From 5dd4cf30d442e4f666f80de8c21de7961231b8be Mon Sep 17 00:00:00 2001
From: Conlan Cesar <conlan.cesar@datadoghq.com>
Date: Tue, 29 Sep 2026 09:15:03 -0400
Subject: [PATCH] cli-plugins: add build-time system plugin directory

Signed-off-by: Conlan Cesar <conlan.cesar@datadoghq.com>
---
 cli-plugins/manager/manager.go         | 12 +++++++++++-
 cli-plugins/manager/manager_test.go    | 13 +++++++++++++
 cli-plugins/manager/manager_unix.go    |  3 ++-
 cli-plugins/manager/manager_windows.go |  3 ++-
 4 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/cli-plugins/manager/manager.go b/cli-plugins/manager/manager.go
index bf398533aa22..2d936b25ee6d 100644
--- a/cli-plugins/manager/manager.go
+++ b/cli-plugins/manager/manager.go
@@ -32,6 +32,12 @@ func (e errPluginNotFound) Error() string {
 	return "Error: No such CLI plugin: " + string(e)
 }
 
+// additionalSystemPluginDir is an optional system plugin directory that can be
+// set at build time using -ldflags -X.
+//
+// For example: -X github.com/docker/cli/cli-plugins/manager.additionalSystemPluginDir=/path/to/cli-plugins
+var additionalSystemPluginDir string
+
 // getPluginDirs returns the platform-specific locations to search for plugins
 // in order of preference.
 //
@@ -39,7 +45,8 @@ func (e errPluginNotFound) Error() string {
 //
 // 1. The "cli-plugins" directory inside the CLIs [config.Path] (usually "~/.docker/cli-plugins").
 // 2. Additional plugin directories as configured through [ConfigFile.CLIPluginsExtraDirs].
-// 3. Platform-specific defaultSystemPluginDirs.
+// 3. The additional system plugin directory configured at build time.
+// 4. Platform-specific defaultSystemPluginDirs.
 //
 // [ConfigFile.CLIPluginsExtraDirs]: https://pkg.go.dev/github.com/docker/cli@v26.1.4+incompatible/cli/config/configfile#ConfigFile.CLIPluginsExtraDirs
 func getPluginDirs(cfg *configfile.ConfigFile) []string {
@@ -50,6 +57,9 @@ func getPluginDirs(cfg *configfile.ConfigFile) []string {
 	}
 	pluginDir := filepath.Join(config.Dir(), "cli-plugins")
 	pluginDirs = append(pluginDirs, pluginDir)
+	if additionalSystemPluginDir != "" {
+		pluginDirs = append(pluginDirs, additionalSystemPluginDir)
+	}
 	pluginDirs = append(pluginDirs, defaultSystemPluginDirs...)
 	return pluginDirs
 }
diff --git a/cli-plugins/manager/manager_test.go b/cli-plugins/manager/manager_test.go
index 07df0f8ecccb..29bf0c261651 100644
--- a/cli-plugins/manager/manager_test.go
+++ b/cli-plugins/manager/manager_test.go
@@ -172,6 +172,12 @@ func TestGetPluginDirs(t *testing.T) {
 	cli := test.NewFakeCli(nil)
 
 	pluginDir := filepath.Join(config.Dir(), "cli-plugins")
+	originalAdditionalSystemPluginDir := additionalSystemPluginDir
+	additionalSystemPluginDir = ""
+	t.Cleanup(func() {
+		additionalSystemPluginDir = originalAdditionalSystemPluginDir
+	})
+
 	expected := append([]string{pluginDir}, defaultSystemPluginDirs...)
 
 	pluginDirs := getPluginDirs(cli.ConfigFile())
@@ -185,4 +191,11 @@ func TestGetPluginDirs(t *testing.T) {
 	})
 	pluginDirs = getPluginDirs(cli.ConfigFile())
 	assert.DeepEqual(t, expected, pluginDirs)
+
+	additionalSystemPluginDir = "qux"
+	expected = append([]string{}, extras...)
+	expected = append(expected, pluginDir, additionalSystemPluginDir)
+	expected = append(expected, defaultSystemPluginDirs...)
+	pluginDirs = getPluginDirs(cli.ConfigFile())
+	assert.DeepEqual(t, expected, pluginDirs)
 }
diff --git a/cli-plugins/manager/manager_unix.go b/cli-plugins/manager/manager_unix.go
index f546dc38496e..32c4d9ac52e4 100644
--- a/cli-plugins/manager/manager_unix.go
+++ b/cli-plugins/manager/manager_unix.go
@@ -9,7 +9,8 @@ package manager
 //
 // 1. The "cli-plugins" directory inside the CLIs config-directory (usually "~/.docker/cli-plugins").
 // 2. Additional plugin directories as configured through [ConfigFile.CLIPluginsExtraDirs].
-// 3. Platform-specific defaultSystemPluginDirs (as defined below).
+// 3. The additional system plugin directory configured at build time.
+// 4. Platform-specific defaultSystemPluginDirs (as defined below).
 //
 // [ConfigFile.CLIPluginsExtraDirs]: https://pkg.go.dev/github.com/docker/cli@v26.1.4+incompatible/cli/config/configfile#ConfigFile.CLIPluginsExtraDirs
 var defaultSystemPluginDirs = []string{
diff --git a/cli-plugins/manager/manager_windows.go b/cli-plugins/manager/manager_windows.go
index b42b713e9988..38d06d66e85e 100644
--- a/cli-plugins/manager/manager_windows.go
+++ b/cli-plugins/manager/manager_windows.go
@@ -12,7 +12,8 @@ import (
 //
 // 1. The "cli-plugins" directory inside the CLIs config-directory (usually "~/.docker/cli-plugins").
 // 2. Additional plugin directories as configured through [ConfigFile.CLIPluginsExtraDirs].
-// 3. Platform-specific defaultSystemPluginDirs (as defined below).
+// 3. The additional system plugin directory configured at build time.
+// 4. Platform-specific defaultSystemPluginDirs (as defined below).
 //
 // [ConfigFile.CLIPluginsExtraDirs]: https://pkg.go.dev/github.com/docker/cli@v26.1.4+incompatible/cli/config/configfile#ConfigFile.CLIPluginsExtraDirs
 var defaultSystemPluginDirs = []string{