[mayankpande88]

What this PR does

The agent's Docker engine client (github.com/docker/docker v28.5.2) carries CVE-2026-33997 (NVD 8.1), and that module has no release with the fix; it lives only in github.com/moby/moby/client. This moves the one file that talks to dockerd onto the moby client and rebuilds on Go 1.26.10. Container discovery on Docker hosts should behave exactly as before.

How to verify

1. Run the new image on a Docker host (or a node with dockerd). Docker containers show up with the same name, image, listen ports and log path as with the previous image.
2. trivy image on the new tag no longer lists CVE-2026-33997 or the Go stdlib findings.

Risks

• Not run end to end on a real node: the full eBPF collection path still needs a run on a Linux node before release (see below).

Linked issue / context

Image CVE cleanup: clears every fixable finding NVD scores 8.0+. The two left (openssl-libs CVE-2026-31789 / CVE-2026-28387) are in the UBI9 base with no Red Hat fix yet.

How was this tested? / detail

• containers/dockerd.go: API version negotiation is now a client option (client.WithAPIVersionNegotiation()); Ping and ContainerInspect take option structs and inspect wraps its result; port-binding host IPs are typed addresses and unset ones are skipped (the old code failed to parse them too). github.com/docker/docker is gone from go.mod/go.sum.
• Go 1.26.5 -> 1.26.10 in both Dockerfiles and CI, GOTOOLCHAIN=local in the builder. The Dockerfile already runs microdnf update -y.
• gofmt clean, go vet exit 0, CI's test set passes (all packages except /containers, as CI does), on Go 1.26.10 in a Linux builder.

Local e2e: built the image; ran DockerdInit + DockerdInspect against a real dockerd for an nginx container -> correct name, image, listen 0.0.0.0:18080, bridge network, json-file log path and 4 env vars; started the full agent container -> dockerd init succeeds with no warning, containerd and BTF socket offsets discovered, then it exits at "neither debugfs nor tracefs are mounted" (the local VM kernel lacks those tracepoints). Not run: eBPF collection on a real Linux node; opened with that gap stated on purpose, to be closed before release.

Scans, NVD 8.0+: 0.1.12-rc.1 = 3 (1 fixable), this build = 2 (0 fixable, UBI9 openssl-libs).

eBPF changes?

No.

Checklist

• gofmt, go vet, go mod tidy clean
• CI test set passes
• CHANGELOG.md updated under ## [Unreleased]
• No real credentials, internal hostnames, or production captures in test fixtures

[gemini-code-assist]

Code Review

This pull request migrates the Docker engine client from github.com/docker/docker to github.com/moby/moby/client to address CVE-2026-33997, updates Go to version 1.26.10 across Dockerfiles, and adjusts Docker client initialization and inspection logic. Feedback on the changes highlights an issue in containers/dockerd.go where direct string concatenation of HostIP and HostPort will fail for IPv6 addresses, and recommends using net.JoinHostPort instead.