Plugins

Purpose

Plugins are out-of-process extensions to the daemon: log drivers, network drivers, IPAM drivers, volume drivers, authorization plugins, and graph drivers. Two flavors coexist:

• Legacy ("v1") plugins — installed by the operator (an HTTP socket on disk). Code: pkg/plugins/.
• Managed ("v2") plugins — distributed as OCI images, lifecycle managed by the daemon (docker plugin install). Code: daemon/pkg/plugin/.

Every extension point uses the same protocol: JSON over a Unix socket, with a registration handshake (/Plugin.Activate) that returns the list of capabilities the plugin implements.

Plugin manager (v2)

daemon/pkg/plugin/manager.go (and the rest of the package) is the v2 manager. It:

1. Pulls a plugin OCI image (reusing the distribution code path).
2. Unpacks the rootfs into the data root.
3. Reads config.json and prepares mounts, devices, and runtime options.
4. Launches the plugin as a containerd task via the Container runtime executor in daemon/internal/plugin/executor/containerd/.
5. Tracks lifecycle (enable, disable, upgrade, remove) and exposes RPC clients to the rest of the daemon.

Plugin store

Daemon.PluginStore (the legacy store, TODO: remove per the field comment in daemon/daemon.go) and pluginManager together implement pkg/plugingetter.PluginGetter, which is how every other subsystem looks up a plugin by name and capability:

p, err := pluginGetter.Get(name, "VolumeDriver", plugingetter.Lookup)
client := p.Client()
client.Call("VolumeDriver.Mount", req, &resp)

The pkg/plugins/client.go helper takes care of the JSON-RPC framing.

Capabilities

Capability	Used by
LogDriver	daemon/logger/
VolumeDriver	daemon/volume/drivers/
NetworkDriver	daemon/libnetwork/drivers/remote/
IpamDriver	daemon/libnetwork/ipams/remote/
Authz	pkg/authorization/
GraphDriver	daemon/graphdriver/ (legacy)
SecretProvider	swarm secrets pipeline

Authorization plugins

When --authorization-plugin=name is set, the daemon runs every API request through the plugin chain in pkg/authorization/. Each plugin gets a pre-request and post-response callback and can deny the request. The middleware lives in daemon/server/middleware/ and is wired up in daemon/command.

Lifecycle

graph LR
  Install[plugin install] --> Pull[Pull OCI image]
  Pull --> Init[Manager.init: unpack + config]
  Init --> Enabled[Enabled]
  Enabled --> Disabled
  Disabled --> Enabled
  Disabled --> Removed
  Enabled --> Upgrade[plugin upgrade]
  Upgrade --> Enabled

Where state lives

• v2 plugins: <data-root>/plugins/.
• v1 plugins: /run/docker/plugins/<name>.sock (Unix socket on the host) plus optional spec under /etc/docker/plugins/.

Entry points for modification

• New plugin capability: define a Go interface, add a getter shim under the consuming subsystem, add a JSON-RPC method, document the capability in docs/extend/.
• v2 plugin lifecycle changes: see daemon/pkg/plugin/manager_*.go.
• Authorization changes: pkg/authorization/.

See also

• Logging, Volumes, Networking (libnetwork) — the consumers.
• daemon/server/router/plugin/ for the HTTP API.