Moby — Dependencies#

Module info#

  • Module: github.com/moby/moby/v2
  • Go version: 1.25.5
  • Direct dependencies: 115
  • Indirect dependencies: 178 (total go.sum entries: 1,108 lines)

Dependency categories#

Container runtime / OCI ecosystem#

The single most important dependency cluster — Moby delegates all container execution to containerd and embraces OCI specifications throughout:

  • github.com/containerd/containerd/v2 v2.2.2 — container lifecycle management, the primary execution backend; Moby talks to it over gRPC
  • github.com/containerd/containerd/api v1.10.0 — protobuf API types for containerd, decoupled from the client library
  • github.com/containerd/cgroups/v3 v3.1.3 — cgroup v1/v2 management for resource limits
  • github.com/containerd/continuity v0.4.5 — filesystem manifest and file walker, used in image layer diffing
  • github.com/containerd/errdefs v1.0.0 — shared error domain with containerd (gRPC status code mapping)
  • github.com/containerd/fifo v1.1.0 — named pipe abstraction for container stdio
  • github.com/containerd/log v0.1.0 — shared structured logging facade (wraps logrus)
  • github.com/containerd/nri v0.11.0 — Node Resource Interface plugin support
  • github.com/containerd/platforms v1.0.0-rc.2 — OCI platform matching (linux/amd64 etc.)
  • github.com/containerd/typeurl/v2 v2.2.3 — type-safe Any marshalling over protobuf
  • github.com/opencontainers/go-digest v1.0.0 — content-addressable SHA256 digests for image layers
  • github.com/opencontainers/image-spec v1.1.1 — OCI image format types (manifests, configs, layers)
  • github.com/opencontainers/runtime-spec v1.3.0 — OCI runtime configuration (process, namespace, cgroup specs)
  • github.com/opencontainers/selinux v1.13.1 — SELinux label management for container isolation
  • github.com/opencontainers/cgroups v0.0.6 — OCI-level cgroup bindings

Moby ecosystem (sub-module fragmentation)#

Moby has been progressively extracting internal libraries into standalone modules. These are direct dependencies on the project’s own satellites:

  • github.com/moby/moby/api v1.54.0 — extracted HTTP API types sub-module (replaced via ./api)
  • github.com/moby/moby/client v0.3.0 — extracted Docker client sub-module (replaced via ./client)
  • github.com/moby/buildkit v0.29.0 — image build subsystem; provides the build cache, solver, and frontend protocol
  • github.com/moby/swarmkit/v2 v2.1.2-* — Swarm orchestration engine embedded in dockerd
  • github.com/moby/docker-image-spec v1.3.1 — Docker-specific image manifest extensions on top of OCI
  • github.com/moby/sys/* — a family of small, focused Linux/system utilities:
    • atomicwriter, mount, mountinfo, reexec, sequential, signal, symlink, user, userns — each a focused package for one OS-level concern
  • github.com/moby/locker v1.0.1 — named mutex (key-based locking for containers/images by ID)
  • github.com/moby/patternmatcher v0.6.1 — .dockerignore-style glob matching
  • github.com/moby/pubsub v1.0.0 — simple publish/subscribe, used for daemon event streaming
  • github.com/moby/go-archive v0.2.0 — tar archive creation/extraction for image layers and builds
  • github.com/moby/ipvs v1.1.0 — netlink-based IPVS management for Swarm load balancing
  • github.com/moby/profiles/apparmor v0.1.0 — AppArmor profile generation
  • github.com/moby/profiles/seccomp v0.1.0 — seccomp syscall filter profiles
  • github.com/moby/policy-helpers v0.0.0-* — authorization policy utilities
  • github.com/moby/term v0.5.2 — terminal width/height and stream type detection

Core infrastructure#

  • github.com/sirupsen/logrus v1.9.4 — structured logging (still the primary logger; logrus vs slog migration not yet complete; only 6 files import it directly — most go through containerd/log)
  • github.com/spf13/cobra v1.10.2 — CLI framework for dockerd command parsing
  • github.com/spf13/pflag v1.0.10 — POSIX-style flag parsing (used by cobra)
  • github.com/pkg/errors v0.9.1 — error wrapping with stack traces (240 files still import this; heavy legacy use)
  • github.com/pelletier/go-toml/v2 v2.3.0 — TOML config file parsing (daemon config)
  • dario.cat/mergo v1.0.2 — struct/map merging (used for config overlay)
  • go.etcd.io/bbolt v1.4.3 — embedded B-tree KV store (BoltDB); used for container state, image metadata, swarm raft log
  • github.com/google/uuid v1.6.0 — UUID generation for container and network IDs

Networking / SDN#

  • github.com/gorilla/mux v1.8.1 — HTTP router for the Docker daemon REST API
  • github.com/vishvananda/netlink v1.3.1 — Linux netlink socket interface (veth creation, bridge management, route tables)
  • github.com/vishvananda/netns v0.0.5 — Linux network namespace manipulation
  • github.com/miekg/dns v1.1.72 — embedded DNS resolver/server (used by libnetwork’s internal DNS)
  • github.com/ishidawataru/sctp v0.0.0-* — SCTP socket support for container networking
  • github.com/hashicorp/memberlist v0.4.0 — SWIM gossip protocol (Swarm node discovery)
  • github.com/hashicorp/serf v0.8.5 — cluster membership layer on memberlist (Swarm)
  • github.com/hashicorp/go-immutable-radix/v2 v2.1.0 — immutable radix tree (libnetwork endpoint/IP database)
  • github.com/hashicorp/go-memdb v1.3.5 — in-memory database with indexing (libnetwork network/endpoint state)
  • github.com/docker/go-connections v0.6.0 — TCP/TLS connection helpers (docker socket binding)
  • github.com/docker/go-events v0.0.0-* — event sink and queue (used in distribution and image events)
  • github.com/rootless-containers/rootlesskit/v2 v2.3.6 — user namespace-based rootless daemon mode

Windows support#

  • github.com/Microsoft/go-winio v0.6.2 — Windows named pipes and I/O for Docker socket on Windows
  • github.com/Microsoft/hcsshim v0.14.0-rc.1 — Windows Host Compute Service (HCS) integration for Windows containers and LCOW (Linux Containers on Windows)
  • github.com/Azure/go-ansiterm v0.0.0-* — ANSI terminal emulation for Windows console

Observability / Telemetry#

  • github.com/prometheus/client_golang v1.23.2 — Prometheus metrics exposition (daemon health, container stats)
  • go.opentelemetry.io/otel v1.42.0 — OpenTelemetry tracing SDK
  • go.opentelemetry.io/otel/sdk v1.42.0 — OTel SDK
  • go.opentelemetry.io/otel/trace v1.42.0 — OTel trace API
  • go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.42.0 — OTLP trace export over HTTP
  • go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 — gRPC OTel interceptors
  • go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 — HTTP OTel middleware
  • go.opentelemetry.io/otel/bridge/opencensus v1.42.0 — compatibility shim (legacy opencensus from Swarm/Kubernetes-derived deps)
  • github.com/docker/go-metrics v0.0.1 — thin Prometheus wrapper (Docker-specific metric conventions)

Logging drivers (cloud/remote)#

Moby’s pluggable logging architecture results in cloud-SDK dependencies pulled into the daemon binary:

  • github.com/aws/aws-sdk-go-v2 v1.41.5 + aws-sdk-go-v2/service/cloudwatchlogs — AWS CloudWatch log driver
  • github.com/aws/aws-sdk-go-v2/config, credentials, feature/ec2/imds, aws/smithy-go — AWS auth chain for EC2 IMDS credentials
  • cloud.google.com/go/logging v1.13.2 + cloud.google.com/go/compute/metadata — GCP Cloud Logging driver (gVisor/GKE)
  • github.com/Graylog2/go-gelf v0.0.0-* — Graylog GELF log driver (UDP/TCP)
  • github.com/fluent/fluent-logger-golang v1.10.1 — Fluentd log driver (msgpack over TCP)
  • github.com/RackSec/srslog v0.0.0-* — BSD syslog (RFC 5424) log driver

Communication / Serialization#

  • google.golang.org/grpc v1.79.3 — gRPC framework (daemon ↔ containerd, daemon ↔ buildkit)
  • github.com/gogo/protobuf v1.3.2 — legacy protobuf encoding (Swarm, older containerd APIs)
  • github.com/golang/protobuf v1.5.4 — protobuf v1 API (bridge to v2)
  • google.golang.org/protobuf v1.36.11 — modern protobuf v2 API
  • github.com/distribution/reference v0.6.0 — image name/reference parsing (nginx:latest, sha256:abc...)
  • github.com/docker/distribution v2.8.3+incompatible — registry push/pull client (V2 distribution protocol)
  • github.com/vbatts/tar-split v0.12.2 — layer tar splitting for reproducible layer storage

Security / Trust#

  • github.com/cloudflare/cfssl v1.6.5 — TLS certificate generation and management (swarm PKI, node certs)
  • github.com/in-toto/in-toto-golang v0.10.0 — supply chain provenance (buildkit attestations, SBOM)
  • github.com/moby/buildkit v0.29.0 — also includes sigstore integration (build provenance)
  • github.com/mitchellh/copystructure v1.2.0 — deep copy (config sanitization)

Storage / Filesystem#

  • github.com/mistifyio/go-zfs/v4 v4.0.0 — ZFS storage driver (ZFS-backed layers)
  • github.com/cpuguy83/tar2go v0.3.1 — tar archive as a virtual filesystem
  • github.com/deckarep/golang-set/v2 v2.8.0 — generic set data structure
  • github.com/montanaflynn/stats v0.9.0 — statistics utilities (container resource usage aggregation)

Concurrency utilities#

  • golang.org/x/sync v0.20.0 — errgroup, semaphore (used extensively for bounded parallelism)
  • resenje.org/singleflight v0.4.3 — deduplicated concurrent operations (alternative to golang.org/x/sync/singleflight, used for image pulls)
  • github.com/docker/go-events v0.0.0-* — event channel multiplexing

Testing#

  • gotest.tools/v3 v3.5.2 — Docker’s own test assertion library (used throughout integration tests)
  • github.com/google/go-cmp v0.7.0 — deep equality comparison for tests
  • pgregory.net/rapid v1.2.0 — property-based testing (rapid/fuzzing style)
  • github.com/AdaLogics/go-fuzz-headers v0.0.0-* — go-fuzz structured input helpers
  • github.com/creack/pty v1.1.24 — PTY allocation for container TTY tests

Extended Go stdlib#

  • golang.org/x/net v0.52.0 — http2, websocket, proxy support
  • golang.org/x/sys v0.42.0 — low-level Linux syscall bindings (namespaces, seccomp, capabilities)
  • golang.org/x/mod v0.34.0 — module version parsing (used in build version metadata)
  • golang.org/x/text v0.35.0 — Unicode text normalization
  • golang.org/x/time v0.15.0 — rate limiting (rate.Limiter)

Other notable#

  • github.com/coreos/go-systemd/v22 v22.7.0 — systemd socket activation and journal logging
  • github.com/godbus/dbus/v5 v5.2.2 — D-Bus IPC (AppArmor policy updates, systemd notifications)
  • github.com/tonistiigi/go-archvariant v1.0.0 — CPU architecture variant detection (arm/v7 vs arm/v8)
  • tags.cncf.io/container-device-interface v1.1.0 — CDI spec support for GPU/accelerator passthrough
  • go.etcd.io/bbolt v1.4.3 — also used as Swarm raft log storage (etcd’s bbolt fork)
  • github.com/golang/gddo v0.0.0-* — godoc.org doc formatting (used in API description rendering)

Stdlib reliance#

Moby makes extremely heavy use of the Go standard library — approximately 1,540 of 2,145 Go source files import at least one stdlib package. The most-used stdlib packages are:

  • context — pervasive; all operations accept a context.Context for cancellation and tracing
  • sync / sync/atomic — mutex, once, waitgroup, atomic ops throughout the daemon
  • net/http — both server (daemon API) and client (registry pull/push)
  • os / os/exec — process management, filesystem operations
  • io / io/fs — streaming data (layer tarballs, container stdio)
  • fmt / errors — error formatting (mix of fmt.Errorf wrapping and pkg/errors)
  • encoding/json — Docker API request/response serialization
  • path/filepath — cross-platform path manipulation

The ratio of stdlib to third-party is relatively balanced: stdlib handles core I/O, concurrency, and HTTP fundamentals, while third-party libraries provide domain-specific functionality (container runtime, networking, cloud APIs) that stdlib doesn’t cover.

Shared dependencies#

Dependencies Moby shares with many other projects in the Go ecosystem (common cross-project connectors):

  • github.com/sirupsen/logrus — ubiquitous in pre-2020 Go infrastructure projects
  • github.com/pkg/errors — widespread in pre-Go 1.13 codebases (240 Moby files)
  • github.com/spf13/cobra + github.com/spf13/pflag — standard CLI framework for Go daemons
  • github.com/gorilla/mux — dominant HTTP router before the chi/echo era
  • google.golang.org/grpc — universal in cloud-native Go services
  • github.com/opencontainers/* — shared by all OCI-compliant runtimes (containerd, cri-o, podman)
  • github.com/prometheus/client_golang — de-facto standard for Go metrics
  • go.opentelemetry.io/otel — increasingly universal distributed tracing
  • golang.org/x/sync, golang.org/x/sys, golang.org/x/net — quasi-stdlib extensions
  • github.com/google/go-cmp — near-universal in Go test suites
  • gotest.tools/v3 — shared across Docker/Moby ecosystem projects

Vendoring#

Yes — Moby vendors all dependencies in the vendor/ directory (2,155 lines in vendor/modules.txt). This is a deliberate choice reflecting:

  1. Reproducibility at build time — Docker Engine is distributed as a production binary; vendoring ensures bit-for-bit reproducible builds without network access
  2. Supply chain security — vendoring prevents dependency substitution attacks; the source code is committed and reviewable
  3. CI/CD isolation — build farm workers don’t need proxy.golang.org access
  4. Legacy practice — Moby predates Go modules and has always vendored; the pattern predates go mod vendor

The go.sum only has 1,108 entries (surprisingly low for 293 total deps), suggesting some modules are represented by workspace or replace directives (./api, ./client) and excluded from the sum database.

Notable dependency decisions#

  1. Dual protobuf strategy (gogo + google): Moby carries both github.com/gogo/protobuf (v1.3.2, legacy Swarm/containerd APIs) and google.golang.org/protobuf (v1.36.11, modern API). The coexistence reflects a years-long migration: Swarm’s ClusterAPI and older containerd interfaces used gogo; newer containerd APIs and BuildKit use official protobuf. This dual dependency is a significant maintenance burden.

  2. gorilla/mux retention: Despite gorilla/mux entering maintenance mode in 2022, Moby continues using it for the daemon REST API. The HTTP API surface is large and stable enough that switching routers has high risk-to-reward ratio — a pragmatic choice over trendiness.

  3. Hashicorp ecosystem for Swarm: The embedded memberlist + serf + go-memdb + go-immutable-radix stack brings a significant distributed systems dependency cluster purely for Swarm mode. This reflects Swarm’s origins as a standalone project before Docker integration.

  4. AWS SDK v2 for a single log driver: The full aws-sdk-go-v2 module (with imds, config, credentials, sts, sso, ssooidc sub-packages) is a direct dependency solely to support the CloudWatch log driver. This inflates the binary significantly for what is a niche feature — illustrating the cost of batteries-included logging.

  5. pkg/errors vs stdlib errors: Despite Go 1.13 introducing errors.Is/errors.As/%w, Moby has 240 files importing github.com/pkg/errors. This is a migration in progress — newer code uses fmt.Errorf("%w", ...) while legacy code retains errors.Wrap. The overlap will persist until a dedicated refactoring pass.

  6. resenje.org/singleflight over golang.org/x/sync/singleflight: Moby uses a third-party singleflight implementation for image pull deduplication, likely for additional features (context cancellation propagation) not present in the stdlib version at the time of adoption.

  7. gotest.tools/v3 as primary test framework: Rather than testify (the de-facto community standard), Docker/Moby developed and uses gotest.tools — a smaller, Docker-idiomatic assertion library. This library is shared across moby, buildkit, and Docker CLI projects, creating a Docker-ecosystem testing monoculture distinct from the broader Go community’s testify dominance.

  8. OpenTelemetry bridge for opencensus: The go.opentelemetry.io/otel/bridge/opencensus dependency is needed because Swarm/etcd-derived dependencies still use opencensus. Rather than forking or patching, Moby bridges the two telemetry systems — an invisible maintenance cost of embedding mature third-party stacks.

Backward Moby — Structure Moby — Architecture Forward