cmd/docker: Add --cloud with configurable context resolution by vvoland · Pull Request #7343 · docker/cli

vvoland · 2026-10-01T16:30:36Z

Resolve it through the offload plugin by default, with a provider override in features.cloud in the Docker config.

Require the selected plugin to advertise CloudContextResolver in its metadata before showing the flag in help and completion or invoking its __resolve-context operation.

Resolve before client initialization without wrapping or re-executing Docker.

Forward --context to downstream plugins so they need not support --cloud or repeat provisioning.
Skip provisioning for help, version, and completion requests.

Summary

Release notes (optional)

A picture of a cute animal (not mandatory but encouraged)

codecov-commenter · 2026-10-01T16:33:37Z

Codecov Report

❌ Patch coverage is 89.47368% with 14 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
cmd/docker/cloud.go	87.03%	8 Missing and 6 partials ⚠️

📢 Thoughts on this report? Let us know!

docker-agent

Assessment: 🟡 NEEDS ATTENTION

Lower-confidence findings (not posted inline)

[medium] cmd/docker/docker.go:514 — os.Args mutated globally before tcmd.Initialize(), affecting processAliases (confidence: weak 52/100)

Plugins had no generic way to declare support for optional CLI contracts, so each one would need its own top-level metadata field. Add Features, keyed by feature name. Values are arbitrary JSON so a feature can carry more than a boolean. Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>

Callers that choose the context from configuration had to do it before Initialize. That meant loading the config file and context store themselves and handling --config a second time. WithContextResolver runs a callback inside Initialize after the config file and context store are loaded, but before telemetry and endpoint initialization. A non-empty result replaces the selected context, an empty result keeps normal selection, and an error aborts initialization. The API client and endpoint are resolved lazily, so they use the overridden context. Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>

Copilot

Copilot review overview

🟡 Changes recommended

Nested plugin help requests can unexpectedly provision a context or fail before displaying help.

Review effort: Balanced
Findings: 1

Open (1)

Skip cloud provisioning for nested plugin help commands · New

What changed in this PR

Adds configurable cloud-context resolution before Docker client initialization.

Changes:

Adds --cloud with plugin capability discovery and context provisioning.
Forwards resolved contexts to downstream plugins.
Adds resolver metadata, initialization hooks, and integration tests.

File	Description
`cmd/docker/docker.go`	Integrates cloud resolution into startup and help.
`cmd/docker/cloud.go`	Implements provider discovery, resolution, and argument rewriting.
`cmd/docker/cloud_test.go`	Tests cloud resolution and plugin forwarding.
`cli/command/cli.go`	Runs context resolvers during initialization.
`cli/command/cli_test.go`	Tests resolver initialization behavior.
`cli/command/cli_options.go`	Adds the context-resolver option.
`cli-plugins/metadata/metadata.go`	Adds plugin feature metadata.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

vvoland · 2026-10-01T17:18:38Z

+	if err != nil || cmd == rootCmd || pluginmanager.IsPluginCommand(cmd) {
+		// Plugin flags are opaque. Only recognize help immediately after the
+		// plugin name; deeper help is available through "docker help PLUGIN".
+		return len(args) > 1 && (args[1] == "--help" || args[1] == "-h" || args[1] == "--help=true"), nil


Yeah not sure theres a better way. We can't just scan the whole command line.. what about something like compose run web some-command--help ?

I don't think there's a good way around this due to the early context resolution that needs to happen before invoking the plugin. We could do a naive/full scan for --help and skip context resolution entirely perhaps?

-h might be too broad. For --help that would break for usages where for example you call a container with a cmd that involves --help (although thats probably a big edge case).

docker-agent

Assessment: 🟢 APPROVE

Lower-confidence findings (not posted inline)

[low] cmd/docker/docker.go:519 — WithContextResolver callback mutates os.Args as a global side-effect before returning (confidence: weak 52/100)
[low] cmd/docker/cloud.go:195 — cloudHelpRequest returns false for a single unknown subcommand, causing cloud provisioning for invalid commands (confidence: weak 52/100)

Dismissed security findings (review manually)

cmd/docker/cloud.go:135 — Plugin executable path from discovery used in exec.CommandContext with #nosec G204 suppression (verifier mitigation: consistent with the existing docker CLI plugin execution model; all plugins execute user-installed binaries with the same trust level; the extra cloudResolverFeature metadata check adds an additional validation step)

docker-agent

Assessment: 🟢 APPROVE

Lower-confidence findings (not posted inline)

[low] cmd/docker/cloud.go:221 — cloudPluginArgs shares *pflag.Flag pointers via AddFlagSet, so ParseAll sets Changed=true on the original root command's flags; notably --cloud is parsed but excluded from the rewritten os.Args, so it remains Changed=true on the root command's actual FlagSet after cobra re-parses (cobra never resets Changed, only sets it). In practice this is benign since no code between cloudPluginArgs and cmd.ExecuteContext reads root-flag Changed state — but it is a latent inconsistency. (confidence: 🟠 weak 52/100)

docker-agent

Assessment: 🟡 NEEDS ATTENTION

thaJeztah

LGTM

Copilot

Copilot review overview

🟡 Changes recommended

Invalid typed command flags can trigger cloud provisioning before Cobra rejects them.

Review effort: Balanced
Findings: 2

Open (2)

Validate flag values before provisioning · New
Skip cloud provisioning for nested plugin help commands

+	err = flags.ParseAll(remaining, func(flag *pflag.Flag, value string) error {
+		if flag.Name == "help" {
+			var err error
+			if help, err = strconv.ParseBool(value); err != nil {
+				return fmt.Errorf("invalid argument %q for \"--help\" flag: %w", value, err)
+			}
+		}
+		return nil


docker-agent

Assessment: 🟢 APPROVE

Resolve it through the offload plugin by default, with a provider override in features.cloud in the Docker config. Require the selected plugin to declare the cloud-context-resolver feature in its metadata before showing the flag in help and completion or invoking its __resolve-context operation. Resolve through WithContextResolver, after the config file and context store are loaded but before client initialization, without wrapping or re-executing Docker. Forward --context to downstream plugins so they need not support --cloud or repeat provisioning. Skip provisioning for help, version, and completion requests. Report unknown flags and missing flag values before provisioning, so a mistyped invocation fails without creating cloud resources or contacting the engine selected before resolution. Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>

Copilot

Copilot review overview

🟢 Approval recommended

The implementation satisfies the described resolver contract and includes broad coverage of success and failure paths.

Review effort: Balanced
Findings: 2

Open (2)

Validate flag values before provisioning
Skip cloud provisioning for nested plugin help commands

docker-agent

Assessment: 🟢 APPROVE

docker-agent

Assessment: 🟡 NEEDS ATTENTION

docker-agent · 2026-10-01T18:50:34Z

+		command.WithEnableGlobalTracerProvider(),
+		command.WithContextResolver(func(cli *command.DockerCli) (string, error) {
+			var err error
+			os.Args, err = processCloud(ctx, cli, cmd, args, os.Args)


[medium] os.Args is mutated inside the WithContextResolver callback; mutation survives if processCloud returns (modifiedArgs, error)

In Go, a multi-return assignment os.Args, err = processCloud(...) always assigns both return values simultaneously. If processCloud returns a partially-rewritten args slice and a non-nil error, the callback returns ("", err), causing Initialize to return that error — but os.Args is already overwritten with the mutated value. The caller in runDocker propagates the error upward and exits, leaving the process-wide os.Args permanently modified.

Because os.Args is a package-level global, any code or goroutine that reads it after the callback fires (including shell-completion paths or signal handlers) sees the rewritten form even when the --cloud operation ultimately failed.

The standard Go idiom is to keep the original value and only commit the change after success:

Suggested change

os.Args, err = processCloud(ctx, cli, cmd, args, os.Args)

newArgs, err := processCloud(ctx, cli, cmd, args, os.Args)

if err != nil {

return "", err

}

os.Args = newArgs

Confidence Score

🟡 moderate 75/100

Technically correct, but I think it's fine to ignore this one; if an error happens, it's a fail

thaJeztah

LGTM

vvoland added this to the 29.9.0 milestone Oct 1, 2026

thaJeztah reviewed Oct 1, 2026

View reviewed changes

Comment thread cli-plugins/metadata/metadata.go Outdated

vvoland commented Oct 1, 2026

View reviewed changes

Comment thread cmd/docker/cloud.go Outdated

docker-agent reviewed Oct 1, 2026

View reviewed changes

Comment thread cmd/docker/cloud.go

Comment thread cmd/docker/cloud.go Outdated

Comment thread cmd/docker/cloud.go Outdated

Comment thread cmd/docker/cloud.go

vvoland force-pushed the work-cloud branch from 623a0e9 to 2dc9d93 Compare October 1, 2026 16:57

vvoland added 2 commits October 1, 2026 19:04

vvoland force-pushed the work-cloud branch from 2dc9d93 to 88011ed Compare October 1, 2026 17:04

vvoland requested a review from docker-agent October 1, 2026 17:05

vvoland added kind/feature area/ux labels Oct 1, 2026

vvoland requested a balanced review from Copilot October 1, 2026 17:09

Copilot started reviewing on behalf of vvoland October 1, 2026 17:09 View session

Copilot AI reviewed Oct 1, 2026

View reviewed changes

docker-agent reviewed Oct 1, 2026

View reviewed changes

vvoland marked this pull request as ready for review October 1, 2026 17:19

docker-agent reviewed Oct 1, 2026

View reviewed changes

Comment thread cmd/docker/cloud.go Outdated

vvoland force-pushed the work-cloud branch from 88011ed to 53a9c4d Compare October 1, 2026 17:37

thaJeztah previously approved these changes Oct 1, 2026

View reviewed changes

vvoland requested review from docker-agent and a balanced review from Copilot October 1, 2026 17:53

Copilot started reviewing on behalf of vvoland October 1, 2026 17:53 View session

Copilot AI reviewed Oct 1, 2026

View reviewed changes

docker-agent reviewed Oct 1, 2026

View reviewed changes

Comment thread cmd/docker/cloud.go Outdated

Comment thread cmd/docker/cloud.go

Comment thread cmd/docker/cloud.go

vvoland dismissed thaJeztah’s stale review via fb1cc07 October 1, 2026 18:17

vvoland force-pushed the work-cloud branch from 53a9c4d to fb1cc07 Compare October 1, 2026 18:17

vvoland requested a balanced review from Copilot October 1, 2026 18:19

vvoland requested a review from docker-agent October 1, 2026 18:19

Copilot started reviewing on behalf of vvoland October 1, 2026 18:20 View session

Copilot AI reviewed Oct 1, 2026

View reviewed changes

docker-agent reviewed Oct 1, 2026

View reviewed changes

Comment thread cmd/docker/cloud.go

vvoland requested a review from thaJeztah October 1, 2026 18:42

docker-agent reviewed Oct 1, 2026

View reviewed changes

thaJeztah approved these changes Oct 1, 2026

View reviewed changes

thaJeztah merged commit cd7b908 into docker:master Oct 1, 2026
101 of 102 checks passed

-			os.Args, err = processCloud(ctx, cli, cmd, args, os.Args)
+			newArgs, err := processCloud(ctx, cli, cmd, args, os.Args)
+			if err != nil {
+				return "", err
+			}
+			os.Args = newArgs

Conversation

vvoland commented Oct 1, 2026

Summary

Release notes (optional)

A picture of a cute animal (not mandatory but encouraged)

Uh oh!

Uh oh!

codecov-commenter commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

docker-agent left a comment

Choose a reason for hiding this comment

Assessment: 🟡 NEEDS ATTENTION

Lower-confidence findings (not posted inline)

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

vvoland Oct 1, 2026

Choose a reason for hiding this comment

Uh oh!

nicksieger Oct 1, 2026

Choose a reason for hiding this comment

Uh oh!

vvoland Oct 1, 2026

Choose a reason for hiding this comment

Uh oh!

docker-agent left a comment

Choose a reason for hiding this comment

Assessment: 🟢 APPROVE

Lower-confidence findings (not posted inline)

Dismissed security findings (review manually)

Uh oh!

docker-agent left a comment

Choose a reason for hiding this comment

Assessment: 🟢 APPROVE

Lower-confidence findings (not posted inline)

Uh oh!

docker-agent left a comment

Choose a reason for hiding this comment

Assessment: 🟡 NEEDS ATTENTION

Uh oh!

Uh oh!

thaJeztah left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

docker-agent left a comment

Choose a reason for hiding this comment

Assessment: 🟢 APPROVE

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟢 Approval recommended

Uh oh!

docker-agent left a comment

Choose a reason for hiding this comment

Assessment: 🟢 APPROVE

Uh oh!

Uh oh!

docker-agent left a comment

Choose a reason for hiding this comment

Assessment: 🟡 NEEDS ATTENTION

Uh oh!

codecov-commenter commented Oct 1, 2026 •

edited

Loading