diff --git a/collector/collector.go b/collector/collector.go
index 7db87b333..d69b00732 100644
--- a/collector/collector.go
+++ b/collector/collector.go
@@ -2,11 +2,10 @@ package collector
 
 import (
 	"errors"
+	"log/slog"
 	"sync"
 	"time"
 
-	"github.com/go-kit/log"
-	"github.com/go-kit/log/level"
 	"github.com/prometheus/client_golang/prometheus"
 )
 
@@ -37,7 +36,7 @@ const (
 )
 
 var (
-	factories              = make(map[string]func(logger log.Logger) (Collector, error))
+	factories              = make(map[string]func(logger *slog.Logger) (Collector, error))
 	initiatedCollectorsMtx = sync.Mutex{}
 	initiatedCollectors    = make(map[string]Collector)
 	collectorState         = make(map[string]bool)
@@ -57,11 +56,11 @@ type typedDesc struct {
 // PodmanCollector implements the prometheus.Collector interface.
 type PodmanCollector struct {
 	Collectors map[string]Collector
-	logger     log.Logger
+	logger     *slog.Logger
 }
 
 // NewPodmanCollector creates a new PodmanCollector.
-func NewPodmanCollector(logger log.Logger) (*PodmanCollector, error) {
+func NewPodmanCollector(logger *slog.Logger) (*PodmanCollector, error) {
 	collectors := make(map[string]Collector)
 
 	initiatedCollectorsMtx.Lock()
@@ -75,7 +74,7 @@ func NewPodmanCollector(logger log.Logger) (*PodmanCollector, error) {
 		if collector, ok := initiatedCollectors[key]; ok {
 			collectors[key] = collector
 		} else {
-			collector, err := factories[key](log.With(logger, "collector", key))
+			collector, err := factories[key](logger)
 			if err != nil {
 				return nil, err
 			}
@@ -109,7 +108,7 @@ func (p PodmanCollector) Collect(ch chan<- prometheus.Metric) {
 	wg.Wait()
 }
 
-func execute(name string, c Collector, ch chan<- prometheus.Metric, logger log.Logger) {
+func execute(name string, c Collector, ch chan<- prometheus.Metric, logger *slog.Logger) {
 	var success float64
 
 	begin := time.Now()
@@ -118,13 +117,13 @@ func execute(name string, c Collector, ch chan<- prometheus.Metric, logger log.L
 
 	if err != nil {
 		if IsNoDataError(err) {
-			level.Debug(logger).Log("msg", "collector returned no data", "name",
+			logger.Debug("collector returned no data", "name",
 				name,
 				"duration_seconds",
 				duration.Seconds(),
 				"err", err)
 		} else {
-			level.Error(logger).Log("msg", "collector failed", "name",
+			logger.Error("collector failed", "name",
 				name,
 				"duration_seconds",
 				duration.Seconds(),
@@ -133,7 +132,7 @@ func execute(name string, c Collector, ch chan<- prometheus.Metric, logger log.L
 
 		success = 0
 	} else {
-		level.Debug(logger).Log("msg", "collector succeeded", "name",
+		logger.Debug("collector succeeded", "name",
 			name,
 			"duration_seconds",
 			duration.Seconds())
@@ -154,7 +153,7 @@ func (d *typedDesc) mustNewConstMetric(value float64, labels ...string) promethe
 	return prometheus.MustNewConstMetric(d.desc, d.valueType, value, labels...)
 }
 
-func registerCollector(collector string, enabledByDefault bool, factory func(logger log.Logger) (Collector, error)) {
+func registerCollector(collector string, enabledByDefault bool, factory func(logger *slog.Logger) (Collector, error)) {
 	collectorState[collector] = enabledByDefault
 	factories[collector] = factory
 }
diff --git a/collector/container.go b/collector/container.go
index bcaa5e8a3..b4939f451 100644
--- a/collector/container.go
+++ b/collector/container.go
@@ -1,8 +1,9 @@
 package collector
 
 import (
+	"log/slog"
+
 	"github.com/containers/prometheus-podman-exporter/pdcs"
-	"github.com/go-kit/log"
 	"github.com/prometheus/client_golang/prometheus"
 )
 
@@ -31,7 +32,7 @@ type containerCollector struct {
 	blockOutput      typedDesc
 	rwSize           typedDesc
 	rootFsSize       typedDesc
-	logger           log.Logger
+	logger           *slog.Logger
 }
 
 type containerDescLabels struct {
@@ -44,7 +45,7 @@ func init() {
 }
 
 // NewContainerStatsCollector returns a Collector exposing containers stats information.
-func NewContainerStatsCollector(logger log.Logger) (Collector, error) {
+func NewContainerStatsCollector(logger *slog.Logger) (Collector, error) {
 	return &containerCollector{
 		info: typedDesc{
 			nil, prometheus.GaugeValue,
diff --git a/collector/image.go b/collector/image.go
index 6b62c0ee0..2b13f3087 100644
--- a/collector/image.go
+++ b/collector/image.go
@@ -1,8 +1,9 @@
 package collector
 
 import (
+	"log/slog"
+
 	"github.com/containers/prometheus-podman-exporter/pdcs"
-	"github.com/go-kit/log"
 	"github.com/prometheus/client_golang/prometheus"
 )
 
@@ -10,7 +11,7 @@ type imageCollector struct {
 	info    typedDesc
 	size    typedDesc
 	created typedDesc
-	logger  log.Logger
+	logger  *slog.Logger
 }
 
 type imageDescLabels struct {
@@ -23,7 +24,7 @@ func init() {
 }
 
 // NewImageStatsCollector returns a Collector exposing image stats information.
-func NewImageStatsCollector(logger log.Logger) (Collector, error) {
+func NewImageStatsCollector(logger *slog.Logger) (Collector, error) {
 	return &imageCollector{
 		info: typedDesc{
 			nil, prometheus.GaugeValue,
diff --git a/collector/network.go b/collector/network.go
index 8a45da992..139b31c55 100644
--- a/collector/network.go
+++ b/collector/network.go
@@ -1,14 +1,15 @@
 package collector
 
 import (
+	"log/slog"
+
 	"github.com/containers/prometheus-podman-exporter/pdcs"
-	"github.com/go-kit/log"
 	"github.com/prometheus/client_golang/prometheus"
 )
 
 type networkCollector struct {
 	info   typedDesc
-	logger log.Logger
+	logger *slog.Logger
 }
 
 func init() {
@@ -16,7 +17,7 @@ func init() {
 }
 
 // NewNetworkStatsCollector returns a Collector exposing network stats information.
-func NewNetworkStatsCollector(logger log.Logger) (Collector, error) {
+func NewNetworkStatsCollector(logger *slog.Logger) (Collector, error) {
 	return &networkCollector{
 		info: typedDesc{
 			prometheus.NewDesc(
diff --git a/collector/pod.go b/collector/pod.go
index 58a156749..6eef67f64 100644
--- a/collector/pod.go
+++ b/collector/pod.go
@@ -1,8 +1,9 @@
 package collector
 
 import (
+	"log/slog"
+
 	"github.com/containers/prometheus-podman-exporter/pdcs"
-	"github.com/go-kit/log"
 	"github.com/prometheus/client_golang/prometheus"
 )
 
@@ -11,7 +12,7 @@ type podCollector struct {
 	state           typedDesc
 	numOfContainers typedDesc
 	created         typedDesc
-	logger          log.Logger
+	logger          *slog.Logger
 }
 
 type podDescLabels struct {
@@ -24,7 +25,7 @@ func init() {
 }
 
 // NewPodStatsCollector returns a Collector exposing pod stats information.
-func NewPodStatsCollector(logger log.Logger) (Collector, error) {
+func NewPodStatsCollector(logger *slog.Logger) (Collector, error) {
 	return &podCollector{
 		info: typedDesc{
 			nil, prometheus.GaugeValue,
diff --git a/collector/system.go b/collector/system.go
index cfbe7c59e..1e7b29996 100644
--- a/collector/system.go
+++ b/collector/system.go
@@ -1,8 +1,9 @@
 package collector
 
 import (
+	"log/slog"
+
 	"github.com/containers/prometheus-podman-exporter/pdcs"
-	"github.com/go-kit/log"
 	"github.com/prometheus/client_golang/prometheus"
 )
 
@@ -11,7 +12,7 @@ type systemCollector struct {
 	runtimeVer typedDesc
 	conmonVer  typedDesc
 	buildahVer typedDesc
-	logger     log.Logger
+	logger     *slog.Logger
 }
 
 func init() {
@@ -19,7 +20,7 @@ func init() {
 }
 
 // NewSystemCollector returns a Collector exposing podman system information.
-func NewSystemCollector(logger log.Logger) (Collector, error) {
+func NewSystemCollector(logger *slog.Logger) (Collector, error) {
 	return &systemCollector{
 		podmanVer: typedDesc{
 			prometheus.NewDesc(
diff --git a/collector/volume.go b/collector/volume.go
index 2f34ad115..71c338e78 100644
--- a/collector/volume.go
+++ b/collector/volume.go
@@ -1,15 +1,16 @@
 package collector
 
 import (
+	"log/slog"
+
 	"github.com/containers/prometheus-podman-exporter/pdcs"
-	"github.com/go-kit/log"
 	"github.com/prometheus/client_golang/prometheus"
 )
 
 type volumeCollector struct {
 	info    typedDesc
 	created typedDesc
-	logger  log.Logger
+	logger  *slog.Logger
 }
 
 var volumeDefaultLAbels = []string{"name", "driver", "mount_point"}
@@ -19,7 +20,7 @@ func init() {
 }
 
 // NewVolumeStatsCollector returns a Collector exposing volume stats information.
-func NewVolumeStatsCollector(logger log.Logger) (Collector, error) {
+func NewVolumeStatsCollector(logger *slog.Logger) (Collector, error) {
 	createdLabels := []string{"name"}
 
 	if enhanceAllMetrics {
diff --git a/exporter/exporter.go b/exporter/exporter.go
index ef399bacf..7c6b46e86 100644
--- a/exporter/exporter.go
+++ b/exporter/exporter.go
@@ -8,8 +8,7 @@ import (
 
 	"github.com/containers/prometheus-podman-exporter/collector"
 	"github.com/containers/prometheus-podman-exporter/pdcs"
-	"github.com/go-kit/log/level"
-	"github.com/prometheus/common/promlog"
+	"github.com/prometheus/common/promslog"
 	"github.com/prometheus/common/version"
 	"github.com/prometheus/exporter-toolkit/web"
 	"github.com/spf13/cobra"
@@ -42,7 +41,7 @@ type exporterOptions struct {
 func Start(cmd *cobra.Command, _ []string) error {
 	// setup exporter
 	logLevel := "info"
-	promlogConfig := &promlog.Config{Level: &promlog.AllowedLevel{}}
+	promlogConfig := &promslog.Config{Level: &promslog.AllowedLevel{}}
 
 	cmdOptions, err := parseOptions(cmd)
 	if err != nil {
@@ -57,16 +56,16 @@ func Start(cmd *cobra.Command, _ []string) error {
 		return err
 	}
 
-	logger := promlog.New(promlogConfig)
+	logger := promslog.New(promlogConfig)
 
 	if err := setEnabledCollectors(cmdOptions); err != nil {
-		level.Error(logger).Log("msg", "cannot set enabled collectors", "err", err)
+		logger.Error("cannot set enabled collectors", "err", err)
 
 		return err
 	}
 
-	level.Info(logger).Log("msg", "Starting podman-prometheus-exporter", "version", version.Info())
-	level.Info(logger).Log("msg", "metrics", "enhanced", cmdOptions.enhanceMetrics)
+	logger.Info("starting podman-prometheus-exporter", "version", version.Info())
+	logger.Info("metrics", "enhanced", cmdOptions.enhanceMetrics)
 
 	http.Handle(
 		cmdOptions.webTelemetryPath,
@@ -93,7 +92,7 @@ func Start(cmd *cobra.Command, _ []string) error {
 	pdcs.StartEventStreamer(logger, updateImages)
 	pdcs.StartCacheSizeTicker(logger, cmdOptions.cacheDuration)
 
-	level.Info(logger).Log("msg", "Listening on", "address", cmdOptions.webListen)
+	logger.Info("Listening on", "address", cmdOptions.webListen)
 
 	server := &http.Server{
 		ReadHeaderTimeout: 3 * time.Second, //nolint:mnd
diff --git a/exporter/handler.go b/exporter/handler.go
index 50fe2f106..22dda229e 100644
--- a/exporter/handler.go
+++ b/exporter/handler.go
@@ -2,13 +2,11 @@ package exporter
 
 import (
 	"fmt"
-	stdlog "log"
+	"log/slog"
 	"net/http"
 	"sort"
 
 	"github.com/containers/prometheus-podman-exporter/collector"
-	"github.com/go-kit/log"
-	"github.com/go-kit/log/level"
 	"github.com/prometheus/client_golang/prometheus"
 	promcollectors "github.com/prometheus/client_golang/prometheus/collectors"
 	"github.com/prometheus/client_golang/prometheus/collectors/version"
@@ -25,13 +23,13 @@ type handler struct {
 	disableExporterMetrics  bool
 	exporterMetricsRegistry *prometheus.Registry
 	maxRequests             int
-	logger                  log.Logger
+	logger                  *slog.Logger
 }
 
 // ServeHTTP implements http.Handler.
 func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	filters := r.URL.Query()["collect[]"]
-	level.Debug(h.logger).Log("msg", "collect query:", "filters", fmt.Sprintf("%v", filters))
+	h.logger.Debug("collect query:", "filters", fmt.Sprintf("%v", filters))
 
 	if len(filters) == 0 {
 		// No filters, use the prepared unfiltered handler.
@@ -42,7 +40,7 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	// To serve filtered metrics, we create a filtering handler on the fly.
 	filteredHandler, err := h.innerHandler(filters...)
 	if err != nil {
-		level.Warn(h.logger).Log("msg", "couldn't create filtered metrics handler:", "err", err)
+		h.logger.Warn("couldn't create filtered metrics handler:", "err", err)
 		w.WriteHeader(http.StatusBadRequest)
 		w.Write([]byte(fmt.Sprintf("couldn't create filtered metrics handler: %s", err)))
 
@@ -52,7 +50,7 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	filteredHandler.ServeHTTP(w, r)
 }
 
-func newHandler(disableExporterMetrics bool, maxRequests int, logger log.Logger) *handler {
+func newHandler(disableExporterMetrics bool, maxRequests int, logger *slog.Logger) *handler {
 	h := &handler{
 		exporterMetricsRegistry: prometheus.NewRegistry(),
 		maxRequests:             maxRequests,
@@ -91,7 +89,7 @@ func (h *handler) innerHandler(filters ...string) (http.Handler, error) {
 	// Only log the creation of an unfiltered handler, which should happen
 	// only once upon startup.
 	if len(filters) == 0 {
-		level.Info(h.logger).Log("msg", "enabled collectors")
+		h.logger.Info("enabled collectors")
 
 		collectors := []string{}
 
@@ -102,7 +100,7 @@ func (h *handler) innerHandler(filters ...string) (http.Handler, error) {
 		sort.Strings(collectors)
 
 		for _, c := range collectors {
-			level.Info(h.logger).Log("collector", c)
+			h.logger.Info("collector", "name", c)
 		}
 	}
 
@@ -116,7 +114,7 @@ func (h *handler) innerHandler(filters ...string) (http.Handler, error) {
 	handler := promhttp.HandlerFor(
 		prometheus.Gatherers{h.exporterMetricsRegistry, r},
 		promhttp.HandlerOpts{
-			ErrorLog:            stdlog.New(log.NewStdlibAdapter(level.Error(h.logger)), "", 0),
+			ErrorLog:            slog.NewLogLogger(h.logger.Handler(), slog.LevelError),
 			ErrorHandling:       promhttp.ContinueOnError,
 			MaxRequestsInFlight: h.maxRequests,
 			Registry:            h.exporterMetricsRegistry,
diff --git a/go.mod b/go.mod
index cd58892a5..83aec1d11 100644
--- a/go.mod
+++ b/go.mod
@@ -6,13 +6,12 @@ require (
 	github.com/containers/common v0.60.4
 	github.com/containers/image/v5 v5.32.2
 	github.com/containers/podman/v5 v5.2.5
-	github.com/go-kit/log v0.2.1
 	github.com/onsi/ginkgo/v2 v2.20.2
 	github.com/onsi/gomega v1.34.2
 	github.com/pkg/errors v0.9.1
 	github.com/prometheus/client_golang v1.20.5
 	github.com/prometheus/common v0.60.1
-	github.com/prometheus/exporter-toolkit v0.11.0
+	github.com/prometheus/exporter-toolkit v0.13.0
 	github.com/sirupsen/logrus v1.9.3
 	github.com/spf13/cobra v1.8.1
 )
@@ -65,7 +64,6 @@ require (
 	github.com/fsnotify/fsnotify v1.7.0 // indirect
 	github.com/fsouza/go-dockerclient v1.11.1 // indirect
 	github.com/go-jose/go-jose/v4 v4.0.2 // indirect
-	github.com/go-logfmt/logfmt v0.5.1 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/analysis v0.23.0 // indirect
@@ -108,6 +106,8 @@ require (
 	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/mattn/go-shellwords v1.0.12 // indirect
 	github.com/mattn/go-sqlite3 v1.14.22 // indirect
+	github.com/mdlayher/socket v0.4.1 // indirect
+	github.com/mdlayher/vsock v1.2.1 // indirect
 	github.com/miekg/pkcs11 v1.1.1 // indirect
 	github.com/mistifyio/go-zfs/v3 v3.0.1 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
diff --git a/go.sum b/go.sum
index 32439738a..c10574156 100644
--- a/go.sum
+++ b/go.sum
@@ -130,10 +130,6 @@ github.com/fsouza/go-dockerclient v1.11.1 h1:i5Vk9riDxW2uP9pVS5FYkpquMTFT5lsx2pt
 github.com/fsouza/go-dockerclient v1.11.1/go.mod h1:UfjOOaspAq+RGh7GX1aZ0HeWWGHQWWsh+H5BgEWB3Pk=
 github.com/go-jose/go-jose/v4 v4.0.2 h1:R3l3kkBds16bO7ZFAEEcofK0MkrAJt3jlJznWZG0nvk=
 github.com/go-jose/go-jose/v4 v4.0.2/go.mod h1:WVf9LFMHh/QVrmqrOfqun0C45tMe3RoiKJMPvgWwLfY=
-github.com/go-kit/log v0.2.1 h1:MRVx0/zhvdseW+Gza6N9rVzU/IVzaeE1SFI4raAhmBU=
-github.com/go-kit/log v0.2.1/go.mod h1:NwTd00d/i8cPZ3xOwwiv2PO5MOcx78fFErGNcVmBjv0=
-github.com/go-logfmt/logfmt v0.5.1 h1:otpy5pqBCBZ1ng9RQ0dPu4PN7ba75Y/aA+UpowDyNVA=
-github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -259,6 +255,10 @@ github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebG
 github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
 github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU=
 github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/mdlayher/socket v0.4.1 h1:eM9y2/jlbs1M615oshPQOHZzj6R6wMT7bX5NPiQvn2U=
+github.com/mdlayher/socket v0.4.1/go.mod h1:cAqeGjoufqdxWkD7DkpyS+wcefOtmu5OQ8KuoJGIReA=
+github.com/mdlayher/vsock v1.2.1 h1:pC1mTJTvjo1r9n9fbm7S1j04rCgCzhCOS5DY0zqHlnQ=
+github.com/mdlayher/vsock v1.2.1/go.mod h1:NRfCibel++DgeMD8z/hP+PPTjlNJsdPOmxcnENvE+SE=
 github.com/miekg/pkcs11 v1.1.1 h1:Ugu9pdy6vAYku5DEpVWVFPYnzV+bxB+iRdbuFSu7TvU=
 github.com/miekg/pkcs11 v1.1.1/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
 github.com/mistifyio/go-zfs/v3 v3.0.1 h1:YaoXgBePoMA12+S1u/ddkv+QqxcfiZK4prI6HPnkFiU=
@@ -330,8 +330,8 @@ github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p
 github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
 github.com/prometheus/common v0.60.1 h1:FUas6GcOw66yB/73KC+BOZoFJmbo/1pojoILArPAaSc=
 github.com/prometheus/common v0.60.1/go.mod h1:h0LYf1R1deLSKtD4Vdg8gy4RuOvENW2J/h19V5NADQw=
-github.com/prometheus/exporter-toolkit v0.11.0 h1:yNTsuZ0aNCNFQ3aFTD2uhPOvr4iD7fdBvKPAEGkNf+g=
-github.com/prometheus/exporter-toolkit v0.11.0/go.mod h1:BVnENhnNecpwoTLiABx7mrPB/OLRIgN74qlQbV+FK1Q=
+github.com/prometheus/exporter-toolkit v0.13.0 h1:lmA0Q+8IaXgmFRKw09RldZmZdnvu9wwcDLIXGmTPw1c=
+github.com/prometheus/exporter-toolkit v0.13.0/go.mod h1:2uop99EZl80KdXhv/MxVI2181fMcwlsumFOqBecGkG0=
 github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
diff --git a/pdcs/container.go b/pdcs/container.go
index 5d683ca7c..73574707c 100644
--- a/pdcs/container.go
+++ b/pdcs/container.go
@@ -2,14 +2,13 @@ package pdcs
 
 import (
 	"context"
+	"log/slog"
 	"sync"
 	"time"
 
 	"github.com/containers/podman/v5/cmd/podman/registry"
 	"github.com/containers/podman/v5/libpod/define"
 	"github.com/containers/podman/v5/pkg/domain/entities"
-	klog "github.com/go-kit/log"
-	"github.com/go-kit/log/level"
 )
 
 const (
@@ -236,9 +235,10 @@ func updateContainerSize() {
 }
 
 // StartCacheSizeTicker starts container cache refresh routine.
-func StartCacheSizeTicker(logger klog.Logger, duration int64) {
-	level.Debug(logger).Log("msg", "starting container size cache ticker", "duration", duration)
-	level.Debug(logger).Log("msg", "update container size cache")
+func StartCacheSizeTicker(logger *slog.Logger, duration int64) {
+	logger.Info("starting container size cache ticker", "duration", duration)
+	logger.Info("update container size cache")
+
 	updateContainerSize()
 
 	ticker := time.NewTicker(time.Duration(duration) * time.Second)
@@ -246,7 +246,7 @@ func StartCacheSizeTicker(logger klog.Logger, duration int64) {
 	go func() {
 		for {
 			<-ticker.C
-			level.Debug(logger).Log("msg", "update container size cache")
+			logger.Info("update container size cache")
 			updateContainerSize()
 		}
 	}()
diff --git a/pdcs/events.go b/pdcs/events.go
index ab33256e9..4821dc08e 100644
--- a/pdcs/events.go
+++ b/pdcs/events.go
@@ -3,21 +3,20 @@ package pdcs
 import (
 	"context"
 	"log"
+	"log/slog"
 
 	"github.com/containers/podman/v5/cmd/podman/registry"
 	"github.com/containers/podman/v5/libpod/events"
 	"github.com/containers/podman/v5/pkg/domain/entities"
-	klog "github.com/go-kit/log"
-	"github.com/go-kit/log/level"
 )
 
-func StartEventStreamer(logger klog.Logger, updateImage bool) {
+func StartEventStreamer(logger *slog.Logger, updateImage bool) {
 	var eventOptions entities.EventsOptions
 
-	level.Debug(logger).Log("msg", "starting podman event streamer")
+	logger.Info("starting podman event streamer")
 
 	if updateImage {
-		level.Debug(logger).Log("msg", "update images")
+		logger.Debug("update images")
 		updateImages()
 	}
 
@@ -39,13 +38,13 @@ func StartEventStreamer(logger klog.Logger, updateImage bool) {
 			select {
 			case event, ok := <-eventChannel:
 				if !ok {
-					level.Error(logger).Log("msg", "podman received event not ok")
+					logger.Error("podman received event not ok")
 
 					continue
 				}
 
 				if updateImage && event.Type == events.Image {
-					level.Debug(logger).Log("msg", "update images")
+					logger.Debug("update images")
 					updateImages()
 				}
 			case err := <-errChannel:
diff --git a/pdcs/events_test.go b/pdcs/events_test.go
index b4277603e..31f1ab0a5 100644
--- a/pdcs/events_test.go
+++ b/pdcs/events_test.go
@@ -7,7 +7,7 @@ import (
 	"github.com/containers/prometheus-podman-exporter/pdcs"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
-	"github.com/prometheus/common/promlog"
+	"github.com/prometheus/common/promslog"
 )
 
 var _ = Describe("Pdcs/Events", func() {
@@ -16,7 +16,7 @@ var _ = Describe("Pdcs/Events", func() {
 		Expect(err).To(BeNil())
 
 		imageCount01 := len(podmanImages)
-		logger := promlog.New(&promlog.Config{})
+		logger := promslog.New(&promslog.Config{})
 		pdcs.StartEventStreamer(logger, true)
 
 		testImage := "quay.io/libpod/alpine"
diff --git a/vendor/github.com/go-kit/log/.gitignore b/vendor/github.com/go-kit/log/.gitignore
deleted file mode 100644
index 66fd13c90..000000000
--- a/vendor/github.com/go-kit/log/.gitignore
+++ /dev/null
@@ -1,15 +0,0 @@
-# Binaries for programs and plugins
-*.exe
-*.exe~
-*.dll
-*.so
-*.dylib
-
-# Test binary, built with `go test -c`
-*.test
-
-# Output of the go coverage tool, specifically when used with LiteIDE
-*.out
-
-# Dependency directories (remove the comment below to include it)
-# vendor/
diff --git a/vendor/github.com/go-kit/log/LICENSE b/vendor/github.com/go-kit/log/LICENSE
deleted file mode 100644
index bb5bdb9cb..000000000
--- a/vendor/github.com/go-kit/log/LICENSE
+++ /dev/null
@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2021 Go kit
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
diff --git a/vendor/github.com/go-kit/log/README.md b/vendor/github.com/go-kit/log/README.md
deleted file mode 100644
index 806779465..000000000
--- a/vendor/github.com/go-kit/log/README.md
+++ /dev/null
@@ -1,156 +0,0 @@
-# package log
-
-[![Go Reference](https://pkg.go.dev/badge/github.com/go-kit/log.svg)](https://pkg.go.dev/github.com/go-kit/log)
-[![Go Report Card](https://goreportcard.com/badge/go-kit/log)](https://goreportcard.com/report/go-kit/log)
-[![GitHub Actions](https://github.com/go-kit/log/actions/workflows/test.yml/badge.svg)](https://github.com/go-kit/log/actions/workflows/test.yml)
-[![Coverage Status](https://coveralls.io/repos/github/go-kit/log/badge.svg?branch=main)](https://coveralls.io/github/go-kit/log?branch=main)
-
-`package log` provides a minimal interface for structured logging in services.
-It may be wrapped to encode conventions, enforce type-safety, provide leveled
-logging, and so on. It can be used for both typical application log events,
-and log-structured data streams.
-
-## Structured logging
-
-Structured logging is, basically, conceding to the reality that logs are
-_data_, and warrant some level of schematic rigor. Using a stricter,
-key/value-oriented message format for our logs, containing contextual and
-semantic information, makes it much easier to get insight into the
-operational activity of the systems we build. Consequently, `package log` is
-of the strong belief that "[the benefits of structured logging outweigh the
-minimal effort involved](https://www.thoughtworks.com/radar/techniques/structured-logging)".
-
-Migrating from unstructured to structured logging is probably a lot easier
-than you'd expect.
-
-```go
-// Unstructured
-log.Printf("HTTP server listening on %s", addr)
-
-// Structured
-logger.Log("transport", "HTTP", "addr", addr, "msg", "listening")
-```
-
-## Usage
-
-### Typical application logging
-
-```go
-w := log.NewSyncWriter(os.Stderr)
-logger := log.NewLogfmtLogger(w)
-logger.Log("question", "what is the meaning of life?", "answer", 42)
-
-// Output:
-// question="what is the meaning of life?" answer=42
-```
-
-### Contextual Loggers
-
-```go
-func main() {
-	var logger log.Logger
-	logger = log.NewLogfmtLogger(log.NewSyncWriter(os.Stderr))
-	logger = log.With(logger, "instance_id", 123)
-
-	logger.Log("msg", "starting")
-	NewWorker(log.With(logger, "component", "worker")).Run()
-	NewSlacker(log.With(logger, "component", "slacker")).Run()
-}
-
-// Output:
-// instance_id=123 msg=starting
-// instance_id=123 component=worker msg=running
-// instance_id=123 component=slacker msg=running
-```
-
-### Interact with stdlib logger
-
-Redirect stdlib logger to Go kit logger.
-
-```go
-import (
-	"os"
-	stdlog "log"
-	kitlog "github.com/go-kit/log"
-)
-
-func main() {
-	logger := kitlog.NewJSONLogger(kitlog.NewSyncWriter(os.Stdout))
-	stdlog.SetOutput(kitlog.NewStdlibAdapter(logger))
-	stdlog.Print("I sure like pie")
-}
-
-// Output:
-// {"msg":"I sure like pie","ts":"2016/01/01 12:34:56"}
-```
-
-Or, if, for legacy reasons, you need to pipe all of your logging through the
-stdlib log package, you can redirect Go kit logger to the stdlib logger.
-
-```go
-logger := kitlog.NewLogfmtLogger(kitlog.StdlibWriter{})
-logger.Log("legacy", true, "msg", "at least it's something")
-
-// Output:
-// 2016/01/01 12:34:56 legacy=true msg="at least it's something"
-```
-
-### Timestamps and callers
-
-```go
-var logger log.Logger
-logger = log.NewLogfmtLogger(log.NewSyncWriter(os.Stderr))
-logger = log.With(logger, "ts", log.DefaultTimestampUTC, "caller", log.DefaultCaller)
-
-logger.Log("msg", "hello")
-
-// Output:
-// ts=2016-01-01T12:34:56Z caller=main.go:15 msg=hello
-```
-
-## Levels
-
-Log levels are supported via the [level package](https://godoc.org/github.com/go-kit/log/level).
-
-## Supported output formats
-
-- [Logfmt](https://brandur.org/logfmt) ([see also](https://blog.codeship.com/logfmt-a-log-format-thats-easy-to-read-and-write))
-- JSON
-
-## Enhancements
-
-`package log` is centered on the one-method Logger interface.
-
-```go
-type Logger interface {
-	Log(keyvals ...interface{}) error
-}
-```
-
-This interface, and its supporting code like is the product of much iteration
-and evaluation. For more details on the evolution of the Logger interface,
-see [The Hunt for a Logger Interface](http://go-talks.appspot.com/github.com/ChrisHines/talks/structured-logging/structured-logging.slide#1),
-a talk by [Chris Hines](https://github.com/ChrisHines).
-Also, please see
-[#63](https://github.com/go-kit/kit/issues/63),
-[#76](https://github.com/go-kit/kit/pull/76),
-[#131](https://github.com/go-kit/kit/issues/131),
-[#157](https://github.com/go-kit/kit/pull/157),
-[#164](https://github.com/go-kit/kit/issues/164), and
-[#252](https://github.com/go-kit/kit/pull/252)
-to review historical conversations about package log and the Logger interface.
-
-Value-add packages and suggestions,
-like improvements to [the leveled logger](https://godoc.org/github.com/go-kit/log/level),
-are of course welcome. Good proposals should
-
-- Be composable with [contextual loggers](https://godoc.org/github.com/go-kit/log#With),
-- Not break the behavior of [log.Caller](https://godoc.org/github.com/go-kit/log#Caller) in any wrapped contextual loggers, and
-- Be friendly to packages that accept only an unadorned log.Logger.
-
-## Benchmarks & comparisons
-
-There are a few Go logging benchmarks and comparisons that include Go kit's package log.
-
-- [imkira/go-loggers-bench](https://github.com/imkira/go-loggers-bench) includes kit/log
-- [uber-common/zap](https://github.com/uber-common/zap), a zero-alloc logging library, includes a comparison with kit/log
diff --git a/vendor/github.com/go-kit/log/doc.go b/vendor/github.com/go-kit/log/doc.go
deleted file mode 100644
index f744382fe..000000000
--- a/vendor/github.com/go-kit/log/doc.go
+++ /dev/null
@@ -1,116 +0,0 @@
-// Package log provides a structured logger.
-//
-// Structured logging produces logs easily consumed later by humans or
-// machines. Humans might be interested in debugging errors, or tracing
-// specific requests. Machines might be interested in counting interesting
-// events, or aggregating information for off-line processing. In both cases,
-// it is important that the log messages are structured and actionable.
-// Package log is designed to encourage both of these best practices.
-//
-// Basic Usage
-//
-// The fundamental interface is Logger. Loggers create log events from
-// key/value data. The Logger interface has a single method, Log, which
-// accepts a sequence of alternating key/value pairs, which this package names
-// keyvals.
-//
-//    type Logger interface {
-//        Log(keyvals ...interface{}) error
-//    }
-//
-// Here is an example of a function using a Logger to create log events.
-//
-//    func RunTask(task Task, logger log.Logger) string {
-//        logger.Log("taskID", task.ID, "event", "starting task")
-//        ...
-//        logger.Log("taskID", task.ID, "event", "task complete")
-//    }
-//
-// The keys in the above example are "taskID" and "event". The values are
-// task.ID, "starting task", and "task complete". Every key is followed
-// immediately by its value.
-//
-// Keys are usually plain strings. Values may be any type that has a sensible
-// encoding in the chosen log format. With structured logging it is a good
-// idea to log simple values without formatting them. This practice allows
-// the chosen logger to encode values in the most appropriate way.
-//
-// Contextual Loggers
-//
-// A contextual logger stores keyvals that it includes in all log events.
-// Building appropriate contextual loggers reduces repetition and aids
-// consistency in the resulting log output. With, WithPrefix, and WithSuffix
-// add context to a logger. We can use With to improve the RunTask example.
-//
-//    func RunTask(task Task, logger log.Logger) string {
-//        logger = log.With(logger, "taskID", task.ID)
-//        logger.Log("event", "starting task")
-//        ...
-//        taskHelper(task.Cmd, logger)
-//        ...
-//        logger.Log("event", "task complete")
-//    }
-//
-// The improved version emits the same log events as the original for the
-// first and last calls to Log. Passing the contextual logger to taskHelper
-// enables each log event created by taskHelper to include the task.ID even
-// though taskHelper does not have access to that value. Using contextual
-// loggers this way simplifies producing log output that enables tracing the
-// life cycle of individual tasks. (See the Contextual example for the full
-// code of the above snippet.)
-//
-// Dynamic Contextual Values
-//
-// A Valuer function stored in a contextual logger generates a new value each
-// time an event is logged. The Valuer example demonstrates how this feature
-// works.
-//
-// Valuers provide the basis for consistently logging timestamps and source
-// code location. The log package defines several valuers for that purpose.
-// See Timestamp, DefaultTimestamp, DefaultTimestampUTC, Caller, and
-// DefaultCaller. A common logger initialization sequence that ensures all log
-// entries contain a timestamp and source location looks like this:
-//
-//    logger := log.NewLogfmtLogger(log.NewSyncWriter(os.Stdout))
-//    logger = log.With(logger, "ts", log.DefaultTimestampUTC, "caller", log.DefaultCaller)
-//
-// Concurrent Safety
-//
-// Applications with multiple goroutines want each log event written to the
-// same logger to remain separate from other log events. Package log provides
-// two simple solutions for concurrent safe logging.
-//
-// NewSyncWriter wraps an io.Writer and serializes each call to its Write
-// method. Using a SyncWriter has the benefit that the smallest practical
-// portion of the logging logic is performed within a mutex, but it requires
-// the formatting Logger to make only one call to Write per log event.
-//
-// NewSyncLogger wraps any Logger and serializes each call to its Log method.
-// Using a SyncLogger has the benefit that it guarantees each log event is
-// handled atomically within the wrapped logger, but it typically serializes
-// both the formatting and output logic. Use a SyncLogger if the formatting
-// logger may perform multiple writes per log event.
-//
-// Error Handling
-//
-// This package relies on the practice of wrapping or decorating loggers with
-// other loggers to provide composable pieces of functionality. It also means
-// that Logger.Log must return an error because some
-// implementations—especially those that output log data to an io.Writer—may
-// encounter errors that cannot be handled locally. This in turn means that
-// Loggers that wrap other loggers should return errors from the wrapped
-// logger up the stack.
-//
-// Fortunately, the decorator pattern also provides a way to avoid the
-// necessity to check for errors every time an application calls Logger.Log.
-// An application required to panic whenever its Logger encounters
-// an error could initialize its logger as follows.
-//
-//    fmtlogger := log.NewLogfmtLogger(log.NewSyncWriter(os.Stdout))
-//    logger := log.LoggerFunc(func(keyvals ...interface{}) error {
-//        if err := fmtlogger.Log(keyvals...); err != nil {
-//            panic(err)
-//        }
-//        return nil
-//    })
-package log
diff --git a/vendor/github.com/go-kit/log/json_logger.go b/vendor/github.com/go-kit/log/json_logger.go
deleted file mode 100644
index d0faed4f0..000000000
--- a/vendor/github.com/go-kit/log/json_logger.go
+++ /dev/null
@@ -1,91 +0,0 @@
-package log
-
-import (
-	"encoding"
-	"encoding/json"
-	"fmt"
-	"io"
-	"reflect"
-)
-
-type jsonLogger struct {
-	io.Writer
-}
-
-// NewJSONLogger returns a Logger that encodes keyvals to the Writer as a
-// single JSON object. Each log event produces no more than one call to
-// w.Write. The passed Writer must be safe for concurrent use by multiple
-// goroutines if the returned Logger will be used concurrently.
-func NewJSONLogger(w io.Writer) Logger {
-	return &jsonLogger{w}
-}
-
-func (l *jsonLogger) Log(keyvals ...interface{}) error {
-	n := (len(keyvals) + 1) / 2 // +1 to handle case when len is odd
-	m := make(map[string]interface{}, n)
-	for i := 0; i < len(keyvals); i += 2 {
-		k := keyvals[i]
-		var v interface{} = ErrMissingValue
-		if i+1 < len(keyvals) {
-			v = keyvals[i+1]
-		}
-		merge(m, k, v)
-	}
-	enc := json.NewEncoder(l.Writer)
-	enc.SetEscapeHTML(false)
-	return enc.Encode(m)
-}
-
-func merge(dst map[string]interface{}, k, v interface{}) {
-	var key string
-	switch x := k.(type) {
-	case string:
-		key = x
-	case fmt.Stringer:
-		key = safeString(x)
-	default:
-		key = fmt.Sprint(x)
-	}
-
-	// We want json.Marshaler and encoding.TextMarshaller to take priority over
-	// err.Error() and v.String(). But json.Marshall (called later) does that by
-	// default so we force a no-op if it's one of those 2 case.
-	switch x := v.(type) {
-	case json.Marshaler:
-	case encoding.TextMarshaler:
-	case error:
-		v = safeError(x)
-	case fmt.Stringer:
-		v = safeString(x)
-	}
-
-	dst[key] = v
-}
-
-func safeString(str fmt.Stringer) (s string) {
-	defer func() {
-		if panicVal := recover(); panicVal != nil {
-			if v := reflect.ValueOf(str); v.Kind() == reflect.Ptr && v.IsNil() {
-				s = "NULL"
-			} else {
-				s = fmt.Sprintf("PANIC in String method: %v", panicVal)
-			}
-		}
-	}()
-	s = str.String()
-	return
-}
-
-func safeError(err error) (s interface{}) {
-	defer func() {
-		if panicVal := recover(); panicVal != nil {
-			if v := reflect.ValueOf(err); v.Kind() == reflect.Ptr && v.IsNil() {
-				s = nil
-			} else {
-				s = fmt.Sprintf("PANIC in Error method: %v", panicVal)
-			}
-		}
-	}()
-	s = err.Error()
-	return
-}
diff --git a/vendor/github.com/go-kit/log/level/doc.go b/vendor/github.com/go-kit/log/level/doc.go
deleted file mode 100644
index fd681dcf9..000000000
--- a/vendor/github.com/go-kit/log/level/doc.go
+++ /dev/null
@@ -1,33 +0,0 @@
-// Package level implements leveled logging on top of Go kit's log package. To
-// use the level package, create a logger as per normal in your func main, and
-// wrap it with level.NewFilter.
-//
-//    var logger log.Logger
-//    logger = log.NewLogfmtLogger(os.Stderr)
-//    logger = level.NewFilter(logger, level.AllowInfo()) // <--
-//    logger = log.With(logger, "ts", log.DefaultTimestampUTC)
-//
-// It's also possible to configure log level from a string. For instance from
-// a flag, environment variable or configuration file.
-//
-//    fs := flag.NewFlagSet("myprogram")
-//    lvl := fs.String("log", "info", "debug, info, warn, error")
-//
-//    var logger log.Logger
-//    logger = log.NewLogfmtLogger(os.Stderr)
-//    logger = level.NewFilter(logger, level.Allow(level.ParseDefault(*lvl, level.InfoValue()))) // <--
-//    logger = log.With(logger, "ts", log.DefaultTimestampUTC)
-//
-// Then, at the callsites, use one of the level.Debug, Info, Warn, or Error
-// helper methods to emit leveled log events.
-//
-//    logger.Log("foo", "bar") // as normal, no level
-//    level.Debug(logger).Log("request_id", reqID, "trace_data", trace.Get())
-//    if value > 100 {
-//        level.Error(logger).Log("value", value)
-//    }
-//
-// NewFilter allows precise control over what happens when a log event is
-// emitted without a level key, or if a squelched level is used. Check the
-// Option functions for details.
-package level
diff --git a/vendor/github.com/go-kit/log/level/level.go b/vendor/github.com/go-kit/log/level/level.go
deleted file mode 100644
index c641d9855..000000000
--- a/vendor/github.com/go-kit/log/level/level.go
+++ /dev/null
@@ -1,256 +0,0 @@
-package level
-
-import (
-	"errors"
-	"strings"
-
-	"github.com/go-kit/log"
-)
-
-// ErrInvalidLevelString is returned whenever an invalid string is passed to Parse.
-var ErrInvalidLevelString = errors.New("invalid level string")
-
-// Error returns a logger that includes a Key/ErrorValue pair.
-func Error(logger log.Logger) log.Logger {
-	return log.WithPrefix(logger, Key(), ErrorValue())
-}
-
-// Warn returns a logger that includes a Key/WarnValue pair.
-func Warn(logger log.Logger) log.Logger {
-	return log.WithPrefix(logger, Key(), WarnValue())
-}
-
-// Info returns a logger that includes a Key/InfoValue pair.
-func Info(logger log.Logger) log.Logger {
-	return log.WithPrefix(logger, Key(), InfoValue())
-}
-
-// Debug returns a logger that includes a Key/DebugValue pair.
-func Debug(logger log.Logger) log.Logger {
-	return log.WithPrefix(logger, Key(), DebugValue())
-}
-
-// NewFilter wraps next and implements level filtering. See the commentary on
-// the Option functions for a detailed description of how to configure levels.
-// If no options are provided, all leveled log events created with Debug,
-// Info, Warn or Error helper methods are squelched and non-leveled log
-// events are passed to next unmodified.
-func NewFilter(next log.Logger, options ...Option) log.Logger {
-	l := &logger{
-		next: next,
-	}
-	for _, option := range options {
-		option(l)
-	}
-	return l
-}
-
-type logger struct {
-	next           log.Logger
-	allowed        level
-	squelchNoLevel bool
-	errNotAllowed  error
-	errNoLevel     error
-}
-
-func (l *logger) Log(keyvals ...interface{}) error {
-	var hasLevel, levelAllowed bool
-	for i := 1; i < len(keyvals); i += 2 {
-		if v, ok := keyvals[i].(*levelValue); ok {
-			hasLevel = true
-			levelAllowed = l.allowed&v.level != 0
-			break
-		}
-	}
-	if !hasLevel && l.squelchNoLevel {
-		return l.errNoLevel
-	}
-	if hasLevel && !levelAllowed {
-		return l.errNotAllowed
-	}
-	return l.next.Log(keyvals...)
-}
-
-// Option sets a parameter for the leveled logger.
-type Option func(*logger)
-
-// Allow the provided log level to pass.
-func Allow(v Value) Option {
-	switch v {
-	case debugValue:
-		return AllowDebug()
-	case infoValue:
-		return AllowInfo()
-	case warnValue:
-		return AllowWarn()
-	case errorValue:
-		return AllowError()
-	default:
-		return AllowNone()
-	}
-}
-
-// AllowAll is an alias for AllowDebug.
-func AllowAll() Option {
-	return AllowDebug()
-}
-
-// AllowDebug allows error, warn, info and debug level log events to pass.
-func AllowDebug() Option {
-	return allowed(levelError | levelWarn | levelInfo | levelDebug)
-}
-
-// AllowInfo allows error, warn and info level log events to pass.
-func AllowInfo() Option {
-	return allowed(levelError | levelWarn | levelInfo)
-}
-
-// AllowWarn allows error and warn level log events to pass.
-func AllowWarn() Option {
-	return allowed(levelError | levelWarn)
-}
-
-// AllowError allows only error level log events to pass.
-func AllowError() Option {
-	return allowed(levelError)
-}
-
-// AllowNone allows no leveled log events to pass.
-func AllowNone() Option {
-	return allowed(0)
-}
-
-func allowed(allowed level) Option {
-	return func(l *logger) { l.allowed = allowed }
-}
-
-// Parse a string to its corresponding level value. Valid strings are "debug",
-// "info", "warn", and "error". Strings are normalized via strings.TrimSpace and
-// strings.ToLower.
-func Parse(level string) (Value, error) {
-	switch strings.TrimSpace(strings.ToLower(level)) {
-	case debugValue.name:
-		return debugValue, nil
-	case infoValue.name:
-		return infoValue, nil
-	case warnValue.name:
-		return warnValue, nil
-	case errorValue.name:
-		return errorValue, nil
-	default:
-		return nil, ErrInvalidLevelString
-	}
-}
-
-// ParseDefault calls Parse and returns the default Value on error.
-func ParseDefault(level string, def Value) Value {
-	v, err := Parse(level)
-	if err != nil {
-		return def
-	}
-	return v
-}
-
-// ErrNotAllowed sets the error to return from Log when it squelches a log
-// event disallowed by the configured Allow[Level] option. By default,
-// ErrNotAllowed is nil; in this case the log event is squelched with no
-// error.
-func ErrNotAllowed(err error) Option {
-	return func(l *logger) { l.errNotAllowed = err }
-}
-
-// SquelchNoLevel instructs Log to squelch log events with no level, so that
-// they don't proceed through to the wrapped logger. If SquelchNoLevel is set
-// to true and a log event is squelched in this way, the error value
-// configured with ErrNoLevel is returned to the caller.
-func SquelchNoLevel(squelch bool) Option {
-	return func(l *logger) { l.squelchNoLevel = squelch }
-}
-
-// ErrNoLevel sets the error to return from Log when it squelches a log event
-// with no level. By default, ErrNoLevel is nil; in this case the log event is
-// squelched with no error.
-func ErrNoLevel(err error) Option {
-	return func(l *logger) { l.errNoLevel = err }
-}
-
-// NewInjector wraps next and returns a logger that adds a Key/level pair to
-// the beginning of log events that don't already contain a level. In effect,
-// this gives a default level to logs without a level.
-func NewInjector(next log.Logger, level Value) log.Logger {
-	return &injector{
-		next:  next,
-		level: level,
-	}
-}
-
-type injector struct {
-	next  log.Logger
-	level interface{}
-}
-
-func (l *injector) Log(keyvals ...interface{}) error {
-	for i := 1; i < len(keyvals); i += 2 {
-		if _, ok := keyvals[i].(*levelValue); ok {
-			return l.next.Log(keyvals...)
-		}
-	}
-	kvs := make([]interface{}, len(keyvals)+2)
-	kvs[0], kvs[1] = key, l.level
-	copy(kvs[2:], keyvals)
-	return l.next.Log(kvs...)
-}
-
-// Value is the interface that each of the canonical level values implement.
-// It contains unexported methods that prevent types from other packages from
-// implementing it and guaranteeing that NewFilter can distinguish the levels
-// defined in this package from all other values.
-type Value interface {
-	String() string
-	levelVal()
-}
-
-// Key returns the unique key added to log events by the loggers in this
-// package.
-func Key() interface{} { return key }
-
-// ErrorValue returns the unique value added to log events by Error.
-func ErrorValue() Value { return errorValue }
-
-// WarnValue returns the unique value added to log events by Warn.
-func WarnValue() Value { return warnValue }
-
-// InfoValue returns the unique value added to log events by Info.
-func InfoValue() Value { return infoValue }
-
-// DebugValue returns the unique value added to log events by Debug.
-func DebugValue() Value { return debugValue }
-
-var (
-	// key is of type interface{} so that it allocates once during package
-	// initialization and avoids allocating every time the value is added to a
-	// []interface{} later.
-	key interface{} = "level"
-
-	errorValue = &levelValue{level: levelError, name: "error"}
-	warnValue  = &levelValue{level: levelWarn, name: "warn"}
-	infoValue  = &levelValue{level: levelInfo, name: "info"}
-	debugValue = &levelValue{level: levelDebug, name: "debug"}
-)
-
-type level byte
-
-const (
-	levelDebug level = 1 << iota
-	levelInfo
-	levelWarn
-	levelError
-)
-
-type levelValue struct {
-	name string
-	level
-}
-
-func (v *levelValue) String() string { return v.name }
-func (v *levelValue) levelVal()      {}
diff --git a/vendor/github.com/go-kit/log/log.go b/vendor/github.com/go-kit/log/log.go
deleted file mode 100644
index 62e11adac..000000000
--- a/vendor/github.com/go-kit/log/log.go
+++ /dev/null
@@ -1,179 +0,0 @@
-package log
-
-import "errors"
-
-// Logger is the fundamental interface for all log operations. Log creates a
-// log event from keyvals, a variadic sequence of alternating keys and values.
-// Implementations must be safe for concurrent use by multiple goroutines. In
-// particular, any implementation of Logger that appends to keyvals or
-// modifies or retains any of its elements must make a copy first.
-type Logger interface {
-	Log(keyvals ...interface{}) error
-}
-
-// ErrMissingValue is appended to keyvals slices with odd length to substitute
-// the missing value.
-var ErrMissingValue = errors.New("(MISSING)")
-
-// With returns a new contextual logger with keyvals prepended to those passed
-// to calls to Log. If logger is also a contextual logger created by With,
-// WithPrefix, or WithSuffix, keyvals is appended to the existing context.
-//
-// The returned Logger replaces all value elements (odd indexes) containing a
-// Valuer with their generated value for each call to its Log method.
-func With(logger Logger, keyvals ...interface{}) Logger {
-	if len(keyvals) == 0 {
-		return logger
-	}
-	l := newContext(logger)
-	kvs := append(l.keyvals, keyvals...)
-	if len(kvs)%2 != 0 {
-		kvs = append(kvs, ErrMissingValue)
-	}
-	return &context{
-		logger: l.logger,
-		// Limiting the capacity of the stored keyvals ensures that a new
-		// backing array is created if the slice must grow in Log or With.
-		// Using the extra capacity without copying risks a data race that
-		// would violate the Logger interface contract.
-		keyvals:    kvs[:len(kvs):len(kvs)],
-		hasValuer:  l.hasValuer || containsValuer(keyvals),
-		sKeyvals:   l.sKeyvals,
-		sHasValuer: l.sHasValuer,
-	}
-}
-
-// WithPrefix returns a new contextual logger with keyvals prepended to those
-// passed to calls to Log. If logger is also a contextual logger created by
-// With, WithPrefix, or WithSuffix, keyvals is prepended to the existing context.
-//
-// The returned Logger replaces all value elements (odd indexes) containing a
-// Valuer with their generated value for each call to its Log method.
-func WithPrefix(logger Logger, keyvals ...interface{}) Logger {
-	if len(keyvals) == 0 {
-		return logger
-	}
-	l := newContext(logger)
-	// Limiting the capacity of the stored keyvals ensures that a new
-	// backing array is created if the slice must grow in Log or With.
-	// Using the extra capacity without copying risks a data race that
-	// would violate the Logger interface contract.
-	n := len(l.keyvals) + len(keyvals)
-	if len(keyvals)%2 != 0 {
-		n++
-	}
-	kvs := make([]interface{}, 0, n)
-	kvs = append(kvs, keyvals...)
-	if len(kvs)%2 != 0 {
-		kvs = append(kvs, ErrMissingValue)
-	}
-	kvs = append(kvs, l.keyvals...)
-	return &context{
-		logger:     l.logger,
-		keyvals:    kvs,
-		hasValuer:  l.hasValuer || containsValuer(keyvals),
-		sKeyvals:   l.sKeyvals,
-		sHasValuer: l.sHasValuer,
-	}
-}
-
-// WithSuffix returns a new contextual logger with keyvals appended to those
-// passed to calls to Log. If logger is also a contextual logger created by
-// With, WithPrefix, or WithSuffix, keyvals is appended to the existing context.
-//
-// The returned Logger replaces all value elements (odd indexes) containing a
-// Valuer with their generated value for each call to its Log method.
-func WithSuffix(logger Logger, keyvals ...interface{}) Logger {
-	if len(keyvals) == 0 {
-		return logger
-	}
-	l := newContext(logger)
-	// Limiting the capacity of the stored keyvals ensures that a new
-	// backing array is created if the slice must grow in Log or With.
-	// Using the extra capacity without copying risks a data race that
-	// would violate the Logger interface contract.
-	n := len(l.sKeyvals) + len(keyvals)
-	if len(keyvals)%2 != 0 {
-		n++
-	}
-	kvs := make([]interface{}, 0, n)
-	kvs = append(kvs, keyvals...)
-	if len(kvs)%2 != 0 {
-		kvs = append(kvs, ErrMissingValue)
-	}
-	kvs = append(l.sKeyvals, kvs...)
-	return &context{
-		logger:     l.logger,
-		keyvals:    l.keyvals,
-		hasValuer:  l.hasValuer,
-		sKeyvals:   kvs,
-		sHasValuer: l.sHasValuer || containsValuer(keyvals),
-	}
-}
-
-// context is the Logger implementation returned by With, WithPrefix, and
-// WithSuffix. It wraps a Logger and holds keyvals that it includes in all
-// log events. Its Log method calls bindValues to generate values for each
-// Valuer in the context keyvals.
-//
-// A context must always have the same number of stack frames between calls to
-// its Log method and the eventual binding of Valuers to their value. This
-// requirement comes from the functional requirement to allow a context to
-// resolve application call site information for a Caller stored in the
-// context. To do this we must be able to predict the number of logging
-// functions on the stack when bindValues is called.
-//
-// Two implementation details provide the needed stack depth consistency.
-//
-//    1. newContext avoids introducing an additional layer when asked to
-//       wrap another context.
-//    2. With, WithPrefix, and WithSuffix avoid introducing an additional
-//       layer by returning a newly constructed context with a merged keyvals
-//       rather than simply wrapping the existing context.
-type context struct {
-	logger     Logger
-	keyvals    []interface{}
-	sKeyvals   []interface{} // suffixes
-	hasValuer  bool
-	sHasValuer bool
-}
-
-func newContext(logger Logger) *context {
-	if c, ok := logger.(*context); ok {
-		return c
-	}
-	return &context{logger: logger}
-}
-
-// Log replaces all value elements (odd indexes) containing a Valuer in the
-// stored context with their generated value, appends keyvals, and passes the
-// result to the wrapped Logger.
-func (l *context) Log(keyvals ...interface{}) error {
-	kvs := append(l.keyvals, keyvals...)
-	if len(kvs)%2 != 0 {
-		kvs = append(kvs, ErrMissingValue)
-	}
-	if l.hasValuer {
-		// If no keyvals were appended above then we must copy l.keyvals so
-		// that future log events will reevaluate the stored Valuers.
-		if len(keyvals) == 0 {
-			kvs = append([]interface{}{}, l.keyvals...)
-		}
-		bindValues(kvs[:(len(l.keyvals))])
-	}
-	kvs = append(kvs, l.sKeyvals...)
-	if l.sHasValuer {
-		bindValues(kvs[len(kvs)-len(l.sKeyvals):])
-	}
-	return l.logger.Log(kvs...)
-}
-
-// LoggerFunc is an adapter to allow use of ordinary functions as Loggers. If
-// f is a function with the appropriate signature, LoggerFunc(f) is a Logger
-// object that calls f.
-type LoggerFunc func(...interface{}) error
-
-// Log implements Logger by calling f(keyvals...).
-func (f LoggerFunc) Log(keyvals ...interface{}) error {
-	return f(keyvals...)
-}
diff --git a/vendor/github.com/go-kit/log/logfmt_logger.go b/vendor/github.com/go-kit/log/logfmt_logger.go
deleted file mode 100644
index a00305298..000000000
--- a/vendor/github.com/go-kit/log/logfmt_logger.go
+++ /dev/null
@@ -1,62 +0,0 @@
-package log
-
-import (
-	"bytes"
-	"io"
-	"sync"
-
-	"github.com/go-logfmt/logfmt"
-)
-
-type logfmtEncoder struct {
-	*logfmt.Encoder
-	buf bytes.Buffer
-}
-
-func (l *logfmtEncoder) Reset() {
-	l.Encoder.Reset()
-	l.buf.Reset()
-}
-
-var logfmtEncoderPool = sync.Pool{
-	New: func() interface{} {
-		var enc logfmtEncoder
-		enc.Encoder = logfmt.NewEncoder(&enc.buf)
-		return &enc
-	},
-}
-
-type logfmtLogger struct {
-	w io.Writer
-}
-
-// NewLogfmtLogger returns a logger that encodes keyvals to the Writer in
-// logfmt format. Each log event produces no more than one call to w.Write.
-// The passed Writer must be safe for concurrent use by multiple goroutines if
-// the returned Logger will be used concurrently.
-func NewLogfmtLogger(w io.Writer) Logger {
-	return &logfmtLogger{w}
-}
-
-func (l logfmtLogger) Log(keyvals ...interface{}) error {
-	enc := logfmtEncoderPool.Get().(*logfmtEncoder)
-	enc.Reset()
-	defer logfmtEncoderPool.Put(enc)
-
-	if err := enc.EncodeKeyvals(keyvals...); err != nil {
-		return err
-	}
-
-	// Add newline to the end of the buffer
-	if err := enc.EndRecord(); err != nil {
-		return err
-	}
-
-	// The Logger interface requires implementations to be safe for concurrent
-	// use by multiple goroutines. For this implementation that means making
-	// only one call to l.w.Write() for each call to Log.
-	if _, err := l.w.Write(enc.buf.Bytes()); err != nil {
-		return err
-	}
-	return nil
-}
diff --git a/vendor/github.com/go-kit/log/nop_logger.go b/vendor/github.com/go-kit/log/nop_logger.go
deleted file mode 100644
index 1047d626c..000000000
--- a/vendor/github.com/go-kit/log/nop_logger.go
+++ /dev/null
@@ -1,8 +0,0 @@
-package log
-
-type nopLogger struct{}
-
-// NewNopLogger returns a logger that doesn't do anything.
-func NewNopLogger() Logger { return nopLogger{} }
-
-func (nopLogger) Log(...interface{}) error { return nil }
diff --git a/vendor/github.com/go-kit/log/staticcheck.conf b/vendor/github.com/go-kit/log/staticcheck.conf
deleted file mode 100644
index 528438b97..000000000
--- a/vendor/github.com/go-kit/log/staticcheck.conf
+++ /dev/null
@@ -1 +0,0 @@
-checks = ["all"]
diff --git a/vendor/github.com/go-kit/log/stdlib.go b/vendor/github.com/go-kit/log/stdlib.go
deleted file mode 100644
index 0338edbe2..000000000
--- a/vendor/github.com/go-kit/log/stdlib.go
+++ /dev/null
@@ -1,151 +0,0 @@
-package log
-
-import (
-	"bytes"
-	"io"
-	"log"
-	"regexp"
-	"strings"
-)
-
-// StdlibWriter implements io.Writer by invoking the stdlib log.Print. It's
-// designed to be passed to a Go kit logger as the writer, for cases where
-// it's necessary to redirect all Go kit log output to the stdlib logger.
-//
-// If you have any choice in the matter, you shouldn't use this. Prefer to
-// redirect the stdlib log to the Go kit logger via NewStdlibAdapter.
-type StdlibWriter struct{}
-
-// Write implements io.Writer.
-func (w StdlibWriter) Write(p []byte) (int, error) {
-	log.Print(strings.TrimSpace(string(p)))
-	return len(p), nil
-}
-
-// StdlibAdapter wraps a Logger and allows it to be passed to the stdlib
-// logger's SetOutput. It will extract date/timestamps, filenames, and
-// messages, and place them under relevant keys.
-type StdlibAdapter struct {
-	Logger
-	timestampKey    string
-	fileKey         string
-	messageKey      string
-	prefix          string
-	joinPrefixToMsg bool
-}
-
-// StdlibAdapterOption sets a parameter for the StdlibAdapter.
-type StdlibAdapterOption func(*StdlibAdapter)
-
-// TimestampKey sets the key for the timestamp field. By default, it's "ts".
-func TimestampKey(key string) StdlibAdapterOption {
-	return func(a *StdlibAdapter) { a.timestampKey = key }
-}
-
-// FileKey sets the key for the file and line field. By default, it's "caller".
-func FileKey(key string) StdlibAdapterOption {
-	return func(a *StdlibAdapter) { a.fileKey = key }
-}
-
-// MessageKey sets the key for the actual log message. By default, it's "msg".
-func MessageKey(key string) StdlibAdapterOption {
-	return func(a *StdlibAdapter) { a.messageKey = key }
-}
-
-// Prefix configures the adapter to parse a prefix from stdlib log events. If
-// you provide a non-empty prefix to the stdlib logger, then your should provide
-// that same prefix to the adapter via this option.
-//
-// By default, the prefix isn't included in the msg key. Set joinPrefixToMsg to
-// true if you want to include the parsed prefix in the msg.
-func Prefix(prefix string, joinPrefixToMsg bool) StdlibAdapterOption {
-	return func(a *StdlibAdapter) { a.prefix = prefix; a.joinPrefixToMsg = joinPrefixToMsg }
-}
-
-// NewStdlibAdapter returns a new StdlibAdapter wrapper around the passed
-// logger. It's designed to be passed to log.SetOutput.
-func NewStdlibAdapter(logger Logger, options ...StdlibAdapterOption) io.Writer {
-	a := StdlibAdapter{
-		Logger:       logger,
-		timestampKey: "ts",
-		fileKey:      "caller",
-		messageKey:   "msg",
-	}
-	for _, option := range options {
-		option(&a)
-	}
-	return a
-}
-
-func (a StdlibAdapter) Write(p []byte) (int, error) {
-	p = a.handlePrefix(p)
-
-	result := subexps(p)
-	keyvals := []interface{}{}
-	var timestamp string
-	if date, ok := result["date"]; ok && date != "" {
-		timestamp = date
-	}
-	if time, ok := result["time"]; ok && time != "" {
-		if timestamp != "" {
-			timestamp += " "
-		}
-		timestamp += time
-	}
-	if timestamp != "" {
-		keyvals = append(keyvals, a.timestampKey, timestamp)
-	}
-	if file, ok := result["file"]; ok && file != "" {
-		keyvals = append(keyvals, a.fileKey, file)
-	}
-	if msg, ok := result["msg"]; ok {
-		msg = a.handleMessagePrefix(msg)
-		keyvals = append(keyvals, a.messageKey, msg)
-	}
-	if err := a.Logger.Log(keyvals...); err != nil {
-		return 0, err
-	}
-	return len(p), nil
-}
-
-func (a StdlibAdapter) handlePrefix(p []byte) []byte {
-	if a.prefix != "" {
-		p = bytes.TrimPrefix(p, []byte(a.prefix))
-	}
-	return p
-}
-
-func (a StdlibAdapter) handleMessagePrefix(msg string) string {
-	if a.prefix == "" {
-		return msg
-	}
-
-	msg = strings.TrimPrefix(msg, a.prefix)
-	if a.joinPrefixToMsg {
-		msg = a.prefix + msg
-	}
-	return msg
-}
-
-const (
-	logRegexpDate = `(?P<date>[0-9]{4}/[0-9]{2}/[0-9]{2})?[ ]?`
-	logRegexpTime = `(?P<time>[0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]+)?)?[ ]?`
-	logRegexpFile = `(?P<file>.+?:[0-9]+)?`
-	logRegexpMsg  = `(: )?(?P<msg>(?s:.*))`
-)
-
-var (
-	logRegexp = regexp.MustCompile(logRegexpDate + logRegexpTime + logRegexpFile + logRegexpMsg)
-)
-
-func subexps(line []byte) map[string]string {
-	m := logRegexp.FindSubmatch(line)
-	if len(m) < len(logRegexp.SubexpNames()) {
-		return map[string]string{}
-	}
-	result := map[string]string{}
-	for i, name := range logRegexp.SubexpNames() {
-		result[name] = strings.TrimRight(string(m[i]), "\n")
-	}
-	return result
-}
diff --git a/vendor/github.com/go-kit/log/sync.go b/vendor/github.com/go-kit/log/sync.go
deleted file mode 100644
index 58bd3add1..000000000
--- a/vendor/github.com/go-kit/log/sync.go
+++ /dev/null
@@ -1,113 +0,0 @@
-package log
-
-import (
-	"io"
-	"sync"
-	"sync/atomic"
-)
-
-// SwapLogger wraps another logger that may be safely replaced while other
-// goroutines use the SwapLogger concurrently. The zero value for a SwapLogger
-// will discard all log events without error.
-//
-// SwapLogger serves well as a package global logger that can be changed by
-// importers.
-type SwapLogger struct {
-	logger atomic.Value
-}
-
-type loggerStruct struct {
-	Logger
-}
-
-// Log implements the Logger interface by forwarding keyvals to the currently
-// wrapped logger. It does not log anything if the wrapped logger is nil.
-func (l *SwapLogger) Log(keyvals ...interface{}) error {
-	s, ok := l.logger.Load().(loggerStruct)
-	if !ok || s.Logger == nil {
-		return nil
-	}
-	return s.Log(keyvals...)
-}
-
-// Swap replaces the currently wrapped logger with logger. Swap may be called
-// concurrently with calls to Log from other goroutines.
-func (l *SwapLogger) Swap(logger Logger) {
-	l.logger.Store(loggerStruct{logger})
-}
-
-// NewSyncWriter returns a new writer that is safe for concurrent use by
-// multiple goroutines. Writes to the returned writer are passed on to w. If
-// another write is already in progress, the calling goroutine blocks until
-// the writer is available.
-//
-// If w implements the following interface, so does the returned writer.
-//
-//    interface {
-//        Fd() uintptr
-//    }
-func NewSyncWriter(w io.Writer) io.Writer {
-	switch w := w.(type) {
-	case fdWriter:
-		return &fdSyncWriter{fdWriter: w}
-	default:
-		return &syncWriter{Writer: w}
-	}
-}
-
-// syncWriter synchronizes concurrent writes to an io.Writer.
-type syncWriter struct {
-	sync.Mutex
-	io.Writer
-}
-
-// Write writes p to the underlying io.Writer. If another write is already in
-// progress, the calling goroutine blocks until the syncWriter is available.
-func (w *syncWriter) Write(p []byte) (n int, err error) {
-	w.Lock()
-	defer w.Unlock()
-	return w.Writer.Write(p)
-}
-
-// fdWriter is an io.Writer that also has an Fd method. The most common
-// example of an fdWriter is an *os.File.
-type fdWriter interface {
-	io.Writer
-	Fd() uintptr
-}
-
-// fdSyncWriter synchronizes concurrent writes to an fdWriter.
-type fdSyncWriter struct {
-	sync.Mutex
-	fdWriter
-}
-
-// Write writes p to the underlying io.Writer. If another write is already in
-// progress, the calling goroutine blocks until the fdSyncWriter is available.
-func (w *fdSyncWriter) Write(p []byte) (n int, err error) {
-	w.Lock()
-	defer w.Unlock()
-	return w.fdWriter.Write(p)
-}
-
-// syncLogger provides concurrent safe logging for another Logger.
-type syncLogger struct {
-	mu     sync.Mutex
-	logger Logger
-}
-
-// NewSyncLogger returns a logger that synchronizes concurrent use of the
-// wrapped logger. When multiple goroutines use the SyncLogger concurrently
-// only one goroutine will be allowed to log to the wrapped logger at a time.
-// The other goroutines will block until the logger is available.
-func NewSyncLogger(logger Logger) Logger {
-	return &syncLogger{logger: logger}
-}
-
-// Log logs keyvals to the underlying Logger. If another log is already in
-// progress, the calling goroutine blocks until the syncLogger is available.
-func (l *syncLogger) Log(keyvals ...interface{}) error {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	return l.logger.Log(keyvals...)
-}
diff --git a/vendor/github.com/go-kit/log/value.go b/vendor/github.com/go-kit/log/value.go
deleted file mode 100644
index 3ce197f78..000000000
--- a/vendor/github.com/go-kit/log/value.go
+++ /dev/null
@@ -1,110 +0,0 @@
-package log
-
-import (
-	"runtime"
-	"strconv"
-	"strings"
-	"time"
-)
-
-// A Valuer generates a log value. When passed to With, WithPrefix, or
-// WithSuffix in a value element (odd indexes), it represents a dynamic
-// value which is re-evaluated with each log event.
-type Valuer func() interface{}
-
-// bindValues replaces all value elements (odd indexes) containing a Valuer
-// with their generated value.
-func bindValues(keyvals []interface{}) {
-	for i := 1; i < len(keyvals); i += 2 {
-		if v, ok := keyvals[i].(Valuer); ok {
-			keyvals[i] = v()
-		}
-	}
-}
-
-// containsValuer returns true if any of the value elements (odd indexes)
-// contain a Valuer.
-func containsValuer(keyvals []interface{}) bool {
-	for i := 1; i < len(keyvals); i += 2 {
-		if _, ok := keyvals[i].(Valuer); ok {
-			return true
-		}
-	}
-	return false
-}
-
-// Timestamp returns a timestamp Valuer. It invokes the t function to get the
-// time; unless you are doing something tricky, pass time.Now.
-//
-// Most users will want to use DefaultTimestamp or DefaultTimestampUTC, which
-// are TimestampFormats that use the RFC3339Nano format.
-func Timestamp(t func() time.Time) Valuer {
-	return func() interface{} { return t() }
-}
-
-// TimestampFormat returns a timestamp Valuer with a custom time format. It
-// invokes the t function to get the time to format; unless you are doing
-// something tricky, pass time.Now. The layout string is passed to
-// Time.Format.
-//
-// Most users will want to use DefaultTimestamp or DefaultTimestampUTC, which
-// are TimestampFormats that use the RFC3339Nano format.
-func TimestampFormat(t func() time.Time, layout string) Valuer {
-	return func() interface{} {
-		return timeFormat{
-			time:   t(),
-			layout: layout,
-		}
-	}
-}
-
-// A timeFormat represents an instant in time and a layout used when
-// marshaling to a text format.
-type timeFormat struct {
-	time   time.Time
-	layout string
-}
-
-func (tf timeFormat) String() string {
-	return tf.time.Format(tf.layout)
-}
-
-// MarshalText implements encoding.TextMarshaller.
-func (tf timeFormat) MarshalText() (text []byte, err error) {
-	// The following code adapted from the standard library time.Time.Format
-	// method. Using the same undocumented magic constant to extend the size
-	// of the buffer as seen there.
-	b := make([]byte, 0, len(tf.layout)+10)
-	b = tf.time.AppendFormat(b, tf.layout)
-	return b, nil
-}
-
-// Caller returns a Valuer that returns a file and line from a specified depth
-// in the callstack. Users will probably want to use DefaultCaller.
-func Caller(depth int) Valuer {
-	return func() interface{} {
-		_, file, line, _ := runtime.Caller(depth)
-		idx := strings.LastIndexByte(file, '/')
-		// using idx+1 below handles both of following cases:
-		// idx == -1 because no "/" was found, or
-		// idx >= 0 and we want to start at the character after the found "/".
-		return file[idx+1:] + ":" + strconv.Itoa(line)
-	}
-}
-
-var (
-	// DefaultTimestamp is a Valuer that returns the current wallclock time,
-	// respecting time zones, when bound.
-	DefaultTimestamp = TimestampFormat(time.Now, time.RFC3339Nano)
-
-	// DefaultTimestampUTC is a Valuer that returns the current time in UTC
-	// when bound.
-	DefaultTimestampUTC = TimestampFormat(
-		func() time.Time { return time.Now().UTC() },
-		time.RFC3339Nano,
-	)
-
-	// DefaultCaller is a Valuer that returns the file and line where the Log
-	// method was invoked. It can only be used with log.With.
-	DefaultCaller = Caller(3)
-)
diff --git a/vendor/github.com/go-logfmt/logfmt/.gitignore b/vendor/github.com/go-logfmt/logfmt/.gitignore
deleted file mode 100644
index 1d74e2196..000000000
--- a/vendor/github.com/go-logfmt/logfmt/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-.vscode/
diff --git a/vendor/github.com/go-logfmt/logfmt/CHANGELOG.md b/vendor/github.com/go-logfmt/logfmt/CHANGELOG.md
deleted file mode 100644
index 1a9a27bcf..000000000
--- a/vendor/github.com/go-logfmt/logfmt/CHANGELOG.md
+++ /dev/null
@@ -1,48 +0,0 @@
-# Changelog
-All notable changes to this project will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-## [0.5.0] - 2020-01-03
-
-### Changed
-- Remove the dependency on github.com/kr/logfmt by [@ChrisHines]
-- Move fuzz code to github.com/go-logfmt/fuzzlogfmt by [@ChrisHines]
-
-## [0.4.0] - 2018-11-21
-
-### Added
-- Go module support by [@ChrisHines]
-- CHANGELOG by [@ChrisHines]
-
-### Changed
-- Drop invalid runes from keys instead of returning ErrInvalidKey by [@ChrisHines]
-- On panic while printing, attempt to print panic value by [@bboreham]
-
-## [0.3.0] - 2016-11-15
-### Added
-- Pool buffers for quoted strings and byte slices by [@nussjustin]
-### Fixed
-- Fuzz fix, quote invalid UTF-8 values by [@judwhite]
-
-## [0.2.0] - 2016-05-08
-### Added
-- Encoder.EncodeKeyvals by [@ChrisHines]
-
-## [0.1.0] - 2016-03-28
-### Added
-- Encoder by [@ChrisHines]
-- Decoder by [@ChrisHines]
-- MarshalKeyvals by [@ChrisHines]
-
-[0.5.0]: https://github.com/go-logfmt/logfmt/compare/v0.4.0...v0.5.0
-[0.4.0]: https://github.com/go-logfmt/logfmt/compare/v0.3.0...v0.4.0
-[0.3.0]: https://github.com/go-logfmt/logfmt/compare/v0.2.0...v0.3.0
-[0.2.0]: https://github.com/go-logfmt/logfmt/compare/v0.1.0...v0.2.0
-[0.1.0]: https://github.com/go-logfmt/logfmt/commits/v0.1.0
-
-[@ChrisHines]: https://github.com/ChrisHines
-[@bboreham]: https://github.com/bboreham
-[@judwhite]: https://github.com/judwhite
-[@nussjustin]: https://github.com/nussjustin
diff --git a/vendor/github.com/go-logfmt/logfmt/LICENSE b/vendor/github.com/go-logfmt/logfmt/LICENSE
deleted file mode 100644
index c02650896..000000000
--- a/vendor/github.com/go-logfmt/logfmt/LICENSE
+++ /dev/null
@@ -1,22 +0,0 @@
-The MIT License (MIT)
-
-Copyright (c) 2015 go-logfmt
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
diff --git a/vendor/github.com/go-logfmt/logfmt/README.md b/vendor/github.com/go-logfmt/logfmt/README.md
deleted file mode 100644
index 8e48fcd3a..000000000
--- a/vendor/github.com/go-logfmt/logfmt/README.md
+++ /dev/null
@@ -1,33 +0,0 @@
-[![Go Reference](https://pkg.go.dev/badge/github.com/go-logfmt/logfmt.svg)](https://pkg.go.dev/github.com/go-logfmt/logfmt)
-[![Go Report Card](https://goreportcard.com/badge/go-logfmt/logfmt)](https://goreportcard.com/report/go-logfmt/logfmt)
-[![Github Actions](https://github.com/go-logfmt/logfmt/actions/workflows/test.yml/badge.svg)](https://github.com/go-logfmt/logfmt/actions/workflows/test.yml)
-[![Coverage Status](https://coveralls.io/repos/github/go-logfmt/logfmt/badge.svg?branch=master)](https://coveralls.io/github/go-logfmt/logfmt?branch=master)
-
-# logfmt
-
-Package logfmt implements utilities to marshal and unmarshal data in the [logfmt
-format](https://brandur.org/logfmt). It provides an API similar to
-[encoding/json](http://golang.org/pkg/encoding/json/) and
-[encoding/xml](http://golang.org/pkg/encoding/xml/).
-
-The logfmt format was first documented by Brandur Leach in [this
-article](https://brandur.org/logfmt). The format has not been formally
-standardized. The most authoritative public specification to date has been the
-documentation of a Go Language [package](http://godoc.org/github.com/kr/logfmt)
-written by Blake Mizerany and Keith Rarick.
-
-## Goals
-
-This project attempts to conform as closely as possible to the prior art, while
-also removing ambiguity where necessary to provide well behaved encoder and
-decoder implementations.
-
-## Non-goals
-
-This project does not attempt to formally standardize the logfmt format. In the
-event that logfmt is standardized this project would take conforming to the
-standard as a goal.
-
-## Versioning
-
-Package logfmt publishes releases via [semver](http://semver.org/) compatible Git tags prefixed with a single 'v'.
diff --git a/vendor/github.com/go-logfmt/logfmt/decode.go b/vendor/github.com/go-logfmt/logfmt/decode.go
deleted file mode 100644
index 2013708e4..000000000
--- a/vendor/github.com/go-logfmt/logfmt/decode.go
+++ /dev/null
@@ -1,237 +0,0 @@
-package logfmt
-
-import (
-	"bufio"
-	"bytes"
-	"fmt"
-	"io"
-	"unicode/utf8"
-)
-
-// A Decoder reads and decodes logfmt records from an input stream.
-type Decoder struct {
-	pos     int
-	key     []byte
-	value   []byte
-	lineNum int
-	s       *bufio.Scanner
-	err     error
-}
-
-// NewDecoder returns a new decoder that reads from r.
-//
-// The decoder introduces its own buffering and may read data from r beyond
-// the logfmt records requested.
-func NewDecoder(r io.Reader) *Decoder {
-	dec := &Decoder{
-		s: bufio.NewScanner(r),
-	}
-	return dec
-}
-
-// ScanRecord advances the Decoder to the next record, which can then be
-// parsed with the ScanKeyval method. It returns false when decoding stops,
-// either by reaching the end of the input or an error. After ScanRecord
-// returns false, the Err method will return any error that occurred during
-// decoding, except that if it was io.EOF, Err will return nil.
-func (dec *Decoder) ScanRecord() bool {
-	if dec.err != nil {
-		return false
-	}
-	if !dec.s.Scan() {
-		dec.err = dec.s.Err()
-		return false
-	}
-	dec.lineNum++
-	dec.pos = 0
-	return true
-}
-
-// ScanKeyval advances the Decoder to the next key/value pair of the current
-// record, which can then be retrieved with the Key and Value methods. It
-// returns false when decoding stops, either by reaching the end of the
-// current record or an error.
-func (dec *Decoder) ScanKeyval() bool {
-	dec.key, dec.value = nil, nil
-	if dec.err != nil {
-		return false
-	}
-
-	line := dec.s.Bytes()
-
-	// garbage
-	for p, c := range line[dec.pos:] {
-		if c > ' ' {
-			dec.pos += p
-			goto key
-		}
-	}
-	dec.pos = len(line)
-	return false
-
-key:
-	const invalidKeyError = "invalid key"
-
-	start, multibyte := dec.pos, false
-	for p, c := range line[dec.pos:] {
-		switch {
-		case c == '=':
-			dec.pos += p
-			if dec.pos > start {
-				dec.key = line[start:dec.pos]
-				if multibyte && bytes.ContainsRune(dec.key, utf8.RuneError) {
-					dec.syntaxError(invalidKeyError)
-					return false
-				}
-			}
-			if dec.key == nil {
-				dec.unexpectedByte(c)
-				return false
-			}
-			goto equal
-		case c == '"':
-			dec.pos += p
-			dec.unexpectedByte(c)
-			return false
-		case c <= ' ':
-			dec.pos += p
-			if dec.pos > start {
-				dec.key = line[start:dec.pos]
-				if multibyte && bytes.ContainsRune(dec.key, utf8.RuneError) {
-					dec.syntaxError(invalidKeyError)
-					return false
-				}
-			}
-			return true
-		case c >= utf8.RuneSelf:
-			multibyte = true
-		}
-	}
-	dec.pos = len(line)
-	if dec.pos > start {
-		dec.key = line[start:dec.pos]
-		if multibyte && bytes.ContainsRune(dec.key, utf8.RuneError) {
-			dec.syntaxError(invalidKeyError)
-			return false
-		}
-	}
-	return true
-
-equal:
-	dec.pos++
-	if dec.pos >= len(line) {
-		return true
-	}
-	switch c := line[dec.pos]; {
-	case c <= ' ':
-		return true
-	case c == '"':
-		goto qvalue
-	}
-
-	// value
-	start = dec.pos
-	for p, c := range line[dec.pos:] {
-		switch {
-		case c == '=' || c == '"':
-			dec.pos += p
-			dec.unexpectedByte(c)
-			return false
-		case c <= ' ':
-			dec.pos += p
-			if dec.pos > start {
-				dec.value = line[start:dec.pos]
-			}
-			return true
-		}
-	}
-	dec.pos = len(line)
-	if dec.pos > start {
-		dec.value = line[start:dec.pos]
-	}
-	return true
-
-qvalue:
-	const (
-		untermQuote  = "unterminated quoted value"
-		invalidQuote = "invalid quoted value"
-	)
-
-	hasEsc, esc := false, false
-	start = dec.pos
-	for p, c := range line[dec.pos+1:] {
-		switch {
-		case esc:
-			esc = false
-		case c == '\\':
-			hasEsc, esc = true, true
-		case c == '"':
-			dec.pos += p + 2
-			if hasEsc {
-				v, ok := unquoteBytes(line[start:dec.pos])
-				if !ok {
-					dec.syntaxError(invalidQuote)
-					return false
-				}
-				dec.value = v
-			} else {
-				start++
-				end := dec.pos - 1
-				if end > start {
-					dec.value = line[start:end]
-				}
-			}
-			return true
-		}
-	}
-	dec.pos = len(line)
-	dec.syntaxError(untermQuote)
-	return false
-}
-
-// Key returns the most recent key found by a call to ScanKeyval. The returned
-// slice may point to internal buffers and is only valid until the next call
-// to ScanRecord.  It does no allocation.
-func (dec *Decoder) Key() []byte {
-	return dec.key
-}
-
-// Value returns the most recent value found by a call to ScanKeyval. The
-// returned slice may point to internal buffers and is only valid until the
-// next call to ScanRecord.  It does no allocation when the value has no
-// escape sequences.
-func (dec *Decoder) Value() []byte {
-	return dec.value
-}
-
-// Err returns the first non-EOF error that was encountered by the Scanner.
-func (dec *Decoder) Err() error {
-	return dec.err
-}
-
-func (dec *Decoder) syntaxError(msg string) {
-	dec.err = &SyntaxError{
-		Msg:  msg,
-		Line: dec.lineNum,
-		Pos:  dec.pos + 1,
-	}
-}
-
-func (dec *Decoder) unexpectedByte(c byte) {
-	dec.err = &SyntaxError{
-		Msg:  fmt.Sprintf("unexpected %q", c),
-		Line: dec.lineNum,
-		Pos:  dec.pos + 1,
-	}
-}
-
-// A SyntaxError represents a syntax error in the logfmt input stream.
-type SyntaxError struct {
-	Msg  string
-	Line int
-	Pos  int
-}
-
-func (e *SyntaxError) Error() string {
-	return fmt.Sprintf("logfmt syntax error at pos %d on line %d: %s", e.Pos, e.Line, e.Msg)
-}
diff --git a/vendor/github.com/go-logfmt/logfmt/doc.go b/vendor/github.com/go-logfmt/logfmt/doc.go
deleted file mode 100644
index 378e9ad12..000000000
--- a/vendor/github.com/go-logfmt/logfmt/doc.go
+++ /dev/null
@@ -1,6 +0,0 @@
-// Package logfmt implements utilities to marshal and unmarshal data in the
-// logfmt format. The logfmt format records key/value pairs in a way that
-// balances readability for humans and simplicity of computer parsing. It is
-// most commonly used as a more human friendly alternative to JSON for
-// structured logging.
-package logfmt
diff --git a/vendor/github.com/go-logfmt/logfmt/encode.go b/vendor/github.com/go-logfmt/logfmt/encode.go
deleted file mode 100644
index 4ea9d2399..000000000
--- a/vendor/github.com/go-logfmt/logfmt/encode.go
+++ /dev/null
@@ -1,322 +0,0 @@
-package logfmt
-
-import (
-	"bytes"
-	"encoding"
-	"errors"
-	"fmt"
-	"io"
-	"reflect"
-	"strings"
-	"unicode/utf8"
-)
-
-// MarshalKeyvals returns the logfmt encoding of keyvals, a variadic sequence
-// of alternating keys and values.
-func MarshalKeyvals(keyvals ...interface{}) ([]byte, error) {
-	buf := &bytes.Buffer{}
-	if err := NewEncoder(buf).EncodeKeyvals(keyvals...); err != nil {
-		return nil, err
-	}
-	return buf.Bytes(), nil
-}
-
-// An Encoder writes logfmt data to an output stream.
-type Encoder struct {
-	w       io.Writer
-	scratch bytes.Buffer
-	needSep bool
-}
-
-// NewEncoder returns a new encoder that writes to w.
-func NewEncoder(w io.Writer) *Encoder {
-	return &Encoder{
-		w: w,
-	}
-}
-
-var (
-	space   = []byte(" ")
-	equals  = []byte("=")
-	newline = []byte("\n")
-	null    = []byte("null")
-)
-
-// EncodeKeyval writes the logfmt encoding of key and value to the stream. A
-// single space is written before the second and subsequent keys in a record.
-// Nothing is written if a non-nil error is returned.
-func (enc *Encoder) EncodeKeyval(key, value interface{}) error {
-	enc.scratch.Reset()
-	if enc.needSep {
-		if _, err := enc.scratch.Write(space); err != nil {
-			return err
-		}
-	}
-	if err := writeKey(&enc.scratch, key); err != nil {
-		return err
-	}
-	if _, err := enc.scratch.Write(equals); err != nil {
-		return err
-	}
-	if err := writeValue(&enc.scratch, value); err != nil {
-		return err
-	}
-	_, err := enc.w.Write(enc.scratch.Bytes())
-	enc.needSep = true
-	return err
-}
-
-// EncodeKeyvals writes the logfmt encoding of keyvals to the stream. Keyvals
-// is a variadic sequence of alternating keys and values. Keys of unsupported
-// type are skipped along with their corresponding value. Values of
-// unsupported type or that cause a MarshalerError are replaced by their error
-// but do not cause EncodeKeyvals to return an error. If a non-nil error is
-// returned some key/value pairs may not have be written.
-func (enc *Encoder) EncodeKeyvals(keyvals ...interface{}) error {
-	if len(keyvals) == 0 {
-		return nil
-	}
-	if len(keyvals)%2 == 1 {
-		keyvals = append(keyvals, nil)
-	}
-	for i := 0; i < len(keyvals); i += 2 {
-		k, v := keyvals[i], keyvals[i+1]
-		err := enc.EncodeKeyval(k, v)
-		if err == ErrUnsupportedKeyType {
-			continue
-		}
-		if _, ok := err.(*MarshalerError); ok || err == ErrUnsupportedValueType {
-			v = err
-			err = enc.EncodeKeyval(k, v)
-		}
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// MarshalerError represents an error encountered while marshaling a value.
-type MarshalerError struct {
-	Type reflect.Type
-	Err  error
-}
-
-func (e *MarshalerError) Error() string {
-	return "error marshaling value of type " + e.Type.String() + ": " + e.Err.Error()
-}
-
-// ErrNilKey is returned by Marshal functions and Encoder methods if a key is
-// a nil interface or pointer value.
-var ErrNilKey = errors.New("nil key")
-
-// ErrInvalidKey is returned by Marshal functions and Encoder methods if, after
-// dropping invalid runes, a key is empty.
-var ErrInvalidKey = errors.New("invalid key")
-
-// ErrUnsupportedKeyType is returned by Encoder methods if a key has an
-// unsupported type.
-var ErrUnsupportedKeyType = errors.New("unsupported key type")
-
-// ErrUnsupportedValueType is returned by Encoder methods if a value has an
-// unsupported type.
-var ErrUnsupportedValueType = errors.New("unsupported value type")
-
-func writeKey(w io.Writer, key interface{}) error {
-	if key == nil {
-		return ErrNilKey
-	}
-
-	switch k := key.(type) {
-	case string:
-		return writeStringKey(w, k)
-	case []byte:
-		if k == nil {
-			return ErrNilKey
-		}
-		return writeBytesKey(w, k)
-	case encoding.TextMarshaler:
-		kb, err := safeMarshal(k)
-		if err != nil {
-			return err
-		}
-		if kb == nil {
-			return ErrNilKey
-		}
-		return writeBytesKey(w, kb)
-	case fmt.Stringer:
-		ks, ok := safeString(k)
-		if !ok {
-			return ErrNilKey
-		}
-		return writeStringKey(w, ks)
-	default:
-		rkey := reflect.ValueOf(key)
-		switch rkey.Kind() {
-		case reflect.Array, reflect.Chan, reflect.Func, reflect.Map, reflect.Slice, reflect.Struct:
-			return ErrUnsupportedKeyType
-		case reflect.Ptr:
-			if rkey.IsNil() {
-				return ErrNilKey
-			}
-			return writeKey(w, rkey.Elem().Interface())
-		}
-		return writeStringKey(w, fmt.Sprint(k))
-	}
-}
-
-// keyRuneFilter returns r for all valid key runes, and -1 for all invalid key
-// runes. When used as the mapping function for strings.Map and bytes.Map
-// functions it causes them to remove invalid key runes from strings or byte
-// slices respectively.
-func keyRuneFilter(r rune) rune {
-	if r <= ' ' || r == '=' || r == '"' || r == utf8.RuneError {
-		return -1
-	}
-	return r
-}
-
-func writeStringKey(w io.Writer, key string) error {
-	k := strings.Map(keyRuneFilter, key)
-	if k == "" {
-		return ErrInvalidKey
-	}
-	_, err := io.WriteString(w, k)
-	return err
-}
-
-func writeBytesKey(w io.Writer, key []byte) error {
-	k := bytes.Map(keyRuneFilter, key)
-	if len(k) == 0 {
-		return ErrInvalidKey
-	}
-	_, err := w.Write(k)
-	return err
-}
-
-func writeValue(w io.Writer, value interface{}) error {
-	switch v := value.(type) {
-	case nil:
-		return writeBytesValue(w, null)
-	case string:
-		return writeStringValue(w, v, true)
-	case []byte:
-		return writeBytesValue(w, v)
-	case encoding.TextMarshaler:
-		vb, err := safeMarshal(v)
-		if err != nil {
-			return err
-		}
-		if vb == nil {
-			vb = null
-		}
-		return writeBytesValue(w, vb)
-	case error:
-		se, ok := safeError(v)
-		return writeStringValue(w, se, ok)
-	case fmt.Stringer:
-		ss, ok := safeString(v)
-		return writeStringValue(w, ss, ok)
-	default:
-		rvalue := reflect.ValueOf(value)
-		switch rvalue.Kind() {
-		case reflect.Array, reflect.Chan, reflect.Func, reflect.Map, reflect.Slice, reflect.Struct:
-			return ErrUnsupportedValueType
-		case reflect.Ptr:
-			if rvalue.IsNil() {
-				return writeBytesValue(w, null)
-			}
-			return writeValue(w, rvalue.Elem().Interface())
-		}
-		return writeStringValue(w, fmt.Sprint(v), true)
-	}
-}
-
-func needsQuotedValueRune(r rune) bool {
-	return r <= ' ' || r == '=' || r == '"' || r == utf8.RuneError
-}
-
-func writeStringValue(w io.Writer, value string, ok bool) error {
-	var err error
-	if ok && value == "null" {
-		_, err = io.WriteString(w, `"null"`)
-	} else if strings.IndexFunc(value, needsQuotedValueRune) != -1 {
-		_, err = writeQuotedString(w, value)
-	} else {
-		_, err = io.WriteString(w, value)
-	}
-	return err
-}
-
-func writeBytesValue(w io.Writer, value []byte) error {
-	var err error
-	if bytes.IndexFunc(value, needsQuotedValueRune) != -1 {
-		_, err = writeQuotedBytes(w, value)
-	} else {
-		_, err = w.Write(value)
-	}
-	return err
-}
-
-// EndRecord writes a newline character to the stream and resets the encoder
-// to the beginning of a new record.
-func (enc *Encoder) EndRecord() error {
-	_, err := enc.w.Write(newline)
-	if err == nil {
-		enc.needSep = false
-	}
-	return err
-}
-
-// Reset resets the encoder to the beginning of a new record.
-func (enc *Encoder) Reset() {
-	enc.needSep = false
-}
-
-func safeError(err error) (s string, ok bool) {
-	defer func() {
-		if panicVal := recover(); panicVal != nil {
-			if v := reflect.ValueOf(err); v.Kind() == reflect.Ptr && v.IsNil() {
-				s, ok = "null", false
-			} else {
-				s, ok = fmt.Sprintf("PANIC:%v", panicVal), false
-			}
-		}
-	}()
-	s, ok = err.Error(), true
-	return
-}
-
-func safeString(str fmt.Stringer) (s string, ok bool) {
-	defer func() {
-		if panicVal := recover(); panicVal != nil {
-			if v := reflect.ValueOf(str); v.Kind() == reflect.Ptr && v.IsNil() {
-				s, ok = "null", false
-			} else {
-				s, ok = fmt.Sprintf("PANIC:%v", panicVal), true
-			}
-		}
-	}()
-	s, ok = str.String(), true
-	return
-}
-
-func safeMarshal(tm encoding.TextMarshaler) (b []byte, err error) {
-	defer func() {
-		if panicVal := recover(); panicVal != nil {
-			if v := reflect.ValueOf(tm); v.Kind() == reflect.Ptr && v.IsNil() {
-				b, err = nil, nil
-			} else {
-				b, err = nil, fmt.Errorf("panic when marshalling: %s", panicVal)
-			}
-		}
-	}()
-	b, err = tm.MarshalText()
-	if err != nil {
-		return nil, &MarshalerError{
-			Type: reflect.TypeOf(tm),
-			Err:  err,
-		}
-	}
-	return
-}
diff --git a/vendor/github.com/go-logfmt/logfmt/jsonstring.go b/vendor/github.com/go-logfmt/logfmt/jsonstring.go
deleted file mode 100644
index 030ac85fc..000000000
--- a/vendor/github.com/go-logfmt/logfmt/jsonstring.go
+++ /dev/null
@@ -1,277 +0,0 @@
-package logfmt
-
-import (
-	"bytes"
-	"io"
-	"strconv"
-	"sync"
-	"unicode"
-	"unicode/utf16"
-	"unicode/utf8"
-)
-
-// Taken from Go's encoding/json and modified for use here.
-
-// Copyright 2010 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-var hex = "0123456789abcdef"
-
-var bufferPool = sync.Pool{
-	New: func() interface{} {
-		return &bytes.Buffer{}
-	},
-}
-
-func getBuffer() *bytes.Buffer {
-	return bufferPool.Get().(*bytes.Buffer)
-}
-
-func poolBuffer(buf *bytes.Buffer) {
-	buf.Reset()
-	bufferPool.Put(buf)
-}
-
-// NOTE: keep in sync with writeQuotedBytes below.
-func writeQuotedString(w io.Writer, s string) (int, error) {
-	buf := getBuffer()
-	buf.WriteByte('"')
-	start := 0
-	for i := 0; i < len(s); {
-		if b := s[i]; b < utf8.RuneSelf {
-			if 0x20 <= b && b != '\\' && b != '"' {
-				i++
-				continue
-			}
-			if start < i {
-				buf.WriteString(s[start:i])
-			}
-			switch b {
-			case '\\', '"':
-				buf.WriteByte('\\')
-				buf.WriteByte(b)
-			case '\n':
-				buf.WriteByte('\\')
-				buf.WriteByte('n')
-			case '\r':
-				buf.WriteByte('\\')
-				buf.WriteByte('r')
-			case '\t':
-				buf.WriteByte('\\')
-				buf.WriteByte('t')
-			default:
-				// This encodes bytes < 0x20 except for \n, \r, and \t.
-				buf.WriteString(`\u00`)
-				buf.WriteByte(hex[b>>4])
-				buf.WriteByte(hex[b&0xF])
-			}
-			i++
-			start = i
-			continue
-		}
-		c, size := utf8.DecodeRuneInString(s[i:])
-		if c == utf8.RuneError {
-			if start < i {
-				buf.WriteString(s[start:i])
-			}
-			buf.WriteString(`\ufffd`)
-			i += size
-			start = i
-			continue
-		}
-		i += size
-	}
-	if start < len(s) {
-		buf.WriteString(s[start:])
-	}
-	buf.WriteByte('"')
-	n, err := w.Write(buf.Bytes())
-	poolBuffer(buf)
-	return n, err
-}
-
-// NOTE: keep in sync with writeQuoteString above.
-func writeQuotedBytes(w io.Writer, s []byte) (int, error) {
-	buf := getBuffer()
-	buf.WriteByte('"')
-	start := 0
-	for i := 0; i < len(s); {
-		if b := s[i]; b < utf8.RuneSelf {
-			if 0x20 <= b && b != '\\' && b != '"' {
-				i++
-				continue
-			}
-			if start < i {
-				buf.Write(s[start:i])
-			}
-			switch b {
-			case '\\', '"':
-				buf.WriteByte('\\')
-				buf.WriteByte(b)
-			case '\n':
-				buf.WriteByte('\\')
-				buf.WriteByte('n')
-			case '\r':
-				buf.WriteByte('\\')
-				buf.WriteByte('r')
-			case '\t':
-				buf.WriteByte('\\')
-				buf.WriteByte('t')
-			default:
-				// This encodes bytes < 0x20 except for \n, \r, and \t.
-				buf.WriteString(`\u00`)
-				buf.WriteByte(hex[b>>4])
-				buf.WriteByte(hex[b&0xF])
-			}
-			i++
-			start = i
-			continue
-		}
-		c, size := utf8.DecodeRune(s[i:])
-		if c == utf8.RuneError {
-			if start < i {
-				buf.Write(s[start:i])
-			}
-			buf.WriteString(`\ufffd`)
-			i += size
-			start = i
-			continue
-		}
-		i += size
-	}
-	if start < len(s) {
-		buf.Write(s[start:])
-	}
-	buf.WriteByte('"')
-	n, err := w.Write(buf.Bytes())
-	poolBuffer(buf)
-	return n, err
-}
-
-// getu4 decodes \uXXXX from the beginning of s, returning the hex value,
-// or it returns -1.
-func getu4(s []byte) rune {
-	if len(s) < 6 || s[0] != '\\' || s[1] != 'u' {
-		return -1
-	}
-	r, err := strconv.ParseUint(string(s[2:6]), 16, 64)
-	if err != nil {
-		return -1
-	}
-	return rune(r)
-}
-
-func unquoteBytes(s []byte) (t []byte, ok bool) {
-	if len(s) < 2 || s[0] != '"' || s[len(s)-1] != '"' {
-		return
-	}
-	s = s[1 : len(s)-1]
-
-	// Check for unusual characters. If there are none,
-	// then no unquoting is needed, so return a slice of the
-	// original bytes.
-	r := 0
-	for r < len(s) {
-		c := s[r]
-		if c == '\\' || c == '"' || c < ' ' {
-			break
-		}
-		if c < utf8.RuneSelf {
-			r++
-			continue
-		}
-		rr, size := utf8.DecodeRune(s[r:])
-		if rr == utf8.RuneError {
-			break
-		}
-		r += size
-	}
-	if r == len(s) {
-		return s, true
-	}
-
-	b := make([]byte, len(s)+2*utf8.UTFMax)
-	w := copy(b, s[0:r])
-	for r < len(s) {
-		// Out of room?  Can only happen if s is full of
-		// malformed UTF-8 and we're replacing each
-		// byte with RuneError.
-		if w >= len(b)-2*utf8.UTFMax {
-			nb := make([]byte, (len(b)+utf8.UTFMax)*2)
-			copy(nb, b[0:w])
-			b = nb
-		}
-		switch c := s[r]; {
-		case c == '\\':
-			r++
-			if r >= len(s) {
-				return
-			}
-			switch s[r] {
-			default:
-				return
-			case '"', '\\', '/', '\'':
-				b[w] = s[r]
-				r++
-				w++
-			case 'b':
-				b[w] = '\b'
-				r++
-				w++
-			case 'f':
-				b[w] = '\f'
-				r++
-				w++
-			case 'n':
-				b[w] = '\n'
-				r++
-				w++
-			case 'r':
-				b[w] = '\r'
-				r++
-				w++
-			case 't':
-				b[w] = '\t'
-				r++
-				w++
-			case 'u':
-				r--
-				rr := getu4(s[r:])
-				if rr < 0 {
-					return
-				}
-				r += 6
-				if utf16.IsSurrogate(rr) {
-					rr1 := getu4(s[r:])
-					if dec := utf16.DecodeRune(rr, rr1); dec != unicode.ReplacementChar {
-						// A valid pair; consume.
-						r += 6
-						w += utf8.EncodeRune(b[w:], dec)
-						break
-					}
-					// Invalid surrogate; fall back to replacement rune.
-					rr = unicode.ReplacementChar
-				}
-				w += utf8.EncodeRune(b[w:], rr)
-			}
-
-		// Quote, control characters are invalid.
-		case c == '"', c < ' ':
-			return
-
-		// ASCII
-		case c < utf8.RuneSelf:
-			b[w] = c
-			r++
-			w++
-
-		// Coerce to well-formed UTF-8.
-		default:
-			rr, size := utf8.DecodeRune(s[r:])
-			r += size
-			w += utf8.EncodeRune(b[w:], rr)
-		}
-	}
-	return b[0:w], true
-}
diff --git a/vendor/github.com/mdlayher/socket/CHANGELOG.md b/vendor/github.com/mdlayher/socket/CHANGELOG.md
new file mode 100644
index 000000000..f0d01641a
--- /dev/null
+++ b/vendor/github.com/mdlayher/socket/CHANGELOG.md
@@ -0,0 +1,80 @@
+# CHANGELOG
+
+## v0.4.1
+
+- [Bug Fix] [commit](https://github.com/mdlayher/socket/commit/2a14ceef4da279de1f957c5761fffcc6c87bbd3b):
+  ensure `socket.Conn` can be used with non-socket file descriptors by handling
+  `ENOTSOCK` in the constructor.
+
+## v0.4.0
+
+**This is the first release of package socket that only supports Go 1.18+.
+Users on older versions of Go must use v0.3.0.**
+
+- [Improvement]: drop support for older versions of Go so we can begin using
+  modern versions of `x/sys` and other dependencies.
+
+## v0.3.0
+
+**This is the last release of package socket that supports Go 1.17 and below.**
+
+- [New API/API change] [PR](https://github.com/mdlayher/socket/pull/8):
+  numerous `socket.Conn` methods now support context cancelation. Future
+  releases will continue adding support as needed.
+  - New `ReadContext` and `WriteContext` methods.
+  - `Connect`, `Recvfrom`, `Recvmsg`, `Sendmsg`, and `Sendto` methods now accept
+    a context.
+  - `Sendto` parameter order was also fixed to match the underlying syscall.
+
+## v0.2.3
+
+- [New API] [commit](https://github.com/mdlayher/socket/commit/a425d96e0f772c053164f8ce4c9c825380a98086):
+  `socket.Conn` has new `Pidfd*` methods for wrapping the `pidfd_*(2)` family of
+  system calls.
+
+## v0.2.2
+
+- [New API] [commit](https://github.com/mdlayher/socket/commit/a2429f1dfe8ec2586df5a09f50ead865276cd027):
+  `socket.Conn` has new `IoctlKCM*` methods for wrapping `ioctl(2)` for `AF_KCM`
+  operations.
+
+## v0.2.1
+
+- [New API] [commit](https://github.com/mdlayher/socket/commit/b18ddbe9caa0e34552b4409a3aa311cb460d2f99):
+  `socket.Conn` has a new `SetsockoptPacketMreq` method for wrapping
+  `setsockopt(2)` for `AF_PACKET` socket options.
+
+## v0.2.0
+
+- [New API] [commit](https://github.com/mdlayher/socket/commit/6e912a68523c45e5fd899239f4b46c402dd856da):
+  `socket.FileConn` can be used to create a `socket.Conn` from an existing
+  `os.File`, which may be provided by systemd socket activation or another
+  external mechanism.
+- [API change] [commit](https://github.com/mdlayher/socket/commit/66d61f565188c23fe02b24099ddc856d538bf1a7):
+  `socket.Conn.Connect` now returns the `unix.Sockaddr` value provided by
+  `getpeername(2)`, since we have to invoke that system call anyway to verify
+  that a connection to a remote peer was successfully established.
+- [Bug Fix] [commit](https://github.com/mdlayher/socket/commit/b60b2dbe0ac3caff2338446a150083bde8c5c19c):
+  check the correct error from `unix.GetsockoptInt` in the `socket.Conn.Connect`
+  method. Thanks @vcabbage!
+
+## v0.1.2
+
+- [Bug Fix]: `socket.Conn.Connect` now properly checks the `SO_ERROR` socket
+  option value after calling `connect(2)` to verify whether or not a connection
+  could successfully be established. This means that `Connect` should now report
+  an error for an `AF_INET` TCP connection refused or `AF_VSOCK` connection
+  reset by peer.
+- [New API]: add `socket.Conn.Getpeername` for use in `Connect`, but also for
+  use by external callers.
+
+## v0.1.1
+
+- [New API]: `socket.Conn` now has `CloseRead`, `CloseWrite`, and `Shutdown`
+  methods.
+- [Improvement]: internal rework to more robustly handle various errors.
+
+## v0.1.0
+
+- Initial unstable release. Most functionality has been developed and ported
+from package [`netlink`](https://github.com/mdlayher/netlink).
diff --git a/vendor/github.com/mdlayher/socket/LICENSE.md b/vendor/github.com/mdlayher/socket/LICENSE.md
new file mode 100644
index 000000000..3ccdb75b2
--- /dev/null
+++ b/vendor/github.com/mdlayher/socket/LICENSE.md
@@ -0,0 +1,9 @@
+# MIT License
+
+Copyright (C) 2021 Matt Layher
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/vendor/github.com/mdlayher/socket/README.md b/vendor/github.com/mdlayher/socket/README.md
new file mode 100644
index 000000000..2aa065cbb
--- /dev/null
+++ b/vendor/github.com/mdlayher/socket/README.md
@@ -0,0 +1,23 @@
+# socket [![Test Status](https://github.com/mdlayher/socket/workflows/Test/badge.svg)](https://github.com/mdlayher/socket/actions) [![Go Reference](https://pkg.go.dev/badge/github.com/mdlayher/socket.svg)](https://pkg.go.dev/github.com/mdlayher/socket) [![Go Report Card](https://goreportcard.com/badge/github.com/mdlayher/socket)](https://goreportcard.com/report/github.com/mdlayher/socket)
+
+Package `socket` provides a low-level network connection type which integrates
+with Go's runtime network poller to provide asynchronous I/O and deadline
+support. MIT Licensed.
+
+This package focuses on UNIX-like operating systems which make use of BSD
+sockets system call APIs. It is meant to be used as a foundation for the
+creation of operating system-specific socket packages, for socket families such
+as Linux's `AF_NETLINK`, `AF_PACKET`, or `AF_VSOCK`. This package should not be
+used directly in end user applications.
+
+Any use of package socket should be guarded by build tags, as one would also
+use when importing the `syscall` or `golang.org/x/sys` packages.
+
+## Stability
+
+See the [CHANGELOG](./CHANGELOG.md) file for a description of changes between
+releases.
+
+This package only supports the two most recent major versions of Go, mirroring
+Go's own release policy. Older versions of Go may lack critical features and bug
+fixes which are necessary for this package to function correctly.
diff --git a/vendor/github.com/mdlayher/socket/accept.go b/vendor/github.com/mdlayher/socket/accept.go
new file mode 100644
index 000000000..47e9d897e
--- /dev/null
+++ b/vendor/github.com/mdlayher/socket/accept.go
@@ -0,0 +1,23 @@
+//go:build !dragonfly && !freebsd && !illumos && !linux
+// +build !dragonfly,!freebsd,!illumos,!linux
+
+package socket
+
+import (
+	"fmt"
+	"runtime"
+
+	"golang.org/x/sys/unix"
+)
+
+const sysAccept = "accept"
+
+// accept wraps accept(2).
+func accept(fd, flags int) (int, unix.Sockaddr, error) {
+	if flags != 0 {
+		// These operating systems have no support for flags to accept(2).
+		return 0, nil, fmt.Errorf("socket: Conn.Accept flags are ineffective on %s", runtime.GOOS)
+	}
+
+	return unix.Accept(fd)
+}
diff --git a/vendor/github.com/mdlayher/socket/accept4.go b/vendor/github.com/mdlayher/socket/accept4.go
new file mode 100644
index 000000000..e1016b206
--- /dev/null
+++ b/vendor/github.com/mdlayher/socket/accept4.go
@@ -0,0 +1,15 @@
+//go:build dragonfly || freebsd || illumos || linux
+// +build dragonfly freebsd illumos linux
+
+package socket
+
+import (
+	"golang.org/x/sys/unix"
+)
+
+const sysAccept = "accept4"
+
+// accept wraps accept4(2).
+func accept(fd, flags int) (int, unix.Sockaddr, error) {
+	return unix.Accept4(fd, flags)
+}
diff --git a/vendor/github.com/mdlayher/socket/conn.go b/vendor/github.com/mdlayher/socket/conn.go
new file mode 100644
index 000000000..7b3cc7a6e
--- /dev/null
+++ b/vendor/github.com/mdlayher/socket/conn.go
@@ -0,0 +1,880 @@
+package socket
+
+import (
+	"context"
+	"errors"
+	"io"
+	"os"
+	"sync"
+	"sync/atomic"
+	"syscall"
+	"time"
+
+	"golang.org/x/sys/unix"
+)
+
+// Lock in an expected public interface for convenience.
+var _ interface {
+	io.ReadWriteCloser
+	syscall.Conn
+	SetDeadline(t time.Time) error
+	SetReadDeadline(t time.Time) error
+	SetWriteDeadline(t time.Time) error
+} = &Conn{}
+
+// A Conn is a low-level network connection which integrates with Go's runtime
+// network poller to provide asynchronous I/O and deadline support.
+//
+// Many of a Conn's blocking methods support net.Conn deadlines as well as
+// cancelation via context. Note that passing a context with a deadline set will
+// override any of the previous deadlines set by calls to the SetDeadline family
+// of methods.
+type Conn struct {
+	// Indicates whether or not Conn.Close has been called. Must be accessed
+	// atomically. Atomics definitions must come first in the Conn struct.
+	closed uint32
+
+	// A unique name for the Conn which is also associated with derived file
+	// descriptors such as those created by accept(2).
+	name string
+
+	// facts contains information we have determined about Conn to trigger
+	// alternate behavior in certain functions.
+	facts facts
+
+	// Provides access to the underlying file registered with the runtime
+	// network poller, and arbitrary raw I/O calls.
+	fd *os.File
+	rc syscall.RawConn
+}
+
+// facts contains facts about a Conn.
+type facts struct {
+	// isStream reports whether this is a streaming descriptor, as opposed to a
+	// packet-based descriptor like a UDP socket.
+	isStream bool
+
+	// zeroReadIsEOF reports Whether a zero byte read indicates EOF. This is
+	// false for a message based socket connection.
+	zeroReadIsEOF bool
+}
+
+// A Config contains options for a Conn.
+type Config struct {
+	// NetNS specifies the Linux network namespace the Conn will operate in.
+	// This option is unsupported on other operating systems.
+	//
+	// If set (non-zero), Conn will enter the specified network namespace and an
+	// error will occur in Socket if the operation fails.
+	//
+	// If not set (zero), a best-effort attempt will be made to enter the
+	// network namespace of the calling thread: this means that any changes made
+	// to the calling thread's network namespace will also be reflected in Conn.
+	// If this operation fails (due to lack of permissions or because network
+	// namespaces are disabled by kernel configuration), Socket will not return
+	// an error, and the Conn will operate in the default network namespace of
+	// the process. This enables non-privileged use of Conn in applications
+	// which do not require elevated privileges.
+	//
+	// Entering a network namespace is a privileged operation (root or
+	// CAP_SYS_ADMIN are required), and most applications should leave this set
+	// to 0.
+	NetNS int
+}
+
+// High-level methods which provide convenience over raw system calls.
+
+// Close closes the underlying file descriptor for the Conn, which also causes
+// all in-flight I/O operations to immediately unblock and return errors. Any
+// subsequent uses of Conn will result in EBADF.
+func (c *Conn) Close() error {
+	// The caller has expressed an intent to close the socket, so immediately
+	// increment s.closed to force further calls to result in EBADF before also
+	// closing the file descriptor to unblock any outstanding operations.
+	//
+	// Because other operations simply check for s.closed != 0, we will permit
+	// double Close, which would increment s.closed beyond 1.
+	if atomic.AddUint32(&c.closed, 1) != 1 {
+		// Multiple Close calls.
+		return nil
+	}
+
+	return os.NewSyscallError("close", c.fd.Close())
+}
+
+// CloseRead shuts down the reading side of the Conn. Most callers should just
+// use Close.
+func (c *Conn) CloseRead() error { return c.Shutdown(unix.SHUT_RD) }
+
+// CloseWrite shuts down the writing side of the Conn. Most callers should just
+// use Close.
+func (c *Conn) CloseWrite() error { return c.Shutdown(unix.SHUT_WR) }
+
+// Read reads directly from the underlying file descriptor.
+func (c *Conn) Read(b []byte) (int, error) { return c.fd.Read(b) }
+
+// ReadContext reads from the underlying file descriptor with added support for
+// context cancelation.
+func (c *Conn) ReadContext(ctx context.Context, b []byte) (int, error) {
+	if c.facts.isStream && len(b) > maxRW {
+		b = b[:maxRW]
+	}
+
+	n, err := readT(c, ctx, "read", func(fd int) (int, error) {
+		return unix.Read(fd, b)
+	})
+	if n == 0 && err == nil && c.facts.zeroReadIsEOF {
+		return 0, io.EOF
+	}
+
+	return n, os.NewSyscallError("read", err)
+}
+
+// Write writes directly to the underlying file descriptor.
+func (c *Conn) Write(b []byte) (int, error) { return c.fd.Write(b) }
+
+// WriteContext writes to the underlying file descriptor with added support for
+// context cancelation.
+func (c *Conn) WriteContext(ctx context.Context, b []byte) (int, error) {
+	var (
+		n, nn int
+		err   error
+	)
+
+	doErr := c.write(ctx, "write", func(fd int) error {
+		max := len(b)
+		if c.facts.isStream && max-nn > maxRW {
+			max = nn + maxRW
+		}
+
+		n, err = unix.Write(fd, b[nn:max])
+		if n > 0 {
+			nn += n
+		}
+		if nn == len(b) {
+			return err
+		}
+		if n == 0 && err == nil {
+			err = io.ErrUnexpectedEOF
+			return nil
+		}
+
+		return err
+	})
+	if doErr != nil {
+		return 0, doErr
+	}
+
+	return nn, os.NewSyscallError("write", err)
+}
+
+// SetDeadline sets both the read and write deadlines associated with the Conn.
+func (c *Conn) SetDeadline(t time.Time) error { return c.fd.SetDeadline(t) }
+
+// SetReadDeadline sets the read deadline associated with the Conn.
+func (c *Conn) SetReadDeadline(t time.Time) error { return c.fd.SetReadDeadline(t) }
+
+// SetWriteDeadline sets the write deadline associated with the Conn.
+func (c *Conn) SetWriteDeadline(t time.Time) error { return c.fd.SetWriteDeadline(t) }
+
+// ReadBuffer gets the size of the operating system's receive buffer associated
+// with the Conn.
+func (c *Conn) ReadBuffer() (int, error) {
+	return c.GetsockoptInt(unix.SOL_SOCKET, unix.SO_RCVBUF)
+}
+
+// WriteBuffer gets the size of the operating system's transmit buffer
+// associated with the Conn.
+func (c *Conn) WriteBuffer() (int, error) {
+	return c.GetsockoptInt(unix.SOL_SOCKET, unix.SO_SNDBUF)
+}
+
+// SetReadBuffer sets the size of the operating system's receive buffer
+// associated with the Conn.
+//
+// When called with elevated privileges on Linux, the SO_RCVBUFFORCE option will
+// be used to override operating system limits. Otherwise SO_RCVBUF is used
+// (which obeys operating system limits).
+func (c *Conn) SetReadBuffer(bytes int) error { return c.setReadBuffer(bytes) }
+
+// SetWriteBuffer sets the size of the operating system's transmit buffer
+// associated with the Conn.
+//
+// When called with elevated privileges on Linux, the SO_SNDBUFFORCE option will
+// be used to override operating system limits. Otherwise SO_SNDBUF is used
+// (which obeys operating system limits).
+func (c *Conn) SetWriteBuffer(bytes int) error { return c.setWriteBuffer(bytes) }
+
+// SyscallConn returns a raw network connection. This implements the
+// syscall.Conn interface.
+//
+// SyscallConn is intended for advanced use cases, such as getting and setting
+// arbitrary socket options using the socket's file descriptor. If possible,
+// those operations should be performed using methods on Conn instead.
+//
+// Once invoked, it is the caller's responsibility to ensure that operations
+// performed using Conn and the syscall.RawConn do not conflict with each other.
+func (c *Conn) SyscallConn() (syscall.RawConn, error) {
+	if atomic.LoadUint32(&c.closed) != 0 {
+		return nil, os.NewSyscallError("syscallconn", unix.EBADF)
+	}
+
+	// TODO(mdlayher): mutex or similar to enforce syscall.RawConn contract of
+	// FD remaining valid for duration of calls?
+	return c.rc, nil
+}
+
+// Socket wraps the socket(2) system call to produce a Conn. domain, typ, and
+// proto are passed directly to socket(2), and name should be a unique name for
+// the socket type such as "netlink" or "vsock".
+//
+// The cfg parameter specifies optional configuration for the Conn. If nil, no
+// additional configuration will be applied.
+//
+// If the operating system supports SOCK_CLOEXEC and SOCK_NONBLOCK, they are
+// automatically applied to typ to mirror the standard library's socket flag
+// behaviors.
+func Socket(domain, typ, proto int, name string, cfg *Config) (*Conn, error) {
+	if cfg == nil {
+		cfg = &Config{}
+	}
+
+	if cfg.NetNS == 0 {
+		// Non-Linux or no network namespace.
+		return socket(domain, typ, proto, name)
+	}
+
+	// Linux only: create Conn in the specified network namespace.
+	return withNetNS(cfg.NetNS, func() (*Conn, error) {
+		return socket(domain, typ, proto, name)
+	})
+}
+
+// socket is the internal, cross-platform entry point for socket(2).
+func socket(domain, typ, proto int, name string) (*Conn, error) {
+	var (
+		fd  int
+		err error
+	)
+
+	for {
+		fd, err = unix.Socket(domain, typ|socketFlags, proto)
+		switch {
+		case err == nil:
+			// Some OSes already set CLOEXEC with typ.
+			if !flagCLOEXEC {
+				unix.CloseOnExec(fd)
+			}
+
+			// No error, prepare the Conn.
+			return New(fd, name)
+		case !ready(err):
+			// System call interrupted or not ready, try again.
+			continue
+		case err == unix.EINVAL, err == unix.EPROTONOSUPPORT:
+			// On Linux, SOCK_NONBLOCK and SOCK_CLOEXEC were introduced in
+			// 2.6.27. On FreeBSD, both flags were introduced in FreeBSD 10.
+			// EINVAL and EPROTONOSUPPORT check for earlier versions of these
+			// OSes respectively.
+			//
+			// Mirror what the standard library does when creating file
+			// descriptors: avoid racing a fork/exec with the creation of new
+			// file descriptors, so that child processes do not inherit socket
+			// file descriptors unexpectedly.
+			//
+			// For a more thorough explanation, see similar work in the Go tree:
+			// func sysSocket in net/sock_cloexec.go, as well as the detailed
+			// comment in syscall/exec_unix.go.
+			syscall.ForkLock.RLock()
+			fd, err = unix.Socket(domain, typ, proto)
+			if err != nil {
+				syscall.ForkLock.RUnlock()
+				return nil, os.NewSyscallError("socket", err)
+			}
+			unix.CloseOnExec(fd)
+			syscall.ForkLock.RUnlock()
+
+			return New(fd, name)
+		default:
+			// Unhandled error.
+			return nil, os.NewSyscallError("socket", err)
+		}
+	}
+}
+
+// FileConn returns a copy of the network connection corresponding to the open
+// file. It is the caller's responsibility to close the file when finished.
+// Closing the Conn does not affect the File, and closing the File does not
+// affect the Conn.
+func FileConn(f *os.File, name string) (*Conn, error) {
+	// First we'll try to do fctnl(2) with F_DUPFD_CLOEXEC because we can dup
+	// the file descriptor and set the flag in one syscall.
+	fd, err := unix.FcntlInt(f.Fd(), unix.F_DUPFD_CLOEXEC, 0)
+	switch err {
+	case nil:
+		// OK, ready to set up non-blocking I/O.
+		return New(fd, name)
+	case unix.EINVAL:
+		// The kernel rejected our fcntl(2), fall back to separate dup(2) and
+		// setting close on exec.
+		//
+		// Mirror what the standard library does when creating file descriptors:
+		// avoid racing a fork/exec with the creation of new file descriptors,
+		// so that child processes do not inherit socket file descriptors
+		// unexpectedly.
+		syscall.ForkLock.RLock()
+		fd, err := unix.Dup(fd)
+		if err != nil {
+			syscall.ForkLock.RUnlock()
+			return nil, os.NewSyscallError("dup", err)
+		}
+		unix.CloseOnExec(fd)
+		syscall.ForkLock.RUnlock()
+
+		return New(fd, name)
+	default:
+		// Any other errors.
+		return nil, os.NewSyscallError("fcntl", err)
+	}
+}
+
+// New wraps an existing file descriptor to create a Conn. name should be a
+// unique name for the socket type such as "netlink" or "vsock".
+//
+// Most callers should use Socket or FileConn to construct a Conn. New is
+// intended for integrating with specific system calls which provide a file
+// descriptor that supports asynchronous I/O. The file descriptor is immediately
+// set to nonblocking mode and registered with Go's runtime network poller for
+// future I/O operations.
+//
+// Unlike FileConn, New does not duplicate the existing file descriptor in any
+// way. The returned Conn takes ownership of the underlying file descriptor.
+func New(fd int, name string) (*Conn, error) {
+	// All Conn I/O is nonblocking for integration with Go's runtime network
+	// poller. Depending on the OS this might already be set but it can't hurt
+	// to set it again.
+	if err := unix.SetNonblock(fd, true); err != nil {
+		return nil, os.NewSyscallError("setnonblock", err)
+	}
+
+	// os.NewFile registers the non-blocking file descriptor with the runtime
+	// poller, which is then used for most subsequent operations except those
+	// that require raw I/O via SyscallConn.
+	//
+	// See also: https://golang.org/pkg/os/#NewFile
+	f := os.NewFile(uintptr(fd), name)
+	rc, err := f.SyscallConn()
+	if err != nil {
+		return nil, err
+	}
+
+	c := &Conn{
+		name: name,
+		fd:   f,
+		rc:   rc,
+	}
+
+	// Probe the file descriptor for socket settings.
+	sotype, err := c.GetsockoptInt(unix.SOL_SOCKET, unix.SO_TYPE)
+	switch {
+	case err == nil:
+		// File is a socket, check its properties.
+		c.facts = facts{
+			isStream:      sotype == unix.SOCK_STREAM,
+			zeroReadIsEOF: sotype != unix.SOCK_DGRAM && sotype != unix.SOCK_RAW,
+		}
+	case errors.Is(err, unix.ENOTSOCK):
+		// File is not a socket, treat it as a regular file.
+		c.facts = facts{
+			isStream:      true,
+			zeroReadIsEOF: true,
+		}
+	default:
+		return nil, err
+	}
+
+	return c, nil
+}
+
+// Low-level methods which provide raw system call access.
+
+// Accept wraps accept(2) or accept4(2) depending on the operating system, but
+// returns a Conn for the accepted connection rather than a raw file descriptor.
+//
+// If the operating system supports accept4(2) (which allows flags),
+// SOCK_CLOEXEC and SOCK_NONBLOCK are automatically applied to flags to mirror
+// the standard library's socket flag behaviors.
+//
+// If the operating system only supports accept(2) (which does not allow flags)
+// and flags is not zero, an error will be returned.
+//
+// Accept obeys context cancelation and uses the deadline set on the context to
+// cancel accepting the next connection. If a deadline is set on ctx, this
+// deadline will override any previous deadlines set using SetDeadline or
+// SetReadDeadline. Upon return, the read deadline is cleared.
+func (c *Conn) Accept(ctx context.Context, flags int) (*Conn, unix.Sockaddr, error) {
+	type ret struct {
+		nfd int
+		sa  unix.Sockaddr
+	}
+
+	r, err := readT(c, ctx, sysAccept, func(fd int) (ret, error) {
+		// Either accept(2) or accept4(2) depending on the OS.
+		nfd, sa, err := accept(fd, flags|socketFlags)
+		return ret{nfd, sa}, err
+	})
+	if err != nil {
+		// internal/poll, context error, or user function error.
+		return nil, nil, err
+	}
+
+	// Successfully accepted a connection, wrap it in a Conn for use by the
+	// caller.
+	ac, err := New(r.nfd, c.name)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return ac, r.sa, nil
+}
+
+// Bind wraps bind(2).
+func (c *Conn) Bind(sa unix.Sockaddr) error {
+	return c.control(context.Background(), "bind", func(fd int) error {
+		return unix.Bind(fd, sa)
+	})
+}
+
+// Connect wraps connect(2). In order to verify that the underlying socket is
+// connected to a remote peer, Connect calls getpeername(2) and returns the
+// unix.Sockaddr from that call.
+//
+// Connect obeys context cancelation and uses the deadline set on the context to
+// cancel connecting to a remote peer. If a deadline is set on ctx, this
+// deadline will override any previous deadlines set using SetDeadline or
+// SetWriteDeadline. Upon return, the write deadline is cleared.
+func (c *Conn) Connect(ctx context.Context, sa unix.Sockaddr) (unix.Sockaddr, error) {
+	const op = "connect"
+
+	// TODO(mdlayher): it would seem that trying to connect to unbound vsock
+	// listeners by calling Connect multiple times results in ECONNRESET for the
+	// first and nil error for subsequent calls. Do we need to memoize the
+	// error? Check what the stdlib behavior is.
+
+	var (
+		// Track progress between invocations of the write closure. We don't
+		// have an explicit WaitWrite call like internal/poll does, so we have
+		// to wait until the runtime calls the closure again to indicate we can
+		// write.
+		progress uint32
+
+		// Capture closure sockaddr and error.
+		rsa unix.Sockaddr
+		err error
+	)
+
+	doErr := c.write(ctx, op, func(fd int) error {
+		if atomic.AddUint32(&progress, 1) == 1 {
+			// First call: initiate connect.
+			return unix.Connect(fd, sa)
+		}
+
+		// Subsequent calls: the runtime network poller indicates fd is
+		// writable. Check for errno.
+		errno, gerr := c.GetsockoptInt(unix.SOL_SOCKET, unix.SO_ERROR)
+		if gerr != nil {
+			return gerr
+		}
+		if errno != 0 {
+			// Connection is still not ready or failed. If errno indicates
+			// the socket is not ready, we will wait for the next write
+			// event. Otherwise we propagate this errno back to the as a
+			// permanent error.
+			uerr := unix.Errno(errno)
+			err = uerr
+			return uerr
+		}
+
+		// According to internal/poll, it's possible for the runtime network
+		// poller to spuriously wake us and return errno 0 for SO_ERROR.
+		// Make sure we are actually connected to a peer.
+		peer, err := c.Getpeername()
+		if err != nil {
+			// internal/poll unconditionally goes back to WaitWrite.
+			// Synthesize an error that will do the same for us.
+			return unix.EAGAIN
+		}
+
+		// Connection complete.
+		rsa = peer
+		return nil
+	})
+	if doErr != nil {
+		// internal/poll or context error.
+		return nil, doErr
+	}
+
+	if err == unix.EISCONN {
+		// TODO(mdlayher): is this block obsolete with the addition of the
+		// getsockopt SO_ERROR check above?
+		//
+		// EISCONN is reported if the socket is already established and should
+		// not be treated as an error.
+		//  - Darwin reports this for at least TCP sockets
+		//  - Linux reports this for at least AF_VSOCK sockets
+		return rsa, nil
+	}
+
+	return rsa, os.NewSyscallError(op, err)
+}
+
+// Getsockname wraps getsockname(2).
+func (c *Conn) Getsockname() (unix.Sockaddr, error) {
+	return controlT(c, context.Background(), "getsockname", unix.Getsockname)
+}
+
+// Getpeername wraps getpeername(2).
+func (c *Conn) Getpeername() (unix.Sockaddr, error) {
+	return controlT(c, context.Background(), "getpeername", unix.Getpeername)
+}
+
+// GetsockoptInt wraps getsockopt(2) for integer values.
+func (c *Conn) GetsockoptInt(level, opt int) (int, error) {
+	return controlT(c, context.Background(), "getsockopt", func(fd int) (int, error) {
+		return unix.GetsockoptInt(fd, level, opt)
+	})
+}
+
+// Listen wraps listen(2).
+func (c *Conn) Listen(n int) error {
+	return c.control(context.Background(), "listen", func(fd int) error {
+		return unix.Listen(fd, n)
+	})
+}
+
+// Recvmsg wraps recvmsg(2).
+func (c *Conn) Recvmsg(ctx context.Context, p, oob []byte, flags int) (int, int, int, unix.Sockaddr, error) {
+	type ret struct {
+		n, oobn, recvflags int
+		from               unix.Sockaddr
+	}
+
+	r, err := readT(c, ctx, "recvmsg", func(fd int) (ret, error) {
+		n, oobn, recvflags, from, err := unix.Recvmsg(fd, p, oob, flags)
+		return ret{n, oobn, recvflags, from}, err
+	})
+	if r.n == 0 && err == nil && c.facts.zeroReadIsEOF {
+		return 0, 0, 0, nil, io.EOF
+	}
+
+	return r.n, r.oobn, r.recvflags, r.from, err
+}
+
+// Recvfrom wraps recvfrom(2).
+func (c *Conn) Recvfrom(ctx context.Context, p []byte, flags int) (int, unix.Sockaddr, error) {
+	type ret struct {
+		n    int
+		addr unix.Sockaddr
+	}
+
+	out, err := readT(c, ctx, "recvfrom", func(fd int) (ret, error) {
+		n, addr, err := unix.Recvfrom(fd, p, flags)
+		return ret{n, addr}, err
+	})
+	if out.n == 0 && err == nil && c.facts.zeroReadIsEOF {
+		return 0, nil, io.EOF
+	}
+
+	return out.n, out.addr, err
+}
+
+// Sendmsg wraps sendmsg(2).
+func (c *Conn) Sendmsg(ctx context.Context, p, oob []byte, to unix.Sockaddr, flags int) (int, error) {
+	return writeT(c, ctx, "sendmsg", func(fd int) (int, error) {
+		return unix.SendmsgN(fd, p, oob, to, flags)
+	})
+}
+
+// Sendto wraps sendto(2).
+func (c *Conn) Sendto(ctx context.Context, p []byte, flags int, to unix.Sockaddr) error {
+	return c.write(ctx, "sendto", func(fd int) error {
+		return unix.Sendto(fd, p, flags, to)
+	})
+}
+
+// SetsockoptInt wraps setsockopt(2) for integer values.
+func (c *Conn) SetsockoptInt(level, opt, value int) error {
+	return c.control(context.Background(), "setsockopt", func(fd int) error {
+		return unix.SetsockoptInt(fd, level, opt, value)
+	})
+}
+
+// Shutdown wraps shutdown(2).
+func (c *Conn) Shutdown(how int) error {
+	return c.control(context.Background(), "shutdown", func(fd int) error {
+		return unix.Shutdown(fd, how)
+	})
+}
+
+// Conn low-level read/write/control functions. These functions mirror the
+// syscall.RawConn APIs but the input closures return errors rather than
+// booleans.
+
+// read wraps readT to execute a function and capture its error result. This is
+// a convenience wrapper for functions which don't return any extra values.
+func (c *Conn) read(ctx context.Context, op string, f func(fd int) error) error {
+	_, err := readT(c, ctx, op, func(fd int) (struct{}, error) {
+		return struct{}{}, f(fd)
+	})
+	return err
+}
+
+// write executes f, a write function, against the associated file descriptor.
+// op is used to create an *os.SyscallError if the file descriptor is closed.
+func (c *Conn) write(ctx context.Context, op string, f func(fd int) error) error {
+	_, err := writeT(c, ctx, op, func(fd int) (struct{}, error) {
+		return struct{}{}, f(fd)
+	})
+	return err
+}
+
+// readT executes c.rc.Read for op using the input function, returning a newly
+// allocated result T.
+func readT[T any](c *Conn, ctx context.Context, op string, f func(fd int) (T, error)) (T, error) {
+	return rwT(c, rwContext[T]{
+		Context: ctx,
+		Type:    read,
+		Op:      op,
+		Do:      f,
+	})
+}
+
+// writeT executes c.rc.Write for op using the input function, returning a newly
+// allocated result T.
+func writeT[T any](c *Conn, ctx context.Context, op string, f func(fd int) (T, error)) (T, error) {
+	return rwT(c, rwContext[T]{
+		Context: ctx,
+		Type:    write,
+		Op:      op,
+		Do:      f,
+	})
+}
+
+// readWrite indicates if an operation intends to read or write.
+type readWrite bool
+
+// Possible readWrite values.
+const (
+	read  readWrite = false
+	write readWrite = true
+)
+
+// An rwContext provides arguments to rwT.
+type rwContext[T any] struct {
+	// The caller's context passed for cancelation.
+	Context context.Context
+
+	// The type of an operation: read or write.
+	Type readWrite
+
+	// The name of the operation used in errors.
+	Op string
+
+	// The actual function to perform.
+	Do func(fd int) (T, error)
+}
+
+// rwT executes c.rc.Read or c.rc.Write (depending on the value of rw.Type) for
+// rw.Op using the input function, returning a newly allocated result T.
+//
+// It obeys context cancelation and the rw.Context must not be nil.
+func rwT[T any](c *Conn, rw rwContext[T]) (T, error) {
+	if atomic.LoadUint32(&c.closed) != 0 {
+		// If the file descriptor is already closed, do nothing.
+		return *new(T), os.NewSyscallError(rw.Op, unix.EBADF)
+	}
+
+	if err := rw.Context.Err(); err != nil {
+		// Early exit due to context cancel.
+		return *new(T), os.NewSyscallError(rw.Op, err)
+	}
+
+	var (
+		// The read or write function used to access the runtime network poller.
+		poll func(func(uintptr) bool) error
+
+		// The read or write function used to set the matching deadline.
+		deadline func(time.Time) error
+	)
+
+	if rw.Type == write {
+		poll = c.rc.Write
+		deadline = c.SetWriteDeadline
+	} else {
+		poll = c.rc.Read
+		deadline = c.SetReadDeadline
+	}
+
+	var (
+		// Whether or not the context carried a deadline we are actively using
+		// for cancelation.
+		setDeadline bool
+
+		// Signals for the cancelation watcher goroutine.
+		wg    sync.WaitGroup
+		doneC = make(chan struct{})
+
+		// Atomic: reports whether we have to disarm the deadline.
+		//
+		// TODO(mdlayher): switch back to atomic.Bool when we drop support for
+		// Go 1.18.
+		needDisarm int64
+	)
+
+	// On cancel, clean up the watcher.
+	defer func() {
+		close(doneC)
+		wg.Wait()
+	}()
+
+	if d, ok := rw.Context.Deadline(); ok {
+		// The context has an explicit deadline. We will use it for cancelation
+		// but disarm it after poll for the next call.
+		if err := deadline(d); err != nil {
+			return *new(T), err
+		}
+		setDeadline = true
+		atomic.AddInt64(&needDisarm, 1)
+	} else {
+		// The context does not have an explicit deadline. We have to watch for
+		// cancelation so we can propagate that signal to immediately unblock
+		// the runtime network poller.
+		//
+		// TODO(mdlayher): is it possible to detect a background context vs a
+		// context with possible future cancel?
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+
+			select {
+			case <-rw.Context.Done():
+				// Cancel the operation. Make the caller disarm after poll
+				// returns.
+				atomic.AddInt64(&needDisarm, 1)
+				_ = deadline(time.Unix(0, 1))
+			case <-doneC:
+				// Nothing to do.
+			}
+		}()
+	}
+
+	var (
+		t   T
+		err error
+	)
+
+	pollErr := poll(func(fd uintptr) bool {
+		t, err = rw.Do(int(fd))
+		return ready(err)
+	})
+
+	if atomic.LoadInt64(&needDisarm) > 0 {
+		_ = deadline(time.Time{})
+	}
+
+	if pollErr != nil {
+		if rw.Context.Err() != nil || (setDeadline && errors.Is(pollErr, os.ErrDeadlineExceeded)) {
+			// The caller canceled the operation or we set a deadline internally
+			// and it was reached.
+			//
+			// Unpack a plain context error. We wait for the context to be done
+			// to synchronize state externally. Otherwise we have noticed I/O
+			// timeout wakeups when we set a deadline but the context was not
+			// yet marked done.
+			<-rw.Context.Done()
+			return *new(T), os.NewSyscallError(rw.Op, rw.Context.Err())
+		}
+
+		// Error from syscall.RawConn methods. Conventionally the standard
+		// library does not wrap internal/poll errors in os.NewSyscallError.
+		return *new(T), pollErr
+	}
+
+	// Result from user function.
+	return t, os.NewSyscallError(rw.Op, err)
+}
+
+// control executes Conn.control for op using the input function.
+func (c *Conn) control(ctx context.Context, op string, f func(fd int) error) error {
+	_, err := controlT(c, ctx, op, func(fd int) (struct{}, error) {
+		return struct{}{}, f(fd)
+	})
+	return err
+}
+
+// controlT executes c.rc.Control for op using the input function, returning a
+// newly allocated result T.
+func controlT[T any](c *Conn, ctx context.Context, op string, f func(fd int) (T, error)) (T, error) {
+	if atomic.LoadUint32(&c.closed) != 0 {
+		// If the file descriptor is already closed, do nothing.
+		return *new(T), os.NewSyscallError(op, unix.EBADF)
+	}
+
+	var (
+		t   T
+		err error
+	)
+
+	doErr := c.rc.Control(func(fd uintptr) {
+		// Repeatedly attempt the syscall(s) invoked by f until completion is
+		// indicated by the return value of ready or the context is canceled.
+		//
+		// The last values for t and err are captured outside of the closure for
+		// use when the loop breaks.
+		for {
+			if err = ctx.Err(); err != nil {
+				// Early exit due to context cancel.
+				return
+			}
+
+			t, err = f(int(fd))
+			if ready(err) {
+				return
+			}
+		}
+	})
+	if doErr != nil {
+		// Error from syscall.RawConn methods. Conventionally the standard
+		// library does not wrap internal/poll errors in os.NewSyscallError.
+		return *new(T), doErr
+	}
+
+	// Result from user function.
+	return t, os.NewSyscallError(op, err)
+}
+
+// ready indicates readiness based on the value of err.
+func ready(err error) bool {
+	switch err {
+	case unix.EAGAIN, unix.EINPROGRESS, unix.EINTR:
+		// When a socket is in non-blocking mode, we might see a variety of errors:
+		//  - EAGAIN: most common case for a socket read not being ready
+		//  - EINPROGRESS: reported by some sockets when first calling connect
+		//  - EINTR: system call interrupted, more frequently occurs in Go 1.14+
+		//    because goroutines can be asynchronously preempted
+		//
+		// Return false to let the poller wait for readiness. See the source code
+		// for internal/poll.FD.RawRead for more details.
+		return false
+	default:
+		// Ready regardless of whether there was an error or no error.
+		return true
+	}
+}
+
+// Darwin and FreeBSD can't read or write 2GB+ files at a time,
+// even on 64-bit systems.
+// The same is true of socket implementations on many systems.
+// See golang.org/issue/7812 and golang.org/issue/16266.
+// Use 1GB instead of, say, 2GB-1, to keep subsequent reads aligned.
+const maxRW = 1 << 30
diff --git a/vendor/github.com/mdlayher/socket/conn_linux.go b/vendor/github.com/mdlayher/socket/conn_linux.go
new file mode 100644
index 000000000..37579d4a0
--- /dev/null
+++ b/vendor/github.com/mdlayher/socket/conn_linux.go
@@ -0,0 +1,118 @@
+//go:build linux
+// +build linux
+
+package socket
+
+import (
+	"context"
+	"os"
+	"unsafe"
+
+	"golang.org/x/net/bpf"
+	"golang.org/x/sys/unix"
+)
+
+// IoctlKCMClone wraps ioctl(2) for unix.KCMClone values, but returns a Conn
+// rather than a raw file descriptor.
+func (c *Conn) IoctlKCMClone() (*Conn, error) {
+	info, err := controlT(c, context.Background(), "ioctl", unix.IoctlKCMClone)
+	if err != nil {
+		return nil, err
+	}
+
+	// Successful clone, wrap in a Conn for use by the caller.
+	return New(int(info.Fd), c.name)
+}
+
+// IoctlKCMAttach wraps ioctl(2) for unix.KCMAttach values.
+func (c *Conn) IoctlKCMAttach(info unix.KCMAttach) error {
+	return c.control(context.Background(), "ioctl", func(fd int) error {
+		return unix.IoctlKCMAttach(fd, info)
+	})
+}
+
+// IoctlKCMUnattach wraps ioctl(2) for unix.KCMUnattach values.
+func (c *Conn) IoctlKCMUnattach(info unix.KCMUnattach) error {
+	return c.control(context.Background(), "ioctl", func(fd int) error {
+		return unix.IoctlKCMUnattach(fd, info)
+	})
+}
+
+// PidfdGetfd wraps pidfd_getfd(2) for a Conn which wraps a pidfd, but returns a
+// Conn rather than a raw file descriptor.
+func (c *Conn) PidfdGetfd(targetFD, flags int) (*Conn, error) {
+	outFD, err := controlT(c, context.Background(), "pidfd_getfd", func(fd int) (int, error) {
+		return unix.PidfdGetfd(fd, targetFD, flags)
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	// Successful getfd, wrap in a Conn for use by the caller.
+	return New(outFD, c.name)
+}
+
+// PidfdSendSignal wraps pidfd_send_signal(2) for a Conn which wraps a Linux
+// pidfd.
+func (c *Conn) PidfdSendSignal(sig unix.Signal, info *unix.Siginfo, flags int) error {
+	return c.control(context.Background(), "pidfd_send_signal", func(fd int) error {
+		return unix.PidfdSendSignal(fd, sig, info, flags)
+	})
+}
+
+// SetBPF attaches an assembled BPF program to a Conn.
+func (c *Conn) SetBPF(filter []bpf.RawInstruction) error {
+	// We can't point to the first instruction in the array if no instructions
+	// are present.
+	if len(filter) == 0 {
+		return os.NewSyscallError("setsockopt", unix.EINVAL)
+	}
+
+	prog := unix.SockFprog{
+		Len:    uint16(len(filter)),
+		Filter: (*unix.SockFilter)(unsafe.Pointer(&filter[0])),
+	}
+
+	return c.SetsockoptSockFprog(unix.SOL_SOCKET, unix.SO_ATTACH_FILTER, &prog)
+}
+
+// RemoveBPF removes a BPF filter from a Conn.
+func (c *Conn) RemoveBPF() error {
+	// 0 argument is ignored.
+	return c.SetsockoptInt(unix.SOL_SOCKET, unix.SO_DETACH_FILTER, 0)
+}
+
+// SetsockoptPacketMreq wraps setsockopt(2) for unix.PacketMreq values.
+func (c *Conn) SetsockoptPacketMreq(level, opt int, mreq *unix.PacketMreq) error {
+	return c.control(context.Background(), "setsockopt", func(fd int) error {
+		return unix.SetsockoptPacketMreq(fd, level, opt, mreq)
+	})
+}
+
+// SetsockoptSockFprog wraps setsockopt(2) for unix.SockFprog values.
+func (c *Conn) SetsockoptSockFprog(level, opt int, fprog *unix.SockFprog) error {
+	return c.control(context.Background(), "setsockopt", func(fd int) error {
+		return unix.SetsockoptSockFprog(fd, level, opt, fprog)
+	})
+}
+
+// GetsockoptTpacketStats wraps getsockopt(2) for unix.TpacketStats values.
+func (c *Conn) GetsockoptTpacketStats(level, name int) (*unix.TpacketStats, error) {
+	return controlT(c, context.Background(), "getsockopt", func(fd int) (*unix.TpacketStats, error) {
+		return unix.GetsockoptTpacketStats(fd, level, name)
+	})
+}
+
+// GetsockoptTpacketStatsV3 wraps getsockopt(2) for unix.TpacketStatsV3 values.
+func (c *Conn) GetsockoptTpacketStatsV3(level, name int) (*unix.TpacketStatsV3, error) {
+	return controlT(c, context.Background(), "getsockopt", func(fd int) (*unix.TpacketStatsV3, error) {
+		return unix.GetsockoptTpacketStatsV3(fd, level, name)
+	})
+}
+
+// Waitid wraps waitid(2).
+func (c *Conn) Waitid(idType int, info *unix.Siginfo, options int, rusage *unix.Rusage) error {
+	return c.read(context.Background(), "waitid", func(fd int) error {
+		return unix.Waitid(idType, fd, info, options, rusage)
+	})
+}
diff --git a/vendor/github.com/mdlayher/socket/doc.go b/vendor/github.com/mdlayher/socket/doc.go
new file mode 100644
index 000000000..7d4566c90
--- /dev/null
+++ b/vendor/github.com/mdlayher/socket/doc.go
@@ -0,0 +1,13 @@
+// Package socket provides a low-level network connection type which integrates
+// with Go's runtime network poller to provide asynchronous I/O and deadline
+// support.
+//
+// This package focuses on UNIX-like operating systems which make use of BSD
+// sockets system call APIs. It is meant to be used as a foundation for the
+// creation of operating system-specific socket packages, for socket families
+// such as Linux's AF_NETLINK, AF_PACKET, or AF_VSOCK. This package should not
+// be used directly in end user applications.
+//
+// Any use of package socket should be guarded by build tags, as one would also
+// use when importing the syscall or golang.org/x/sys packages.
+package socket
diff --git a/vendor/github.com/mdlayher/socket/netns_linux.go b/vendor/github.com/mdlayher/socket/netns_linux.go
new file mode 100644
index 000000000..b29115ad1
--- /dev/null
+++ b/vendor/github.com/mdlayher/socket/netns_linux.go
@@ -0,0 +1,150 @@
+//go:build linux
+// +build linux
+
+package socket
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"runtime"
+
+	"golang.org/x/sync/errgroup"
+	"golang.org/x/sys/unix"
+)
+
+// errNetNSDisabled is returned when network namespaces are unavailable on
+// a given system.
+var errNetNSDisabled = errors.New("socket: Linux network namespaces are not enabled on this system")
+
+// withNetNS invokes fn within the context of the network namespace specified by
+// fd, while also managing the logic required to safely do so by manipulating
+// thread-local state.
+func withNetNS(fd int, fn func() (*Conn, error)) (*Conn, error) {
+	var (
+		eg   errgroup.Group
+		conn *Conn
+	)
+
+	eg.Go(func() error {
+		// Retrieve and store the calling OS thread's network namespace so the
+		// thread can be reassigned to it after creating a socket in another network
+		// namespace.
+		runtime.LockOSThread()
+
+		ns, err := threadNetNS()
+		if err != nil {
+			// No thread-local manipulation, unlock.
+			runtime.UnlockOSThread()
+			return err
+		}
+		defer ns.Close()
+
+		// Beyond this point, the thread's network namespace is poisoned. Do not
+		// unlock the OS thread until all network namespace manipulation completes
+		// to avoid returning to the caller with altered thread-local state.
+
+		// Assign the current OS thread the goroutine is locked to to the given
+		// network namespace.
+		if err := ns.Set(fd); err != nil {
+			return err
+		}
+
+		// Attempt Conn creation and unconditionally restore the original namespace.
+		c, err := fn()
+		if nerr := ns.Restore(); nerr != nil {
+			// Failed to restore original namespace. Return an error and allow the
+			// runtime to terminate the thread.
+			if err == nil {
+				_ = c.Close()
+			}
+
+			return nerr
+		}
+
+		// No more thread-local state manipulation; return the new Conn.
+		runtime.UnlockOSThread()
+		conn = c
+		return nil
+	})
+
+	if err := eg.Wait(); err != nil {
+		return nil, err
+	}
+
+	return conn, nil
+}
+
+// A netNS is a handle that can manipulate network namespaces.
+//
+// Operations performed on a netNS must use runtime.LockOSThread before
+// manipulating any network namespaces.
+type netNS struct {
+	// The handle to a network namespace.
+	f *os.File
+
+	// Indicates if network namespaces are disabled on this system, and thus
+	// operations should become a no-op or return errors.
+	disabled bool
+}
+
+// threadNetNS constructs a netNS using the network namespace of the calling
+// thread. If the namespace is not the default namespace, runtime.LockOSThread
+// should be invoked first.
+func threadNetNS() (*netNS, error) {
+	return fileNetNS(fmt.Sprintf("/proc/self/task/%d/ns/net", unix.Gettid()))
+}
+
+// fileNetNS opens file and creates a netNS. fileNetNS should only be called
+// directly in tests.
+func fileNetNS(file string) (*netNS, error) {
+	f, err := os.Open(file)
+	switch {
+	case err == nil:
+		return &netNS{f: f}, nil
+	case os.IsNotExist(err):
+		// Network namespaces are not enabled on this system. Use this signal
+		// to return errors elsewhere if the caller explicitly asks for a
+		// network namespace to be set.
+		return &netNS{disabled: true}, nil
+	default:
+		return nil, err
+	}
+}
+
+// Close releases the handle to a network namespace.
+func (n *netNS) Close() error {
+	return n.do(func() error { return n.f.Close() })
+}
+
+// FD returns a file descriptor which represents the network namespace.
+func (n *netNS) FD() int {
+	if n.disabled {
+		// No reasonable file descriptor value in this case, so specify a
+		// non-existent one.
+		return -1
+	}
+
+	return int(n.f.Fd())
+}
+
+// Restore restores the original network namespace for the calling thread.
+func (n *netNS) Restore() error {
+	return n.do(func() error { return n.Set(n.FD()) })
+}
+
+// Set sets a new network namespace for the current thread using fd.
+func (n *netNS) Set(fd int) error {
+	return n.do(func() error {
+		return os.NewSyscallError("setns", unix.Setns(fd, unix.CLONE_NEWNET))
+	})
+}
+
+// do runs fn if network namespaces are enabled on this system.
+func (n *netNS) do(fn func() error) error {
+	if n.disabled {
+		return errNetNSDisabled
+	}
+
+	return fn()
+}
diff --git a/vendor/github.com/mdlayher/socket/netns_others.go b/vendor/github.com/mdlayher/socket/netns_others.go
new file mode 100644
index 000000000..4cceb3d04
--- /dev/null
+++ b/vendor/github.com/mdlayher/socket/netns_others.go
@@ -0,0 +1,14 @@
+//go:build !linux
+// +build !linux
+
+package socket
+
+import (
+	"fmt"
+	"runtime"
+)
+
+// withNetNS returns an error on non-Linux systems.
+func withNetNS(_ int, _ func() (*Conn, error)) (*Conn, error) {
+	return nil, fmt.Errorf("socket: Linux network namespace support is not available on %s", runtime.GOOS)
+}
diff --git a/vendor/github.com/mdlayher/socket/setbuffer_linux.go b/vendor/github.com/mdlayher/socket/setbuffer_linux.go
new file mode 100644
index 000000000..0d4aa4417
--- /dev/null
+++ b/vendor/github.com/mdlayher/socket/setbuffer_linux.go
@@ -0,0 +1,24 @@
+//go:build linux
+// +build linux
+
+package socket
+
+import "golang.org/x/sys/unix"
+
+// setReadBuffer wraps the SO_RCVBUF{,FORCE} setsockopt(2) options.
+func (c *Conn) setReadBuffer(bytes int) error {
+	err := c.SetsockoptInt(unix.SOL_SOCKET, unix.SO_RCVBUFFORCE, bytes)
+	if err != nil {
+		err = c.SetsockoptInt(unix.SOL_SOCKET, unix.SO_RCVBUF, bytes)
+	}
+	return err
+}
+
+// setWriteBuffer wraps the SO_SNDBUF{,FORCE} setsockopt(2) options.
+func (c *Conn) setWriteBuffer(bytes int) error {
+	err := c.SetsockoptInt(unix.SOL_SOCKET, unix.SO_SNDBUFFORCE, bytes)
+	if err != nil {
+		err = c.SetsockoptInt(unix.SOL_SOCKET, unix.SO_SNDBUF, bytes)
+	}
+	return err
+}
diff --git a/vendor/github.com/mdlayher/socket/setbuffer_others.go b/vendor/github.com/mdlayher/socket/setbuffer_others.go
new file mode 100644
index 000000000..72b36dbe3
--- /dev/null
+++ b/vendor/github.com/mdlayher/socket/setbuffer_others.go
@@ -0,0 +1,16 @@
+//go:build !linux
+// +build !linux
+
+package socket
+
+import "golang.org/x/sys/unix"
+
+// setReadBuffer wraps the SO_RCVBUF setsockopt(2) option.
+func (c *Conn) setReadBuffer(bytes int) error {
+	return c.SetsockoptInt(unix.SOL_SOCKET, unix.SO_RCVBUF, bytes)
+}
+
+// setWriteBuffer wraps the SO_SNDBUF setsockopt(2) option.
+func (c *Conn) setWriteBuffer(bytes int) error {
+	return c.SetsockoptInt(unix.SOL_SOCKET, unix.SO_SNDBUF, bytes)
+}
diff --git a/vendor/github.com/mdlayher/socket/typ_cloexec_nonblock.go b/vendor/github.com/mdlayher/socket/typ_cloexec_nonblock.go
new file mode 100644
index 000000000..40e834310
--- /dev/null
+++ b/vendor/github.com/mdlayher/socket/typ_cloexec_nonblock.go
@@ -0,0 +1,12 @@
+//go:build !darwin
+// +build !darwin
+
+package socket
+
+import "golang.org/x/sys/unix"
+
+const (
+	// These operating systems support CLOEXEC and NONBLOCK socket options.
+	flagCLOEXEC = true
+	socketFlags = unix.SOCK_CLOEXEC | unix.SOCK_NONBLOCK
+)
diff --git a/vendor/github.com/mdlayher/socket/typ_none.go b/vendor/github.com/mdlayher/socket/typ_none.go
new file mode 100644
index 000000000..9bbb1aab5
--- /dev/null
+++ b/vendor/github.com/mdlayher/socket/typ_none.go
@@ -0,0 +1,11 @@
+//go:build darwin
+// +build darwin
+
+package socket
+
+const (
+	// These operating systems do not support CLOEXEC and NONBLOCK socket
+	// options.
+	flagCLOEXEC = false
+	socketFlags = 0
+)
diff --git a/vendor/github.com/mdlayher/vsock/.gitignore b/vendor/github.com/mdlayher/vsock/.gitignore
new file mode 100644
index 000000000..8130d4158
--- /dev/null
+++ b/vendor/github.com/mdlayher/vsock/.gitignore
@@ -0,0 +1,4 @@
+cover.out
+vsock.test
+cmd/vscp/vscp
+cmd/vsockhttp/vsockhttp
diff --git a/vendor/github.com/mdlayher/vsock/CHANGELOG.md b/vendor/github.com/mdlayher/vsock/CHANGELOG.md
new file mode 100644
index 000000000..c64a797bc
--- /dev/null
+++ b/vendor/github.com/mdlayher/vsock/CHANGELOG.md
@@ -0,0 +1,53 @@
+# CHANGELOG
+
+# v1.2.1
+
+- [Improvement]: updated dependencies, test with Go 1.20.
+
+# v1.2.0
+
+**This is the first release of package vsock that only supports Go 1.18+. Users
+on older versions of Go must use v1.1.1.**
+
+- [Improvement]: drop support for older versions of Go so we can begin using
+  modern versions of `x/sys` and other dependencies.
+
+## v1.1.1
+
+**This is the last release of package vsock that supports Go 1.17 and below.**
+
+- [Bug Fix] [commit](https://github.com/mdlayher/vsock/commit/ead86435c244d5d6baad549a6df0557ada3f4401):
+  fix build on non-UNIX platforms such as Windows. This is a no-op change on
+  Linux but provides a friendlier experience for non-Linux users.
+
+## v1.1.0
+
+- [New API] [commit](https://github.com/mdlayher/vsock/commit/44cd82dc5f7de644436f22236b111ab97fa9a14f):
+  `vsock.FileListener` can be used to create a `vsock.Listener` from an existing
+  `os.File`, which may be provided by systemd socket activation or another
+  external mechanism.
+
+## v1.0.1
+
+- [Bug Fix] [commit](https://github.com/mdlayher/vsock/commit/99a6dccdebad21d1fa5f757d228d677ccb1412dc):
+  upgrade `github.com/mdlayher/socket` to handle non-blocking `connect(2)`
+  errors (called in `vsock.Dial`) properly by checking the `SO_ERROR` socket
+  option. Lock in this behavior with a new test.
+- [Improvement] [commit](https://github.com/mdlayher/vsock/commit/375f3bbcc363500daf367ec511638a4655471719):
+  downgrade the version of `golang.org/x/net` in use to support Go 1.12. We
+  don't need the latest version for this package.
+
+## v1.0.0
+
+**This is the first release of package vsock that only supports Go 1.12+.
+Users on older versions of Go must use an unstable release.**
+
+- Initial stable commit!
+- [API change]: the `vsock.Dial` and `vsock.Listen` constructors now accept an
+  optional `*vsock.Config` parameter to enable future expansion in v1.x.x
+  without prompting further breaking API changes. Because `vsock.Config` has no
+  options as of this release, `nil` may be passed in all call sites to fix
+  existing code upon upgrading to v1.0.0.
+- [New API]: the `vsock.ListenContextID` function can be used to create a
+  `*vsock.Listener` which is bound to an explicit context ID address, rather
+  than inferring one automatically as `vsock.Listen` does.
diff --git a/vendor/github.com/mdlayher/vsock/LICENSE.md b/vendor/github.com/mdlayher/vsock/LICENSE.md
new file mode 100644
index 000000000..9fa6774b1
--- /dev/null
+++ b/vendor/github.com/mdlayher/vsock/LICENSE.md
@@ -0,0 +1,9 @@
+# MIT License
+
+Copyright (C) 2017-2022 Matt Layher
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/vendor/github.com/mdlayher/vsock/README.md b/vendor/github.com/mdlayher/vsock/README.md
new file mode 100644
index 000000000..b1ec4cfbe
--- /dev/null
+++ b/vendor/github.com/mdlayher/vsock/README.md
@@ -0,0 +1,21 @@
+# vsock [![Test Status](https://github.com/mdlayher/vsock/workflows/Linux%20Test/badge.svg)](https://github.com/mdlayher/vsock/actions) [![Go Reference](https://pkg.go.dev/badge/github.com/mdlayher/vsock.svg)](https://pkg.go.dev/github.com/mdlayher/vsock)  [![Go Report Card](https://goreportcard.com/badge/github.com/mdlayher/vsock)](https://goreportcard.com/report/github.com/mdlayher/vsock)
+
+Package `vsock` provides access to Linux VM sockets (`AF_VSOCK`) for
+communication between a hypervisor and its virtual machines.  MIT Licensed.
+
+For more information about VM sockets, see my blog about
+[Linux VM sockets in Go](https://mdlayher.com/blog/linux-vm-sockets-in-go/) or
+the [QEMU wiki page on virtio-vsock](http://wiki.qemu-project.org/Features/VirtioVsock).
+
+## Stability
+
+See the [CHANGELOG](./CHANGELOG.md) file for a description of changes between
+releases.
+
+This package has a stable v1 API and any future breaking changes will prompt
+the release of a new major version. Features and bug fixes will continue to
+occur in the v1.x.x series.
+
+This package only supports the two most recent major versions of Go, mirroring
+Go's own release policy. Older versions of Go may lack critical features and bug
+fixes which are necessary for this package to function correctly.
diff --git a/vendor/github.com/mdlayher/vsock/conn_linux.go b/vendor/github.com/mdlayher/vsock/conn_linux.go
new file mode 100644
index 000000000..6029d547e
--- /dev/null
+++ b/vendor/github.com/mdlayher/vsock/conn_linux.go
@@ -0,0 +1,62 @@
+//go:build linux
+// +build linux
+
+package vsock
+
+import (
+	"context"
+
+	"github.com/mdlayher/socket"
+	"golang.org/x/sys/unix"
+)
+
+// A conn is the net.Conn implementation for connection-oriented VM sockets.
+// We can use socket.Conn directly on Linux to implement all of the necessary
+// methods.
+type conn = socket.Conn
+
+// dial is the entry point for Dial on Linux.
+func dial(cid, port uint32, _ *Config) (*Conn, error) {
+	// TODO(mdlayher): Config default nil check and initialize. Pass options to
+	// socket.Config where necessary.
+
+	c, err := socket.Socket(unix.AF_VSOCK, unix.SOCK_STREAM, 0, "vsock", nil)
+	if err != nil {
+		return nil, err
+	}
+
+	sa := &unix.SockaddrVM{CID: cid, Port: port}
+	rsa, err := c.Connect(context.Background(), sa)
+	if err != nil {
+		_ = c.Close()
+		return nil, err
+	}
+
+	// TODO(mdlayher): getpeername(2) appears to return nil in the GitHub CI
+	// environment, so in the event of a nil sockaddr, fall back to the previous
+	// method of synthesizing the remote address.
+	if rsa == nil {
+		rsa = sa
+	}
+
+	lsa, err := c.Getsockname()
+	if err != nil {
+		_ = c.Close()
+		return nil, err
+	}
+
+	lsavm := lsa.(*unix.SockaddrVM)
+	rsavm := rsa.(*unix.SockaddrVM)
+
+	return &Conn{
+		c: c,
+		local: &Addr{
+			ContextID: lsavm.CID,
+			Port:      lsavm.Port,
+		},
+		remote: &Addr{
+			ContextID: rsavm.CID,
+			Port:      rsavm.Port,
+		},
+	}, nil
+}
diff --git a/vendor/github.com/mdlayher/vsock/doc.go b/vendor/github.com/mdlayher/vsock/doc.go
new file mode 100644
index 000000000..e158b1836
--- /dev/null
+++ b/vendor/github.com/mdlayher/vsock/doc.go
@@ -0,0 +1,10 @@
+// Package vsock provides access to Linux VM sockets (AF_VSOCK) for
+// communication between a hypervisor and its virtual machines.
+//
+// The types in this package implement interfaces provided by package net and
+// may be used in applications that expect a net.Listener or net.Conn.
+//
+//   - *Addr implements net.Addr
+//   - *Conn implements net.Conn
+//   - *Listener implements net.Listener
+package vsock
diff --git a/vendor/github.com/mdlayher/vsock/fd_linux.go b/vendor/github.com/mdlayher/vsock/fd_linux.go
new file mode 100644
index 000000000..531e53f92
--- /dev/null
+++ b/vendor/github.com/mdlayher/vsock/fd_linux.go
@@ -0,0 +1,36 @@
+package vsock
+
+import (
+	"fmt"
+	"os"
+
+	"golang.org/x/sys/unix"
+)
+
+// contextID retrieves the local context ID for this system.
+func contextID() (uint32, error) {
+	f, err := os.Open(devVsock)
+	if err != nil {
+		return 0, err
+	}
+	defer f.Close()
+
+	return unix.IoctlGetUint32(int(f.Fd()), unix.IOCTL_VM_SOCKETS_GET_LOCAL_CID)
+}
+
+// isErrno determines if an error a matches UNIX error number.
+func isErrno(err error, errno int) bool {
+	switch errno {
+	case ebadf:
+		return err == unix.EBADF
+	case enotconn:
+		return err == unix.ENOTCONN
+	default:
+		panicf("vsock: isErrno called with unhandled error number parameter: %d", errno)
+		return false
+	}
+}
+
+func panicf(format string, a ...interface{}) {
+	panic(fmt.Sprintf(format, a...))
+}
diff --git a/vendor/github.com/mdlayher/vsock/listener_linux.go b/vendor/github.com/mdlayher/vsock/listener_linux.go
new file mode 100644
index 000000000..50fa1b7a4
--- /dev/null
+++ b/vendor/github.com/mdlayher/vsock/listener_linux.go
@@ -0,0 +1,133 @@
+//go:build linux
+// +build linux
+
+package vsock
+
+import (
+	"context"
+	"net"
+	"os"
+	"time"
+
+	"github.com/mdlayher/socket"
+	"golang.org/x/sys/unix"
+)
+
+var _ net.Listener = &listener{}
+
+// A listener is the net.Listener implementation for connection-oriented
+// VM sockets.
+type listener struct {
+	c    *socket.Conn
+	addr *Addr
+}
+
+// Addr and Close implement the net.Listener interface for listener.
+func (l *listener) Addr() net.Addr                { return l.addr }
+func (l *listener) Close() error                  { return l.c.Close() }
+func (l *listener) SetDeadline(t time.Time) error { return l.c.SetDeadline(t) }
+
+// Accept accepts a single connection from the listener, and sets up
+// a net.Conn backed by conn.
+func (l *listener) Accept() (net.Conn, error) {
+	c, rsa, err := l.c.Accept(context.Background(), 0)
+	if err != nil {
+		return nil, err
+	}
+
+	savm := rsa.(*unix.SockaddrVM)
+	remote := &Addr{
+		ContextID: savm.CID,
+		Port:      savm.Port,
+	}
+
+	return &Conn{
+		c:      c,
+		local:  l.addr,
+		remote: remote,
+	}, nil
+}
+
+// name is the socket name passed to package socket.
+const name = "vsock"
+
+// listen is the entry point for Listen on Linux.
+func listen(cid, port uint32, _ *Config) (*Listener, error) {
+	// TODO(mdlayher): Config default nil check and initialize. Pass options to
+	// socket.Config where necessary.
+
+	c, err := socket.Socket(unix.AF_VSOCK, unix.SOCK_STREAM, 0, name, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	// Be sure to close the Conn if any of the system calls fail before we
+	// return the Conn to the caller.
+
+	if port == 0 {
+		port = unix.VMADDR_PORT_ANY
+	}
+
+	if err := c.Bind(&unix.SockaddrVM{CID: cid, Port: port}); err != nil {
+		_ = c.Close()
+		return nil, err
+	}
+
+	if err := c.Listen(unix.SOMAXCONN); err != nil {
+		_ = c.Close()
+		return nil, err
+	}
+
+	l, err := newListener(c)
+	if err != nil {
+		_ = c.Close()
+		return nil, err
+	}
+
+	return l, nil
+}
+
+// fileListener is the entry point for FileListener on Linux.
+func fileListener(f *os.File) (*Listener, error) {
+	c, err := socket.FileConn(f, name)
+	if err != nil {
+		return nil, err
+	}
+
+	l, err := newListener(c)
+	if err != nil {
+		_ = c.Close()
+		return nil, err
+	}
+
+	return l, nil
+}
+
+// newListener creates a Listener from a raw socket.Conn.
+func newListener(c *socket.Conn) (*Listener, error) {
+	lsa, err := c.Getsockname()
+	if err != nil {
+		return nil, err
+	}
+
+	// Now that the library can also accept arbitrary os.Files, we have to
+	// verify the address family so we don't accidentally create a
+	// *vsock.Listener backed by TCP or some other socket type.
+	lsavm, ok := lsa.(*unix.SockaddrVM)
+	if !ok {
+		// All errors should wrapped with os.SyscallError.
+		return nil, os.NewSyscallError("listen", unix.EINVAL)
+	}
+
+	addr := &Addr{
+		ContextID: lsavm.CID,
+		Port:      lsavm.Port,
+	}
+
+	return &Listener{
+		l: &listener{
+			c:    c,
+			addr: addr,
+		},
+	}, nil
+}
diff --git a/vendor/github.com/mdlayher/vsock/vsock.go b/vendor/github.com/mdlayher/vsock/vsock.go
new file mode 100644
index 000000000..78763936a
--- /dev/null
+++ b/vendor/github.com/mdlayher/vsock/vsock.go
@@ -0,0 +1,435 @@
+package vsock
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"os"
+	"strings"
+	"syscall"
+	"time"
+)
+
+const (
+	// Hypervisor specifies that a socket should communicate with the hypervisor
+	// process. Note that this is _not_ the same as a socket owned by a process
+	// running on the hypervisor. Most users should probably use Host instead.
+	Hypervisor = 0x0
+
+	// Local specifies that a socket should communicate with a matching socket
+	// on the same machine. This provides an alternative to UNIX sockets or
+	// similar and may be useful in testing VM sockets applications.
+	Local = 0x1
+
+	// Host specifies that a socket should communicate with processes other than
+	// the hypervisor on the host machine. This is the correct choice to
+	// communicate with a process running on a hypervisor using a socket dialed
+	// from a guest.
+	Host = 0x2
+
+	// Error numbers we recognize, copied here to avoid importing x/sys/unix in
+	// cross-platform code.
+	ebadf    = 9
+	enotconn = 107
+
+	// devVsock is the location of /dev/vsock.  It is exposed on both the
+	// hypervisor and on virtual machines.
+	devVsock = "/dev/vsock"
+
+	// network is the vsock network reported in net.OpError.
+	network = "vsock"
+
+	// Operation names which may be returned in net.OpError.
+	opAccept      = "accept"
+	opClose       = "close"
+	opDial        = "dial"
+	opListen      = "listen"
+	opRawControl  = "raw-control"
+	opRawRead     = "raw-read"
+	opRawWrite    = "raw-write"
+	opRead        = "read"
+	opSet         = "set"
+	opSyscallConn = "syscall-conn"
+	opWrite       = "write"
+)
+
+// TODO(mdlayher): plumb through socket.Config.NetNS if it makes sense.
+
+// Config contains options for a Conn or Listener.
+type Config struct{}
+
+// Listen opens a connection-oriented net.Listener for incoming VM sockets
+// connections. The port parameter specifies the port for the Listener. Config
+// specifies optional configuration for the Listener. If config is nil, a
+// default configuration will be used.
+//
+// To allow the server to assign a port automatically, specify 0 for port. The
+// address of the server can be retrieved using the Addr method.
+//
+// Listen automatically infers the appropriate context ID for this machine by
+// calling ContextID and passing that value to ListenContextID. Callers with
+// advanced use cases (such as using the Local context ID) may wish to use
+// ListenContextID directly.
+//
+// When the Listener is no longer needed, Close must be called to free
+// resources.
+func Listen(port uint32, cfg *Config) (*Listener, error) {
+	cid, err := ContextID()
+	if err != nil {
+		// No addresses available.
+		return nil, opError(opListen, err, nil, nil)
+	}
+
+	return ListenContextID(cid, port, cfg)
+}
+
+// ListenContextID is the same as Listen, but also accepts an explicit context
+// ID parameter. This function is intended for advanced use cases and most
+// callers should use Listen instead.
+//
+// See the documentation of Listen for more details.
+func ListenContextID(contextID, port uint32, cfg *Config) (*Listener, error) {
+	l, err := listen(contextID, port, cfg)
+	if err != nil {
+		// No remote address available.
+		return nil, opError(opListen, err, &Addr{
+			ContextID: contextID,
+			Port:      port,
+		}, nil)
+	}
+
+	return l, nil
+}
+
+// FileListener returns a copy of the network listener corresponding to an open
+// os.File. It is the caller's responsibility to close the Listener when
+// finished. Closing the Listener does not affect the os.File, and closing the
+// os.File does not affect the Listener.
+//
+// This function is intended for advanced use cases and most callers should use
+// Listen instead.
+func FileListener(f *os.File) (*Listener, error) {
+	l, err := fileListener(f)
+	if err != nil {
+		// No addresses available.
+		return nil, opError(opListen, err, nil, nil)
+	}
+
+	return l, nil
+}
+
+var _ net.Listener = &Listener{}
+
+// A Listener is a VM sockets implementation of a net.Listener.
+type Listener struct {
+	l *listener
+}
+
+// Accept implements the Accept method in the net.Listener interface; it waits
+// for the next call and returns a generic net.Conn. The returned net.Conn will
+// always be of type *Conn.
+func (l *Listener) Accept() (net.Conn, error) {
+	c, err := l.l.Accept()
+	if err != nil {
+		return nil, l.opError(opAccept, err)
+	}
+
+	return c, nil
+}
+
+// Addr returns the listener's network address, a *Addr. The Addr returned is
+// shared by all invocations of Addr, so do not modify it.
+func (l *Listener) Addr() net.Addr { return l.l.Addr() }
+
+// Close stops listening on the VM sockets address. Already Accepted connections
+// are not closed.
+func (l *Listener) Close() error {
+	return l.opError(opClose, l.l.Close())
+}
+
+// SetDeadline sets the deadline associated with the listener. A zero time value
+// disables the deadline.
+func (l *Listener) SetDeadline(t time.Time) error {
+	return l.opError(opSet, l.l.SetDeadline(t))
+}
+
+// opError is a convenience for the function opError that also passes the local
+// address of the Listener.
+func (l *Listener) opError(op string, err error) error {
+	// No remote address for a Listener.
+	return opError(op, err, l.Addr(), nil)
+}
+
+// Dial dials a connection-oriented net.Conn to a VM sockets listener. The
+// context ID and port parameters specify the address of the listener. Config
+// specifies optional configuration for the Conn. If config is nil, a default
+// configuration will be used.
+//
+// If dialing a connection from the hypervisor to a virtual machine, the VM's
+// context ID should be specified.
+//
+// If dialing from a VM to the hypervisor, Hypervisor should be used to
+// communicate with the hypervisor process, or Host should be used to
+// communicate with other processes on the host machine.
+//
+// When the connection is no longer needed, Close must be called to free
+// resources.
+func Dial(contextID, port uint32, cfg *Config) (*Conn, error) {
+	c, err := dial(contextID, port, cfg)
+	if err != nil {
+		// No local address, but we have a remote address we can return.
+		return nil, opError(opDial, err, nil, &Addr{
+			ContextID: contextID,
+			Port:      port,
+		})
+	}
+
+	return c, nil
+}
+
+var (
+	_ net.Conn     = &Conn{}
+	_ syscall.Conn = &Conn{}
+)
+
+// A Conn is a VM sockets implementation of a net.Conn.
+type Conn struct {
+	c      *conn
+	local  *Addr
+	remote *Addr
+}
+
+// Close closes the connection.
+func (c *Conn) Close() error {
+	return c.opError(opClose, c.c.Close())
+}
+
+// CloseRead shuts down the reading side of the VM sockets connection. Most
+// callers should just use Close.
+func (c *Conn) CloseRead() error {
+	return c.opError(opClose, c.c.CloseRead())
+}
+
+// CloseWrite shuts down the writing side of the VM sockets connection. Most
+// callers should just use Close.
+func (c *Conn) CloseWrite() error {
+	return c.opError(opClose, c.c.CloseWrite())
+}
+
+// LocalAddr returns the local network address. The Addr returned is shared by
+// all invocations of LocalAddr, so do not modify it.
+func (c *Conn) LocalAddr() net.Addr { return c.local }
+
+// RemoteAddr returns the remote network address. The Addr returned is shared by
+// all invocations of RemoteAddr, so do not modify it.
+func (c *Conn) RemoteAddr() net.Addr { return c.remote }
+
+// Read implements the net.Conn Read method.
+func (c *Conn) Read(b []byte) (int, error) {
+	n, err := c.c.Read(b)
+	if err != nil {
+		return n, c.opError(opRead, err)
+	}
+
+	return n, nil
+}
+
+// Write implements the net.Conn Write method.
+func (c *Conn) Write(b []byte) (int, error) {
+	n, err := c.c.Write(b)
+	if err != nil {
+		return n, c.opError(opWrite, err)
+	}
+
+	return n, nil
+}
+
+// SetDeadline implements the net.Conn SetDeadline method.
+func (c *Conn) SetDeadline(t time.Time) error {
+	return c.opError(opSet, c.c.SetDeadline(t))
+}
+
+// SetReadDeadline implements the net.Conn SetReadDeadline method.
+func (c *Conn) SetReadDeadline(t time.Time) error {
+	return c.opError(opSet, c.c.SetReadDeadline(t))
+}
+
+// SetWriteDeadline implements the net.Conn SetWriteDeadline method.
+func (c *Conn) SetWriteDeadline(t time.Time) error {
+	return c.opError(opSet, c.c.SetWriteDeadline(t))
+}
+
+// SyscallConn returns a raw network connection. This implements the
+// syscall.Conn interface.
+func (c *Conn) SyscallConn() (syscall.RawConn, error) {
+	rc, err := c.c.SyscallConn()
+	if err != nil {
+		return nil, c.opError(opSyscallConn, err)
+	}
+
+	return &rawConn{
+		rc:     rc,
+		local:  c.local,
+		remote: c.remote,
+	}, nil
+}
+
+// opError is a convenience for the function opError that also passes the local
+// and remote addresses of the Conn.
+func (c *Conn) opError(op string, err error) error {
+	return opError(op, err, c.local, c.remote)
+}
+
+// TODO(mdlayher): see if we can port smarter net.OpError with local/remote
+// address error logic into socket.Conn's SyscallConn type to avoid the need for
+// this wrapper.
+
+var _ syscall.RawConn = &rawConn{}
+
+// A rawConn is a syscall.RawConn that wraps an internal syscall.RawConn in order
+// to produce net.OpError error values.
+type rawConn struct {
+	rc            syscall.RawConn
+	local, remote *Addr
+}
+
+// Control implements the syscall.RawConn Control method.
+func (rc *rawConn) Control(fn func(fd uintptr)) error {
+	return rc.opError(opRawControl, rc.rc.Control(fn))
+}
+
+// Control implements the syscall.RawConn Read method.
+func (rc *rawConn) Read(fn func(fd uintptr) (done bool)) error {
+	return rc.opError(opRawRead, rc.rc.Read(fn))
+}
+
+// Control implements the syscall.RawConn Write method.
+func (rc *rawConn) Write(fn func(fd uintptr) (done bool)) error {
+	return rc.opError(opRawWrite, rc.rc.Write(fn))
+}
+
+// opError is a convenience for the function opError that also passes the local
+// and remote addresses of the rawConn.
+func (rc *rawConn) opError(op string, err error) error {
+	return opError(op, err, rc.local, rc.remote)
+}
+
+var _ net.Addr = &Addr{}
+
+// An Addr is the address of a VM sockets endpoint.
+type Addr struct {
+	ContextID, Port uint32
+}
+
+// Network returns the address's network name, "vsock".
+func (a *Addr) Network() string { return network }
+
+// String returns a human-readable representation of Addr, and indicates if
+// ContextID is meant to be used for a hypervisor, host, VM, etc.
+func (a *Addr) String() string {
+	var host string
+
+	switch a.ContextID {
+	case Hypervisor:
+		host = fmt.Sprintf("hypervisor(%d)", a.ContextID)
+	case Local:
+		host = fmt.Sprintf("local(%d)", a.ContextID)
+	case Host:
+		host = fmt.Sprintf("host(%d)", a.ContextID)
+	default:
+		host = fmt.Sprintf("vm(%d)", a.ContextID)
+	}
+
+	return fmt.Sprintf("%s:%d", host, a.Port)
+}
+
+// fileName returns a file name for use with os.NewFile for Addr.
+func (a *Addr) fileName() string {
+	return fmt.Sprintf("%s:%s", a.Network(), a.String())
+}
+
+// ContextID retrieves the local VM sockets context ID for this system.
+// ContextID can be used to directly determine if a system is capable of using
+// VM sockets.
+//
+// If the kernel module is unavailable, access to the kernel module is denied,
+// or VM sockets are unsupported on this system, it returns an error.
+func ContextID() (uint32, error) {
+	return contextID()
+}
+
+// opError unpacks err if possible, producing a net.OpError with the input
+// parameters in order to implement net.Conn. As a convenience, opError returns
+// nil if the input error is nil.
+func opError(op string, err error, local, remote net.Addr) error {
+	if err == nil {
+		return nil
+	}
+
+	// TODO(mdlayher): this entire function is suspect and should probably be
+	// looked at carefully, especially with Go 1.13+ error wrapping.
+	//
+	// Eventually this *net.OpError logic should probably be ported into
+	// mdlayher/socket because similar checks are necessary to comply with
+	// nettest.TestConn.
+
+	// Unwrap inner errors from error types.
+	//
+	// TODO(mdlayher): errors.Cause or similar in Go 1.13.
+	switch xerr := err.(type) {
+	// os.PathError produced by os.File method calls.
+	case *os.PathError:
+		// Although we could make use of xerr.Op here, we're passing it manually
+		// for consistency, since some of the Conn calls we are making don't
+		// wrap an os.File, which would return an Op for us.
+		//
+		// As a special case, if the error is related to access to the /dev/vsock
+		// device, we don't unwrap it, so the caller has more context as to why
+		// their operation actually failed than "permission denied" or similar.
+		if xerr.Path != devVsock {
+			err = xerr.Err
+		}
+	}
+
+	switch {
+	case err == io.EOF, isErrno(err, enotconn):
+		// We may see a literal io.EOF as happens with x/net/nettest, but
+		// "transport not connected" also means io.EOF in Go.
+		return io.EOF
+	case err == os.ErrClosed, isErrno(err, ebadf), strings.Contains(err.Error(), "use of closed"):
+		// Different operations may return different errors that all effectively
+		// indicate a closed file.
+		//
+		// To rectify the differences, net.TCPConn uses an error with this text
+		// from internal/poll for the backing file already being closed.
+		err = errors.New("use of closed network connection")
+	default:
+		// Nothing to do, return this directly.
+	}
+
+	// Determine source and addr using the rules defined by net.OpError's
+	// documentation: https://golang.org/pkg/net/#OpError.
+	var source, addr net.Addr
+	switch op {
+	case opClose, opDial, opRawRead, opRawWrite, opRead, opWrite:
+		if local != nil {
+			source = local
+		}
+		if remote != nil {
+			addr = remote
+		}
+	case opAccept, opListen, opRawControl, opSet, opSyscallConn:
+		if local != nil {
+			addr = local
+		}
+	}
+
+	return &net.OpError{
+		Op:     op,
+		Net:    network,
+		Source: source,
+		Addr:   addr,
+		Err:    err,
+	}
+}
diff --git a/vendor/github.com/mdlayher/vsock/vsock_others.go b/vendor/github.com/mdlayher/vsock/vsock_others.go
new file mode 100644
index 000000000..5c1e88e39
--- /dev/null
+++ b/vendor/github.com/mdlayher/vsock/vsock_others.go
@@ -0,0 +1,45 @@
+//go:build !linux
+// +build !linux
+
+package vsock
+
+import (
+	"fmt"
+	"net"
+	"os"
+	"runtime"
+	"syscall"
+	"time"
+)
+
+// errUnimplemented is returned by all functions on platforms that
+// cannot make use of VM sockets.
+var errUnimplemented = fmt.Errorf("vsock: not implemented on %s", runtime.GOOS)
+
+func fileListener(_ *os.File) (*Listener, error)       { return nil, errUnimplemented }
+func listen(_, _ uint32, _ *Config) (*Listener, error) { return nil, errUnimplemented }
+
+type listener struct{}
+
+func (*listener) Accept() (net.Conn, error)     { return nil, errUnimplemented }
+func (*listener) Addr() net.Addr                { return nil }
+func (*listener) Close() error                  { return errUnimplemented }
+func (*listener) SetDeadline(_ time.Time) error { return errUnimplemented }
+
+func dial(_, _ uint32, _ *Config) (*Conn, error) { return nil, errUnimplemented }
+
+type conn struct{}
+
+func (*conn) Close() error                          { return errUnimplemented }
+func (*conn) CloseRead() error                      { return errUnimplemented }
+func (*conn) CloseWrite() error                     { return errUnimplemented }
+func (*conn) Read(_ []byte) (int, error)            { return 0, errUnimplemented }
+func (*conn) Write(_ []byte) (int, error)           { return 0, errUnimplemented }
+func (*conn) SetDeadline(_ time.Time) error         { return errUnimplemented }
+func (*conn) SetReadDeadline(_ time.Time) error     { return errUnimplemented }
+func (*conn) SetWriteDeadline(_ time.Time) error    { return errUnimplemented }
+func (*conn) SyscallConn() (syscall.RawConn, error) { return nil, errUnimplemented }
+
+func contextID() (uint32, error) { return 0, errUnimplemented }
+
+func isErrno(_ error, _ int) bool { return false }
diff --git a/vendor/github.com/prometheus/common/promlog/log.go b/vendor/github.com/prometheus/common/promlog/log.go
deleted file mode 100644
index 50746544a..000000000
--- a/vendor/github.com/prometheus/common/promlog/log.go
+++ /dev/null
@@ -1,192 +0,0 @@
-// Copyright 2017 The Prometheus Authors
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Package promlog defines standardised ways to initialize Go kit loggers
-// across Prometheus components.
-// It should typically only ever be imported by main packages.
-package promlog
-
-import (
-	"fmt"
-	"os"
-	"sync"
-	"time"
-
-	"github.com/go-kit/log"
-	"github.com/go-kit/log/level"
-)
-
-var (
-	// This timestamp format differs from RFC3339Nano by using .000 instead
-	// of .999999999 which changes the timestamp from 9 variable to 3 fixed
-	// decimals (.130 instead of .130987456).
-	timestampFormat = log.TimestampFormat(
-		func() time.Time { return time.Now().UTC() },
-		"2006-01-02T15:04:05.000Z07:00",
-	)
-
-	LevelFlagOptions  = []string{"debug", "info", "warn", "error"}
-	FormatFlagOptions = []string{"logfmt", "json"}
-)
-
-// AllowedLevel is a settable identifier for the minimum level a log entry
-// must be have.
-type AllowedLevel struct {
-	s string
-	o level.Option
-}
-
-func (l *AllowedLevel) UnmarshalYAML(unmarshal func(interface{}) error) error {
-	var s string
-	type plain string
-	if err := unmarshal((*plain)(&s)); err != nil {
-		return err
-	}
-	if s == "" {
-		return nil
-	}
-	lo := &AllowedLevel{}
-	if err := lo.Set(s); err != nil {
-		return err
-	}
-	*l = *lo
-	return nil
-}
-
-func (l *AllowedLevel) String() string {
-	return l.s
-}
-
-// Set updates the value of the allowed level.
-func (l *AllowedLevel) Set(s string) error {
-	switch s {
-	case "debug":
-		l.o = level.AllowDebug()
-	case "info":
-		l.o = level.AllowInfo()
-	case "warn":
-		l.o = level.AllowWarn()
-	case "error":
-		l.o = level.AllowError()
-	default:
-		return fmt.Errorf("unrecognized log level %q", s)
-	}
-	l.s = s
-	return nil
-}
-
-// AllowedFormat is a settable identifier for the output format that the logger can have.
-type AllowedFormat struct {
-	s string
-}
-
-func (f *AllowedFormat) String() string {
-	return f.s
-}
-
-// Set updates the value of the allowed format.
-func (f *AllowedFormat) Set(s string) error {
-	switch s {
-	case "logfmt", "json":
-		f.s = s
-	default:
-		return fmt.Errorf("unrecognized log format %q", s)
-	}
-	return nil
-}
-
-// Config is a struct containing configurable settings for the logger
-type Config struct {
-	Level  *AllowedLevel
-	Format *AllowedFormat
-}
-
-// New returns a new leveled oklog logger. Each logged line will be annotated
-// with a timestamp. The output always goes to stderr.
-func New(config *Config) log.Logger {
-	if config.Format != nil && config.Format.s == "json" {
-		return NewWithLogger(log.NewJSONLogger(log.NewSyncWriter(os.Stderr)), config)
-	}
-
-	return NewWithLogger(log.NewLogfmtLogger(log.NewSyncWriter(os.Stderr)), config)
-}
-
-// NewWithLogger returns a new leveled oklog logger with a custom log.Logger.
-// Each logged line will be annotated with a timestamp.
-func NewWithLogger(l log.Logger, config *Config) log.Logger {
-	if config.Level != nil {
-		l = log.With(l, "ts", timestampFormat, "caller", log.Caller(5))
-		l = level.NewFilter(l, config.Level.o)
-	} else {
-		l = log.With(l, "ts", timestampFormat, "caller", log.DefaultCaller)
-	}
-	return l
-}
-
-// NewDynamic returns a new leveled logger. Each logged line will be annotated
-// with a timestamp. The output always goes to stderr. Some properties can be
-// changed, like the level.
-func NewDynamic(config *Config) *logger {
-	if config.Format != nil && config.Format.s == "json" {
-		return NewDynamicWithLogger(log.NewJSONLogger(log.NewSyncWriter(os.Stderr)), config)
-	}
-
-	return NewDynamicWithLogger(log.NewLogfmtLogger(log.NewSyncWriter(os.Stderr)), config)
-}
-
-// NewDynamicWithLogger returns a new leveled logger with a custom io.Writer.
-// Each logged line will be annotated with a timestamp.
-// Some properties can be changed, like the level.
-func NewDynamicWithLogger(l log.Logger, config *Config) *logger {
-	lo := &logger{
-		base:    l,
-		leveled: l,
-	}
-
-	if config.Level != nil {
-		lo.SetLevel(config.Level)
-	}
-
-	return lo
-}
-
-type logger struct {
-	base         log.Logger
-	leveled      log.Logger
-	currentLevel *AllowedLevel
-	mtx          sync.Mutex
-}
-
-// Log implements logger.Log.
-func (l *logger) Log(keyvals ...interface{}) error {
-	l.mtx.Lock()
-	defer l.mtx.Unlock()
-	return l.leveled.Log(keyvals...)
-}
-
-// SetLevel changes the log level.
-func (l *logger) SetLevel(lvl *AllowedLevel) {
-	l.mtx.Lock()
-	defer l.mtx.Unlock()
-	if lvl == nil {
-		l.leveled = log.With(l.base, "ts", timestampFormat, "caller", log.DefaultCaller)
-		l.currentLevel = nil
-		return
-	}
-
-	if l.currentLevel != nil && l.currentLevel.s != lvl.s {
-		_ = l.base.Log("msg", "Log level changed", "prev", l.currentLevel, "current", lvl)
-	}
-	l.currentLevel = lvl
-	l.leveled = level.NewFilter(log.With(l.base, "ts", timestampFormat, "caller", log.Caller(5)), lvl.o)
-}
diff --git a/vendor/github.com/prometheus/common/promslog/slog.go b/vendor/github.com/prometheus/common/promslog/slog.go
new file mode 100644
index 000000000..1677605af
--- /dev/null
+++ b/vendor/github.com/prometheus/common/promslog/slog.go
@@ -0,0 +1,198 @@
+// Copyright 2024 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package promslog defines standardised ways to initialize the Go standard
+// library's log/slog logger.
+// It should typically only ever be imported by main packages.
+
+package promslog
+
+import (
+	"fmt"
+	"io"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+)
+
+type LogStyle string
+
+const (
+	SlogStyle  LogStyle = "slog"
+	GoKitStyle LogStyle = "go-kit"
+)
+
+var (
+	LevelFlagOptions  = []string{"debug", "info", "warn", "error"}
+	FormatFlagOptions = []string{"logfmt", "json"}
+
+	callerAddFunc             = false
+	defaultWriter             = os.Stderr
+	goKitStyleReplaceAttrFunc = func(groups []string, a slog.Attr) slog.Attr {
+		key := a.Key
+		switch key {
+		case slog.TimeKey:
+			a.Key = "ts"
+
+			// This timestamp format differs from RFC3339Nano by using .000 instead
+			// of .999999999 which changes the timestamp from 9 variable to 3 fixed
+			// decimals (.130 instead of .130987456).
+			t := a.Value.Time()
+			a.Value = slog.StringValue(t.UTC().Format("2006-01-02T15:04:05.000Z07:00"))
+		case slog.SourceKey:
+			a.Key = "caller"
+			src, _ := a.Value.Any().(*slog.Source)
+
+			switch callerAddFunc {
+			case true:
+				a.Value = slog.StringValue(filepath.Base(src.File) + "(" + filepath.Base(src.Function) + "):" + strconv.Itoa(src.Line))
+			default:
+				a.Value = slog.StringValue(filepath.Base(src.File) + ":" + strconv.Itoa(src.Line))
+			}
+		case slog.LevelKey:
+			a.Value = slog.StringValue(strings.ToLower(a.Value.String()))
+		default:
+		}
+
+		return a
+	}
+	truncateSourceAttrFunc = func(groups []string, a slog.Attr) slog.Attr {
+		if a.Key != slog.SourceKey {
+			return a
+		}
+
+		if src, ok := a.Value.Any().(*slog.Source); ok {
+			a.Value = slog.StringValue(filepath.Base(src.File) + ":" + strconv.Itoa(src.Line))
+		}
+
+		return a
+	}
+)
+
+// AllowedLevel is a settable identifier for the minimum level a log entry
+// must be have.
+type AllowedLevel struct {
+	s   string
+	lvl *slog.LevelVar
+}
+
+func (l *AllowedLevel) UnmarshalYAML(unmarshal func(interface{}) error) error {
+	var s string
+	type plain string
+	if err := unmarshal((*plain)(&s)); err != nil {
+		return err
+	}
+	if s == "" {
+		return nil
+	}
+	lo := &AllowedLevel{}
+	if err := lo.Set(s); err != nil {
+		return err
+	}
+	*l = *lo
+	return nil
+}
+
+func (l *AllowedLevel) String() string {
+	return l.s
+}
+
+// Set updates the value of the allowed level.
+func (l *AllowedLevel) Set(s string) error {
+	if l.lvl == nil {
+		l.lvl = &slog.LevelVar{}
+	}
+
+	switch s {
+	case "debug":
+		l.lvl.Set(slog.LevelDebug)
+		callerAddFunc = true
+	case "info":
+		l.lvl.Set(slog.LevelInfo)
+		callerAddFunc = false
+	case "warn":
+		l.lvl.Set(slog.LevelWarn)
+		callerAddFunc = false
+	case "error":
+		l.lvl.Set(slog.LevelError)
+		callerAddFunc = false
+	default:
+		return fmt.Errorf("unrecognized log level %s", s)
+	}
+	l.s = s
+	return nil
+}
+
+// AllowedFormat is a settable identifier for the output format that the logger can have.
+type AllowedFormat struct {
+	s string
+}
+
+func (f *AllowedFormat) String() string {
+	return f.s
+}
+
+// Set updates the value of the allowed format.
+func (f *AllowedFormat) Set(s string) error {
+	switch s {
+	case "logfmt", "json":
+		f.s = s
+	default:
+		return fmt.Errorf("unrecognized log format %s", s)
+	}
+	return nil
+}
+
+// Config is a struct containing configurable settings for the logger
+type Config struct {
+	Level  *AllowedLevel
+	Format *AllowedFormat
+	Style  LogStyle
+	Writer io.Writer
+}
+
+// New returns a new slog.Logger. Each logged line will be annotated
+// with a timestamp. The output always goes to stderr.
+func New(config *Config) *slog.Logger {
+	if config.Level == nil {
+		config.Level = &AllowedLevel{}
+		_ = config.Level.Set("info")
+	}
+
+	if config.Writer == nil {
+		config.Writer = defaultWriter
+	}
+
+	logHandlerOpts := &slog.HandlerOptions{
+		Level:       config.Level.lvl,
+		AddSource:   true,
+		ReplaceAttr: truncateSourceAttrFunc,
+	}
+
+	if config.Style == GoKitStyle {
+		logHandlerOpts.ReplaceAttr = goKitStyleReplaceAttrFunc
+	}
+
+	if config.Format != nil && config.Format.s == "json" {
+		return slog.New(slog.NewJSONHandler(config.Writer, logHandlerOpts))
+	}
+	return slog.New(slog.NewTextHandler(config.Writer, logHandlerOpts))
+}
+
+// NewNopLogger is a convenience function to return an slog.Logger that writes
+// to io.Discard.
+func NewNopLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(io.Discard, nil))
+}
diff --git a/vendor/github.com/prometheus/exporter-toolkit/web/cache.go b/vendor/github.com/prometheus/exporter-toolkit/web/cache.go
index 9425e7ac9..252928eea 100644
--- a/vendor/github.com/prometheus/exporter-toolkit/web/cache.go
+++ b/vendor/github.com/prometheus/exporter-toolkit/web/cache.go
@@ -18,15 +18,10 @@ package web
 import (
 	weakrand "math/rand"
 	"sync"
-	"time"
 )
 
 var cacheSize = 100
 
-func init() {
-	weakrand.Seed(time.Now().UnixNano())
-}
-
 type cache struct {
 	cache map[string]bool
 	mtx   sync.Mutex
diff --git a/vendor/github.com/prometheus/exporter-toolkit/web/handler.go b/vendor/github.com/prometheus/exporter-toolkit/web/handler.go
index c607a163a..51da762c9 100644
--- a/vendor/github.com/prometheus/exporter-toolkit/web/handler.go
+++ b/vendor/github.com/prometheus/exporter-toolkit/web/handler.go
@@ -18,11 +18,11 @@ package web
 import (
 	"encoding/hex"
 	"fmt"
+	"log/slog"
 	"net/http"
 	"strings"
 	"sync"
 
-	"github.com/go-kit/log"
 	"golang.org/x/crypto/bcrypt"
 )
 
@@ -78,7 +78,7 @@ HeadersLoop:
 type webHandler struct {
 	tlsConfigPath string
 	handler       http.Handler
-	logger        log.Logger
+	logger        *slog.Logger
 	cache         *cache
 	// bcryptMtx is there to ensure that bcrypt.CompareHashAndPassword is run
 	// only once in parallel as this is CPU intensive.
@@ -88,7 +88,7 @@ type webHandler struct {
 func (u *webHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	c, err := getConfig(u.tlsConfigPath)
 	if err != nil {
-		u.logger.Log("msg", "Unable to parse configuration", "err", err)
+		u.logger.Error("Unable to parse configuration", "err", err.Error())
 		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
 		return
 	}
diff --git a/vendor/github.com/prometheus/exporter-toolkit/web/landing_page.css b/vendor/github.com/prometheus/exporter-toolkit/web/landing_page.css
index 260bc8a09..0dd728a9f 100644
--- a/vendor/github.com/prometheus/exporter-toolkit/web/landing_page.css
+++ b/vendor/github.com/prometheus/exporter-toolkit/web/landing_page.css
@@ -15,4 +15,9 @@ label {
   display: inline-block;
   width: {{.Form.Width}}em;
 }
+#pprof {
+  border: black 2px solid;
+  padding: 1rem;
+  width: fit-content;
+}
 {{.ExtraCSS}}
diff --git a/vendor/github.com/prometheus/exporter-toolkit/web/landing_page.html b/vendor/github.com/prometheus/exporter-toolkit/web/landing_page.html
index 4f2e18177..e1ac0aecd 100644
--- a/vendor/github.com/prometheus/exporter-toolkit/web/landing_page.html
+++ b/vendor/github.com/prometheus/exporter-toolkit/web/landing_page.html
@@ -30,6 +30,14 @@ <h1>{{.Name}}</h1>
       </div>
       {{ end }}
       {{ .ExtraHTML }}
+      <div id="pprof">
+      Download a detailed report of resource usage (pprof format, from the Go runtime):
+      <ul>
+        <li><a href="debug/pprof/heap">heap usage (memory)</a>
+        <li><a href="debug/pprof/profile?seconds=60">CPU usage (60 second profile)</a>
+      </ul>
+      To visualize and share profiles you can upload to <a href="https://pprof.me" target="_blank">pprof.me</a>
+      </div>
     </main>
   </body>
 </html>
diff --git a/vendor/github.com/prometheus/exporter-toolkit/web/tls_config.go b/vendor/github.com/prometheus/exporter-toolkit/web/tls_config.go
index 61383bce1..0730a938f 100644
--- a/vendor/github.com/prometheus/exporter-toolkit/web/tls_config.go
+++ b/vendor/github.com/prometheus/exporter-toolkit/web/tls_config.go
@@ -18,14 +18,17 @@ import (
 	"crypto/x509"
 	"errors"
 	"fmt"
+	"log/slog"
 	"net"
 	"net/http"
+	"net/url"
 	"os"
 	"path/filepath"
+	"strconv"
+	"strings"
 
 	"github.com/coreos/go-systemd/v22/activation"
-	"github.com/go-kit/log"
-	"github.com/go-kit/log/level"
+	"github.com/mdlayher/vsock"
 	config_util "github.com/prometheus/common/config"
 	"golang.org/x/sync/errgroup"
 	"gopkg.in/yaml.v2"
@@ -263,7 +266,7 @@ func ConfigToTLSConfig(c *TLSConfig) (*tls.Config, error) {
 
 // ServeMultiple starts the server on the given listeners. The FlagConfig is
 // also passed on to Serve.
-func ServeMultiple(listeners []net.Listener, server *http.Server, flags *FlagConfig, logger log.Logger) error {
+func ServeMultiple(listeners []net.Listener, server *http.Server, flags *FlagConfig, logger *slog.Logger) error {
 	errs := new(errgroup.Group)
 	for _, l := range listeners {
 		l := l
@@ -275,16 +278,18 @@ func ServeMultiple(listeners []net.Listener, server *http.Server, flags *FlagCon
 }
 
 // ListenAndServe starts the server on addresses given in WebListenAddresses in
-// the FlagConfig or instead uses systemd socket activated listeners if
-// WebSystemdSocket in the FlagConfig is true. The FlagConfig is also passed on
-// to ServeMultiple.
-func ListenAndServe(server *http.Server, flags *FlagConfig, logger log.Logger) error {
+// the FlagConfig. When address starts looks like vsock://:{port}, it listens on
+// vsock. More info check https://wiki.qemu.org/Features/VirtioVsock .
+// Or instead uses systemd socket activated listeners if WebSystemdSocket in the
+// FlagConfig is true.
+// The FlagConfig is also passed on to ServeMultiple.
+func ListenAndServe(server *http.Server, flags *FlagConfig, logger *slog.Logger) error {
 	if flags.WebSystemdSocket == nil && (flags.WebListenAddresses == nil || len(*flags.WebListenAddresses) == 0) {
 		return ErrNoListeners
 	}
 
 	if flags.WebSystemdSocket != nil && *flags.WebSystemdSocket {
-		level.Info(logger).Log("msg", "Listening on systemd activated listeners instead of port listeners.")
+		logger.Info("Listening on systemd activated listeners instead of port listeners.")
 		listeners, err := activation.Listeners()
 		if err != nil {
 			return err
@@ -297,9 +302,22 @@ func ListenAndServe(server *http.Server, flags *FlagConfig, logger log.Logger) e
 
 	listeners := make([]net.Listener, 0, len(*flags.WebListenAddresses))
 	for _, address := range *flags.WebListenAddresses {
-		listener, err := net.Listen("tcp", address)
-		if err != nil {
-			return err
+		var err error
+		var listener net.Listener
+		if strings.HasPrefix(address, "vsock://") {
+			port, err := parseVsockPort(address)
+			if err != nil {
+				return err
+			}
+			listener, err = vsock.Listen(port, nil)
+			if err != nil {
+				return err
+			}
+		} else {
+			listener, err = net.Listen("tcp", address)
+			if err != nil {
+				return err
+			}
 		}
 		defer listener.Close()
 		listeners = append(listeners, listener)
@@ -307,13 +325,29 @@ func ListenAndServe(server *http.Server, flags *FlagConfig, logger log.Logger) e
 	return ServeMultiple(listeners, server, flags, logger)
 }
 
+func parseVsockPort(address string) (uint32, error) {
+	uri, err := url.Parse(address)
+	if err != nil {
+		return 0, err
+	}
+	_, portStr, err := net.SplitHostPort(uri.Host)
+	if err != nil {
+		return 0, err
+	}
+	port, err := strconv.ParseUint(portStr, 10, 32)
+	if err != nil {
+		return 0, err
+	}
+	return uint32(port), nil
+}
+
 // Server starts the server on the given listener. Based on the file path
 // WebConfigFile in the FlagConfig, TLS or basic auth could be enabled.
-func Serve(l net.Listener, server *http.Server, flags *FlagConfig, logger log.Logger) error {
-	level.Info(logger).Log("msg", "Listening on", "address", l.Addr().String())
+func Serve(l net.Listener, server *http.Server, flags *FlagConfig, logger *slog.Logger) error {
+	logger.Info("Listening on", "address", l.Addr().String())
 	tlsConfigPath := *flags.WebConfigFile
 	if tlsConfigPath == "" {
-		level.Info(logger).Log("msg", "TLS is disabled.", "http2", false, "address", l.Addr().String())
+		logger.Info("TLS is disabled.", "http2", false, "address", l.Addr().String())
 		return server.Serve(l)
 	}
 
@@ -346,10 +380,10 @@ func Serve(l net.Listener, server *http.Server, flags *FlagConfig, logger log.Lo
 			server.TLSNextProto = make(map[string]func(*http.Server, *tls.Conn, http.Handler))
 		}
 		// Valid TLS config.
-		level.Info(logger).Log("msg", "TLS is enabled.", "http2", c.HTTPConfig.HTTP2, "address", l.Addr().String())
+		logger.Info("TLS is enabled.", "http2", c.HTTPConfig.HTTP2, "address", l.Addr().String())
 	case errNoTLSConfig:
 		// No TLS config, back to plain HTTP.
-		level.Info(logger).Log("msg", "TLS is disabled.", "http2", false, "address", l.Addr().String())
+		logger.Info("TLS is disabled.", "http2", false, "address", l.Addr().String())
 		return server.Serve(l)
 	default:
 		// Invalid TLS config.
@@ -477,6 +511,6 @@ func (tv *TLSVersion) MarshalYAML() (interface{}, error) {
 // tlsConfigPath, TLS or basic auth could be enabled.
 //
 // Deprecated: Use ListenAndServe instead.
-func Listen(server *http.Server, flags *FlagConfig, logger log.Logger) error {
+func Listen(server *http.Server, flags *FlagConfig, logger *slog.Logger) error {
 	return ListenAndServe(server, flags, logger)
 }
diff --git a/vendor/golang.org/x/net/bpf/asm.go b/vendor/golang.org/x/net/bpf/asm.go
new file mode 100644
index 000000000..15e21b181
--- /dev/null
+++ b/vendor/golang.org/x/net/bpf/asm.go
@@ -0,0 +1,41 @@
+// Copyright 2016 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package bpf
+
+import "fmt"
+
+// Assemble converts insts into raw instructions suitable for loading
+// into a BPF virtual machine.
+//
+// Currently, no optimization is attempted, the assembled program flow
+// is exactly as provided.
+func Assemble(insts []Instruction) ([]RawInstruction, error) {
+	ret := make([]RawInstruction, len(insts))
+	var err error
+	for i, inst := range insts {
+		ret[i], err = inst.Assemble()
+		if err != nil {
+			return nil, fmt.Errorf("assembling instruction %d: %s", i+1, err)
+		}
+	}
+	return ret, nil
+}
+
+// Disassemble attempts to parse raw back into
+// Instructions. Unrecognized RawInstructions are assumed to be an
+// extension not implemented by this package, and are passed through
+// unchanged to the output. The allDecoded value reports whether insts
+// contains no RawInstructions.
+func Disassemble(raw []RawInstruction) (insts []Instruction, allDecoded bool) {
+	insts = make([]Instruction, len(raw))
+	allDecoded = true
+	for i, r := range raw {
+		insts[i] = r.Disassemble()
+		if _, ok := insts[i].(RawInstruction); ok {
+			allDecoded = false
+		}
+	}
+	return insts, allDecoded
+}
diff --git a/vendor/golang.org/x/net/bpf/constants.go b/vendor/golang.org/x/net/bpf/constants.go
new file mode 100644
index 000000000..12f3ee835
--- /dev/null
+++ b/vendor/golang.org/x/net/bpf/constants.go
@@ -0,0 +1,222 @@
+// Copyright 2016 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package bpf
+
+// A Register is a register of the BPF virtual machine.
+type Register uint16
+
+const (
+	// RegA is the accumulator register. RegA is always the
+	// destination register of ALU operations.
+	RegA Register = iota
+	// RegX is the indirection register, used by LoadIndirect
+	// operations.
+	RegX
+)
+
+// An ALUOp is an arithmetic or logic operation.
+type ALUOp uint16
+
+// ALU binary operation types.
+const (
+	ALUOpAdd ALUOp = iota << 4
+	ALUOpSub
+	ALUOpMul
+	ALUOpDiv
+	ALUOpOr
+	ALUOpAnd
+	ALUOpShiftLeft
+	ALUOpShiftRight
+	aluOpNeg // Not exported because it's the only unary ALU operation, and gets its own instruction type.
+	ALUOpMod
+	ALUOpXor
+)
+
+// A JumpTest is a comparison operator used in conditional jumps.
+type JumpTest uint16
+
+// Supported operators for conditional jumps.
+// K can be RegX for JumpIfX
+const (
+	// K == A
+	JumpEqual JumpTest = iota
+	// K != A
+	JumpNotEqual
+	// K > A
+	JumpGreaterThan
+	// K < A
+	JumpLessThan
+	// K >= A
+	JumpGreaterOrEqual
+	// K <= A
+	JumpLessOrEqual
+	// K & A != 0
+	JumpBitsSet
+	// K & A == 0
+	JumpBitsNotSet
+)
+
+// An Extension is a function call provided by the kernel that
+// performs advanced operations that are expensive or impossible
+// within the BPF virtual machine.
+//
+// Extensions are only implemented by the Linux kernel.
+//
+// TODO: should we prune this list? Some of these extensions seem
+// either broken or near-impossible to use correctly, whereas other
+// (len, random, ifindex) are quite useful.
+type Extension int
+
+// Extension functions available in the Linux kernel.
+const (
+	// extOffset is the negative maximum number of instructions used
+	// to load instructions by overloading the K argument.
+	extOffset = -0x1000
+	// ExtLen returns the length of the packet.
+	ExtLen Extension = 1
+	// ExtProto returns the packet's L3 protocol type.
+	ExtProto Extension = 0
+	// ExtType returns the packet's type (skb->pkt_type in the kernel)
+	//
+	// TODO: better documentation. How nice an API do we want to
+	// provide for these esoteric extensions?
+	ExtType Extension = 4
+	// ExtPayloadOffset returns the offset of the packet payload, or
+	// the first protocol header that the kernel does not know how to
+	// parse.
+	ExtPayloadOffset Extension = 52
+	// ExtInterfaceIndex returns the index of the interface on which
+	// the packet was received.
+	ExtInterfaceIndex Extension = 8
+	// ExtNetlinkAttr returns the netlink attribute of type X at
+	// offset A.
+	ExtNetlinkAttr Extension = 12
+	// ExtNetlinkAttrNested returns the nested netlink attribute of
+	// type X at offset A.
+	ExtNetlinkAttrNested Extension = 16
+	// ExtMark returns the packet's mark value.
+	ExtMark Extension = 20
+	// ExtQueue returns the packet's assigned hardware queue.
+	ExtQueue Extension = 24
+	// ExtLinkLayerType returns the packet's hardware address type
+	// (e.g. Ethernet, Infiniband).
+	ExtLinkLayerType Extension = 28
+	// ExtRXHash returns the packets receive hash.
+	//
+	// TODO: figure out what this rxhash actually is.
+	ExtRXHash Extension = 32
+	// ExtCPUID returns the ID of the CPU processing the current
+	// packet.
+	ExtCPUID Extension = 36
+	// ExtVLANTag returns the packet's VLAN tag.
+	ExtVLANTag Extension = 44
+	// ExtVLANTagPresent returns non-zero if the packet has a VLAN
+	// tag.
+	//
+	// TODO: I think this might be a lie: it reads bit 0x1000 of the
+	// VLAN header, which changed meaning in recent revisions of the
+	// spec - this extension may now return meaningless information.
+	ExtVLANTagPresent Extension = 48
+	// ExtVLANProto returns 0x8100 if the frame has a VLAN header,
+	// 0x88a8 if the frame has a "Q-in-Q" double VLAN header, or some
+	// other value if no VLAN information is present.
+	ExtVLANProto Extension = 60
+	// ExtRand returns a uniformly random uint32.
+	ExtRand Extension = 56
+)
+
+// The following gives names to various bit patterns used in opcode construction.
+
+const (
+	opMaskCls uint16 = 0x7
+	// opClsLoad masks
+	opMaskLoadDest  = 0x01
+	opMaskLoadWidth = 0x18
+	opMaskLoadMode  = 0xe0
+	// opClsALU & opClsJump
+	opMaskOperand  = 0x08
+	opMaskOperator = 0xf0
+)
+
+const (
+	// +---------------+-----------------+---+---+---+
+	// | AddrMode (3b) | LoadWidth (2b)  | 0 | 0 | 0 |
+	// +---------------+-----------------+---+---+---+
+	opClsLoadA uint16 = iota
+	// +---------------+-----------------+---+---+---+
+	// | AddrMode (3b) | LoadWidth (2b)  | 0 | 0 | 1 |
+	// +---------------+-----------------+---+---+---+
+	opClsLoadX
+	// +---+---+---+---+---+---+---+---+
+	// | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 |
+	// +---+---+---+---+---+---+---+---+
+	opClsStoreA
+	// +---+---+---+---+---+---+---+---+
+	// | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 1 |
+	// +---+---+---+---+---+---+---+---+
+	opClsStoreX
+	// +---------------+-----------------+---+---+---+
+	// | Operator (4b) | OperandSrc (1b) | 1 | 0 | 0 |
+	// +---------------+-----------------+---+---+---+
+	opClsALU
+	// +-----------------------------+---+---+---+---+
+	// |      TestOperator (4b)      | 0 | 1 | 0 | 1 |
+	// +-----------------------------+---+---+---+---+
+	opClsJump
+	// +---+-------------------------+---+---+---+---+
+	// | 0 | 0 | 0 |   RetSrc (1b)   | 0 | 1 | 1 | 0 |
+	// +---+-------------------------+---+---+---+---+
+	opClsReturn
+	// +---+-------------------------+---+---+---+---+
+	// | 0 | 0 | 0 |  TXAorTAX (1b)  | 0 | 1 | 1 | 1 |
+	// +---+-------------------------+---+---+---+---+
+	opClsMisc
+)
+
+const (
+	opAddrModeImmediate uint16 = iota << 5
+	opAddrModeAbsolute
+	opAddrModeIndirect
+	opAddrModeScratch
+	opAddrModePacketLen // actually an extension, not an addressing mode.
+	opAddrModeMemShift
+)
+
+const (
+	opLoadWidth4 uint16 = iota << 3
+	opLoadWidth2
+	opLoadWidth1
+)
+
+// Operand for ALU and Jump instructions
+type opOperand uint16
+
+// Supported operand sources.
+const (
+	opOperandConstant opOperand = iota << 3
+	opOperandX
+)
+
+// An jumpOp is a conditional jump condition.
+type jumpOp uint16
+
+// Supported jump conditions.
+const (
+	opJumpAlways jumpOp = iota << 4
+	opJumpEqual
+	opJumpGT
+	opJumpGE
+	opJumpSet
+)
+
+const (
+	opRetSrcConstant uint16 = iota << 4
+	opRetSrcA
+)
+
+const (
+	opMiscTAX = 0x00
+	opMiscTXA = 0x80
+)
diff --git a/vendor/golang.org/x/net/bpf/doc.go b/vendor/golang.org/x/net/bpf/doc.go
new file mode 100644
index 000000000..04ec1c8ab
--- /dev/null
+++ b/vendor/golang.org/x/net/bpf/doc.go
@@ -0,0 +1,80 @@
+// Copyright 2016 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+/*
+Package bpf implements marshaling and unmarshaling of programs for the
+Berkeley Packet Filter virtual machine, and provides a Go implementation
+of the virtual machine.
+
+BPF's main use is to specify a packet filter for network taps, so that
+the kernel doesn't have to expensively copy every packet it sees to
+userspace. However, it's been repurposed to other areas where running
+user code in-kernel is needed. For example, Linux's seccomp uses BPF
+to apply security policies to system calls. For simplicity, this
+documentation refers only to packets, but other uses of BPF have their
+own data payloads.
+
+BPF programs run in a restricted virtual machine. It has almost no
+access to kernel functions, and while conditional branches are
+allowed, they can only jump forwards, to guarantee that there are no
+infinite loops.
+
+# The virtual machine
+
+The BPF VM is an accumulator machine. Its main register, called
+register A, is an implicit source and destination in all arithmetic
+and logic operations. The machine also has 16 scratch registers for
+temporary storage, and an indirection register (register X) for
+indirect memory access. All registers are 32 bits wide.
+
+Each run of a BPF program is given one packet, which is placed in the
+VM's read-only "main memory". LoadAbsolute and LoadIndirect
+instructions can fetch up to 32 bits at a time into register A for
+examination.
+
+The goal of a BPF program is to produce and return a verdict (uint32),
+which tells the kernel what to do with the packet. In the context of
+packet filtering, the returned value is the number of bytes of the
+packet to forward to userspace, or 0 to ignore the packet. Other
+contexts like seccomp define their own return values.
+
+In order to simplify programs, attempts to read past the end of the
+packet terminate the program execution with a verdict of 0 (ignore
+packet). This means that the vast majority of BPF programs don't need
+to do any explicit bounds checking.
+
+In addition to the bytes of the packet, some BPF programs have access
+to extensions, which are essentially calls to kernel utility
+functions. Currently, the only extensions supported by this package
+are the Linux packet filter extensions.
+
+# Examples
+
+This packet filter selects all ARP packets.
+
+	bpf.Assemble([]bpf.Instruction{
+		// Load "EtherType" field from the ethernet header.
+		bpf.LoadAbsolute{Off: 12, Size: 2},
+		// Skip over the next instruction if EtherType is not ARP.
+		bpf.JumpIf{Cond: bpf.JumpNotEqual, Val: 0x0806, SkipTrue: 1},
+		// Verdict is "send up to 4k of the packet to userspace."
+		bpf.RetConstant{Val: 4096},
+		// Verdict is "ignore packet."
+		bpf.RetConstant{Val: 0},
+	})
+
+This packet filter captures a random 1% sample of traffic.
+
+	bpf.Assemble([]bpf.Instruction{
+		// Get a 32-bit random number from the Linux kernel.
+		bpf.LoadExtension{Num: bpf.ExtRand},
+		// 1% dice roll?
+		bpf.JumpIf{Cond: bpf.JumpLessThan, Val: 2^32/100, SkipFalse: 1},
+		// Capture.
+		bpf.RetConstant{Val: 4096},
+		// Ignore.
+		bpf.RetConstant{Val: 0},
+	})
+*/
+package bpf // import "golang.org/x/net/bpf"
diff --git a/vendor/golang.org/x/net/bpf/instructions.go b/vendor/golang.org/x/net/bpf/instructions.go
new file mode 100644
index 000000000..3cffcaa01
--- /dev/null
+++ b/vendor/golang.org/x/net/bpf/instructions.go
@@ -0,0 +1,726 @@
+// Copyright 2016 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package bpf
+
+import "fmt"
+
+// An Instruction is one instruction executed by the BPF virtual
+// machine.
+type Instruction interface {
+	// Assemble assembles the Instruction into a RawInstruction.
+	Assemble() (RawInstruction, error)
+}
+
+// A RawInstruction is a raw BPF virtual machine instruction.
+type RawInstruction struct {
+	// Operation to execute.
+	Op uint16
+	// For conditional jump instructions, the number of instructions
+	// to skip if the condition is true/false.
+	Jt uint8
+	Jf uint8
+	// Constant parameter. The meaning depends on the Op.
+	K uint32
+}
+
+// Assemble implements the Instruction Assemble method.
+func (ri RawInstruction) Assemble() (RawInstruction, error) { return ri, nil }
+
+// Disassemble parses ri into an Instruction and returns it. If ri is
+// not recognized by this package, ri itself is returned.
+func (ri RawInstruction) Disassemble() Instruction {
+	switch ri.Op & opMaskCls {
+	case opClsLoadA, opClsLoadX:
+		reg := Register(ri.Op & opMaskLoadDest)
+		sz := 0
+		switch ri.Op & opMaskLoadWidth {
+		case opLoadWidth4:
+			sz = 4
+		case opLoadWidth2:
+			sz = 2
+		case opLoadWidth1:
+			sz = 1
+		default:
+			return ri
+		}
+		switch ri.Op & opMaskLoadMode {
+		case opAddrModeImmediate:
+			if sz != 4 {
+				return ri
+			}
+			return LoadConstant{Dst: reg, Val: ri.K}
+		case opAddrModeScratch:
+			if sz != 4 || ri.K > 15 {
+				return ri
+			}
+			return LoadScratch{Dst: reg, N: int(ri.K)}
+		case opAddrModeAbsolute:
+			if ri.K > extOffset+0xffffffff {
+				return LoadExtension{Num: Extension(-extOffset + ri.K)}
+			}
+			return LoadAbsolute{Size: sz, Off: ri.K}
+		case opAddrModeIndirect:
+			return LoadIndirect{Size: sz, Off: ri.K}
+		case opAddrModePacketLen:
+			if sz != 4 {
+				return ri
+			}
+			return LoadExtension{Num: ExtLen}
+		case opAddrModeMemShift:
+			return LoadMemShift{Off: ri.K}
+		default:
+			return ri
+		}
+
+	case opClsStoreA:
+		if ri.Op != opClsStoreA || ri.K > 15 {
+			return ri
+		}
+		return StoreScratch{Src: RegA, N: int(ri.K)}
+
+	case opClsStoreX:
+		if ri.Op != opClsStoreX || ri.K > 15 {
+			return ri
+		}
+		return StoreScratch{Src: RegX, N: int(ri.K)}
+
+	case opClsALU:
+		switch op := ALUOp(ri.Op & opMaskOperator); op {
+		case ALUOpAdd, ALUOpSub, ALUOpMul, ALUOpDiv, ALUOpOr, ALUOpAnd, ALUOpShiftLeft, ALUOpShiftRight, ALUOpMod, ALUOpXor:
+			switch operand := opOperand(ri.Op & opMaskOperand); operand {
+			case opOperandX:
+				return ALUOpX{Op: op}
+			case opOperandConstant:
+				return ALUOpConstant{Op: op, Val: ri.K}
+			default:
+				return ri
+			}
+		case aluOpNeg:
+			return NegateA{}
+		default:
+			return ri
+		}
+
+	case opClsJump:
+		switch op := jumpOp(ri.Op & opMaskOperator); op {
+		case opJumpAlways:
+			return Jump{Skip: ri.K}
+		case opJumpEqual, opJumpGT, opJumpGE, opJumpSet:
+			cond, skipTrue, skipFalse := jumpOpToTest(op, ri.Jt, ri.Jf)
+			switch operand := opOperand(ri.Op & opMaskOperand); operand {
+			case opOperandX:
+				return JumpIfX{Cond: cond, SkipTrue: skipTrue, SkipFalse: skipFalse}
+			case opOperandConstant:
+				return JumpIf{Cond: cond, Val: ri.K, SkipTrue: skipTrue, SkipFalse: skipFalse}
+			default:
+				return ri
+			}
+		default:
+			return ri
+		}
+
+	case opClsReturn:
+		switch ri.Op {
+		case opClsReturn | opRetSrcA:
+			return RetA{}
+		case opClsReturn | opRetSrcConstant:
+			return RetConstant{Val: ri.K}
+		default:
+			return ri
+		}
+
+	case opClsMisc:
+		switch ri.Op {
+		case opClsMisc | opMiscTAX:
+			return TAX{}
+		case opClsMisc | opMiscTXA:
+			return TXA{}
+		default:
+			return ri
+		}
+
+	default:
+		panic("unreachable") // switch is exhaustive on the bit pattern
+	}
+}
+
+func jumpOpToTest(op jumpOp, skipTrue uint8, skipFalse uint8) (JumpTest, uint8, uint8) {
+	var test JumpTest
+
+	// Decode "fake" jump conditions that don't appear in machine code
+	// Ensures the Assemble -> Disassemble stage recreates the same instructions
+	// See https://github.com/golang/go/issues/18470
+	if skipTrue == 0 {
+		switch op {
+		case opJumpEqual:
+			test = JumpNotEqual
+		case opJumpGT:
+			test = JumpLessOrEqual
+		case opJumpGE:
+			test = JumpLessThan
+		case opJumpSet:
+			test = JumpBitsNotSet
+		}
+
+		return test, skipFalse, 0
+	}
+
+	switch op {
+	case opJumpEqual:
+		test = JumpEqual
+	case opJumpGT:
+		test = JumpGreaterThan
+	case opJumpGE:
+		test = JumpGreaterOrEqual
+	case opJumpSet:
+		test = JumpBitsSet
+	}
+
+	return test, skipTrue, skipFalse
+}
+
+// LoadConstant loads Val into register Dst.
+type LoadConstant struct {
+	Dst Register
+	Val uint32
+}
+
+// Assemble implements the Instruction Assemble method.
+func (a LoadConstant) Assemble() (RawInstruction, error) {
+	return assembleLoad(a.Dst, 4, opAddrModeImmediate, a.Val)
+}
+
+// String returns the instruction in assembler notation.
+func (a LoadConstant) String() string {
+	switch a.Dst {
+	case RegA:
+		return fmt.Sprintf("ld #%d", a.Val)
+	case RegX:
+		return fmt.Sprintf("ldx #%d", a.Val)
+	default:
+		return fmt.Sprintf("unknown instruction: %#v", a)
+	}
+}
+
+// LoadScratch loads scratch[N] into register Dst.
+type LoadScratch struct {
+	Dst Register
+	N   int // 0-15
+}
+
+// Assemble implements the Instruction Assemble method.
+func (a LoadScratch) Assemble() (RawInstruction, error) {
+	if a.N < 0 || a.N > 15 {
+		return RawInstruction{}, fmt.Errorf("invalid scratch slot %d", a.N)
+	}
+	return assembleLoad(a.Dst, 4, opAddrModeScratch, uint32(a.N))
+}
+
+// String returns the instruction in assembler notation.
+func (a LoadScratch) String() string {
+	switch a.Dst {
+	case RegA:
+		return fmt.Sprintf("ld M[%d]", a.N)
+	case RegX:
+		return fmt.Sprintf("ldx M[%d]", a.N)
+	default:
+		return fmt.Sprintf("unknown instruction: %#v", a)
+	}
+}
+
+// LoadAbsolute loads packet[Off:Off+Size] as an integer value into
+// register A.
+type LoadAbsolute struct {
+	Off  uint32
+	Size int // 1, 2 or 4
+}
+
+// Assemble implements the Instruction Assemble method.
+func (a LoadAbsolute) Assemble() (RawInstruction, error) {
+	return assembleLoad(RegA, a.Size, opAddrModeAbsolute, a.Off)
+}
+
+// String returns the instruction in assembler notation.
+func (a LoadAbsolute) String() string {
+	switch a.Size {
+	case 1: // byte
+		return fmt.Sprintf("ldb [%d]", a.Off)
+	case 2: // half word
+		return fmt.Sprintf("ldh [%d]", a.Off)
+	case 4: // word
+		if a.Off > extOffset+0xffffffff {
+			return LoadExtension{Num: Extension(a.Off + 0x1000)}.String()
+		}
+		return fmt.Sprintf("ld [%d]", a.Off)
+	default:
+		return fmt.Sprintf("unknown instruction: %#v", a)
+	}
+}
+
+// LoadIndirect loads packet[X+Off:X+Off+Size] as an integer value
+// into register A.
+type LoadIndirect struct {
+	Off  uint32
+	Size int // 1, 2 or 4
+}
+
+// Assemble implements the Instruction Assemble method.
+func (a LoadIndirect) Assemble() (RawInstruction, error) {
+	return assembleLoad(RegA, a.Size, opAddrModeIndirect, a.Off)
+}
+
+// String returns the instruction in assembler notation.
+func (a LoadIndirect) String() string {
+	switch a.Size {
+	case 1: // byte
+		return fmt.Sprintf("ldb [x + %d]", a.Off)
+	case 2: // half word
+		return fmt.Sprintf("ldh [x + %d]", a.Off)
+	case 4: // word
+		return fmt.Sprintf("ld [x + %d]", a.Off)
+	default:
+		return fmt.Sprintf("unknown instruction: %#v", a)
+	}
+}
+
+// LoadMemShift multiplies the first 4 bits of the byte at packet[Off]
+// by 4 and stores the result in register X.
+//
+// This instruction is mainly useful to load into X the length of an
+// IPv4 packet header in a single instruction, rather than have to do
+// the arithmetic on the header's first byte by hand.
+type LoadMemShift struct {
+	Off uint32
+}
+
+// Assemble implements the Instruction Assemble method.
+func (a LoadMemShift) Assemble() (RawInstruction, error) {
+	return assembleLoad(RegX, 1, opAddrModeMemShift, a.Off)
+}
+
+// String returns the instruction in assembler notation.
+func (a LoadMemShift) String() string {
+	return fmt.Sprintf("ldx 4*([%d]&0xf)", a.Off)
+}
+
+// LoadExtension invokes a linux-specific extension and stores the
+// result in register A.
+type LoadExtension struct {
+	Num Extension
+}
+
+// Assemble implements the Instruction Assemble method.
+func (a LoadExtension) Assemble() (RawInstruction, error) {
+	if a.Num == ExtLen {
+		return assembleLoad(RegA, 4, opAddrModePacketLen, 0)
+	}
+	return assembleLoad(RegA, 4, opAddrModeAbsolute, uint32(extOffset+a.Num))
+}
+
+// String returns the instruction in assembler notation.
+func (a LoadExtension) String() string {
+	switch a.Num {
+	case ExtLen:
+		return "ld #len"
+	case ExtProto:
+		return "ld #proto"
+	case ExtType:
+		return "ld #type"
+	case ExtPayloadOffset:
+		return "ld #poff"
+	case ExtInterfaceIndex:
+		return "ld #ifidx"
+	case ExtNetlinkAttr:
+		return "ld #nla"
+	case ExtNetlinkAttrNested:
+		return "ld #nlan"
+	case ExtMark:
+		return "ld #mark"
+	case ExtQueue:
+		return "ld #queue"
+	case ExtLinkLayerType:
+		return "ld #hatype"
+	case ExtRXHash:
+		return "ld #rxhash"
+	case ExtCPUID:
+		return "ld #cpu"
+	case ExtVLANTag:
+		return "ld #vlan_tci"
+	case ExtVLANTagPresent:
+		return "ld #vlan_avail"
+	case ExtVLANProto:
+		return "ld #vlan_tpid"
+	case ExtRand:
+		return "ld #rand"
+	default:
+		return fmt.Sprintf("unknown instruction: %#v", a)
+	}
+}
+
+// StoreScratch stores register Src into scratch[N].
+type StoreScratch struct {
+	Src Register
+	N   int // 0-15
+}
+
+// Assemble implements the Instruction Assemble method.
+func (a StoreScratch) Assemble() (RawInstruction, error) {
+	if a.N < 0 || a.N > 15 {
+		return RawInstruction{}, fmt.Errorf("invalid scratch slot %d", a.N)
+	}
+	var op uint16
+	switch a.Src {
+	case RegA:
+		op = opClsStoreA
+	case RegX:
+		op = opClsStoreX
+	default:
+		return RawInstruction{}, fmt.Errorf("invalid source register %v", a.Src)
+	}
+
+	return RawInstruction{
+		Op: op,
+		K:  uint32(a.N),
+	}, nil
+}
+
+// String returns the instruction in assembler notation.
+func (a StoreScratch) String() string {
+	switch a.Src {
+	case RegA:
+		return fmt.Sprintf("st M[%d]", a.N)
+	case RegX:
+		return fmt.Sprintf("stx M[%d]", a.N)
+	default:
+		return fmt.Sprintf("unknown instruction: %#v", a)
+	}
+}
+
+// ALUOpConstant executes A = A <Op> Val.
+type ALUOpConstant struct {
+	Op  ALUOp
+	Val uint32
+}
+
+// Assemble implements the Instruction Assemble method.
+func (a ALUOpConstant) Assemble() (RawInstruction, error) {
+	return RawInstruction{
+		Op: opClsALU | uint16(opOperandConstant) | uint16(a.Op),
+		K:  a.Val,
+	}, nil
+}
+
+// String returns the instruction in assembler notation.
+func (a ALUOpConstant) String() string {
+	switch a.Op {
+	case ALUOpAdd:
+		return fmt.Sprintf("add #%d", a.Val)
+	case ALUOpSub:
+		return fmt.Sprintf("sub #%d", a.Val)
+	case ALUOpMul:
+		return fmt.Sprintf("mul #%d", a.Val)
+	case ALUOpDiv:
+		return fmt.Sprintf("div #%d", a.Val)
+	case ALUOpMod:
+		return fmt.Sprintf("mod #%d", a.Val)
+	case ALUOpAnd:
+		return fmt.Sprintf("and #%d", a.Val)
+	case ALUOpOr:
+		return fmt.Sprintf("or #%d", a.Val)
+	case ALUOpXor:
+		return fmt.Sprintf("xor #%d", a.Val)
+	case ALUOpShiftLeft:
+		return fmt.Sprintf("lsh #%d", a.Val)
+	case ALUOpShiftRight:
+		return fmt.Sprintf("rsh #%d", a.Val)
+	default:
+		return fmt.Sprintf("unknown instruction: %#v", a)
+	}
+}
+
+// ALUOpX executes A = A <Op> X
+type ALUOpX struct {
+	Op ALUOp
+}
+
+// Assemble implements the Instruction Assemble method.
+func (a ALUOpX) Assemble() (RawInstruction, error) {
+	return RawInstruction{
+		Op: opClsALU | uint16(opOperandX) | uint16(a.Op),
+	}, nil
+}
+
+// String returns the instruction in assembler notation.
+func (a ALUOpX) String() string {
+	switch a.Op {
+	case ALUOpAdd:
+		return "add x"
+	case ALUOpSub:
+		return "sub x"
+	case ALUOpMul:
+		return "mul x"
+	case ALUOpDiv:
+		return "div x"
+	case ALUOpMod:
+		return "mod x"
+	case ALUOpAnd:
+		return "and x"
+	case ALUOpOr:
+		return "or x"
+	case ALUOpXor:
+		return "xor x"
+	case ALUOpShiftLeft:
+		return "lsh x"
+	case ALUOpShiftRight:
+		return "rsh x"
+	default:
+		return fmt.Sprintf("unknown instruction: %#v", a)
+	}
+}
+
+// NegateA executes A = -A.
+type NegateA struct{}
+
+// Assemble implements the Instruction Assemble method.
+func (a NegateA) Assemble() (RawInstruction, error) {
+	return RawInstruction{
+		Op: opClsALU | uint16(aluOpNeg),
+	}, nil
+}
+
+// String returns the instruction in assembler notation.
+func (a NegateA) String() string {
+	return fmt.Sprintf("neg")
+}
+
+// Jump skips the following Skip instructions in the program.
+type Jump struct {
+	Skip uint32
+}
+
+// Assemble implements the Instruction Assemble method.
+func (a Jump) Assemble() (RawInstruction, error) {
+	return RawInstruction{
+		Op: opClsJump | uint16(opJumpAlways),
+		K:  a.Skip,
+	}, nil
+}
+
+// String returns the instruction in assembler notation.
+func (a Jump) String() string {
+	return fmt.Sprintf("ja %d", a.Skip)
+}
+
+// JumpIf skips the following Skip instructions in the program if A
+// <Cond> Val is true.
+type JumpIf struct {
+	Cond      JumpTest
+	Val       uint32
+	SkipTrue  uint8
+	SkipFalse uint8
+}
+
+// Assemble implements the Instruction Assemble method.
+func (a JumpIf) Assemble() (RawInstruction, error) {
+	return jumpToRaw(a.Cond, opOperandConstant, a.Val, a.SkipTrue, a.SkipFalse)
+}
+
+// String returns the instruction in assembler notation.
+func (a JumpIf) String() string {
+	return jumpToString(a.Cond, fmt.Sprintf("#%d", a.Val), a.SkipTrue, a.SkipFalse)
+}
+
+// JumpIfX skips the following Skip instructions in the program if A
+// <Cond> X is true.
+type JumpIfX struct {
+	Cond      JumpTest
+	SkipTrue  uint8
+	SkipFalse uint8
+}
+
+// Assemble implements the Instruction Assemble method.
+func (a JumpIfX) Assemble() (RawInstruction, error) {
+	return jumpToRaw(a.Cond, opOperandX, 0, a.SkipTrue, a.SkipFalse)
+}
+
+// String returns the instruction in assembler notation.
+func (a JumpIfX) String() string {
+	return jumpToString(a.Cond, "x", a.SkipTrue, a.SkipFalse)
+}
+
+// jumpToRaw assembles a jump instruction into a RawInstruction
+func jumpToRaw(test JumpTest, operand opOperand, k uint32, skipTrue, skipFalse uint8) (RawInstruction, error) {
+	var (
+		cond jumpOp
+		flip bool
+	)
+	switch test {
+	case JumpEqual:
+		cond = opJumpEqual
+	case JumpNotEqual:
+		cond, flip = opJumpEqual, true
+	case JumpGreaterThan:
+		cond = opJumpGT
+	case JumpLessThan:
+		cond, flip = opJumpGE, true
+	case JumpGreaterOrEqual:
+		cond = opJumpGE
+	case JumpLessOrEqual:
+		cond, flip = opJumpGT, true
+	case JumpBitsSet:
+		cond = opJumpSet
+	case JumpBitsNotSet:
+		cond, flip = opJumpSet, true
+	default:
+		return RawInstruction{}, fmt.Errorf("unknown JumpTest %v", test)
+	}
+	jt, jf := skipTrue, skipFalse
+	if flip {
+		jt, jf = jf, jt
+	}
+	return RawInstruction{
+		Op: opClsJump | uint16(cond) | uint16(operand),
+		Jt: jt,
+		Jf: jf,
+		K:  k,
+	}, nil
+}
+
+// jumpToString converts a jump instruction to assembler notation
+func jumpToString(cond JumpTest, operand string, skipTrue, skipFalse uint8) string {
+	switch cond {
+	// K == A
+	case JumpEqual:
+		return conditionalJump(operand, skipTrue, skipFalse, "jeq", "jneq")
+	// K != A
+	case JumpNotEqual:
+		return fmt.Sprintf("jneq %s,%d", operand, skipTrue)
+	// K > A
+	case JumpGreaterThan:
+		return conditionalJump(operand, skipTrue, skipFalse, "jgt", "jle")
+	// K < A
+	case JumpLessThan:
+		return fmt.Sprintf("jlt %s,%d", operand, skipTrue)
+	// K >= A
+	case JumpGreaterOrEqual:
+		return conditionalJump(operand, skipTrue, skipFalse, "jge", "jlt")
+	// K <= A
+	case JumpLessOrEqual:
+		return fmt.Sprintf("jle %s,%d", operand, skipTrue)
+	// K & A != 0
+	case JumpBitsSet:
+		if skipFalse > 0 {
+			return fmt.Sprintf("jset %s,%d,%d", operand, skipTrue, skipFalse)
+		}
+		return fmt.Sprintf("jset %s,%d", operand, skipTrue)
+	// K & A == 0, there is no assembler instruction for JumpBitNotSet, use JumpBitSet and invert skips
+	case JumpBitsNotSet:
+		return jumpToString(JumpBitsSet, operand, skipFalse, skipTrue)
+	default:
+		return fmt.Sprintf("unknown JumpTest %#v", cond)
+	}
+}
+
+func conditionalJump(operand string, skipTrue, skipFalse uint8, positiveJump, negativeJump string) string {
+	if skipTrue > 0 {
+		if skipFalse > 0 {
+			return fmt.Sprintf("%s %s,%d,%d", positiveJump, operand, skipTrue, skipFalse)
+		}
+		return fmt.Sprintf("%s %s,%d", positiveJump, operand, skipTrue)
+	}
+	return fmt.Sprintf("%s %s,%d", negativeJump, operand, skipFalse)
+}
+
+// RetA exits the BPF program, returning the value of register A.
+type RetA struct{}
+
+// Assemble implements the Instruction Assemble method.
+func (a RetA) Assemble() (RawInstruction, error) {
+	return RawInstruction{
+		Op: opClsReturn | opRetSrcA,
+	}, nil
+}
+
+// String returns the instruction in assembler notation.
+func (a RetA) String() string {
+	return fmt.Sprintf("ret a")
+}
+
+// RetConstant exits the BPF program, returning a constant value.
+type RetConstant struct {
+	Val uint32
+}
+
+// Assemble implements the Instruction Assemble method.
+func (a RetConstant) Assemble() (RawInstruction, error) {
+	return RawInstruction{
+		Op: opClsReturn | opRetSrcConstant,
+		K:  a.Val,
+	}, nil
+}
+
+// String returns the instruction in assembler notation.
+func (a RetConstant) String() string {
+	return fmt.Sprintf("ret #%d", a.Val)
+}
+
+// TXA copies the value of register X to register A.
+type TXA struct{}
+
+// Assemble implements the Instruction Assemble method.
+func (a TXA) Assemble() (RawInstruction, error) {
+	return RawInstruction{
+		Op: opClsMisc | opMiscTXA,
+	}, nil
+}
+
+// String returns the instruction in assembler notation.
+func (a TXA) String() string {
+	return fmt.Sprintf("txa")
+}
+
+// TAX copies the value of register A to register X.
+type TAX struct{}
+
+// Assemble implements the Instruction Assemble method.
+func (a TAX) Assemble() (RawInstruction, error) {
+	return RawInstruction{
+		Op: opClsMisc | opMiscTAX,
+	}, nil
+}
+
+// String returns the instruction in assembler notation.
+func (a TAX) String() string {
+	return fmt.Sprintf("tax")
+}
+
+func assembleLoad(dst Register, loadSize int, mode uint16, k uint32) (RawInstruction, error) {
+	var (
+		cls uint16
+		sz  uint16
+	)
+	switch dst {
+	case RegA:
+		cls = opClsLoadA
+	case RegX:
+		cls = opClsLoadX
+	default:
+		return RawInstruction{}, fmt.Errorf("invalid target register %v", dst)
+	}
+	switch loadSize {
+	case 1:
+		sz = opLoadWidth1
+	case 2:
+		sz = opLoadWidth2
+	case 4:
+		sz = opLoadWidth4
+	default:
+		return RawInstruction{}, fmt.Errorf("invalid load byte length %d", sz)
+	}
+	return RawInstruction{
+		Op: cls | sz | mode,
+		K:  k,
+	}, nil
+}
diff --git a/vendor/golang.org/x/net/bpf/setter.go b/vendor/golang.org/x/net/bpf/setter.go
new file mode 100644
index 000000000..43e35f0ac
--- /dev/null
+++ b/vendor/golang.org/x/net/bpf/setter.go
@@ -0,0 +1,10 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package bpf
+
+// A Setter is a type which can attach a compiled BPF filter to itself.
+type Setter interface {
+	SetBPF(filter []RawInstruction) error
+}
diff --git a/vendor/golang.org/x/net/bpf/vm.go b/vendor/golang.org/x/net/bpf/vm.go
new file mode 100644
index 000000000..73f57f1f7
--- /dev/null
+++ b/vendor/golang.org/x/net/bpf/vm.go
@@ -0,0 +1,150 @@
+// Copyright 2016 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package bpf
+
+import (
+	"errors"
+	"fmt"
+)
+
+// A VM is an emulated BPF virtual machine.
+type VM struct {
+	filter []Instruction
+}
+
+// NewVM returns a new VM using the input BPF program.
+func NewVM(filter []Instruction) (*VM, error) {
+	if len(filter) == 0 {
+		return nil, errors.New("one or more Instructions must be specified")
+	}
+
+	for i, ins := range filter {
+		check := len(filter) - (i + 1)
+		switch ins := ins.(type) {
+		// Check for out-of-bounds jumps in instructions
+		case Jump:
+			if check <= int(ins.Skip) {
+				return nil, fmt.Errorf("cannot jump %d instructions; jumping past program bounds", ins.Skip)
+			}
+		case JumpIf:
+			if check <= int(ins.SkipTrue) {
+				return nil, fmt.Errorf("cannot jump %d instructions in true case; jumping past program bounds", ins.SkipTrue)
+			}
+			if check <= int(ins.SkipFalse) {
+				return nil, fmt.Errorf("cannot jump %d instructions in false case; jumping past program bounds", ins.SkipFalse)
+			}
+		case JumpIfX:
+			if check <= int(ins.SkipTrue) {
+				return nil, fmt.Errorf("cannot jump %d instructions in true case; jumping past program bounds", ins.SkipTrue)
+			}
+			if check <= int(ins.SkipFalse) {
+				return nil, fmt.Errorf("cannot jump %d instructions in false case; jumping past program bounds", ins.SkipFalse)
+			}
+		// Check for division or modulus by zero
+		case ALUOpConstant:
+			if ins.Val != 0 {
+				break
+			}
+
+			switch ins.Op {
+			case ALUOpDiv, ALUOpMod:
+				return nil, errors.New("cannot divide by zero using ALUOpConstant")
+			}
+		// Check for unknown extensions
+		case LoadExtension:
+			switch ins.Num {
+			case ExtLen:
+			default:
+				return nil, fmt.Errorf("extension %d not implemented", ins.Num)
+			}
+		}
+	}
+
+	// Make sure last instruction is a return instruction
+	switch filter[len(filter)-1].(type) {
+	case RetA, RetConstant:
+	default:
+		return nil, errors.New("BPF program must end with RetA or RetConstant")
+	}
+
+	// Though our VM works using disassembled instructions, we
+	// attempt to assemble the input filter anyway to ensure it is compatible
+	// with an operating system VM.
+	_, err := Assemble(filter)
+
+	return &VM{
+		filter: filter,
+	}, err
+}
+
+// Run runs the VM's BPF program against the input bytes.
+// Run returns the number of bytes accepted by the BPF program, and any errors
+// which occurred while processing the program.
+func (v *VM) Run(in []byte) (int, error) {
+	var (
+		// Registers of the virtual machine
+		regA       uint32
+		regX       uint32
+		regScratch [16]uint32
+
+		// OK is true if the program should continue processing the next
+		// instruction, or false if not, causing the loop to break
+		ok = true
+	)
+
+	// TODO(mdlayher): implement:
+	// - NegateA:
+	//   - would require a change from uint32 registers to int32
+	//     registers
+
+	// TODO(mdlayher): add interop tests that check signedness of ALU
+	// operations against kernel implementation, and make sure Go
+	// implementation matches behavior
+
+	for i := 0; i < len(v.filter) && ok; i++ {
+		ins := v.filter[i]
+
+		switch ins := ins.(type) {
+		case ALUOpConstant:
+			regA = aluOpConstant(ins, regA)
+		case ALUOpX:
+			regA, ok = aluOpX(ins, regA, regX)
+		case Jump:
+			i += int(ins.Skip)
+		case JumpIf:
+			jump := jumpIf(ins, regA)
+			i += jump
+		case JumpIfX:
+			jump := jumpIfX(ins, regA, regX)
+			i += jump
+		case LoadAbsolute:
+			regA, ok = loadAbsolute(ins, in)
+		case LoadConstant:
+			regA, regX = loadConstant(ins, regA, regX)
+		case LoadExtension:
+			regA = loadExtension(ins, in)
+		case LoadIndirect:
+			regA, ok = loadIndirect(ins, in, regX)
+		case LoadMemShift:
+			regX, ok = loadMemShift(ins, in)
+		case LoadScratch:
+			regA, regX = loadScratch(ins, regScratch, regA, regX)
+		case RetA:
+			return int(regA), nil
+		case RetConstant:
+			return int(ins.Val), nil
+		case StoreScratch:
+			regScratch = storeScratch(ins, regScratch, regA, regX)
+		case TAX:
+			regX = regA
+		case TXA:
+			regA = regX
+		default:
+			return 0, fmt.Errorf("unknown Instruction at index %d: %T", i, ins)
+		}
+	}
+
+	return 0, nil
+}
diff --git a/vendor/golang.org/x/net/bpf/vm_instructions.go b/vendor/golang.org/x/net/bpf/vm_instructions.go
new file mode 100644
index 000000000..0aa307c06
--- /dev/null
+++ b/vendor/golang.org/x/net/bpf/vm_instructions.go
@@ -0,0 +1,182 @@
+// Copyright 2016 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package bpf
+
+import (
+	"encoding/binary"
+	"fmt"
+)
+
+func aluOpConstant(ins ALUOpConstant, regA uint32) uint32 {
+	return aluOpCommon(ins.Op, regA, ins.Val)
+}
+
+func aluOpX(ins ALUOpX, regA uint32, regX uint32) (uint32, bool) {
+	// Guard against division or modulus by zero by terminating
+	// the program, as the OS BPF VM does
+	if regX == 0 {
+		switch ins.Op {
+		case ALUOpDiv, ALUOpMod:
+			return 0, false
+		}
+	}
+
+	return aluOpCommon(ins.Op, regA, regX), true
+}
+
+func aluOpCommon(op ALUOp, regA uint32, value uint32) uint32 {
+	switch op {
+	case ALUOpAdd:
+		return regA + value
+	case ALUOpSub:
+		return regA - value
+	case ALUOpMul:
+		return regA * value
+	case ALUOpDiv:
+		// Division by zero not permitted by NewVM and aluOpX checks
+		return regA / value
+	case ALUOpOr:
+		return regA | value
+	case ALUOpAnd:
+		return regA & value
+	case ALUOpShiftLeft:
+		return regA << value
+	case ALUOpShiftRight:
+		return regA >> value
+	case ALUOpMod:
+		// Modulus by zero not permitted by NewVM and aluOpX checks
+		return regA % value
+	case ALUOpXor:
+		return regA ^ value
+	default:
+		return regA
+	}
+}
+
+func jumpIf(ins JumpIf, regA uint32) int {
+	return jumpIfCommon(ins.Cond, ins.SkipTrue, ins.SkipFalse, regA, ins.Val)
+}
+
+func jumpIfX(ins JumpIfX, regA uint32, regX uint32) int {
+	return jumpIfCommon(ins.Cond, ins.SkipTrue, ins.SkipFalse, regA, regX)
+}
+
+func jumpIfCommon(cond JumpTest, skipTrue, skipFalse uint8, regA uint32, value uint32) int {
+	var ok bool
+
+	switch cond {
+	case JumpEqual:
+		ok = regA == value
+	case JumpNotEqual:
+		ok = regA != value
+	case JumpGreaterThan:
+		ok = regA > value
+	case JumpLessThan:
+		ok = regA < value
+	case JumpGreaterOrEqual:
+		ok = regA >= value
+	case JumpLessOrEqual:
+		ok = regA <= value
+	case JumpBitsSet:
+		ok = (regA & value) != 0
+	case JumpBitsNotSet:
+		ok = (regA & value) == 0
+	}
+
+	if ok {
+		return int(skipTrue)
+	}
+
+	return int(skipFalse)
+}
+
+func loadAbsolute(ins LoadAbsolute, in []byte) (uint32, bool) {
+	offset := int(ins.Off)
+	size := ins.Size
+
+	return loadCommon(in, offset, size)
+}
+
+func loadConstant(ins LoadConstant, regA uint32, regX uint32) (uint32, uint32) {
+	switch ins.Dst {
+	case RegA:
+		regA = ins.Val
+	case RegX:
+		regX = ins.Val
+	}
+
+	return regA, regX
+}
+
+func loadExtension(ins LoadExtension, in []byte) uint32 {
+	switch ins.Num {
+	case ExtLen:
+		return uint32(len(in))
+	default:
+		panic(fmt.Sprintf("unimplemented extension: %d", ins.Num))
+	}
+}
+
+func loadIndirect(ins LoadIndirect, in []byte, regX uint32) (uint32, bool) {
+	offset := int(ins.Off) + int(regX)
+	size := ins.Size
+
+	return loadCommon(in, offset, size)
+}
+
+func loadMemShift(ins LoadMemShift, in []byte) (uint32, bool) {
+	offset := int(ins.Off)
+
+	// Size of LoadMemShift is always 1 byte
+	if !inBounds(len(in), offset, 1) {
+		return 0, false
+	}
+
+	// Mask off high 4 bits and multiply low 4 bits by 4
+	return uint32(in[offset]&0x0f) * 4, true
+}
+
+func inBounds(inLen int, offset int, size int) bool {
+	return offset+size <= inLen
+}
+
+func loadCommon(in []byte, offset int, size int) (uint32, bool) {
+	if !inBounds(len(in), offset, size) {
+		return 0, false
+	}
+
+	switch size {
+	case 1:
+		return uint32(in[offset]), true
+	case 2:
+		return uint32(binary.BigEndian.Uint16(in[offset : offset+size])), true
+	case 4:
+		return uint32(binary.BigEndian.Uint32(in[offset : offset+size])), true
+	default:
+		panic(fmt.Sprintf("invalid load size: %d", size))
+	}
+}
+
+func loadScratch(ins LoadScratch, regScratch [16]uint32, regA uint32, regX uint32) (uint32, uint32) {
+	switch ins.Dst {
+	case RegA:
+		regA = regScratch[ins.N]
+	case RegX:
+		regX = regScratch[ins.N]
+	}
+
+	return regA, regX
+}
+
+func storeScratch(ins StoreScratch, regScratch [16]uint32, regA uint32, regX uint32) [16]uint32 {
+	switch ins.Src {
+	case RegA:
+		regScratch[ins.N] = regA
+	case RegX:
+		regScratch[ins.N] = regX
+	}
+
+	return regScratch
+}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 2c3ebd8b0..4a91b8d0c 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -538,13 +538,6 @@ github.com/fsouza/go-dockerclient
 github.com/go-jose/go-jose/v4
 github.com/go-jose/go-jose/v4/cipher
 github.com/go-jose/go-jose/v4/json
-# github.com/go-kit/log v0.2.1
-## explicit; go 1.17
-github.com/go-kit/log
-github.com/go-kit/log/level
-# github.com/go-logfmt/logfmt v0.5.1
-## explicit; go 1.17
-github.com/go-logfmt/logfmt
 # github.com/go-logr/logr v1.4.2
 ## explicit; go 1.18
 github.com/go-logr/logr
@@ -702,6 +695,12 @@ github.com/mattn/go-shellwords
 # github.com/mattn/go-sqlite3 v1.14.22
 ## explicit; go 1.19
 github.com/mattn/go-sqlite3
+# github.com/mdlayher/socket v0.4.1
+## explicit; go 1.20
+github.com/mdlayher/socket
+# github.com/mdlayher/vsock v1.2.1
+## explicit; go 1.20
+github.com/mdlayher/vsock
 # github.com/miekg/pkcs11 v1.1.1
 ## explicit; go 1.12
 github.com/miekg/pkcs11
@@ -868,10 +867,10 @@ github.com/prometheus/client_model/go
 github.com/prometheus/common/config
 github.com/prometheus/common/expfmt
 github.com/prometheus/common/model
-github.com/prometheus/common/promlog
+github.com/prometheus/common/promslog
 github.com/prometheus/common/version
-# github.com/prometheus/exporter-toolkit v0.11.0
-## explicit; go 1.18
+# github.com/prometheus/exporter-toolkit v0.13.0
+## explicit; go 1.22
 github.com/prometheus/exporter-toolkit/web
 # github.com/prometheus/procfs v0.15.1
 ## explicit; go 1.20
@@ -1033,6 +1032,7 @@ golang.org/x/exp/slices
 golang.org/x/mod/semver
 # golang.org/x/net v0.29.0
 ## explicit; go 1.18
+golang.org/x/net/bpf
 golang.org/x/net/context
 golang.org/x/net/html
 golang.org/x/net/html/atom