feat(offload): add docker-offload-plugin deb/rpm packaging

.github/workflows/.pkgs.yml

@@ -21,6 +21,9 @@ jobs:
         name: Set pkgs output
         id: set
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          # offload builds from a private source tree and is built from its own repo.
+          DISABLED_PACKAGES: offload
         with:
           script: |
             const fs = require('fs');

docker-bake.hcl

@@ -55,7 +55,8 @@ variable "PKGS_BASE" {
     "docker-cli",
     "docker-engine",
     "model",
-    "agent"
+    "agent",
+    "offload"
   ]
 }
 
@@ -91,6 +92,8 @@ variable "PKG_PLATFORMS_BASE" {
     model = ["darwin/amd64", "darwin/arm64", "linux/amd64", "linux/arm64", "linux/arm/v7", "windows/amd64", "windows/arm64"]
     # https://github.com/docker/docker-agent/blob/5b9feaabe743a5ad577f2247ed55d5dcb2678e8b/Taskfile.yml#L79
     agent = ["darwin/amd64", "darwin/arm64", "linux/amd64", "linux/arm64", "windows/amd64", "windows/arm64"]
+    # Linux packages only; darwin and windows ship through the source repo.
+    offload = ["linux/amd64", "linux/arm64"]
   }
 }
 
@@ -102,7 +105,8 @@ variable "PKG_PLATFORMS_EXTRA" {
 variable "PKG_DISTROS" {
   description = "Package-specific distro mapping. Packages omitted here build for all DISTROS."
   default = {
-    docker = ["static"]
+    docker  = ["static"]
+    offload = ["ubuntu2404", "ubuntu2604", "rockylinux8"]
   }
 }
 
@@ -211,6 +215,28 @@ variable "NIGHTLY_BUILD" {
   default = null
 }
 
+variable "VERSION" {
+  description = "Version to build, with v prefix, for example v0.7.52. Only used for the offload package, whose source tree is passed in as the src named context."
+  default = null
+}
+variable "COMMIT" {
+  description = "Short commit of the source tree. Only used for the offload package."
+  default = null
+}
+variable "BUILD" {
+  description = "Build number of the release build. Only used for the offload package."
+  default = null
+}
+variable "DATE" {
+  description = "Commit date of the release tag (YYYY-MM-DD). Only used for the offload package."
+  default = null
+}
+
+variable "PKG_BUILD_ENV_FILE" {
+  description = "File with build secrets, passed to the package build as the build-env secret. Only read by packages that mount it."
+  default = null
+}
+
 variable "GO_IMAGE" {
   description = "Go image to use for building packages."
   default = "golang"
@@ -693,6 +719,20 @@ target "_pkg-agent" {
   }
 }
 
+# The source repo is private, so there is no PKG_REPO/PKG_REF clone. The caller passes the
+# vendored source tree as the src named context, and builds are run from the source repo.
+target "_pkg-offload" {
+  args = {
+    PKG_NAME = PKG_NAME != null && PKG_NAME != "" ? PKG_NAME : "docker-offload-plugin"
+    GO_IMAGE_VARIANT = GO_IMAGE_VARIANT != null && GO_IMAGE_VARIANT != "" ? GO_IMAGE_VARIANT : "trixie"
+    PKG_DEB_EPOCH = PKG_DEB_EPOCH != null && PKG_DEB_EPOCH != "" ? PKG_DEB_EPOCH : ""
+    VERSION = VERSION
+    COMMIT = COMMIT
+    BUILD = BUILD
+    DATE = DATE
+  }
+}
+
 # Returns the list of supported platforms for a given package.
 function "pkgPlatforms" {
   params = [pkg]
@@ -760,7 +800,7 @@ target "pkg" {
   # BAKE_LOCAL_PLATFORM is a built-in var returning the current platform's
   # default platform specification: https://docs.docker.com/build/customize/bake/file-definition/#built-in-variables
   platforms = LOCAL_PLATFORM != null ? [BAKE_LOCAL_PLATFORM] : distroPlatforms(item.distro, item.pkg)
-  secret = distroSecrets(item.distro)
+  secret = concat(distroSecrets(item.distro), PKG_BUILD_ENV_FILE != null && PKG_BUILD_ENV_FILE != "" ? ["type=file,id=build-env,src=${PKG_BUILD_ENV_FILE}"] : [])
   attest = [
     "type=sbom",
     "type=provenance,mode=max"

pkg/offload/Dockerfile

@@ -0,0 +1,117 @@
+# syntax=docker/dockerfile:1
+
+# Copyright 2026 Docker Packaging authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+ARG XX_VERSION="1.10.0"
+
+ARG DISTRO_NAME="debian13"
+ARG DISTRO_TYPE="deb"
+ARG DISTRO_RELEASE="debian"
+ARG DISTRO_SUITE="trixie"
+ARG DISTRO_ID="13"
+ARG DISTRO_IMAGE="debian:trixie"
+
+ARG PKG_NAME="docker-offload-plugin"
+
+ARG GO_IMAGE="golang"
+# Must be the exact Go version of the release build, so the package build reproduces it.
+ARG GO_VERSION="1.27.3"
+ARG GO_IMAGE_VARIANT="trixie"
+
+# stage used as named context that mounts hack/scripts
+# see pkg target in docker-bake.hcl
+FROM scratch AS scripts
+
+# The source tree is private and is passed in by the caller as the src named context, with
+# Go dependencies already vendored. There is no git clone fallback.
+FROM scratch AS src
+
+# cross compilation helper
+FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
+
+# go base image to retrieve /usr/local/go
+FROM ${GO_IMAGE}:${GO_VERSION}-${GO_IMAGE_VARIANT} AS go
+
+# deb
+FROM ${DISTRO_IMAGE} AS builder-deb
+COPY --from=xx / /
+ENV GOPATH="/go"
+ENV PATH="$PATH:/usr/local/go/bin:$GOPATH/bin"
+ENV GOTOOLCHAIN="local"
+ARG DISTRO_NAME
+RUN apt-get update && apt-get install -y --no-install-recommends apt-utils bash ca-certificates devscripts equivs
+COPY deb /root/package/debian
+ARG TARGETPLATFORM
+RUN mk-build-deps -t "xx-apt-get -o Debug::pkgProblemResolver=yes --no-install-recommends -y" -i /root/package/debian/control
+WORKDIR /root/package
+ARG NIGHTLY_BUILD
+ARG VERSION
+ARG COMMIT
+ARG BUILD
+ARG DATE
+ARG DISTRO_RELEASE
+ARG DISTRO_ID
+ARG DISTRO_SUITE
+ARG PKG_NAME
+ARG PKG_PACKAGER
+ARG PKG_DEB_BUILDFLAGS
+ARG PKG_DEB_REVISION
+ARG PKG_DEB_EPOCH
+ARG SOURCE_DATE_EPOCH
+RUN --mount=type=bind,source=scripts/pkg-deb-build.sh,target=/usr/local/bin/pkg-deb-build \
+    --mount=type=bind,from=scripts,source=gen-deb-changelog.sh,target=/usr/local/bin/gen-deb-changelog \
+    --mount=type=bind,from=src,target=/root/package/offload,rw \
+    --mount=type=bind,from=go,source=/usr/local/go,target=/usr/local/go \
+    --mount=type=secret,id=build-env,target=/run/secrets/build-env \
+    OUTDIR=/out SRCDIR=./offload BUILD_ENV_FILE=/run/secrets/build-env pkg-deb-build
+
+# rpm
+FROM ${DISTRO_IMAGE} AS builder-rpm
+COPY --from=xx / /
+ENV GOPATH="/go"
+ENV PATH="$PATH:/usr/local/go/bin:$GOPATH/bin"
+ENV GOTOOLCHAIN="local"
+ARG DISTRO_NAME
+RUN --mount=type=bind,from=scripts,source=rpm-init.sh,target=/usr/local/bin/rpm-init \
+  rpm-init $DISTRO_NAME
+COPY rpm /root/rpmbuild/SPECS
+ARG TARGETPLATFORM
+RUN --mount=type=bind,from=scripts,source=rpm-builddep.sh,target=/usr/local/bin/rpm-builddep \
+  rpm-builddep $(xx-info rhel-arch) /root/rpmbuild/SPECS
+WORKDIR /root/rpmbuild
+ARG NIGHTLY_BUILD
+ARG VERSION
+ARG COMMIT
+ARG BUILD
+ARG DATE
+ARG DISTRO_RELEASE
+ARG DISTRO_ID
+ARG DISTRO_SUITE
+ARG PKG_NAME
+ARG PKG_PACKAGER
+ARG PKG_RPM_BUILDFLAGS
+ARG PKG_RPM_RELEASE
+ARG SOURCE_DATE_EPOCH
+RUN --mount=type=bind,source=scripts/pkg-rpm-build.sh,target=/usr/local/bin/pkg-rpm-build \
+    --mount=type=bind,from=src,target=/usr/local/src/offload,rw \
+    --mount=type=bind,from=go,source=/usr/local/go,target=/usr/local/go \
+    --mount=type=secret,id=build-env,target=/run/secrets/build-env \
+    OUTDIR=/out SRCDIR=/usr/local/src/offload BUILD_ENV_FILE=/run/secrets/build-env pkg-rpm-build
+
+FROM builder-${DISTRO_TYPE} AS build-pkg
+ARG BUILDKIT_SBOM_SCAN_STAGE=true
+
+FROM scratch AS pkg
+COPY --from=build-pkg /out /

pkg/offload/deb/control

@@ -0,0 +1,16 @@
+Source: docker-offload-plugin
+Section: admin
+Priority: optional
+Maintainer: Docker <support@docker.com>
+Homepage: https://www.docker.com
+Standards-Version: 3.9.6
+Build-Depends: bash,
+               debhelper-compat (= 13),
+               make
+
+Package: docker-offload-plugin
+Priority: optional
+Architecture: linux-any
+Enhances: docker-ce-cli
+Description: Docker Offload plugin for the Docker CLI.
+Homepage: https://docs.docker.com/offload/

pkg/offload/deb/copyright

@@ -0,0 +1,8 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: docker-offload-plugin
+Source: https://docs.docker.com/offload/
+
+Files: *
+Copyright: Docker, Inc.
+License: Proprietary
+ All rights reserved.

pkg/offload/deb/rules

@@ -0,0 +1,25 @@
+#!/usr/bin/make -f
+
+# force packages to be built with xz compression, as Ubuntu 21.10 and up use
+# zstd compression, which is non-standard, and breaks 'dpkg-sig --verify'
+override_dh_builddeb:
+	dh_builddeb -- -Zxz
+
+override_dh_auto_build:
+	make -C $(CURDIR)/offload ce-release VERSION=$(VERSION) COMMIT=$(COMMIT) BUILD=$(BUILD) DATE=$(DATE) BUILD_ENV_FILE=$(BUILD_ENV_FILE)
+
+override_dh_auto_test:
+	ver="$$($(CURDIR)/offload/dist/docker-offload docker-cli-plugin-metadata | awk '{ gsub(/[",:]/,"")}; $$1 == "Version" { print $$2 }')"; \
+		test "$$ver" = "$(VERSION)" && echo "PASS: docker-offload version OK" || (echo "FAIL: docker-offload version ($$ver) did not match $(VERSION)" && exit 1)
+
+# The build is reproducible, and the packaged binary is checked against the release
+# checksums, so do not strip or otherwise rewrite it after the build.
+override_dh_strip:
+
+override_dh_dwz:
+
+override_dh_auto_install:
+	install -D -p -m 0755 $(CURDIR)/offload/dist/docker-offload debian/docker-offload-plugin/usr/libexec/docker/cli-plugins/docker-offload
+
+%:
+	dh $@

pkg/offload/deb/source/format

@@ -0,0 +1 @@
+1.0

pkg/offload/rpm/docker-offload-plugin.spec

@@ -0,0 +1,40 @@
+%global debug_package %{nil}
+# The build is reproducible, and the packaged binary is checked against the release
+# checksums, so do not rewrite the ELF notes after the build.
+%global __brp_strip_comment_note %{nil}
+
+Name: docker-offload-plugin
+Version: %{_version}
+Release: %{_release}%{?dist}
+Epoch: 0
+Summary: Docker Offload plugin for the Docker CLI
+Group: Tools/Docker
+License: Proprietary
+URL: https://docs.docker.com/offload/
+Vendor: Docker
+Packager: Docker <support@docker.com>
+
+Enhances: docker-ce-cli
+
+BuildRequires: bash
+BuildRequires: make
+
+%description
+Docker Offload plugin for the Docker CLI.
+
+%prep
+
+%build
+make -C %{_srcdir} ce-release VERSION=%{_origversion} COMMIT=%{_commit} BUILD=%{_build} DATE=%{_date} BUILD_ENV_FILE=%{_buildenvfile}
+
+%check
+ver="$(%{_srcdir}/dist/docker-offload docker-cli-plugin-metadata | awk '{ gsub(/[",:]/,"")}; $1 == "Version" { print $2 }')"
+test "$ver" = "%{_origversion}" && echo "PASS: docker-offload version OK" || { echo "FAIL: docker-offload version ($ver) did not match %{_origversion}"; exit 1; }
+
+%install
+install -D -p -m 0755 %{_srcdir}/dist/docker-offload ${RPM_BUILD_ROOT}%{_libexecdir}/docker/cli-plugins/docker-offload
+
+%files
+%{_libexecdir}/docker/cli-plugins/docker-offload
+
+%changelog