Since commit 925b484 ("No fallback nameservers for internal
resolver"), if the host's resolv.conf has no nameservers and
no servers are supplied via config, the internal resolver will
not use Google's DNS - so the container will not be able to
resolve external DNS requests.

That can happen when container's are "restart-always" and the
docker daemon starts before the host's DNS is configured.

So, to highlight the issue (which may not be an error, but
probably is), include a warning in the container's resolv.conf
file.

Also, log a warning - logs currently say "No non-localhost DNS
nameservers are left in resolv.conf. Using default external
servers". But, that's misleading because it's from an initial
resolv.conf setup, before the internal resolver configured without
those fallbacks - we'll drop the fallbacks completely once the
default bridge has an internal resolver).

Signed-off-by: Rob Murray <rob.murray@docker.com>

Warn when no external DNS nameservers are found

Go maintainers started to unconditionally update the minimum go version
for golang.org/x/ dependencies to go1.23, which means that we'll no longer
be able to support any version below that when updating those dependencies;

> all: upgrade go directive to at least 1.23.0 [generated]
>
> By now Go 1.24.0 has been released, and Go 1.22 is no longer supported
> per the Go Release Policy (https://go.dev/doc/devel/release#policy).
>
> For golang/go#69095.

This updates our minimum version to go1.23, as we won't be able to maintain
compatibility with older versions because of the above.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Fix a logical error in the rootless setup tool where the iptables error
handling was incorrectly placed. The code was setting
`faced_iptables_error=1` even when iptables was available, causing
unnecessary error messages and setup suggestions.

This patch correctly moves the error handling into the `else` branch so
that we only report iptables errors when the command is actually
unavailable.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>

- We now only use winresources for the dockerd binary, so we can
  reduce some uses of wildcards
- Use explicit ("/") to indicate these should only be ignored
  relative to the root of the repository and build-context
- Remove remnant ignore for rpm builds

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

notable changes

- oauth2.go: use a more straightforward return value
- oauth2: Deep copy context client in NewClient
- jws: improve fix for CVE-2025-22868

full diff: golang/oauth2@v0.27.0...v0.29.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

full diff: containerd/containerd@v2.0.4...v2.0.5

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

contrib/rootless-setuptool: Fix iptables detection

vendor: github.com/containerd/containerd v2.0.5, golang.org/x/oauth2 v0.29.0

cleanup ignore files

update go:build tags to go1.23 to align with vendor.mod