From 1b03f99a1c9803f45f7213d8ed18959be9fa746c Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 17 Jul 2023 07:26:35 +0000
Subject: [PATCH 1/9] dev-lang/go: Update from 1.19.10 to 1.19.11

---
 changelog/updates/2023-07-17-go-1.19.11-update.md               | 1 +
 .../src/third_party/coreos-overlay/dev-lang/go/Manifest         | 2 +-
 .../dev-lang/go/{go-1.19.10.ebuild => go-1.19.11.ebuild}        | 0
 3 files changed, 2 insertions(+), 1 deletion(-)
 create mode 100644 changelog/updates/2023-07-17-go-1.19.11-update.md
 rename sdk_container/src/third_party/coreos-overlay/dev-lang/go/{go-1.19.10.ebuild => go-1.19.11.ebuild} (100%)

diff --git a/changelog/updates/2023-07-17-go-1.19.11-update.md b/changelog/updates/2023-07-17-go-1.19.11-update.md
new file mode 100644
index 0000000000..203ebb1024
--- /dev/null
+++ b/changelog/updates/2023-07-17-go-1.19.11-update.md
@@ -0,0 +1 @@
+- Go ([1.19.11](https://go.dev/doc/devel/release#go1.19.11))
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-lang/go/Manifest b/sdk_container/src/third_party/coreos-overlay/dev-lang/go/Manifest
index 84544fbebf..ba7f4048f8 100644
--- a/sdk_container/src/third_party/coreos-overlay/dev-lang/go/Manifest
+++ b/sdk_container/src/third_party/coreos-overlay/dev-lang/go/Manifest
@@ -1,2 +1,2 @@
-DIST go1.19.10.src.tar.gz 26563069 BLAKE2B 2aec01a67ba3e61f83b635bdf830bf6407342bd877b84367f268560cbb691291825622c4035db99f86ca7ae2153fd11f3f800ab7a90089da7624a531e189f374 SHA512 e8e7d1118d0c409d692ebb406f0e6807781dfd8f7dbe8b03be145e3fc287cde967fde387a216eb9996366508f4e61954cd131cd33f85b652bfd223e37bf41a67
+DIST go1.19.11.src.tar.gz 26568253 BLAKE2B 06d06edd602ee88114353a8d867e9ba0cb88333115d308290b4bc2ec52f7655a50ff506068862c5c5ac8311e4e971635d409b4d6bbff2082f0667b2515e2576f SHA512 da95a1f007a1aff3bd6eeb4b7560654e1ed990e9f6d14663c5309e72714718287a2eb2937f9ec9a041adf384454a2a3bbf8f1671f11c4bd55c76d95e03e7538b
 DIST go1.20.5.src.tar.gz 26192951 BLAKE2B 13ab06a45a7b13eb5cf8886594343bc169df3c4ff0062ac89c0997283686563edccb7d39423457947f945782bef418ab1a1f3b8712aa8817a8f4c61b54e8574c SHA512 94cecb366cd9d9722b53e52ea3b0a5715a9e9dc21da0273dd3db9354557f71b9501b018125ef073dacc2e59125335f436cea1151cd8df0d60e2ad513f841905c
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-lang/go/go-1.19.10.ebuild b/sdk_container/src/third_party/coreos-overlay/dev-lang/go/go-1.19.11.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/dev-lang/go/go-1.19.10.ebuild
rename to sdk_container/src/third_party/coreos-overlay/dev-lang/go/go-1.19.11.ebuild

From dd25c1cd05ee40ae9c59e85637591e9295960274 Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 17 Jul 2023 07:26:42 +0000
Subject: [PATCH 2/9] dev-lang/go: Update from 1.20.5 to 1.20.6

---
 changelog/updates/2023-07-17-go-1.20.6-update.md                | 1 +
 .../src/third_party/coreos-overlay/dev-lang/go/Manifest         | 2 +-
 .../dev-lang/go/{go-1.20.5.ebuild => go-1.20.6.ebuild}          | 0
 3 files changed, 2 insertions(+), 1 deletion(-)
 create mode 100644 changelog/updates/2023-07-17-go-1.20.6-update.md
 rename sdk_container/src/third_party/coreos-overlay/dev-lang/go/{go-1.20.5.ebuild => go-1.20.6.ebuild} (100%)

diff --git a/changelog/updates/2023-07-17-go-1.20.6-update.md b/changelog/updates/2023-07-17-go-1.20.6-update.md
new file mode 100644
index 0000000000..e62dc9aba8
--- /dev/null
+++ b/changelog/updates/2023-07-17-go-1.20.6-update.md
@@ -0,0 +1 @@
+- Go ([1.20.6](https://go.dev/doc/devel/release#go1.20.6))
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-lang/go/Manifest b/sdk_container/src/third_party/coreos-overlay/dev-lang/go/Manifest
index ba7f4048f8..41ce0f4b4b 100644
--- a/sdk_container/src/third_party/coreos-overlay/dev-lang/go/Manifest
+++ b/sdk_container/src/third_party/coreos-overlay/dev-lang/go/Manifest
@@ -1,2 +1,2 @@
 DIST go1.19.11.src.tar.gz 26568253 BLAKE2B 06d06edd602ee88114353a8d867e9ba0cb88333115d308290b4bc2ec52f7655a50ff506068862c5c5ac8311e4e971635d409b4d6bbff2082f0667b2515e2576f SHA512 da95a1f007a1aff3bd6eeb4b7560654e1ed990e9f6d14663c5309e72714718287a2eb2937f9ec9a041adf384454a2a3bbf8f1671f11c4bd55c76d95e03e7538b
-DIST go1.20.5.src.tar.gz 26192951 BLAKE2B 13ab06a45a7b13eb5cf8886594343bc169df3c4ff0062ac89c0997283686563edccb7d39423457947f945782bef418ab1a1f3b8712aa8817a8f4c61b54e8574c SHA512 94cecb366cd9d9722b53e52ea3b0a5715a9e9dc21da0273dd3db9354557f71b9501b018125ef073dacc2e59125335f436cea1151cd8df0d60e2ad513f841905c
+DIST go1.20.6.src.tar.gz 26194491 BLAKE2B 1a31f77ec5208d738ab190557a7b8767d8f8a6d56ae6beda81b55995d4281f11117216124e53c566a032db9cc26e0eea146e2ea8ed02240092e2c78e9b5f32c8 SHA512 509ade7c2a76bd46b26dda4522692ceef5023aae21461b866006341f98544e7ea755aee230a9fea789ed7afb1c49a693c34c8337892e308dfb051aef2b08c975
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-lang/go/go-1.20.5.ebuild b/sdk_container/src/third_party/coreos-overlay/dev-lang/go/go-1.20.6.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/dev-lang/go/go-1.20.5.ebuild
rename to sdk_container/src/third_party/coreos-overlay/dev-lang/go/go-1.20.6.ebuild

From 7ae05d571a54c8dccff21a1b8a05675b9a90e2e4 Mon Sep 17 00:00:00 2001
From: Dongsu Park <dpark@linux.microsoft.com>
Date: Mon, 17 Jul 2023 10:31:40 +0200
Subject: [PATCH 3/9] changelog: add security changelog for Go 1.19.11, 1.20.6

---
 changelog/security/2023-07-17-go-1.19.11-1.20.6.md | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 changelog/security/2023-07-17-go-1.19.11-1.20.6.md

diff --git a/changelog/security/2023-07-17-go-1.19.11-1.20.6.md b/changelog/security/2023-07-17-go-1.19.11-1.20.6.md
new file mode 100644
index 0000000000..ddad66d27b
--- /dev/null
+++ b/changelog/security/2023-07-17-go-1.19.11-1.20.6.md
@@ -0,0 +1 @@
+- Go ([CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406))

From c7209aaf50d9a047833684227ca220560f067322 Mon Sep 17 00:00:00 2001
From: Dongsu Park <dpark@linux.microsoft.com>
Date: Thu, 20 Jul 2023 09:49:07 +0200
Subject: [PATCH 4/9] overlay app-containers/docker: reset to Gentoo

Reset to the state according to the state of Gentoo upstream,
to commit 964117a9a27f8c048d646f423ffaf09b57bfad00,
to create Flatcar patches on top of that.
---
 .../docker/docker-20.10.24-r2.ebuild          | 66 ++++---------------
 ...nrc-Depend-on-containerd-init-script.patch | 28 ++++++++
 .../docker/files/50-docker.network            |  6 --
 .../docker/files/90-docker-veth.network       |  5 --
 .../docker/files/docker.service               | 37 -----------
 .../app-containers/docker/files/docker.socket | 13 ----
 .../app-containers/docker/files/dockerd       | 41 ------------
 7 files changed, 42 insertions(+), 154 deletions(-)
 create mode 100644 sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/0001-Openrc-Depend-on-containerd-init-script.patch
 delete mode 100644 sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/50-docker.network
 delete mode 100644 sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/90-docker-veth.network
 delete mode 100644 sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/docker.service
 delete mode 100644 sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/docker.socket
 delete mode 100644 sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/dockerd

diff --git a/sdk_container/src/third_party/coreos-overlay/app-containers/docker/docker-20.10.24-r2.ebuild b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/docker-20.10.24-r2.ebuild
index 63dc429a82..cbc0f16d21 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-containers/docker/docker-20.10.24-r2.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/docker-20.10.24-r2.ebuild
@@ -7,11 +7,6 @@ MY_PV=${PV/_/-}
 GIT_COMMIT=d6cbf44b8c
 inherit linux-info systemd udev golang-vcs-snapshot
 
-COREOS_GO_VERSION="go1.19"
-COREOS_GO_GO111MODULE="off"
-
-inherit coreos-go-depend
-
 DESCRIPTION="The core functions you need to create Docker images and run Docker containers"
 HOMEPAGE="https://www.docker.com/"
 SRC_URI="https://github.com/moby/moby/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
@@ -19,9 +14,8 @@ SRC_URI="https://github.com/moby/moby/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
 LICENSE="Apache-2.0"
 SLOT="0"
 KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
-# Flatcar: default enable required USE flags
-IUSE="apparmor aufs +btrfs +cli +container-init +device-mapper +hardened
-+overlay +seccomp selinux"
+IUSE="apparmor aufs btrfs +cli +container-init device-mapper hardened
+overlay seccomp selinux"
 
 DEPEND="
 	acct-group/docker
@@ -32,21 +26,11 @@ DEPEND="
 	seccomp? ( >=sys-libs/libseccomp-2.2.1 )
 "
 
-# Flatcar:
-# For CoreOS builds coreos-kernel must be installed because this ebuild
-# checks the kernel config. The kernel config is left by the kernel compile
-# or an explicit copy when installing binary packages. See coreos-kernel.eclass
-DEPEND+="
-	sys-kernel/coreos-kernel
-"
-
 # https://github.com/moby/moby/blob/master/project/PACKAGERS.md#runtime-dependencies
 # https://github.com/moby/moby/blob/master/project/PACKAGERS.md#optional-dependencies
 # https://github.com/moby/moby/tree/master//hack/dockerfile/install
 # make sure docker-proxy is pinned to exact version from ^,
 # for appropriate branchch/version of course
-# Flatcar:
-# containerd ebuild doesn't support apparmor, device-mapper and seccomp use flags
 RDEPEND="
 	${DEPEND}
 	>=net-firewall/iptables-1.4
@@ -54,7 +38,7 @@ RDEPEND="
 	>=dev-vcs/git-1.7
 	>=app-arch/xz-utils-4.9
 	dev-libs/libltdl
-	>=app-containers/containerd-1.6.16[btrfs?]
+	>=app-containers/containerd-1.6.16[apparmor?,btrfs?,device-mapper?,seccomp?]
 	~app-containers/docker-proxy-0.8.0_p20230118
 	cli? ( ~app-containers/docker-cli-${PV} )
 	container-init? ( >=sys-process/tini-0.19.0[static] )
@@ -62,9 +46,9 @@ RDEPEND="
 "
 
 # https://github.com/docker/docker/blob/master/project/PACKAGERS.md#build-dependencies
-# Flatcar: drop go-md2man
 BDEPEND="
 	>=dev-lang/go-1.16.12
+	dev-go/go-md2man
 	virtual/pkgconfig
 "
 # tests require running dockerd as root and downloading containers
@@ -72,9 +56,10 @@ RESTRICT="installsources strip test"
 
 S="${WORKDIR}/${P}/src/${EGO_PN}"
 
-# Flatcar: Dropped outdated bug links, dropped openrc init script patch
+# https://bugs.gentoo.org/748984 https://github.com/etcd-io/etcd/pull/12552
 PATCHES=(
 	"${FILESDIR}/ppc64-buildmode.patch"
+	"${FILESDIR}/0001-Openrc-Depend-on-containerd-init-script.patch"
 )
 
 # see "contrib/check-config.sh" from upstream's sources
@@ -187,17 +172,14 @@ pkg_setup() {
 }
 
 src_compile() {
-	# Flatcar: for cross-compilation
-	go_export
 	export DOCKER_GITCOMMIT="${GIT_COMMIT}"
 	export GOPATH="${WORKDIR}/${P}"
 	export VERSION=${PV}
 
 	# setup CFLAGS and LDFLAGS for separate build target
 	# see https://github.com/tianon/docker-overlay/pull/10
-	# Flatcar: allow injecting CFLAGS/LDFLAGS, which is needed for torcx rpath
-	export CGO_CFLAGS="${CGO_CFLAGS} -I${ESYSROOT}/usr/include"
-	export CGO_LDFLAGS="${CGO_LDFLAGS} -L${ESYSROOT}/usr/$(get_libdir)"
+	export CGO_CFLAGS="-I${ESYSROOT}/usr/include"
+	export CGO_LDFLAGS="-L${ESYSROOT}/usr/$(get_libdir)"
 
 	# let's set up some optional features :)
 	export DOCKER_BUILDTAGS=''
@@ -212,15 +194,11 @@ src_compile() {
 			DOCKER_BUILDTAGS+=" $tag"
 		fi
 	done
-	# Flatcar: Add journald to build tags.
-	DOCKER_BUILDTAGS+=' journald'
 
-	# Flatcar:
-	# inject LDFLAGS for torcx
 	if use hardened; then
-		sed -i "s#EXTLDFLAGS_STATIC='#&-fno-PIC $LDFLAGS #" hack/make.sh || die
+		sed -i "s/EXTLDFLAGS_STATIC='/&-fno-PIC /" hack/make.sh || die
 		grep -q -- '-fno-PIC' hack/make.sh || die 'hardened sed failed'
-		sed  "s#LDFLAGS_STATIC_DOCKER='#&-extldflags \"-fno-PIC $LDFLAGS\" #" \
+		sed  "s/LDFLAGS_STATIC_DOCKER='/&-extldflags -fno-PIC /" \
 			-i hack/make/dynbinary-daemon || die
 		grep -q -- '-fno-PIC' hack/make/dynbinary-daemon || die 'hardened sed failed'
 	fi
@@ -239,32 +217,16 @@ src_install() {
 	newinitd contrib/init/openrc/docker.initd docker
 	newconfd contrib/init/openrc/docker.confd docker
 
-	# Flatcar:
-	# install our systemd units/network config and our wrapper into
-	# /usr/lib/flatcar/docker for backwards compatibility instead of
-	# the units from contrib/init/systemd directory.
-	#
-	# systemd_dounit contrib/init/systemd/docker.{service,socket}
-	exeinto /usr/lib/flatcar
-	doexe "${FILESDIR}/dockerd"
-
-	systemd_dounit "${FILESDIR}/docker.service"
-	systemd_dounit "${FILESDIR}/docker.socket"
-
-	insinto /usr/lib/systemd/network
-	doins "${FILESDIR}/50-docker.network"
-	doins "${FILESDIR}/90-docker-veth.network"
+	systemd_dounit contrib/init/systemd/docker.{service,socket}
 
 	udev_dorules contrib/udev/*.rules
 
 	dodoc AUTHORS CONTRIBUTING.md CHANGELOG.md NOTICE README.md
 	dodoc -r docs/*
 
-	# Flatcar:
-	# don't install contrib bits
-	# # note: intentionally not using "doins" so that we preserve +x bits
-	# dodir /usr/share/${PN}/contrib
-	# cp -R contrib/* "${ED}/usr/share/${PN}/contrib"
+	# note: intentionally not using "doins" so that we preserve +x bits
+	dodir /usr/share/${PN}/contrib
+	cp -R contrib/* "${ED}/usr/share/${PN}/contrib"
 }
 
 pkg_postinst() {
diff --git a/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/0001-Openrc-Depend-on-containerd-init-script.patch b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/0001-Openrc-Depend-on-containerd-init-script.patch
new file mode 100644
index 0000000000..22aa145f33
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/0001-Openrc-Depend-on-containerd-init-script.patch
@@ -0,0 +1,28 @@
+From bb69104381805014eb7675682d204fe460a52388 Mon Sep 17 00:00:00 2001
+From: Jan Breig <git@pygos.space>
+Date: Mon, 16 May 2022 14:58:36 +0200
+Subject: [PATCH] Openrc: Depend on containerd init script
+
+Signed-off-by: Jan Breig <git@pygos.space>
+---
+ contrib/init/openrc/docker.initd | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/contrib/init/openrc/docker.initd b/contrib/init/openrc/docker.initd
+index 3229223bad..57defb8f57 100644
+--- a/contrib/init/openrc/docker.initd
++++ b/contrib/init/openrc/docker.initd
+@@ -17,6 +17,10 @@ rc_ulimit="${DOCKER_ULIMIT:--c unlimited -n 1048576 -u unlimited}"
+ 
+ retry="${DOCKER_RETRY:-TERM/60/KILL/10}"
+ 
++depend() {
++	need containerd
++}
++
+ start_pre() {
+ 	checkpath -f -m 0644 -o root:docker "$DOCKER_LOGFILE"
+ }
+-- 
+2.35.1
+
diff --git a/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/50-docker.network b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/50-docker.network
deleted file mode 100644
index a0d17b5368..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/50-docker.network
+++ /dev/null
@@ -1,6 +0,0 @@
-[Match]
-Type=bridge
-Name=docker* br-*
-
-[Link]
-Unmanaged=yes
diff --git a/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/90-docker-veth.network b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/90-docker-veth.network
deleted file mode 100644
index 3ca3816c23..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/90-docker-veth.network
+++ /dev/null
@@ -1,5 +0,0 @@
-[Match]
-Driver=veth
-
-[Link]
-Unmanaged=yes
diff --git a/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/docker.service b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/docker.service
deleted file mode 100644
index a8f1bf4ef5..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/docker.service
+++ /dev/null
@@ -1,37 +0,0 @@
-[Unit]
-Description=Docker Application Container Engine
-Documentation=http://docs.docker.com
-After=containerd.service docker.socket network-online.target
-Wants=network-online.target
-Requires=containerd.service docker.socket
-
-[Service]
-Type=notify
-EnvironmentFile=-/run/flannel/flannel_docker_opts.env
-Environment=DOCKER_SELINUX=--selinux-enabled=true
-
-# the default is not to use systemd for cgroups because the delegate issues still
-# exists and systemd currently does not support the cgroup feature set required
-# for containers run by docker
-ExecStart=/usr/bin/dockerd --host=fd:// --containerd=/var/run/docker/libcontainerd/docker-containerd.sock $DOCKER_SELINUX $DOCKER_OPTS $DOCKER_CGROUPS $DOCKER_OPT_BIP $DOCKER_OPT_MTU $DOCKER_OPT_IPMASQ
-ExecReload=/bin/kill -s HUP $MAINPID
-LimitNOFILE=1048576
-# Having non-zero Limit*s causes performance problems due to accounting overhead
-# in the kernel. We recommend using cgroups to do container-local accounting.
-LimitNPROC=infinity
-LimitCORE=infinity
-# Uncomment TasksMax if your systemd version supports it.
-# Only systemd 226 and above support this version.
-TasksMax=infinity
-TimeoutStartSec=0
-# set delegate yes so that systemd does not reset the cgroups of docker containers
-Delegate=yes
-# kill only the docker process, not all processes in the cgroup
-KillMode=process
-# restart the docker process if it exits prematurely
-Restart=on-failure
-StartLimitBurst=3
-StartLimitInterval=60s
-
-[Install]
-WantedBy=multi-user.target
diff --git a/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/docker.socket b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/docker.socket
deleted file mode 100644
index 53133c4f8f..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/docker.socket
+++ /dev/null
@@ -1,13 +0,0 @@
-[Unit]
-Description=Docker Socket for the API
-PartOf=docker.service
-
-[Socket]
-ListenStream=/var/run/docker.sock
-SocketMode=0660
-SocketUser=root
-SocketGroup=docker
-
-[Install]
-WantedBy=sockets.target
-
diff --git a/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/dockerd b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/dockerd
deleted file mode 100644
index 19c440bdda..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/dockerd
+++ /dev/null
@@ -1,41 +0,0 @@
-#!/bin/bash
-# Wrapper for launching docker daemons with selinux default on
-# This wrapper script has been deprecated (euank: 2017-05-09) and is retained
-# for backwards compatibility.
-
-set -e
-
-parse_docker_args() {
-    local flag
-    while [[ $# -gt 0 ]]; do
-        flag="$1"
-        shift
-
-        # treat --flag=foo and --flag foo identically
-        if [[ "${flag}" == *=* ]]; then
-            set -- "${flag#*=}" "$@"
-            flag="${flag%=*}"
-        fi
-
-        case "${flag}" in
-            --selinux-enabled)
-                ARG_SELINUX="$1"
-                shift
-                ;;
-            *)
-                # ignore everything else
-                ;;
-        esac
-    done
-}
-
-parse_docker_args "$@"
-
-USE_SELINUX=""
-# Do not override selinux if it is already explicitly configured.
-if [[ -z "${ARG_SELINUX}" ]]; then
-        # If unspecified, default off
-        USE_SELINUX="--selinux-enabled=false"
-fi
-
-exec dockerd "$@" ${USE_SELINUX}

From 3d001c577d49c792a2638f0cba02130cbe1d89f2 Mon Sep 17 00:00:00 2001
From: Dongsu Park <dpark@linux.microsoft.com>
Date: Thu, 20 Jul 2023 09:59:41 +0200
Subject: [PATCH 5/9] overlay app-containers/docker: Apply Flatcar
 modifications

Apply Flatcar patches, based on commit
9d6af12f1cc48359e0f84654302155b46ad780c7.
---
 .../docker/docker-20.10.24-r2.ebuild          | 66 +++++++++++++++----
 ...nrc-Depend-on-containerd-init-script.patch | 28 --------
 .../docker/files/50-docker.network            |  6 ++
 .../docker/files/90-docker-veth.network       |  5 ++
 .../docker/files/docker.service               | 37 +++++++++++
 .../app-containers/docker/files/docker.socket | 13 ++++
 .../app-containers/docker/files/dockerd       | 41 ++++++++++++
 7 files changed, 154 insertions(+), 42 deletions(-)
 delete mode 100644 sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/0001-Openrc-Depend-on-containerd-init-script.patch
 create mode 100644 sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/50-docker.network
 create mode 100644 sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/90-docker-veth.network
 create mode 100644 sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/docker.service
 create mode 100644 sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/docker.socket
 create mode 100644 sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/dockerd

diff --git a/sdk_container/src/third_party/coreos-overlay/app-containers/docker/docker-20.10.24-r2.ebuild b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/docker-20.10.24-r2.ebuild
index cbc0f16d21..63dc429a82 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-containers/docker/docker-20.10.24-r2.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/docker-20.10.24-r2.ebuild
@@ -7,6 +7,11 @@ MY_PV=${PV/_/-}
 GIT_COMMIT=d6cbf44b8c
 inherit linux-info systemd udev golang-vcs-snapshot
 
+COREOS_GO_VERSION="go1.19"
+COREOS_GO_GO111MODULE="off"
+
+inherit coreos-go-depend
+
 DESCRIPTION="The core functions you need to create Docker images and run Docker containers"
 HOMEPAGE="https://www.docker.com/"
 SRC_URI="https://github.com/moby/moby/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
@@ -14,8 +19,9 @@ SRC_URI="https://github.com/moby/moby/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
 LICENSE="Apache-2.0"
 SLOT="0"
 KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
-IUSE="apparmor aufs btrfs +cli +container-init device-mapper hardened
-overlay seccomp selinux"
+# Flatcar: default enable required USE flags
+IUSE="apparmor aufs +btrfs +cli +container-init +device-mapper +hardened
++overlay +seccomp selinux"
 
 DEPEND="
 	acct-group/docker
@@ -26,11 +32,21 @@ DEPEND="
 	seccomp? ( >=sys-libs/libseccomp-2.2.1 )
 "
 
+# Flatcar:
+# For CoreOS builds coreos-kernel must be installed because this ebuild
+# checks the kernel config. The kernel config is left by the kernel compile
+# or an explicit copy when installing binary packages. See coreos-kernel.eclass
+DEPEND+="
+	sys-kernel/coreos-kernel
+"
+
 # https://github.com/moby/moby/blob/master/project/PACKAGERS.md#runtime-dependencies
 # https://github.com/moby/moby/blob/master/project/PACKAGERS.md#optional-dependencies
 # https://github.com/moby/moby/tree/master//hack/dockerfile/install
 # make sure docker-proxy is pinned to exact version from ^,
 # for appropriate branchch/version of course
+# Flatcar:
+# containerd ebuild doesn't support apparmor, device-mapper and seccomp use flags
 RDEPEND="
 	${DEPEND}
 	>=net-firewall/iptables-1.4
@@ -38,7 +54,7 @@ RDEPEND="
 	>=dev-vcs/git-1.7
 	>=app-arch/xz-utils-4.9
 	dev-libs/libltdl
-	>=app-containers/containerd-1.6.16[apparmor?,btrfs?,device-mapper?,seccomp?]
+	>=app-containers/containerd-1.6.16[btrfs?]
 	~app-containers/docker-proxy-0.8.0_p20230118
 	cli? ( ~app-containers/docker-cli-${PV} )
 	container-init? ( >=sys-process/tini-0.19.0[static] )
@@ -46,9 +62,9 @@ RDEPEND="
 "
 
 # https://github.com/docker/docker/blob/master/project/PACKAGERS.md#build-dependencies
+# Flatcar: drop go-md2man
 BDEPEND="
 	>=dev-lang/go-1.16.12
-	dev-go/go-md2man
 	virtual/pkgconfig
 "
 # tests require running dockerd as root and downloading containers
@@ -56,10 +72,9 @@ RESTRICT="installsources strip test"
 
 S="${WORKDIR}/${P}/src/${EGO_PN}"
 
-# https://bugs.gentoo.org/748984 https://github.com/etcd-io/etcd/pull/12552
+# Flatcar: Dropped outdated bug links, dropped openrc init script patch
 PATCHES=(
 	"${FILESDIR}/ppc64-buildmode.patch"
-	"${FILESDIR}/0001-Openrc-Depend-on-containerd-init-script.patch"
 )
 
 # see "contrib/check-config.sh" from upstream's sources
@@ -172,14 +187,17 @@ pkg_setup() {
 }
 
 src_compile() {
+	# Flatcar: for cross-compilation
+	go_export
 	export DOCKER_GITCOMMIT="${GIT_COMMIT}"
 	export GOPATH="${WORKDIR}/${P}"
 	export VERSION=${PV}
 
 	# setup CFLAGS and LDFLAGS for separate build target
 	# see https://github.com/tianon/docker-overlay/pull/10
-	export CGO_CFLAGS="-I${ESYSROOT}/usr/include"
-	export CGO_LDFLAGS="-L${ESYSROOT}/usr/$(get_libdir)"
+	# Flatcar: allow injecting CFLAGS/LDFLAGS, which is needed for torcx rpath
+	export CGO_CFLAGS="${CGO_CFLAGS} -I${ESYSROOT}/usr/include"
+	export CGO_LDFLAGS="${CGO_LDFLAGS} -L${ESYSROOT}/usr/$(get_libdir)"
 
 	# let's set up some optional features :)
 	export DOCKER_BUILDTAGS=''
@@ -194,11 +212,15 @@ src_compile() {
 			DOCKER_BUILDTAGS+=" $tag"
 		fi
 	done
+	# Flatcar: Add journald to build tags.
+	DOCKER_BUILDTAGS+=' journald'
 
+	# Flatcar:
+	# inject LDFLAGS for torcx
 	if use hardened; then
-		sed -i "s/EXTLDFLAGS_STATIC='/&-fno-PIC /" hack/make.sh || die
+		sed -i "s#EXTLDFLAGS_STATIC='#&-fno-PIC $LDFLAGS #" hack/make.sh || die
 		grep -q -- '-fno-PIC' hack/make.sh || die 'hardened sed failed'
-		sed  "s/LDFLAGS_STATIC_DOCKER='/&-extldflags -fno-PIC /" \
+		sed  "s#LDFLAGS_STATIC_DOCKER='#&-extldflags \"-fno-PIC $LDFLAGS\" #" \
 			-i hack/make/dynbinary-daemon || die
 		grep -q -- '-fno-PIC' hack/make/dynbinary-daemon || die 'hardened sed failed'
 	fi
@@ -217,16 +239,32 @@ src_install() {
 	newinitd contrib/init/openrc/docker.initd docker
 	newconfd contrib/init/openrc/docker.confd docker
 
-	systemd_dounit contrib/init/systemd/docker.{service,socket}
+	# Flatcar:
+	# install our systemd units/network config and our wrapper into
+	# /usr/lib/flatcar/docker for backwards compatibility instead of
+	# the units from contrib/init/systemd directory.
+	#
+	# systemd_dounit contrib/init/systemd/docker.{service,socket}
+	exeinto /usr/lib/flatcar
+	doexe "${FILESDIR}/dockerd"
+
+	systemd_dounit "${FILESDIR}/docker.service"
+	systemd_dounit "${FILESDIR}/docker.socket"
+
+	insinto /usr/lib/systemd/network
+	doins "${FILESDIR}/50-docker.network"
+	doins "${FILESDIR}/90-docker-veth.network"
 
 	udev_dorules contrib/udev/*.rules
 
 	dodoc AUTHORS CONTRIBUTING.md CHANGELOG.md NOTICE README.md
 	dodoc -r docs/*
 
-	# note: intentionally not using "doins" so that we preserve +x bits
-	dodir /usr/share/${PN}/contrib
-	cp -R contrib/* "${ED}/usr/share/${PN}/contrib"
+	# Flatcar:
+	# don't install contrib bits
+	# # note: intentionally not using "doins" so that we preserve +x bits
+	# dodir /usr/share/${PN}/contrib
+	# cp -R contrib/* "${ED}/usr/share/${PN}/contrib"
 }
 
 pkg_postinst() {
diff --git a/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/0001-Openrc-Depend-on-containerd-init-script.patch b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/0001-Openrc-Depend-on-containerd-init-script.patch
deleted file mode 100644
index 22aa145f33..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/0001-Openrc-Depend-on-containerd-init-script.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From bb69104381805014eb7675682d204fe460a52388 Mon Sep 17 00:00:00 2001
-From: Jan Breig <git@pygos.space>
-Date: Mon, 16 May 2022 14:58:36 +0200
-Subject: [PATCH] Openrc: Depend on containerd init script
-
-Signed-off-by: Jan Breig <git@pygos.space>
----
- contrib/init/openrc/docker.initd | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/contrib/init/openrc/docker.initd b/contrib/init/openrc/docker.initd
-index 3229223bad..57defb8f57 100644
---- a/contrib/init/openrc/docker.initd
-+++ b/contrib/init/openrc/docker.initd
-@@ -17,6 +17,10 @@ rc_ulimit="${DOCKER_ULIMIT:--c unlimited -n 1048576 -u unlimited}"
- 
- retry="${DOCKER_RETRY:-TERM/60/KILL/10}"
- 
-+depend() {
-+	need containerd
-+}
-+
- start_pre() {
- 	checkpath -f -m 0644 -o root:docker "$DOCKER_LOGFILE"
- }
--- 
-2.35.1
-
diff --git a/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/50-docker.network b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/50-docker.network
new file mode 100644
index 0000000000..a0d17b5368
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/50-docker.network
@@ -0,0 +1,6 @@
+[Match]
+Type=bridge
+Name=docker* br-*
+
+[Link]
+Unmanaged=yes
diff --git a/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/90-docker-veth.network b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/90-docker-veth.network
new file mode 100644
index 0000000000..3ca3816c23
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/90-docker-veth.network
@@ -0,0 +1,5 @@
+[Match]
+Driver=veth
+
+[Link]
+Unmanaged=yes
diff --git a/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/docker.service b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/docker.service
new file mode 100644
index 0000000000..a8f1bf4ef5
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/docker.service
@@ -0,0 +1,37 @@
+[Unit]
+Description=Docker Application Container Engine
+Documentation=http://docs.docker.com
+After=containerd.service docker.socket network-online.target
+Wants=network-online.target
+Requires=containerd.service docker.socket
+
+[Service]
+Type=notify
+EnvironmentFile=-/run/flannel/flannel_docker_opts.env
+Environment=DOCKER_SELINUX=--selinux-enabled=true
+
+# the default is not to use systemd for cgroups because the delegate issues still
+# exists and systemd currently does not support the cgroup feature set required
+# for containers run by docker
+ExecStart=/usr/bin/dockerd --host=fd:// --containerd=/var/run/docker/libcontainerd/docker-containerd.sock $DOCKER_SELINUX $DOCKER_OPTS $DOCKER_CGROUPS $DOCKER_OPT_BIP $DOCKER_OPT_MTU $DOCKER_OPT_IPMASQ
+ExecReload=/bin/kill -s HUP $MAINPID
+LimitNOFILE=1048576
+# Having non-zero Limit*s causes performance problems due to accounting overhead
+# in the kernel. We recommend using cgroups to do container-local accounting.
+LimitNPROC=infinity
+LimitCORE=infinity
+# Uncomment TasksMax if your systemd version supports it.
+# Only systemd 226 and above support this version.
+TasksMax=infinity
+TimeoutStartSec=0
+# set delegate yes so that systemd does not reset the cgroups of docker containers
+Delegate=yes
+# kill only the docker process, not all processes in the cgroup
+KillMode=process
+# restart the docker process if it exits prematurely
+Restart=on-failure
+StartLimitBurst=3
+StartLimitInterval=60s
+
+[Install]
+WantedBy=multi-user.target
diff --git a/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/docker.socket b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/docker.socket
new file mode 100644
index 0000000000..53133c4f8f
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/docker.socket
@@ -0,0 +1,13 @@
+[Unit]
+Description=Docker Socket for the API
+PartOf=docker.service
+
+[Socket]
+ListenStream=/var/run/docker.sock
+SocketMode=0660
+SocketUser=root
+SocketGroup=docker
+
+[Install]
+WantedBy=sockets.target
+
diff --git a/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/dockerd b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/dockerd
new file mode 100644
index 0000000000..19c440bdda
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/dockerd
@@ -0,0 +1,41 @@
+#!/bin/bash
+# Wrapper for launching docker daemons with selinux default on
+# This wrapper script has been deprecated (euank: 2017-05-09) and is retained
+# for backwards compatibility.
+
+set -e
+
+parse_docker_args() {
+    local flag
+    while [[ $# -gt 0 ]]; do
+        flag="$1"
+        shift
+
+        # treat --flag=foo and --flag foo identically
+        if [[ "${flag}" == *=* ]]; then
+            set -- "${flag#*=}" "$@"
+            flag="${flag%=*}"
+        fi
+
+        case "${flag}" in
+            --selinux-enabled)
+                ARG_SELINUX="$1"
+                shift
+                ;;
+            *)
+                # ignore everything else
+                ;;
+        esac
+    done
+}
+
+parse_docker_args "$@"
+
+USE_SELINUX=""
+# Do not override selinux if it is already explicitly configured.
+if [[ -z "${ARG_SELINUX}" ]]; then
+        # If unspecified, default off
+        USE_SELINUX="--selinux-enabled=false"
+fi
+
+exec dockerd "$@" ${USE_SELINUX}

From 908df5f1579b8e95d9b80616368b9bd21ac783a4 Mon Sep 17 00:00:00 2001
From: Dongsu Park <dpark@linux.microsoft.com>
Date: Thu, 20 Jul 2023 10:02:13 +0200
Subject: [PATCH 6/9] overlay app-containers/docker: fix invalid headers issue
 with Go 1.19.11

Docker client and daemon started to fail at sending or handling most
local connections when being compiled with Go 1.19.11, which addresses
CVE-2023-29406 by blocking invalid host headers of HTTP/1. As a
workaround, Docker started to define a dummy host header, and to use
it for local connections.

Backport the fixes to Flatcar to fix the runtime failures.

See also https://github.com/moby/moby/issues/45935,
https://github.com/moby/moby/pull/45942.
---
 ...24-r2.ebuild => docker-20.10.24-r3.ebuild} |   6 +-
 ...dummy-hostname-to-use-for-local-conn.patch | 161 ++++++++++++++++++
 ...a-dummy-hostname-for-local-connectio.patch |  72 ++++++++
 3 files changed, 238 insertions(+), 1 deletion(-)
 rename sdk_container/src/third_party/coreos-overlay/app-containers/docker/{docker-20.10.24-r2.ebuild => docker-20.10.24-r3.ebuild} (97%)
 create mode 100644 sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/0001-client-define-a-dummy-hostname-to-use-for-local-conn.patch
 create mode 100644 sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/0002-pkg-plugins-use-a-dummy-hostname-for-local-connectio.patch

diff --git a/sdk_container/src/third_party/coreos-overlay/app-containers/docker/docker-20.10.24-r2.ebuild b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/docker-20.10.24-r3.ebuild
similarity index 97%
rename from sdk_container/src/third_party/coreos-overlay/app-containers/docker/docker-20.10.24-r2.ebuild
rename to sdk_container/src/third_party/coreos-overlay/app-containers/docker/docker-20.10.24-r3.ebuild
index 63dc429a82..fd5dc6e762 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-containers/docker/docker-20.10.24-r2.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/docker-20.10.24-r3.ebuild
@@ -72,9 +72,13 @@ RESTRICT="installsources strip test"
 
 S="${WORKDIR}/${P}/src/${EGO_PN}"
 
-# Flatcar: Dropped outdated bug links, dropped openrc init script patch
+# Flatcar: Dropped outdated bug links, dropped openrc init script patch,
+# backport upstream patches for fixing invalid headers issue when building
+# with Go 1.19.11+.
 PATCHES=(
 	"${FILESDIR}/ppc64-buildmode.patch"
+	"${FILESDIR}/0001-client-define-a-dummy-hostname-to-use-for-local-conn.patch"
+	"${FILESDIR}/0002-pkg-plugins-use-a-dummy-hostname-for-local-connectio.patch"
 )
 
 # see "contrib/check-config.sh" from upstream's sources
diff --git a/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/0001-client-define-a-dummy-hostname-to-use-for-local-conn.patch b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/0001-client-define-a-dummy-hostname-to-use-for-local-conn.patch
new file mode 100644
index 0000000000..2009922b4d
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/0001-client-define-a-dummy-hostname-to-use-for-local-conn.patch
@@ -0,0 +1,161 @@
+From 74b4974cb7e7e81e57661f93b03c94a95a15472e Mon Sep 17 00:00:00 2001
+Message-Id: <74b4974cb7e7e81e57661f93b03c94a95a15472e.1689689028.git.dpark@linux.microsoft.com>
+From: Sebastiaan van Stijn <github@gone.nl>
+Date: Wed, 12 Jul 2023 14:15:38 +0200
+Subject: [PATCH 1/2] client: define a "dummy" hostname to use for local
+ connections
+
+For local communications (npipe://, unix://), the hostname is not used,
+but we need valid and meaningful hostname.
+
+The current code used the client's `addr` as hostname in some cases, which
+could contain the path for the unix-socket (`/var/run/docker.sock`), which
+gets rejected by go1.20.6 and go1.19.11 because of a security fix for
+[CVE-2023-29406 ][1], which was implemented in  https://go.dev/issue/60374.
+
+Prior versions go Go would clean the host header, and strip slashes in the
+process, but go1.20.6 and go1.19.11 no longer do, and reject the host
+header.
+
+This patch introduces a `DummyHost` const, and uses this dummy host for
+cases where we don't need an actual hostname.
+
+Before this patch (using go1.20.6):
+
+    make GO_VERSION=1.20.6 TEST_FILTER=TestAttach test-integration
+    === RUN   TestAttachWithTTY
+        attach_test.go:46: assertion failed: error is not nil: http: invalid Host header
+    --- FAIL: TestAttachWithTTY (0.11s)
+    === RUN   TestAttachWithoutTTy
+        attach_test.go:46: assertion failed: error is not nil: http: invalid Host header
+    --- FAIL: TestAttachWithoutTTy (0.02s)
+    FAIL
+
+With this patch applied:
+
+    make GO_VERSION=1.20.6 TEST_FILTER=TestAttach test-integration
+    INFO: Testing against a local daemon
+    === RUN   TestAttachWithTTY
+    --- PASS: TestAttachWithTTY (0.12s)
+    === RUN   TestAttachWithoutTTy
+    --- PASS: TestAttachWithoutTTy (0.02s)
+    PASS
+
+[1]: https://github.com/advisories/GHSA-f8f7-69v5-w4vx
+
+Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
+(cherry picked from commit 92975f0c11f0566cc3c36659f5e3bb9faf5cb176)
+Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
+---
+ client/client.go       | 30 ++++++++++++++++++++++++++++++
+ client/hijack.go       |  6 +++++-
+ client/request.go      | 14 ++++++--------
+ client/request_test.go |  4 ++--
+ 4 files changed, 43 insertions(+), 11 deletions(-)
+
+diff --git a/client/client.go b/client/client.go
+index 0d3614d5..d0ce09ae 100644
+--- a/client/client.go
++++ b/client/client.go
+@@ -56,6 +56,36 @@ import (
+ 	"github.com/pkg/errors"
+ )
+ 
++// DummyHost is a hostname used for local communication.
++//
++// It acts as a valid formatted hostname for local connections (such as "unix://"
++// or "npipe://") which do not require a hostname. It should never be resolved,
++// but uses the special-purpose ".localhost" TLD (as defined in [RFC 2606, Section 2]
++// and [RFC 6761, Section 6.3]).
++//
++// [RFC 7230, Section 5.4] defines that an empty header must be used for such
++// cases:
++//
++//	If the authority component is missing or undefined for the target URI,
++//	then a client MUST send a Host header field with an empty field-value.
++//
++// However, [Go stdlib] enforces the semantics of HTTP(S) over TCP, does not
++// allow an empty header to be used, and requires req.URL.Scheme to be either
++// "http" or "https".
++//
++// For further details, refer to:
++//
++//   - https://github.com/docker/engine-api/issues/189
++//   - https://github.com/golang/go/issues/13624
++//   - https://github.com/golang/go/issues/61076
++//   - https://github.com/moby/moby/issues/45935
++//
++// [RFC 2606, Section 2]: https://www.rfc-editor.org/rfc/rfc2606.html#section-2
++// [RFC 6761, Section 6.3]: https://www.rfc-editor.org/rfc/rfc6761#section-6.3
++// [RFC 7230, Section 5.4]: https://datatracker.ietf.org/doc/html/rfc7230#section-5.4
++// [Go stdlib]: https://github.com/golang/go/blob/6244b1946bc2101b01955468f1be502dbadd6807/src/net/http/transport.go#L558-L569
++const DummyHost = "api.moby.localhost"
++
+ // ErrRedirect is the error returned by checkRedirect when the request is non-GET.
+ var ErrRedirect = errors.New("unexpected redirect in response")
+ 
+diff --git a/client/hijack.go b/client/hijack.go
+index e1dc49ef..b8fac0be 100644
+--- a/client/hijack.go
++++ b/client/hijack.go
+@@ -62,7 +62,11 @@ func fallbackDial(proto, addr string, tlsConfig *tls.Config) (net.Conn, error) {
+ }
+ 
+ func (cli *Client) setupHijackConn(ctx context.Context, req *http.Request, proto string) (net.Conn, error) {
+-	req.Host = cli.addr
++	req.URL.Host = cli.addr
++	if cli.proto == "unix" || cli.proto == "npipe" {
++		// Override host header for non-tcp connections.
++		req.Host = DummyHost
++	}
+ 	req.Header.Set("Connection", "Upgrade")
+ 	req.Header.Set("Upgrade", proto)
+ 
+diff --git a/client/request.go b/client/request.go
+index d3d9a3fe..66530d4b 100644
+--- a/client/request.go
++++ b/client/request.go
+@@ -88,15 +88,13 @@ func (cli *Client) buildRequest(method, path string, body io.Reader, headers hea
+ 		return nil, err
+ 	}
+ 	req = cli.addHeaders(req, headers)
+-
+-	if cli.proto == "unix" || cli.proto == "npipe" {
+-		// For local communications, it doesn't matter what the host is. We just
+-		// need a valid and meaningful host name. (See #189)
+-		req.Host = "docker"
+-	}
+-
+-	req.URL.Host = cli.addr
+ 	req.URL.Scheme = cli.scheme
++	req.URL.Host = cli.addr
++
++	if cli.proto == "unix" || cli.proto == "npipe" {
++		// Override host header for non-tcp connections.
++		req.Host = DummyHost
++	}
+ 
+ 	if expectedPayload && req.Header.Get("Content-Type") == "" {
+ 		req.Header.Set("Content-Type", "text/plain")
+diff --git a/client/request_test.go b/client/request_test.go
+index a3be507b..c1a10923 100644
+--- a/client/request_test.go
++++ b/client/request_test.go
+@@ -27,12 +27,12 @@ func TestSetHostHeader(t *testing.T) {
+ 	}{
+ 		{
+ 			"unix:///var/run/docker.sock",
+-			"docker",
++			DummyHost,
+ 			"/var/run/docker.sock",
+ 		},
+ 		{
+ 			"npipe:////./pipe/docker_engine",
+-			"docker",
++			DummyHost,
+ 			"//./pipe/docker_engine",
+ 		},
+ 		{
+-- 
+2.34.1
+
diff --git a/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/0002-pkg-plugins-use-a-dummy-hostname-for-local-connectio.patch b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/0002-pkg-plugins-use-a-dummy-hostname-for-local-connectio.patch
new file mode 100644
index 0000000000..da7e0dbc11
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/app-containers/docker/files/0002-pkg-plugins-use-a-dummy-hostname-for-local-connectio.patch
@@ -0,0 +1,72 @@
+From 1603196c5bc3e3b826c841e599bc45fc33562633 Mon Sep 17 00:00:00 2001
+Message-Id: <1603196c5bc3e3b826c841e599bc45fc33562633.1689689028.git.dpark@linux.microsoft.com>
+In-Reply-To: <74b4974cb7e7e81e57661f93b03c94a95a15472e.1689689028.git.dpark@linux.microsoft.com>
+References: <74b4974cb7e7e81e57661f93b03c94a95a15472e.1689689028.git.dpark@linux.microsoft.com>
+From: Sebastiaan van Stijn <github@gone.nl>
+Date: Wed, 12 Jul 2023 15:07:59 +0200
+Subject: [PATCH 2/2] pkg/plugins: use a dummy hostname for local connections
+
+For local communications (npipe://, unix://), the hostname is not used,
+but we need valid and meaningful hostname.
+
+The current code used the socket path as hostname, which gets rejected by
+go1.20.6 and go1.19.11 because of a security fix for [CVE-2023-29406 ][1],
+which was implemented in  https://go.dev/issue/60374.
+
+Prior versions go Go would clean the host header, and strip slashes in the
+process, but go1.20.6 and go1.19.11 no longer do, and reject the host
+header.
+
+Before this patch, tests would fail on go1.20.6:
+
+    === FAIL: pkg/authorization TestAuthZRequestPlugin (15.01s)
+    time="2023-07-12T12:53:45Z" level=warning msg="Unable to connect to plugin: //tmp/authz2422457390/authz-test-plugin.sock/AuthZPlugin.AuthZReq: Post \"http://%2F%2Ftmp%2Fauthz2422457390%2Fauthz-test-plugin.sock/AuthZPlugin.AuthZReq\": http: invalid Host header, retrying in 1s"
+    time="2023-07-12T12:53:46Z" level=warning msg="Unable to connect to plugin: //tmp/authz2422457390/authz-test-plugin.sock/AuthZPlugin.AuthZReq: Post \"http://%2F%2Ftmp%2Fauthz2422457390%2Fauthz-test-plugin.sock/AuthZPlugin.AuthZReq\": http: invalid Host header, retrying in 2s"
+    time="2023-07-12T12:53:48Z" level=warning msg="Unable to connect to plugin: //tmp/authz2422457390/authz-test-plugin.sock/AuthZPlugin.AuthZReq: Post \"http://%2F%2Ftmp%2Fauthz2422457390%2Fauthz-test-plugin.sock/AuthZPlugin.AuthZReq\": http: invalid Host header, retrying in 4s"
+    time="2023-07-12T12:53:52Z" level=warning msg="Unable to connect to plugin: //tmp/authz2422457390/authz-test-plugin.sock/AuthZPlugin.AuthZReq: Post \"http://%2F%2Ftmp%2Fauthz2422457390%2Fauthz-test-plugin.sock/AuthZPlugin.AuthZReq\": http: invalid Host header, retrying in 8s"
+        authz_unix_test.go:82: Failed to authorize request Post "http://%2F%2Ftmp%2Fauthz2422457390%2Fauthz-test-plugin.sock/AuthZPlugin.AuthZReq": http: invalid Host header
+
+[1]: https://github.com/advisories/GHSA-f8f7-69v5-w4vx
+
+Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
+(cherry picked from commit 6b7705d5b29e226a24902a8dcc488836faaee33c)
+Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
+---
+ pkg/plugins/client.go | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/pkg/plugins/client.go b/pkg/plugins/client.go
+index 752fecd0..e683eb77 100644
+--- a/pkg/plugins/client.go
++++ b/pkg/plugins/client.go
+@@ -18,6 +18,12 @@ import (
+ 
+ const (
+ 	defaultTimeOut = 30
++
++	// dummyHost is a hostname used for local communication.
++	//
++	// For local communications (npipe://, unix://), the hostname is not used,
++	// but we need valid and meaningful hostname.
++	dummyHost = "plugin.moby.localhost"
+ )
+ 
+ func newTransport(addr string, tlsConfig *tlsconfig.Options) (transport.Transport, error) {
+@@ -44,8 +50,12 @@ func newTransport(addr string, tlsConfig *tlsconfig.Options) (transport.Transpor
+ 		return nil, err
+ 	}
+ 	scheme := httpScheme(u)
+-
+-	return transport.NewHTTPTransport(tr, scheme, socket), nil
++	hostName := u.Host
++	if hostName == "" || u.Scheme == "unix" || u.Scheme == "npipe" {
++		// Override host header for non-tcp connections.
++		hostName = dummyHost
++	}
++	return transport.NewHTTPTransport(tr, scheme, hostName), nil
+ }
+ 
+ // NewClient creates a new plugin client (http).
+-- 
+2.34.1
+

From 82045f0fd4db9e54b64e062b87ebf6da57aae8c9 Mon Sep 17 00:00:00 2001
From: Dongsu Park <dpark@linux.microsoft.com>
Date: Thu, 20 Jul 2023 10:17:18 +0200
Subject: [PATCH 7/9] overlay app-containers/docker-cli: reset to Gentoo

Reset to the state according to the state of Gentoo upstream,
to commit b93160fedf4e7a6f7f4101dfb7f3ff0df5cee2c0.
to create Flatcar patches on top of that.
---
 .../docker-cli/docker-cli-20.10.24.ebuild         | 15 +++------------
 1 file changed, 3 insertions(+), 12 deletions(-)

diff --git a/sdk_container/src/third_party/coreos-overlay/app-containers/docker-cli/docker-cli-20.10.24.ebuild b/sdk_container/src/third_party/coreos-overlay/app-containers/docker-cli/docker-cli-20.10.24.ebuild
index 27e4a3545c..aefc34e0e1 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-containers/docker-cli/docker-cli-20.10.24.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/app-containers/docker-cli/docker-cli-20.10.24.ebuild
@@ -5,10 +5,7 @@ EAPI=7
 GIT_COMMIT=e78084afe5
 EGO_PN="github.com/docker/cli"
 
-COREOS_GO_PACKAGE="${EGO_PN}"
-COREOS_GO_VERSION="go1.19"
-
-inherit bash-completion-r1  golang-vcs-snapshot coreos-go-depend
+inherit bash-completion-r1  golang-vcs-snapshot
 
 DESCRIPTION="the command line binary for docker"
 HOMEPAGE="https://www.docker.com/"
@@ -32,23 +29,17 @@ src_prepare() {
 }
 
 src_compile() {
-	# Flatcar: override go version
-	go_export
-
 	export DISABLE_WARN_OUTSIDE_CONTAINER=1
 	export GOPATH="${WORKDIR}/${P}"
 	# setup CFLAGS and LDFLAGS for separate build target
 	# see https://github.com/tianon/docker-overlay/pull/10
-	# FLatcar: inject our own CFLAGS/LDFLAGS for torcx
-	export CGO_CFLAGS="${CGO_CFLAGS} -I${SYSROOT}/usr/include"
-	export CGO_LDFLAGS="${CGO_LDFLAGS} -L${SYSROOT}/usr/$(get_libdir)"
+	export CGO_CFLAGS="-I${SYSROOT}/usr/include"
+	export CGO_LDFLAGS="-L${SYSROOT}/usr/$(get_libdir)"
 		emake \
 		LDFLAGS="$(usex hardened '-extldflags -fno-PIC' '')" \
 		VERSION="${PV}" \
 		GITCOMMIT="${GIT_COMMIT}" \
 		dynbinary
-
-	# Flatcar: removed man page generation since they are not included in images
 }
 
 src_install() {

From 3d1c3a66c016a7bb88387eded919b4900afb2068 Mon Sep 17 00:00:00 2001
From: Dongsu Park <dpark@linux.microsoft.com>
Date: Thu, 20 Jul 2023 10:19:12 +0200
Subject: [PATCH 8/9] overlay app-containers/docker-cli: Apply Flatcar
 modifications

Apply Flatcar patches, based on commit
817ad4c0db8461fda6a00c3617311d94a9abc380.
---
 .../docker-cli/docker-cli-20.10.24.ebuild           | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/sdk_container/src/third_party/coreos-overlay/app-containers/docker-cli/docker-cli-20.10.24.ebuild b/sdk_container/src/third_party/coreos-overlay/app-containers/docker-cli/docker-cli-20.10.24.ebuild
index aefc34e0e1..c755dcea52 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-containers/docker-cli/docker-cli-20.10.24.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/app-containers/docker-cli/docker-cli-20.10.24.ebuild
@@ -5,7 +5,10 @@ EAPI=7
 GIT_COMMIT=e78084afe5
 EGO_PN="github.com/docker/cli"
 
-inherit bash-completion-r1  golang-vcs-snapshot
+COREOS_GO_PACKAGE="${EGO_PN}"
+COREOS_GO_VERSION="go1.19"
+
+inherit bash-completion-r1  golang-vcs-snapshot coreos-go-depend
 
 DESCRIPTION="the command line binary for docker"
 HOMEPAGE="https://www.docker.com/"
@@ -29,12 +32,16 @@ src_prepare() {
 }
 
 src_compile() {
+	# Flatcar: override go version
+	go_export
+
 	export DISABLE_WARN_OUTSIDE_CONTAINER=1
 	export GOPATH="${WORKDIR}/${P}"
 	# setup CFLAGS and LDFLAGS for separate build target
 	# see https://github.com/tianon/docker-overlay/pull/10
-	export CGO_CFLAGS="-I${SYSROOT}/usr/include"
-	export CGO_LDFLAGS="-L${SYSROOT}/usr/$(get_libdir)"
+	# FLatcar: inject our own CFLAGS/LDFLAGS for torcx
+	export CGO_CFLAGS="${CGO_CFLAGS} -I${SYSROOT}/usr/include"
+	export CGO_LDFLAGS="${CGO_LDFLAGS} -L${SYSROOT}/usr/$(get_libdir)"
 		emake \
 		LDFLAGS="$(usex hardened '-extldflags -fno-PIC' '')" \
 		VERSION="${PV}" \

From f36ae06dd7336636fbec147791a2732ae1e68708 Mon Sep 17 00:00:00 2001
From: Dongsu Park <dpark@linux.microsoft.com>
Date: Thu, 20 Jul 2023 10:21:31 +0200
Subject: [PATCH 9/9] overlay app-containers/docker-cli: vendor docker client
 for fixing invalid header

To fix invalid header issue that started to happen when being built with
Go 1.19.11+, it is necessary for the docker cli repo to vendor the new docker
client part of github.com/docker/docker.

Based on https://github.com/docker/cli/commit/5d4e44df90bb.
---
 ...4.ebuild => docker-cli-20.10.24-r1.ebuild} |   5 +
 ...ker-v20.10.25-45-g0d4b9ed98b-v20.10..patch | 104 ++++++++++++++++++
 2 files changed, 109 insertions(+)
 rename sdk_container/src/third_party/coreos-overlay/app-containers/docker-cli/{docker-cli-20.10.24.ebuild => docker-cli-20.10.24-r1.ebuild} (90%)
 create mode 100644 sdk_container/src/third_party/coreos-overlay/app-containers/docker-cli/files/0001-20.10-vendor-docker-v20.10.25-45-g0d4b9ed98b-v20.10..patch

diff --git a/sdk_container/src/third_party/coreos-overlay/app-containers/docker-cli/docker-cli-20.10.24.ebuild b/sdk_container/src/third_party/coreos-overlay/app-containers/docker-cli/docker-cli-20.10.24-r1.ebuild
similarity index 90%
rename from sdk_container/src/third_party/coreos-overlay/app-containers/docker-cli/docker-cli-20.10.24.ebuild
rename to sdk_container/src/third_party/coreos-overlay/app-containers/docker-cli/docker-cli-20.10.24-r1.ebuild
index c755dcea52..e5181c72ea 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-containers/docker-cli/docker-cli-20.10.24.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/app-containers/docker-cli/docker-cli-20.10.24-r1.ebuild
@@ -26,6 +26,11 @@ RESTRICT="installsources strip"
 
 S="${WORKDIR}/${P}/src/${EGO_PN}"
 
+# Flatcar: fix invalid headers issue when building with Go 1.19.11+.
+PATCHES=(
+	"${FILESDIR}/0001-20.10-vendor-docker-v20.10.25-45-g0d4b9ed98b-v20.10..patch"
+)
+
 src_prepare() {
 	default
 	sed -i 's@dockerd\?\.exe@@g' contrib/completion/bash/docker || die
diff --git a/sdk_container/src/third_party/coreos-overlay/app-containers/docker-cli/files/0001-20.10-vendor-docker-v20.10.25-45-g0d4b9ed98b-v20.10..patch b/sdk_container/src/third_party/coreos-overlay/app-containers/docker-cli/files/0001-20.10-vendor-docker-v20.10.25-45-g0d4b9ed98b-v20.10..patch
new file mode 100644
index 0000000000..d35abf1783
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/app-containers/docker-cli/files/0001-20.10-vendor-docker-v20.10.25-45-g0d4b9ed98b-v20.10..patch
@@ -0,0 +1,104 @@
+From 5d4e44df90bb913f30a1f0215f9715cb60e17d75 Mon Sep 17 00:00:00 2001
+Message-Id: <5d4e44df90bb913f30a1f0215f9715cb60e17d75.1689769748.git.dpark@linux.microsoft.com>
+From: Sebastiaan van Stijn <github@gone.nl>
+Date: Mon, 17 Jul 2023 16:48:27 +0200
+Subject: [PATCH] [20.10] vendor: docker v20.10.25-45-g0d4b9ed98b
+ (v20.10.26-dev)
+
+full diff: https://github.com/docker/docker/compare/v20.10.25...0d4b9ed98be2aecf27e8dd014bef7bad0be15457
+
+Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
+---
+ .../github.com/docker/docker/client/client.go | 30 +++++++++++++++++++
+ .../github.com/docker/docker/client/hijack.go |  6 +++-
+ .../docker/docker/client/request.go           | 14 ++++-----
+ vendor/github.com/docker/docker/vendor.conf   |  2 +-
+ 5 files changed, 43 insertions(+), 11 deletions(-)
+
+diff --git a/vendor/github.com/docker/docker/client/client.go b/vendor/github.com/docker/docker/client/client.go
+index 0d3614d5..d0ce09ae 100644
+--- a/vendor/github.com/docker/docker/client/client.go
++++ b/vendor/github.com/docker/docker/client/client.go
+@@ -56,6 +56,36 @@ import (
+ 	"github.com/pkg/errors"
+ )
+ 
++// DummyHost is a hostname used for local communication.
++//
++// It acts as a valid formatted hostname for local connections (such as "unix://"
++// or "npipe://") which do not require a hostname. It should never be resolved,
++// but uses the special-purpose ".localhost" TLD (as defined in [RFC 2606, Section 2]
++// and [RFC 6761, Section 6.3]).
++//
++// [RFC 7230, Section 5.4] defines that an empty header must be used for such
++// cases:
++//
++//	If the authority component is missing or undefined for the target URI,
++//	then a client MUST send a Host header field with an empty field-value.
++//
++// However, [Go stdlib] enforces the semantics of HTTP(S) over TCP, does not
++// allow an empty header to be used, and requires req.URL.Scheme to be either
++// "http" or "https".
++//
++// For further details, refer to:
++//
++//   - https://github.com/docker/engine-api/issues/189
++//   - https://github.com/golang/go/issues/13624
++//   - https://github.com/golang/go/issues/61076
++//   - https://github.com/moby/moby/issues/45935
++//
++// [RFC 2606, Section 2]: https://www.rfc-editor.org/rfc/rfc2606.html#section-2
++// [RFC 6761, Section 6.3]: https://www.rfc-editor.org/rfc/rfc6761#section-6.3
++// [RFC 7230, Section 5.4]: https://datatracker.ietf.org/doc/html/rfc7230#section-5.4
++// [Go stdlib]: https://github.com/golang/go/blob/6244b1946bc2101b01955468f1be502dbadd6807/src/net/http/transport.go#L558-L569
++const DummyHost = "api.moby.localhost"
++
+ // ErrRedirect is the error returned by checkRedirect when the request is non-GET.
+ var ErrRedirect = errors.New("unexpected redirect in response")
+ 
+diff --git a/vendor/github.com/docker/docker/client/hijack.go b/vendor/github.com/docker/docker/client/hijack.go
+index e1dc49ef..b8fac0be 100644
+--- a/vendor/github.com/docker/docker/client/hijack.go
++++ b/vendor/github.com/docker/docker/client/hijack.go
+@@ -62,7 +62,11 @@ func fallbackDial(proto, addr string, tlsConfig *tls.Config) (net.Conn, error) {
+ }
+ 
+ func (cli *Client) setupHijackConn(ctx context.Context, req *http.Request, proto string) (net.Conn, error) {
+-	req.Host = cli.addr
++	req.URL.Host = cli.addr
++	if cli.proto == "unix" || cli.proto == "npipe" {
++		// Override host header for non-tcp connections.
++		req.Host = DummyHost
++	}
+ 	req.Header.Set("Connection", "Upgrade")
+ 	req.Header.Set("Upgrade", proto)
+ 
+diff --git a/vendor/github.com/docker/docker/client/request.go b/vendor/github.com/docker/docker/client/request.go
+index d3d9a3fe..66530d4b 100644
+--- a/vendor/github.com/docker/docker/client/request.go
++++ b/vendor/github.com/docker/docker/client/request.go
+@@ -88,15 +88,13 @@ func (cli *Client) buildRequest(method, path string, body io.Reader, headers hea
+ 		return nil, err
+ 	}
+ 	req = cli.addHeaders(req, headers)
+-
+-	if cli.proto == "unix" || cli.proto == "npipe" {
+-		// For local communications, it doesn't matter what the host is. We just
+-		// need a valid and meaningful host name. (See #189)
+-		req.Host = "docker"
+-	}
+-
+-	req.URL.Host = cli.addr
+ 	req.URL.Scheme = cli.scheme
++	req.URL.Host = cli.addr
++
++	if cli.proto == "unix" || cli.proto == "npipe" {
++		// Override host header for non-tcp connections.
++		req.Host = DummyHost
++	}
+ 
+ 	if expectedPayload && req.Header.Get("Content-Type") == "" {
+ 		req.Header.Set("Content-Type", "text/plain")
+-- 
+2.34.1
+