@@ -268,7 +268,7 @@ func (cli *DaemonCli) start(opts *daemonOptions) (err error) {

 	// Restart all autostart containers which has a swarm endpoint

 	// and is not yet running now that we have successfully

 	// initialized the cluster.

-	d.RestartSwarmContainers()

+	d.RestartSwarmContainers(cli.Config)

 	logrus.Info("Daemon has completed initialization")

@@ -371,7 +371,7 @@ func newRouterOptions(ctx context.Context, config *config.Config, d *daemon.Daem

 		DefaultCgroupParent: cgroupParent,

 		RegistryHosts:       d.RegistryHosts,

 		BuilderConfig:       config.Builder,

-		Rootless:            d.Rootless(),

+		Rootless:            daemon.Rootless(config),

 		IdentityMapping:     d.IdentityMapping(),

 		DNSConfig:           config.DNSConfig,

 		ApparmorProfile:     daemon.DefaultApparmorProfile(),

@@ -9,7 +9,6 @@ import (

 	"os"

 	"path/filepath"

 	"strings"

-	"sync"

 	"golang.org/x/text/encoding"

 	"golang.org/x/text/encoding/unicode"

@@ -227,7 +226,6 @@ type CommonConfig struct {

 	NetworkConfig

 	registry.ServiceOptions

-	sync.Mutex

 	// FIXME(vdemeester) This part is not that clear and is mainly dependent on cli flags

 	// It should probably be handled outside this package.

 	ValuesSet map[string]interface{} `json:"-"`

@@ -650,11 +648,11 @@ func Validate(config *Config) error {

 		return err

 	}

-	if defaultRuntime := config.GetDefaultRuntimeName(); defaultRuntime != "" {

-		if !builtinRuntimes[defaultRuntime] {

+	if config.DefaultRuntime != "" {

+		if !builtinRuntimes[config.DefaultRuntime] {

 			runtimes := config.GetAllRuntimes()

-			if _, ok := runtimes[defaultRuntime]; !ok && !IsPermissibleC8dRuntimeName(defaultRuntime) {

-				return errors.Errorf("specified default runtime '%s' does not exist", defaultRuntime)

+			if _, ok := runtimes[config.DefaultRuntime]; !ok && !IsPermissibleC8dRuntimeName(config.DefaultRuntime) {

+				return fmt.Errorf("specified default runtime '%s' does not exist", config.DefaultRuntime)

 			}

 		}

 	}

@@ -669,15 +667,6 @@ func Validate(config *Config) error {

 	return config.ValidatePlatformConfig()

 }

-// GetDefaultRuntimeName returns the current default runtime

-func (conf *Config) GetDefaultRuntimeName() string {

-	conf.Lock()

-	rt := conf.DefaultRuntime

-	conf.Unlock()

-

-	return rt

-}

-

 // MaskCredentials masks credentials that are in an URL.

 func MaskCredentials(rawURL string) string {

 	parsedURL, err := url.Parse(rawURL)

@@ -84,8 +84,6 @@ type Config struct {

 // GetRuntime returns the runtime path and arguments for a given

 // runtime name

 func (conf *Config) GetRuntime(name string) *types.Runtime {

-	conf.Lock()

-	defer conf.Unlock()

 	if rt, ok := conf.Runtimes[name]; ok {

 		return &rt

 	}

@@ -94,10 +92,7 @@ func (conf *Config) GetRuntime(name string) *types.Runtime {

 // GetAllRuntimes returns a copy of the runtimes map

 func (conf *Config) GetAllRuntimes() map[string]types.Runtime {

-	conf.Lock()

-	rts := conf.Runtimes

-	conf.Unlock()

-	return rts

+	return conf.Runtimes

 }

 // GetExecRoot returns the user configured Exec-root

@@ -107,8 +102,6 @@ func (conf *Config) GetExecRoot() string {

 // GetInitPath returns the configured docker-init path

 func (conf *Config) GetInitPath() string {

-	conf.Lock()

-	defer conf.Unlock()

 	if conf.InitPath != "" {

 		return conf.InitPath

 	}

@@ -10,6 +10,7 @@ import (

 	containertypes "github.com/docker/docker/api/types/container"

 	"github.com/docker/docker/api/types/strslice"

 	"github.com/docker/docker/container"

+	"github.com/docker/docker/daemon/config"

 	"github.com/docker/docker/daemon/network"

 	"github.com/docker/docker/errdefs"

 	"github.com/docker/docker/image"

@@ -206,10 +207,10 @@ func (daemon *Daemon) generateHostname(id string, config *containertypes.Config)

 	}

 }

-func (daemon *Daemon) setSecurityOptions(container *container.Container, hostConfig *containertypes.HostConfig) error {

+func (daemon *Daemon) setSecurityOptions(cfg *config.Config, container *container.Container, hostConfig *containertypes.HostConfig) error {

 	container.Lock()

 	defer container.Unlock()

-	return daemon.parseSecurityOpt(&container.SecurityOptions, hostConfig)

+	return daemon.parseSecurityOpt(cfg, &container.SecurityOptions, hostConfig)

 }

 func (daemon *Daemon) setHostConfig(container *container.Container, hostConfig *containertypes.HostConfig) error {

@@ -234,7 +235,7 @@ func (daemon *Daemon) setHostConfig(container *container.Container, hostConfig *

 // verifyContainerSettings performs validation of the hostconfig and config

 // structures.

-func (daemon *Daemon) verifyContainerSettings(hostConfig *containertypes.HostConfig, config *containertypes.Config, update bool) (warnings []string, err error) {

+func (daemon *Daemon) verifyContainerSettings(daemonCfg *config.Config, hostConfig *containertypes.HostConfig, config *containertypes.Config, update bool) (warnings []string, err error) {

 	// First perform verification of settings common across all platforms.

 	if err = validateContainerConfig(config); err != nil {

 		return warnings, err

@@ -244,7 +245,7 @@ func (daemon *Daemon) verifyContainerSettings(hostConfig *containertypes.HostCon

 	}

 	// Now do platform-specific verification

-	warnings, err = verifyPlatformContainerSettings(daemon, hostConfig, update)

+	warnings, err = verifyPlatformContainerSettings(daemon, daemonCfg, hostConfig, update)

 	for _, w := range warnings {

 		logrus.Warn(w)

 	}

@@ -12,6 +12,7 @@ import (

 	containertypes "github.com/docker/docker/api/types/container"

 	networktypes "github.com/docker/docker/api/types/network"

 	"github.com/docker/docker/container"

+	"github.com/docker/docker/daemon/config"

 	"github.com/docker/docker/daemon/network"

 	"github.com/docker/docker/errdefs"

 	"github.com/docker/docker/libnetwork"

@@ -26,19 +27,19 @@ import (

 	"github.com/sirupsen/logrus"

 )

-func (daemon *Daemon) getDNSSearchSettings(container *container.Container) []string {

+func (daemon *Daemon) getDNSSearchSettings(cfg *config.Config, container *container.Container) []string {

 	if len(container.HostConfig.DNSSearch) > 0 {

 		return container.HostConfig.DNSSearch

 	}

-	if len(daemon.configStore.DNSSearch) > 0 {

-		return daemon.configStore.DNSSearch

+	if len(cfg.DNSSearch) > 0 {

+		return cfg.DNSSearch

 	}

 	return nil

 }

-func (daemon *Daemon) buildSandboxOptions(container *container.Container) ([]libnetwork.SandboxOption, error) {

+func (daemon *Daemon) buildSandboxOptions(cfg *config.Config, container *container.Container) ([]libnetwork.SandboxOption, error) {

 	var (

 		sboxOptions []libnetwork.SandboxOption

 		err         error

@@ -61,21 +62,21 @@ func (daemon *Daemon) buildSandboxOptions(container *container.Container) ([]lib

 		sboxOptions = append(sboxOptions, libnetwork.OptionUseExternalKey())

 	}

-	if err = daemon.setupPathsAndSandboxOptions(container, &sboxOptions); err != nil {

+	if err = daemon.setupPathsAndSandboxOptions(container, cfg, &sboxOptions); err != nil {

 		return nil, err

 	}

 	if len(container.HostConfig.DNS) > 0 {

 		dns = container.HostConfig.DNS

-	} else if len(daemon.configStore.DNS) > 0 {

-		dns = daemon.configStore.DNS

+	} else if len(cfg.DNS) > 0 {

+		dns = cfg.DNS

 	}

 	for _, d := range dns {

 		sboxOptions = append(sboxOptions, libnetwork.OptionDNS(d))

 	}

-	dnsSearch := daemon.getDNSSearchSettings(container)

+	dnsSearch := daemon.getDNSSearchSettings(cfg, container)

 	for _, ds := range dnsSearch {

 		sboxOptions = append(sboxOptions, libnetwork.OptionDNSSearch(ds))

@@ -83,8 +84,8 @@ func (daemon *Daemon) buildSandboxOptions(container *container.Container) ([]lib

 	if len(container.HostConfig.DNSOptions) > 0 {

 		dnsOptions = container.HostConfig.DNSOptions

-	} else if len(daemon.configStore.DNSOptions) > 0 {

-		dnsOptions = daemon.configStore.DNSOptions

+	} else if len(cfg.DNSOptions) > 0 {

+		dnsOptions = cfg.DNSOptions

 	}

 	for _, ds := range dnsOptions {

@@ -112,7 +113,7 @@ func (daemon *Daemon) buildSandboxOptions(container *container.Container) ([]lib

 		// value with the IP address stored in the daemon level HostGatewayIP

 		// config variable

 		if ip == opts.HostGatewayName {

-			gateway := daemon.configStore.HostGatewayIP.String()

+			gateway := cfg.HostGatewayIP.String()

 			if gateway == "" {

 				return nil, fmt.Errorf("unable to derive the IP value for host-gateway")

 			}

@@ -218,7 +219,7 @@ func (daemon *Daemon) buildSandboxOptions(container *container.Container) ([]lib

 	}

 	for alias, parent := range daemon.parents(container) {

-		if daemon.configStore.DisableBridge || !container.HostConfig.NetworkMode.IsPrivate() {

+		if cfg.DisableBridge || !container.HostConfig.NetworkMode.IsPrivate() {

 			continue

 		}

@@ -291,13 +292,13 @@ func (daemon *Daemon) updateNetworkSettings(container *container.Container, n li

 	return nil

 }

-func (daemon *Daemon) updateEndpointNetworkSettings(container *container.Container, n libnetwork.Network, ep *libnetwork.Endpoint) error {

+func (daemon *Daemon) updateEndpointNetworkSettings(cfg *config.Config, container *container.Container, n libnetwork.Network, ep *libnetwork.Endpoint) error {

 	if err := buildEndpointInfo(container.NetworkSettings, n, ep); err != nil {

 		return err

 	}

 	if container.HostConfig.NetworkMode == runconfig.DefaultDaemonNetworkMode() {

-		container.NetworkSettings.Bridge = daemon.configStore.BridgeConfig.Iface

+		container.NetworkSettings.Bridge = cfg.BridgeConfig.Iface

 	}

 	return nil

@@ -305,7 +306,7 @@ func (daemon *Daemon) updateEndpointNetworkSettings(container *container.Contain

 // UpdateNetwork is used to update the container's network (e.g. when linked containers

 // get removed/unlinked).

-func (daemon *Daemon) updateNetwork(container *container.Container) error {

+func (daemon *Daemon) updateNetwork(cfg *config.Config, container *container.Container) error {

 	var (

 		start = time.Now()

 		ctrl  = daemon.netController

@@ -335,7 +336,7 @@ func (daemon *Daemon) updateNetwork(container *container.Container) error {

 		return nil

 	}

-	sbOptions, err := daemon.buildSandboxOptions(container)

+	sbOptions, err := daemon.buildSandboxOptions(cfg, container)

 	if err != nil {

 		return fmt.Errorf("Update network failed: %v", err)

 	}

@@ -519,7 +520,7 @@ func (daemon *Daemon) updateContainerNetworkSettings(container *container.Contai

 	}

 }

-func (daemon *Daemon) allocateNetwork(container *container.Container) (retErr error) {

+func (daemon *Daemon) allocateNetwork(cfg *config.Config, container *container.Container) (retErr error) {

 	if daemon.netController == nil {

 		return nil

 	}

@@ -552,7 +553,7 @@ func (daemon *Daemon) allocateNetwork(container *container.Container) (retErr er

 	defaultNetName := runconfig.DefaultDaemonNetworkMode().NetworkName()

 	if nConf, ok := container.NetworkSettings.Networks[defaultNetName]; ok {

 		cleanOperationalData(nConf)

-		if err := daemon.connectToNetwork(container, defaultNetName, nConf.EndpointSettings, updateSettings); err != nil {

+		if err := daemon.connectToNetwork(cfg, container, defaultNetName, nConf.EndpointSettings, updateSettings); err != nil {

 			return err

 		}

 	}

@@ -569,7 +570,7 @@ func (daemon *Daemon) allocateNetwork(container *container.Container) (retErr er

 	for netName, epConf := range networks {

 		cleanOperationalData(epConf)

-		if err := daemon.connectToNetwork(container, netName, epConf.EndpointSettings, updateSettings); err != nil {

+		if err := daemon.connectToNetwork(cfg, container, netName, epConf.EndpointSettings, updateSettings); err != nil {

 			return err

 		}

 	}

@@ -578,7 +579,7 @@ func (daemon *Daemon) allocateNetwork(container *container.Container) (retErr er

 	// create its network sandbox now if not present

 	if len(networks) == 0 {

 		if nil == daemon.getNetworkSandbox(container) {

-			sbOptions, err := daemon.buildSandboxOptions(container)

+			sbOptions, err := daemon.buildSandboxOptions(cfg, container)

 			if err != nil {

 				return err

 			}

@@ -722,13 +723,13 @@ func (daemon *Daemon) updateNetworkConfig(container *container.Container, n libn

 	return nil

 }

-func (daemon *Daemon) connectToNetwork(container *container.Container, idOrName string, endpointConfig *networktypes.EndpointSettings, updateSettings bool) (err error) {

+func (daemon *Daemon) connectToNetwork(cfg *config.Config, container *container.Container, idOrName string, endpointConfig *networktypes.EndpointSettings, updateSettings bool) (err error) {

 	start := time.Now()

 	if container.HostConfig.NetworkMode.IsContainer() {

 		return runconfig.ErrConflictSharedNetwork

 	}

 	if containertypes.NetworkMode(idOrName).IsBridge() &&

-		daemon.configStore.DisableBridge {

+		cfg.DisableBridge {

 		container.Config.NetworkDisabled = true

 		return nil

 	}

@@ -766,7 +767,7 @@ func (daemon *Daemon) connectToNetwork(container *container.Container, idOrName

 	controller := daemon.netController

 	sb := daemon.getNetworkSandbox(container)

-	createOptions, err := buildCreateEndpointOptions(container, n, endpointConfig, sb, daemon.configStore.DNS)

+	createOptions, err := buildCreateEndpointOptions(container, n, endpointConfig, sb, cfg.DNS)

 	if err != nil {

 		return err

 	}

@@ -790,12 +791,12 @@ func (daemon *Daemon) connectToNetwork(container *container.Container, idOrName

 	delete(container.NetworkSettings.Networks, n.ID())

-	if err := daemon.updateEndpointNetworkSettings(container, n, ep); err != nil {

+	if err := daemon.updateEndpointNetworkSettings(cfg, container, n, ep); err != nil {

 		return err

 	}

 	if sb == nil {

-		sbOptions, err := daemon.buildSandboxOptions(container)

+		sbOptions, err := daemon.buildSandboxOptions(cfg, container)

 		if err != nil {

 			return err

 		}

@@ -946,7 +947,7 @@ func (daemon *Daemon) tryDetachContainerFromClusterNetwork(network libnetwork.Ne

 	daemon.LogNetworkEventWithAttributes(network, "disconnect", attributes)

 }

-func (daemon *Daemon) initializeNetworking(container *container.Container) error {

+func (daemon *Daemon) initializeNetworking(cfg *config.Config, container *container.Container) error {

 	var err error

 	if container.HostConfig.NetworkMode.IsContainer() {

@@ -975,7 +976,7 @@ func (daemon *Daemon) initializeNetworking(container *container.Container) error

 		}

 	}

-	if err := daemon.allocateNetwork(container); err != nil {

+	if err := daemon.allocateNetwork(cfg, container); err != nil {

 		return err

 	}

@@ -1074,7 +1075,7 @@ func (daemon *Daemon) ConnectToNetwork(container *container.Container, idOrName

 			}

 		}

 	} else {

-		if err := daemon.connectToNetwork(container, idOrName, endpointConfig, true); err != nil {

+		if err := daemon.connectToNetwork(daemon.config(), container, idOrName, endpointConfig, true); err != nil {

 			return err

 		}

 	}

@@ -10,6 +10,7 @@ import (

 	"syscall"

 	"github.com/docker/docker/container"

+	"github.com/docker/docker/daemon/config"

 	"github.com/docker/docker/daemon/links"

 	"github.com/docker/docker/errdefs"

 	"github.com/docker/docker/libnetwork"

@@ -380,7 +381,7 @@ func serviceDiscoveryOnDefaultNetwork() bool {

 	return false

 }

-func (daemon *Daemon) setupPathsAndSandboxOptions(container *container.Container, sboxOptions *[]libnetwork.SandboxOption) error {

+func (daemon *Daemon) setupPathsAndSandboxOptions(container *container.Container, cfg *config.Config, sboxOptions *[]libnetwork.SandboxOption) error {

 	var err error

 	// Set the correct paths for /etc/hosts and /etc/resolv.conf, based on the

@@ -427,7 +428,7 @@ func (daemon *Daemon) setupPathsAndSandboxOptions(container *container.Container

 		// Copy the host's resolv.conf for the container (/run/systemd/resolve/resolv.conf or /etc/resolv.conf)

 		*sboxOptions = append(

 			*sboxOptions,

-			libnetwork.OptionOriginResolvConfPath(daemon.configStore.GetResolvConf()),

+			libnetwork.OptionOriginResolvConfPath(cfg.GetResolvConf()),

 		)

 	}

@@ -5,6 +5,7 @@ import (

 	"os"

 	"github.com/docker/docker/container"

+	"github.com/docker/docker/daemon/config"

 	"github.com/docker/docker/libnetwork"

 	"github.com/docker/docker/pkg/system"

 	"github.com/pkg/errors"

@@ -161,7 +162,7 @@ func serviceDiscoveryOnDefaultNetwork() bool {

 	return true

 }

-func (daemon *Daemon) setupPathsAndSandboxOptions(container *container.Container, sboxOptions *[]libnetwork.SandboxOption) error {

+func (daemon *Daemon) setupPathsAndSandboxOptions(container *container.Container, cfg *config.Config, sboxOptions *[]libnetwork.SandboxOption) error {

 	return nil

 }

@@ -33,8 +33,9 @@ func TestContainerWarningHostAndPublishPorts(t *testing.T) {

 		}

 		cs := &config.Config{}

 		configureRuntimes(cs)

-		d := &Daemon{configStore: cs}

-		wrns, err := d.verifyContainerSettings(hostConfig, &containertypes.Config{}, false)

+		d := &Daemon{}

+		d.configStore.Store(cs)

+		wrns, err := d.verifyContainerSettings(cs, hostConfig, &containertypes.Config{}, false)

 		assert.NilError(t, err)

 		assert.DeepEqual(t, tc.warnings, wrns)

 	}

@@ -14,6 +14,7 @@ import (

 	imagetypes "github.com/docker/docker/api/types/image"

 	networktypes "github.com/docker/docker/api/types/network"

 	"github.com/docker/docker/container"

+	"github.com/docker/docker/daemon/config"

 	"github.com/docker/docker/daemon/images"

 	"github.com/docker/docker/errdefs"

 	"github.com/docker/docker/image"

@@ -34,7 +35,7 @@ type createOpts struct {

 // CreateManagedContainer creates a container that is managed by a Service

 func (daemon *Daemon) CreateManagedContainer(ctx context.Context, params types.ContainerCreateConfig) (containertypes.CreateResponse, error) {

-	return daemon.containerCreate(ctx, createOpts{

+	return daemon.containerCreate(ctx, daemon.config(), createOpts{

 		params:  params,

 		managed: true,

 	})

@@ -42,7 +43,7 @@ func (daemon *Daemon) CreateManagedContainer(ctx context.Context, params types.C

 // ContainerCreate creates a regular container

 func (daemon *Daemon) ContainerCreate(ctx context.Context, params types.ContainerCreateConfig) (containertypes.CreateResponse, error) {

-	return daemon.containerCreate(ctx, createOpts{

+	return daemon.containerCreate(ctx, daemon.config(), createOpts{

 		params: params,

 	})

 }

@@ -50,19 +51,19 @@ func (daemon *Daemon) ContainerCreate(ctx context.Context, params types.Containe

 // ContainerCreateIgnoreImagesArgsEscaped creates a regular container. This is called from the builder RUN case

 // and ensures that we do not take the images ArgsEscaped

 func (daemon *Daemon) ContainerCreateIgnoreImagesArgsEscaped(ctx context.Context, params types.ContainerCreateConfig) (containertypes.CreateResponse, error) {

-	return daemon.containerCreate(ctx, createOpts{

+	return daemon.containerCreate(ctx, daemon.config(), createOpts{

 		params:                  params,

 		ignoreImagesArgsEscaped: true,

 	})

 }

-func (daemon *Daemon) containerCreate(ctx context.Context, opts createOpts) (containertypes.CreateResponse, error) {

+func (daemon *Daemon) containerCreate(ctx context.Context, daemonCfg *config.Config, opts createOpts) (containertypes.CreateResponse, error) {

 	start := time.Now()

 	if opts.params.Config == nil {

 		return containertypes.CreateResponse{}, errdefs.InvalidParameter(errors.New("Config cannot be empty in order to create a container"))

 	}

-	warnings, err := daemon.verifyContainerSettings(opts.params.HostConfig, opts.params.Config, false)

+	warnings, err := daemon.verifyContainerSettings(daemonCfg, opts.params.HostConfig, opts.params.Config, false)

 	if err != nil {

 		return containertypes.CreateResponse{Warnings: warnings}, errdefs.InvalidParameter(err)

 	}

@@ -94,12 +95,12 @@ func (daemon *Daemon) containerCreate(ctx context.Context, opts createOpts) (con

 	if opts.params.HostConfig == nil {

 		opts.params.HostConfig = &containertypes.HostConfig{}

 	}

-	err = daemon.adaptContainerSettings(opts.params.HostConfig, opts.params.AdjustCPUShares)

+	err = daemon.adaptContainerSettings(daemonCfg, opts.params.HostConfig, opts.params.AdjustCPUShares)

 	if err != nil {

 		return containertypes.CreateResponse{Warnings: warnings}, errdefs.InvalidParameter(err)

 	}

-	ctr, err := daemon.create(ctx, opts)

+	ctr, err := daemon.create(ctx, daemonCfg, opts)

 	if err != nil {

 		return containertypes.CreateResponse{Warnings: warnings}, err

 	}

@@ -113,7 +114,7 @@ func (daemon *Daemon) containerCreate(ctx context.Context, opts createOpts) (con

 }

 // Create creates a new container from the given configuration with a given name.

-func (daemon *Daemon) create(ctx context.Context, opts createOpts) (retC *container.Container, retErr error) {

+func (daemon *Daemon) create(ctx context.Context, daemonCfg *config.Config, opts createOpts) (retC *container.Container, retErr error) {

 	var (

 		ctr         *container.Container

 		img         *image.Image

@@ -175,7 +176,7 @@ func (daemon *Daemon) create(ctx context.Context, opts createOpts) (retC *contai

 		}

 	}()

-	if err := daemon.setSecurityOptions(ctr, opts.params.HostConfig); err != nil {

+	if err := daemon.setSecurityOptions(daemonCfg, ctr, opts.params.HostConfig); err != nil {

 		return nil, err

 	}

@@ -16,6 +16,7 @@ import (

 	"runtime"

 	"strings"

 	"sync"

+	"sync/atomic"

 	"time"

 	"github.com/containerd/containerd"

@@ -84,7 +85,8 @@ type Daemon struct {

 	containersReplica     *container.ViewDB

 	execCommands          *container.ExecStore

 	imageService          ImageService

-	configStore           *config.Config

+	configStore           atomic.Pointer[config.Config]

+	configReload          sync.Mutex

 	statsCollector        *stats.Collector

 	defaultLogConfig      containertypes.LogConfig

 	registryService       *registry.Service

@@ -148,20 +150,31 @@ func (daemon *Daemon) StoreHosts(hosts []string) {

 	}

 }

+// config returns an immutable snapshot of the current daemon configuration.

+// Multiple calls to this function will return the same pointer until the

+// configuration is reloaded so callers must take care not to modify the

+// returned value.

+//

+// To ensure that the configuration used remains consistent throughout the

+// lifetime of an operation, the configuration pointer should be passed down the

+// call stack, like one would a [context.Context] value. Only the entrypoints

+// for operations, the outermost functions, should call this function.

+func (daemon *Daemon) config() *config.Config {

+	cfg := daemon.configStore.Load()

+	if cfg == nil {

+		return &config.Config{}

+	}

+	return cfg

+}

+

 // HasExperimental returns whether the experimental features of the daemon are enabled or not

 func (daemon *Daemon) HasExperimental() bool {

-	return daemon.configStore != nil && daemon.configStore.Experimental

+	return daemon.config().Experimental

 }

 // Features returns the features map from configStore

 func (daemon *Daemon) Features() map[string]bool {

-	daemon.configStore.Lock()

-	defer daemon.configStore.Unlock()

-	f := make(map[string]bool, len(daemon.configStore.Features))

-	for k, v := range daemon.configStore.Features {

-		f[k] = v

-	}

-	return f

+	return daemon.config().Features

 }

 // UsesSnapshotter returns true if feature flag to use containerd snapshotter is enabled

@@ -172,17 +185,14 @@ func (daemon *Daemon) UsesSnapshotter() bool {

 // RegistryHosts returns the registry hosts configuration for the host component

 // of a distribution image reference.

 func (daemon *Daemon) RegistryHosts(host string) ([]docker.RegistryHost, error) {

-	daemon.configStore.Lock()

-	serviceOpts := daemon.configStore.ServiceOptions

-	daemon.configStore.Unlock()

-

 	var (

+		conf        = daemon.config()

 		registryKey = "docker.io"

-		mirrors     = make([]string, len(serviceOpts.Mirrors))

+		mirrors     = make([]string, len(conf.Mirrors))

 		m           = map[string]resolverconfig.RegistryConfig{}

 	)

 	// must trim "https://" or "http://" prefix

-	for i, v := range serviceOpts.Mirrors {

+	for i, v := range conf.Mirrors {

 		if uri, err := url.Parse(v); err == nil {

 			v = uri.Host

 		}

@@ -191,7 +201,7 @@ func (daemon *Daemon) RegistryHosts(host string) ([]docker.RegistryHost, error)

 	// set mirrors for default registry

 	m[registryKey] = resolverconfig.RegistryConfig{Mirrors: mirrors}

-	for _, v := range serviceOpts.InsecureRegistries {

+	for _, v := range conf.InsecureRegistries {

 		u, err := url.Parse(v)

 		if err != nil && !strings.HasPrefix(v, "http://") && !strings.HasPrefix(v, "https://") {

 			originalErr := err

@@ -237,7 +247,7 @@ type layerAccessor interface {

 	GetLayerByID(cid string) (layer.RWLayer, error)

 }

-func (daemon *Daemon) restore() error {

+func (daemon *Daemon) restore(cfg *config.Config) error {

 	var mapLock sync.Mutex

 	containers := make(map[string]*container.Container)

@@ -377,7 +387,7 @@ func (daemon *Daemon) restore() error {

 							logger(c).WithError(err).Error("failed to delete task from containerd")

 							return

 						}

-					} else if !daemon.configStore.LiveRestoreEnabled {

+					} else if !cfg.LiveRestoreEnabled {

 						logger(c).Debug("shutting down container considered alive by containerd")

 						if err := daemon.shutdownContainer(c); err != nil && !errdefs.IsNotFound(err) {

 							log.WithError(err).Error("error shutting down container")

@@ -457,7 +467,7 @@ func (daemon *Daemon) restore() error {

 				c.ResetRestartManager(false)

 				if !c.HostConfig.NetworkMode.IsContainer() && c.IsRunning() {

-					options, err := daemon.buildSandboxOptions(c)

+					options, err := daemon.buildSandboxOptions(cfg, c)

 					if err != nil {

 						logger(c).WithError(err).Warn("failed to build sandbox option to restore container")

 					}

@@ -475,7 +485,7 @@ func (daemon *Daemon) restore() error {

 			// not initialized yet. We will start

 			// it after the cluster is

 			// initialized.

-			if daemon.configStore.AutoRestart && c.ShouldRestart() && !c.NetworkSettings.HasSwarmEndpoint && c.HasBeenStartedBefore {

+			if cfg.AutoRestart && c.ShouldRestart() && !c.NetworkSettings.HasSwarmEndpoint && c.HasBeenStartedBefore {

 				mapLock.Lock()

 				restartContainers[c] = make(chan struct{})

 				mapLock.Unlock()

@@ -513,7 +523,7 @@ func (daemon *Daemon) restore() error {

 	//

 	// Note that we cannot initialize the network controller earlier, as it

 	// needs to know if there's active sandboxes (running containers).

-	if err = daemon.initNetworkController(activeSandboxes); err != nil {

+	if err = daemon.initNetworkController(cfg, activeSandboxes); err != nil {

 		return fmt.Errorf("Error initializing network controller: %v", err)

 	}

@@ -560,7 +570,7 @@ func (daemon *Daemon) restore() error {

 			if err := daemon.prepareMountPoints(c); err != nil {

 				log.WithError(err).Error("failed to prepare mount points for container")

 			}

-			if err := daemon.containerStart(context.Background(), c, "", "", true); err != nil {

+			if err := daemon.containerStart(context.Background(), cfg, c, "", "", true); err != nil {

 				log.WithError(err).Error("failed to start container")

 			}

 			close(chNotify)

@@ -576,7 +586,7 @@ func (daemon *Daemon) restore() error {

 		go func(cid string) {

 			_ = sem.Acquire(context.Background(), 1)

-			if err := daemon.ContainerRm(cid, &types.ContainerRmConfig{ForceRemove: true, RemoveVolume: true}); err != nil {

+			if err := daemon.containerRm(cfg, cid, &types.ContainerRmConfig{ForceRemove: true, RemoveVolume: true}); err != nil {

 				logrus.WithField("container", cid).WithError(err).Error("failed to remove container")

 			}

@@ -624,7 +634,7 @@ func (daemon *Daemon) restore() error {

 // RestartSwarmContainers restarts any autostart container which has a

 // swarm endpoint.

-func (daemon *Daemon) RestartSwarmContainers() {

+func (daemon *Daemon) RestartSwarmContainers(cfg *config.Config) {

 	ctx := context.Background()

 	// parallelLimit is the maximum number of parallel startup jobs that we

@@ -642,7 +652,7 @@ func (daemon *Daemon) RestartSwarmContainers() {

 			// Autostart all the containers which has a

 			// swarm endpoint now that the cluster is

 			// initialized.

-			if daemon.configStore.AutoRestart && c.ShouldRestart() && c.NetworkSettings.HasSwarmEndpoint && c.HasBeenStartedBefore {

+			if cfg.AutoRestart && c.ShouldRestart() && c.NetworkSettings.HasSwarmEndpoint && c.HasBeenStartedBefore {

 				group.Add(1)

 				go func(c *container.Container) {

 					if err := sem.Acquire(ctx, 1); err != nil {

@@ -651,7 +661,7 @@ func (daemon *Daemon) RestartSwarmContainers() {

 						return

 					}

-					if err := daemon.containerStart(ctx, c, "", "", true); err != nil {

+					if err := daemon.containerStart(ctx, cfg, c, "", "", true); err != nil {

 						logrus.WithField("container", c.ID).WithError(err).Error("failed to start swarm container")

 					}

@@ -735,10 +745,7 @@ func (daemon *Daemon) setClusterProvider(clusterProvider cluster.Provider) {

 // IsSwarmCompatible verifies if the current daemon

 // configuration is compatible with the swarm mode

 func (daemon *Daemon) IsSwarmCompatible() error {

-	if daemon.configStore == nil {

-		return nil

-	}

-	return daemon.configStore.IsSwarmCompatible()

+	return daemon.config().IsSwarmCompatible()

 }

 // NewDaemon sets up everything for the daemon to be able to service

@@ -800,10 +807,10 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S

 	}

 	d := &Daemon{

-		configStore: config,

 		PluginStore: pluginStore,

 		startupDone: make(chan struct{}),

 	}

+	d.configStore.Store(config)

 	// TEST_INTEGRATION_USE_SNAPSHOTTER is used for integration tests only.

 	if os.Getenv("TEST_INTEGRATION_USE_SNAPSHOTTER") != "" {

@@ -834,12 +841,12 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S

 	}

 	d.setupDumpStackTrap(stackDumpDir)

-	if err := d.setupSeccompProfile(); err != nil {

+	if err := d.setupSeccompProfile(config); err != nil {

 		return nil, err

 	}

 	// Set the default isolation mode (only applicable on Windows)

-	if err := d.setDefaultIsolation(); err != nil {

+	if err := d.setDefaultIsolation(config); err != nil {

 		return nil, fmt.Errorf("error setting default isolation mode: %v", err)

 	}

@@ -881,7 +888,7 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S

 	d.registryService = registryService

 	dlogger.RegisterPluginGetter(d.PluginStore)

-	metricsSockPath, err := d.listenMetricsSock()

+	metricsSockPath, err := d.listenMetricsSock(config)

 	if err != nil {

 		return nil, err

 	}

@@ -942,7 +949,7 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S

 			shimOpts interface{}

 		)

 		if runtime.GOOS != "windows" {

-			shim, shimOpts, err = d.getRuntime(config.GetDefaultRuntimeName())

+			shim, shimOpts, err = d.getRuntime(config, config.DefaultRuntime)

 			if err != nil {

 				return nil, err

 			}

@@ -965,9 +972,11 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S

 		return nil, errors.Wrap(err, "couldn't create plugin manager")

 	}

-	if err := d.setupDefaultLogConfig(); err != nil {

-		return nil, err

+	d.defaultLogConfig, err = defaultLogConfig(config)

+	if err != nil {

+		return nil, errors.Wrap(err, "failed to set log opts")

 	}

+	logrus.Debugf("Using default logging driver %s", d.defaultLogConfig.Type)

 	d.volumes, err = volumesservice.NewVolumeService(config.Root, d.PluginStore, rootIDs, d)

 	if err != nil {

@@ -982,7 +991,7 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S

 	// at this point.

 	//

 	// TODO(thaJeztah) add a utility to only collect the CgroupDevicesEnabled information

-	if runtime.GOOS == "linux" && !userns.RunningInUserNS() && !getSysInfo(d).CgroupDevicesEnabled {

+	if runtime.GOOS == "linux" && !userns.RunningInUserNS() && !getSysInfo(config).CgroupDevicesEnabled {

 		return nil, errors.New("Devices cgroup isn't mounted")

 	}

@@ -1135,11 +1144,11 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S

 	go d.execCommandGC()

-	if err := d.initLibcontainerd(ctx); err != nil {

+	if err := d.initLibcontainerd(ctx, config); err != nil {

 		return nil, err

 	}

-	if err := d.restore(); err != nil {

+	if err := d.restore(config); err != nil {

 		return nil, err

 	}

 	close(d.startupDone)

@@ -1201,7 +1210,11 @@ func (daemon *Daemon) shutdownContainer(c *container.Container) error {

 // A negative (-1) timeout means "indefinitely", which means that containers

 // are not forcibly killed, and the daemon shuts down after all containers exit.

 func (daemon *Daemon) ShutdownTimeout() int {

-	shutdownTimeout := daemon.configStore.ShutdownTimeout

+	return daemon.shutdownTimeout(daemon.config())

+}

+

+func (daemon *Daemon) shutdownTimeout(cfg *config.Config) int {

+	shutdownTimeout := cfg.ShutdownTimeout

 	if shutdownTimeout < 0 {

 		return -1

 	}

@@ -1228,7 +1241,8 @@ func (daemon *Daemon) Shutdown(ctx context.Context) error {

 	// Keep mounts and networking running on daemon shutdown if

 	// we are to keep containers running and restore them.

-	if daemon.configStore.LiveRestoreEnabled && daemon.containers != nil {

+	cfg := daemon.config()

+	if cfg.LiveRestoreEnabled && daemon.containers != nil {

 		// check if there are any running containers, if none we should do some cleanup

 		if ls, err := daemon.Containers(ctx, &types.ContainerListOptions{}); len(ls) != 0 || err != nil {

 			// metrics plugins still need some cleanup

@@ -1238,8 +1252,8 @@ func (daemon *Daemon) Shutdown(ctx context.Context) error {

 	}

 	if daemon.containers != nil {

-		logrus.Debugf("daemon configured with a %d seconds minimum shutdown timeout", daemon.configStore.ShutdownTimeout)

-		logrus.Debugf("start clean shutdown of all containers with a %d seconds timeout...", daemon.ShutdownTimeout())

+		logrus.Debugf("daemon configured with a %d seconds minimum shutdown timeout", cfg.ShutdownTimeout)

+		logrus.Debugf("start clean shutdown of all containers with a %d seconds timeout...", daemon.shutdownTimeout(cfg))

 		daemon.containers.ApplyAll(func(c *container.Container) {

 			if !c.IsRunning() {

 				return

@@ -1293,7 +1307,7 @@ func (daemon *Daemon) Shutdown(ctx context.Context) error {

 		daemon.mdDB.Close()

 	}

-	return daemon.cleanupMounts()

+	return daemon.cleanupMounts(cfg)

 }

 // Mount sets container.BaseFS

@@ -1374,15 +1388,10 @@ func isBridgeNetworkDisabled(conf *config.Config) bool {

 	return conf.BridgeConfig.Iface == config.DisableNetworkBridge

 }

-func (daemon *Daemon) networkOptions(pg plugingetter.PluginGetter, activeSandboxes map[string]interface{}) ([]nwconfig.Option, error) {

-	options := []nwconfig.Option{}

-	if daemon.configStore == nil {

-		return options, nil

-	}

-	conf := daemon.configStore

+func (daemon *Daemon) networkOptions(conf *config.Config, pg plugingetter.PluginGetter, activeSandboxes map[string]interface{}) ([]nwconfig.Option, error) {

 	dd := runconfig.DefaultDaemonNetworkMode()

-	options = []nwconfig.Option{

+	options := []nwconfig.Option{

 		nwconfig.OptionDataDir(conf.Root),

 		nwconfig.OptionExecRoot(conf.GetExecRoot()),

 		nwconfig.OptionDefaultDriver(string(dd)),

@@ -1514,7 +1523,7 @@ func (daemon *Daemon) RawSysInfo() *sysinfo.SysInfo {

 		// We check if sysInfo is not set here, to allow some test to

 		// override the actual sysInfo.

 		if daemon.sysInfo == nil {

-			daemon.sysInfo = getSysInfo(daemon)

+			daemon.sysInfo = getSysInfo(daemon.config())

 		}

 	})

@@ -76,7 +76,7 @@ func (daemon *Daemon) cleanupMountsFromReaderByID(reader io.Reader, id string, u

 }

 // cleanupMounts umounts used by container resources and the daemon root mount

-func (daemon *Daemon) cleanupMounts() error {

+func (daemon *Daemon) cleanupMounts(cfg *config.Config) error {

 	if err := daemon.cleanupMountsByID(""); err != nil {

 		return err

 	}

@@ -100,7 +100,7 @@ func (daemon *Daemon) cleanupMounts() error {

 		return nil

 	}

-	unmountFile := getUnmountOnShutdownPath(daemon.configStore)

+	unmountFile := getUnmountOnShutdownPath(cfg)

 	if _, err := os.Stat(unmountFile); err != nil {

 		return nil

 	}

@@ -239,14 +239,14 @@ func kernelSupportsRecursivelyReadOnly() error {

 	return kernelSupportsRROErr

 }

-func (daemon *Daemon) supportsRecursivelyReadOnly(runtime string) error {

+func supportsRecursivelyReadOnly(cfg *config.Config, runtime string) error {

 	if err := kernelSupportsRecursivelyReadOnly(); err != nil {

 		return fmt.Errorf("rro is not supported: %w (kernel is older than 5.12?)", err)

 	}

 	if runtime == "" {

-		runtime = daemon.configStore.GetDefaultRuntimeName()

+		runtime = cfg.DefaultRuntime

 	}

-	rt := daemon.configStore.GetRuntime(runtime)

+	rt := cfg.GetRuntime(runtime)

 	if rt.Features == nil {

 		return fmt.Errorf("rro is not supported by runtime %q: OCI features struct is not available", runtime)

 	}