Method doRequest

client/request.go:130–219

doRequest sends an HTTP request and returns an HTTP response. It is a wrapper around [http.Client.Do] with extra handling to decorate errors. Otherwise, it behaves identical to [http.Client.Do]; an error is returned when failing to make a connection, On error, any Response can be ignored. A non-2xx

(req *http.Request)

// when failing to make a connection, On error, any Response can be ignored.
// A non-2xx status code doesn't cause an error.
func (cli *Client) doRequest(req *http.Request) (*http.Response, error) {
	resp, err := cli.client.Do(req) // #nosec G704 -- ignore "SSRF via taint analysis"; API client intentionally sends caller-provided requests/URLs.
	if err == nil {
		return resp, nil
	}

	if cli.scheme != "https" && strings.Contains(err.Error(), "malformed HTTP response") {
		return nil, errConnectionFailed{fmt.Errorf("%w.\n* Are you trying to connect to a TLS-enabled daemon without TLS?", err)}
	}

	const (
		// Go 1.25 /  TLS 1.3 may produce a generic "handshake failure"
		// whereas TLS 1.2 may produce a "bad certificate" TLS alert.
		// See https://github.com/golang/go/issues/56371
		//
		// > https://tip.golang.org/doc/go1.12#tls_1_3
		// >
		// > In TLS 1.3 the client is the last one to speak in the handshake, so if
		// > it causes an error to occur on the server, it will be returned on the
		// > client by the first Read, not by Handshake. For example, that will be
		// > the case if the server rejects the client certificate.
		//
		// https://github.com/golang/go/blob/go1.25.1/src/crypto/tls/alert.go#L71-L72
		alertBadCertificate   = "bad certificate"   // go1.24 / TLS 1.2
		alertHandshakeFailure = "handshake failure" // go1.25 / TLS 1.3
	)

	// TODO(thaJeztah): see if we can use errors.As for a [crypto/tls.AlertError] instead of bare string matching.
	if cli.scheme == "https" && (strings.Contains(err.Error(), alertHandshakeFailure) || strings.Contains(err.Error(), alertBadCertificate)) {
		return nil, errConnectionFailed{fmt.Errorf("the server probably has client authentication (--tlsverify) enabled; check your TLS client certification settings: %w", err)}
	}

	// Don't decorate context sentinel errors; users may be comparing to
	// them directly.
	if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
		return nil, err
	}

	if errors.Is(err, os.ErrPermission) {
		// Don't include request errors (Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.51/version"),
		// which are irrelevant if we weren't able to connect.
		return nil, errConnectionFailed{fmt.Errorf("permission denied while trying to connect to the docker API at %v", cli.host)}
	}
	if errors.Is(err, os.ErrNotExist) {
		// Unwrap the error to remove request errors (Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.51/version"),
		// which are irrelevant if we weren't able to connect.
		err = errors.Unwrap(err)
		return nil, errConnectionFailed{fmt.Errorf("failed to connect to the docker API at %v; check if the path is correct and if the daemon is running: %w", cli.host, err)}
	}
	var dnsErr *net.DNSError
	if errors.As(err, &dnsErr) {
		return nil, errConnectionFailed{fmt.Errorf("failed to connect to the docker API at %v: %w", cli.host, dnsErr)}
	}

	var nErr net.Error
	if errors.As(err, &nErr) {
		// FIXME(thaJeztah): any net.Error should be considered a connection error (but we should include the original error)?
		if nErr.Timeout() {