From 8f2b39f5708755cc35d66f85f8a7f9bc315a9747 Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Thu, 20 Feb 2025 15:10:59 +0900
Subject: [PATCH] CI: test Docker v28 in addition to v27

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 .github/workflows/main.yaml | 10 +++++++++-
 Dockerfile                  | 10 ++++++++--
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
index 71a06c8d..9dc5123a 100644
--- a/.github/workflows/main.yaml
+++ b/.github/workflows/main.yaml
@@ -186,6 +186,12 @@ jobs:
   test-integration-docker:
     name: "Integration test (Docker)"
     runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        # The design of the proxy was changed in Docker v28.
+        # rootlesskit-docker-proxy is no longer used since Docker v28.
+        docker_version: [27.5.1, 28.0.1]
     steps:
     - name: "Set up AppArmor"
       run: |
@@ -201,7 +207,9 @@ jobs:
     - name: "Check out"
       uses: actions/checkout@v4
     - name: "Build integration test image"
-      run: DOCKER_BUILDKIT=1 docker build -t rootlesskit:test-integration-docker --target test-integration-docker .
+      run: DOCKER_BUILDKIT=1 docker build -t rootlesskit:test-integration-docker --target test-integration-docker --build-arg DOCKER_VERSION .
+      env:
+        DOCKER_VERSION: ${{ matrix.docker_version }}
     - name: "Create a custom network to avoid IP confusion"
       run: docker network create custom
     - name: "Docker Integration test: net=slirp4netns, port-driver=builtin"
diff --git a/Dockerfile b/Dockerfile
index c942932c..e44320ea 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,7 +4,7 @@ ARG SHADOW_VERSION=4.16.0
 ARG SLIRP4NETNS_VERSION=v1.3.1
 ARG VPNKIT_VERSION=0.5.0
 ARG PASST_VERSION=2024_12_11.09478d5
-ARG DOCKER_VERSION=27.5.0
+ARG DOCKER_VERSION=28.0.1
 ARG DOCKER_CHANNEL=stable
 
 FROM golang:${GO_VERSION}-alpine AS build
@@ -92,12 +92,18 @@ ENV LD_LIBRARY_PATH=/home/user/lib
 WORKDIR /home/user/hack
 
 FROM test-integration AS test-integration-docker
-COPY --from=artifact /rootlesskit-docker-proxy /home/user/bin/
 ARG DOCKER_VERSION
 ARG DOCKER_CHANNEL
 RUN curl -fsSL https://download.docker.com/linux/static/${DOCKER_CHANNEL}/x86_64/docker-${DOCKER_VERSION}.tgz | tar xz --strip-components=1 -C /home/user/bin/
 RUN curl -fsSL -o /home/user/bin/dockerd-rootless.sh https://raw.githubusercontent.com/moby/moby/v${DOCKER_VERSION}/contrib/dockerd-rootless.sh && \
   chmod +x /home/user/bin/dockerd-rootless.sh
+# rootlesskit-docker-proxy is no longer needed since Docker v28
+RUN --mount=source=/rootlesskit-docker-proxy,target=/tmp/rootlesskit-docker-proxy,from=artifact <<EOT
+  set -ex
+  if [ "$(echo ${DOCKER_VERSION} | cut -d . -f 1)" -lt "28" ]; then
+    cp -a /tmp/rootlesskit-docker-proxy /home/user/bin
+  fi
+EOT
 ENV DOCKERD_ROOTLESS_ROOTLESSKIT_NET=slirp4netns
 ENV DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=builtin
 ENV DOCKER_HOST=unix:///run/user/2000/docker.sock