Tooling

The build, lint, and CI tools that drive day-to-day development.

Makefile

Makefile at the repo root is the entry point. It mostly invokes docker buildx bake (docker-bake.hcl) or runs hack/make.sh inside the docker-dev container. Highlights:

Target	What it does
make binary	Statically linked Linux binaries via buildx bake.
make dynbinary	Dynamically linked Linux binaries.
make cross	Cross-compile binaries for non-Linux platforms.
make win	Windows binary.
make shell	Interactive shell inside the dev container.
make dev	Build + restart daemon loop (hack/dev.sh).
make run	Build + run dockerd in a privileged container.
make test-unit	Unit tests via hack/test/unit.
make test-integration	API + (legacy) integration-cli suites.
make validate	DCO + gofmt + vendor + swagger + golangci-lint + license checks.
make swagger-gen	Regenerate API types from api/swagger.yaml.
make swagger-docs	Local HTML preview of the API docs.

The Dockerfile is a multi-stage build that produces the dev image, the binary stage, and the final container image stages used in releases.

hack/

hack/ is the catch-all for build, test, and validation scripts.

Path	Purpose
hack/make.sh	Master entry point (binaries, tests, install).
hack/make/*	Individual phases consumed by hack/make.sh.
hack/test/unit	Unit-test runner with race detection and coverage.
hack/test/integration	Integration-test runner.
hack/validate/	Scripts for individual make validate-* targets.
hack/dockerfiles/	Auxiliary Dockerfiles (e.g. file generators).
hack/dev.sh	Watch-and-restart helper used by make dev.
hack/vendor.sh	Vendor sync helper.

Linting

.golangci.yml (16K config) enables errcheck, revive, staticcheck, unused, gocritic, gosec, whitespace, and a long list of other linters with project-specific exclusions. Run with:

make validate-golangci-lint

CI

Workflows live in .github/workflows/:

Workflow	Trigger / role
ci.yml	PR & push: build + unit + integration on multiple distros.
arm64.yml	Build + test on ARM64.
windows-2022.yml, windows-2025.yml	Windows builds and tests.
bin-image.yml	Container image builds for engine releases.
buildkit.yml	Validates BuildKit integration on each push.
validate-pr.yml, validate-milestone.yml	PR-only metadata checks.
labeler.yml	Auto-labels PRs by changed paths.
codeql.yml	GitHub CodeQL security analysis.
zizmor.yml	Workflow lint (zizmor).
vm.yml, test.yml	Auxiliary build/test pipelines.

CI uses Codecov (config in .codecov.yml) and uploads coverage from unit and integration runs.

Editor support

The repo is plain Go, so any editor with gopls works. There is a .devcontainer/ configuration for VS Code Remote Containers that gives you the same toolchain as make shell.

Vendoring

Dependencies are committed under vendor/. Refresh with make vendor; CI checks consistency with make validate-vendor.