internal/ and daemon/internal/

Purpose

Per Go's internal/ rule, any package under an internal/ directory can only be imported from within the parent. Moby uses two such trees:

• internal/ — top-level helpers shared between cmd binaries and tests.
• daemon/internal/ — utilities and subsystems that the daemon uses but does not expose.

New utilities are expected to land here rather than in the legacy pkg/ tree.

Top-level internal/

Package	Role
internal/iterutil/	Tiny generic iterator helpers.
internal/sliceutil/	Generic slice helpers (Map, Filter, Dedup, etc.).
internal/namesgenerator/	The friendly random container name generator (adoring_curie).
internal/test/	Build-tag testing infrastructure.
internal/testutil/	Daemon test harness (start/stop daemons, environment predicates, request helpers).
internal/tools/	tools.go for go install-able dev tools (linter, formatter, etc.).

daemon/internal/

This is the bulk of the modern utility code. Notable packages:

Package	Role
daemon/internal/builder-next/	BuildKit integration. See Builder.
daemon/internal/distribution/	Legacy registry client. See Distribution.
daemon/internal/image/	Legacy image store.
daemon/internal/layer/	Legacy layer abstraction.
daemon/internal/libcontainerd/	Containerd client wrapper. See Container runtime.
daemon/internal/refstore/	Image reference (tag) store.
daemon/internal/restartmanager/	Restart policy state machine.
daemon/internal/metrics/	Prometheus metrics exposed by the daemon.
daemon/internal/quota/	XFS / project quota helpers used by overlay2.
daemon/internal/idtools/	UID/GID remapping for userns containers.
daemon/internal/filters/	The shared filter expression evaluator used across endpoints.
daemon/internal/runconfig/	Defaults, validation, and merging for container run config.
daemon/internal/stream/, stdcopymux/	Multiplexed stdout/stderr framing for attach/exec.
daemon/internal/streamformatter/	The JSON-line formatter that turns progress/events into the wire stream.
daemon/internal/stringid/	Container/image ID generators.
daemon/internal/system/	Per-OS syscall wrappers used across the daemon.
daemon/internal/usergroup/, unshare/	User/namespace helpers.
daemon/internal/nri/	Containerd NRI plugin wiring.
daemon/internal/plugin/	Containerd-backed plugin executor.
daemon/internal/rootless/	Rootless mode helpers.
daemon/internal/multierror/	Multi-error aggregation.
daemon/internal/otelutil/	OpenTelemetry helpers (baggage, tracer setup).
daemon/internal/versions/	API-version comparisons and constants.
daemon/internal/platform/	OCI platform matching helpers.
daemon/internal/cleanups/	RAII-style cleanup stacks for setup/teardown.
daemon/internal/lazyregexp/	Lazy-compiled regex used in hot paths.
daemon/internal/mod/	Embedded build info (vcs, version, commit hash).
daemon/internal/netipstringer/, netiputil/	net/netip helpers.

The full list is much longer; see ls daemon/internal/.

Why this exists

Previously most of these packages lived under the public pkg/ tree. Several were moved here to clarify that they are not stable API. The boundary also lets the daemon refactor freely without breaking external consumers.

See also

• pkg/ for the legacy public utilities.
• The subsystems they back, listed under Systems.