@@ -21,6 +21,7 @@ linters:

     - dogsled                   # Detects assignments with too many blank identifiers.

     - dupword                   # Detects duplicate words.

     - durationcheck             # Detect cases where two time.Duration values are being multiplied in possibly erroneous ways.

+    - errorlint                 # Detects code that will cause problems with the error wrapping scheme introduced in Go 1.13.

     - errchkjson                # Detects unsupported types passed to json encoding functions and reports if checks for the returned error can be omitted.

     - exhaustive                # Detects missing options in enum switch statements.

     - exptostd                  # Detects functions from golang.org/x/exp/ that can be replaced by std functions.

@@ -75,6 +76,13 @@ linters:

         - "false"   # some tests use this as expected output

         - "root"    # for tests using "ls" output with files owned by "root:root"

+    errorlint:

+      # Check whether fmt.Errorf uses the %w verb for formatting errors.

+      # See the https://github.com/polyfloyd/go-errorlint for caveats.

+      errorf: false

+      # Check for plain type assertions and type switches.

+      asserts: false

+

     exhaustive:

       # Program elements to check for exhaustiveness.

       # Default: [ switch ]

@@ -74,7 +74,7 @@ func ReadJSON(r *http.Request, out interface{}) error {

 	err = dec.Decode(out)

 	defer r.Body.Close()

 	if err != nil {

-		if err == io.EOF {

+		if errors.Is(err, io.EOF) {

 			return errdefs.InvalidParameter(errors.New("invalid JSON: got EOF while reading request body"))

 		}

 		return errdefs.InvalidParameter(errors.Wrap(err, "invalid JSON"))

@@ -108,14 +108,14 @@ func (dr *distributionRouter) fetchManifest(ctx context.Context, distrepo distri

 	}

 	mnfst, err := mnfstsrvc.Get(ctx, distributionInspect.Descriptor.Digest)

 	if err != nil {

-		switch err {

-		case reference.ErrReferenceInvalidFormat,

-			reference.ErrTagInvalidFormat,

-			reference.ErrDigestInvalidFormat,

-			reference.ErrNameContainsUppercase,

-			reference.ErrNameEmpty,

-			reference.ErrNameTooLong,

-			reference.ErrNameNotCanonical:

+		switch {

+		case errors.Is(err, reference.ErrReferenceInvalidFormat),

+			errors.Is(err, reference.ErrTagInvalidFormat),

+			errors.Is(err, reference.ErrDigestInvalidFormat),

+			errors.Is(err, reference.ErrNameContainsUppercase),

+			errors.Is(err, reference.ErrNameEmpty),

+			errors.Is(err, reference.ErrNameTooLong),

+			errors.Is(err, reference.ErrNameNotCanonical):

 			return registry.DistributionInspect{}, errdefs.InvalidParameter(err)

 		}

 		return registry.DistributionInspect{}, err

@@ -96,7 +96,7 @@ func inspectResponse(ct string, r io.Reader, clen int64) (string, io.Reader, err

 	if rlen == 0 {

 		return ct, r, errors.New("empty response")

 	}

-	if err != nil && err != io.EOF {

+	if err != nil && !errors.Is(err, io.EOF) {

 		return ct, r, err

 	}

@@ -3,6 +3,7 @@ package client

 import (

 	"bytes"

 	"context"

+	"errors"

 	"fmt"

 	"io"

 	"log"

@@ -167,7 +168,7 @@ func ExampleClient_ContainerLogs_withTimeout() {

 	}

 	_, err = io.Copy(os.Stdout, reader)

-	if err != nil && err != io.EOF {

+	if err != nil && !errors.Is(err, io.EOF) {

 		log.Fatal(err)

 	}

 }

@@ -4,6 +4,7 @@ import (

 	"bytes"

 	"context"

 	"encoding/json"

+	"errors"

 	"fmt"

 	"io"

 	"net/http"

@@ -143,7 +144,7 @@ func TestEvents(t *testing.T) {

 		for {

 			select {

 			case err := <-errs:

-				if err != nil && err != io.EOF {

+				if err != nil && !errors.Is(err, io.EOF) {

 					t.Fatal(err)

 				}

@@ -3,6 +3,7 @@ package client

 import (

 	"bytes"

 	"context"

+	"errors"

 	"fmt"

 	"io"

 	"log"

@@ -138,7 +139,7 @@ func ExampleClient_ServiceLogs_withTimeout() {

 	}

 	_, err = io.Copy(os.Stdout, reader)

-	if err != nil && err != io.EOF {

+	if err != nil && !errors.Is(err, io.EOF) {

 		log.Fatal(err)

 	}

 }

@@ -121,7 +121,7 @@ func (proxy *UDPProxy) replyLoop(cte *connTrackEntry, serverAddr net.IP, clientA

 	again:

 		read, err := cte.conn.Read(readBuf)

 		if err != nil {

-			if err, ok := err.(*net.OpError); ok && err.Err == syscall.ECONNREFUSED {

+			if err, ok := err.(*net.OpError); ok && errors.Is(err.Err, syscall.ECONNREFUSED) {

 				// This will happen if the last write failed

 				// (e.g: nothing is actually listening on the

 				// proxied port on the container), ignore it

@@ -86,7 +86,7 @@ func (c *Config) CopyStreams(ctx context.Context, cfg *AttachConfig) <-chan erro

 			} else {

 				_, err = pools.Copy(cfg.CStdin, cfg.Stdin)

 			}

-			if err == io.ErrClosedPipe {

+			if errors.Is(err, io.ErrClosedPipe) {

 				err = nil

 			}

 			if err != nil {

@@ -109,7 +109,7 @@ func (c *Config) CopyStreams(ctx context.Context, cfg *AttachConfig) <-chan erro

 		}()

 		_, err := pools.Copy(stream, streamPipe)

-		if err == io.ErrClosedPipe {

+		if errors.Is(err, io.ErrClosedPipe) {

 			err = nil

 		}

 		if err != nil {

@@ -2,6 +2,7 @@ package bytespipe

 import (

 	"bytes"

+	"errors"

 	"testing"

 )

@@ -42,7 +43,7 @@ func TestFixedBufferLen(t *testing.T) {

 	if n != 0 {

 		t.Fatalf("expected no bytes to be written to buffer, got %d", n)

 	}

-	if err != errBufferFull {

+	if !errors.Is(err, errBufferFull) {

 		t.Fatalf("expected errBufferFull, got %v", err)

 	}

@@ -99,7 +100,7 @@ func TestFixedBufferWrite(t *testing.T) {

 	if n != 59 {

 		t.Fatalf("expected 59 bytes written before buffer is full, got %d", n)

 	}

-	if err != errBufferFull {

+	if !errors.Is(err, errBufferFull) {

 		t.Fatalf("expected errBufferFull, got %v - %v", err, buf.buf[:64])

 	}

 }

@@ -71,7 +71,7 @@ loop0:

 		bp.bufLen += n

 		// errBufferFull is an error we expect to get if the buffer is full

-		if err != nil && err != errBufferFull {

+		if err != nil && !errors.Is(err, errBufferFull) {

 			bp.wait.Broadcast()

 			return written, err

 		}

@@ -354,7 +354,7 @@ func (c *Cluster) errNoManager(st nodeState) error {

 		if errors.Is(st.err, errSwarmLocked) {

 			return errSwarmLocked

 		}

-		if st.err == errSwarmCertificatesExpired {

+		if errors.Is(st.err, errSwarmCertificatesExpired) {

 			return errSwarmCertificatesExpired

 		}

 		return errors.WithStack(notAvailableError(`This node is not a swarm manager. Use "docker swarm init" or "docker swarm join" to connect this node to swarm and try again.`))

@@ -426,7 +426,7 @@ func managerStats(client swarmapi.ControlClient, currentNodeID string) (current

 }

 func detectLockedError(err error) error {

-	if err == swarmnode.ErrInvalidUnlockKey {

+	if errors.Is(err, swarmnode.ErrInvalidUnlockKey) {

 		return errors.WithStack(errSwarmLocked)

 	}

 	return err

@@ -117,7 +117,7 @@ func TestWaitCancel(t *testing.T) {

 	cancel()

 	select {

 	case err := <-chErr:

-		if err != context.Canceled {

+		if !errors.Is(err, context.Canceled) {

 			t.Fatal(err)

 		}

 	case <-time.After(10 * time.Second):

@@ -1,6 +1,7 @@

 package convert

 import (

+	"errors"

 	"testing"

 	containertypes "github.com/docker/docker/api/types/container"

@@ -148,7 +149,7 @@ func TestServiceConvertToGRPCGenericRuntimeCustom(t *testing.T) {

 		},

 	}

-	if _, err := ServiceSpecToGRPC(s); err != ErrUnsupportedRuntime {

+	if _, err := ServiceSpecToGRPC(s); !errors.Is(err, ErrUnsupportedRuntime) {

 		t.Fatal(err)

 	}

 }

@@ -409,7 +410,7 @@ func TestServiceConvertToGRPCNetworkAttachmentRuntime(t *testing.T) {

 	if err == nil {

 		t.Fatalf("expected error %v but got no error", ErrUnsupportedRuntime)

 	}

-	if err != ErrUnsupportedRuntime {

+	if !errors.Is(err, ErrUnsupportedRuntime) {

 		t.Fatalf("expected error %v but got error %v", ErrUnsupportedRuntime, err)

 	}

 }

@@ -436,7 +437,7 @@ func TestServiceConvertToGRPCMismatchedRuntime(t *testing.T) {

 			}

 			s.TaskTemplate.Runtime = rt

-			if _, err := ServiceSpecToGRPC(s); err != ErrMismatchedRuntime {

+			if _, err := ServiceSpecToGRPC(s); !errors.Is(err, ErrMismatchedRuntime) {

 				t.Fatalf("expected %v got %v", ErrMismatchedRuntime, err)

 			}

 		}

@@ -305,7 +305,7 @@ func (r *controller) Wait(pctx context.Context) error {

 	go func() {

 		ectx, cancel := context.WithCancel(ctx) // cancel event context on first event

 		defer cancel()

-		if err := r.checkHealth(ectx); err == ErrContainerUnhealthy {

+		if err := r.checkHealth(ectx); errors.Is(err, ErrContainerUnhealthy) {

 			healthErr <- ErrContainerUnhealthy

 			if err := r.Shutdown(ectx); err != nil {

 				log.G(ectx).WithError(err).Debug("shutdown failed on unhealthy")

@@ -4,6 +4,7 @@ package container

 import (

 	"context"

+	"errors"

 	"testing"

 	"time"

@@ -80,7 +81,7 @@ func TestHealthStates(t *testing.T) {

 		select {

 		case err := <-errChan:

-			if err != expectedErr {

+			if !errors.Is(err, expectedErr) {

 				t.Fatalf("expect error %v, but get %v", expectedErr, err)

 			}

 		case <-timer.C:

@@ -1,6 +1,7 @@

 package cluster

 import (

+	"errors"

 	"fmt"

 	"net"

 	"strings"

@@ -26,7 +27,7 @@ func resolveListenAddr(specifiedAddr string) (string, string, error) {

 	// system? If so, use the address from that interface.

 	specifiedIP, err := resolveInputIPAddr(specifiedHost, true)

 	if err != nil {

-		if err == errBadNetworkIdentifier {

+		if errors.Is(err, errBadNetworkIdentifier) {

 			err = errBadListenAddr

 		}

 		return "", "", err

@@ -57,7 +58,7 @@ func (c *Cluster) resolveAdvertiseAddr(advertiseAddr, listenAddrPort string) (st

 		// system? If so, use the address from that interface.

 		advertiseIP, err := resolveInputIPAddr(advertiseHost, false)

 		if err != nil {

-			if err == errBadNetworkIdentifier {

+			if errors.Is(err, errBadNetworkIdentifier) {

 				err = errBadAdvertiseAddr

 			}

 			return "", "", err

@@ -72,7 +73,7 @@ func (c *Cluster) resolveAdvertiseAddr(advertiseAddr, listenAddrPort string) (st

 		// that interface.

 		defaultAdvertiseIP, err := resolveInputIPAddr(c.config.DefaultAdvertiseAddr, false)

 		if err != nil {

-			if err == errBadNetworkIdentifier {

+			if errors.Is(err, errBadNetworkIdentifier) {

 				err = errBadDefaultAdvertiseAddr

 			}

 			return "", "", err

@@ -151,7 +152,7 @@ func resolveDataPathAddr(dataPathAddr string) (string, error) {

 	// If a data path flag is specified try to resolve the IP address.

 	dataPathIP, err := resolveInputIPAddr(dataPathAddr, false)

 	if err != nil {

-		if err == errBadNetworkIdentifier {

+		if errors.Is(err, errBadNetworkIdentifier) {

 			err = errBadDataPathAddr

 		}

 		return "", err

@@ -216,7 +217,7 @@ func resolveInputIPAddr(input string, isUnspecifiedValid bool) (net.IP, error) {

 		return interfaceAddr, nil

 	}

 	// String matched interface but there is a potential ambiguity to be resolved

-	if err != errNoSuchInterface {

+	if !errors.Is(err, errNoSuchInterface) {

 		return nil, err

 	}

@@ -513,7 +513,7 @@ func (c *Cluster) ServiceLogs(ctx context.Context, selector *backend.LogSelector

 			default:

 			}

 			subscribeMsg, err := stream.Recv()

-			if err == io.EOF {

+			if errors.Is(err, io.EOF) {

 				return

 			}

 			// if we're not io.EOF, push the message in and return

@@ -314,7 +314,7 @@ func (c *Cluster) UnlockSwarm(req types.UnlockRequest) error {

 	if !state.IsActiveManager() {

 		// when manager is not active,

 		// unless it is locked, otherwise return error.

-		if err := c.errNoManager(state); err != errSwarmLocked {

+		if err := c.errNoManager(state); !errors.Is(err, errSwarmLocked) {

 			c.mu.RUnlock()

 			return err

 		}

@@ -462,7 +462,7 @@ func killProcessDirectly(ctr *container.Container) error {

 	}

 	if err := unix.Kill(pid, syscall.SIGKILL); err != nil {

-		if err != unix.ESRCH {

+		if !errors.Is(err, unix.ESRCH) {

 			return errdefs.System(err)

 		}

 		err = errNoSuchProcess{pid, syscall.SIGKILL}

@@ -102,7 +102,7 @@ func (c cacheAdaptor) Get(id image.ID) (*image.Image, error) {

 		}

 		return nil

 	})

-	if err != nil && err != errFound {

+	if err != nil && !errors.Is(err, errFound) {

 		return nil, err

 	}

@@ -217,7 +217,7 @@ func findContentByUncompressedDigest(ctx context.Context, cs content.Manager, un

 		return errStopWalk

 	}, `labels."containerd.io/uncompressed"==`+uncompressed.String())

-	if err != nil && err != errStopWalk {

+	if err != nil && !errors.Is(err, errStopWalk) {

 		return out, err

 	}

 	if out.Digest == "" {

@@ -699,7 +699,7 @@ func setupLabelFilter(ctx context.Context, store content.Store, fltrs filters.Ar

 			return nil, errFoundConfig

 		})), nil, image.Target)

-		if err == errFoundConfig {

+		if errors.Is(err, errFoundConfig) {

 			return true

 		}

 		if err != nil {

@@ -31,7 +31,7 @@ func (i *ImageService) walkImageManifests(ctx context.Context, img c8dimages.Ima

 	handleManifest := func(ctx context.Context, d ocispec.Descriptor) error {

 		platformImg, err := i.NewImageManifest(ctx, img, d)

 		if err != nil {

-			if err == errNotManifest {

+			if errors.Is(err, errNotManifest) {

 				return nil

 			}

 			return err

@@ -59,7 +59,7 @@ func (i *ImageService) walkReachableImageManifests(ctx context.Context, img c8di

 	handleManifest := func(ctx context.Context, d ocispec.Descriptor) error {

 		platformImg, err := i.NewImageManifest(ctx, img, d)

 		if err != nil {

-			if err == errNotManifest {

+			if errors.Is(err, errNotManifest) {

 				return nil

 			}

 			return err

@@ -49,7 +49,7 @@ func copyRegular(srcPath, dstPath string, fileinfo os.FileInfo, copyWithFileRang

 		}

 		*copyWithFileClone = false

-		if err == unix.EXDEV {

+		if errors.Is(err, unix.EXDEV) {

 			*copyWithFileRange = false

 		}

 	}

@@ -57,7 +57,7 @@ func copyRegular(srcPath, dstPath string, fileinfo os.FileInfo, copyWithFileRang

 		err = doCopyWithFileRange(srcFile, dstFile, fileinfo)

 		// Trying the file_clone may not have caught the exdev case

 		// as the ioctl may not have been available (therefore EINVAL)

-		if err == unix.EXDEV || err == unix.ENOSYS {

+		if errors.Is(err, unix.EXDEV) || errors.Is(err, unix.ENOSYS) {

 			*copyWithFileRange = false

 		} else {

 			return err

@@ -269,7 +269,7 @@ func isEmptyDir(name string) bool {

 	}

 	defer f.Close()

-	if _, err = f.Readdirnames(1); err == io.EOF {

+	if _, err = f.Readdirnames(1); errors.Is(err, io.EOF) {

 		return true

 	}

 	return false

@@ -5,6 +5,7 @@ package graphtest

 import (

 	"bytes"

 	"crypto/rand"

+	"errors"

 	"os"

 	"path"

 	"testing"

@@ -312,7 +313,7 @@ func DriverTestSetQuota(t *testing.T, drivername string, required bool) {

 	createOpts.StorageOpt = make(map[string]string, 1)

 	createOpts.StorageOpt["size"] = "50M"

 	layerName := drivername + "Test"

-	if err := driver.CreateReadWrite(layerName, "Base", createOpts); err == quota.ErrQuotaNotSupported && !required {

+	if err := driver.CreateReadWrite(layerName, "Base", createOpts); errors.Is(err, quota.ErrQuotaNotSupported) && !required {

 		t.Skipf("Quota not supported on underlying filesystem: %v", err)

 	} else if err != nil {

 		t.Fatal(err)

@@ -337,7 +338,7 @@ func DriverTestSetQuota(t *testing.T, drivername string, required bool) {

 	if err == nil {

 		t.Fatalf("expected write to fail(), instead had success")

 	}

-	if pathError, ok := err.(*os.PathError); ok && pathError.Err != unix.EDQUOT && pathError.Err != unix.ENOSPC {

+	if pathError, ok := err.(*os.PathError); ok && !errors.Is(pathError.Err, unix.EDQUOT) && !errors.Is(pathError.Err, unix.ENOSPC) {

 		os.Remove(path.Join(mountPath, "bigfile"))

 		t.Fatalf("expect write() to fail with %v or %v, got %v", unix.EDQUOT, unix.ENOSPC, pathError.Err)

 	}

@@ -106,7 +106,7 @@ func doesSupportNativeDiff(d string) error {

 	// rename "d1" to "d2"

 	if err := os.Rename(filepath.Join(td, mergedDirName, "d1"), filepath.Join(td, mergedDirName, "d2")); err != nil {

 		// if rename failed with syscall.EXDEV, the kernel doesn't have CONFIG_OVERLAY_FS_REDIRECT_DIR enabled

-		if err.(*os.LinkError).Err == syscall.EXDEV {

+		if errors.Is(err.(*os.LinkError).Err, syscall.EXDEV) {

 			return nil

 		}

 		return errors.Wrap(err, "failed to rename dir in merged directory")

@@ -2,6 +2,7 @@ package vfs

 import (

 	"context"

+	"errors"

 	"github.com/containerd/log"

 	"github.com/docker/docker/quota"

@@ -15,7 +16,7 @@ type driverQuota struct {

 func setupDriverQuota(driver *Driver) {

 	if quotaCtl, err := quota.NewControl(driver.home); err == nil {

 		driver.quotaCtl = quotaCtl

-	} else if err != quota.ErrQuotaNotSupported {

+	} else if !errors.Is(err, quota.ErrQuotaNotSupported) {

 		log.G(context.TODO()).Warnf("Unable to setup quota: %v\n", err)

 	}

 }

@@ -524,7 +524,7 @@ func includeContainerInList(container *container.Snapshot, filter *listContext)

 			}

 			return nil

 		})

-		if err != volumeExist {

+		if !errors.Is(err, volumeExist) {

 			return excludeContainer

 		}

 	}

@@ -560,7 +560,7 @@ func includeContainerInList(container *container.Snapshot, filter *listContext)

 			}

 			return nil

 		})

-		if err != networkExist {

+		if !errors.Is(err, networkExist) {

 			return excludeContainer

 		}

 	}

@@ -107,7 +107,7 @@ func (a *pluginAdapterWithRead) ReadLogs(ctx context.Context, config ReadConfig)

 			var buf logdriver.LogEntry

 			if err := dec.Decode(&buf); err != nil {

-				if err == io.EOF {

+				if errors.Is(err, io.EOF) {

 					return

 				}

 				watcher.Err <- errors.Wrap(err, "error decoding log message")

@@ -3,6 +3,7 @@ package logger

 import (

 	"context"

 	"encoding/binary"

+	"errors"

 	"io"

 	"sync"

 	"testing"

@@ -118,7 +119,7 @@ func (l *mockLoggingPlugin) waitLen(i int) {

 }

 func (l *mockLoggingPlugin) check(t *testing.T) {

-	if l.err != nil && l.err != io.EOF {

+	if l.err != nil && !errors.Is(l.err, io.EOF) {

 		t.Fatal(l.err)

 	}

 }

@@ -431,7 +431,7 @@ func (l *logStream) Log(msg *logger.Message) error {

 	// (i.e. returns false) in this case.

 	ctx := context.TODO()

 	if err := l.messages.Enqueue(ctx, msg); err != nil {

-		if err == loggerutils.ErrQueueClosed {

+		if errors.Is(err, loggerutils.ErrQueueClosed) {

 			return errClosed

 		}

 		return err

@@ -2,6 +2,7 @@ package gcplogs

 import (

 	"context"

+	"errors"

 	"fmt"

 	"sync"

 	"sync/atomic"

@@ -187,7 +188,7 @@ func New(info logger.Info) (logger.Logger, error) {

 	// without overly spamming /var/log/docker.log so we log the first time

 	// we overflow and every 1000th time after.

 	c.OnError = func(err error) {

-		if err == logging.ErrOverflow {

+		if errors.Is(err, logging.ErrOverflow) {

 			if i := droppedLogs.Add(1); i%1000 == 1 {

 				log.G(context.TODO()).Errorf("gcplogs driver has dropped %v logs", i)

 			}

@@ -4,6 +4,7 @@ import (

 	"bufio"

 	"bytes"

 	"context"

+	"errors"

 	"fmt"

 	"io"

 	"os"

@@ -104,7 +105,7 @@ func TestEncodeDecode(t *testing.T) {

 	assert.Assert(t, string(msg.Line) == "hello 3\n")

 	_, err = dec.Decode()

-	assert.Assert(t, err == io.EOF)

+	assert.Assert(t, errors.Is(err, io.EOF))

 }

 func TestReadLogs(t *testing.T) {

@@ -46,7 +46,7 @@ func getTailReader(ctx context.Context, r loggerutils.SizeReaderAt, req int) (lo

 		}

 		n, err := r.ReadAt(buf, offset-encodeBinaryLen64)

-		if err != nil && err != io.EOF {

+		if err != nil && !errors.Is(err, io.EOF) {

 			return nil, 0, errors.Wrap(err, "error reading log message footer")

 		}

@@ -57,7 +57,7 @@ func getTailReader(ctx context.Context, r loggerutils.SizeReaderAt, req int) (lo

 		msgLen := binary.BigEndian.Uint32(buf)

 		n, err = r.ReadAt(buf, offset-encodeBinaryLen64-encodeBinaryLen64-int64(msgLen))

-		if err != nil && err != io.EOF {

+		if err != nil && !errors.Is(err, io.EOF) {

 			return nil, 0, errors.Wrap(err, "error reading log message header")

 		}

@@ -2,6 +2,7 @@ package logger

 import (

 	"context"

+	"errors"

 	"strconv"

 	"testing"

 	"time"

@@ -97,7 +98,7 @@ func TestRingClose(t *testing.T) {

 		t.Fatal(err)

 	}

 	r.Close()

-	if err := r.Enqueue(&Message{}); err != errClosed {

+	if err := r.Enqueue(&Message{}); !errors.Is(err, errClosed) {

 		t.Fatalf("expected errClosed, got: %v", err)

 	}

 	if len(r.queue) != 1 {

@@ -153,7 +153,7 @@ func (daemon *Daemon) handleContainerExit(c *container.Container, e *libcontaine

 				c.CheckpointTo(context.TODO(), daemon.containersReplica)

 				c.Unlock()

 				defer daemon.autoRemove(&cfg.Config, c)

-				if waitErr != restartmanager.ErrRestartCanceled {

+				if !errors.Is(waitErr, restartmanager.ErrRestartCanceled) {

 					log.G(ctx).Errorf("restartmanger wait error: %+v", waitErr)

 				}

 			}

@@ -164,15 +164,15 @@ func retryOnError(err error) error {

 			return xfer.DoNotRetry{Err: err}

 		}

 	case *url.Error:

-		switch v.Err {

-		case auth.ErrNoBasicAuthCredentials, auth.ErrNoToken:

+		switch {

+		case errors.Is(v.Err, auth.ErrNoBasicAuthCredentials), errors.Is(v.Err, auth.ErrNoToken):

 			return xfer.DoNotRetry{Err: v.Err}

 		}

 		return retryOnError(v.Err)

 	case *client.UnexpectedHTTPResponseError, unsupportedMediaTypeError:

 		return xfer.DoNotRetry{Err: err}

 	case error:

-		if err == distribution.ErrBlobUnknown {

+		if errors.Is(err, distribution.ErrBlobUnknown) {

 			return xfer.DoNotRetry{Err: err}

 		}

 		if strings.Contains(err.Error(), strings.ToLower(syscall.ENOSPC.Error())) {

@@ -65,7 +65,7 @@ func addDigestReference(store refstore.Store, ref reference.Named, dgst digest.D

 			log.G(context.TODO()).Errorf("Image ID for digest %s changed from %s to %s, cannot update", dgst.String(), oldTagID, id)

 		}

 		return nil

-	} else if err != refstore.ErrDoesNotExist {

+	} else if !errors.Is(err, refstore.ErrDoesNotExist) {

 		return err

 	}

@@ -248,7 +248,7 @@ func (ld *layerDescriptor) Download(ctx context.Context, progressOutput progress

 	_, err = io.Copy(tmpFile, io.TeeReader(reader, ld.verifier))

 	if err != nil {

-		if err == transport.ErrWrongCodeForByteRange {

+		if errors.Is(err, transport.ErrWrongCodeForByteRange) {

 			if err := ld.truncateDownloadFile(); err != nil {

 				return nil, 0, xfer.DoNotRetry{Err: err}

 			}

@@ -421,7 +421,7 @@ func (p *puller) pullTag(ctx context.Context, ref reference.Named, platform *oci

 			if oldTagID == id {

 				return false, addDigestReference(p.config.ReferenceStore, ref, manifestDigest, id)

 			}

-		} else if err != refstore.ErrDoesNotExist {

+		} else if !errors.Is(err, refstore.ErrDoesNotExist) {

 			return false, err

 		}

@@ -525,8 +525,8 @@ attempts:

 		var err error

 		desc, err = pd.repo.Blobs(ctx).Stat(ctx, dgst)

 		pd.checkedDigests[meta.Digest] = struct{}{}

-		switch err {

-		case nil:

+		switch {

+		case err == nil:

 			if m, ok := digestToMetadata[desc.Digest]; !ok || m.SourceRepository != pd.repoName.Name() || !metadata.CheckV2MetadataHMAC(m, pd.hmacKey) {

 				// cache mapping from this layer's DiffID to the blobsum

 				if err := pd.metadataService.TagAndAdd(diffID, pd.hmacKey, metadata.V2Metadata{

@@ -539,7 +539,7 @@ attempts:

 			desc.MediaType = schema2.MediaTypeLayer

 			exists = true

 			break attempts

-		case distribution.ErrBlobUnknown:

+		case errors.Is(err, distribution.ErrBlobUnknown):

 			if meta.SourceRepository == pd.repoName.Name() {

 				// remove the mapping to the target repository

 				if err := pd.metadataService.Remove(*meta); err != nil {

@@ -351,7 +351,7 @@ func TestCancelledDownload(t *testing.T) {

 	descriptors := downloadDescriptors(nil)

 	_, _, err := ldm.Download(ctx, *image.NewRootFS(), descriptors, progress.ChanOutput(progressChan))

-	if err != context.Canceled {

+	if !errors.Is(err, context.Canceled) {

 		close(progressChan)

 		t.Fatal("expected download to be cancelled")

 	}

@@ -125,7 +125,7 @@ func TestCancelledUpload(t *testing.T) {

 	descriptors := uploadDescriptors(nil)

 	err := lum.Upload(ctx, descriptors, progress.ChanOutput(progressChan))

-	if err != context.Canceled {

+	if !errors.Is(err, context.Canceled) {

 		t.Fatal("expected upload to be cancelled")

 	}

@@ -22,7 +22,7 @@ func TestNotFound(t *testing.T) {

 	if !cerrdefs.IsNotFound(e) {

 		t.Fatalf("expected not found error, got: %T", e)

 	}

-	if cause := e.(wrapped).Unwrap(); cause != errTest {

+	if cause := e.(wrapped).Unwrap(); cause != errTest { //nolint:errorlint // not using errors.Is, as this tests for the unwrapped error.

 		t.Fatalf("causual should be errTest, got: %v", cause)

 	}

 	if !errors.Is(e, errTest) {

@@ -43,7 +43,7 @@ func TestConflict(t *testing.T) {

 	if !cerrdefs.IsConflict(e) {

 		t.Fatalf("expected conflict error, got: %T", e)

 	}

-	if cause := e.(wrapped).Unwrap(); cause != errTest {

+	if cause := e.(wrapped).Unwrap(); cause != errTest { //nolint:errorlint // not using errors.Is, as this tests for the unwrapped error.

 		t.Fatalf("causual should be errTest, got: %v", cause)

 	}

 	if !errors.Is(e, errTest) {

@@ -64,7 +64,7 @@ func TestForbidden(t *testing.T) {

 	if !cerrdefs.IsPermissionDenied(e) {

 		t.Fatalf("expected forbidden error, got: %T", e)

 	}

-	if cause := e.(wrapped).Unwrap(); cause != errTest {

+	if cause := e.(wrapped).Unwrap(); cause != errTest { //nolint:errorlint // not using errors.Is, as this tests for the unwrapped error.

 		t.Fatalf("causual should be errTest, got: %v", cause)

 	}

 	if !errors.Is(e, errTest) {

@@ -85,7 +85,7 @@ func TestInvalidParameter(t *testing.T) {

 	if !cerrdefs.IsInvalidArgument(e) {

 		t.Fatalf("expected invalid argument error, got %T", e)

 	}

-	if cause := e.(wrapped).Unwrap(); cause != errTest {

+	if cause := e.(wrapped).Unwrap(); cause != errTest { //nolint:errorlint // not using errors.Is, as this tests for the unwrapped error.

 		t.Fatalf("causual should be errTest, got: %v", cause)

 	}

 	if !errors.Is(e, errTest) {

@@ -106,7 +106,7 @@ func TestNotImplemented(t *testing.T) {

 	if !cerrdefs.IsNotImplemented(e) {

 		t.Fatalf("expected not implemented error, got %T", e)

 	}

-	if cause := e.(wrapped).Unwrap(); cause != errTest {

+	if cause := e.(wrapped).Unwrap(); cause != errTest { //nolint:errorlint // not using errors.Is, as this tests for the unwrapped error.

 		t.Fatalf("causual should be errTest, got: %v", cause)

 	}

 	if !errors.Is(e, errTest) {

@@ -127,7 +127,7 @@ func TestNotModified(t *testing.T) {

 	if !cerrdefs.IsNotModified(e) {

 		t.Fatalf("expected not modified error, got %T", e)

 	}

-	if cause := e.(wrapped).Unwrap(); cause != errTest {

+	if cause := e.(wrapped).Unwrap(); cause != errTest { //nolint:errorlint // not using errors.Is, as this tests for the unwrapped error.

 		t.Fatalf("causual should be errTest, got: %v", cause)

 	}

 	if !errors.Is(e, errTest) {

@@ -148,7 +148,7 @@ func TestUnauthorized(t *testing.T) {

 	if !cerrdefs.IsUnauthorized(e) {

 		t.Fatalf("expected unauthorized error, got %T", e)

 	}

-	if cause := e.(wrapped).Unwrap(); cause != errTest {

+	if cause := e.(wrapped).Unwrap(); cause != errTest { //nolint:errorlint // not using errors.Is, as this tests for the unwrapped error.

 		t.Fatalf("causual should be errTest, got: %v", cause)

 	}

 	if !errors.Is(e, errTest) {

@@ -169,7 +169,7 @@ func TestUnknown(t *testing.T) {

 	if !cerrdefs.IsUnknown(e) {

 		t.Fatalf("expected unknown error, got %T", e)

 	}

-	if cause := e.(wrapped).Unwrap(); cause != errTest {

+	if cause := e.(wrapped).Unwrap(); cause != errTest { //nolint:errorlint // not using errors.Is, as this tests for the unwrapped error.

 		t.Fatalf("causual should be errTest, got: %v", cause)

 	}

 	if !errors.Is(e, errTest) {

@@ -190,7 +190,7 @@ func TestCancelled(t *testing.T) {

 	if !cerrdefs.IsCanceled(e) {

 		t.Fatalf("expected cancelled error, got %T", e)

 	}

-	if cause := e.(wrapped).Unwrap(); cause != errTest {

+	if cause := e.(wrapped).Unwrap(); cause != errTest { //nolint:errorlint // not using errors.Is, as this tests for the unwrapped error.

 		t.Fatalf("causual should be errTest, got: %v", cause)

 	}

 	if !errors.Is(e, errTest) {

@@ -211,7 +211,7 @@ func TestDeadline(t *testing.T) {

 	if !cerrdefs.IsDeadlineExceeded(e) {

 		t.Fatalf("expected deadline error, got %T", e)

 	}

-	if cause := e.(wrapped).Unwrap(); cause != errTest {

+	if cause := e.(wrapped).Unwrap(); cause != errTest { //nolint:errorlint // not using errors.Is, as this tests for the unwrapped error.

 		t.Fatalf("causual should be errTest, got: %v", cause)

 	}

 	if !errors.Is(e, errTest) {

@@ -232,7 +232,7 @@ func TestDataLoss(t *testing.T) {

 	if !cerrdefs.IsDataLoss(e) {

 		t.Fatalf("expected data loss error, got %T", e)

 	}

-	if cause := e.(wrapped).Unwrap(); cause != errTest {

+	if cause := e.(wrapped).Unwrap(); cause != errTest { //nolint:errorlint // not using errors.Is, as this tests for the unwrapped error.

 		t.Fatalf("causual should be errTest, got: %v", cause)

 	}

 	if !errors.Is(e, errTest) {

@@ -253,7 +253,7 @@ func TestUnavailable(t *testing.T) {

 	if !cerrdefs.IsUnavailable(e) {

 		t.Fatalf("expected unavaillable error, got %T", e)

 	}

-	if cause := e.(wrapped).Unwrap(); cause != errTest {

+	if cause := e.(wrapped).Unwrap(); cause != errTest { //nolint:errorlint // not using errors.Is, as this tests for the unwrapped error.

 		t.Fatalf("causual should be errTest, got: %v", cause)

 	}

 	if !errors.Is(e, errTest) {

@@ -274,7 +274,7 @@ func TestSystem(t *testing.T) {

 	if !cerrdefs.IsInternal(e) {

 		t.Fatalf("expected system error, got %T", e)

 	}

-	if cause := e.(wrapped).Unwrap(); cause != errTest {

+	if cause := e.(wrapped).Unwrap(); cause != errTest { //nolint:errorlint // not using errors.Is, as this tests for the unwrapped error.

 		t.Fatalf("causual should be errTest, got: %v", cause)

 	}

 	if !errors.Is(e, errTest) {

@@ -199,7 +199,7 @@ func (imageNotFoundError) NotFound() {}

 func (is *store) Search(term string) (ID, error) {

 	dgst, err := is.digestSet.Lookup(term)

 	if err != nil {

-		if err == digestset.ErrDigestNotFound {

+		if errors.Is(err, digestset.ErrDigestNotFound) {

 			err = imageNotFoundError(term)

 		}

 		return "", errors.WithStack(err)

@@ -71,7 +71,7 @@ func (s *DockerAPISuite) TestExecResizeImmediatelyAfterExecStart(c *testing.T) {