diff --git a/cli/context/store/metadatastore.go b/cli/context/store/metadatastore.go
index 6b8975a4ac9c..e8b25675b3fc 100644
--- a/cli/context/store/metadatastore.go
+++ b/cli/context/store/metadatastore.go
@@ -12,7 +12,7 @@ import (
 	"sort"
 
 	"github.com/docker/docker/errdefs"
-	"github.com/docker/docker/pkg/ioutils"
+	"github.com/docker/docker/pkg/atomicwriter"
 	"github.com/fvbommel/sortorder"
 	"github.com/pkg/errors"
 )
@@ -40,7 +40,7 @@ func (s *metadataStore) createOrUpdate(meta Metadata) error {
 	if err != nil {
 		return err
 	}
-	return ioutils.AtomicWriteFile(filepath.Join(contextDir, metaFile), bytes, 0o644)
+	return atomicwriter.WriteFile(filepath.Join(contextDir, metaFile), bytes, 0o644)
 }
 
 func parseTypedOrMap(payload []byte, getter TypeGetter) (any, error) {
diff --git a/cli/context/store/tlsstore.go b/cli/context/store/tlsstore.go
index ffbbde7c0dbc..3cbfe627326d 100644
--- a/cli/context/store/tlsstore.go
+++ b/cli/context/store/tlsstore.go
@@ -5,7 +5,7 @@ import (
 	"path/filepath"
 
 	"github.com/docker/docker/errdefs"
-	"github.com/docker/docker/pkg/ioutils"
+	"github.com/docker/docker/pkg/atomicwriter"
 	"github.com/pkg/errors"
 )
 
@@ -32,7 +32,7 @@ func (s *tlsStore) createOrUpdate(name, endpointName, filename string, data []by
 	if err := os.MkdirAll(endpointDir, 0o700); err != nil {
 		return err
 	}
-	return ioutils.AtomicWriteFile(filepath.Join(endpointDir, filename), data, 0o600)
+	return atomicwriter.WriteFile(filepath.Join(endpointDir, filename), data, 0o600)
 }
 
 func (s *tlsStore) getData(name, endpointName, filename string) ([]byte, error) {
diff --git a/vendor.mod b/vendor.mod
index 26c89a6f8f95..24fa088406ff 100644
--- a/vendor.mod
+++ b/vendor.mod
@@ -13,7 +13,7 @@ require (
 	github.com/distribution/reference v0.6.0
 	github.com/docker/cli-docs-tool v0.8.0
 	github.com/docker/distribution v2.8.3+incompatible
-	github.com/docker/docker v27.0.2-0.20250101151200-6f6c3b921180+incompatible // master (v-next)
+	github.com/docker/docker v27.0.2-0.20250108165300-50212d215ba7+incompatible // master (v-next)
 	github.com/docker/docker-credential-helpers v0.8.2
 	github.com/docker/go-connections v0.5.0
 	github.com/docker/go-units v0.5.0
@@ -25,7 +25,7 @@ require (
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
 	github.com/mattn/go-runewidth v0.0.15
 	github.com/moby/patternmatcher v0.6.0
-	github.com/moby/swarmkit/v2 v2.0.0-20241017191044-e8ecf83ee08e
+	github.com/moby/swarmkit/v2 v2.0.0-20250103191802-8c1959736554
 	github.com/moby/sys/capability v0.4.0
 	github.com/moby/sys/sequential v0.6.0
 	github.com/moby/sys/signal v0.7.1
diff --git a/vendor.sum b/vendor.sum
index 2522535bb751..d6150b50bab4 100644
--- a/vendor.sum
+++ b/vendor.sum
@@ -51,8 +51,8 @@ github.com/docker/cli-docs-tool v0.8.0/go.mod h1:8TQQ3E7mOXoYUs811LiPdUnAhXrcVsB
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v27.0.2-0.20250101151200-6f6c3b921180+incompatible h1:R8zzddOp6gD0KL9SGDvRtbGiWZ8fxqzzu2v6t+whvdc=
-github.com/docker/docker v27.0.2-0.20250101151200-6f6c3b921180+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v27.0.2-0.20250108165300-50212d215ba7+incompatible h1:d2wmwnGBWKKlr7JBS6SD/1O3DRvZATLQg4tbgk0rzvo=
+github.com/docker/docker v27.0.2-0.20250108165300-50212d215ba7+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
 github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
 github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c h1:lzqkGL9b3znc+ZUgi7FlLnqjQhcXxkNM/quxIjBVMD0=
@@ -166,8 +166,8 @@ github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3N
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
 github.com/moby/patternmatcher v0.6.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
-github.com/moby/swarmkit/v2 v2.0.0-20241017191044-e8ecf83ee08e h1:1yC8fRqStY6NirU/swI74fsrHvZVMbtxsHcvl8YpzDg=
-github.com/moby/swarmkit/v2 v2.0.0-20241017191044-e8ecf83ee08e/go.mod h1:mTTGIAz/59OGZR5Qe+QByIe3Nxc+sSuJkrsStFhr6Lg=
+github.com/moby/swarmkit/v2 v2.0.0-20250103191802-8c1959736554 h1:DMHJbgyNZWyrPKYjCYt2IxEO7KA0eSd4fo6KQsv2W84=
+github.com/moby/swarmkit/v2 v2.0.0-20250103191802-8c1959736554/go.mod h1:mTTGIAz/59OGZR5Qe+QByIe3Nxc+sSuJkrsStFhr6Lg=
 github.com/moby/sys/capability v0.4.0 h1:4D4mI6KlNtWMCM1Z/K0i7RV1FkX+DBDHKVJpCndZoHk=
 github.com/moby/sys/capability v0.4.0/go.mod h1:4g9IK291rVkms3LKCDOoYlnV8xKwoDTpIrNEE35Wq0I=
 github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
diff --git a/vendor/github.com/docker/docker/builder/remotecontext/urlutil/urlutil.go b/vendor/github.com/docker/docker/builder/remotecontext/urlutil/urlutil.go
index e8459cc820f2..34c603cbc335 100644
--- a/vendor/github.com/docker/docker/builder/remotecontext/urlutil/urlutil.go
+++ b/vendor/github.com/docker/docker/builder/remotecontext/urlutil/urlutil.go
@@ -6,13 +6,14 @@
 package urlutil // import "github.com/docker/docker/builder/remotecontext/urlutil"
 
 import (
-	"regexp"
 	"strings"
+
+	"github.com/docker/docker/internal/lazyregexp"
 )
 
 // urlPathWithFragmentSuffix matches fragments to use as Git reference and build
 // context from the Git repository. See IsGitURL for details.
-var urlPathWithFragmentSuffix = regexp.MustCompile(`\.git(?:#.+)?$`)
+var urlPathWithFragmentSuffix = lazyregexp.New(`\.git(?:#.+)?$`)
 
 // IsURL returns true if the provided str is an HTTP(S) URL by checking if it
 // has a http:// or https:// scheme. No validation is performed to verify if the
diff --git a/vendor/github.com/docker/docker/client/utils.go b/vendor/github.com/docker/docker/client/utils.go
index 0fea7c820689..8cbd671792db 100644
--- a/vendor/github.com/docker/docker/client/utils.go
+++ b/vendor/github.com/docker/docker/client/utils.go
@@ -4,14 +4,14 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/url"
-	"regexp"
 
 	"github.com/docker/docker/api/types/filters"
 	"github.com/docker/docker/errdefs"
+	"github.com/docker/docker/internal/lazyregexp"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 )
 
-var headerRegexp = regexp.MustCompile(`\ADocker/.+\s\((.+)\)\z`)
+var headerRegexp = lazyregexp.New(`\ADocker/.+\s\((.+)\)\z`)
 
 // getDockerOS returns the operating system based on the server header from the daemon.
 func getDockerOS(serverHeader string) string {
diff --git a/vendor/github.com/docker/docker/internal/lazyregexp/lazyregexp.go b/vendor/github.com/docker/docker/internal/lazyregexp/lazyregexp.go
new file mode 100644
index 000000000000..6334edb60dca
--- /dev/null
+++ b/vendor/github.com/docker/docker/internal/lazyregexp/lazyregexp.go
@@ -0,0 +1,90 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Code below was largely copied from golang.org/x/mod@v0.22;
+// https://github.com/golang/mod/blob/v0.22.0/internal/lazyregexp/lazyre.go
+// with some additional methods added.
+
+// Package lazyregexp is a thin wrapper over regexp, allowing the use of global
+// regexp variables without forcing them to be compiled at init.
+package lazyregexp
+
+import (
+	"os"
+	"regexp"
+	"strings"
+	"sync"
+)
+
+// Regexp is a wrapper around [regexp.Regexp], where the underlying regexp will be
+// compiled the first time it is needed.
+type Regexp struct {
+	str  string
+	once sync.Once
+	rx   *regexp.Regexp
+}
+
+func (r *Regexp) re() *regexp.Regexp {
+	r.once.Do(r.build)
+	return r.rx
+}
+
+func (r *Regexp) build() {
+	r.rx = regexp.MustCompile(r.str)
+	r.str = ""
+}
+
+func (r *Regexp) FindSubmatch(s []byte) [][]byte {
+	return r.re().FindSubmatch(s)
+}
+
+func (r *Regexp) FindAllStringSubmatch(s string, n int) [][]string {
+	return r.re().FindAllStringSubmatch(s, n)
+}
+
+func (r *Regexp) FindStringSubmatch(s string) []string {
+	return r.re().FindStringSubmatch(s)
+}
+
+func (r *Regexp) FindStringSubmatchIndex(s string) []int {
+	return r.re().FindStringSubmatchIndex(s)
+}
+
+func (r *Regexp) ReplaceAllString(src, repl string) string {
+	return r.re().ReplaceAllString(src, repl)
+}
+
+func (r *Regexp) FindString(s string) string {
+	return r.re().FindString(s)
+}
+
+func (r *Regexp) FindAllString(s string, n int) []string {
+	return r.re().FindAllString(s, n)
+}
+
+func (r *Regexp) MatchString(s string) bool {
+	return r.re().MatchString(s)
+}
+
+func (r *Regexp) ReplaceAllStringFunc(src string, repl func(string) string) string {
+	return r.re().ReplaceAllStringFunc(src, repl)
+}
+
+func (r *Regexp) SubexpNames() []string {
+	return r.re().SubexpNames()
+}
+
+var inTest = len(os.Args) > 0 && strings.HasSuffix(strings.TrimSuffix(os.Args[0], ".exe"), ".test")
+
+// New creates a new lazy regexp, delaying the compiling work until it is first
+// needed. If the code is being run as part of tests, the regexp compiling will
+// happen immediately.
+func New(str string) *Regexp {
+	lr := &Regexp{str: str}
+	if inTest {
+		// In tests, always compile the regexps early.
+		lr.re()
+	}
+	return lr
+}
diff --git a/vendor/github.com/docker/docker/pkg/ioutils/fswriters.go b/vendor/github.com/docker/docker/pkg/atomicwriter/atomicwriter.go
similarity index 74%
rename from vendor/github.com/docker/docker/pkg/ioutils/fswriters.go
rename to vendor/github.com/docker/docker/pkg/atomicwriter/atomicwriter.go
index 05da97b0e416..cbbe835bb128 100644
--- a/vendor/github.com/docker/docker/pkg/ioutils/fswriters.go
+++ b/vendor/github.com/docker/docker/pkg/atomicwriter/atomicwriter.go
@@ -1,4 +1,4 @@
-package ioutils // import "github.com/docker/docker/pkg/ioutils"
+package atomicwriter
 
 import (
 	"io"
@@ -6,11 +6,11 @@ import (
 	"path/filepath"
 )
 
-// NewAtomicFileWriter returns WriteCloser so that writing to it writes to a
+// New returns a WriteCloser so that writing to it writes to a
 // temporary file and closing it atomically changes the temporary file to
 // destination path. Writing and closing concurrently is not allowed.
 // NOTE: umask is not considered for the file's permissions.
-func NewAtomicFileWriter(filename string, perm os.FileMode) (io.WriteCloser, error) {
+func New(filename string, perm os.FileMode) (io.WriteCloser, error) {
 	f, err := os.CreateTemp(filepath.Dir(filename), ".tmp-"+filepath.Base(filename))
 	if err != nil {
 		return nil, err
@@ -27,10 +27,10 @@ func NewAtomicFileWriter(filename string, perm os.FileMode) (io.WriteCloser, err
 	}, nil
 }
 
-// AtomicWriteFile atomically writes data to a file named by filename and with the specified permission bits.
+// WriteFile atomically writes data to a file named by filename and with the specified permission bits.
 // NOTE: umask is not considered for the file's permissions.
-func AtomicWriteFile(filename string, data []byte, perm os.FileMode) error {
-	f, err := NewAtomicFileWriter(filename, perm)
+func WriteFile(filename string, data []byte, perm os.FileMode) error {
+	f, err := New(filename, perm)
 	if err != nil {
 		return err
 	}
@@ -82,32 +82,32 @@ func (w *atomicFileWriter) Close() (retErr error) {
 	return nil
 }
 
-// AtomicWriteSet is used to atomically write a set
+// WriteSet is used to atomically write a set
 // of files and ensure they are visible at the same time.
 // Must be committed to a new directory.
-type AtomicWriteSet struct {
+type WriteSet struct {
 	root string
 }
 
-// NewAtomicWriteSet creates a new atomic write set to
+// NewWriteSet creates a new atomic write set to
 // atomically create a set of files. The given directory
 // is used as the base directory for storing files before
 // commit. If no temporary directory is given the system
 // default is used.
-func NewAtomicWriteSet(tmpDir string) (*AtomicWriteSet, error) {
+func NewWriteSet(tmpDir string) (*WriteSet, error) {
 	td, err := os.MkdirTemp(tmpDir, "write-set-")
 	if err != nil {
 		return nil, err
 	}
 
-	return &AtomicWriteSet{
+	return &WriteSet{
 		root: td,
 	}, nil
 }
 
 // WriteFile writes a file to the set, guaranteeing the file
 // has been synced.
-func (ws *AtomicWriteSet) WriteFile(filename string, data []byte, perm os.FileMode) error {
+func (ws *WriteSet) WriteFile(filename string, data []byte, perm os.FileMode) error {
 	f, err := ws.FileWriter(filename, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, perm)
 	if err != nil {
 		return err
@@ -136,7 +136,7 @@ func (w syncFileCloser) Close() error {
 
 // FileWriter opens a file writer inside the set. The file
 // should be synced and closed before calling commit.
-func (ws *AtomicWriteSet) FileWriter(name string, flag int, perm os.FileMode) (io.WriteCloser, error) {
+func (ws *WriteSet) FileWriter(name string, flag int, perm os.FileMode) (io.WriteCloser, error) {
 	f, err := os.OpenFile(filepath.Join(ws.root, name), flag, perm)
 	if err != nil {
 		return nil, err
@@ -146,18 +146,18 @@ func (ws *AtomicWriteSet) FileWriter(name string, flag int, perm os.FileMode) (i
 
 // Cancel cancels the set and removes all temporary data
 // created in the set.
-func (ws *AtomicWriteSet) Cancel() error {
+func (ws *WriteSet) Cancel() error {
 	return os.RemoveAll(ws.root)
 }
 
 // Commit moves all created files to the target directory. The
 // target directory must not exist and the parent of the target
 // directory must exist.
-func (ws *AtomicWriteSet) Commit(target string) error {
+func (ws *WriteSet) Commit(target string) error {
 	return os.Rename(ws.root, target)
 }
 
 // String returns the location the set is writing to.
-func (ws *AtomicWriteSet) String() string {
+func (ws *WriteSet) String() string {
 	return ws.root
 }
diff --git a/vendor/github.com/docker/docker/pkg/idtools/idtools.go b/vendor/github.com/docker/docker/pkg/idtools/idtools.go
index 82b325a2b72b..d2fbd943a656 100644
--- a/vendor/github.com/docker/docker/pkg/idtools/idtools.go
+++ b/vendor/github.com/docker/docker/pkg/idtools/idtools.go
@@ -1,11 +1,8 @@
-package idtools // import "github.com/docker/docker/pkg/idtools"
+package idtools
 
 import (
-	"bufio"
 	"fmt"
 	"os"
-	"strconv"
-	"strings"
 )
 
 // IDMap contains a single entry for user namespace range remapping. An array
@@ -17,22 +14,6 @@ type IDMap struct {
 	Size        int `json:"size"`
 }
 
-type subIDRange struct {
-	Start  int
-	Length int
-}
-
-type subIDRanges []subIDRange
-
-func (e subIDRanges) Len() int           { return len(e) }
-func (e subIDRanges) Swap(i, j int)      { e[i], e[j] = e[j], e[i] }
-func (e subIDRanges) Less(i, j int) bool { return e[i].Start < e[j].Start }
-
-const (
-	subuidFileName = "/etc/subuid"
-	subgidFileName = "/etc/subgid"
-)
-
 // MkdirAllAndChown creates a directory (include any along the path) and then modifies
 // ownership to the requested uid/gid.  If the directory already exists, this
 // function will still change ownership and permissions.
@@ -162,67 +143,6 @@ func (i IdentityMapping) Empty() bool {
 	return len(i.UIDMaps) == 0 && len(i.GIDMaps) == 0
 }
 
-func createIDMap(subidRanges subIDRanges) []IDMap {
-	idMap := []IDMap{}
-
-	containerID := 0
-	for _, idrange := range subidRanges {
-		idMap = append(idMap, IDMap{
-			ContainerID: containerID,
-			HostID:      idrange.Start,
-			Size:        idrange.Length,
-		})
-		containerID = containerID + idrange.Length
-	}
-	return idMap
-}
-
-func parseSubuid(username string) (subIDRanges, error) {
-	return parseSubidFile(subuidFileName, username)
-}
-
-func parseSubgid(username string) (subIDRanges, error) {
-	return parseSubidFile(subgidFileName, username)
-}
-
-// parseSubidFile will read the appropriate file (/etc/subuid or /etc/subgid)
-// and return all found subIDRanges for a specified username. If the special value
-// "ALL" is supplied for username, then all subIDRanges in the file will be returned
-func parseSubidFile(path, username string) (subIDRanges, error) {
-	var rangeList subIDRanges
-
-	subidFile, err := os.Open(path)
-	if err != nil {
-		return rangeList, err
-	}
-	defer subidFile.Close()
-
-	s := bufio.NewScanner(subidFile)
-	for s.Scan() {
-		text := strings.TrimSpace(s.Text())
-		if text == "" || strings.HasPrefix(text, "#") {
-			continue
-		}
-		parts := strings.Split(text, ":")
-		if len(parts) != 3 {
-			return rangeList, fmt.Errorf("Cannot parse subuid/gid information: Format not correct for %s file", path)
-		}
-		if parts[0] == username || username == "ALL" {
-			startid, err := strconv.Atoi(parts[1])
-			if err != nil {
-				return rangeList, fmt.Errorf("String to int conversion failed during subuid/gid parsing of %s: %v", path, err)
-			}
-			length, err := strconv.Atoi(parts[2])
-			if err != nil {
-				return rangeList, fmt.Errorf("String to int conversion failed during subuid/gid parsing of %s: %v", path, err)
-			}
-			rangeList = append(rangeList, subIDRange{startid, length})
-		}
-	}
-
-	return rangeList, s.Err()
-}
-
 // CurrentIdentity returns the identity of the current process
 func CurrentIdentity() Identity {
 	return Identity{UID: os.Getuid(), GID: os.Getegid()}
diff --git a/vendor/github.com/docker/docker/pkg/idtools/idtools_unix.go b/vendor/github.com/docker/docker/pkg/idtools/idtools_unix.go
index cd621bdcc2ae..1f11fe474014 100644
--- a/vendor/github.com/docker/docker/pkg/idtools/idtools_unix.go
+++ b/vendor/github.com/docker/docker/pkg/idtools/idtools_unix.go
@@ -1,13 +1,10 @@
 //go:build !windows
 
-package idtools // import "github.com/docker/docker/pkg/idtools"
+package idtools
 
 import (
-	"bytes"
 	"fmt"
-	"io"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"strconv"
 	"syscall"
@@ -72,127 +69,25 @@ func mkdirAs(path string, mode os.FileMode, owner Identity, mkAll, chownExisting
 	return nil
 }
 
-// LookupUser uses traditional local system files lookup (from libcontainer/user) on a username,
-// followed by a call to `getent` for supporting host configured non-files passwd and group dbs
+// LookupUser uses traditional local system files lookup (from libcontainer/user) on a username
+//
+// Deprecated: use [user.LookupUser] instead
 func LookupUser(name string) (user.User, error) {
-	// first try a local system files lookup using existing capabilities
-	usr, err := user.LookupUser(name)
-	if err == nil {
-		return usr, nil
-	}
-	// local files lookup failed; attempt to call `getent` to query configured passwd dbs
-	usr, err = getentUser(name)
-	if err != nil {
-		return user.User{}, err
-	}
-	return usr, nil
+	return user.LookupUser(name)
 }
 
-// LookupUID uses traditional local system files lookup (from libcontainer/user) on a uid,
-// followed by a call to `getent` for supporting host configured non-files passwd and group dbs
+// LookupUID uses traditional local system files lookup (from libcontainer/user) on a uid
+//
+// Deprecated: use [user.LookupUid] instead
 func LookupUID(uid int) (user.User, error) {
-	// first try a local system files lookup using existing capabilities
-	usr, err := user.LookupUid(uid)
-	if err == nil {
-		return usr, nil
-	}
-	// local files lookup failed; attempt to call `getent` to query configured passwd dbs
-	return getentUser(strconv.Itoa(uid))
-}
-
-func getentUser(name string) (user.User, error) {
-	reader, err := callGetent("passwd", name)
-	if err != nil {
-		return user.User{}, err
-	}
-	users, err := user.ParsePasswd(reader)
-	if err != nil {
-		return user.User{}, err
-	}
-	if len(users) == 0 {
-		return user.User{}, fmt.Errorf("getent failed to find passwd entry for %q", name)
-	}
-	return users[0], nil
+	return user.LookupUid(uid)
 }
 
 // LookupGroup uses traditional local system files lookup (from libcontainer/user) on a group name,
-// followed by a call to `getent` for supporting host configured non-files passwd and group dbs
+//
+// Deprecated: use [user.LookupGroup] instead
 func LookupGroup(name string) (user.Group, error) {
-	// first try a local system files lookup using existing capabilities
-	group, err := user.LookupGroup(name)
-	if err == nil {
-		return group, nil
-	}
-	// local files lookup failed; attempt to call `getent` to query configured group dbs
-	return getentGroup(name)
-}
-
-// LookupGID uses traditional local system files lookup (from libcontainer/user) on a group ID,
-// followed by a call to `getent` for supporting host configured non-files passwd and group dbs
-func LookupGID(gid int) (user.Group, error) {
-	// first try a local system files lookup using existing capabilities
-	group, err := user.LookupGid(gid)
-	if err == nil {
-		return group, nil
-	}
-	// local files lookup failed; attempt to call `getent` to query configured group dbs
-	return getentGroup(strconv.Itoa(gid))
-}
-
-func getentGroup(name string) (user.Group, error) {
-	reader, err := callGetent("group", name)
-	if err != nil {
-		return user.Group{}, err
-	}
-	groups, err := user.ParseGroup(reader)
-	if err != nil {
-		return user.Group{}, err
-	}
-	if len(groups) == 0 {
-		return user.Group{}, fmt.Errorf("getent failed to find groups entry for %q", name)
-	}
-	return groups[0], nil
-}
-
-func callGetent(database, key string) (io.Reader, error) {
-	getentCmd, err := resolveBinary("getent")
-	// if no `getent` command within the execution environment, can't do anything else
-	if err != nil {
-		return nil, fmt.Errorf("unable to find getent command: %w", err)
-	}
-	command := exec.Command(getentCmd, database, key)
-	// we run getent within container filesystem, but without /dev so /dev/null is not available for exec to mock stdin
-	command.Stdin = io.NopCloser(bytes.NewReader(nil))
-	out, err := command.CombinedOutput()
-	if err != nil {
-		exitCode, errC := getExitCode(err)
-		if errC != nil {
-			return nil, err
-		}
-		switch exitCode {
-		case 1:
-			return nil, fmt.Errorf("getent reported invalid parameters/database unknown")
-		case 2:
-			return nil, fmt.Errorf("getent unable to find entry %q in %s database", key, database)
-		case 3:
-			return nil, fmt.Errorf("getent database doesn't support enumeration")
-		default:
-			return nil, err
-		}
-	}
-	return bytes.NewReader(out), nil
-}
-
-// getExitCode returns the ExitStatus of the specified error if its type is
-// exec.ExitError, returns 0 and an error otherwise.
-func getExitCode(err error) (int, error) {
-	exitCode := 0
-	if exiterr, ok := err.(*exec.ExitError); ok {
-		if procExit, ok := exiterr.Sys().(syscall.WaitStatus); ok {
-			return procExit.ExitStatus(), nil
-		}
-	}
-	return exitCode, fmt.Errorf("failed to get exit code")
+	return user.LookupGroup(name)
 }
 
 // setPermissions performs a chown/chmod only if the uid/gid don't match what's requested
@@ -223,16 +118,17 @@ func setPermissions(p string, mode os.FileMode, owner Identity, stat os.FileInfo
 // using the data from /etc/sub{uid,gid} ranges, creates the
 // proper uid and gid remapping ranges for that user/group pair
 func LoadIdentityMapping(name string) (IdentityMapping, error) {
-	usr, err := LookupUser(name)
+	// TODO: Consider adding support for calling out to "getent"
+	usr, err := user.LookupUser(name)
 	if err != nil {
 		return IdentityMapping{}, fmt.Errorf("could not get user for username %s: %v", name, err)
 	}
 
-	subuidRanges, err := lookupSubUIDRanges(usr)
+	subuidRanges, err := lookupSubRangesFile("/etc/subuid", usr)
 	if err != nil {
 		return IdentityMapping{}, err
 	}
-	subgidRanges, err := lookupSubGIDRanges(usr)
+	subgidRanges, err := lookupSubRangesFile("/etc/subgid", usr)
 	if err != nil {
 		return IdentityMapping{}, err
 	}
@@ -243,36 +139,28 @@ func LoadIdentityMapping(name string) (IdentityMapping, error) {
 	}, nil
 }
 
-func lookupSubUIDRanges(usr user.User) ([]IDMap, error) {
-	rangeList, err := parseSubuid(strconv.Itoa(usr.Uid))
+func lookupSubRangesFile(path string, usr user.User) ([]IDMap, error) {
+	uidstr := strconv.Itoa(usr.Uid)
+	rangeList, err := user.ParseSubIDFileFilter(path, func(sid user.SubID) bool {
+		return sid.Name == usr.Name || sid.Name == uidstr
+	})
 	if err != nil {
 		return nil, err
 	}
-	if len(rangeList) == 0 {
-		rangeList, err = parseSubuid(usr.Name)
-		if err != nil {
-			return nil, err
-		}
-	}
 	if len(rangeList) == 0 {
 		return nil, fmt.Errorf("no subuid ranges found for user %q", usr.Name)
 	}
-	return createIDMap(rangeList), nil
-}
 
-func lookupSubGIDRanges(usr user.User) ([]IDMap, error) {
-	rangeList, err := parseSubgid(strconv.Itoa(usr.Uid))
-	if err != nil {
-		return nil, err
-	}
-	if len(rangeList) == 0 {
-		rangeList, err = parseSubgid(usr.Name)
-		if err != nil {
-			return nil, err
-		}
-	}
-	if len(rangeList) == 0 {
-		return nil, fmt.Errorf("no subgid ranges found for user %q", usr.Name)
+	idMap := []IDMap{}
+
+	containerID := 0
+	for _, idrange := range rangeList {
+		idMap = append(idMap, IDMap{
+			ContainerID: containerID,
+			HostID:      int(idrange.SubID),
+			Size:        int(idrange.Count),
+		})
+		containerID = containerID + int(idrange.Count)
 	}
-	return createIDMap(rangeList), nil
+	return idMap, nil
 }
diff --git a/vendor/github.com/docker/docker/pkg/idtools/idtools_windows.go b/vendor/github.com/docker/docker/pkg/idtools/idtools_windows.go
index 5b7c2ad771bc..43702f7f3a49 100644
--- a/vendor/github.com/docker/docker/pkg/idtools/idtools_windows.go
+++ b/vendor/github.com/docker/docker/pkg/idtools/idtools_windows.go
@@ -1,16 +1,20 @@
-package idtools // import "github.com/docker/docker/pkg/idtools"
+package idtools
 
 import (
 	"os"
 )
 
 const (
+	// Deprecated: copy value locally
 	SeTakeOwnershipPrivilege = "SeTakeOwnershipPrivilege"
 )
 
 const (
+	// Deprecated: copy value locally
 	ContainerAdministratorSidString = "S-1-5-93-2-1"
-	ContainerUserSidString          = "S-1-5-93-2-2"
+
+	// Deprecated: copy value locally
+	ContainerUserSidString = "S-1-5-93-2-2"
 )
 
 // This is currently a wrapper around [os.MkdirAll] since currently
diff --git a/vendor/github.com/docker/docker/pkg/idtools/usergroupadd_linux.go b/vendor/github.com/docker/docker/pkg/idtools/usergroupadd_linux.go
deleted file mode 100644
index 7fd6c413d451..000000000000
--- a/vendor/github.com/docker/docker/pkg/idtools/usergroupadd_linux.go
+++ /dev/null
@@ -1,166 +0,0 @@
-package idtools // import "github.com/docker/docker/pkg/idtools"
-
-import (
-	"fmt"
-	"os/exec"
-	"regexp"
-	"sort"
-	"strconv"
-	"strings"
-	"sync"
-)
-
-// add a user and/or group to Linux /etc/passwd, /etc/group using standard
-// Linux distribution commands:
-// adduser --system --shell /bin/false --disabled-login --disabled-password --no-create-home --group <username>
-// useradd -r -s /bin/false <username>
-
-var (
-	once        sync.Once
-	userCommand string
-	idOutRegexp = regexp.MustCompile(`uid=([0-9]+).*gid=([0-9]+)`)
-)
-
-const (
-	// default length for a UID/GID subordinate range
-	defaultRangeLen   = 65536
-	defaultRangeStart = 100000
-)
-
-// AddNamespaceRangesUser takes a username and uses the standard system
-// utility to create a system user/group pair used to hold the
-// /etc/sub{uid,gid} ranges which will be used for user namespace
-// mapping ranges in containers.
-func AddNamespaceRangesUser(name string) (int, int, error) {
-	if err := addUser(name); err != nil {
-		return -1, -1, fmt.Errorf("error adding user %q: %v", name, err)
-	}
-
-	// Query the system for the created uid and gid pair
-	out, err := exec.Command("id", name).CombinedOutput()
-	if err != nil {
-		return -1, -1, fmt.Errorf("error trying to find uid/gid for new user %q: %v", name, err)
-	}
-	matches := idOutRegexp.FindStringSubmatch(strings.TrimSpace(string(out)))
-	if len(matches) != 3 {
-		return -1, -1, fmt.Errorf("can't find uid, gid from `id` output: %q", string(out))
-	}
-	uid, err := strconv.Atoi(matches[1])
-	if err != nil {
-		return -1, -1, fmt.Errorf("can't convert found uid (%s) to int: %v", matches[1], err)
-	}
-	gid, err := strconv.Atoi(matches[2])
-	if err != nil {
-		return -1, -1, fmt.Errorf("Can't convert found gid (%s) to int: %v", matches[2], err)
-	}
-
-	// Now we need to create the subuid/subgid ranges for our new user/group (system users
-	// do not get auto-created ranges in subuid/subgid)
-
-	if err := createSubordinateRanges(name); err != nil {
-		return -1, -1, fmt.Errorf("couldn't create subordinate ID ranges: %v", err)
-	}
-	return uid, gid, nil
-}
-
-func addUser(name string) error {
-	once.Do(func() {
-		// set up which commands are used for adding users/groups dependent on distro
-		if _, err := resolveBinary("adduser"); err == nil {
-			userCommand = "adduser"
-		} else if _, err := resolveBinary("useradd"); err == nil {
-			userCommand = "useradd"
-		}
-	})
-	var args []string
-	switch userCommand {
-	case "adduser":
-		args = []string{"--system", "--shell", "/bin/false", "--no-create-home", "--disabled-login", "--disabled-password", "--group", name}
-	case "useradd":
-		args = []string{"-r", "-s", "/bin/false", name}
-	default:
-		return fmt.Errorf("cannot add user; no useradd/adduser binary found")
-	}
-
-	if out, err := exec.Command(userCommand, args...).CombinedOutput(); err != nil {
-		return fmt.Errorf("failed to add user with error: %v; output: %q", err, string(out))
-	}
-	return nil
-}
-
-func createSubordinateRanges(name string) error {
-	// first, we should verify that ranges weren't automatically created
-	// by the distro tooling
-	ranges, err := parseSubuid(name)
-	if err != nil {
-		return fmt.Errorf("error while looking for subuid ranges for user %q: %v", name, err)
-	}
-	if len(ranges) == 0 {
-		// no UID ranges; let's create one
-		startID, err := findNextUIDRange()
-		if err != nil {
-			return fmt.Errorf("can't find available subuid range: %v", err)
-		}
-		idRange := fmt.Sprintf("%d-%d", startID, startID+defaultRangeLen-1)
-		out, err := exec.Command("usermod", "-v", idRange, name).CombinedOutput()
-		if err != nil {
-			return fmt.Errorf("unable to add subuid range to user: %q; output: %s, err: %v", name, out, err)
-		}
-	}
-
-	ranges, err = parseSubgid(name)
-	if err != nil {
-		return fmt.Errorf("error while looking for subgid ranges for user %q: %v", name, err)
-	}
-	if len(ranges) == 0 {
-		// no GID ranges; let's create one
-		startID, err := findNextGIDRange()
-		if err != nil {
-			return fmt.Errorf("can't find available subgid range: %v", err)
-		}
-		idRange := fmt.Sprintf("%d-%d", startID, startID+defaultRangeLen-1)
-		out, err := exec.Command("usermod", "-w", idRange, name).CombinedOutput()
-		if err != nil {
-			return fmt.Errorf("unable to add subgid range to user: %q; output: %s, err: %v", name, out, err)
-		}
-	}
-	return nil
-}
-
-func findNextUIDRange() (int, error) {
-	ranges, err := parseSubuid("ALL")
-	if err != nil {
-		return -1, fmt.Errorf("couldn't parse all ranges in /etc/subuid file: %v", err)
-	}
-	sort.Sort(ranges)
-	return findNextRangeStart(ranges)
-}
-
-func findNextGIDRange() (int, error) {
-	ranges, err := parseSubgid("ALL")
-	if err != nil {
-		return -1, fmt.Errorf("couldn't parse all ranges in /etc/subgid file: %v", err)
-	}
-	sort.Sort(ranges)
-	return findNextRangeStart(ranges)
-}
-
-func findNextRangeStart(rangeList subIDRanges) (int, error) {
-	startID := defaultRangeStart
-	for _, arange := range rangeList {
-		if wouldOverlap(arange, startID) {
-			startID = arange.Start + arange.Length
-		}
-	}
-	return startID, nil
-}
-
-func wouldOverlap(arange subIDRange, ID int) bool {
-	low := ID
-	high := ID + defaultRangeLen
-	if (low >= arange.Start && low <= arange.Start+arange.Length) ||
-		(high <= arange.Start+arange.Length && high >= arange.Start) {
-		return true
-	}
-	return false
-}
diff --git a/vendor/github.com/docker/docker/pkg/idtools/usergroupadd_unsupported.go b/vendor/github.com/docker/docker/pkg/idtools/usergroupadd_unsupported.go
deleted file mode 100644
index 6a9311c4a750..000000000000
--- a/vendor/github.com/docker/docker/pkg/idtools/usergroupadd_unsupported.go
+++ /dev/null
@@ -1,12 +0,0 @@
-//go:build !linux
-
-package idtools // import "github.com/docker/docker/pkg/idtools"
-
-import "fmt"
-
-// AddNamespaceRangesUser takes a name and finds an unused uid, gid pair
-// and calls the appropriate helper function to add the group and then
-// the user to the group in /etc/group and /etc/passwd respectively.
-func AddNamespaceRangesUser(name string) (int, int, error) {
-	return -1, -1, fmt.Errorf("No support for adding users or groups on this OS")
-}
diff --git a/vendor/github.com/docker/docker/pkg/idtools/utils_unix.go b/vendor/github.com/docker/docker/pkg/idtools/utils_unix.go
deleted file mode 100644
index 517a2f52ca2f..000000000000
--- a/vendor/github.com/docker/docker/pkg/idtools/utils_unix.go
+++ /dev/null
@@ -1,26 +0,0 @@
-//go:build !windows
-
-package idtools // import "github.com/docker/docker/pkg/idtools"
-
-import (
-	"fmt"
-	"os/exec"
-	"path/filepath"
-)
-
-func resolveBinary(binname string) (string, error) {
-	binaryPath, err := exec.LookPath(binname)
-	if err != nil {
-		return "", err
-	}
-	resolvedPath, err := filepath.EvalSymlinks(binaryPath)
-	if err != nil {
-		return "", err
-	}
-	// only return no error if the final resolved binary basename
-	// matches what was searched for
-	if filepath.Base(resolvedPath) == binname {
-		return resolvedPath, nil
-	}
-	return "", fmt.Errorf("Binary %q does not resolve to a binary of that name in $PATH (%q)", binname, resolvedPath)
-}
diff --git a/vendor/github.com/docker/docker/pkg/ioutils/fswriters_deprecated.go b/vendor/github.com/docker/docker/pkg/ioutils/fswriters_deprecated.go
new file mode 100644
index 000000000000..c3cee16db232
--- /dev/null
+++ b/vendor/github.com/docker/docker/pkg/ioutils/fswriters_deprecated.go
@@ -0,0 +1,44 @@
+package ioutils
+
+import (
+	"io"
+	"os"
+
+	"github.com/docker/docker/pkg/atomicwriter"
+)
+
+// NewAtomicFileWriter returns WriteCloser so that writing to it writes to a
+// temporary file and closing it atomically changes the temporary file to
+// destination path. Writing and closing concurrently is not allowed.
+// NOTE: umask is not considered for the file's permissions.
+//
+// Deprecated: use [atomicwriter.New] instead.
+func NewAtomicFileWriter(filename string, perm os.FileMode) (io.WriteCloser, error) {
+	return atomicwriter.New(filename, perm)
+}
+
+// AtomicWriteFile atomically writes data to a file named by filename and with the specified permission bits.
+// NOTE: umask is not considered for the file's permissions.
+//
+// Deprecated: use [atomicwriter.WriteFile] instead.
+func AtomicWriteFile(filename string, data []byte, perm os.FileMode) error {
+	return atomicwriter.WriteFile(filename, data, perm)
+}
+
+// AtomicWriteSet is used to atomically write a set
+// of files and ensure they are visible at the same time.
+// Must be committed to a new directory.
+//
+// Deprecated: use [atomicwriter.WriteSet] instead.
+type AtomicWriteSet = atomicwriter.WriteSet
+
+// NewAtomicWriteSet creates a new atomic write set to
+// atomically create a set of files. The given directory
+// is used as the base directory for storing files before
+// commit. If no temporary directory is given the system
+// default is used.
+//
+// Deprecated: use [atomicwriter.NewWriteSet] instead.
+func NewAtomicWriteSet(tmpDir string) (*atomicwriter.WriteSet, error) {
+	return atomicwriter.NewWriteSet(tmpDir)
+}
diff --git a/vendor/github.com/docker/docker/registry/config.go b/vendor/github.com/docker/docker/registry/config.go
index 07fdea1b6cea..f8d94ce80636 100644
--- a/vendor/github.com/docker/docker/registry/config.go
+++ b/vendor/github.com/docker/docker/registry/config.go
@@ -4,13 +4,13 @@ import (
 	"context"
 	"net"
 	"net/url"
-	"regexp"
 	"strconv"
 	"strings"
 
 	"github.com/containerd/log"
 	"github.com/distribution/reference"
 	"github.com/docker/docker/api/types/registry"
+	"github.com/docker/docker/internal/lazyregexp"
 )
 
 // ServiceOptions holds command line options.
@@ -57,7 +57,7 @@ var (
 	}
 
 	emptyServiceConfig, _ = newServiceConfig(ServiceOptions{})
-	validHostPortRegex    = regexp.MustCompile(`^` + reference.DomainRegexp.String() + `$`)
+	validHostPortRegex    = lazyregexp.New(`^` + reference.DomainRegexp.String() + `$`)
 
 	// certsDir is used to override defaultCertsDir.
 	certsDir string
diff --git a/vendor/github.com/docker/docker/registry/registry.go b/vendor/github.com/docker/docker/registry/registry.go
index 7866dcd0d8fb..6b079199ddc0 100644
--- a/vendor/github.com/docker/docker/registry/registry.go
+++ b/vendor/github.com/docker/docker/registry/registry.go
@@ -14,6 +14,7 @@ import (
 	"github.com/containerd/log"
 	"github.com/docker/distribution/registry/client/transport"
 	"github.com/docker/go-connections/tlsconfig"
+	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
 )
 
 // HostCertsDir returns the config directory for a specific host.
@@ -115,7 +116,7 @@ func Headers(userAgent string, metaHeaders http.Header) []transport.RequestModif
 
 // newTransport returns a new HTTP transport. If tlsConfig is nil, it uses the
 // default TLS configuration.
-func newTransport(tlsConfig *tls.Config) *http.Transport {
+func newTransport(tlsConfig *tls.Config) http.RoundTripper {
 	if tlsConfig == nil {
 		tlsConfig = tlsconfig.ServerDefault()
 	}
@@ -125,12 +126,14 @@ func newTransport(tlsConfig *tls.Config) *http.Transport {
 		KeepAlive: 30 * time.Second,
 	}
 
-	return &http.Transport{
-		Proxy:               http.ProxyFromEnvironment,
-		DialContext:         direct.DialContext,
-		TLSHandshakeTimeout: 10 * time.Second,
-		TLSClientConfig:     tlsConfig,
-		// TODO(dmcgowan): Call close idle connections when complete and use keep alive
-		DisableKeepAlives: true,
-	}
+	return otelhttp.NewTransport(
+		&http.Transport{
+			Proxy:               http.ProxyFromEnvironment,
+			DialContext:         direct.DialContext,
+			TLSHandshakeTimeout: 10 * time.Second,
+			TLSClientConfig:     tlsConfig,
+			// TODO(dmcgowan): Call close idle connections when complete and use keep alive
+			DisableKeepAlives: true,
+		},
+	)
 }
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 8857063efb7d..f2db1e014095 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -55,7 +55,7 @@ github.com/docker/distribution/registry/client/transport
 github.com/docker/distribution/registry/storage/cache
 github.com/docker/distribution/registry/storage/cache/memory
 github.com/docker/distribution/uuid
-# github.com/docker/docker v27.0.2-0.20250101151200-6f6c3b921180+incompatible
+# github.com/docker/docker v27.0.2-0.20250108165300-50212d215ba7+incompatible
 ## explicit
 github.com/docker/docker/api
 github.com/docker/docker/api/types
@@ -81,8 +81,10 @@ github.com/docker/docker/builder/remotecontext/git
 github.com/docker/docker/builder/remotecontext/urlutil
 github.com/docker/docker/client
 github.com/docker/docker/errdefs
+github.com/docker/docker/internal/lazyregexp
 github.com/docker/docker/internal/multierror
 github.com/docker/docker/pkg/archive
+github.com/docker/docker/pkg/atomicwriter
 github.com/docker/docker/pkg/homedir
 github.com/docker/docker/pkg/idtools
 github.com/docker/docker/pkg/ioutils
@@ -195,7 +197,7 @@ github.com/moby/docker-image-spec/specs-go/v1
 ## explicit; go 1.19
 github.com/moby/patternmatcher
 github.com/moby/patternmatcher/ignorefile
-# github.com/moby/swarmkit/v2 v2.0.0-20241017191044-e8ecf83ee08e
+# github.com/moby/swarmkit/v2 v2.0.0-20250103191802-8c1959736554
 ## explicit; go 1.18
 github.com/moby/swarmkit/v2/api
 github.com/moby/swarmkit/v2/api/deepcopy