@@ -16,7 +16,6 @@ import (

 	"github.com/docker/docker/api/types/swarm"

 	"github.com/docker/docker/api/types/volume"

 	"github.com/docker/go-connections/nat"

-	"github.com/opencontainers/runtime-spec/specs-go/features"

 )

 const (

@@ -657,16 +656,6 @@ type Runtime struct {

 	Type    string                 `json:"runtimeType,omitempty"`

 	Options map[string]interface{} `json:"options,omitempty"`

-

-	// This is exposed here only for internal use

-	ShimConfig *ShimConfig        `json:"-"`

-	Features   *features.Features `json:"-"`

-}

-

-// ShimConfig is used by runtime to configure containerd shims

-type ShimConfig struct {

-	Binary string

-	Opts   interface{}

 }

 // DiskUsageObject represents an object type used for disk usage query filtering.

@@ -268,7 +268,7 @@ func (cli *DaemonCli) start(opts *daemonOptions) (err error) {

 	// Restart all autostart containers which has a swarm endpoint

 	// and is not yet running now that we have successfully

 	// initialized the cluster.

-	d.RestartSwarmContainers(cli.Config)

+	d.RestartSwarmContainers()

 	logrus.Info("Daemon has completed initialization")

@@ -81,15 +81,6 @@ type Config struct {

 	Rootless   bool   `json:"rootless,omitempty"`

 }

-// GetRuntime returns the runtime path and arguments for a given

-// runtime name

-func (conf *Config) GetRuntime(name string) *types.Runtime {

-	if rt, ok := conf.Runtimes[name]; ok {

-		return &rt

-	}

-	return nil

-}

-

 // GetAllRuntimes returns a copy of the runtimes map

 func (conf *Config) GetAllRuntimes() map[string]types.Runtime {

 	return conf.Runtimes

@@ -30,12 +30,6 @@ type Config struct {

 	// for the Windows daemon.)

 }

-// GetRuntime returns the runtime path and arguments for a given

-// runtime name

-func (conf *Config) GetRuntime(name string) *types.Runtime {

-	return nil

-}

-

 // GetAllRuntimes returns a copy of the runtimes map

 func (conf *Config) GetAllRuntimes() map[string]types.Runtime {

 	return map[string]types.Runtime{}

@@ -235,7 +235,7 @@ func (daemon *Daemon) setHostConfig(container *container.Container, hostConfig *

 // verifyContainerSettings performs validation of the hostconfig and config

 // structures.

-func (daemon *Daemon) verifyContainerSettings(daemonCfg *config.Config, hostConfig *containertypes.HostConfig, config *containertypes.Config, update bool) (warnings []string, err error) {

+func (daemon *Daemon) verifyContainerSettings(daemonCfg *configStore, hostConfig *containertypes.HostConfig, config *containertypes.Config, update bool) (warnings []string, err error) {

 	// First perform verification of settings common across all platforms.

 	if err = validateContainerConfig(config); err != nil {

 		return warnings, err

@@ -1075,7 +1075,7 @@ func (daemon *Daemon) ConnectToNetwork(container *container.Container, idOrName

 			}

 		}

 	} else {

-		if err := daemon.connectToNetwork(daemon.config(), container, idOrName, endpointConfig, true); err != nil {

+		if err := daemon.connectToNetwork(&daemon.config().Config, container, idOrName, endpointConfig, true); err != nil {

 			return err

 		}

 	}

@@ -31,11 +31,14 @@ func TestContainerWarningHostAndPublishPorts(t *testing.T) {

 			NetworkMode:  "host",

 			PortBindings: tc.ports,

 		}

-		cs := &config.Config{}

-		configureRuntimes(cs)

 		d := &Daemon{}

-		d.configStore.Store(cs)

-		wrns, err := d.verifyContainerSettings(cs, hostConfig, &containertypes.Config{}, false)

+		cfg, err := config.New()

+		assert.NilError(t, err)

+		configureRuntimes(cfg)

+		runtimes, err := setupRuntimes(cfg)

+		assert.NilError(t, err)

+		daemonCfg := &configStore{Config: *cfg, Runtimes: runtimes}

+		wrns, err := d.verifyContainerSettings(daemonCfg, hostConfig, &containertypes.Config{}, false)

 		assert.NilError(t, err)

 		assert.DeepEqual(t, tc.warnings, wrns)

 	}

@@ -57,7 +57,7 @@ func (daemon *Daemon) ContainerCreateIgnoreImagesArgsEscaped(ctx context.Context

 	})

 }

-func (daemon *Daemon) containerCreate(ctx context.Context, daemonCfg *config.Config, opts createOpts) (containertypes.CreateResponse, error) {

+func (daemon *Daemon) containerCreate(ctx context.Context, daemonCfg *configStore, opts createOpts) (containertypes.CreateResponse, error) {

 	start := time.Now()

 	if opts.params.Config == nil {

 		return containertypes.CreateResponse{}, errdefs.InvalidParameter(errors.New("Config cannot be empty in order to create a container"))

@@ -95,12 +95,12 @@ func (daemon *Daemon) containerCreate(ctx context.Context, daemonCfg *config.Con

 	if opts.params.HostConfig == nil {

 		opts.params.HostConfig = &containertypes.HostConfig{}

 	}

-	err = daemon.adaptContainerSettings(daemonCfg, opts.params.HostConfig, opts.params.AdjustCPUShares)

+	err = daemon.adaptContainerSettings(&daemonCfg.Config, opts.params.HostConfig, opts.params.AdjustCPUShares)

 	if err != nil {

 		return containertypes.CreateResponse{Warnings: warnings}, errdefs.InvalidParameter(err)

 	}

-	ctr, err := daemon.create(ctx, daemonCfg, opts)

+	ctr, err := daemon.create(ctx, &daemonCfg.Config, opts)

 	if err != nil {

 		return containertypes.CreateResponse{Warnings: warnings}, err

 	}

@@ -77,6 +77,12 @@ import (

 	"resenje.org/singleflight"

 )

+type configStore struct {

+	config.Config

+

+	Runtimes runtimes

+}

+

 // Daemon holds information about the Docker daemon.

 type Daemon struct {

 	id                    string

@@ -85,7 +91,7 @@ type Daemon struct {

 	containersReplica     *container.ViewDB

 	execCommands          *container.ExecStore

 	imageService          ImageService

-	configStore           atomic.Pointer[config.Config]

+	configStore           atomic.Pointer[configStore]

 	configReload          sync.Mutex

 	statsCollector        *stats.Collector

 	defaultLogConfig      containertypes.LogConfig

@@ -159,10 +165,10 @@ func (daemon *Daemon) StoreHosts(hosts []string) {

 // lifetime of an operation, the configuration pointer should be passed down the

 // call stack, like one would a [context.Context] value. Only the entrypoints

 // for operations, the outermost functions, should call this function.

-func (daemon *Daemon) config() *config.Config {

+func (daemon *Daemon) config() *configStore {

 	cfg := daemon.configStore.Load()

 	if cfg == nil {

-		return &config.Config{}

+		return &configStore{}

 	}

 	return cfg

 }

@@ -247,7 +253,7 @@ type layerAccessor interface {

 	GetLayerByID(cid string) (layer.RWLayer, error)

 }

-func (daemon *Daemon) restore(cfg *config.Config) error {

+func (daemon *Daemon) restore(cfg *configStore) error {

 	var mapLock sync.Mutex

 	containers := make(map[string]*container.Container)

@@ -467,7 +473,7 @@ func (daemon *Daemon) restore(cfg *config.Config) error {

 				c.ResetRestartManager(false)

 				if !c.HostConfig.NetworkMode.IsContainer() && c.IsRunning() {

-					options, err := daemon.buildSandboxOptions(cfg, c)

+					options, err := daemon.buildSandboxOptions(&cfg.Config, c)

 					if err != nil {

 						logger(c).WithError(err).Warn("failed to build sandbox option to restore container")

 					}

@@ -523,7 +529,7 @@ func (daemon *Daemon) restore(cfg *config.Config) error {

 	//

 	// Note that we cannot initialize the network controller earlier, as it

 	// needs to know if there's active sandboxes (running containers).

-	if err = daemon.initNetworkController(cfg, activeSandboxes); err != nil {

+	if err = daemon.initNetworkController(&cfg.Config, activeSandboxes); err != nil {

 		return fmt.Errorf("Error initializing network controller: %v", err)

 	}

@@ -586,7 +592,7 @@ func (daemon *Daemon) restore(cfg *config.Config) error {

 		go func(cid string) {

 			_ = sem.Acquire(context.Background(), 1)

-			if err := daemon.containerRm(cfg, cid, &types.ContainerRmConfig{ForceRemove: true, RemoveVolume: true}); err != nil {

+			if err := daemon.containerRm(&cfg.Config, cid, &types.ContainerRmConfig{ForceRemove: true, RemoveVolume: true}); err != nil {

 				logrus.WithField("container", cid).WithError(err).Error("failed to remove container")

 			}

@@ -634,9 +640,11 @@ func (daemon *Daemon) restore(cfg *config.Config) error {

 // RestartSwarmContainers restarts any autostart container which has a

 // swarm endpoint.

-func (daemon *Daemon) RestartSwarmContainers(cfg *config.Config) {

-	ctx := context.Background()

+func (daemon *Daemon) RestartSwarmContainers() {

+	daemon.restartSwarmContainers(context.Background(), daemon.config())

+}

+func (daemon *Daemon) restartSwarmContainers(ctx context.Context, cfg *configStore) {

 	// parallelLimit is the maximum number of parallel startup jobs that we

 	// allow (this is the limited used for all startup semaphores). The multipler

 	// (128) was chosen after some fairly significant benchmarking -- don't change

@@ -806,11 +814,23 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S

 		os.Setenv("TMPDIR", realTmp)

 	}

+	if err := initRuntimesDir(config); err != nil {

+		return nil, err

+	}

+	runtimes, err := setupRuntimes(config)

+	if err != nil {

+		return nil, err

+	}

+

 	d := &Daemon{

 		PluginStore: pluginStore,

 		startupDone: make(chan struct{}),

 	}

-	d.configStore.Store(config)

+	configStore := &configStore{

+		Config:   *config,

+		Runtimes: runtimes,

+	}

+	d.configStore.Store(configStore)

 	// TEST_INTEGRATION_USE_SNAPSHOTTER is used for integration tests only.

 	if os.Getenv("TEST_INTEGRATION_USE_SNAPSHOTTER") != "" {

@@ -830,27 +850,27 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S

 		}

 	}()

-	if err := d.setGenericResources(config); err != nil {

+	if err := d.setGenericResources(&configStore.Config); err != nil {

 		return nil, err

 	}

 	// set up SIGUSR1 handler on Unix-like systems, or a Win32 global event

 	// on Windows to dump Go routine stacks

-	stackDumpDir := config.Root

-	if execRoot := config.GetExecRoot(); execRoot != "" {

+	stackDumpDir := configStore.Root

+	if execRoot := configStore.GetExecRoot(); execRoot != "" {

 		stackDumpDir = execRoot

 	}

 	d.setupDumpStackTrap(stackDumpDir)

-	if err := d.setupSeccompProfile(config); err != nil {

+	if err := d.setupSeccompProfile(&configStore.Config); err != nil {

 		return nil, err

 	}

 	// Set the default isolation mode (only applicable on Windows)

-	if err := d.setDefaultIsolation(config); err != nil {

+	if err := d.setDefaultIsolation(&configStore.Config); err != nil {

 		return nil, fmt.Errorf("error setting default isolation mode: %v", err)

 	}

-	if err := configureMaxThreads(config); err != nil {

+	if err := configureMaxThreads(&configStore.Config); err != nil {

 		logrus.Warnf("Failed to configure golang's threads limit: %v", err)

 	}

@@ -859,7 +879,7 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S

 		logrus.Errorf(err.Error())

 	}

-	daemonRepo := filepath.Join(config.Root, "containers")

+	daemonRepo := filepath.Join(configStore.Root, "containers")

 	if err := idtools.MkdirAllAndChown(daemonRepo, 0o710, idtools.Identity{

 		UID: idtools.CurrentIdentity().UID,

 		GID: rootIDs.GID,

@@ -867,20 +887,11 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S

 		return nil, err

 	}

-	// Create the directory where we'll store the runtime scripts (i.e. in

-	// order to support runtimeArgs)

-	if err = os.Mkdir(filepath.Join(config.Root, "runtimes"), 0o700); err != nil && !errors.Is(err, os.ErrExist) {

-		return nil, err

-	}

-	if err := d.loadRuntimes(); err != nil {

-		return nil, err

-	}

-

 	if isWindows {

 		// Note that permissions (0o700) are ignored on Windows; passing them to

 		// show intent only. We could consider using idtools.MkdirAndChown here

 		// to apply an ACL.

-		if err = os.Mkdir(filepath.Join(config.Root, "credentialspecs"), 0o700); err != nil && !errors.Is(err, os.ErrExist) {

+		if err = os.Mkdir(filepath.Join(configStore.Root, "credentialspecs"), 0o700); err != nil && !errors.Is(err, os.ErrExist) {

 			return nil, err

 		}

 	}

@@ -888,7 +899,7 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S

 	d.registryService = registryService

 	dlogger.RegisterPluginGetter(d.PluginStore)

-	metricsSockPath, err := d.listenMetricsSock(config)

+	metricsSockPath, err := d.listenMetricsSock(&configStore.Config)

 	if err != nil {

 		return nil, err

 	}

@@ -927,20 +938,20 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S

 		grpc.WithDefaultCallOptions(grpc.MaxCallSendMsgSize(defaults.DefaultMaxSendMsgSize)),

 	}

-	if config.ContainerdAddr != "" {

-		d.containerdCli, err = containerd.New(config.ContainerdAddr, containerd.WithDefaultNamespace(config.ContainerdNamespace), containerd.WithDialOpts(gopts), containerd.WithTimeout(60*time.Second))

+	if configStore.ContainerdAddr != "" {

+		d.containerdCli, err = containerd.New(configStore.ContainerdAddr, containerd.WithDefaultNamespace(configStore.ContainerdNamespace), containerd.WithDialOpts(gopts), containerd.WithTimeout(60*time.Second))

 		if err != nil {

-			return nil, errors.Wrapf(err, "failed to dial %q", config.ContainerdAddr)

+			return nil, errors.Wrapf(err, "failed to dial %q", configStore.ContainerdAddr)

 		}

 	}

 	createPluginExec := func(m *plugin.Manager) (plugin.Executor, error) {

 		var pluginCli *containerd.Client

-		if config.ContainerdAddr != "" {

-			pluginCli, err = containerd.New(config.ContainerdAddr, containerd.WithDefaultNamespace(config.ContainerdPluginNamespace), containerd.WithDialOpts(gopts), containerd.WithTimeout(60*time.Second))

+		if configStore.ContainerdAddr != "" {

+			pluginCli, err = containerd.New(configStore.ContainerdAddr, containerd.WithDefaultNamespace(configStore.ContainerdPluginNamespace), containerd.WithDialOpts(gopts), containerd.WithTimeout(60*time.Second))

 			if err != nil {

-				return nil, errors.Wrapf(err, "failed to dial %q", config.ContainerdAddr)

+				return nil, errors.Wrapf(err, "failed to dial %q", configStore.ContainerdAddr)

 			}

 		}

@@ -949,22 +960,22 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S

 			shimOpts interface{}

 		)

 		if runtime.GOOS != "windows" {

-			shim, shimOpts, err = d.getRuntime(config, config.DefaultRuntime)

+			shim, shimOpts, err = runtimes.Get(configStore.DefaultRuntime)

 			if err != nil {

 				return nil, err

 			}

 		}

-		return pluginexec.New(ctx, getPluginExecRoot(config), pluginCli, config.ContainerdPluginNamespace, m, shim, shimOpts)

+		return pluginexec.New(ctx, getPluginExecRoot(&configStore.Config), pluginCli, configStore.ContainerdPluginNamespace, m, shim, shimOpts)

 	}

 	// Plugin system initialization should happen before restore. Do not change order.

 	d.pluginManager, err = plugin.NewManager(plugin.ManagerConfig{

-		Root:               filepath.Join(config.Root, "plugins"),

-		ExecRoot:           getPluginExecRoot(config),

+		Root:               filepath.Join(configStore.Root, "plugins"),

+		ExecRoot:           getPluginExecRoot(&configStore.Config),

 		Store:              d.PluginStore,

 		CreateExecutor:     createPluginExec,

 		RegistryService:    registryService,

-		LiveRestoreEnabled: config.LiveRestoreEnabled,

+		LiveRestoreEnabled: configStore.LiveRestoreEnabled,

 		LogPluginEvent:     d.LogPluginEvent, // todo: make private

 		AuthzMiddleware:    authzMiddleware,

 	})

@@ -972,13 +983,13 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S

 		return nil, errors.Wrap(err, "couldn't create plugin manager")

 	}

-	d.defaultLogConfig, err = defaultLogConfig(config)

+	d.defaultLogConfig, err = defaultLogConfig(&configStore.Config)

 	if err != nil {

 		return nil, errors.Wrap(err, "failed to set log opts")

 	}

 	logrus.Debugf("Using default logging driver %s", d.defaultLogConfig.Type)

-	d.volumes, err = volumesservice.NewVolumeService(config.Root, d.PluginStore, rootIDs, d)

+	d.volumes, err = volumesservice.NewVolumeService(configStore.Root, d.PluginStore, rootIDs, d)

 	if err != nil {

 		return nil, err

 	}

@@ -991,11 +1002,11 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S

 	// at this point.

 	//

 	// TODO(thaJeztah) add a utility to only collect the CgroupDevicesEnabled information

-	if runtime.GOOS == "linux" && !userns.RunningInUserNS() && !getSysInfo(config).CgroupDevicesEnabled {

+	if runtime.GOOS == "linux" && !userns.RunningInUserNS() && !getSysInfo(&configStore.Config).CgroupDevicesEnabled {

 		return nil, errors.New("Devices cgroup isn't mounted")

 	}

-	d.id, err = loadOrCreateID(filepath.Join(config.Root, "engine-id"))

+	d.id, err = loadOrCreateID(filepath.Join(configStore.Root, "engine-id"))

 	if err != nil {

 		return nil, err

 	}

@@ -1008,7 +1019,7 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S

 	d.statsCollector = d.newStatsCollector(1 * time.Second)

 	d.EventsService = events.New()

-	d.root = config.Root

+	d.root = configStore.Root

 	d.idMapping = idMapping

 	d.linkIndex = newLinkIndex()

@@ -1023,7 +1034,7 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S

 	} else if driverName != "" {

 		logrus.Infof("Setting the storage driver from the $DOCKER_DRIVER environment variable (%s)", driverName)

 	} else {

-		driverName = config.GraphDriver

+		driverName = configStore.GraphDriver

 	}

 	if d.UsesSnapshotter() {

@@ -1039,7 +1050,7 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S

 		// Configure and validate the kernels security support. Note this is a Linux/FreeBSD

 		// operation only, so it is safe to pass *just* the runtime OS graphdriver.

-		if err := configureKernelSecuritySupport(config, driverName); err != nil {

+		if err := configureKernelSecuritySupport(&configStore.Config, driverName); err != nil {

 			return nil, err

 		}

 		d.imageService = ctrd.NewService(ctrd.ImageServiceConfig{

@@ -1052,13 +1063,13 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S

 		})

 	} else {

 		layerStore, err := layer.NewStoreFromOptions(layer.StoreOptions{

-			Root:                      config.Root,

-			MetadataStorePathTemplate: filepath.Join(config.Root, "image", "%s", "layerdb"),

+			Root:                      configStore.Root,

+			MetadataStorePathTemplate: filepath.Join(configStore.Root, "image", "%s", "layerdb"),

 			GraphDriver:               driverName,

-			GraphDriverOptions:        config.GraphOptions,

+			GraphDriverOptions:        configStore.GraphOptions,

 			IDMapping:                 idMapping,

 			PluginGetter:              d.PluginStore,

-			ExperimentalEnabled:       config.Experimental,

+			ExperimentalEnabled:       configStore.Experimental,

 		})

 		if err != nil {

 			return nil, err

@@ -1066,11 +1077,11 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S

 		// Configure and validate the kernels security support. Note this is a Linux/FreeBSD

 		// operation only, so it is safe to pass *just* the runtime OS graphdriver.

-		if err := configureKernelSecuritySupport(config, layerStore.DriverName()); err != nil {

+		if err := configureKernelSecuritySupport(&configStore.Config, layerStore.DriverName()); err != nil {

 			return nil, err

 		}

-		imageRoot := filepath.Join(config.Root, "image", layerStore.DriverName())

+		imageRoot := filepath.Join(configStore.Root, "image", layerStore.DriverName())

 		ifs, err := image.NewFSStoreBackend(filepath.Join(imageRoot, "imagedb"))

 		if err != nil {

 			return nil, err

@@ -1144,11 +1155,11 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S

 	go d.execCommandGC()

-	if err := d.initLibcontainerd(ctx, config); err != nil {

+	if err := d.initLibcontainerd(ctx, &configStore.Config); err != nil {

 		return nil, err

 	}

-	if err := d.restore(config); err != nil {

+	if err := d.restore(configStore); err != nil {

 		return nil, err

 	}

 	close(d.startupDone)

@@ -1210,7 +1221,7 @@ func (daemon *Daemon) shutdownContainer(c *container.Container) error {

 // A negative (-1) timeout means "indefinitely", which means that containers

 // are not forcibly killed, and the daemon shuts down after all containers exit.

 func (daemon *Daemon) ShutdownTimeout() int {

-	return daemon.shutdownTimeout(daemon.config())

+	return daemon.shutdownTimeout(&daemon.config().Config)

 }

 func (daemon *Daemon) shutdownTimeout(cfg *config.Config) int {

@@ -1241,7 +1252,7 @@ func (daemon *Daemon) Shutdown(ctx context.Context) error {

 	// Keep mounts and networking running on daemon shutdown if

 	// we are to keep containers running and restore them.

-	cfg := daemon.config()

+	cfg := &daemon.config().Config

 	if cfg.LiveRestoreEnabled && daemon.containers != nil {

 		// check if there are any running containers, if none we should do some cleanup

 		if ls, err := daemon.Containers(ctx, &types.ContainerListOptions{}); len(ls) != 0 || err != nil {

@@ -1523,7 +1534,7 @@ func (daemon *Daemon) RawSysInfo() *sysinfo.SysInfo {

 		// We check if sysInfo is not set here, to allow some test to

 		// override the actual sysInfo.

 		if daemon.sysInfo == nil {

-			daemon.sysInfo = getSysInfo(daemon.config())

+			daemon.sysInfo = getSysInfo(&daemon.config().Config)

 		}

 	})

@@ -239,18 +239,18 @@ func kernelSupportsRecursivelyReadOnly() error {

 	return kernelSupportsRROErr

 }

-func supportsRecursivelyReadOnly(cfg *config.Config, runtime string) error {

+func supportsRecursivelyReadOnly(cfg *configStore, runtime string) error {

 	if err := kernelSupportsRecursivelyReadOnly(); err != nil {

 		return fmt.Errorf("rro is not supported: %w (kernel is older than 5.12?)", err)

 	}

 	if runtime == "" {

 		runtime = cfg.DefaultRuntime

 	}

-	rt := cfg.GetRuntime(runtime)

-	if rt.Features == nil {

+	features := cfg.Runtimes.Features(runtime)

+	if features == nil {

 		return fmt.Errorf("rro is not supported by runtime %q: OCI features struct is not available", runtime)

 	}

-	for _, s := range rt.Features.MountOptions {

+	for _, s := range features.MountOptions {

 		if s == "rro" {

 			return nil

 		}

@@ -10,7 +10,6 @@ import (

 	"testing"

 	containertypes "github.com/docker/docker/api/types/container"

-	"github.com/docker/docker/daemon/config"

 	"github.com/docker/docker/libnetwork/testutils"

 	"github.com/docker/docker/libnetwork/types"

 	"github.com/google/go-cmp/cmp/cmpopts"

@@ -178,7 +177,7 @@ func TestNotCleanupMounts(t *testing.T) {

 func TestValidateContainerIsolationLinux(t *testing.T) {

 	d := Daemon{}

-	_, err := d.verifyContainerSettings(&config.Config{}, &containertypes.HostConfig{Isolation: containertypes.IsolationHyperV}, nil, false)

+	_, err := d.verifyContainerSettings(&configStore{}, &containertypes.HostConfig{Isolation: containertypes.IsolationHyperV}, nil, false)

 	assert.Check(t, is.Error(err, "invalid isolation 'hyperv' on linux"))

 }

@@ -250,7 +249,7 @@ func TestRootMountCleanup(t *testing.T) {

 	testRoot, err := os.MkdirTemp("", t.Name())

 	assert.NilError(t, err)

 	defer os.RemoveAll(testRoot)

-	cfg := &config.Config{}

+	cfg := &configStore{}

 	err = mount.MakePrivate(testRoot)

 	assert.NilError(t, err)

@@ -266,16 +265,16 @@ func TestRootMountCleanup(t *testing.T) {

 	d := &Daemon{root: cfg.Root}

 	d.configStore.Store(cfg)

-	unmountFile := getUnmountOnShutdownPath(cfg)

+	unmountFile := getUnmountOnShutdownPath(&cfg.Config)

 	t.Run("regular dir no mountpoint", func(t *testing.T) {

-		err = setupDaemonRootPropagation(cfg)

+		err = setupDaemonRootPropagation(&cfg.Config)

 		assert.NilError(t, err)

 		_, err = os.Stat(unmountFile)

 		assert.NilError(t, err)

 		checkMounted(t, cfg.Root, true)

-		assert.Assert(t, d.cleanupMounts(cfg))

+		assert.Assert(t, d.cleanupMounts(&cfg.Config))

 		checkMounted(t, cfg.Root, false)

 		_, err = os.Stat(unmountFile)

@@ -287,13 +286,13 @@ func TestRootMountCleanup(t *testing.T) {

 		assert.NilError(t, err)

 		defer mount.Unmount(cfg.Root)

-		err = setupDaemonRootPropagation(cfg)

+		err = setupDaemonRootPropagation(&cfg.Config)

 		assert.NilError(t, err)

 		assert.Check(t, ensureShared(cfg.Root))

 		_, err = os.Stat(unmountFile)

 		assert.Assert(t, os.IsNotExist(err))

-		assert.Assert(t, d.cleanupMounts(cfg))

+		assert.Assert(t, d.cleanupMounts(&cfg.Config))

 		checkMounted(t, cfg.Root, true)

 	})

@@ -303,14 +302,14 @@ func TestRootMountCleanup(t *testing.T) {

 		assert.NilError(t, err)

 		defer mount.Unmount(cfg.Root)

-		err = setupDaemonRootPropagation(cfg)

+		err = setupDaemonRootPropagation(&cfg.Config)

 		assert.NilError(t, err)

 		if _, err := os.Stat(unmountFile); err == nil {

 			t.Fatal("unmount file should not exist")

 		}

-		assert.Assert(t, d.cleanupMounts(cfg))

+		assert.Assert(t, d.cleanupMounts(&cfg.Config))

 		checkMounted(t, cfg.Root, true)

 		assert.Assert(t, mount.Unmount(cfg.Root))

 	})

@@ -323,13 +322,13 @@ func TestRootMountCleanup(t *testing.T) {

 		err = os.WriteFile(unmountFile, nil, 0644)

 		assert.NilError(t, err)

-		err = setupDaemonRootPropagation(cfg)

+		err = setupDaemonRootPropagation(&cfg.Config)

 		assert.NilError(t, err)

 		_, err = os.Stat(unmountFile)

 		assert.Check(t, os.IsNotExist(err), err)

 		checkMounted(t, cfg.Root, false)

-		assert.Assert(t, d.cleanupMounts(cfg))

+		assert.Assert(t, d.cleanupMounts(&cfg.Config))

 	})

 }

@@ -8,7 +8,6 @@ import (

 	containertypes "github.com/docker/docker/api/types/container"

 	"github.com/docker/docker/container"

-	"github.com/docker/docker/daemon/config"

 	"github.com/docker/docker/errdefs"

 	"github.com/docker/docker/libnetwork"

 	"github.com/docker/docker/pkg/idtools"

@@ -301,7 +300,7 @@ func TestMerge(t *testing.T) {

 func TestValidateContainerIsolation(t *testing.T) {

 	d := Daemon{}

-	_, err := d.verifyContainerSettings(&config.Config{}, &containertypes.HostConfig{Isolation: containertypes.Isolation("invalid")}, nil, false)

+	_, err := d.verifyContainerSettings(&configStore{}, &containertypes.HostConfig{Isolation: containertypes.Isolation("invalid")}, nil, false)

 	assert.Check(t, is.Error(err, "invalid isolation 'invalid' on "+runtime.GOOS))

 }

@@ -639,7 +639,7 @@ func isRunningSystemd() bool {

 // verifyPlatformContainerSettings performs platform-specific validation of the

 // hostconfig and config structures.

-func verifyPlatformContainerSettings(daemon *Daemon, daemonCfg *config.Config, hostConfig *containertypes.HostConfig, update bool) (warnings []string, err error) {

+func verifyPlatformContainerSettings(daemon *Daemon, daemonCfg *configStore, hostConfig *containertypes.HostConfig, update bool) (warnings []string, err error) {

 	if hostConfig == nil {

 		return nil, nil

 	}

@@ -691,7 +691,7 @@ func verifyPlatformContainerSettings(daemon *Daemon, daemonCfg *config.Config, h

 			return warnings, fmt.Errorf("cannot share the host PID namespace when user namespaces are enabled")

 		}

 	}

-	if hostConfig.CgroupParent != "" && UsingSystemd(daemonCfg) {

+	if hostConfig.CgroupParent != "" && UsingSystemd(&daemonCfg.Config) {

 		// CgroupParent for systemd cgroup should be named as "xxx.slice"

 		if len(hostConfig.CgroupParent) <= 6 || !strings.HasSuffix(hostConfig.CgroupParent, ".slice") {

 			return warnings, fmt.Errorf("cgroup-parent for systemd cgroup should be a valid slice named as \"xxx.slice\"")

@@ -701,7 +701,7 @@ func verifyPlatformContainerSettings(daemon *Daemon, daemonCfg *config.Config, h

 		hostConfig.Runtime = daemonCfg.DefaultRuntime

 	}

-	if _, _, err := daemon.getRuntime(daemonCfg, hostConfig.Runtime); err != nil {

+	if _, _, err := daemonCfg.Runtimes.Get(hostConfig.Runtime); err != nil {

 		return warnings, err

 	}

@@ -757,7 +757,7 @@ func verifyDaemonSettings(conf *config.Config) error {

 	configureRuntimes(conf)

 	if rtName := conf.DefaultRuntime; rtName != "" {

-		if conf.GetRuntime(rtName) == nil {

+		if _, ok := conf.Runtimes[rtName]; !ok {

 			if !config.IsPermissibleC8dRuntimeName(rtName) {

 				return fmt.Errorf("specified default runtime '%s' does not exist", rtName)

 			}

@@ -245,7 +245,7 @@ func TestParseSecurityOpt(t *testing.T) {

 }

 func TestParseNNPSecurityOptions(t *testing.T) {

-	daemonCfg := &config.Config{NoNewPrivileges: true}

+	daemonCfg := &configStore{Config: config.Config{NoNewPrivileges: true}}

 	daemon := &Daemon{}

 	daemon.configStore.Store(daemonCfg)

 	opts := &container.SecurityOptions{}

@@ -254,7 +254,7 @@ func TestParseNNPSecurityOptions(t *testing.T) {

 	// test NNP when "daemon:true" and "no-new-privileges=false""

 	cfg.SecurityOpt = []string{"no-new-privileges=false"}

-	if err := daemon.parseSecurityOpt(daemonCfg, opts, cfg); err != nil {

+	if err := daemon.parseSecurityOpt(&daemonCfg.Config, opts, cfg); err != nil {

 		t.Fatalf("Unexpected daemon.parseSecurityOpt error: %v", err)

 	}

 	if opts.NoNewPrivileges {

@@ -265,7 +265,7 @@ func TestParseNNPSecurityOptions(t *testing.T) {

 	daemonCfg.NoNewPrivileges = false

 	cfg.SecurityOpt = []string{"no-new-privileges=true"}

-	if err := daemon.parseSecurityOpt(daemonCfg, opts, cfg); err != nil {

+	if err := daemon.parseSecurityOpt(&daemonCfg.Config, opts, cfg); err != nil {

 		t.Fatalf("Unexpected daemon.parseSecurityOpt error: %v", err)

 	}

 	if !opts.NoNewPrivileges {

@@ -171,7 +171,7 @@ func verifyPlatformContainerResources(resources *containertypes.Resources, isHyp

 // verifyPlatformContainerSettings performs platform-specific validation of the

 // hostconfig and config structures.

-func verifyPlatformContainerSettings(daemon *Daemon, daemonCfg *config.Config, hostConfig *containertypes.HostConfig, update bool) (warnings []string, err error) {

+func verifyPlatformContainerSettings(daemon *Daemon, daemonCfg *configStore, hostConfig *containertypes.HostConfig, update bool) (warnings []string, err error) {

 	if hostConfig == nil {

 		return nil, nil

 	}

@@ -556,10 +556,6 @@ func (daemon *Daemon) setupSeccompProfile(*config.Config) error {

 	return nil

 }

-func (daemon *Daemon) loadRuntimes() error {

-	return nil

-}

-

 func setupResolvConf(config *config.Config) {}

 func getSysInfo(*config.Config) *sysinfo.SysInfo {

@@ -25,7 +25,7 @@ import (

 // fails. If the remove succeeds, the container name is released, and

 // network links are removed.

 func (daemon *Daemon) ContainerRm(name string, config *types.ContainerRmConfig) error {

-	return daemon.containerRm(daemon.config(), name, config)

+	return daemon.containerRm(&daemon.config().Config, name, config)

 }

 func (daemon *Daemon) containerRm(cfg *config.Config, name string, opts *types.ContainerRmConfig) error {

@@ -252,7 +252,7 @@ func (daemon *Daemon) ContainerExecStart(ctx context.Context, name string, optio

 		p.Cwd = "/"

 	}

-	daemonCfg := daemon.config()

+	daemonCfg := &daemon.config().Config

 	if err := daemon.execSetPlatformOpt(ctx, daemonCfg, ec, p); err != nil {

 		return err

 	}

@@ -9,7 +9,6 @@ import (

 	"github.com/containerd/containerd/pkg/apparmor"

 	containertypes "github.com/docker/docker/api/types/container"

 	"github.com/docker/docker/container"

-	"github.com/docker/docker/daemon/config"

 	specs "github.com/opencontainers/runtime-spec/specs-go"

 	"gotest.tools/v3/assert"

 )

@@ -50,7 +49,7 @@ func TestExecSetPlatformOptAppArmor(t *testing.T) {

 		},

 	}

-	cfg := &config.Config{}

+	cfg := &configStore{}

 	d := &Daemon{}

 	d.configStore.Store(cfg)

@@ -83,7 +82,7 @@ func TestExecSetPlatformOptAppArmor(t *testing.T) {

 				ec := &container.ExecConfig{Container: c, Privileged: execPrivileged}

 				p := &specs.Process{}

-				err := d.execSetPlatformOpt(context.Background(), cfg, ec, p)

+				err := d.execSetPlatformOpt(context.Background(), &cfg.Config, ec, p)

 				assert.NilError(t, err)

 				assert.Equal(t, p.ApparmorProfile, tc.expectedProfile)

 			})

@@ -64,14 +64,14 @@ func (daemon *Daemon) SystemInfo() *types.Info {

 	daemon.fillContainerStates(v)

 	daemon.fillDebugInfo(v)

-	daemon.fillAPIInfo(v, cfg)

+	daemon.fillAPIInfo(v, &cfg.Config)

 	// Retrieve platform specific info

-	daemon.fillPlatformInfo(v, sysInfo, cfg)

+	daemon.fillPlatformInfo(v, sysInfo, &cfg.Config)

 	daemon.fillDriverInfo(v)

-	daemon.fillPluginsInfo(v, cfg)

-	daemon.fillSecurityOptions(v, sysInfo, cfg)

+	daemon.fillPluginsInfo(v, &cfg.Config)

+	daemon.fillSecurityOptions(v, sysInfo, &cfg.Config)

 	daemon.fillLicense(v)

-	daemon.fillDefaultAddressPools(v, cfg)

+	daemon.fillDefaultAddressPools(v, &cfg.Config)

 	return v

 }

@@ -117,7 +117,7 @@ func (daemon *Daemon) SystemVersion() types.Version {

 	v.Platform.Name = dockerversion.PlatformName

-	daemon.fillPlatformVersion(&v, cfg)

+	daemon.fillPlatformVersion(&v, &cfg.Config)

 	return v

 }

@@ -38,22 +38,22 @@ func (daemon *Daemon) fillPlatformInfo(v *types.Info, sysInfo *sysinfo.SysInfo,

 		v.CPUSet = sysInfo.Cpuset

 		v.PidsLimit = sysInfo.PidsLimit

 	}

-	v.Runtimes = cfg.GetAllRuntimes()

+	v.Runtimes = make(map[string]types.Runtime)

+	for n, r := range cfg.Runtimes {

+		v.Runtimes[n] = types.Runtime{

+			Path: r.Path,

+			Args: append([]string(nil), r.Args...),

+		}

+	}

 	v.DefaultRuntime = cfg.DefaultRuntime

 	v.RuncCommit.ID = "N/A"

 	v.ContainerdCommit.ID = "N/A"

 	v.InitCommit.ID = "N/A"

-	if rt := cfg.GetRuntime(v.DefaultRuntime); rt != nil {

-		if rv, err := exec.Command(rt.Path, "--version").Output(); err == nil {

-			if _, _, commit, err := parseRuntimeVersion(string(rv)); err != nil {

-				logrus.Warnf("failed to parse %s version: %v", rt.Path, err)

-			} else {

-				v.RuncCommit.ID = commit

-			}

-		} else {

-			logrus.Warnf("failed to retrieve %s version: %v", rt.Path, err)

-		}

+	if _, _, commit, err := parseDefaultRuntimeVersion(cfg); err != nil {

+		logrus.Warnf(err.Error())

+	} else {

+		v.RuncCommit.ID = commit

 	}

 	if rv, err := daemon.containerd.Version(context.Background()); err == nil {

@@ -177,23 +177,16 @@ func (daemon *Daemon) fillPlatformVersion(v *types.Version, cfg *config.Config)

 		})

 	}

-	defaultRuntime := cfg.DefaultRuntime

-	if rt := cfg.GetRuntime(defaultRuntime); rt != nil {

-		if rv, err := exec.Command(rt.Path, "--version").Output(); err == nil {

-			if _, ver, commit, err := parseRuntimeVersion(string(rv)); err != nil {

-				logrus.Warnf("failed to parse %s version: %v", rt.Path, err)

-			} else {

-				v.Components = append(v.Components, types.ComponentVersion{

-					Name:    defaultRuntime,

-					Version: ver,

-					Details: map[string]string{

-						"GitCommit": commit,

-					},

-				})

-			}

-		} else {

-			logrus.Warnf("failed to retrieve %s version: %v", rt.Path, err)

-		}

+	if _, ver, commit, err := parseDefaultRuntimeVersion(cfg); err != nil {

+		logrus.Warnf(err.Error())

+	} else {

+		v.Components = append(v.Components, types.ComponentVersion{

+			Name:    cfg.DefaultRuntime,

+			Version: ver,

+			Details: map[string]string{

+				"GitCommit": commit,

+			},

+		})

 	}

 	if initBinary, err := cfg.LookupInitPath(); err != nil {

@@ -318,7 +311,7 @@ func parseInitVersion(v string) (version string, commit string, err error) {

 //	runc version 1.0.0-rc5+dev

 //	commit: 69663f0bd4b60df09991c08812a60108003fa340

 //	spec: 1.0.0

-func parseRuntimeVersion(v string) (runtime string, version string, commit string, err error) {

+func parseRuntimeVersion(v string) (runtime, version, commit string, err error) {

 	lines := strings.Split(strings.TrimSpace(v), "\n")

 	for _, line := range lines {

 		if strings.Contains(line, "version") {