@@ -1,9 +1,9 @@

 package daemon

 import (

-	"github.com/moby/moby/api/types/filters"

 	"github.com/moby/moby/api/types/network"

 	lncluster "github.com/moby/moby/v2/daemon/libnetwork/cluster"

+	dnetwork "github.com/moby/moby/v2/daemon/network"

 )

 // Cluster is the interface for [github.com/moby/moby/v2/daemon/cluster.Cluster].

@@ -22,6 +22,6 @@ type ClusterStatus interface {

 // NetworkManager provides methods to manage networks

 type NetworkManager interface {

 	GetNetwork(input string) (network.Inspect, error)

-	GetNetworks(filters.Args) ([]network.Inspect, error)

+	GetNetworks(dnetwork.Filter) ([]network.Inspect, error)

 	RemoveNetwork(input string) error

 }

@@ -2,6 +2,7 @@ package convert

 import (

 	"strings"

+	"time"

 	gogotypes "github.com/gogo/protobuf/types"

 	"github.com/moby/moby/api/types/network"

@@ -270,6 +271,11 @@ func (nw FilterNetwork) Scope() string {

 	return scope.Swarm

 }

+func (nw FilterNetwork) Created() time.Time {

+	t, _ := gogotypes.TimestampFromProto(nw.N.Meta.CreatedAt)

+	return t

+}

+

 func (nw FilterNetwork) HasContainerAttachments() bool {

 	// Not tracked in swarmkit

 	return false

@@ -5,7 +5,6 @@ import (

 	"fmt"

 	"github.com/containerd/log"

-	"github.com/moby/moby/api/types/filters"

 	"github.com/moby/moby/api/types/network"

 	types "github.com/moby/moby/api/types/swarm"

 	"github.com/moby/moby/v2/daemon/cluster/convert"

@@ -16,25 +15,11 @@ import (

 )

 // GetNetworks returns all current cluster managed networks.

-func (c *Cluster) GetNetworks(filter filters.Args) ([]network.Inspect, error) {

-	flt, err := networkSettings.NewFilter(filter)

-	if err != nil {

-		return nil, err

-	}

-

-	var f *swarmapi.ListNetworksRequest_Filters

-

-	if filter.Len() > 0 {

-		f = &swarmapi.ListNetworksRequest_Filters{}

-

-		if filter.Contains("name") {

-			f.Names = filter.Get("name")

-			f.NamePrefixes = filter.Get("name")

-		}

-

-		if filter.Contains("id") {

-			f.IDPrefixes = filter.Get("id")

-		}

+func (c *Cluster) GetNetworks(filter networkSettings.Filter) ([]network.Inspect, error) {

+	f := &swarmapi.ListNetworksRequest_Filters{

+		Names:        filter.Get("name"),

+		NamePrefixes: filter.Get("name"),

+		IDPrefixes:   filter.Get("id"),

 	}

 	list, err := c.listNetworks(context.TODO(), f)

@@ -46,7 +31,7 @@ func (c *Cluster) GetNetworks(filter filters.Args) ([]network.Inspect, error) {

 		if n.Spec.Annotations.Labels["com.docker.swarm.predefined"] == "true" {

 			continue

 		}

-		if flt.Matches(convert.FilterNetwork{N: n}) {

+		if filter.Matches(convert.FilterNetwork{N: n}) {

 			filtered = append(filtered, convert.BasicNetworkFromGRPC(*n))

 		}

 	}

@@ -17,7 +17,6 @@ import (

 	"github.com/docker/go-connections/nat"

 	containertypes "github.com/moby/moby/api/types/container"

 	"github.com/moby/moby/api/types/events"

-	"github.com/moby/moby/api/types/filters"

 	networktypes "github.com/moby/moby/api/types/network"

 	clustertypes "github.com/moby/moby/v2/daemon/cluster/provider"

 	"github.com/moby/moby/v2/daemon/config"

@@ -591,16 +590,11 @@ func (daemon *Daemon) deleteNetwork(nw *libnetwork.Network, dynamic bool) error

 }

 // GetNetworks returns a list of all networks

-func (daemon *Daemon) GetNetworks(filter filters.Args, config backend.NetworkListConfig) ([]networktypes.Inspect, error) {

-	flt, err := network.NewFilter(filter)

-	if err != nil {

-		return nil, err

-	}

-

+func (daemon *Daemon) GetNetworks(filter network.Filter, config backend.NetworkListConfig) ([]networktypes.Inspect, error) {

 	allNetworks := daemon.getAllNetworks()

 	networks := make([]networktypes.Inspect, 0, len(allNetworks))

 	for _, n := range allNetworks {

-		if flt.Matches(n) {

+		if filter.Matches(n) {

 			nr := buildNetworkResource(n)

 			if config.Detailed {

 				nr.Containers = buildContainerAttachments(n)

@@ -1,7 +1,10 @@

 package network

 import (

+	"time"

+

 	"github.com/moby/moby/api/types/filters"

+	"github.com/moby/moby/v2/daemon/internal/timestamp"

 	"github.com/moby/moby/v2/errdefs"

 	"github.com/pkg/errors"

 )

@@ -10,6 +13,7 @@ type Filter struct {

 	args filters.Args

 	filterByUse, danglingOnly bool

+	until                     time.Time

 }

 type FilterNetwork interface {

@@ -18,6 +22,7 @@ type FilterNetwork interface {

 	ID() string

 	Labels() map[string]string

 	Scope() string

+	Created() time.Time

 	HasContainerAttachments() bool

 	HasServiceAttachments() bool

 }

@@ -46,7 +51,31 @@ func NewFilter(args filters.Args) (Filter, error) {

 	if err := args.WalkValues("type", validateNetworkTypeFilter); err != nil {

 		return Filter{}, err

 	}

-	return Filter{args: args, filterByUse: filterByUse, danglingOnly: danglingOnly}, nil

+	until := time.Time{}

+	if untilFilters := args.Get("until"); len(untilFilters) > 0 {

+		if len(untilFilters) > 1 {

+			return Filter{}, errdefs.InvalidParameter(errors.New("more than one until filter specified"))

+		}

+		ts, err := timestamp.GetTimestamp(untilFilters[0], time.Now())

+		if err != nil {

+			return Filter{}, errdefs.InvalidParameter(err)

+		}

+		seconds, nanoseconds, err := timestamp.ParseTimestamps(ts, 0)

+		if err != nil {

+			return Filter{}, errdefs.InvalidParameter(err)

+		}

+		until = time.Unix(seconds, nanoseconds)

+	}

+	return Filter{

+		args:         args,

+		filterByUse:  filterByUse,

+		danglingOnly: danglingOnly,

+		until:        until,

+	}, nil

+}

+

+func (f Filter) Get(key string) []string {

+	return f.args.Get(key)

 }

 // Matches returns true if nw satisfies the filter criteria.

@@ -67,6 +96,10 @@ func (f Filter) Matches(nw FilterNetwork) bool {

 		!f.args.MatchKVList("label", nw.Labels()) {

 		return false

 	}

+	if f.args.Contains("label!") &&

+		f.args.MatchKVList("label!", nw.Labels()) {

+		return false

+	}

 	if f.args.Contains("scope") &&

 		!f.args.ExactMatch("scope", nw.Scope()) {

 		return false

@@ -84,6 +117,10 @@ func (f Filter) Matches(nw FilterNetwork) bool {

 		!matchesType(netTypes, nw) {

 		return false

 	}

+	if !f.until.IsZero() &&

+		nw.Created().After(f.until) {

+		return false

+	}

 	return true

 }

@@ -4,6 +4,7 @@ package network

 import (

 	"testing"

+	"time"

 	"gotest.tools/v3/assert"

 	is "gotest.tools/v3/assert/cmp"

@@ -20,6 +21,7 @@ type mockFilterNetwork struct {

 	id         string

 	labels     map[string]string

 	scope      string

+	created    time.Time

 	containers bool

 	services   bool

 }

@@ -44,6 +46,10 @@ func (n mockFilterNetwork) Scope() string {

 	return n.scope

 }

+func (n mockFilterNetwork) Created() time.Time {

+	return n.created

+}

+

 func (n mockFilterNetwork) HasContainerAttachments() bool {

 	return n.containers

 }

@@ -55,41 +61,47 @@ func (n mockFilterNetwork) HasServiceAttachments() bool {

 func TestFilter(t *testing.T) {

 	networks := []mockFilterNetwork{

 		{

-			name:   network.NetworkHost,

-			id:     "ubfg", // ROT13(name)

-			driver: "host",

-			scope:  "local",

+			name:    network.NetworkHost,

+			id:      "ubfg", // ROT13(name)

+			driver:  "host",

+			scope:   "local",

+			created: time.Date(2025, time.June, 1, 0, 0, 0, 0, time.Local),

 		},

 		{

-			name:   network.NetworkBridge,

-			id:     "oevqtr",

-			driver: "bridge",

-			scope:  "local",

+			name:    network.NetworkBridge,

+			id:      "oevqtr",

+			driver:  "bridge",

+			scope:   "local",

+			created: time.Date(2025, time.June, 1, 0, 0, 0, 0, time.Local),

 		},

 		{

-			name:   network.NetworkNone,

-			id:     "abar",

-			driver: "null",

-			scope:  "local",

+			name:    network.NetworkNone,

+			id:      "abar",

+			driver:  "null",

+			scope:   "local",

+			created: time.Date(2025, time.June, 1, 0, 0, 0, 0, time.Local),

 		},

 		{

-			name:   "myoverlay",

-			id:     "zlbireynl",

-			driver: "overlay",

-			scope:  "swarm",

+			name:    "myoverlay",

+			id:      "zlbireynl",

+			driver:  "overlay",

+			scope:   "swarm",

+			created: time.Date(2024, time.June, 1, 12, 0, 0, 0, time.Local),

 		},

 		{

-			name:   "mydrivernet",

-			id:     "zlqevirearg",

-			driver: "mydriver",

-			scope:  "local",

-			labels: map[string]string{"foo": "bar"},

+			name:    "mydrivernet",

+			id:      "zlqevirearg",

+			driver:  "mydriver",

+			scope:   "local",

+			labels:  map[string]string{"foo": "bar"},

+			created: time.Date(2024, time.December, 1, 2, 0, 0, 0, time.Local),

 		},

 		{

-			name:   "mykvnet",

-			id:     "zlxiarg",

-			driver: "mykvdriver",

-			scope:  "global",

+			name:    "mykvnet",

+			id:      "zlxiarg",

+			driver:  "mykvdriver",

+			scope:   "global",

+			created: time.Date(2025, time.January, 1, 0, 0, 0, 0, time.Local),

 		},

 		{

 			name:       "networkwithcontainer",

@@ -97,6 +109,7 @@ func TestFilter(t *testing.T) {

 			driver:     "nwc",

 			scope:      "local",

 			containers: true,

+			created:    time.Date(2025, time.June, 1, 0, 0, 0, 0, time.Local),

 		},

 		{

 			name:     "networkwithservice",

@@ -104,6 +117,14 @@ func TestFilter(t *testing.T) {

 			driver:   "nwc",

 			scope:    "local",

 			services: true,

+			created:  time.Date(2025, time.June, 1, 0, 0, 0, 0, time.Local),

+		},

+		{

+			name:    "idoverlap",

+			id:      "aaaaa0my0bbbbbb",

+			driver:  "nwc",

+			scope:   "local",

+			created: time.Date(2025, time.February, 1, 0, 0, 0, 0, time.Local),

 		},

 	}

@@ -142,7 +163,7 @@ func TestFilter(t *testing.T) {

 		{

 			subtest: "type=custom",

 			filter:  filters.NewArgs(filters.Arg("type", "custom")),

-			results: []string{"myoverlay", "mydrivernet", "mykvnet", "networkwithcontainer", "networkwithservice"},

+			results: []string{"myoverlay", "mydrivernet", "mykvnet", "networkwithcontainer", "networkwithservice", "idoverlap"},

 		},

 		{

 			subtest: "type=builtin",

@@ -157,7 +178,7 @@ func TestFilter(t *testing.T) {

 		{

 			subtest: "scope=local",

 			filter:  filters.NewArgs(filters.Arg("scope", "local")),

-			results: []string{network.NetworkHost, network.NetworkBridge, network.NetworkNone, "mydrivernet", "networkwithcontainer", "networkwithservice"},

+			results: []string{network.NetworkHost, network.NetworkBridge, network.NetworkNone, "mydrivernet", "networkwithcontainer", "networkwithservice", "idoverlap"},

 		},

 		{

 			subtest: "scope=swarm",

@@ -172,12 +193,12 @@ func TestFilter(t *testing.T) {

 		{

 			subtest: "dangling=true",

 			filter:  filters.NewArgs(filters.Arg("dangling", "true")),

-			results: []string{"myoverlay", "mydrivernet", "mykvnet"},

+			results: []string{"myoverlay", "mydrivernet", "mykvnet", "idoverlap"},

 		},

 		{

 			subtest: "dangling=1",

 			filter:  filters.NewArgs(filters.Arg("dangling", "1")),

-			results: []string{"myoverlay", "mydrivernet", "mykvnet"},

+			results: []string{"myoverlay", "mydrivernet", "mykvnet", "idoverlap"},

 		},

 		{

 			subtest: "dangling=false",

@@ -227,6 +248,31 @@ func TestFilter(t *testing.T) {

 			filter:  filters.NewArgs(filters.Arg("id", "argjbex")),

 			results: []string{"networkwithcontainer", "networkwithservice"},

 		},

+		{

+			subtest: "id=my",

+			filter:  filters.NewArgs(filters.Arg("id", "my")),

+			results: []string{"idoverlap"},

+		},

+		{

+			subtest: "label!=foo",

+			filter:  filters.NewArgs(filters.Arg("label!", "foo")),

+			results: []string{network.NetworkHost, network.NetworkBridge, network.NetworkNone, "myoverlay", "mykvnet", "networkwithcontainer", "networkwithservice", "idoverlap"},

+		},

+		{

+			subtest: "until=2025-01-01",

+			filter:  filters.NewArgs(filters.Arg("until", "2025-01-01")),

+			results: []string{"myoverlay", "mydrivernet", "mykvnet"},

+		},

+		{

+			subtest: "until=2024-12-01T01:00:00",

+			filter:  filters.NewArgs(filters.Arg("until", "2024-12-01T01:00:00")),

+			results: []string{"myoverlay"},

+		},

+		{

+			subtest: "MultipleTerms=until",

+			filter:  filters.NewArgs(filters.Arg("until", "2024-12-01T01:00:00"), filters.Arg("until", "2h")),

+			err:     "more than one until filter specified",

+		},

 	}

 	for _, testCase := range testCases {

@@ -13,6 +13,7 @@ import (

 	"github.com/moby/moby/v2/daemon/internal/lazyregexp"

 	"github.com/moby/moby/v2/daemon/internal/timestamp"

 	"github.com/moby/moby/v2/daemon/libnetwork"

+	dnetwork "github.com/moby/moby/v2/daemon/network"

 	"github.com/moby/moby/v2/daemon/server/backend"

 	"github.com/moby/moby/v2/errdefs"

 	"github.com/pkg/errors"

@@ -96,11 +97,9 @@ func (daemon *Daemon) ContainersPrune(ctx context.Context, pruneFilters filters.

 }

 // localNetworksPrune removes unused local networks

-func (daemon *Daemon) localNetworksPrune(ctx context.Context, pruneFilters filters.Args) *network.PruneReport {

+func (daemon *Daemon) localNetworksPrune(ctx context.Context, pruneFilters dnetwork.Filter) *network.PruneReport {

 	rep := &network.PruneReport{}

-	until, _ := getUntilFromPruneFilters(pruneFilters)

-

 	// When the function returns true, the walk will stop.

 	daemon.netController.WalkNetworks(func(nw *libnetwork.Network) bool {

 		select {

@@ -112,10 +111,7 @@ func (daemon *Daemon) localNetworksPrune(ctx context.Context, pruneFilters filte

 		if nw.ConfigOnly() {

 			return false

 		}

-		if !until.IsZero() && nw.Created().After(until) {

-			return false

-		}

-		if !matchLabels(pruneFilters, nw.Labels()) {

+		if !pruneFilters.Matches(nw) {

 			return false

 		}

 		if !nw.IsPruneable() {

@@ -137,11 +133,9 @@ func (daemon *Daemon) localNetworksPrune(ctx context.Context, pruneFilters filte

 var networkIsInUse = lazyregexp.New(`network ([[:alnum:]]+) is in use`)

 // clusterNetworksPrune removes unused cluster networks

-func (daemon *Daemon) clusterNetworksPrune(ctx context.Context, pruneFilters filters.Args) (*network.PruneReport, error) {

+func (daemon *Daemon) clusterNetworksPrune(ctx context.Context, pruneFilters dnetwork.Filter) (*network.PruneReport, error) {

 	rep := &network.PruneReport{}

-	until, _ := getUntilFromPruneFilters(pruneFilters)

-

 	cluster := daemon.GetCluster()

 	if !cluster.IsManager() {

@@ -162,12 +156,6 @@ func (daemon *Daemon) clusterNetworksPrune(ctx context.Context, pruneFilters fil

 				// Routing-mesh network removal has to be explicitly invoked by user

 				continue

 			}

-			if !until.IsZero() && nw.Created.After(until) {

-				continue

-			}

-			if !matchLabels(pruneFilters, nw.Labels) {

-				continue

-			}

 			// https://github.com/moby/moby/issues/24186

 			// `docker network inspect` unfortunately displays ONLY those containers that are local to that node.

 			// So we try to remove it anyway and check the error

@@ -187,19 +175,20 @@ func (daemon *Daemon) clusterNetworksPrune(ctx context.Context, pruneFilters fil

 }

 // NetworksPrune removes unused networks

-func (daemon *Daemon) NetworksPrune(ctx context.Context, pruneFilters filters.Args) (*network.PruneReport, error) {

+func (daemon *Daemon) NetworksPrune(ctx context.Context, filterArgs filters.Args) (*network.PruneReport, error) {

 	if !daemon.pruneRunning.CompareAndSwap(false, true) {

 		return nil, errPruneRunning

 	}

 	defer daemon.pruneRunning.Store(false)

 	// make sure that only accepted filters have been received

-	err := pruneFilters.Validate(networksAcceptedFilters)

+	err := filterArgs.Validate(networksAcceptedFilters)

 	if err != nil {

 		return nil, err

 	}

-	if _, err := getUntilFromPruneFilters(pruneFilters); err != nil {

+	pruneFilters, err := dnetwork.NewFilter(filterArgs)

+	if err != nil {

 		return nil, err

 	}

@@ -5,13 +5,14 @@ import (

 	"github.com/moby/moby/api/types/filters"

 	"github.com/moby/moby/api/types/network"

+	dnetwork "github.com/moby/moby/v2/daemon/network"

 	"github.com/moby/moby/v2/daemon/server/backend"

 )

 // Backend is all the methods that need to be implemented

 // to provide network specific functionality.

 type Backend interface {

-	GetNetworks(filters.Args, backend.NetworkListConfig) ([]network.Inspect, error)

+	GetNetworks(dnetwork.Filter, backend.NetworkListConfig) ([]network.Inspect, error)

 	CreateNetwork(ctx context.Context, nc network.CreateRequest) (*network.CreateResponse, error)

 	ConnectContainerToNetwork(ctx context.Context, containerName, networkName string, endpointConfig *network.EndpointSettings) error

 	DisconnectContainerFromNetwork(containerName string, networkName string, force bool) error

@@ -22,7 +23,7 @@ type Backend interface {

 // ClusterBackend is all the methods that need to be implemented

 // to provide cluster network specific functionality.

 type ClusterBackend interface {

-	GetNetworks(filters.Args) ([]network.Inspect, error)

+	GetNetworks(dnetwork.Filter) ([]network.Inspect, error)

 	GetNetwork(name string) (network.Inspect, error)

 	GetNetworksByName(name string) ([]network.Inspect, error)

 	CreateNetwork(nc network.CreateRequest) (string, error)

@@ -11,6 +11,7 @@ import (

 	"github.com/moby/moby/api/types/versions"

 	"github.com/moby/moby/v2/daemon/libnetwork"

 	"github.com/moby/moby/v2/daemon/libnetwork/scope"

+	dnetwork "github.com/moby/moby/v2/daemon/network"

 	"github.com/moby/moby/v2/daemon/server/backend"

 	"github.com/moby/moby/v2/daemon/server/httputils"

 	"github.com/moby/moby/v2/daemon/server/networkbackend"

@@ -23,12 +24,17 @@ func (n *networkRouter) getNetworksList(ctx context.Context, w http.ResponseWrit

 		return err

 	}

-	filter, err := filters.FromJSON(r.Form.Get("filters"))

+	filterArgs, err := filters.FromJSON(r.Form.Get("filters"))

 	if err != nil {

 		return err

 	}

-	if err := network.ValidateFilters(filter); err != nil {

+	if err := network.ValidateFilters(filterArgs); err != nil {

+		return err

+	}

+

+	filter, err := dnetwork.NewFilter(filterArgs)

+	if err != nil {

 		return err

 	}

@@ -114,10 +120,15 @@ func (n *networkRouter) getNetwork(ctx context.Context, w http.ResponseWriter, r

 	// TODO(@cpuguy83): All this logic for figuring out which network to return does not belong here

 	// Instead there should be a backend function to just get one network.

-	filter := filters.NewArgs(filters.Arg("idOrName", term))

+	filterArgs := filters.NewArgs(filters.Arg("idOrName", term))

 	if networkScope != "" {

-		filter.Add("scope", networkScope)

+		filterArgs.Add("scope", networkScope)

+	}

+	filter, err := dnetwork.NewFilter(filterArgs)

+	if err != nil {

+		return err

 	}

+

 	networks, _ := n.backend.GetNetworks(filter, backend.NetworkListConfig{Detailed: true, Verbose: verbose})

 	for _, nw := range networks {

 		if nw.ID == term {

@@ -322,7 +333,10 @@ func (n *networkRouter) findUniqueNetwork(term string) (network.Inspect, error)

 	listByFullName := map[string]network.Inspect{}

 	listByPartialID := map[string]network.Inspect{}

-	filter := filters.NewArgs(filters.Arg("idOrName", term))

+	filter, err := dnetwork.NewFilter(filters.NewArgs(filters.Arg("idOrName", term)))

+	if err != nil {

+		return network.Inspect{}, err

+	}

 	networks, _ := n.backend.GetNetworks(filter, backend.NetworkListConfig{Detailed: true})

 	for _, nw := range networks {

 		if nw.ID == term {