From ea7d666df57e7ac57f221dee587811f6b024de2f Mon Sep 17 00:00:00 2001
From: AnilAltinay <aaltinay@google.com>
Date: Wed, 29 Jul 2026 10:59:04 -0700
Subject: [PATCH] Internal Change

PiperOrigin-RevId: 955975956
---
 pkg/test/dockerutil/dockerutil.go | 7 +++++++
 test/e2e/integration_test.go      | 3 +++
 test/syscalls/linux/landlock.cc   | 1 +
 3 files changed, 11 insertions(+)

diff --git a/pkg/test/dockerutil/dockerutil.go b/pkg/test/dockerutil/dockerutil.go
index 2819c09f22e..182cef2f659 100644
--- a/pkg/test/dockerutil/dockerutil.go
+++ b/pkg/test/dockerutil/dockerutil.go
@@ -142,6 +142,13 @@ func IsRestoreSupported() bool {
 	return major <= 27
 }
 
+// IsAnnotationsSupported returns true if the docker version supports annotations.
+// Docker annotations were introduced in API v1.44 (Docker v25.0).
+func IsAnnotationsSupported() bool {
+	major, _ := getDockerVersion()
+	return major >= 25
+}
+
 // RuntimePath returns the binary path for the current runtime.
 func RuntimePath() (string, error) {
 	rs, err := runtimeMap()
diff --git a/test/e2e/integration_test.go b/test/e2e/integration_test.go
index fd929922400..5fc32c8d257 100644
--- a/test/e2e/integration_test.go
+++ b/test/e2e/integration_test.go
@@ -110,6 +110,9 @@ func TestLifeCycle(t *testing.T) {
 }
 
 func TestDisallowRootfsTarAnnotation(t *testing.T) {
+	if !dockerutil.IsAnnotationsSupported() {
+		t.Skip("Docker version does not support annotations (< 25.0).")
+	}
 	ctx := context.Background()
 	d := dockerutil.MakeContainer(ctx, t)
 	defer d.CleanUp(ctx)
diff --git a/test/syscalls/linux/landlock.cc b/test/syscalls/linux/landlock.cc
index 84e3a3cb60a..eb67104bb51 100644
--- a/test/syscalls/linux/landlock.cc
+++ b/test/syscalls/linux/landlock.cc
@@ -1042,6 +1042,7 @@ TEST(LandlockTest, AddNetPortRuleWithoutHandledNetFails) {
 // non-tty normally fails with ENOTTY; under a ruleset that handles IOCTL_DEV
 // but does not grant it on the device, the ioctl is rejected earlier with
 // EACCES instead.
+// TODO(aaltinay): delete this line.
 TEST(LandlockTest, IoctlDevDeniedWithoutRule) {
   SKIP_IF(IsRunningOnGvisor());
   SKIP_IF(LandlockAbiVersion() < 5);