Merge branch 'docker:main' into laravel-compose

Author: rw4lll

.github/CODEOWNERS

@@ -15,12 +15,16 @@
 
 /content/manuals/extensions-sdk/ @aevesdocker
 
-/content/manuals/scout/ @dvdksn
+/content/manuals/scout/ @craig-osterhout
 
 /content/manuals/docker-hub/ @craig-osterhout
 
 /content/manuals/engine/ @dvdksn
 
+/content/reference/api/engine/ @dvdksn
+
+/content/reference/cli/ @dvdksn
+
 /content/manuals/subscription/ @sarahsanders-docker
 
 /content/manuals/security/ @aevesdocker
@@ -29,11 +33,14 @@
 
 /content/manuals/docker-hub/official_images/ @craig-osterhout
 
-/content/manuals/registry/ @dvdksn
+/content/manuals/registry/ @craig-osterhout
 
 /content/manuals/admin/ @sarahsanders-docker
 
 /content/manuals/billing/ @sarahsanders-docker
 
 /content/manuals/accounts/ @sarahsanders-docker
 
+/hack @dvdksn
+
+/_vendor @dvdksn

.github/ISSUE_TEMPLATE/new_guide.yml

@@ -0,0 +1,25 @@
+# https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/syntax-for-githubs-form-schema
+name: New guide
+description: Propose a new guide for Docker docs
+labels:
+  - area/guides
+  - kind/proposal
+
+body:
+  - type: textarea
+    attributes:
+      label: Description
+      description: |
+        Briefly describe the topic that you would like us to cover.
+    validations:
+      required: true
+  - type: checkboxes
+    attributes:
+      label: Would you like to contribute this guide?
+      description: |
+        If you select this checkbox, you indicate that you're willing to
+        contribute this guide. If not, we will treat this issue as a request,
+        and someone (a Docker employee, Docker captain, or community member)
+        may pick it up and start working on it.
+      options:
+        - label: "Yes"

.github/labeler.yml

@@ -2,7 +2,7 @@ area/release:
   - changed-files:
       - any-glob-to-any-file:
           - .github/**
-          - _releaser/**
+          - hack/releaser/**
           - netlify.toml
 
 area/config:
@@ -14,6 +14,7 @@ area/config:
           - docker-bake.hcl
           - hugo.yaml
           - pagefind.yml
+          - hack/vendor
 
 area/contrib:
   - changed-files:
@@ -28,7 +29,7 @@ area/tests:
           - .markdownlint.json
           - .vale.ini
           - _vale/**
-          - scripts/test_*
+          - hack/test/*
 
 area/build:
   - changed-files:
@@ -159,6 +160,11 @@ area/accounts:
       - any-glob-to-any-file:
           - content/manuals/accounts/**
 
+area/copilot:
+  - changed-files:
+      - any-glob-to-any-file:
+          - content/manuals/copilot/**
+
 hugo:
   - changed-files:
       - any-glob-to-any-file:
@@ -178,3 +184,4 @@ dependencies:
           - go.sum
           - package*.json
           - _vendor/**
+          - hack/vendor

.github/workflows/build.yml

@@ -11,12 +11,42 @@ on:
       - main
   pull_request:
 
+env:
+  # Use edge release of buildx (latest RC, fallback to latest stable)
+  SETUP_BUILDX_VERSION: edge
+  SETUP_BUILDKIT_IMAGE: "moby/buildkit:latest"
+
 permissions:
   contents: read # to fetch code (actions/checkout)
 
 jobs:
+  releaser:
+    runs-on: ubuntu-24.04
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          version: ${{ env.SETUP_BUILDX_VERSION }}
+          driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }}
+      -
+        name: Build
+        uses: docker/bake-action@v5
+        with:
+          files: |
+            docker-bake.hcl
+          targets: releaser-build
+          set: |
+            *.cache-from=type=gha,scope=releaser
+            *.cache-to=type=gha,scope=releaser,mode=max
+
   build:
     runs-on: ubuntu-24.04
+    needs:
+      - releaser
     steps:
       -
         name: Checkout
@@ -34,6 +64,16 @@ jobs:
           set: |
             *.cache-from=type=gha,scope=build
             *.cache-to=type=gha,scope=build,mode=max
+      -
+        name: Check Cloudfront config
+        uses: docker/bake-action@v5
+        with:
+          targets: aws-cloudfront-update
+        env:
+          DRY_RUN: true
+          AWS_REGION: us-east-1
+          AWS_CLOUDFRONT_ID: 0123456789ABCD
+          AWS_LAMBDA_FUNCTION: DockerDocsRedirectFunction-dummy
 
   vale:
     if: ${{ github.event_name == 'pull_request' }}
@@ -76,25 +116,3 @@ jobs:
             *.cache-to=type=gha,scope=validate-${{ matrix.target }},mode=max
             *.cache-from=type=gha,scope=validate-${{ matrix.target }}
             *.cache-from=type=gha,scope=build
-
-  # build-releaser builds the _releaser used for AWS deployment in publish workflow.
-  # It's just to be sure it builds correctly.
-  build-releaser:
-    runs-on: ubuntu-24.04
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      -
-        name: Build
-        uses: docker/bake-action@v5
-        with:
-          files: |
-            docker-bake.hcl
-          targets: releaser-build
-          set: |
-            *.cache-from=type=gha,scope=releaser
-            *.cache-to=type=gha,scope=releaser,mode=max

.github/workflows/deploy.yml

@@ -12,6 +12,11 @@ on:
       - main
       - published
 
+env:
+  # Use edge release of buildx (latest RC, fallback to latest stable)
+  SETUP_BUILDX_VERSION: edge
+  SETUP_BUILDKIT_IMAGE: "moby/buildkit:latest"
+
 # these permissions are needed to interact with GitHub's OIDC Token endpoint.
 permissions:
   id-token: write
@@ -80,6 +85,9 @@ jobs:
       -
         name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
+        with:
+          version: ${{ env.SETUP_BUILDX_VERSION }}
+          driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }}
       -
         name: Build website
         uses: docker/bake-action@v5

.github/workflows/validate-upstream.yml

@@ -23,6 +23,11 @@ on:
         type: boolean
         required: false
 
+env:
+  # Use edge release of buildx (latest RC, fallback to latest stable)
+  SETUP_BUILDX_VERSION: edge
+  SETUP_BUILDKIT_IMAGE: "moby/buildkit:latest"
+
 jobs:
   run:
     runs-on: ubuntu-24.04
@@ -80,6 +85,9 @@ jobs:
       -
         name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
+        with:
+          version: ${{ env.SETUP_BUILDX_VERSION }}
+          driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }}
       -
         name: Validate
         uses: docker/bake-action@v5

Dockerfile

@@ -1,22 +1,43 @@
 # syntax=docker/dockerfile:1
 # check=skip=InvalidBaseImagePlatform
 
-# ALPINE_VERSION sets the Alpine Linux version for all Alpine stages
-ARG ALPINE_VERSION=3.20
-# GO_VERSION sets the Go version for the base stage
+ARG ALPINE_VERSION=3.21
 ARG GO_VERSION=1.23
-# HTMLTEST_VERSION sets the wjdp/htmltest version for HTML testing
 ARG HTMLTEST_VERSION=0.17.0
-# HUGO_VERSION sets the version of Hugo to build the site with
-ARG HUGO_VERSION=0.136.3
+ARG HUGO_VERSION=0.139.0
+ARG NODE_VERSION=22
+ARG PAGEFIND_VERSION=1.1.1
 
-# build-base is the base stage used for building the site
-FROM ghcr.io/gohugoio/hugo:v${HUGO_VERSION} AS build-base
+# base defines the generic base stage
+FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS base
+RUN apk add --no-cache \
+    git \
+    nodejs \
+    npm \
+    gcompat
+
+# npm downloads Node.js dependencies
+FROM base AS npm
 ENV NODE_ENV="production"
+WORKDIR /out
 RUN --mount=source=package.json,target=package.json \
     --mount=source=package-lock.json,target=package-lock.json \
     --mount=type=cache,target=/root/.npm \
     npm ci
+
+# hugo downloads the Hugo binary
+FROM base AS hugo
+ARG TARGETARCH
+ARG HUGO_VERSION
+WORKDIR /out
+ADD https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_linux-${TARGETARCH}.tar.gz .
+RUN tar xvf hugo_extended_${HUGO_VERSION}_linux-${TARGETARCH}.tar.gz
+
+# build-base is the base stage used for building the site
+FROM base AS build-base
+WORKDIR /project
+COPY --from=hugo /out/hugo /bin/hugo
+COPY --from=npm /out/node_modules node_modules
 COPY . .
 
 # build creates production builds with Hugo
@@ -25,7 +46,9 @@ FROM build-base AS build
 ARG HUGO_ENV="development"
 # DOCS_URL sets the base URL for the site
 ARG DOCS_URL="https://docs.docker.com"
-RUN hugo --gc --minify -e $HUGO_ENV -b $DOCS_URL
+ENV HUGO_CACHEDIR="/tmp/hugo_cache"
+RUN --mount=type=cache,target=/tmp/hugo_cache \
+    hugo --gc --minify -e $HUGO_ENV -b $DOCS_URL
 
 # lint lints markdown files
 FROM davidanson/markdownlint-cli2:v0.14.0 AS lint
@@ -61,8 +84,8 @@ RUN hugo mod vendor
 
 # vendor is an empty stage with only vendored Hugo modules
 FROM scratch AS vendor
-COPY --from=update-modules /src/_vendor /_vendor
-COPY --from=update-modules /src/go.* /
+COPY --from=update-modules /project/_vendor /_vendor
+COPY --from=update-modules /project/go.* /
 
 # build-upstream builds an upstream project with a replacement module
 FROM build-base AS build-upstream
@@ -87,10 +110,7 @@ RUN htmltest
 FROM alpine:${ALPINE_VERSION} AS unused-media
 RUN apk add --no-cache fd ripgrep
 WORKDIR /test
-RUN --mount=type=bind,target=. <<"EOT"
-set -ex
-./scripts/test_unused_media.sh
-EOT
+RUN --mount=type=bind,target=. ./hack/test/unused_media
 
 # path-warnings checks for duplicate target paths
 FROM build-base AS path-warnings
@@ -105,8 +125,8 @@ fi
 EOT
 
 # pagefind installs the Pagefind runtime
-FROM node:alpine${ALPINE_VERSION} AS pagefind
-ARG PAGEFIND_VERSION=1.1.1
+FROM base AS pagefind
+ARG PAGEFIND_VERSION
 COPY --from=build /project/public ./public
 RUN --mount=type=bind,src=pagefind.yml,target=pagefind.yml \
     npx pagefind@v${PAGEFIND_VERSION} --output-path "/pagefind"
@@ -122,7 +142,7 @@ RUN apk add yq
 COPY --from=build /project/public ./public
 RUN --mount=type=bind,target=. <<"EOT"
 set -ex
-./scripts/test_go_redirects.sh
+./hack/test/go_redirects
 EOT
 
 # release is an empty scratch image with only compiled assets

Makefile

@@ -1,3 +1,3 @@
 .PHONY: vendor
 vendor: ## vendor hugo modules
-	./scripts/vendor.sh
+	./hack/vendor