diff --git a/swarmd/cmd/swarmd/main.go b/swarmd/cmd/swarmd/main.go
index 739fe012be..f0a74a998b 100644
--- a/swarmd/cmd/swarmd/main.go
+++ b/swarmd/cmd/swarmd/main.go
@@ -10,8 +10,8 @@ import (
 	"os"
 	"os/signal"
 
-	engineapi "github.com/docker/docker/client"
 	grpc_prometheus "github.com/grpc-ecosystem/go-grpc-prometheus"
+	engineapi "github.com/moby/moby/client"
 	"github.com/moby/swarmkit/swarmd/dockerexec"
 	"github.com/moby/swarmkit/swarmd/internal/defaults"
 	"github.com/moby/swarmkit/v2/api"
@@ -171,7 +171,7 @@ var (
 				return err
 			}
 
-			client, err := engineapi.NewClientWithOpts(
+			client, err := engineapi.New(
 				engineapi.WithHost(engineAddr),
 			)
 			if err != nil {
diff --git a/swarmd/dockerexec/adapter.go b/swarmd/dockerexec/adapter.go
index 94008fbacb..3cb4d4d91b 100644
--- a/swarmd/dockerexec/adapter.go
+++ b/swarmd/dockerexec/adapter.go
@@ -8,11 +8,10 @@ import (
 	"strings"
 	"time"
 
-	"github.com/docker/docker/api/types"
-	"github.com/docker/docker/api/types/container"
-	"github.com/docker/docker/api/types/events"
-	engineapi "github.com/docker/docker/client"
 	gogotypes "github.com/gogo/protobuf/types"
+	"github.com/moby/moby/api/types/container"
+	"github.com/moby/moby/api/types/events"
+	engineapi "github.com/moby/moby/client"
 	"github.com/moby/swarmkit/v2/agent/exec"
 	"github.com/moby/swarmkit/v2/api"
 	"github.com/moby/swarmkit/v2/log"
@@ -42,16 +41,16 @@ func newContainerAdapter(client engineapi.APIClient, nodeDescription *api.NodeDe
 	}, nil
 }
 
-func noopPrivilegeFn() (string, error) { return "", nil }
+func noopPrivilegeFn(context.Context) (string, error) { return "", nil }
 
-func (c *containerConfig) imagePullOptions() types.ImagePullOptions {
+func (c *containerConfig) imagePullOptions() engineapi.ImagePullOptions {
 	var registryAuth string
 
 	if c.spec().PullOptions != nil {
 		registryAuth = c.spec().PullOptions.RegistryAuth
 	}
 
-	return types.ImagePullOptions{
+	return engineapi.ImagePullOptions{
 		// if the image needs to be pulled, the auth config will be retrieved and updated
 		RegistryAuth:  registryAuth,
 		PrivilegeFunc: noopPrivilegeFn,
@@ -130,7 +129,7 @@ func (c *containerAdapter) createNetworks(ctx context.Context) error {
 
 func (c *containerAdapter) removeNetworks(ctx context.Context) error {
 	for _, nid := range c.container.networks() {
-		if err := c.client.NetworkRemove(ctx, nid); err != nil {
+		if _, err := c.client.NetworkRemove(ctx, nid, engineapi.NetworkRemoveOptions{}); err != nil {
 			if isActiveEndpointError(err) {
 				continue
 			}
@@ -144,24 +143,28 @@ func (c *containerAdapter) removeNetworks(ctx context.Context) error {
 }
 
 func (c *containerAdapter) create(ctx context.Context) error {
-	_, err := c.client.ContainerCreate(ctx,
-		c.container.config(),
-		c.container.hostConfig(),
-		c.container.networkingConfig(),
-		nil,
-		c.container.name(),
-	)
+	_, err := c.client.ContainerCreate(ctx, engineapi.ContainerCreateOptions{
+		Config:           c.container.config(),
+		HostConfig:       c.container.hostConfig(),
+		NetworkingConfig: c.container.networkingConfig(),
+		Name:             c.container.name(),
+	})
 
 	return err
 }
 
 func (c *containerAdapter) start(ctx context.Context) error {
 	// TODO(nishanttotla): Consider adding checkpoint handling later
-	return c.client.ContainerStart(ctx, c.container.name(), types.ContainerStartOptions{})
+	_, err := c.client.ContainerStart(ctx, c.container.name(), engineapi.ContainerStartOptions{})
+	return err
 }
 
-func (c *containerAdapter) inspect(ctx context.Context) (types.ContainerJSON, error) {
-	return c.client.ContainerInspect(ctx, c.container.name())
+func (c *containerAdapter) inspect(ctx context.Context) (container.InspectResponse, error) {
+	res, err := c.client.ContainerInspect(ctx, c.container.name(), engineapi.ContainerInspectOptions{})
+	if err != nil {
+		return container.InspectResponse{}, err
+	}
+	return res.Container, nil
 }
 
 // events issues a call to the events API and returns a channel with all
@@ -169,7 +172,7 @@ func (c *containerAdapter) inspect(ctx context.Context) (types.ContainerJSON, er
 //
 // A chan struct{} is returned that will be closed if the event processing
 // fails and needs to be restarted.
-func (c *containerAdapter) events(ctx context.Context) (<-chan events.Message, <-chan struct{}, error) {
+func (c *containerAdapter) events(ctx context.Context) engineapi.EventsResult {
 	// TODO(stevvooe): Move this to a single, global event dispatch. For
 	// now, we create a connection per container.
 	var (
@@ -180,7 +183,7 @@ func (c *containerAdapter) events(ctx context.Context) (<-chan events.Message, <
 	log.G(ctx).Debugf("waiting on events")
 	// TODO(stevvooe): For long running tasks, it is likely that we will have
 	// to restart this under failure.
-	eventCh, errCh := c.client.Events(ctx, types.EventsOptions{
+	res := c.client.Events(ctx, engineapi.EventsListOptions{
 		Since:   "0",
 		Filters: c.container.eventFilter(),
 	})
@@ -190,13 +193,13 @@ func (c *containerAdapter) events(ctx context.Context) (<-chan events.Message, <
 
 		for {
 			select {
-			case msg := <-eventCh:
+			case msg := <-res.Messages:
 				select {
 				case eventsq <- msg:
 				case <-ctx.Done():
 					return
 				}
-			case err := <-errCh:
+			case err := <-res.Err:
 				log.G(ctx).WithError(err).Error("error from events stream")
 				return
 			case <-ctx.Done():
@@ -206,7 +209,10 @@ func (c *containerAdapter) events(ctx context.Context) (<-chan events.Message, <
 		}
 	}()
 
-	return eventsq, closed, nil
+	return engineapi.EventsResult{
+		Messages: eventsq,
+		Err:      nil,
+	}
 }
 
 func (c *containerAdapter) shutdown(ctx context.Context) error {
@@ -220,18 +226,21 @@ func (c *containerAdapter) shutdown(ctx context.Context) error {
 		stopgraceFromProto, _ := gogotypes.DurationFromProto(spec.StopGracePeriod)
 		stopgraceSeconds = int(stopgraceFromProto.Seconds())
 	}
-	return c.client.ContainerStop(ctx, c.container.name(), container.StopOptions{Timeout: &stopgraceSeconds})
+	_, err := c.client.ContainerStop(ctx, c.container.name(), engineapi.ContainerStopOptions{Timeout: &stopgraceSeconds})
+	return err
 }
 
 func (c *containerAdapter) terminate(ctx context.Context) error {
-	return c.client.ContainerKill(ctx, c.container.name(), "")
+	_, err := c.client.ContainerKill(ctx, c.container.name(), engineapi.ContainerKillOptions{})
+	return err
 }
 
 func (c *containerAdapter) remove(ctx context.Context) error {
-	return c.client.ContainerRemove(ctx, c.container.name(), types.ContainerRemoveOptions{
+	_, err := c.client.ContainerRemove(ctx, c.container.name(), engineapi.ContainerRemoveOptions{
 		RemoveVolumes: true,
 		Force:         true,
 	})
+	return err
 }
 
 func (c *containerAdapter) createVolumes(ctx context.Context) error {
@@ -268,7 +277,7 @@ func (c *containerAdapter) logs(ctx context.Context, options api.LogSubscription
 		return nil, errors.New("logs not supported on services with TTY")
 	}
 
-	apiOptions := types.ContainerLogsOptions{
+	apiOptions := engineapi.ContainerLogsOptions{
 		Follow:     options.Follow,
 		Timestamps: true,
 		Details:    false,
diff --git a/swarmd/dockerexec/container.go b/swarmd/dockerexec/container.go
index 2ab35f38ef..d0e3d82d1d 100644
--- a/swarmd/dockerexec/container.go
+++ b/swarmd/dockerexec/container.go
@@ -4,20 +4,18 @@ import (
 	"errors"
 	"fmt"
 	"net"
+	"net/netip"
 	"strconv"
 	"strings"
 	"time"
 
-	"github.com/docker/docker/api/types"
-	enginecontainer "github.com/docker/docker/api/types/container"
-	"github.com/docker/docker/api/types/events"
-	"github.com/docker/docker/api/types/filters"
-	enginemount "github.com/docker/docker/api/types/mount"
-	"github.com/docker/docker/api/types/network"
-	"github.com/docker/docker/api/types/volume"
-	"github.com/docker/go-connections/nat"
 	"github.com/docker/go-units"
 	gogotypes "github.com/gogo/protobuf/types"
+	enginecontainer "github.com/moby/moby/api/types/container"
+	"github.com/moby/moby/api/types/events"
+	enginemount "github.com/moby/moby/api/types/mount"
+	"github.com/moby/moby/api/types/network"
+	engineapi "github.com/moby/moby/client"
 	"github.com/moby/swarmkit/v2/agent/exec"
 	"github.com/moby/swarmkit/v2/api"
 	"github.com/moby/swarmkit/v2/api/genericresource"
@@ -93,12 +91,13 @@ func (c *containerConfig) image() string {
 	return c.spec().Image
 }
 
-func portSpec(port uint32, protocol api.PortConfig_Protocol) nat.Port {
-	return nat.Port(fmt.Sprintf("%d/%s", port, strings.ToLower(protocol.String())))
+func portSpec(port uint32, protocol api.PortConfig_Protocol) network.Port {
+	p, _ := network.ParsePort(fmt.Sprintf("%d/%s", port, strings.ToLower(protocol.String())))
+	return p
 }
 
-func (c *containerConfig) portBindings() nat.PortMap {
-	portBindings := nat.PortMap{}
+func (c *containerConfig) portBindings() network.PortMap {
+	portBindings := network.PortMap{}
 	if c.task.Endpoint == nil {
 		return portBindings
 	}
@@ -109,7 +108,7 @@ func (c *containerConfig) portBindings() nat.PortMap {
 		}
 
 		port := portSpec(portConfig.TargetPort, portConfig.Protocol)
-		binding := []nat.PortBinding{
+		binding := []network.PortBinding{
 			{},
 		}
 
@@ -125,17 +124,18 @@ func (c *containerConfig) portBindings() nat.PortMap {
 func (c *containerConfig) isolation() enginecontainer.Isolation {
 	switch c.spec().Isolation {
 	case api.ContainerIsolationDefault:
-		return enginecontainer.Isolation("default")
+		return "default"
 	case api.ContainerIsolationHyperV:
-		return enginecontainer.Isolation("hyperv")
+		return "hyperv"
 	case api.ContainerIsolationProcess:
-		return enginecontainer.Isolation("process")
+		return "process"
+	default:
+		return ""
 	}
-	return enginecontainer.Isolation("")
 }
 
-func (c *containerConfig) exposedPorts() map[nat.Port]struct{} {
-	exposedPorts := make(map[nat.Port]struct{})
+func (c *containerConfig) exposedPorts() network.PortSet {
+	exposedPorts := make(network.PortSet)
 	if c.task.Endpoint == nil {
 		return exposedPorts
 	}
@@ -427,7 +427,7 @@ func getMountMask(m *api.Mount) string {
 }
 
 // This handles the case of volumes that are defined inside a service Mount
-func (c *containerConfig) volumeCreateRequest(mount *api.Mount) *volume.CreateOptions {
+func (c *containerConfig) volumeCreateRequest(mount *api.Mount) *engineapi.VolumeCreateOptions {
 	var (
 		driverName string
 		driverOpts map[string]string
@@ -441,7 +441,7 @@ func (c *containerConfig) volumeCreateRequest(mount *api.Mount) *volume.CreateOp
 	}
 
 	// FIXME: do we need the ClusterVolumeSpec here?
-	return &volume.CreateOptions{
+	return &engineapi.VolumeCreateOptions{
 		Name:       mount.Source,
 		Driver:     driverName,
 		DriverOpts: driverOpts,
@@ -513,20 +513,20 @@ func (c *containerConfig) virtualIP(networkID string) string {
 func (c *containerConfig) networkingConfig() *network.NetworkingConfig {
 	epConfig := make(map[string]*network.EndpointSettings)
 	for _, na := range c.task.Networks {
-		var ipv4, ipv6 string
+		var ipv4, ipv6 netip.Addr
 		for _, addr := range na.Addresses {
-			ip, _, err := net.ParseCIDR(addr)
+			prefix, err := netip.ParsePrefix(addr)
 			if err != nil {
 				continue
 			}
 
-			if ip.To4() != nil {
-				ipv4 = ip.String()
+			ip := prefix.Addr()
+			if ip.Is4() {
+				ipv4 = ip
 				continue
 			}
-
-			if ip.To16() != nil {
-				ipv6 = ip.String()
+			if ip.Is6() {
+				ipv6 = ip
 			}
 		}
 
@@ -556,39 +556,48 @@ func (c *containerConfig) networks() []string {
 	return networks
 }
 
-func (c *containerConfig) networkCreateOptions(name string) (types.NetworkCreate, error) {
+func (c *containerConfig) networkCreateOptions(name string) (engineapi.NetworkCreateOptions, error) {
 	na, ok := c.networksAttachments[name]
 	if !ok {
-		return types.NetworkCreate{}, errors.New("container: unknown network referenced")
+		return engineapi.NetworkCreateOptions{}, errors.New("container: unknown network referenced")
 	}
 
-	options := types.NetworkCreate{
+	options := engineapi.NetworkCreateOptions{
 		Driver: na.Network.DriverState.Name,
 		IPAM: &network.IPAM{
 			Driver: na.Network.IPAM.Driver.Name,
 		},
-		Options:        na.Network.DriverState.Options,
-		CheckDuplicate: true,
+		Options: na.Network.DriverState.Options,
 	}
 
 	for _, ic := range na.Network.IPAM.Configs {
-		c := network.IPAMConfig{
-			Subnet:  ic.Subnet,
-			IPRange: ic.Range,
-			Gateway: ic.Gateway,
+		sn, err := netip.ParsePrefix(ic.Subnet)
+		if err != nil {
+			continue
+		}
+		r, err := netip.ParsePrefix(ic.Range)
+		if err != nil {
+			continue
+		}
+		gw, err := netip.ParseAddr(ic.Gateway)
+		if err != nil {
+			continue
 		}
-		options.IPAM.Config = append(options.IPAM.Config, c)
+		options.IPAM.Config = append(options.IPAM.Config, network.IPAMConfig{
+			Subnet:  sn,
+			IPRange: r,
+			Gateway: gw,
+		})
 	}
 
 	return options, nil
 }
 
-func (c containerConfig) eventFilter() filters.Args {
-	filter := filters.NewArgs()
-	filter.Add("type", string(events.ContainerEventType))
-	filter.Add("name", c.name())
-	filter.Add("label", fmt.Sprintf("%v.task.id=%v", systemLabelPrefix, c.task.ID))
-	return filter
+func (c containerConfig) eventFilter() engineapi.Filters {
+	return make(engineapi.Filters).
+		Add("type", string(events.ContainerEventType)).
+		Add("name", c.name()).
+		Add("label", fmt.Sprintf("%v.task.id=%v", systemLabelPrefix, c.task.ID))
 }
 
 func (c *containerConfig) init() *bool {
diff --git a/swarmd/dockerexec/container_test.go b/swarmd/dockerexec/container_test.go
index 0b9add675e..8a02d9f4b6 100644
--- a/swarmd/dockerexec/container_test.go
+++ b/swarmd/dockerexec/container_test.go
@@ -5,11 +5,11 @@ import (
 	"testing"
 	"time"
 
-	enginecontainer "github.com/docker/docker/api/types/container"
-	enginemount "github.com/docker/docker/api/types/mount"
-	"github.com/docker/docker/api/types/strslice"
 	"github.com/docker/go-units"
 	gogotypes "github.com/gogo/protobuf/types"
+	enginecontainer "github.com/moby/moby/api/types/container"
+	enginemount "github.com/moby/moby/api/types/mount"
+	"github.com/moby/moby/api/types/strslice"
 	"github.com/moby/swarmkit/v2/api"
 )
 
diff --git a/swarmd/dockerexec/controller.go b/swarmd/dockerexec/controller.go
index abc0508fa2..c7be6a91cb 100644
--- a/swarmd/dockerexec/controller.go
+++ b/swarmd/dockerexec/controller.go
@@ -8,14 +8,13 @@ import (
 	"fmt"
 	"io"
 	"strconv"
-	"strings"
 	"time"
 
-	"github.com/docker/docker/api/types"
-	"github.com/docker/docker/api/types/events"
-	engineapi "github.com/docker/docker/client"
-	"github.com/docker/go-connections/nat"
 	gogotypes "github.com/gogo/protobuf/types"
+	"github.com/moby/moby/api/types/container"
+	"github.com/moby/moby/api/types/events"
+	"github.com/moby/moby/api/types/network"
+	engineapi "github.com/moby/moby/client"
 	"github.com/pkg/errors"
 	"golang.org/x/time/rate"
 
@@ -602,7 +601,7 @@ func (e *exitError) Unwrap() error {
 	return e.cause
 }
 
-func makeExitError(ctnr types.ContainerJSON) error {
+func makeExitError(ctnr container.InspectResponse) error {
 	if ctnr.State.ExitCode != 0 {
 		var cause error
 		if ctnr.State.Error != "" {
@@ -621,7 +620,7 @@ func makeExitError(ctnr types.ContainerJSON) error {
 
 }
 
-func parseContainerStatus(ctnr types.ContainerJSON) (*api.ContainerStatus, error) {
+func parseContainerStatus(ctnr container.InspectResponse) (*api.ContainerStatus, error) {
 	status := &api.ContainerStatus{
 		ContainerID: ctnr.ID,
 		PID:         int32(ctnr.State.Pid),
@@ -631,7 +630,7 @@ func parseContainerStatus(ctnr types.ContainerJSON) (*api.ContainerStatus, error
 	return status, nil
 }
 
-func parsePortStatus(ctnr types.ContainerJSON) (*api.PortStatus, error) {
+func parsePortStatus(ctnr container.InspectResponse) (*api.PortStatus, error) {
 	status := &api.PortStatus{}
 
 	if ctnr.NetworkSettings != nil && len(ctnr.NetworkSettings.Ports) > 0 {
@@ -645,30 +644,26 @@ func parsePortStatus(ctnr types.ContainerJSON) (*api.PortStatus, error) {
 	return status, nil
 }
 
-func parsePortMap(portMap nat.PortMap) ([]*api.PortConfig, error) {
+func parsePortMap(portMap network.PortMap) ([]*api.PortConfig, error) {
 	exposedPorts := make([]*api.PortConfig, 0, len(portMap))
 
 	for portProtocol, mapping := range portMap {
-		parts := strings.SplitN(string(portProtocol), "/", 2)
-		if len(parts) != 2 {
+		if !portProtocol.IsValid() {
 			return nil, fmt.Errorf("invalid port mapping: %s", portProtocol)
 		}
 
-		port, err := strconv.ParseUint(parts[0], 10, 16)
-		if err != nil {
-			return nil, err
-		}
+		port := portProtocol.Num()
 
 		var protocol api.PortConfig_Protocol
-		switch strings.ToLower(parts[1]) {
-		case "tcp":
+		switch portProtocol.Proto() {
+		case network.TCP:
 			protocol = api.ProtocolTCP
-		case "udp":
+		case network.UDP:
 			protocol = api.ProtocolUDP
-		case "sctp":
+		case network.SCTP:
 			protocol = api.ProtocolSCTP
 		default:
-			return nil, fmt.Errorf("invalid protocol: %s", parts[1])
+			return nil, fmt.Errorf("invalid protocol: %s", portProtocol.Proto())
 		}
 
 		for _, binding := range mapping {
diff --git a/swarmd/dockerexec/controller_integration_test.go b/swarmd/dockerexec/controller_integration_test.go
index 68e92883a7..cd685a02bc 100644
--- a/swarmd/dockerexec/controller_integration_test.go
+++ b/swarmd/dockerexec/controller_integration_test.go
@@ -5,7 +5,7 @@ import (
 	"flag"
 	"testing"
 
-	engineapi "github.com/docker/docker/client"
+	engineapi "github.com/moby/moby/client"
 	"github.com/moby/swarmkit/v2/agent/exec"
 	"github.com/moby/swarmkit/v2/api"
 	"github.com/moby/swarmkit/v2/api/genericresource"
diff --git a/swarmd/dockerexec/controller_test.go b/swarmd/dockerexec/controller_test.go
index 9a7ff1e32f..29dcc66798 100644
--- a/swarmd/dockerexec/controller_test.go
+++ b/swarmd/dockerexec/controller_test.go
@@ -10,14 +10,11 @@ import (
 	"testing"
 	"time"
 
-	v1 "github.com/opencontainers/image-spec/specs-go/v1"
+	engineapi "github.com/moby/moby/client"
 
-	"github.com/docker/docker/api/types"
-	"github.com/docker/docker/api/types/container"
-	containertypes "github.com/docker/docker/api/types/container"
-	"github.com/docker/docker/api/types/events"
-	"github.com/docker/docker/api/types/network"
 	gogotypes "github.com/gogo/protobuf/types"
+	"github.com/moby/moby/api/types/container"
+	"github.com/moby/moby/api/types/events"
 	"github.com/moby/swarmkit/v2/agent/exec"
 	"github.com/moby/swarmkit/v2/api"
 	"github.com/moby/swarmkit/v2/identity"
@@ -36,19 +33,19 @@ func TestControllerPrepare(t *testing.T) {
 		assert.Equal(t, 1, client.calls["ContainerCreate"])
 	}()
 
-	client.ImagePullFn = func(_ context.Context, refStr string, options types.ImagePullOptions) (io.ReadCloser, error) {
+	client.ImagePullFn = func(_ context.Context, refStr string, options engineapi.ImagePullOptions) (io.ReadCloser, error) {
 		if refStr == config.image() {
 			return io.NopCloser(bytes.NewBuffer([]byte{})), nil
 		}
 		panic("unexpected call of ImagePull")
 	}
 
-	client.ContainerCreateFn = func(_ context.Context, cConfig *containertypes.Config, hConfig *containertypes.HostConfig, nConfig *network.NetworkingConfig, platform *v1.Platform, containerName string) (containertypes.CreateResponse, error) {
-		if reflect.DeepEqual(*cConfig, *config.config()) &&
-			reflect.DeepEqual(*hConfig, *config.hostConfig()) &&
-			reflect.DeepEqual(*nConfig, *config.networkingConfig()) &&
-			containerName == config.name() {
-			return containertypes.CreateResponse{ID: "container-id-" + task.ID}, nil
+	client.ContainerCreateFn = func(_ context.Context, options engineapi.ContainerCreateOptions) (engineapi.ContainerCreateResult, error) {
+		if reflect.DeepEqual(*options.Config, *config.config()) &&
+			reflect.DeepEqual(*options.HostConfig, *config.hostConfig()) &&
+			reflect.DeepEqual(*options.NetworkingConfig, *config.networkingConfig()) &&
+			options.Name == config.name() {
+			return engineapi.ContainerCreateResult{ID: "container-id-" + task.ID}, nil
 		}
 		panic("unexpected call to ContainerCreate")
 	}
@@ -66,25 +63,25 @@ func TestControllerPrepareAlreadyPrepared(t *testing.T) {
 		assert.Equal(t, 1, client.calls["ContainerInspect"])
 	}()
 
-	client.ImagePullFn = func(_ context.Context, refStr string, options types.ImagePullOptions) (io.ReadCloser, error) {
+	client.ImagePullFn = func(_ context.Context, refStr string, options engineapi.ImagePullOptions) (io.ReadCloser, error) {
 		if refStr == config.image() {
 			return io.NopCloser(bytes.NewBuffer([]byte{})), nil
 		}
 		panic("unexpected call of ImagePull")
 	}
 
-	client.ContainerCreateFn = func(_ context.Context, cConfig *containertypes.Config, hostConfig *containertypes.HostConfig, networking *network.NetworkingConfig, platform *v1.Platform, containerName string) (containertypes.CreateResponse, error) {
-		if reflect.DeepEqual(*cConfig, *config.config()) &&
-			reflect.DeepEqual(*networking, *config.networkingConfig()) &&
-			containerName == config.name() {
-			return containertypes.CreateResponse{}, fmt.Errorf("Conflict. The name")
+	client.ContainerCreateFn = func(_ context.Context, options engineapi.ContainerCreateOptions) (engineapi.ContainerCreateResult, error) {
+		if reflect.DeepEqual(*options.Config, *config.config()) &&
+			reflect.DeepEqual(*options.NetworkingConfig, *config.networkingConfig()) &&
+			options.Name == config.name() {
+			return engineapi.ContainerCreateResult{}, fmt.Errorf("Conflict. The name")
 		}
 		panic("unexpected call of ContainerCreate")
 	}
 
-	client.ContainerInspectFn = func(_ context.Context, containerName string) (types.ContainerJSON, error) {
+	client.ContainerInspectFn = func(_ context.Context, containerName string) (container.InspectResponse, error) {
 		if containerName == config.name() {
-			return types.ContainerJSON{}, nil
+			return container.InspectResponse{}, nil
 		}
 		panic("unexpected call of ContainerInspect")
 	}
@@ -104,21 +101,19 @@ func TestControllerStart(t *testing.T) {
 		assert.Equal(t, 1, client.calls["ContainerStart"])
 	}()
 
-	client.ContainerInspectFn = func(_ context.Context, containerName string) (types.ContainerJSON, error) {
+	client.ContainerInspectFn = func(_ context.Context, containerName string) (container.InspectResponse, error) {
 		if containerName == config.name() {
-			return types.ContainerJSON{
-				ContainerJSONBase: &types.ContainerJSONBase{
-					State: &types.ContainerState{
-						Status: "created",
-					},
+			return container.InspectResponse{
+				State: &container.State{
+					Status: "created",
 				},
 			}, nil
 		}
 		panic("unexpected call of ContainerInspect")
 	}
 
-	client.ContainerStartFn = func(_ context.Context, containerName string, options types.ContainerStartOptions) error {
-		if containerName == config.name() && reflect.DeepEqual(options, types.ContainerStartOptions{}) {
+	client.ContainerStartFn = func(_ context.Context, containerName string, options engineapi.ContainerStartOptions) error {
+		if containerName == config.name() && reflect.DeepEqual(options, engineapi.ContainerStartOptions{}) {
 			return nil
 		}
 		panic("unexpected call of ContainerStart")
@@ -135,13 +130,11 @@ func TestControllerStartAlreadyStarted(t *testing.T) {
 		assert.Equal(t, 1, client.calls["ContainerInspect"])
 	}()
 
-	client.ContainerInspectFn = func(_ context.Context, containerName string) (types.ContainerJSON, error) {
+	client.ContainerInspectFn = func(_ context.Context, containerName string) (container.InspectResponse, error) {
 		if containerName == config.name() {
-			return types.ContainerJSON{
-				ContainerJSONBase: &types.ContainerJSONBase{
-					State: &types.ContainerState{
-						Status: "notcreated", // can be anything but created
-					},
+			return container.InspectResponse{
+				State: &container.State{
+					Status: "notcreated", // can be anything but created
 				},
 			}, nil
 		}
@@ -163,29 +156,25 @@ func TestControllerWait(t *testing.T) {
 		assert.Equal(t, 1, client.calls["Events"])
 	}()
 
-	client.ContainerInspectFn = func(_ context.Context, container string) (types.ContainerJSON, error) {
-		if client.calls["ContainerInspect"] == 1 && container == config.name() {
-			return types.ContainerJSON{
-				ContainerJSONBase: &types.ContainerJSONBase{
-					State: &types.ContainerState{
-						Status: "running",
-					},
+	client.ContainerInspectFn = func(_ context.Context, ctrID string) (container.InspectResponse, error) {
+		if client.calls["ContainerInspect"] == 1 && ctrID == config.name() {
+			return container.InspectResponse{
+				State: &container.State{
+					Status: "running",
 				},
 			}, nil
-		} else if client.calls["ContainerInspect"] == 2 && container == config.name() {
-			return types.ContainerJSON{
-				ContainerJSONBase: &types.ContainerJSONBase{
-					State: &types.ContainerState{
-						Status: "stopped", // can be anything but created
-					},
+		} else if client.calls["ContainerInspect"] == 2 && ctrID == config.name() {
+			return container.InspectResponse{
+				State: &container.State{
+					Status: "stopped", // can be anything but created
 				},
 			}, nil
 		}
 		panic("unexpected call of ContainerInspect")
 	}
 
-	client.EventsFn = func(_ context.Context, options types.EventsOptions) (<-chan events.Message, <-chan error) {
-		if reflect.DeepEqual(options, types.EventsOptions{
+	client.EventsFn = func(_ context.Context, options engineapi.EventsListOptions) engineapi.EventsResult {
+		if reflect.DeepEqual(options, engineapi.EventsListOptions{
 			Since:   "0",
 			Filters: config.eventFilter(),
 		}) {
@@ -206,29 +195,27 @@ func TestControllerWaitUnhealthy(t *testing.T) {
 		assert.Equal(t, 1, client.calls["Events"])
 		assert.Equal(t, 1, client.calls["ContainerStop"])
 	}()
-	client.ContainerInspectFn = func(_ context.Context, containerName string) (types.ContainerJSON, error) {
+	client.ContainerInspectFn = func(_ context.Context, containerName string) (container.InspectResponse, error) {
 		if containerName == config.name() {
-			return types.ContainerJSON{
-				ContainerJSONBase: &types.ContainerJSONBase{
-					State: &types.ContainerState{
-						Status: "running",
-					},
+			return container.InspectResponse{
+				State: &container.State{
+					Status: "running",
 				},
 			}, nil
 		}
 		panic("unexpected call ContainerInspect")
 	}
-	evs, errs := makeEvents(t, config, events.ActionCreate, events.ActionHealthStatusUnhealthy)
-	client.EventsFn = func(_ context.Context, options types.EventsOptions) (<-chan events.Message, <-chan error) {
-		if reflect.DeepEqual(options, types.EventsOptions{
+	res := makeEvents(t, config, events.ActionCreate, events.ActionHealthStatusUnhealthy)
+	client.EventsFn = func(_ context.Context, options engineapi.EventsListOptions) engineapi.EventsResult {
+		if reflect.DeepEqual(options, engineapi.EventsListOptions{
 			Since:   "0",
 			Filters: config.eventFilter(),
 		}) {
-			return evs, errs
+			return res
 		}
 		panic("unexpected call of Events")
 	}
-	client.ContainerStopFn = func(_ context.Context, containerName string, options container.StopOptions) error {
+	client.ContainerStopFn = func(_ context.Context, containerName string, options engineapi.ContainerStopOptions) error {
 		if containerName == config.name() && *options.Timeout == tenSecond {
 			return nil
 		}
@@ -247,32 +234,28 @@ func TestControllerWaitExitError(t *testing.T) {
 		assert.Equal(t, 1, client.calls["Events"])
 	}()
 
-	client.ContainerInspectFn = func(_ context.Context, containerName string) (types.ContainerJSON, error) {
+	client.ContainerInspectFn = func(_ context.Context, containerName string) (container.InspectResponse, error) {
 		if client.calls["ContainerInspect"] == 1 && containerName == config.name() {
-			return types.ContainerJSON{
-				ContainerJSONBase: &types.ContainerJSONBase{
-					State: &types.ContainerState{
-						Status: "running",
-					},
+			return container.InspectResponse{
+				State: &container.State{
+					Status: "running",
 				},
 			}, nil
 		} else if client.calls["ContainerInspect"] == 2 && containerName == config.name() {
-			return types.ContainerJSON{
-				ContainerJSONBase: &types.ContainerJSONBase{
-					ID: "cid",
-					State: &types.ContainerState{
-						Status:   "exited", // can be anything but created
-						ExitCode: 1,
-						Pid:      1,
-					},
+			return container.InspectResponse{
+				ID: "cid",
+				State: &container.State{
+					Status:   "exited", // can be anything but created
+					ExitCode: 1,
+					Pid:      1,
 				},
 			}, nil
 		}
 		panic("unexpected call of ContainerInspect")
 	}
 
-	client.EventsFn = func(_ context.Context, options types.EventsOptions) (<-chan events.Message, <-chan error) {
-		if reflect.DeepEqual(options, types.EventsOptions{
+	client.EventsFn = func(_ context.Context, options engineapi.EventsListOptions) engineapi.EventsResult {
+		if reflect.DeepEqual(options, engineapi.EventsListOptions{
 			Since:   "0",
 			Filters: config.eventFilter(),
 		}) {
@@ -302,13 +285,11 @@ func TestControllerWaitExitedClean(t *testing.T) {
 		assert.Equal(t, 1, client.calls["ContainerInspect"])
 	}()
 
-	client.ContainerInspectFn = func(_ context.Context, container string) (types.ContainerJSON, error) {
-		if container == config.name() {
-			return types.ContainerJSON{
-				ContainerJSONBase: &types.ContainerJSONBase{
-					State: &types.ContainerState{
-						Status: "exited",
-					},
+	client.ContainerInspectFn = func(_ context.Context, ctrID string) (container.InspectResponse, error) {
+		if ctrID == config.name() {
+			return container.InspectResponse{
+				State: &container.State{
+					Status: "exited",
 				},
 			}, nil
 		}
@@ -327,16 +308,14 @@ func TestControllerWaitExitedError(t *testing.T) {
 		assert.Equal(t, 1, client.calls["ContainerInspect"])
 	}()
 
-	client.ContainerInspectFn = func(_ context.Context, containerName string) (types.ContainerJSON, error) {
+	client.ContainerInspectFn = func(_ context.Context, containerName string) (container.InspectResponse, error) {
 		if containerName == config.name() {
-			return types.ContainerJSON{
-				ContainerJSONBase: &types.ContainerJSONBase{
-					ID: "cid",
-					State: &types.ContainerState{
-						Status:   "exited",
-						ExitCode: 1,
-						Pid:      1,
-					},
+			return container.InspectResponse{
+				ID: "cid",
+				State: &container.State{
+					Status:   "exited",
+					ExitCode: 1,
+					Pid:      1,
 				},
 			}, nil
 		}
@@ -355,7 +334,7 @@ func TestControllerShutdown(t *testing.T) {
 		assert.Equal(t, 1, client.calls["ContainerStop"])
 	}()
 
-	client.ContainerStopFn = func(_ context.Context, containerName string, option container.StopOptions) error {
+	client.ContainerStopFn = func(_ context.Context, containerName string, option engineapi.ContainerStopOptions) error {
 		if containerName == config.name() && *option.Timeout == tenSecond {
 			return nil
 		}
@@ -392,15 +371,15 @@ func TestControllerRemove(t *testing.T) {
 		assert.Equal(t, 1, client.calls["ContainerRemove"])
 	}()
 
-	client.ContainerStopFn = func(_ context.Context, container string, option container.StopOptions) error {
+	client.ContainerStopFn = func(_ context.Context, container string, option engineapi.ContainerStopOptions) error {
 		if container == config.name() && *option.Timeout == tenSecond {
 			return nil
 		}
 		panic("unexpected call of ContainerStop")
 	}
 
-	client.ContainerRemoveFn = func(_ context.Context, container string, options types.ContainerRemoveOptions) error {
-		if container == config.name() && reflect.DeepEqual(options, types.ContainerRemoveOptions{
+	client.ContainerRemoveFn = func(_ context.Context, container string, options engineapi.ContainerRemoveOptions) error {
+		if container == config.name() && reflect.DeepEqual(options, engineapi.ContainerRemoveOptions{
 			RemoveVolumes: true,
 			Force:         true,
 		}) {
@@ -464,7 +443,7 @@ func genTask(t *testing.T) *api.Task {
 	}
 }
 
-func makeEvents(t *testing.T, container *containerConfig, actions ...events.Action) (<-chan events.Message, <-chan error) {
+func makeEvents(t *testing.T, container *containerConfig, actions ...events.Action) engineapi.EventsResult {
 	t.Helper()
 	evs := make(chan events.Message, len(actions))
 	for _, action := range actions {
@@ -481,5 +460,8 @@ func makeEvents(t *testing.T, container *containerConfig, actions ...events.Acti
 	}
 	close(evs)
 
-	return evs, nil
+	return engineapi.EventsResult{
+		Messages: evs,
+		Err:      nil,
+	}
 }
diff --git a/swarmd/dockerexec/docker_client_stub.go b/swarmd/dockerexec/docker_client_stub.go
index cbcfb1b2de..251a69ebf4 100644
--- a/swarmd/dockerexec/docker_client_stub.go
+++ b/swarmd/dockerexec/docker_client_stub.go
@@ -6,12 +6,9 @@ import (
 	"runtime"
 	"strings"
 
-	"github.com/docker/docker/api/types"
-	"github.com/docker/docker/api/types/container"
-	"github.com/docker/docker/api/types/events"
-	"github.com/docker/docker/api/types/network"
-	"github.com/docker/docker/client"
-	v1 "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/moby/moby/api/types/container"
+	"github.com/moby/moby/api/types/events"
+	"github.com/moby/moby/client"
 )
 
 // StubAPIClient implements the client.APIClient interface, but allows
@@ -19,14 +16,14 @@ import (
 type StubAPIClient struct {
 	client.APIClient
 	calls              map[string]int
-	ContainerCreateFn  func(_ context.Context, config *container.Config, hostConfig *container.HostConfig, networking *network.NetworkingConfig, platform *v1.Platform, containerName string) (container.CreateResponse, error)
-	ContainerInspectFn func(_ context.Context, containerID string) (types.ContainerJSON, error)
+	ContainerCreateFn  func(_ context.Context, options client.ContainerCreateOptions) (client.ContainerCreateResult, error)
+	ContainerInspectFn func(_ context.Context, containerID string) (container.InspectResponse, error)
 	ContainerKillFn    func(_ context.Context, containerID, signal string) error
-	ContainerRemoveFn  func(_ context.Context, containerID string, options types.ContainerRemoveOptions) error
-	ContainerStartFn   func(_ context.Context, containerID string, options types.ContainerStartOptions) error
-	ContainerStopFn    func(_ context.Context, containerID string, options container.StopOptions) error
-	ImagePullFn        func(_ context.Context, refStr string, options types.ImagePullOptions) (io.ReadCloser, error)
-	EventsFn           func(_ context.Context, options types.EventsOptions) (<-chan events.Message, <-chan error)
+	ContainerRemoveFn  func(_ context.Context, containerID string, options client.ContainerRemoveOptions) error
+	ContainerStartFn   func(_ context.Context, containerID string, options client.ContainerStartOptions) error
+	ContainerStopFn    func(_ context.Context, containerID string, options client.ContainerStopOptions) error
+	ImagePullFn        func(_ context.Context, refStr string, options client.ImagePullOptions) (io.ReadCloser, error)
+	EventsFn           func(_ context.Context, options client.EventsListOptions) client.EventsResult
 }
 
 // NewStubAPIClient returns an initialized StubAPIClient
@@ -51,15 +48,19 @@ func (sa *StubAPIClient) called() {
 }
 
 // ContainerCreate is part of the APIClient interface
-func (sa *StubAPIClient) ContainerCreate(ctx context.Context, config *container.Config, hostConfig *container.HostConfig, networking *network.NetworkingConfig, platform *v1.Platform, containerName string) (container.CreateResponse, error) {
+func (sa *StubAPIClient) ContainerCreate(ctx context.Context, options client.ContainerCreateOptions) (client.ContainerCreateResult, error) {
 	sa.called()
-	return sa.ContainerCreateFn(ctx, config, hostConfig, networking, platform, containerName)
+	return sa.ContainerCreateFn(ctx, options)
 }
 
 // ContainerInspect is part of the APIClient interface
-func (sa *StubAPIClient) ContainerInspect(ctx context.Context, containerID string) (types.ContainerJSON, error) {
+func (sa *StubAPIClient) ContainerInspect(ctx context.Context, containerID string, _ client.ContainerInspectOptions) (client.ContainerInspectResult, error) {
 	sa.called()
-	return sa.ContainerInspectFn(ctx, containerID)
+	c, err := sa.ContainerInspectFn(ctx, containerID)
+	if err != nil {
+		return client.ContainerInspectResult{}, err
+	}
+	return client.ContainerInspectResult{Container: c}, nil
 }
 
 // ContainerKill is part of the APIClient interface
@@ -69,31 +70,31 @@ func (sa *StubAPIClient) ContainerKill(ctx context.Context, containerID, signal
 }
 
 // ContainerRemove is part of the APIClient interface
-func (sa *StubAPIClient) ContainerRemove(ctx context.Context, containerID string, options types.ContainerRemoveOptions) error {
+func (sa *StubAPIClient) ContainerRemove(ctx context.Context, containerID string, options client.ContainerRemoveOptions) error {
 	sa.called()
 	return sa.ContainerRemoveFn(ctx, containerID, options)
 }
 
 // ContainerStart is part of the APIClient interface
-func (sa *StubAPIClient) ContainerStart(ctx context.Context, containerID string, options types.ContainerStartOptions) error {
+func (sa *StubAPIClient) ContainerStart(ctx context.Context, containerID string, options client.ContainerStartOptions) error {
 	sa.called()
 	return sa.ContainerStartFn(ctx, containerID, options)
 }
 
 // ContainerStop is part of the APIClient interface
-func (sa *StubAPIClient) ContainerStop(ctx context.Context, containerID string, options container.StopOptions) error {
+func (sa *StubAPIClient) ContainerStop(ctx context.Context, containerID string, options client.ContainerStopOptions) error {
 	sa.called()
 	return sa.ContainerStopFn(ctx, containerID, options)
 }
 
 // ImagePull is part of the APIClient interface
-func (sa *StubAPIClient) ImagePull(ctx context.Context, refStr string, options types.ImagePullOptions) (io.ReadCloser, error) {
+func (sa *StubAPIClient) ImagePull(ctx context.Context, refStr string, options client.ImagePullOptions) (io.ReadCloser, error) {
 	sa.called()
 	return sa.ImagePullFn(ctx, refStr, options)
 }
 
 // Events is part of the APIClient interface
-func (sa *StubAPIClient) Events(ctx context.Context, options types.EventsOptions) (<-chan events.Message, <-chan error) {
+func (sa *StubAPIClient) Events(ctx context.Context, options client.EventsListOptions) (<-chan events.Message, <-chan error) {
 	sa.called()
 	return sa.EventsFn(ctx, options)
 }
diff --git a/swarmd/dockerexec/executor.go b/swarmd/dockerexec/executor.go
index 1aa0e99132..996136ca3a 100644
--- a/swarmd/dockerexec/executor.go
+++ b/swarmd/dockerexec/executor.go
@@ -6,8 +6,7 @@ import (
 	"strings"
 	"sync"
 
-	"github.com/docker/docker/api/types/filters"
-	engineapi "github.com/docker/docker/client"
+	engineapi "github.com/moby/moby/client"
 	"github.com/moby/swarmkit/v2/agent/exec"
 	"github.com/moby/swarmkit/v2/agent/secrets"
 	"github.com/moby/swarmkit/v2/api"
@@ -34,10 +33,11 @@ func NewExecutor(client engineapi.APIClient, genericResources []*api.GenericReso
 
 // Describe returns the underlying node description from the docker client.
 func (e *executor) Describe(ctx context.Context) (*api.NodeDescription, error) {
-	info, err := e.client.Info(ctx)
+	res, err := e.client.Info(ctx, engineapi.InfoOptions{})
 	if err != nil {
 		return nil, err
 	}
+	info := res.Info
 
 	plugins := map[api.PluginDescription]struct{}{}
 	addPlugins := func(typ string, names []string) {
@@ -57,12 +57,12 @@ func (e *executor) Describe(ctx context.Context) (*api.NodeDescription, error) {
 	addPlugins("Authorization", info.Plugins.Authorization)
 
 	// retrieve v2 plugins
-	v2plugins, err := e.client.PluginList(ctx, filters.NewArgs())
+	v2plugins, err := e.client.PluginList(ctx, engineapi.PluginListOptions{})
 	if err != nil {
 		log.L.WithError(err).Warning("PluginList operation failed")
 	} else {
 		// add v2 plugins to 'plugins'
-		for _, plgn := range v2plugins {
+		for _, plgn := range v2plugins.Items {
 			for _, typ := range plgn.Config.Interface.Types {
 				if typ.Prefix == "docker" && plgn.Enabled {
 					plgnTyp := typ.Capability
diff --git a/swarmd/go.mod b/swarmd/go.mod
index c83c2905c8..e5a29a8b20 100644
--- a/swarmd/go.mod
+++ b/swarmd/go.mod
@@ -4,14 +4,14 @@ go 1.24.0
 
 require (
 	github.com/cloudflare/cfssl v1.6.4
-	github.com/docker/docker v24.0.0-rc.2.0.20230908212318-6ce5aa1cd5a4+incompatible // master (v25.0.0-dev)
-	github.com/docker/go-connections v0.4.1-0.20231110212414-fa09c952e3ea
 	github.com/docker/go-units v0.5.0
 	github.com/dustin/go-humanize v1.0.1
 	github.com/gogo/protobuf v1.3.2
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0
+	github.com/moby/moby/api v1.54.2
+	github.com/moby/moby/client v0.4.1
 	github.com/moby/swarmkit/v2 v2.1.2-0.20251106140653-b63092e712bf
-	github.com/opencontainers/image-spec v1.1.0
+	github.com/opencontainers/image-spec v1.1.1
 	github.com/pkg/errors v0.9.1
 	github.com/prometheus/client_golang v1.20.5
 	github.com/sirupsen/logrus v1.9.3
@@ -45,10 +45,12 @@ require (
 	github.com/bits-and-blooms/bitset v1.13.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/container-storage-interface/spec v1.2.0 // indirect
-	github.com/containerd/containerd v1.7.29 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/coreos/go-semver v0.3.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
+	github.com/docker/go-connections v0.7.0 // indirect
 	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
 	github.com/docker/go-metrics v0.0.1 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
@@ -64,8 +66,7 @@ require (
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jmoiron/sqlx v1.3.3 // indirect
 	github.com/klauspost/compress v1.17.9 // indirect
-	github.com/moby/term v0.5.2 // indirect
-	github.com/morikuni/aec v1.0.0 // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
@@ -81,7 +82,6 @@ require (
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
 	go.opentelemetry.io/otel v1.38.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.38.0 // indirect
 	go.opentelemetry.io/otel/metric v1.38.0 // indirect
 	go.opentelemetry.io/otel/trace v1.38.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
@@ -94,7 +94,6 @@ require (
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250825161204-c5933d9347a5 // indirect
 	google.golang.org/protobuf v1.36.8 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	gotest.tools/v3 v3.5.2 // indirect
 	k8s.io/klog/v2 v2.90.1 // indirect
 )
 
diff --git a/swarmd/go.sum b/swarmd/go.sum
index d5e71d116f..e84b6abc6d 100644
--- a/swarmd/go.sum
+++ b/swarmd/go.sum
@@ -1,7 +1,5 @@
 code.cloudfoundry.org/clock v1.1.0 h1:XLzC6W3Ah/Y7ht1rmZ6+QfPdt1iGWEAAtIZXgiaj57c=
 code.cloudfoundry.org/clock v1.1.0/go.mod h1:yA3fxddT9RINQL2XHS7PS+OXxKCGhfrZmlNUCIM6AKo=
-github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
-github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
@@ -12,8 +10,6 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bits-and-blooms/bitset v1.13.0 h1:bAQ9OPNFYbGHV6Nez0tmNI0RiEu7/hxlYJRUA0wFAVE=
 github.com/bits-and-blooms/bitset v1.13.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
-github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
-github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cloudflare/cfssl v1.6.4 h1:NMOvfrEjFfC63K3SGXgAnFdsgkmiq4kATme5BfcqrO8=
@@ -22,10 +18,10 @@ github.com/cockroachdb/datadriven v1.0.2 h1:H9MtNqVoVhvd9nCBwOyDjUEdZCREqbIdCJD9
 github.com/cockroachdb/datadriven v1.0.2/go.mod h1:a9RdTaap04u637JoCzcUoIcDmvwSUtcUFtT/C3kJlTU=
 github.com/container-storage-interface/spec v1.2.0 h1:bD9KIVgaVKKkQ/UbVUY9kCaH/CJbhNxe0eeB4JeJV2s=
 github.com/container-storage-interface/spec v1.2.0/go.mod h1:6URME8mwIBbpVyZV93Ce5St17xBiQJQY67NDsuohiy4=
-github.com/containerd/containerd v1.7.29 h1:90fWABQsaN9mJhGkoVnuzEY+o1XDPbg9BTC9QTAHnuE=
-github.com/containerd/containerd v1.7.29/go.mod h1:azUkWcOvHrWvaiUjSQH0fjzuHIwSPg1WL5PshGP4Szs=
-github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
-github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
+github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
+github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
+github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
 github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
 github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
@@ -34,10 +30,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/docker v24.0.0-rc.2.0.20230908212318-6ce5aa1cd5a4+incompatible h1:sqXunZ6IkpGcR9Kgj8R4MaCXNBZYhlcXxe4BGC8tJAI=
-github.com/docker/docker v24.0.0-rc.2.0.20230908212318-6ce5aa1cd5a4+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/go-connections v0.4.1-0.20231110212414-fa09c952e3ea h1:+4n+kUVbPdu6qMI9SUnSKMC+D50gNW4L7Lhk9tI2lVo=
-github.com/docker/go-connections v0.4.1-0.20231110212414-fa09c952e3ea/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
+github.com/docker/go-connections v0.7.0 h1:6SsRfJddP22WMrCkj19x9WKjEDTB+ahsdiGYf0mN39c=
+github.com/docker/go-connections v0.7.0/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c h1:+pKlWGMw7gf6bQ+oDZB4KHQFypsfjYlq/C4rfL7D3g8=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8=
@@ -118,14 +112,16 @@ github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+
 github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/mattn/go-sqlite3 v1.14.6/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
-github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
-github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
+github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
+github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
+github.com/moby/moby/api v1.54.2 h1:wiat9QAhnDQjA7wk1kh/TqHz2I1uUA7M7t9SAl/JNXg=
+github.com/moby/moby/api v1.54.2/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
+github.com/moby/moby/client v0.4.1 h1:DMQgisVoMkmMs7fp3ROSdiBnoAu8+vo3GggFl06M/wY=
+github.com/moby/moby/client v0.4.1/go.mod h1:z52C9O2POPOsnxZAy//WtKcQ32P+jT/NGeXu/7nfjGQ=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
-github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
-github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/mreiferson/go-httpclient v0.0.0-20160630210159-31f0106b4474/go.mod h1:OQA4XLvDbMgS8P0CevmM4m9Q3Jq4phKUzcocxuGJ5m8=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
@@ -139,8 +135,8 @@ github.com/onsi/gomega v1.27.6/go.mod h1:PIQNjfQwkP3aQAH7lf7j87O/5FiNr+ZR8+ipb+q
 github.com/op/go-logging v0.0.0-20160315200505-970db520ece7/go.mod h1:HzydrMdWErDVzsI23lYNej1Htcns9BCg93Dk0bBINWk=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
-github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
 github.com/phayes/permbits v0.0.0-20190612203442-39d7c581d2ee h1:P6U24L02WMfj9ymZTxl7CxS73JC99x3ukk+DBkgQGQs=
 github.com/phayes/permbits v0.0.0-20190612203442-39d7c581d2ee/go.mod h1:3uODdxMgOaPYeWU7RzZLxVtJHZ/x1f/iHkBZuKJDzuY=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -216,10 +212,6 @@ go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 h1:RbKq8BG
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0/go.mod h1:h06DGIukJOevXaj/xrNjhi/2098RZzcLTbc0jDAUbsg=
 go.opentelemetry.io/otel v1.38.0 h1:RkfdswUDRimDg0m2Az18RKOsnI8UDzppJAtj01/Ymk8=
 go.opentelemetry.io/otel v1.38.0/go.mod h1:zcmtmQ1+YmQM9wrNsTGV/q/uyusom3P8RxwExxkZhjM=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 h1:GqRJVj7UmLjCVyVJ3ZFLdPRmhDUp2zFmQe3RHIOsw24=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0/go.mod h1:ri3aaHSmCTVYu2AWv44YMauwAQc0aqI9gHKIcSbI1pU=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.38.0 h1:aTL7F04bJHUlztTsNGJ2l+6he8c+y/b//eR0jjjemT4=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.38.0/go.mod h1:kldtb7jDTeol0l3ewcmd8SDvx3EmIE7lyvqbasU3QC4=
 go.opentelemetry.io/otel/metric v1.38.0 h1:Kl6lzIYGAh5M159u9NgiRkmoMKjvbsKtYRwgfrA6WpA=
 go.opentelemetry.io/otel/metric v1.38.0/go.mod h1:kB5n/QoRM8YwmUahxvI3bO34eVtQf2i4utNVLr9gEmI=
 go.opentelemetry.io/otel/sdk v1.38.0 h1:l48sr5YbNf2hpCUj/FoGhW9yDkl+Ma+LrVl8qaM5b+E=
@@ -228,8 +220,6 @@ go.opentelemetry.io/otel/sdk/metric v1.38.0 h1:aSH66iL0aZqo//xXzQLYozmWrXxyFkBJ6
 go.opentelemetry.io/otel/sdk/metric v1.38.0/go.mod h1:dg9PBnW9XdQ1Hd6ZnRz689CbtrUp0wMMs9iPcgT9EZA=
 go.opentelemetry.io/otel/trace v1.38.0 h1:Fxk5bKrDZJUH+AMyyIXGcFAPah0oRcT+LuNtJrmcNLE=
 go.opentelemetry.io/otel/trace v1.38.0/go.mod h1:j1P9ivuFsTceSWe1oY+EeW3sc+Pp42sO++GHkg4wwhs=
-go.opentelemetry.io/proto/otlp v1.7.1 h1:gTOMpGDb0WTBOP8JaO72iL3auEZhVmAQg4ipjOVAtj4=
-go.opentelemetry.io/proto/otlp v1.7.1/go.mod h1:b2rVh6rfI/s2pHWNlB7ILJcRALpcNDzKhACevjI+ZnE=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
@@ -316,3 +306,5 @@ gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
 gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
 k8s.io/klog/v2 v2.90.1 h1:m4bYOKall2MmOiRaR1J+We67Do7vm9KiQVlT96lnHUw=
 k8s.io/klog/v2 v2.90.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
+pgregory.net/rapid v1.2.0 h1:keKAYRcjm+e1F0oAuU5F5+YPAWcyxNNRK2wud503Gnk=
+pgregory.net/rapid v1.2.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04=
diff --git a/swarmd/go.work.sum b/swarmd/go.work.sum
index cbdb77d1b0..9080948b1d 100644
--- a/swarmd/go.work.sum
+++ b/swarmd/go.work.sum
@@ -513,6 +513,8 @@ github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
 github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0 h1:59MxjQVfjXsBpLy+dbd2/ELV5ofnUkUZBvWSC85sheA=
 github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0/go.mod h1:OahwfttHWG6eJ0clwcfBAHoDI6X/LV/15hx/wlMZSrU=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/BurntSushi/toml v0.3.1 h1:WXkYYl6Yr3qBf1K79EBnL4mak0OimBfB0XUf9Vl28OQ=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802 h1:1BDTz0u9nC3//pOCMdNH+CiXJVYJh5UQNCOBG7jbELc=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.25.0 h1:3c8yed4lgqTt+oTQ+JNMDo+F4xprBf+O/il4ZC0nRLw=
@@ -566,6 +568,8 @@ github.com/campoy/embedmd v1.0.0 h1:V4kI2qTJJLf4J29RzI/MAt2c3Bl4dQSYPuflzwFH2hY=
 github.com/campoy/embedmd v1.0.0/go.mod h1:oxyr9RCiSXg0M3VJ3ks0UGfp98BpSSGr0kpiX3MzVl8=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/census-instrumentation/opencensus-proto v0.3.0 h1:t/LhUZLVitR1Ow2YOnduCsavhwFUklBMoGVYUCqmCqk=
+github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/census-instrumentation/opencensus-proto v0.4.1 h1:iKLQ0xPNFxR/2hzXZMrBo8f1j86j5WHzznCCQxV/b8g=
 github.com/census-instrumentation/opencensus-proto v0.4.1/go.mod h1:4T9NM4+4Vw91VeyqjLS6ao50K5bOcLKN6Q42XnYaRYw=
 github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
@@ -578,6 +582,8 @@ github.com/cloudflare/backoff v0.0.0-20161212185259-647f3cdfc87a h1:8d1CEOF1xlde
 github.com/cloudflare/backoff v0.0.0-20161212185259-647f3cdfc87a/go.mod h1:rzgs2ZOiguV6/NpiDgADjRLPNyZlApIWxKpkT+X8SdY=
 github.com/cloudflare/redoctober v0.0.0-20211013234631-6a74ccc611f6 h1:QKzett0dn5FhjcIHNKSClEilabfhWCnsdijq3ftm9Ms=
 github.com/cloudflare/redoctober v0.0.0-20211013234631-6a74ccc611f6/go.mod h1:Ikt4Wfpln1YOrak+auA8BNxgiilj0Y2y7nO+aN2eMzk=
+github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4 h1:hzAQntlaYRkVSFEfj9OTWlVV1H155FMD8BTKktLv0QI=
+github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
 github.com/cncf/udpa/go v0.0.0-20220112060539-c52dc94e7fbe h1:QQ3GSy+MqSHxm/d8nCtnAiZdYFd45cYZPs8vOOIYKfk=
 github.com/cncf/udpa/go v0.0.0-20220112060539-c52dc94e7fbe/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
 github.com/cncf/xds/go v0.0.0-20230105202645-06c439db220b h1:ACGZRIr7HsgBKHsueQ1yM4WaVaXh21ynwqsF8M8tXhA=
@@ -636,6 +642,8 @@ github.com/containerd/typeurl v1.0.2 h1:Chlt8zIieDbzQFzXzAeBEF92KhExuE4p9p92/QmY
 github.com/containerd/typeurl v1.0.2/go.mod h1:9trJWW2sRlGub4wZJRTW83VtbOLS6hwcDZXTn6oPz9s=
 github.com/containerd/typeurl/v2 v2.1.1 h1:3Q4Pt7i8nYwy2KmQWIw2+1hTvwTE/6w9FqcttATPO/4=
 github.com/containerd/typeurl/v2 v2.1.1/go.mod h1:IDp2JFvbwZ31H8dQbEIY7sDl2L3o3HZj1hsSQlywkQ0=
+github.com/containerd/typeurl/v2 v2.2.0 h1:6NBDbQzr7I5LHgp34xAXYF5DOTQDn05X58lsPEmzLso=
+github.com/containerd/typeurl/v2 v2.2.0/go.mod h1:8XOOxnyatxSWuG8OfsZXVnAF4iZfedjS/8UHSPJnX4g=
 github.com/containerd/zfs v1.1.0 h1:n7OZ7jZumLIqNJqXrEc/paBM840mORnmGdJDmAmJZHM=
 github.com/containerd/zfs v1.1.0/go.mod h1:oZF9wBnrnQjpWLaPKEinrx3TQ9a+W/RJO7Zb41d8YLE=
 github.com/containernetworking/cni v1.1.1 h1:ky20T7c0MvKvbMOwS/FrlbNwjEoqJEUUYfsL4b0mc4k=
@@ -665,6 +673,8 @@ github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ3
 github.com/creack/pty v1.1.11 h1:07n33Z8lZxZ2qwegKbObQohDhXDQxiMMz1NOUGYlesw=
 github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
 github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
+github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
+github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
@@ -733,7 +743,6 @@ github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc=
 github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
 github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
@@ -745,9 +754,9 @@ github.com/google/cel-go v0.17.1 h1:s2151PDGy/eqpCI80/8dl4VL3xTkqI/YubXLXCFw0mw=
 github.com/google/cel-go v0.17.1/go.mod h1:HXZKzB0LXqer5lHHgfWAnlYwJaQBDKMjxjulNQzhwhY=
 github.com/google/flatbuffers v2.0.8+incompatible h1:ivUb1cGomAB101ZM1T0nOiWz9pSrTMoa9+EiY7igmkM=
 github.com/google/flatbuffers v2.0.8+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/gofuzz v1.0.0 h1:A8PeW59pxE9IoFRqBp37U+mSNaQoZ46F1f0f863XSXw=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/martian v2.1.0+incompatible h1:/CP5g8u/VJHijgedC/Legn3BAbAaWPgecwXBIDzw5no=
@@ -856,9 +865,13 @@ github.com/mattn/go-runewidth v0.0.13 h1:lTGmDsbAYt5DmK6OnoV7EuIF1wEIFAcxld6ypU4
 github.com/mattn/go-runewidth v0.0.13/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mattn/go-sqlite3 v1.14.15 h1:vfoHhTN1af61xCRSWzFIWzx2YskyMTwHLrExkBOjvxI=
 github.com/mattn/go-sqlite3 v1.14.15/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
+github.com/matttproud/golang_protobuf_extensions v1.0.2 h1:hAHbPm5IJGijwng3PWk09JkG9WeqChjprR5s9bBZ+OM=
+github.com/matttproud/golang_protobuf_extensions v1.0.2/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
 github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
 github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
 github.com/miekg/dns v1.0.14 h1:9jZdLNd/P4+SfEJ0TNyxYpsK8N4GtfylBLqtbYN1sbA=
+github.com/miekg/pkcs11 v1.0.3 h1:iMwmD7I5225wv84WxIG/bmxz9AXjWvTWIbM/TYHvWtw=
+github.com/miekg/pkcs11 v1.0.3/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
 github.com/miekg/pkcs11 v1.1.1 h1:Ugu9pdy6vAYku5DEpVWVFPYnzV+bxB+iRdbuFSu7TvU=
 github.com/miekg/pkcs11 v1.1.1/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
 github.com/minio/asm2plan9s v0.0.0-20200509001527-cdd76441f9d8 h1:AMFGa4R4MiIpspGNG7Z948v4n35fFGB3RR3G/ry4FWs=
@@ -894,6 +907,8 @@ github.com/moby/sys/user v0.3.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85
 github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
 github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
+github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
+github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
@@ -950,6 +965,8 @@ github.com/russross/blackfriday v1.6.0 h1:KqfZb0pUVN2lYqZUYRddxF4OR8ZMURnJIG5Y3V
 github.com/russross/blackfriday v1.6.0/go.mod h1:ti0ldHuxg49ri4ksnFxlkCfN+hvslNlmVHqNRXXJNAY=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f h1:UFr9zpz4xgTnIE5yIMtWAMngCdZ9p/+q6lTbgelo80M=
+github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 h1:lZUw3E0/J3roVtGQ+SCrUrg3ON6NgVqpn3+iol9aGu4=
+github.com/santhosh-tekuri/jsonschema/v5 v5.3.1/go.mod h1:uToXkOrWAZ6/Oc07xWQrPOhJotwFIyu2bBVN41fcDUY=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 h1:nn5Wsu0esKSJiIVhscUtVbo7ada43DJhG55ua/hjS5I=
 github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
 github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
@@ -1081,12 +1098,14 @@ go.uber.org/multierr v1.10.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN8
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.39.0/go.mod h1:L+Xg3Wf6HoL4Bn4238Z6ft6KfEpN0tJGo53AAPC632U=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4 h1:c2HOrn5iMezYjSlGPncknSEr/8x5LELb/ilJbXi9DEA=
 golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136 h1:A1gGSx58LAGVHUUsOf7IiR0u8Xb6W51gRwfDBhkdcaw=
 golang.org/x/exp v0.0.0-20230522175609-2e198f4a06a1 h1:k/i9J1pBpvlfR+9QsetwPyERsqu1GIbi967PQMq3Ivc=
 golang.org/x/exp v0.0.0-20230522175609-2e198f4a06a1/go.mod h1:V1LtkGg67GoY2N1AnLN78QLrzxkLyJw7RJb1gzOOz9w=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b h1:+qEpEAPhDZ1o0x3tHzZTQDArnOixOzGD9HUJfcg0mb4=
 golang.org/x/image v0.25.0 h1:Y6uW6rH1y5y/LK1J8BPWZtr6yZ7hrsy6hFrXjgsc2fQ=
 golang.org/x/image v0.25.0/go.mod h1:tCAmOEGthTtkalusGp1g3xa2gke8J6c2N565dTyl9Rs=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3 h1:XQyxROzUlZH+WIQwySDgnISgOivlhjIEwaQaJEJrrN0=
 golang.org/x/lint v0.0.0-20210508222113-6edffad5e616 h1:VLliZ0d+/avPrXXH+OakdXhpJuEoBZuwh1m2j7U6Iug=
 golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028 h1:4+4C/Iv2U4fMZBiMCc98MG1In4gJY5YRhtpDNeDeHWs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
@@ -1181,7 +1200,6 @@ google.golang.org/grpc v1.67.1/go.mod h1:1gLDyUQU7CTLJI90u3nXZ9ekeghjeM7pTDZlqFN
 google.golang.org/grpc v1.71.0/go.mod h1:H0GRtasmQOh9LkFoCPDu3ZrwUtD1YGE+b2vYBYd/8Ec=
 google.golang.org/grpc/examples v0.0.0-20230224211313-3775f633ce20 h1:MLBCGN1O7GzIx+cBiwfYPwtmZ41U3Mn/cotLJciaArI=
 google.golang.org/grpc/examples v0.0.0-20230224211313-3775f633ce20/go.mod h1:Nr5H8+MlGWr5+xX/STzdoEqJrO+YteqFbMyCsrb6mH0=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
@@ -1206,6 +1224,7 @@ gopkg.in/square/go-jose.v2 v2.5.1 h1:7odma5RETjNHWJnR32wx8t+Io4djHE1PqxCFx3iiZ2w
 gopkg.in/square/go-jose.v2 v2.5.1/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc h1:/hemPrYIhOhy8zYrNj+069zDB68us2sMGsfkFJO0iZs=
 honnef.co/go/tools v0.0.1-2019.2.3 h1:3JgtbtFHMiCmsznwGVTUWbgGov+pVqnlf1dEJTNAXeM=
 k8s.io/api v0.22.5 h1:xk7C+rMjF/EGELiD560jdmwzrB788mfcHiNbMQLIVI8=
 k8s.io/api v0.22.5/go.mod h1:mEhXyLaSD1qTOf40rRiKXkc+2iCem09rWLlFwhCEiAs=