fix(security): migrate docker/docker to moby/moby modules (BlackDuck Polaris findings)

[fzl-22]

Motivation

BlackDuck Polaris flagged docker v28.3.3 with 3 high-severity CVEs:

• CVE-2024-41110 — Auth bypass (CWE-288)
• CVE-2026-34040 — Auth bypass (CWE-288)
• CVE-2026-33997 — Off-by-one (CWE-193)

Recommended target (long-term): docker-v29.5.3 (no known vulnerabilities).

Changes

github.com/docker/docker is deprecated since v29 ([1], [2]). This PR
replaces all direct imports with github.com/moby/moby/client and
github.com/moby/moby/api, and adapts to the following v29 breaking changes:

• ContainerCreate, ContainerStart, etc. now use option structs
• client.IsErrNotFound removed — replaced with error string check
• Port.Int() replaced by Port.Num() (returns uint16)
• PortBinding.HostIP changed from string to netip.Addr

Additionally:

• fixes a pre-existing bug where image cleanup failed in -short
  mode for images that were never pulled.

Limitation

• docker/docker remains as an indirect dependency via github.com/dhui/dktest,
  which has not migrated yet. Bumped to v28.5.2 to resolve a build error.
  Full removal requires an upstream dktest update.
• Waiting for refactor: migrate from github.com/docker/docker -> github.com/moby/moby dhui/dktest#53 to be merged to fully remove docker/docker from the dependency tree.

Related Links

• https://github.com/moby/moby#go-modules
• https://github.com/moby/moby/releases/tag/docker-v29.0.0

[coveralls]

coverage: 54.338% (-0.09%) from 54.432% — fzl-22:master into golang-migrate:master

[fzl-22]

@dhui @Fontinalis Could you review this when you get a chance? It addresses a high-severity SCA finding by migrating the docker/docker imports to moby/moby.

All CI checks are passing.

[jhasrasuri]

remove approval

[fzl-22]

@jhasrasuri Can you clarify what needs fixing in go.mod? Thanks

[fzl-22]

Currently, github.com/docker/docker@v28.3.3 introduces 2 new security findings with HIGH severity:

• CVE-2026-42306 - Time-of-Check Time-of-Use (TOCTOU) Race Condition
• CVE-2026-42306 - UNIX Symbolic Link (Symlink) Following