diff --git a/go.mod b/go.mod
index 0631cc777aeb..0adb8171f994 100644
--- a/go.mod
+++ b/go.mod
@@ -32,7 +32,7 @@ require (
 	github.com/coreos/go-systemd/v22 v22.5.0
 	github.com/distribution/reference v0.6.0
 	github.com/docker/cli v27.4.1+incompatible
-	github.com/docker/docker v27.4.1+incompatible
+	github.com/docker/docker v27.5.0+incompatible
 	github.com/docker/go-connections v0.5.0
 	github.com/docker/go-units v0.5.0
 	github.com/gofrs/flock v0.12.1
diff --git a/go.sum b/go.sum
index 82fb83b9e87d..1029526ccc03 100644
--- a/go.sum
+++ b/go.sum
@@ -134,8 +134,8 @@ github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5Qvfr
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/docker/cli v27.4.1+incompatible h1:VzPiUlRJ/xh+otB75gva3r05isHMo5wXDfPRi5/b4hI=
 github.com/docker/cli v27.4.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/docker v27.4.1+incompatible h1:ZJvcY7gfwHn1JF48PfbyXg7Jyt9ZCWDW+GGXOIxEwp4=
-github.com/docker/docker v27.4.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v27.5.0+incompatible h1:um++2NcQtGRTz5eEgO6aJimo6/JxrTXC941hd05JO6U=
+github.com/docker/docker v27.5.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
 github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
diff --git a/vendor/github.com/docker/docker/api/swagger.yaml b/vendor/github.com/docker/docker/api/swagger.yaml
index f519806cd47e..142bb038a1cd 100644
--- a/vendor/github.com/docker/docker/api/swagger.yaml
+++ b/vendor/github.com/docker/docker/api/swagger.yaml
@@ -1195,6 +1195,7 @@ definitions:
               - "default"
               - "process"
               - "hyperv"
+              - ""
           MaskedPaths:
             type: "array"
             description: |
@@ -4180,6 +4181,7 @@ definitions:
               - "default"
               - "process"
               - "hyperv"
+              - ""
           Init:
             description: |
               Run an init inside the container that forwards signals and reaps
@@ -5750,6 +5752,7 @@ definitions:
           - "default"
           - "hyperv"
           - "process"
+          - ""
       InitBinary:
         description: |
           Name and, optional, path of the `docker-init` binary.
@@ -11632,6 +11635,7 @@ paths:
             example:
               ListenAddr: "0.0.0.0:2377"
               AdvertiseAddr: "192.168.1.1:2377"
+              DataPathAddr: "192.168.1.1"
               RemoteAddrs:
                 - "node1:2377"
               JoinToken: "SWMTKN-1-3pu6hszjas19xyp7ghgosyx9k8atbfcr8p2is99znpy26u2lkl-7p73s1dx5in4tatdymyhg9hu2"
diff --git a/vendor/github.com/docker/docker/api/types/container/hostconfig.go b/vendor/github.com/docker/docker/api/types/container/hostconfig.go
index 03648fb7b5dc..83198305e7a8 100644
--- a/vendor/github.com/docker/docker/api/types/container/hostconfig.go
+++ b/vendor/github.com/docker/docker/api/types/container/hostconfig.go
@@ -10,7 +10,7 @@ import (
 	"github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/api/types/strslice"
 	"github.com/docker/go-connections/nat"
-	units "github.com/docker/go-units"
+	"github.com/docker/go-units"
 )
 
 // CgroupnsMode represents the cgroup namespace mode of the container
diff --git a/vendor/github.com/docker/docker/pkg/chrootarchive/archive_unix_nolinux.go b/vendor/github.com/docker/docker/pkg/chrootarchive/archive_unix_nolinux.go
index 13e557b12830..8689573d9406 100644
--- a/vendor/github.com/docker/docker/pkg/chrootarchive/archive_unix_nolinux.go
+++ b/vendor/github.com/docker/docker/pkg/chrootarchive/archive_unix_nolinux.go
@@ -11,7 +11,7 @@ import (
 	"syscall"
 
 	"github.com/docker/docker/pkg/archive"
-	"github.com/docker/docker/pkg/reexec"
+	"github.com/moby/sys/reexec"
 	"github.com/pkg/errors"
 	"golang.org/x/sys/unix"
 )
diff --git a/vendor/github.com/docker/docker/pkg/ioutils/bytespipe.go b/vendor/github.com/docker/docker/pkg/ioutils/bytespipe.go
index c1cfa62fd27f..85450bf6b3e4 100644
--- a/vendor/github.com/docker/docker/pkg/ioutils/bytespipe.go
+++ b/vendor/github.com/docker/docker/pkg/ioutils/bytespipe.go
@@ -18,6 +18,8 @@ const blockThreshold = 1e6
 
 var (
 	// ErrClosed is returned when Write is called on a closed BytesPipe.
+	//
+	// Deprecated: this type is only used internally, and will be removed in the next release.
 	ErrClosed = errors.New("write to closed BytesPipe")
 
 	bufPools     = make(map[int]*sync.Pool)
@@ -28,6 +30,8 @@ var (
 // All written data may be read at most once. Also, BytesPipe allocates
 // and releases new byte slices to adjust to current needs, so the buffer
 // won't be overgrown after peak loads.
+//
+// Deprecated: this type is only used internally, and will be removed in the next release.
 type BytesPipe struct {
 	mu        sync.Mutex
 	wait      *sync.Cond
@@ -40,6 +44,8 @@ type BytesPipe struct {
 // NewBytesPipe creates new BytesPipe, initialized by specified slice.
 // If buf is nil, then it will be initialized with slice which cap is 64.
 // buf will be adjusted in a way that len(buf) == 0, cap(buf) == cap(buf).
+//
+// Deprecated: this function is only used internally, and will be removed in the next release.
 func NewBytesPipe() *BytesPipe {
 	bp := &BytesPipe{}
 	bp.buf = append(bp.buf, getBuffer(minCap))
diff --git a/vendor/github.com/docker/docker/pkg/ioutils/writeflusher.go b/vendor/github.com/docker/docker/pkg/ioutils/writeflusher.go
index 91b8d182662f..d8a8893ff1c8 100644
--- a/vendor/github.com/docker/docker/pkg/ioutils/writeflusher.go
+++ b/vendor/github.com/docker/docker/pkg/ioutils/writeflusher.go
@@ -80,13 +80,19 @@ func (wf *WriteFlusher) Close() error {
 	return nil
 }
 
+// nopFlusher represents a type which flush operation is nop.
+type nopFlusher struct{}
+
+// Flush is a nop operation.
+func (f *nopFlusher) Flush() {}
+
 // NewWriteFlusher returns a new WriteFlusher.
 func NewWriteFlusher(w io.Writer) *WriteFlusher {
 	var fl flusher
 	if f, ok := w.(flusher); ok {
 		fl = f
 	} else {
-		fl = &NopFlusher{}
+		fl = &nopFlusher{}
 	}
 	return &WriteFlusher{w: w, flusher: fl, closed: make(chan struct{}), flushed: make(chan struct{})}
 }
diff --git a/vendor/github.com/docker/docker/pkg/ioutils/writers.go b/vendor/github.com/docker/docker/pkg/ioutils/writers.go
index 1f50602f28c8..aec8b4c03e51 100644
--- a/vendor/github.com/docker/docker/pkg/ioutils/writers.go
+++ b/vendor/github.com/docker/docker/pkg/ioutils/writers.go
@@ -6,6 +6,8 @@ import (
 )
 
 // NopWriter represents a type which write operation is nop.
+//
+// Deprecated: use [io.Discard] instead. This type will be removed in the next release.
 type NopWriter struct{}
 
 func (*NopWriter) Write(buf []byte) (int, error) {
@@ -19,15 +21,16 @@ type nopWriteCloser struct {
 func (w *nopWriteCloser) Close() error { return nil }
 
 // NopWriteCloser returns a nopWriteCloser.
+//
+// Deprecated: This function is no longer used and will be removed in the next release.
 func NopWriteCloser(w io.Writer) io.WriteCloser {
 	return &nopWriteCloser{w}
 }
 
 // NopFlusher represents a type which flush operation is nop.
-type NopFlusher struct{}
-
-// Flush is a nop operation.
-func (f *NopFlusher) Flush() {}
+//
+// Deprecated: NopFlusher is only used internally and will be removed in the next release.
+type NopFlusher = nopFlusher
 
 type writeCloserWrapper struct {
 	io.Writer
@@ -55,12 +58,16 @@ func NewWriteCloserWrapper(r io.Writer, closer func() error) io.WriteCloser {
 // of bytes written to the writer during a "session".
 // This can be convenient when write return is masked
 // (e.g., json.Encoder.Encode())
+//
+// Deprecated: this type is no longer used and will be removed in the next release.
 type WriteCounter struct {
 	Count  int64
 	Writer io.Writer
 }
 
 // NewWriteCounter returns a new WriteCounter.
+//
+// Deprecated: this function is no longer used and will be removed in the next release.
 func NewWriteCounter(w io.Writer) *WriteCounter {
 	return &WriteCounter{
 		Writer: w,
diff --git a/vendor/github.com/docker/docker/pkg/reexec/command_linux.go b/vendor/github.com/docker/docker/pkg/reexec/command_linux.go
deleted file mode 100644
index 952633c864e0..000000000000
--- a/vendor/github.com/docker/docker/pkg/reexec/command_linux.go
+++ /dev/null
@@ -1,26 +0,0 @@
-package reexec
-
-import (
-	"os/exec"
-	"syscall"
-)
-
-// Command returns an [*exec.Cmd] which has Path as current binary which,
-// on Linux, is set to the in-memory version (/proc/self/exe) of the current
-// binary, it is thus safe to delete or replace the on-disk binary (os.Args[0]).
-//
-// On Linux, the Pdeathsig of [*exec.Cmd.SysProcAttr] is set to SIGTERM.
-// This signal will be sent to the process when the OS thread which created
-// the process dies.
-//
-// It is the caller's responsibility to ensure that the creating thread is
-// not terminated prematurely. See https://go.dev/issue/27505 for more details.
-func Command(args ...string) *exec.Cmd {
-	return &exec.Cmd{
-		Path: Self(),
-		Args: args,
-		SysProcAttr: &syscall.SysProcAttr{
-			Pdeathsig: syscall.SIGTERM,
-		},
-	}
-}
diff --git a/vendor/github.com/docker/docker/pkg/reexec/command_other.go b/vendor/github.com/docker/docker/pkg/reexec/command_other.go
deleted file mode 100644
index b458ef2d20d6..000000000000
--- a/vendor/github.com/docker/docker/pkg/reexec/command_other.go
+++ /dev/null
@@ -1,19 +0,0 @@
-//go:build freebsd || darwin || windows
-
-package reexec
-
-import (
-	"os/exec"
-)
-
-// Command returns *exec.Cmd with its Path set to the path of the current
-// binary using the result of [Self]. For example if current binary is
-// "my-binary" at "/usr/bin/" (or "my-binary.exe" at "C:\" on Windows),
-// then cmd.Path is set to "/usr/bin/my-binary" and "C:\my-binary.exe"
-// respectively.
-func Command(args ...string) *exec.Cmd {
-	return &exec.Cmd{
-		Path: Self(),
-		Args: args,
-	}
-}
diff --git a/vendor/github.com/docker/docker/pkg/reexec/command_unsupported.go b/vendor/github.com/docker/docker/pkg/reexec/command_unsupported.go
deleted file mode 100644
index 3e98b989a3c2..000000000000
--- a/vendor/github.com/docker/docker/pkg/reexec/command_unsupported.go
+++ /dev/null
@@ -1,12 +0,0 @@
-//go:build !linux && !windows && !freebsd && !darwin
-
-package reexec
-
-import (
-	"os/exec"
-)
-
-// Command is unsupported on operating systems apart from Linux, Windows, and Darwin.
-func Command(args ...string) *exec.Cmd {
-	return nil
-}
diff --git a/vendor/github.com/docker/docker/pkg/reexec/reexec.go b/vendor/github.com/docker/docker/pkg/reexec/reexec.go
deleted file mode 100644
index b9d11a2a5870..000000000000
--- a/vendor/github.com/docker/docker/pkg/reexec/reexec.go
+++ /dev/null
@@ -1,64 +0,0 @@
-// Package reexec facilitates the busybox style reexec of a binary.
-//
-// Handlers can be registered with a name and the argv 0 of the exec of
-// the binary will be used to find and execute custom init paths.
-//
-// It is used in dockerd to work around forking limitations when using Go.
-package reexec
-
-import (
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-)
-
-var registeredInitializers = make(map[string]func())
-
-// Register adds an initialization func under the specified name. It panics
-// if the given name is already registered.
-func Register(name string, initializer func()) {
-	if _, exists := registeredInitializers[name]; exists {
-		panic(fmt.Sprintf("reexec func already registered under name %q", name))
-	}
-
-	registeredInitializers[name] = initializer
-}
-
-// Init is called as the first part of the exec process and returns true if an
-// initialization function was called.
-func Init() bool {
-	if initializer, ok := registeredInitializers[os.Args[0]]; ok {
-		initializer()
-		return true
-	}
-	return false
-}
-
-// Self returns the path to the current process's binary. On Linux, it
-// returns "/proc/self/exe", which provides the in-memory version of the
-// current binary, whereas on other platforms it attempts to looks up the
-// absolute path for os.Args[0], or otherwise returns os.Args[0] as-is.
-func Self() string {
-	if runtime.GOOS == "linux" {
-		return "/proc/self/exe"
-	}
-	return naiveSelf()
-}
-
-func naiveSelf() string {
-	name := os.Args[0]
-	if filepath.Base(name) == name {
-		if lp, err := exec.LookPath(name); err == nil {
-			return lp
-		}
-	}
-	// handle conversion of relative paths to absolute
-	if absName, err := filepath.Abs(name); err == nil {
-		return absName
-	}
-	// if we couldn't get absolute name, return original
-	// (NOTE: Go only errors on Abs() if os.Getwd fails)
-	return name
-}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 5a809e837eb8..f65de249bd0f 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -466,7 +466,7 @@ github.com/docker/cli/cli/config/configfile
 github.com/docker/cli/cli/config/credentials
 github.com/docker/cli/cli/config/types
 github.com/docker/cli/cli/connhelper/commandconn
-# github.com/docker/docker v27.4.1+incompatible
+# github.com/docker/docker v27.5.0+incompatible
 ## explicit
 github.com/docker/docker/api
 github.com/docker/docker/api/types
@@ -498,7 +498,6 @@ github.com/docker/docker/pkg/chrootarchive
 github.com/docker/docker/pkg/idtools
 github.com/docker/docker/pkg/ioutils
 github.com/docker/docker/pkg/pools
-github.com/docker/docker/pkg/reexec
 github.com/docker/docker/pkg/system
 github.com/docker/docker/profiles/seccomp
 # github.com/docker/docker-credential-helpers v0.8.2