greider - American molecular biologist and joint winner of the 2009 Nobel Prize for Physiology or Medicine for the discovery of telomerase. https://en.wikipedia.org/wiki/Carol_W._Greider
 		"greider",
 
@@ -540,9 +522,6 @@ var (
 		// Yukihiro Matsumoto - Japanese computer scientist and software programmer best known as the chief designer of the Ruby programming language. https://en.wikipedia.org/wiki/Yukihiro_Matsumoto
 		"matsumoto",
 
-		// James Clerk Maxwell - Scottish physicist, best known for his formulation of electromagnetic theory. https://en.wikipedia.org/wiki/James_Clerk_Maxwell
-		"maxwell",
-
 		// Maria Mayer - American theoretical physicist and Nobel laureate in Physics for proposing the nuclear shell model of the atomic nucleus - https://en.wikipedia.org/wiki/Maria_Mayer
 		"mayer",
 
@@ -585,18 +564,12 @@ var (
 		// Maryam Mirzakhani - an Iranian mathematician and the first woman to win the Fields Medal. https://en.wikipedia.org/wiki/Maryam_Mirzakhani
 		"mirzakhani",
 
-		// Gordon Earle Moore - American engineer, Silicon Valley founding father, author of Moore's law. https://en.wikipedia.org/wiki/Gordon_Moore
-		"moore",
-
 		// Samuel Morse - contributed to the invention of a single-wire telegraph system based on European telegraphs and was a co-developer of the Morse code - https://en.wikipedia.org/wiki/Samuel_Morse
 		"morse",
 
 		// Ian Murdock - founder of the Debian project - https://en.wikipedia.org/wiki/Ian_Murdock
 		"murdock",
 
-		// May-Britt Moser - Nobel prize winner neuroscientist who contributed to the discovery of grid cells in the brain. https://en.wikipedia.org/wiki/May-Britt_Moser
-		"moser",
-
 		// John Napier of Merchiston - Scottish landowner known as an astronomer, mathematician and physicist. Best known for his discovery of logarithms. https://en.wikipedia.org/wiki/John_Napier
 		"napier",
 
@@ -672,9 +645,6 @@ var (
 		// Dennis Ritchie - co-creator of UNIX and the C programming language. - https://en.wikipedia.org/wiki/Dennis_Ritchie
 		"ritchie",
 
-		// Ida Rhodes - American pioneer in computer programming, designed the first computer used for Social Security. https://en.wikipedia.org/wiki/Ida_Rhodes
-		"rhodes",
-
 		// Julia Hall Bowman Robinson - American mathematician renowned for her contributions to the fields of computability theory and computational complexity theory. https://en.wikipedia.org/wiki/Julia_Robinson
 		"robinson",
 
@@ -717,15 +687,9 @@ var (
 		// Betty Snyder - one of the original programmers of the ENIAC. https://en.wikipedia.org/wiki/ENIAC - https://en.wikipedia.org/wiki/Betty_Holberton
 		"snyder",
 
-		// Cynthia Solomon - Pioneer in the fields of artificial intelligence, computer science and educational computing. Known for creation of Logo, an educational programming language.  https://en.wikipedia.org/wiki/Cynthia_Solomon
-		"solomon",
-
 		// Frances Spence - one of the original programmers of the ENIAC. https://en.wikipedia.org/wiki/ENIAC - https://en.wikipedia.org/wiki/Frances_Spence
 		"spence",
 
-		// Ivan Edward Sutherland - American computer scientist and Internet pioneer, widely regarded as the father of computer graphics. https://en.wikipedia.org/wiki/Ivan_Sutherland
-		"sutherland",
-
 		// Richard Matthew Stallman - the founder of the Free Software movement, the GNU project, the Free Software Foundation, and the League for Programming Freedom. He also invented the concept of copyleft to protect the ideals of this movement, and enshrined this concept in the widely-used GPL (General Public License) for software. https://en.wikiquote.org/wiki/Richard_Stallman
 		"stallman",
 
diff --git a/vendor/github.com/docker/docker/pkg/parsers/kernel/kernel_unix_test.go b/vendor/github.com/docker/docker/pkg/parsers/kernel/kernel_unix_test.go
index 9d2e496af..2f36490c5 100644
--- a/vendor/github.com/docker/docker/pkg/parsers/kernel/kernel_unix_test.go
+++ b/vendor/github.com/docker/docker/pkg/parsers/kernel/kernel_unix_test.go
@@ -27,7 +27,6 @@ func TestParseRelease(t *testing.T) {
 	assertParseRelease(t, "3.4.54.longterm-1", &VersionInfo{Kernel: 3, Major: 4, Minor: 54, Flavor: ".longterm-1"}, 0)
 	assertParseRelease(t, "3.4.54.longterm-1", &VersionInfo{Kernel: 3, Major: 4, Minor: 54, Flavor: ".longterm-1"}, 0)
 	assertParseRelease(t, "3.8.0-19-generic", &VersionInfo{Kernel: 3, Major: 8, Minor: 0, Flavor: "-19-generic"}, 0)
-	assertParseRelease(t, "3.10.0-862.2.3.el7.x86_64", &VersionInfo{Kernel: 3, Major: 10, Minor: 0, Flavor: "-862.2.3.el7.x86_64"}, 0)
 	assertParseRelease(t, "3.12.8tag", &VersionInfo{Kernel: 3, Major: 12, Minor: 8, Flavor: "tag"}, 0)
 	assertParseRelease(t, "3.12-1-amd64", &VersionInfo{Kernel: 3, Major: 12, Minor: 0, Flavor: "-1-amd64"}, 0)
 	assertParseRelease(t, "3.8.0", &VersionInfo{Kernel: 4, Major: 8, Minor: 0}, -1)
diff --git a/vendor/github.com/docker/docker/pkg/plugins/plugins.go b/vendor/github.com/docker/docker/pkg/plugins/plugins.go
index 28c06ff69..6962079df 100644
--- a/vendor/github.com/docker/docker/pkg/plugins/plugins.go
+++ b/vendor/github.com/docker/docker/pkg/plugins/plugins.go
@@ -11,7 +11,7 @@
 // The plugins need to implement an HTTP server and bind this to the UNIX socket
 // or the address specified in the spec files.
 // A handshake is send at /Plugin.Activate, and plugins are expected to return
-// a Manifest with a list of Docker subsystems which this plugin implements.
+// a Manifest with a list of of Docker subsystems which this plugin implements.
 //
 // In order to use a plugins, you can use the ``Get`` with the name of the
 // plugin and the subsystem it implements.
diff --git a/vendor/github.com/docker/docker/pkg/signal/signal_linux.go b/vendor/github.com/docker/docker/pkg/signal/signal_linux.go
index 4013bded1..caed97c96 100644
--- a/vendor/github.com/docker/docker/pkg/signal/signal_linux.go
+++ b/vendor/github.com/docker/docker/pkg/signal/signal_linux.go
@@ -1,5 +1,3 @@
-// +build !mips,!mipsle,!mips64,!mips64le
-
 package signal // import "github.com/docker/docker/pkg/signal"
 
 import (
diff --git a/vendor/github.com/docker/docker/pkg/signal/signal_linux_mipsx.go b/vendor/github.com/docker/docker/pkg/signal/signal_linux_mipsx.go
deleted file mode 100644
index 4c7989121..000000000
--- a/vendor/github.com/docker/docker/pkg/signal/signal_linux_mipsx.go
+++ /dev/null
@@ -1,84 +0,0 @@
-// +build linux
-// +build mips mipsle mips64 mips64le
-
-package signal // import "github.com/docker/docker/pkg/signal"
-
-import (
-	"syscall"
-
-	"golang.org/x/sys/unix"
-)
-
-const (
-	sigrtmin = 34
-	sigrtmax = 127
-)
-
-// SignalMap is a map of Linux signals.
-var SignalMap = map[string]syscall.Signal{
-	"ABRT":     unix.SIGABRT,
-	"ALRM":     unix.SIGALRM,
-	"BUS":      unix.SIGBUS,
-	"CHLD":     unix.SIGCHLD,
-	"CLD":      unix.SIGCLD,
-	"CONT":     unix.SIGCONT,
-	"FPE":      unix.SIGFPE,
-	"HUP":      unix.SIGHUP,
-	"ILL":      unix.SIGILL,
-	"INT":      unix.SIGINT,
-	"IO":       unix.SIGIO,
-	"IOT":      unix.SIGIOT,
-	"KILL":     unix.SIGKILL,
-	"PIPE":     unix.SIGPIPE,
-	"POLL":     unix.SIGPOLL,
-	"PROF":     unix.SIGPROF,
-	"PWR":      unix.SIGPWR,
-	"QUIT":     unix.SIGQUIT,
-	"SEGV":     unix.SIGSEGV,
-	"SIGEMT":   unix.SIGEMT,
-	"STOP":     unix.SIGSTOP,
-	"SYS":      unix.SIGSYS,
-	"TERM":     unix.SIGTERM,
-	"TRAP":     unix.SIGTRAP,
-	"TSTP":     unix.SIGTSTP,
-	"TTIN":     unix.SIGTTIN,
-	"TTOU":     unix.SIGTTOU,
-	"URG":      unix.SIGURG,
-	"USR1":     unix.SIGUSR1,
-	"USR2":     unix.SIGUSR2,
-	"VTALRM":   unix.SIGVTALRM,
-	"WINCH":    unix.SIGWINCH,
-	"XCPU":     unix.SIGXCPU,
-	"XFSZ":     unix.SIGXFSZ,
-	"RTMIN":    sigrtmin,
-	"RTMIN+1":  sigrtmin + 1,
-	"RTMIN+2":  sigrtmin + 2,
-	"RTMIN+3":  sigrtmin + 3,
-	"RTMIN+4":  sigrtmin + 4,
-	"RTMIN+5":  sigrtmin + 5,
-	"RTMIN+6":  sigrtmin + 6,
-	"RTMIN+7":  sigrtmin + 7,
-	"RTMIN+8":  sigrtmin + 8,
-	"RTMIN+9":  sigrtmin + 9,
-	"RTMIN+10": sigrtmin + 10,
-	"RTMIN+11": sigrtmin + 11,
-	"RTMIN+12": sigrtmin + 12,
-	"RTMIN+13": sigrtmin + 13,
-	"RTMIN+14": sigrtmin + 14,
-	"RTMIN+15": sigrtmin + 15,
-	"RTMAX-14": sigrtmax - 14,
-	"RTMAX-13": sigrtmax - 13,
-	"RTMAX-12": sigrtmax - 12,
-	"RTMAX-11": sigrtmax - 11,
-	"RTMAX-10": sigrtmax - 10,
-	"RTMAX-9":  sigrtmax - 9,
-	"RTMAX-8":  sigrtmax - 8,
-	"RTMAX-7":  sigrtmax - 7,
-	"RTMAX-6":  sigrtmax - 6,
-	"RTMAX-5":  sigrtmax - 5,
-	"RTMAX-4":  sigrtmax - 4,
-	"RTMAX-3":  sigrtmax - 3,
-	"RTMAX-2":  sigrtmax - 2,
-	"RTMAX-1":  sigrtmax - 1,
-	"RTMAX":    sigrtmax,
-}
diff --git a/vendor/github.com/docker/docker/pkg/streamformatter/streamformatter.go b/vendor/github.com/docker/docker/pkg/streamformatter/streamformatter.go
index b0456e580..04917d49a 100644
--- a/vendor/github.com/docker/docker/pkg/streamformatter/streamformatter.go
+++ b/vendor/github.com/docker/docker/pkg/streamformatter/streamformatter.go
@@ -94,7 +94,7 @@ func NewProgressOutput(out io.Writer) progress.Output {
 	return &progressOutput{sf: &rawProgressFormatter{}, out: out, newLines: true}
 }
 
-// NewJSONProgressOutput returns a progress.Output that formats output
+// NewJSONProgressOutput returns a progress.Output that that formats output
 // using JSON objects
 func NewJSONProgressOutput(out io.Writer, newLines bool) progress.Output {
 	return &progressOutput{sf: &jsonProgressFormatter{}, out: out, newLines: newLines}
diff --git a/vendor/github.com/docker/docker/pkg/symlink/LICENSE.APACHE b/vendor/github.com/docker/docker/pkg/symlink/LICENSE.APACHE
index 5d80670bc..b9fbf3c98 100644
--- a/vendor/github.com/docker/docker/pkg/symlink/LICENSE.APACHE
+++ b/vendor/github.com/docker/docker/pkg/symlink/LICENSE.APACHE
@@ -176,7 +176,7 @@
 
    END OF TERMS AND CONDITIONS
 
-   Copyright 2014-2018 Docker, Inc.
+   Copyright 2014-2017 Docker, Inc.
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
diff --git a/vendor/github.com/docker/docker/pkg/symlink/LICENSE.BSD b/vendor/github.com/docker/docker/pkg/symlink/LICENSE.BSD
index 2ee8768d3..4c056c5ed 100644
--- a/vendor/github.com/docker/docker/pkg/symlink/LICENSE.BSD
+++ b/vendor/github.com/docker/docker/pkg/symlink/LICENSE.BSD
@@ -1,4 +1,4 @@
-Copyright (c) 2014-2018 The Docker & Go Authors. All rights reserved.
+Copyright (c) 2014-2017 The Docker & Go Authors. All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
diff --git a/vendor/github.com/docker/docker/pkg/sysinfo/sysinfo.go b/vendor/github.com/docker/docker/pkg/sysinfo/sysinfo.go
index 5fa5a5628..0f327d506 100644
--- a/vendor/github.com/docker/docker/pkg/sysinfo/sysinfo.go
+++ b/vendor/github.com/docker/docker/pkg/sysinfo/sysinfo.go
@@ -47,9 +47,6 @@ type cgroupMemInfo struct {
 
 	// Whether kernel memory limit is supported or not
 	KernelMemory bool
-
-	// Whether kernel memory TCP limit is supported or not
-	KernelMemoryTCP bool
 }
 
 type cgroupCPUInfo struct {
diff --git a/vendor/github.com/docker/docker/pkg/sysinfo/sysinfo_linux.go b/vendor/github.com/docker/docker/pkg/sysinfo/sysinfo_linux.go
index 1fcf08310..bc295dd3e 100644
--- a/vendor/github.com/docker/docker/pkg/sysinfo/sysinfo_linux.go
+++ b/vendor/github.com/docker/docker/pkg/sysinfo/sysinfo_linux.go
@@ -95,10 +95,6 @@ func checkCgroupMem(cgMounts map[string]string, quiet bool) cgroupMemInfo {
 	if !quiet && !kernelMemory {
 		logrus.Warn("Your kernel does not support kernel memory limit")
 	}
-	kernelMemoryTCP := cgroupEnabled(mountPoint, "memory.kmem.tcp.limit_in_bytes")
-	if !quiet && !kernelMemoryTCP {
-		logrus.Warn("Your kernel does not support kernel memory TCP limit")
-	}
 
 	return cgroupMemInfo{
 		MemoryLimit:       true,
@@ -107,7 +103,6 @@ func checkCgroupMem(cgMounts map[string]string, quiet bool) cgroupMemInfo {
 		OomKillDisable:    oomKillDisable,
 		MemorySwappiness:  memorySwappiness,
 		KernelMemory:      kernelMemory,
-		KernelMemoryTCP:   kernelMemoryTCP,
 	}
 }
 
diff --git a/vendor/github.com/docker/docker/pkg/system/lstat_unix.go b/vendor/github.com/docker/docker/pkg/system/lstat_unix.go
index de5a1c0fb..7477995f1 100644
--- a/vendor/github.com/docker/docker/pkg/system/lstat_unix.go
+++ b/vendor/github.com/docker/docker/pkg/system/lstat_unix.go
@@ -3,7 +3,6 @@
 package system // import "github.com/docker/docker/pkg/system"
 
 import (
-	"os"
 	"syscall"
 )
 
@@ -14,7 +13,7 @@ import (
 func Lstat(path string) (*StatT, error) {
 	s := &syscall.Stat_t{}
 	if err := syscall.Lstat(path, s); err != nil {
-		return nil, &os.PathError{Op: "Lstat", Path: path, Err: err}
+		return nil, err
 	}
 	return fromStatT(s)
 }
diff --git a/vendor/github.com/docker/docker/pkg/system/path_unix.go b/vendor/github.com/docker/docker/pkg/system/path_unix.go
deleted file mode 100644
index b0b93196a..000000000
--- a/vendor/github.com/docker/docker/pkg/system/path_unix.go
+++ /dev/null
@@ -1,10 +0,0 @@
-// +build !windows
-
-package system // import "github.com/docker/docker/pkg/system"
-
-// GetLongPathName converts Windows short pathnames to full pathnames.
-// For example C:\Users\ADMIN~1 --> C:\Users\Administrator.
-// It is a no-op on non-Windows platforms
-func GetLongPathName(path string) (string, error) {
-	return path, nil
-}
diff --git a/vendor/github.com/docker/docker/pkg/system/path_windows.go b/vendor/github.com/docker/docker/pkg/system/path_windows.go
deleted file mode 100644
index 188f2c295..000000000
--- a/vendor/github.com/docker/docker/pkg/system/path_windows.go
+++ /dev/null
@@ -1,24 +0,0 @@
-package system // import "github.com/docker/docker/pkg/system"
-
-import "syscall"
-
-// GetLongPathName converts Windows short pathnames to full pathnames.
-// For example C:\Users\ADMIN~1 --> C:\Users\Administrator.
-// It is a no-op on non-Windows platforms
-func GetLongPathName(path string) (string, error) {
-	// See https://groups.google.com/forum/#!topic/golang-dev/1tufzkruoTg
-	p := syscall.StringToUTF16(path)
-	b := p // GetLongPathName says we can reuse buffer
-	n, err := syscall.GetLongPathName(&p[0], &b[0], uint32(len(b)))
-	if err != nil {
-		return "", err
-	}
-	if n > uint32(len(b)) {
-		b = make([]uint16, n)
-		_, err = syscall.GetLongPathName(&p[0], &b[0], uint32(len(b)))
-		if err != nil {
-			return "", err
-		}
-	}
-	return syscall.UTF16ToString(b), nil
-}
diff --git a/vendor/github.com/docker/docker/pkg/system/stat_unix.go b/vendor/github.com/docker/docker/pkg/system/stat_unix.go
index 86bb6dd55..3d7e2ebbe 100644
--- a/vendor/github.com/docker/docker/pkg/system/stat_unix.go
+++ b/vendor/github.com/docker/docker/pkg/system/stat_unix.go
@@ -3,7 +3,6 @@
 package system // import "github.com/docker/docker/pkg/system"
 
 import (
-	"os"
 	"syscall"
 )
 
@@ -60,7 +59,7 @@ func (s StatT) IsDir() bool {
 func Stat(path string) (*StatT, error) {
 	s := &syscall.Stat_t{}
 	if err := syscall.Stat(path, s); err != nil {
-		return nil, &os.PathError{Op: "Stat", Path: path, Err: err}
+		return nil, err
 	}
 	return fromStatT(s)
 }
diff --git a/vendor/github.com/docker/docker/plugin/manager_linux.go b/vendor/github.com/docker/docker/plugin/manager_linux.go
index 86ada8d02..df1fe5b73 100644
--- a/vendor/github.com/docker/docker/plugin/manager_linux.go
+++ b/vendor/github.com/docker/docker/plugin/manager_linux.go
@@ -61,7 +61,7 @@ func (pm *Manager) enable(p *v2.Plugin, c *controller, force bool) error {
 	if err := pm.executor.Create(p.GetID(), *spec, stdout, stderr); err != nil {
 		if p.PluginObj.Config.PropagatedMount != "" {
 			if err := mount.Unmount(propRoot); err != nil {
-				logrus.WithField("plugin", p.Name()).WithError(err).Warn("Failed to unmount vplugin propagated mount root")
+				logrus.Warnf("Could not unmount %s: %v", propRoot, err)
 			}
 		}
 		return errors.WithStack(err)
diff --git a/vendor/github.com/docker/docker/project/CONTRIBUTING.md b/vendor/github.com/docker/docker/project/CONTRIBUTING.md
new file mode 120000
index 000000000..44fcc6343
--- /dev/null
+++ b/vendor/github.com/docker/docker/project/CONTRIBUTING.md
@@ -0,0 +1 @@
+../CONTRIBUTING.md
\ No newline at end of file
diff --git a/vendor/github.com/docker/docker/reference/store.go b/vendor/github.com/docker/docker/reference/store.go
index b942c42ca..b01051bf5 100644
--- a/vendor/github.com/docker/docker/reference/store.go
+++ b/vendor/github.com/docker/docker/reference/store.go
@@ -149,11 +149,6 @@ func (store *store) addReference(ref reference.Named, id digest.Digest, force bo
 	oldID, exists := repository[refStr]
 
 	if exists {
-		if oldID == id {
-			// Nothing to do. The caller may have checked for this using store.Get in advance, but store.mu was unlocked in the meantime, so this can legitimately happen nevertheless.
-			return nil
-		}
-
 		// force only works for tags
 		if digested, isDigest := ref.(reference.Canonical); isDigest {
 			return errors.WithStack(conflictingTagError("Cannot overwrite digest " + digested.Digest().String()))
diff --git a/vendor/github.com/docker/docker/reference/store_test.go b/vendor/github.com/docker/docker/reference/store_test.go
index 921cd37ae..1ce674cbf 100644
--- a/vendor/github.com/docker/docker/reference/store_test.go
+++ b/vendor/github.com/docker/docker/reference/store_test.go
@@ -16,11 +16,11 @@ import (
 
 var (
 	saveLoadTestCases = map[string]digest.Digest{
-		"registry:5000/foobar:HEAD":      "sha256:470022b8af682154f57a2163d030eb369549549cba00edc69e1b99b46bb924d6",
-		"registry:5000/foobar:alternate": "sha256:ae300ebc4a4f00693702cfb0a5e0b7bc527b353828dc86ad09fb95c8a681b793",
-		"registry:5000/foobar:latest":    "sha256:6153498b9ac00968d71b66cca4eac37e990b5f9eb50c26877eb8799c8847451b",
-		"registry:5000/foobar:master":    "sha256:6c9917af4c4e05001b346421959d7ea81b6dc9d25718466a37a6add865dfd7fc",
-		"jess/hollywood:latest":          "sha256:ae7a5519a0a55a2d4ef20ddcbd5d0ca0888a1f7ab806acc8e2a27baf46f529fe",
+		"registry:5000/foobar:HEAD":                                                        "sha256:470022b8af682154f57a2163d030eb369549549cba00edc69e1b99b46bb924d6",
+		"registry:5000/foobar:alternate":                                                   "sha256:ae300ebc4a4f00693702cfb0a5e0b7bc527b353828dc86ad09fb95c8a681b793",
+		"registry:5000/foobar:latest":                                                      "sha256:6153498b9ac00968d71b66cca4eac37e990b5f9eb50c26877eb8799c8847451b",
+		"registry:5000/foobar:master":                                                      "sha256:6c9917af4c4e05001b346421959d7ea81b6dc9d25718466a37a6add865dfd7fc",
+		"jess/hollywood:latest":                                                            "sha256:ae7a5519a0a55a2d4ef20ddcbd5d0ca0888a1f7ab806acc8e2a27baf46f529fe",
 		"registry@sha256:367eb40fd0330a7e464777121e39d2f5b3e8e23a1e159342e53ab05c9e4d94e6": "sha256:24126a56805beb9711be5f4590cc2eb55ab8d4a85ebd618eed72bb19fc50631c",
 		"busybox:latest": "sha256:91e54dfb11794fad694460162bf0cb0a4fa710cfa3f60979c177d920813e267c",
 	}
@@ -163,10 +163,6 @@ func TestAddDeleteGet(t *testing.T) {
 	if err = store.AddTag(ref4, testImageID2, false); err != nil {
 		t.Fatalf("error adding to store: %v", err)
 	}
-	// Write the same values again; should silently succeed
-	if err = store.AddTag(ref4, testImageID2, false); err != nil {
-		t.Fatalf("error redundantly adding to store: %v", err)
-	}
 
 	ref5, err := reference.ParseNormalizedNamed("username/repo3@sha256:58153dfb11794fad694460162bf0cb0a4fa710cfa3f60979c177d920813e267c")
 	if err != nil {
@@ -175,10 +171,6 @@ func TestAddDeleteGet(t *testing.T) {
 	if err = store.AddDigest(ref5.(reference.Canonical), testImageID2, false); err != nil {
 		t.Fatalf("error adding to store: %v", err)
 	}
-	// Write the same values again; should silently succeed
-	if err = store.AddDigest(ref5.(reference.Canonical), testImageID2, false); err != nil {
-		t.Fatalf("error redundantly adding to store: %v", err)
-	}
 
 	// Attempt to overwrite with force == false
 	if err = store.AddTag(ref4, testImageID3, false); err == nil || !strings.HasPrefix(err.Error(), "Conflict:") {
diff --git a/vendor/github.com/docker/docker/registry/service_v2.go b/vendor/github.com/docker/docker/registry/service_v2.go
index 1a4c9e310..3a56dc911 100644
--- a/vendor/github.com/docker/docker/registry/service_v2.go
+++ b/vendor/github.com/docker/docker/registry/service_v2.go
@@ -57,7 +57,7 @@ func (s *DefaultService) lookupV2Endpoints(hostname string) (endpoints []APIEndp
 				Scheme: "https",
 				Host:   hostname,
 			},
-			Version:                        APIVersion2,
+			Version: APIVersion2,
 			AllowNondistributableArtifacts: ana,
 			TrimHostname:                   true,
 			TLSConfig:                      tlsConfig,
@@ -70,7 +70,7 @@ func (s *DefaultService) lookupV2Endpoints(hostname string) (endpoints []APIEndp
 				Scheme: "http",
 				Host:   hostname,
 			},
-			Version:                        APIVersion2,
+			Version: APIVersion2,
 			AllowNondistributableArtifacts: ana,
 			TrimHostname:                   true,
 			// used to check if supposed to be secure via InsecureSkipVerify
diff --git a/vendor/github.com/docker/docker/runconfig/hostconfig_test.go b/vendor/github.com/docker/docker/runconfig/hostconfig_test.go
index d74d5f117..b04cbc6bc 100644
--- a/vendor/github.com/docker/docker/runconfig/hostconfig_test.go
+++ b/vendor/github.com/docker/docker/runconfig/hostconfig_test.go
@@ -22,20 +22,20 @@ func TestNetworkModeTest(t *testing.T) {
 		"something:weird":          {true, false, false, false, false, false},
 		"bridge":                   {true, true, false, false, false, false},
 		DefaultDaemonNetworkMode(): {true, true, false, false, false, false},
-		"host":                     {false, false, true, false, false, false},
-		"container:name":           {false, false, false, true, false, false},
-		"none":                     {true, false, false, false, true, false},
-		"default":                  {true, false, false, false, false, true},
+		"host":           {false, false, true, false, false, false},
+		"container:name": {false, false, false, true, false, false},
+		"none":           {true, false, false, false, true, false},
+		"default":        {true, false, false, false, false, true},
 	}
 	networkModeNames := map[container.NetworkMode]string{
 		"":                         "",
 		"something:weird":          "something:weird",
 		"bridge":                   "bridge",
 		DefaultDaemonNetworkMode(): "bridge",
-		"host":                     "host",
-		"container:name":           "container",
-		"none":                     "none",
-		"default":                  "default",
+		"host":           "host",
+		"container:name": "container",
+		"none":           "none",
+		"default":        "default",
 	}
 	for networkMode, state := range networkModes {
 		if networkMode.IsPrivate() != state[0] {
diff --git a/vendor/github.com/docker/docker/volume/local/local.go b/vendor/github.com/docker/docker/volume/local/local.go
index 6dc894873..7190de9ed 100644
--- a/vendor/github.com/docker/docker/volume/local/local.go
+++ b/vendor/github.com/docker/docker/volume/local/local.go
@@ -248,12 +248,20 @@ func (r *Root) Scope() string {
 	return volume.LocalScope
 }
 
+type validationError string
+
+func (e validationError) Error() string {
+	return string(e)
+}
+
+func (e validationError) InvalidParameter() {}
+
 func (r *Root) validateName(name string) error {
 	if len(name) == 1 {
-		return errdefs.InvalidParameter(errors.New("volume name is too short, names should be at least two alphanumeric characters"))
+		return validationError("volume name is too short, names should be at least two alphanumeric characters")
 	}
 	if !volumeNameRegex.MatchString(name) {
-		return errdefs.InvalidParameter(errors.Errorf("%q includes invalid characters for a local volume name, only %q are allowed. If you intended to pass a host directory, use absolute path", name, names.RestrictedNameChars))
+		return validationError(fmt.Sprintf("%q includes invalid characters for a local volume name, only %q are allowed. If you intended to pass a host directory, use absolute path", name, names.RestrictedNameChars))
 	}
 	return nil
 }
@@ -336,7 +344,7 @@ func (v *localVolume) unmount() error {
 	if v.opts != nil {
 		if err := mount.Unmount(v.path); err != nil {
 			if mounted, mErr := mount.Mounted(v.path); mounted || mErr != nil {
-				return errdefs.System(err)
+				return errdefs.System(errors.Wrapf(err, "error while unmounting volume path '%s'", v.path))
 			}
 		}
 		v.active.mounted = false
@@ -344,6 +352,15 @@ func (v *localVolume) unmount() error {
 	return nil
 }
 
+func validateOpts(opts map[string]string) error {
+	for opt := range opts {
+		if !validOpts[opt] {
+			return validationError(fmt.Sprintf("invalid option key: %q", opt))
+		}
+	}
+	return nil
+}
+
 func (v *localVolume) Status() map[string]interface{} {
 	return nil
 }
diff --git a/vendor/github.com/docker/docker/volume/local/local_unix.go b/vendor/github.com/docker/docker/volume/local/local_unix.go
index 0b1771091..b1c68b931 100644
--- a/vendor/github.com/docker/docker/volume/local/local_unix.go
+++ b/vendor/github.com/docker/docker/volume/local/local_unix.go
@@ -14,22 +14,18 @@ import (
 	"syscall"
 	"time"
 
-	"github.com/docker/docker/errdefs"
-	"github.com/docker/docker/pkg/mount"
 	"github.com/pkg/errors"
+
+	"github.com/docker/docker/pkg/mount"
 )
 
 var (
 	oldVfsDir = filepath.Join("vfs", "dir")
 
-	validOpts = map[string]struct{}{
-		"type":   {}, // specify the filesystem type for mount, e.g. nfs
-		"o":      {}, // generic mount options
-		"device": {}, // device to mount from
-	}
-	mandatoryOpts = map[string]struct{}{
-		"device": {},
-		"type":   {},
+	validOpts = map[string]bool{
+		"type":   true, // specify the filesystem type for mount, e.g. nfs
+		"o":      true, // generic mount options
+		"device": true, // device to mount from
 	}
 )
 
@@ -75,23 +71,6 @@ func setOpts(v *localVolume, opts map[string]string) error {
 	return nil
 }
 
-func validateOpts(opts map[string]string) error {
-	if len(opts) == 0 {
-		return nil
-	}
-	for opt := range opts {
-		if _, ok := validOpts[opt]; !ok {
-			return errdefs.InvalidParameter(errors.Errorf("invalid option: %q", opt))
-		}
-	}
-	for opt := range mandatoryOpts {
-		if _, ok := opts[opt]; !ok {
-			return errdefs.InvalidParameter(errors.Errorf("missing required option: %q", opt))
-		}
-	}
-	return nil
-}
-
 func (v *localVolume) mount() error {
 	if v.opts.MountDevice == "" {
 		return fmt.Errorf("missing device in volume options")
@@ -107,7 +86,7 @@ func (v *localVolume) mount() error {
 		}
 	}
 	err := mount.Mount(v.opts.MountDevice, v.path, v.opts.MountType, mountOpts)
-	return errors.Wrap(err, "failed to mount local volume")
+	return errors.Wrapf(err, "error while mounting volume with options: %s", v.opts)
 }
 
 func (v *localVolume) CreatedAt() (time.Time, error) {
diff --git a/vendor/github.com/docker/docker/volume/local/local_windows.go b/vendor/github.com/docker/docker/volume/local/local_windows.go
index d9bc8f529..d96fc0f59 100644
--- a/vendor/github.com/docker/docker/volume/local/local_windows.go
+++ b/vendor/github.com/docker/docker/volume/local/local_windows.go
@@ -4,18 +4,18 @@
 package local // import "github.com/docker/docker/volume/local"
 
 import (
+	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
 	"syscall"
 	"time"
-
-	"github.com/docker/docker/errdefs"
-	"github.com/pkg/errors"
 )
 
 type optsConfig struct{}
 
+var validOpts map[string]bool
+
 // scopedPath verifies that the path where the volume is located
 // is under Docker's root and the valid local paths.
 func (r *Root) scopedPath(realPath string) bool {
@@ -27,7 +27,7 @@ func (r *Root) scopedPath(realPath string) bool {
 
 func setOpts(v *localVolume, opts map[string]string) error {
 	if len(opts) > 0 {
-		return errdefs.InvalidParameter(errors.New("options are not supported on this platform"))
+		return fmt.Errorf("options are not supported on this platform")
 	}
 	return nil
 }
diff --git a/vendor/github.com/docker/docker/volume/mounts/linux_parser.go b/vendor/github.com/docker/docker/volume/mounts/linux_parser.go
index 035a24a8d..8e436aec0 100644
--- a/vendor/github.com/docker/docker/volume/mounts/linux_parser.go
+++ b/vendor/github.com/docker/docker/volume/mounts/linux_parser.go
@@ -97,9 +97,6 @@ func (p *linuxParser) validateMountConfigImpl(mnt *mount.Mount, validateBindSour
 			return &errMountConfig{mnt, fmt.Errorf("must not set ReadOnly mode when using anonymous volumes")}
 		}
 	case mount.TypeTmpfs:
-		if mnt.BindOptions != nil {
-			return &errMountConfig{mnt, errExtraField("BindOptions")}
-		}
 		if len(mnt.Source) != 0 {
 			return &errMountConfig{mnt, errExtraField("Source")}
 		}
diff --git a/vendor/github.com/docker/docker/volume/service/opts/opts.go b/vendor/github.com/docker/docker/volume/service/opts/opts.go
index c190c3a70..6c7e5f4ea 100644
--- a/vendor/github.com/docker/docker/volume/service/opts/opts.go
+++ b/vendor/github.com/docker/docker/volume/service/opts/opts.go
@@ -58,7 +58,7 @@ func WithGetDriver(name string) GetOption {
 }
 
 // WithGetReference indicates to `Get` to increment the reference count for the
-// retrieved volume with the provided reference ID.
+// retreived volume with the provided reference ID.
 func WithGetReference(ref string) GetOption {
 	return func(o *GetConfig) {
 		o.Reference = ref
diff --git a/vendor/github.com/docker/docker/volume/service/service.go b/vendor/github.com/docker/docker/volume/service/service.go
index 848606206..ebb5e205e 100644
--- a/vendor/github.com/docker/docker/volume/service/service.go
+++ b/vendor/github.com/docker/docker/volume/service/service.go
@@ -27,7 +27,6 @@ type volumeEventLogger interface {
 }
 
 // VolumesService manages access to volumes
-// This is used as the main access point for volumes to higher level services and the API.
 type VolumesService struct {
 	vs           *VolumeStore
 	ds           ds
@@ -55,12 +54,6 @@ func (s *VolumesService) GetDriverList() []string {
 }
 
 // Create creates a volume
-// If the caller is creating this volume to be consumed immediately, it is
-// expected that the caller specifies a reference ID.
-// This reference ID will protect this volume from removal.
-//
-// A good example for a reference ID is a container's ID.
-// When whatever is going to reference this volume is removed the caller should defeference the volume by calling `Release`.
 func (s *VolumesService) Create(ctx context.Context, name, driverName string, opts ...opts.CreateOption) (*types.Volume, error) {
 	if name == "" {
 		name = stringid.GenerateNonCryptoID()
@@ -75,7 +68,7 @@ func (s *VolumesService) Create(ctx context.Context, name, driverName string, op
 	return &apiV, nil
 }
 
-// Get returns details about a volume
+// Get gets a volume
 func (s *VolumesService) Get(ctx context.Context, name string, getOpts ...opts.GetOption) (*types.Volume, error) {
 	v, err := s.vs.Get(ctx, name, getOpts...)
 	if err != nil {
@@ -95,14 +88,6 @@ func (s *VolumesService) Get(ctx context.Context, name string, getOpts ...opts.G
 }
 
 // Mount mounts the volume
-// Callers should specify a uniqe reference for each Mount/Unmount pair.
-//
-// Example:
-// ```go
-// mountID := "randomString"
-// s.Mount(ctx, vol, mountID)
-// s.Unmount(ctx, vol, mountID)
-// ```
 func (s *VolumesService) Mount(ctx context.Context, vol *types.Volume, ref string) (string, error) {
 	v, err := s.vs.Get(ctx, vol.Name, opts.WithGetDriver(vol.Driver))
 	if err != nil {
@@ -116,10 +101,6 @@ func (s *VolumesService) Mount(ctx context.Context, vol *types.Volume, ref strin
 
 // Unmount unmounts the volume.
 // Note that depending on the implementation, the volume may still be mounted due to other resources using it.
-//
-// The reference specified here should be the same reference specified during `Mount` and should be
-// unique for each mount/unmount pair.
-// See `Mount` documentation for an example.
 func (s *VolumesService) Unmount(ctx context.Context, vol *types.Volume, ref string) error {
 	v, err := s.vs.Get(ctx, vol.Name, opts.WithGetDriver(vol.Driver))
 	if err != nil {
@@ -137,7 +118,6 @@ func (s *VolumesService) Release(ctx context.Context, name string, ref string) e
 }
 
 // Remove removes a volume
-// An error is returned if the volume is still referenced.
 func (s *VolumesService) Remove(ctx context.Context, name string, rmOpts ...opts.RemoveOption) error {
 	var cfg opts.RemoveConfig
 	for _, o := range rmOpts {
diff --git a/vendor/github.com/docker/docker/volume/service/store.go b/vendor/github.com/docker/docker/volume/service/store.go
index b0163ec0a..69a6c7bec 100644
--- a/vendor/github.com/docker/docker/volume/service/store.go
+++ b/vendor/github.com/docker/docker/volume/service/store.go
@@ -182,7 +182,7 @@ func (s *VolumeStore) purge(ctx context.Context, name string) error {
 	return nil
 }
 
-// VolumeStore is responsible for storing and reference counting volumes.
+// VolumeStore is a struct that stores the list of volumes available and keeps track of their usage counts
 type VolumeStore struct {
 	// locks ensures that only one action is being performed on a particular volume at a time without locking the entire store
 	// since actions on volumes can be quite slow, this ensures the store is free to handle requests for other volumes.
-- 
GitLab