[question] do we have a plan to revendor libnetwork to the latest version or stable one

[allencloud]

Ⅰ. Issue Description

We have vendor libnetwork to take advantages of libnetwork's ability on network management. While I am afraid that currently we met several serious issues ever which are not so easy to handle, so we did some tricky work to handle this:

• use a very strange way to vendor libnetwork in extra(https://github.com/alibaba/pouch/tree/master/extra/libnetwork);
• log package logrus brings so much inconvenience.

I think we should take more things into consideration whether to use latest or stable version of libnetwork to bring more convenience.

ping @rudyfly

[idealhack]

I found this is not easy with govendor. Have you considered migrating to dep?

[fuweid]

Hi @idealhack，could you mind to explain the special thing in dep? Thanks

[idealhack]

@fuweid dep is a better package manager in general and it is maintain by Go team.

[idealhack]

In fact, I encountered some problems with pouch and govendor, for example:

1. Some packages are dependencies of pouch not in vendor.json.

2. Some packages are not direct dependencies of pouch currently in vendor.json.

3. Why does so many different packages using a same revision 2b8ed96d2a422bf205adcdfa05272dc12c81613b? This is a commit hash in containerd.

In the meantime, dep is good at resolving dependencies and migrating from other tools, but it seems pouch want to depend on two versions of cri runtime, this can not be done by dep itself, by design. so I asked about this in #1359.

Anyway, despite of these problems, I managed get libnetwork with govendor working now.