Repository: moby/moby
File: daemon/command/daemon.go (Go)

Code before:
	b, shutdownBuildKit, err := initBuildkit(ctx, d, cdiCache)
	if err != nil {
		return fmt.Errorf("error initializing buildkit: %w", err)
	}

	if runtime.GOOS == "windows" {
		if enabled, ok := d.Features()["buildkit"]; ok && enabled {
			log.G(ctx).Warn("Buildkit feature is enabled in the daemon.json configuration file. Support for BuildKit on Windows is experimental, and enabling this feature may not work. Use at your own risk!")
		}
	}

	routers := buildRouters(routerOptions{
		features: d.Features,
		daemon:   d,
		cluster:  c,
		builder:  b,
	})
	httpServer.Handler = apiServer.CreateMux(ctx, routers...)

	go d.ProcessClusterNotifications(ctx, c.GetWatchStream())

	cli.setupConfigReloadTrap()

	// after the daemon is done setting up we can notify systemd api
	notifyReady()
	log.G(ctx).Info("Daemon has completed initialization")

	// Daemon is fully initialized. Start handling API traffic
	// and wait for serve API to complete.
	var (
		apiWG  sync.WaitGroup
		errAPI = make(chan error, 1)
	)
	for _, ls := range lss {
		apiWG.Add(1)
		go func(ls net.Listener) {
			defer apiWG.Done()
			log.G(ctx).Infof("API listen on %s", ls.Addr())
			if err := httpServer.Serve(ls); err != http.ErrServerClosed {
				log.G(ctx).WithFields(log.Fields{
					"error":    err,
					"listener": ls.Addr(),
				}).Error("ServeAPI error")

				select {
				case errAPI <- err:
				default:
				}
			}
		}(ls)
	}

Review comment (suggestion):
Note: This will implicitly expose the containerd content store via buildkit:

https://github.com/moby/moby/blob/c64b781df2387bea01720a3a3411f7d29dd40ea8/vendor/github.com/moby/buildkit/control/control.go#L164

It's read-only so that's good, but we should make that explicitly registered by the Moby and not implicitly by Buildkit.

Code after:
	b, shutdownBuildKit, err := initBuildkit(ctx, d, cdiCache)
	if err != nil {
		return fmt.Errorf("error initializing buildkit: %w", err)
	}

	if runtime.GOOS == "windows" {
		if enabled, ok := d.Features()["buildkit"]; ok && enabled {
			log.G(ctx).Warn("Buildkit feature is enabled in the daemon.json configuration file. Support for BuildKit on Windows is experimental, and enabling this feature may not work. Use at your own risk!")
		}
	}

	// Enable HTTP/1, HTTP/2 and h2c on the HTTP server. h2c won't be used for *tls.Conn listeners, and HTTP/2 won't be
	// used for non-TLS connections.
	var p http.Protocols
	p.SetHTTP1(true)
	p.SetHTTP2(true)
	p.SetUnencryptedHTTP2(true)

	routers := buildRouters(routerOptions{
		features: d.Features,
		daemon:   d,
		cluster:  c,
		builder:  b,
	})
	gs := newGRPCServer(ctx)
	b.backend.RegisterGRPC(gs)
	httpServer.Protocols = &p
	httpServer.Handler = newHTTPHandler(ctx, gs, apiServer.CreateMux(ctx, routers...))

	go d.ProcessClusterNotifications(ctx, c.GetWatchStream())

	cli.setupConfigReloadTrap()

	// after the daemon is done setting up we can notify systemd api
	notifyReady()
	log.G(ctx).Info("Daemon has completed initialization")

	// Daemon is fully initialized. Start handling API traffic
	// and wait for serve API to complete.
	var (
		apiWG  sync.WaitGroup
		errAPI = make(chan error, 1)
	)
	for _, ls := range lss {
		apiWG.Add(1)
		go func(ls net.Listener) {
			defer apiWG.Done()
			log.G(ctx).Infof("API listen on %s", ls.Addr())
			if err := httpServer.Serve(ls); err != http.ErrServerClosed {
				log.G(ctx).WithFields(log.Fields{
					"error":    err,