@@ -253,6 +253,7 @@ func (cli *DaemonCli) start(opts *daemonOptions) (err error) {

 		Root:                   cli.Config.Root,

 		Name:                   name,

 		Backend:                d,

+		ImageBackend:           d.ImageService(),

 		PluginBackend:          d.PluginManager(),

 		NetworkSubnetsProvider: d,

 		DefaultAdvertiseAddr:   cli.Config.SwarmDefaultAdvertiseAddr,

@@ -345,12 +346,12 @@ func newRouterOptions(config *config.Config, daemon *daemon.Daemon) (routerOptio

 		return opts, errors.Wrap(err, "failed to create fscache")

 	}

-	manager, err := dockerfile.NewBuildManager(daemon, sm, buildCache, daemon.IDMappings())

+	manager, err := dockerfile.NewBuildManager(daemon.BuilderBackend(), sm, buildCache, daemon.IDMappings())

 	if err != nil {

 		return opts, err

 	}

-	bb, err := buildbackend.NewBackend(daemon, manager, buildCache)

+	bb, err := buildbackend.NewBackend(daemon.ImageService(), manager, buildCache)

 	if err != nil {

 		return opts, errors.Wrap(err, "failed to create buildmanager")

 	}

@@ -507,14 +508,14 @@ func initRouter(opts routerOptions) {

 		// we need to add the checkpoint router before the container router or the DELETE gets masked

 		checkpointrouter.NewRouter(opts.daemon, decoder),

 		container.NewRouter(opts.daemon, decoder),

-		image.NewRouter(opts.daemon),

+		image.NewRouter(opts.daemon.ImageService()),

 		systemrouter.NewRouter(opts.daemon, opts.cluster, opts.buildCache),

 		volume.NewRouter(opts.daemon),

 		build.NewRouter(opts.buildBackend, opts.daemon),

 		sessionrouter.NewRouter(opts.sessionManager),

 		swarmrouter.NewRouter(opts.cluster),

 		pluginrouter.NewRouter(opts.daemon.PluginManager()),

-		distributionrouter.NewRouter(opts.daemon),

+		distributionrouter.NewRouter(opts.daemon.ImageService()),

 	}

 	if opts.daemon.NetworkControllerEnabled() {

deleted file mode 100644

@@ -1,225 +0,0 @@

-package daemon // import "github.com/docker/docker/daemon"

-

-import (

-	"io"

-

-	"github.com/docker/distribution/reference"

-	"github.com/docker/docker/api/types"

-	"github.com/docker/docker/api/types/backend"

-	"github.com/docker/docker/builder"

-	"github.com/docker/docker/image"

-	"github.com/docker/docker/layer"

-	"github.com/docker/docker/pkg/containerfs"

-	"github.com/docker/docker/pkg/idtools"

-	"github.com/docker/docker/pkg/stringid"

-	"github.com/docker/docker/pkg/system"

-	"github.com/docker/docker/registry"

-	"github.com/pkg/errors"

-	"golang.org/x/net/context"

-)

-

-type roLayer struct {

-	released   bool

-	layerStore layer.Store

-	roLayer    layer.Layer

-}

-

-func (l *roLayer) DiffID() layer.DiffID {

-	if l.roLayer == nil {

-		return layer.DigestSHA256EmptyTar

-	}

-	return l.roLayer.DiffID()

-}

-

-func (l *roLayer) Release() error {

-	if l.released {

-		return nil

-	}

-	if l.roLayer != nil {

-		metadata, err := l.layerStore.Release(l.roLayer)

-		layer.LogReleaseMetadata(metadata)

-		if err != nil {

-			return errors.Wrap(err, "failed to release ROLayer")

-		}

-	}

-	l.roLayer = nil

-	l.released = true

-	return nil

-}

-

-func (l *roLayer) NewRWLayer() (builder.RWLayer, error) {

-	var chainID layer.ChainID

-	if l.roLayer != nil {

-		chainID = l.roLayer.ChainID()

-	}

-

-	mountID := stringid.GenerateRandomID()

-	newLayer, err := l.layerStore.CreateRWLayer(mountID, chainID, nil)

-	if err != nil {

-		return nil, errors.Wrap(err, "failed to create rwlayer")

-	}

-

-	rwLayer := &rwLayer{layerStore: l.layerStore, rwLayer: newLayer}

-

-	fs, err := newLayer.Mount("")

-	if err != nil {

-		rwLayer.Release()

-		return nil, err

-	}

-

-	rwLayer.fs = fs

-

-	return rwLayer, nil

-}

-

-type rwLayer struct {

-	released   bool

-	layerStore layer.Store

-	rwLayer    layer.RWLayer

-	fs         containerfs.ContainerFS

-}

-

-func (l *rwLayer) Root() containerfs.ContainerFS {

-	return l.fs

-}

-

-func (l *rwLayer) Commit() (builder.ROLayer, error) {

-	stream, err := l.rwLayer.TarStream()

-	if err != nil {

-		return nil, err

-	}

-	defer stream.Close()

-

-	var chainID layer.ChainID

-	if parent := l.rwLayer.Parent(); parent != nil {

-		chainID = parent.ChainID()

-	}

-

-	newLayer, err := l.layerStore.Register(stream, chainID)

-	if err != nil {

-		return nil, err

-	}

-	// TODO: An optimization would be to handle empty layers before returning

-	return &roLayer{layerStore: l.layerStore, roLayer: newLayer}, nil

-}

-

-func (l *rwLayer) Release() error {

-	if l.released {

-		return nil

-	}

-

-	if l.fs != nil {

-		if err := l.rwLayer.Unmount(); err != nil {

-			return errors.Wrap(err, "failed to unmount RWLayer")

-		}

-		l.fs = nil

-	}

-

-	metadata, err := l.layerStore.ReleaseRWLayer(l.rwLayer)

-	layer.LogReleaseMetadata(metadata)

-	if err != nil {

-		return errors.Wrap(err, "failed to release RWLayer")

-	}

-	l.released = true

-	return nil

-}

-

-func newROLayerForImage(img *image.Image, layerStore layer.Store) (builder.ROLayer, error) {

-	if img == nil || img.RootFS.ChainID() == "" {

-		return &roLayer{layerStore: layerStore}, nil

-	}

-	// Hold a reference to the image layer so that it can't be removed before

-	// it is released

-	layer, err := layerStore.Get(img.RootFS.ChainID())

-	if err != nil {

-		return nil, errors.Wrapf(err, "failed to get layer for image %s", img.ImageID())

-	}

-	return &roLayer{layerStore: layerStore, roLayer: layer}, nil

-}

-

-// TODO: could this use the regular daemon PullImage ?

-func (daemon *Daemon) pullForBuilder(ctx context.Context, name string, authConfigs map[string]types.AuthConfig, output io.Writer, os string) (*image.Image, error) {

-	ref, err := reference.ParseNormalizedNamed(name)

-	if err != nil {

-		return nil, err

-	}

-	ref = reference.TagNameOnly(ref)

-

-	pullRegistryAuth := &types.AuthConfig{}

-	if len(authConfigs) > 0 {

-		// The request came with a full auth config, use it

-		repoInfo, err := daemon.RegistryService.ResolveRepository(ref)

-		if err != nil {

-			return nil, err

-		}

-

-		resolvedConfig := registry.ResolveAuthConfig(authConfigs, repoInfo.Index)

-		pullRegistryAuth = &resolvedConfig

-	}

-

-	if err := daemon.pullImageWithReference(ctx, ref, os, nil, pullRegistryAuth, output); err != nil {

-		return nil, err

-	}

-	return daemon.GetImage(name)

-}

-

-// GetImageAndReleasableLayer returns an image and releaseable layer for a reference or ID.

-// Every call to GetImageAndReleasableLayer MUST call releasableLayer.Release() to prevent

-// leaking of layers.

-func (daemon *Daemon) GetImageAndReleasableLayer(ctx context.Context, refOrID string, opts backend.GetImageAndLayerOptions) (builder.Image, builder.ROLayer, error) {

-	if refOrID == "" {

-		if !system.IsOSSupported(opts.OS) {

-			return nil, nil, system.ErrNotSupportedOperatingSystem

-		}

-		layer, err := newROLayerForImage(nil, daemon.layerStores[opts.OS])

-		return nil, layer, err

-	}

-

-	if opts.PullOption != backend.PullOptionForcePull {

-		image, err := daemon.GetImage(refOrID)

-		if err != nil && opts.PullOption == backend.PullOptionNoPull {

-			return nil, nil, err

-		}

-		// TODO: shouldn't we error out if error is different from "not found" ?

-		if image != nil {

-			if !system.IsOSSupported(image.OperatingSystem()) {

-				return nil, nil, system.ErrNotSupportedOperatingSystem

-			}

-			layer, err := newROLayerForImage(image, daemon.layerStores[image.OperatingSystem()])

-			return image, layer, err

-		}

-	}

-

-	image, err := daemon.pullForBuilder(ctx, refOrID, opts.AuthConfig, opts.Output, opts.OS)

-	if err != nil {

-		return nil, nil, err

-	}

-	if !system.IsOSSupported(image.OperatingSystem()) {

-		return nil, nil, system.ErrNotSupportedOperatingSystem

-	}

-	layer, err := newROLayerForImage(image, daemon.layerStores[image.OperatingSystem()])

-	return image, layer, err

-}

-

-// CreateImage creates a new image by adding a config and ID to the image store.

-// This is similar to LoadImage() except that it receives JSON encoded bytes of

-// an image instead of a tar archive.

-func (daemon *Daemon) CreateImage(config []byte, parent string) (builder.Image, error) {

-	id, err := daemon.imageStore.Create(config)

-	if err != nil {

-		return nil, errors.Wrapf(err, "failed to create image")

-	}

-

-	if parent != "" {

-		if err := daemon.imageStore.SetParent(id, image.ID(parent)); err != nil {

-			return nil, errors.Wrapf(err, "failed to set parent %s", parent)

-		}

-	}

-

-	return daemon.imageStore.Get(id)

-}

-

-// IDMappings returns uid/gid mappings for the builder

-func (daemon *Daemon) IDMappings() *idtools.IDMappings {

-	return daemon.idMappings

-}

deleted file mode 100644

@@ -1,27 +0,0 @@

-package daemon // import "github.com/docker/docker/daemon"

-

-import (

-	"github.com/docker/docker/builder"

-	"github.com/docker/docker/image/cache"

-	"github.com/sirupsen/logrus"

-)

-

-// MakeImageCache creates a stateful image cache.

-func (daemon *Daemon) MakeImageCache(sourceRefs []string) builder.ImageCache {

-	if len(sourceRefs) == 0 {

-		return cache.NewLocal(daemon.imageStore)

-	}

-

-	cache := cache.New(daemon.imageStore)

-

-	for _, ref := range sourceRefs {

-		img, err := daemon.GetImage(ref)

-		if err != nil {

-			logrus.Warnf("Could not look up %s for cache resolution, skipping: %+v", ref, err)

-			continue

-		}

-		cache.Populate(img)

-	}

-

-	return cache

-}

@@ -83,6 +83,7 @@ type Config struct {

 	Root                   string

 	Name                   string

 	Backend                executorpkg.Backend

+	ImageBackend           executorpkg.ImageBackend

 	PluginBackend          plugin.Backend

 	NetworkSubnetsProvider NetworkSubnetsProvider

@@ -31,7 +31,6 @@ type Backend interface {

 	FindNetwork(idName string) (libnetwork.Network, error)

 	SetupIngress(clustertypes.NetworkCreateRequest, string) (<-chan struct{}, error)

 	ReleaseIngress() (<-chan struct{}, error)

-	PullImage(ctx context.Context, image, tag, platform string, metaHeaders map[string][]string, authConfig *types.AuthConfig, outStream io.Writer) error

 	CreateManagedContainer(config types.ContainerCreateConfig) (container.ContainerCreateCreatedBody, error)

 	ContainerStart(name string, hostConfig *container.HostConfig, checkpoint string, checkpointDir string) error

 	ContainerStop(name string, seconds *int) error

@@ -58,9 +57,14 @@ type Backend interface {

 	UnsubscribeFromEvents(listener chan interface{})

 	UpdateAttachment(string, string, string, *network.NetworkingConfig) error

 	WaitForDetachment(context.Context, string, string, string, string) error

-	GetRepository(context.Context, reference.Named, *types.AuthConfig) (distribution.Repository, bool, error)

-	LookupImage(name string) (*types.ImageInspect, error)

 	PluginManager() *plugin.Manager

 	PluginGetter() *plugin.Store

 	GetAttachmentStore() *networkSettings.AttachmentStore

 }

+

+// ImageBackend is used by an executor to perform image operations

+type ImageBackend interface {

+	PullImage(ctx context.Context, image, tag, platform string, metaHeaders map[string][]string, authConfig *types.AuthConfig, outStream io.Writer) error

+	GetRepository(context.Context, reference.Named, *types.AuthConfig) (distribution.Repository, bool, error)

+	LookupImage(name string) (*types.ImageInspect, error)

+}

@@ -36,11 +36,12 @@ import (

 // containerConfig.

 type containerAdapter struct {

 	backend      executorpkg.Backend

+	imageBackend executorpkg.ImageBackend

 	container    *containerConfig

 	dependencies exec.DependencyGetter

 }

-func newContainerAdapter(b executorpkg.Backend, task *api.Task, node *api.NodeDescription, dependencies exec.DependencyGetter) (*containerAdapter, error) {

+func newContainerAdapter(b executorpkg.Backend, i executorpkg.ImageBackend, task *api.Task, node *api.NodeDescription, dependencies exec.DependencyGetter) (*containerAdapter, error) {

 	ctnr, err := newContainerConfig(task, node)

 	if err != nil {

 		return nil, err

@@ -49,6 +50,7 @@ func newContainerAdapter(b executorpkg.Backend, task *api.Task, node *api.NodeDe

 	return &containerAdapter{

 		container:    ctnr,

 		backend:      b,

+		imageBackend: i,

 		dependencies: dependencies,

 	}, nil

 }

@@ -66,7 +68,7 @@ func (c *containerAdapter) pullImage(ctx context.Context) error {

 	named, err := reference.ParseNormalizedNamed(spec.Image)

 	if err == nil {

 		if _, ok := named.(reference.Canonical); ok {

-			_, err := c.backend.LookupImage(spec.Image)

+			_, err := c.imageBackend.LookupImage(spec.Image)

 			if err == nil {

 				return nil

 			}

@@ -92,7 +94,7 @@ func (c *containerAdapter) pullImage(ctx context.Context) error {

 		// TODO @jhowardmsft LCOW Support: This will need revisiting as

 		// the stack is built up to include LCOW support for swarm.

 		platform := runtime.GOOS

-		err := c.backend.PullImage(ctx, c.container.image(), "", platform, metaHeaders, authConfig, pw)

+		err := c.imageBackend.PullImage(ctx, c.container.image(), "", platform, metaHeaders, authConfig, pw)

 		pw.CloseWithError(err)

 	}()

@@ -20,8 +20,8 @@ type networkAttacherController struct {

 	closed  chan struct{}

 }

-func newNetworkAttacherController(b executorpkg.Backend, task *api.Task, node *api.NodeDescription, dependencies exec.DependencyGetter) (*networkAttacherController, error) {

-	adapter, err := newContainerAdapter(b, task, node, dependencies)

+func newNetworkAttacherController(b executorpkg.Backend, i executorpkg.ImageBackend, task *api.Task, node *api.NodeDescription, dependencies exec.DependencyGetter) (*networkAttacherController, error) {

+	adapter, err := newContainerAdapter(b, i, task, node, dependencies)

 	if err != nil {

 		return nil, err

 	}

@@ -40,8 +40,8 @@ type controller struct {

 var _ exec.Controller = &controller{}

 // NewController returns a docker exec runner for the provided task.

-func newController(b executorpkg.Backend, task *api.Task, node *api.NodeDescription, dependencies exec.DependencyGetter) (*controller, error) {

-	adapter, err := newContainerAdapter(b, task, node, dependencies)

+func newController(b executorpkg.Backend, i executorpkg.ImageBackend, task *api.Task, node *api.NodeDescription, dependencies exec.DependencyGetter) (*controller, error) {

+	adapter, err := newContainerAdapter(b, i, task, node, dependencies)

 	if err != nil {

 		return nil, err

 	}

@@ -26,6 +26,7 @@ import (

 type executor struct {

 	backend       executorpkg.Backend

+	imageBackend  executorpkg.ImageBackend

 	pluginBackend plugin.Backend

 	dependencies  exec.DependencyManager

 	mutex         sync.Mutex // This mutex protects the following node field

@@ -33,10 +34,11 @@ type executor struct {

 }

 // NewExecutor returns an executor from the docker client.

-func NewExecutor(b executorpkg.Backend, p plugin.Backend) exec.Executor {

+func NewExecutor(b executorpkg.Backend, p plugin.Backend, i executorpkg.ImageBackend) exec.Executor {

 	return &executor{

 		backend:       b,

 		pluginBackend: p,

+		imageBackend:  i,

 		dependencies:  agent.NewDependencyManager(),

 	}

 }

@@ -200,7 +202,7 @@ func (e *executor) Controller(t *api.Task) (exec.Controller, error) {

 	e.mutex.Unlock()

 	if t.Spec.GetAttachment() != nil {

-		return newNetworkAttacherController(e.backend, t, nodeDescription, dependencyGetter)

+		return newNetworkAttacherController(e.backend, e.imageBackend, t, nodeDescription, dependencyGetter)

 	}

 	var ctlr exec.Controller

@@ -229,7 +231,7 @@ func (e *executor) Controller(t *api.Task) (exec.Controller, error) {

 			return ctlr, fmt.Errorf("unsupported runtime type: %q", runtimeKind)

 		}

 	case *api.TaskSpec_Container:

-		c, err := newController(e.backend, t, nodeDescription, dependencyGetter)

+		c, err := newController(e.backend, e.imageBackend, t, nodeDescription, dependencyGetter)

 		if err != nil {

 			return ctlr, err

 		}

@@ -52,7 +52,7 @@ func TestHealthStates(t *testing.T) {

 		EventsService: e,

 	}

-	controller, err := newController(daemon, task, nil, nil)

+	controller, err := newController(daemon, nil, task, nil, nil)

 	if err != nil {

 		t.Fatalf("create controller fail %v", err)

 	}

@@ -12,7 +12,7 @@ import (

 )

 func newTestControllerWithMount(m api.Mount) (*controller, error) {

-	return newController(&daemon.Daemon{}, &api.Task{

+	return newController(&daemon.Daemon{}, nil, &api.Task{

 		ID:        stringid.GenerateRandomID(),

 		ServiceID: stringid.GenerateRandomID(),

 		Spec: api.TaskSpec{

@@ -120,12 +120,15 @@ func (n *nodeRunner) start(conf nodeStartConfig) error {

 		JoinAddr:           joinAddr,

 		StateDir:           n.cluster.root,

 		JoinToken:          conf.joinToken,

-		Executor:           container.NewExecutor(n.cluster.config.Backend, n.cluster.config.PluginBackend),

-		HeartbeatTick:      1,

-		ElectionTick:       3,

-		UnlockKey:          conf.lockKey,

-		AutoLockManagers:   conf.autolock,

-		PluginGetter:       n.cluster.config.Backend.PluginGetter(),

+		Executor: container.NewExecutor(

+			n.cluster.config.Backend,

+			n.cluster.config.PluginBackend,

+			n.cluster.config.ImageBackend),

+		HeartbeatTick:    1,

+		ElectionTick:     3,

+		UnlockKey:        conf.lockKey,

+		AutoLockManagers: conf.autolock,

+		PluginGetter:     n.cluster.config.Backend.PluginGetter(),

 	}

 	if conf.availability != "" {

 		avail, ok := swarmapi.NodeSpec_Availability_value[strings.ToUpper(string(conf.availability))]

@@ -570,7 +570,7 @@ func (c *Cluster) imageWithDigestString(ctx context.Context, image string, authC

 			return "", errors.Errorf("image reference not tagged: %s", image)

 		}

-		repo, _, err := c.config.Backend.GetRepository(ctx, taggedRef, authConfig)

+		repo, _, err := c.config.ImageBackend.GetRepository(ctx, taggedRef, authConfig)

 		if err != nil {

 			return "", err

 		}

@@ -155,7 +155,7 @@ func (daemon *Daemon) CreateImageFromContainer(name string, c *backend.CreateIma

 		return "", err

 	}

-	id, err := daemon.commitImage(backend.CommitConfig{

+	id, err := daemon.imageService.CommitImage(backend.CommitConfig{

 		Author:              c.Author,

 		Comment:             c.Comment,

 		Config:              newConfig,

@@ -171,7 +171,7 @@ func (daemon *Daemon) CreateImageFromContainer(name string, c *backend.CreateIma

 	var imageRef string

 	if c.Repo != "" {

-		imageRef, err = daemon.TagImage(string(id), c.Repo, c.Tag)

+		imageRef, err = daemon.imageService.TagImage(string(id), c.Repo, c.Tag)

 		if err != nil {

 			return "", err

 		}

@@ -158,7 +158,7 @@ func (daemon *Daemon) newContainer(name string, operatingSystem string, config *

 	base.ImageID = imgID

 	base.NetworkSettings = &network.Settings{IsAnonymousEndpoint: noExplicitName}

 	base.Name = name

-	base.Driver = daemon.GraphDriverName(operatingSystem)

+	base.Driver = daemon.imageService.GraphDriverForOS(operatingSystem)

 	base.OS = operatingSystem

 	return base, err

 }

@@ -64,12 +64,6 @@ func (daemon *Daemon) setupConfigDir(c *container.Container) (setupErr error) {

 	return nil

 }

-// getSize returns real size & virtual size

-func (daemon *Daemon) getSize(containerID string) (int64, int64) {

-	// TODO Windows

-	return 0, 0

-}

-

 func (daemon *Daemon) setupIpcDirs(container *container.Container) error {

 	return nil

 }

@@ -15,7 +15,6 @@ import (

 	"github.com/docker/docker/container"

 	"github.com/docker/docker/errdefs"

 	"github.com/docker/docker/image"

-	"github.com/docker/docker/layer"

 	"github.com/docker/docker/pkg/idtools"

 	"github.com/docker/docker/pkg/stringid"

 	"github.com/docker/docker/pkg/system"

@@ -42,7 +41,7 @@ func (daemon *Daemon) containerCreate(params types.ContainerCreateConfig, manage

 	os := runtime.GOOS

 	if params.Config.Image != "" {

-		img, err := daemon.GetImage(params.Config.Image)

+		img, err := daemon.imageService.GetImage(params.Config.Image)

 		if err == nil {

 			os = img.OS

 		}

@@ -92,7 +91,7 @@ func (daemon *Daemon) create(params types.ContainerCreateConfig, managed bool) (

 	os := runtime.GOOS

 	if params.Config.Image != "" {

-		img, err = daemon.GetImage(params.Config.Image)

+		img, err = daemon.imageService.GetImage(params.Config.Image)

 		if err != nil {

 			return nil, err

 		}

@@ -158,9 +157,11 @@ func (daemon *Daemon) create(params types.ContainerCreateConfig, managed bool) (

 	}

 	// Set RWLayer for container after mount labels have been set

-	if err := daemon.setRWLayer(container); err != nil {

+	rwLayer, err := daemon.imageService.CreateLayer(container, setupInitLayer(daemon.idMappings))

+	if err != nil {

 		return nil, errdefs.System(err)

 	}

+	container.RWLayer = rwLayer

 	rootIDs := daemon.idMappings.RootPair()

 	if err := idtools.MkdirAndChown(container.Root, 0700, rootIDs); err != nil {

@@ -254,33 +255,6 @@ func (daemon *Daemon) generateSecurityOpt(hostConfig *containertypes.HostConfig)

 	return nil, nil

 }

-func (daemon *Daemon) setRWLayer(container *container.Container) error {

-	var layerID layer.ChainID

-	if container.ImageID != "" {

-		img, err := daemon.imageStore.Get(container.ImageID)

-		if err != nil {

-			return err

-		}

-		layerID = img.RootFS.ChainID()

-	}

-

-	rwLayerOpts := &layer.CreateRWLayerOpts{

-		MountLabel: container.MountLabel,

-		InitFunc:   setupInitLayer(daemon.idMappings),

-		StorageOpt: container.HostConfig.StorageOpt,

-	}

-

-	// Indexing by OS is safe here as validation of OS has already been performed in create() (the only

-	// caller), and guaranteed non-nil

-	rwLayer, err := daemon.layerStores[container.OS].CreateRWLayer(container.ID, layerID, rwLayerOpts)

-	if err != nil {

-		return err

-	}

-	container.RWLayer = rwLayer

-

-	return nil

-}

-

 // VolumeCreate creates a volume with the specified name, driver, and opts

 // This is called directly from the Engine API

 func (daemon *Daemon) VolumeCreate(name, driverName string, opts, labels map[string]string) (*types.Volume, error) {

@@ -21,11 +21,13 @@ import (

 	"github.com/docker/docker/api/types"

 	containertypes "github.com/docker/docker/api/types/container"

 	"github.com/docker/docker/api/types/swarm"

+	"github.com/docker/docker/builder"

 	"github.com/docker/docker/container"

 	"github.com/docker/docker/daemon/config"

 	"github.com/docker/docker/daemon/discovery"

 	"github.com/docker/docker/daemon/events"

 	"github.com/docker/docker/daemon/exec"

+	"github.com/docker/docker/daemon/images"

 	"github.com/docker/docker/daemon/logger"

 	"github.com/docker/docker/daemon/network"

 	"github.com/docker/docker/errdefs"

@@ -34,7 +36,6 @@ import (

 	_ "github.com/docker/docker/daemon/graphdriver/register"

 	"github.com/docker/docker/daemon/stats"

 	dmetadata "github.com/docker/docker/distribution/metadata"

-	"github.com/docker/docker/distribution/xfer"

 	"github.com/docker/docker/dockerversion"

 	"github.com/docker/docker/image"

 	"github.com/docker/docker/layer"

@@ -57,7 +58,6 @@ import (

 	"github.com/docker/libnetwork"

 	"github.com/docker/libnetwork/cluster"

 	nwconfig "github.com/docker/libnetwork/config"

-	"github.com/docker/libtrust"

 	"github.com/pkg/errors"

 )

@@ -70,44 +70,38 @@ var (

 // Daemon holds information about the Docker daemon.

 type Daemon struct {

-	ID                        string

-	repository                string

-	containers                container.Store

-	containersReplica         container.ViewDB

-	execCommands              *exec.Store

-	downloadManager           *xfer.LayerDownloadManager

-	uploadManager             *xfer.LayerUploadManager

-	trustKey                  libtrust.PrivateKey

-	idIndex                   *truncindex.TruncIndex

-	configStore               *config.Config

-	statsCollector            *stats.Collector

-	defaultLogConfig          containertypes.LogConfig

-	RegistryService           registry.Service

-	EventsService             *events.Events

-	netController             libnetwork.NetworkController

-	volumes                   *store.VolumeStore

-	discoveryWatcher          discovery.Reloader

-	root                      string

-	seccompEnabled            bool

-	apparmorEnabled           bool

-	shutdown                  bool

-	idMappings                *idtools.IDMappings

-	graphDrivers              map[string]string // By operating system

-	referenceStore            refstore.Store

-	imageStore                image.Store

-	imageRoot                 string

-	layerStores               map[string]layer.Store // By operating system

-	distributionMetadataStore dmetadata.Store

-	PluginStore               *plugin.Store // todo: remove

-	pluginManager             *plugin.Manager

-	linkIndex                 *linkIndex

-	containerd                libcontainerd.Client

-	containerdRemote          libcontainerd.Remote

-	defaultIsolation          containertypes.Isolation // Default isolation mode on Windows

-	clusterProvider           cluster.Provider

-	cluster                   Cluster

-	genericResources          []swarm.GenericResource

-	metricsPluginListener     net.Listener

+	ID                string

+	repository        string

+	containers        container.Store

+	containersReplica container.ViewDB

+	execCommands      *exec.Store

+	imageService      *images.ImageService

+	idIndex           *truncindex.TruncIndex

+	configStore       *config.Config

+	statsCollector    *stats.Collector

+	defaultLogConfig  containertypes.LogConfig

+	RegistryService   registry.Service

+	EventsService     *events.Events

+	netController     libnetwork.NetworkController

+	volumes           *store.VolumeStore

+	discoveryWatcher  discovery.Reloader

+	root              string

+	seccompEnabled    bool

+	apparmorEnabled   bool

+	shutdown          bool

+	idMappings        *idtools.IDMappings

+	// TODO: move graphDrivers field to an InfoService

+	graphDrivers map[string]string // By operating system

+

+	PluginStore           *plugin.Store // todo: remove

+	pluginManager         *plugin.Manager

+	linkIndex             *linkIndex

+	containerd            libcontainerd.Client

+	defaultIsolation      containertypes.Isolation // Default isolation mode on Windows

+	clusterProvider       cluster.Provider

+	cluster               Cluster

+	genericResources      []swarm.GenericResource

+	metricsPluginListener net.Listener

 	machineMemory uint64

@@ -162,7 +156,7 @@ func (daemon *Daemon) restore() error {

 		// Ignore the container if it does not support the current driver being used by the graph

 		currentDriverForContainerOS := daemon.graphDrivers[container.OS]

 		if (container.Driver == "" && currentDriverForContainerOS == "aufs") || container.Driver == currentDriverForContainerOS {

-			rwlayer, err := daemon.layerStores[container.OS].GetRWLayer(container.ID)

+			rwlayer, err := daemon.imageService.GetLayerByID(container.ID, container.OS)

 			if err != nil {

 				logrus.Errorf("Failed to load container mount %v: %v", id, err)

 				continue

@@ -705,7 +699,7 @@ func NewDaemon(config *config.Config, registryService registry.Service, containe

 	// be set through an environment variable, a daemon start parameter, or chosen through

 	// initialization of the layerstore through driver priority order for example.

 	d.graphDrivers = make(map[string]string)

-	d.layerStores = make(map[string]layer.Store)

+	layerStores := make(map[string]layer.Store)

 	if runtime.GOOS == "windows" {

 		d.graphDrivers[runtime.GOOS] = "windowsfilter"

 		if system.LCOWSupported() {

@@ -754,7 +748,7 @@ func NewDaemon(config *config.Config, registryService registry.Service, containe

 	}

 	for operatingSystem, gd := range d.graphDrivers {

-		d.layerStores[operatingSystem], err = layer.NewStoreFromOptions(layer.StoreOptions{

+		layerStores[operatingSystem], err = layer.NewStoreFromOptions(layer.StoreOptions{

 			Root: config.Root,

 			MetadataStorePathTemplate: filepath.Join(config.Root, "image", "%s", "layerdb"),

 			GraphDriver:               gd,

@@ -771,7 +765,7 @@ func NewDaemon(config *config.Config, registryService registry.Service, containe

 	// As layerstore initialization may set the driver

 	for os := range d.graphDrivers {

-		d.graphDrivers[os] = d.layerStores[os].DriverName()

+		d.graphDrivers[os] = layerStores[os].DriverName()

 	}

 	// Configure and validate the kernels security support. Note this is a Linux/FreeBSD

@@ -780,22 +774,17 @@ func NewDaemon(config *config.Config, registryService registry.Service, containe

 		return nil, err

 	}

-	logrus.Debugf("Max Concurrent Downloads: %d", *config.MaxConcurrentDownloads)

-	d.downloadManager = xfer.NewLayerDownloadManager(d.layerStores, *config.MaxConcurrentDownloads)

-	logrus.Debugf("Max Concurrent Uploads: %d", *config.MaxConcurrentUploads)

-	d.uploadManager = xfer.NewLayerUploadManager(*config.MaxConcurrentUploads)

-

-	d.imageRoot = filepath.Join(config.Root, "image", d.graphDrivers[runtime.GOOS])

-	ifs, err := image.NewFSStoreBackend(filepath.Join(d.imageRoot, "imagedb"))

+	imageRoot := filepath.Join(config.Root, "image", d.graphDrivers[runtime.GOOS])

+	ifs, err := image.NewFSStoreBackend(filepath.Join(imageRoot, "imagedb"))

 	if err != nil {

 		return nil, err

 	}

 	lgrMap := make(map[string]image.LayerGetReleaser)

-	for os, ls := range d.layerStores {

+	for os, ls := range layerStores {

 		lgrMap[os] = ls

 	}

-	d.imageStore, err = image.NewImageStore(ifs, lgrMap)

+	imageStore, err := image.NewImageStore(ifs, lgrMap)

 	if err != nil {

 		return nil, err

 	}

@@ -817,8 +806,6 @@ func NewDaemon(config *config.Config, registryService registry.Service, containe

 		return nil, err

 	}

-	eventsService := events.New()

-

 	// We have a single tag/reference store for the daemon globally. However, it's

 	// stored under the graphdriver. On host platforms which only support a single

 	// container OS, but multiple selectable graphdrivers, this means depending on which

@@ -829,14 +816,13 @@ func NewDaemon(config *config.Config, registryService registry.Service, containe

 	// operating systems, the list of graphdrivers available isn't user configurable.

 	// For backwards compatibility, we just put it under the windowsfilter

 	// directory regardless.

-	refStoreLocation := filepath.Join(d.imageRoot, `repositories.json`)

+	refStoreLocation := filepath.Join(imageRoot, `repositories.json`)

 	rs, err := refstore.NewReferenceStore(refStoreLocation)

 	if err != nil {

 		return nil, fmt.Errorf("Couldn't create reference store repository: %s", err)

 	}

-	d.referenceStore = rs

-	d.distributionMetadataStore, err = dmetadata.NewFSMetadataStore(filepath.Join(d.imageRoot, "distribution"))

+	distributionMetadataStore, err := dmetadata.NewFSMetadataStore(filepath.Join(imageRoot, "distribution"))

 	if err != nil {

 		return nil, err

 	}

@@ -844,7 +830,7 @@ func NewDaemon(config *config.Config, registryService registry.Service, containe

 	// No content-addressability migration on Windows as it never supported pre-CA

 	if runtime.GOOS != "windows" {

 		migrationStart := time.Now()

-		if err := v1.Migrate(config.Root, d.graphDrivers[runtime.GOOS], d.layerStores[runtime.GOOS], d.imageStore, rs, d.distributionMetadataStore); err != nil {

+		if err := v1.Migrate(config.Root, d.graphDrivers[runtime.GOOS], layerStores[runtime.GOOS], imageStore, rs, distributionMetadataStore); err != nil {

 			logrus.Errorf("Graph migration failed: %q. Your old graph data was found to be too inconsistent for upgrading to content-addressable storage. Some of the old data was probably not upgraded. We recommend starting over with a clean storage directory if possible.", err)

 		}

 		logrus.Infof("Graph migration to content-addressability took %.2f seconds", time.Since(migrationStart).Seconds())

@@ -870,20 +856,34 @@ func NewDaemon(config *config.Config, registryService registry.Service, containe

 		return nil, err

 	}

 	d.execCommands = exec.NewStore()

-	d.trustKey = trustKey

 	d.idIndex = truncindex.NewTruncIndex([]string{})

 	d.statsCollector = d.newStatsCollector(1 * time.Second)

-	d.EventsService = eventsService

+	d.EventsService = events.New()

 	d.volumes = volStore

 	d.root = config.Root

 	d.idMappings = idMappings

 	d.seccompEnabled = sysInfo.Seccomp

 	d.apparmorEnabled = sysInfo.AppArmor

-	d.containerdRemote = containerdRemote

 	d.linkIndex = newLinkIndex()

+	// TODO: imageStore, distributionMetadataStore, and ReferenceStore are only

+	// used above to run migration. They could be initialized in ImageService

+	// if migration is called from daemon/images. layerStore might move as well.

+	d.imageService = images.NewImageService(images.ImageServiceConfig{

+		ContainerStore:            d.containers,

+		DistributionMetadataStore: distributionMetadataStore,

+		EventsService:             d.EventsService,

+		ImageStore:                imageStore,

+		LayerStores:               layerStores,

+		MaxConcurrentDownloads:    *config.MaxConcurrentDownloads,

+		MaxConcurrentUploads:      *config.MaxConcurrentUploads,

+		ReferenceStore:            rs,

+		RegistryService:           registryService,

+		TrustKey:                  trustKey,

+	})

+

 	go d.execCommandGC()

 	d.containerd, err = containerdRemote.NewClient(ContainersNamespace, d)

@@ -1005,7 +1005,7 @@ func (daemon *Daemon) Shutdown() error {

 				logrus.Errorf("Stop container error: %v", err)

 				return

 			}

-			if mountid, err := daemon.layerStores[c.OS].GetMountID(c.ID); err == nil {

+			if mountid, err := daemon.imageService.GetLayerMountID(c.ID, c.OS); err == nil {

 				daemon.cleanupMountsByID(mountid)

 			}

 			logrus.Debugf("container stopped %s", c.ID)

@@ -1018,12 +1018,8 @@ func (daemon *Daemon) Shutdown() error {

 		}

 	}