remove direct dependency on docker/docker

[glours]

What I did

• Copy pkg/pidfile from moby/moby/v2 into internal/pidfile as a temporary internal package, removing the direct dependency on github.com/docker/docker for pidfile functionality
• github.com/docker/docker moves from a direct to an indirect dependency (still transitively required by docker/buildx)
• The internal copy includes platform-specific process-alive checks (unix/windows) and is intended to be replaced once pidfile is published as a standalone module

The github.com/docker/docker Go module has been deprecated and no longer receives releases. The moby/moby repository now publishes three modules (client, api, and v2), with only client and api intended for external use. The v2 module (daemon internals) is not meant for external consumption.

Per discussion with moby maintainers, the recommended approach is to copy the pkg/pidfile code as a temporary internal package until it is extracted into its own module.

Related issue
N/A

(not mandatory) A picture of a cute animal, if possible in relation to what you did

[thaJeztah]

I think short-term it'd be better to just copy the files to an internal package; we can look at moving some of the remaining pkg/xxx packages to github.com/moby/sys as a separate module.

[thaJeztah]

FWIW security warnings are definitely false positives; the CVEs only impact the daemon

[thaJeztah]

LGTM, thanks!

I'll have a look next week to see if we can move some of the remaining pkg/ packages 👍

[thaJeztah]

PR description probably should be updated though 🤔 😂

[Copilot]

Pull request overview

This PR migrates Compose away from direct github.com/docker/docker imports by switching to the split github.com/moby/moby/* modules and introducing an internal pidfile helper to replace the previously used Engine pidfile package.

Changes:

• Replace docker/docker version and stdcopy imports with moby/moby equivalents.
• Add internal/pidfile as a temporary in-repo replacement for the removed docker/docker/pkg/pidfile dependency.
• Adjust go.mod to drop the direct github.com/docker/docker requirement (remaining as an indirect dependency).

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pkg/compose/model.go	Switch version comparison helper import to moby module.
pkg/compose/logs_test.go	Switch stdcopy import to moby module; add test-only stdio mux writer helper.
internal/pidfile/pidfile.go	Add internal pidfile Read/Write implementation (temporary copy).
internal/pidfile/pidfile_unix.go	Add non-Windows “alive” implementation.
internal/pidfile/pidfile_windows.go	Add Windows “alive” implementation.
internal/locker/pidfile_unix.go	Update pidfile import to new internal package.
internal/locker/pidfile_windows.go	Update pidfile import to new internal package.
go.mod	Move github.com/docker/docker from direct to indirect requirement.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

alive() always returns true if OpenProcess and GetExitCodeProcess succeed, regardless of whether the process has actually exited (exit code != STILL_ACTIVE). Additionally, when GetExitCodeProcess returns an error, the function compares an untrusted/undefined exit-code value against STATUS_PENDING. This can cause stale pidfiles to be treated as “still running” indefinitely on Windows. Consider returning false on GetExitCodeProcess error, and otherwise checking the returned exit code (e.g., windows.STILL_ACTIVE / equivalent) before returning true.

Suggested change

	return c == uint32(windows.STATUS_PENDING)
	}
	return true
	return false
	}
	return c == windows.STILL_ACTIVE

[thaJeztah]

Let's leave that for the module we're moving; ISTR there were some reasons to do this, but would have to check history 😂

[Copilot]

On non-Windows platforms, alive() falls back to checking for /proc/ for all OSes except darwin. This is less reliable than using unix.Kill(pid, 0) (which also lets you treat EPERM as “alive”) and can be wrong on Linux configurations that restrict /proc visibility (e.g., hidepid) and on Unix variants without /proc. Consider using unix.Kill(pid, 0) for the default case as well, similar to the darwin branch.

[Copilot]

Package comment says it provides helper functions to “create and remove PID files”, but this package currently only implements Read and Write (no remove/delete helper). Consider either adding a Remove helper (if intended) or adjusting the package comment to match the actual API surface.

[thaJeztah]

LGTM

we can look at the CoPilot comments in the moby repository (and when we move the package); I'm not sure if they are all legit concerns (could be!); this PR is just adding a temporary fork, so same code as already used.