scripts/build/.variables: don't use "netgo" when building Windows binaries

[thaJeztah]

relates to:

• fixes Docker CLI v29 Gets I/O Timeouts Talking to Engine Behind VPN Due to Apparent Change in DNS Resolution #6665
• (likely) introduced in Fix static build + CGO #6631
• related: hack/make/.binary: don't use "netgo" when building Windows binaries moby/moby#45603

scripts/build/.variables: don't use "netgo" when building Windows binaries

commit 880ef75 fixed static builds with CGO, which included setting the netgo build-tag for static builds.

Starting with go1.19, the Go runtime on Windows now supports the netgo build- flag to use a native Go DNS resolver. Prior to that version, the build-flag only had an effect on non-Windows platforms. From the go1.19 release notes: https://go.dev/doc/go1.19#net

Resolver.PreferGo is now implemented on Windows and Plan 9. It previously
only worked on Unix platforms. Combined with Dialer.Resolver and Resolver.Dial,
it's now possible to write portable programs and be in control of all DNS name
lookups when dialing.

The net package now has initial support for the netgo build tag on Windows.
When used, the package uses the Go DNS client (as used by Resolver.PreferGo)
instead of asking Windows for DNS results. The upstream DNS server it discovers
from Windows may not yet be correct with complex system network configurations,
however.

This originally caused issues in the daemon, because the pure-go implementation did not respect file-based resolution (C:\Windows\System32\Drivers\etc\hosts), resulting in localhost not being resolvable, and custom entries in .etc/hosts not being used.

That specific problem was resolved in go1.22 (through golang/go@33d4a51), but other limitations may still apply, and resolver ordering may not respect VPN adaptors (such as Twingate) and queries sent through the local network adapter instead of the VPN tunnel, resulting in DNS resolution failures;

Get "https://example.com:2376/v1.52/containers/json": dial tcp: lookup example.com: i/o timeout

This patch unsets the netgo option when (cross-)compiling for Windows, similar to the patch used for the daemon (see moby/moby@53d1b12).

- What I did

- How I did it

- How to verify it

- Human readable description for the release notes

- A picture of a cute animal (not mandatory but encouraged)

[Copilot]

Pull request overview

This PR adjusts the build-tag logic in scripts/build/.variables to avoid enabling Go’s netgo resolver when building Windows binaries, mitigating DNS resolution issues reported for Windows clients behind VPNs.

Changes:

• Keep osusergo netgo for static CGO builds in general.
• Remove the netgo build tag specifically when GOOS=windows to prefer the Windows system resolver.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[thaJeztah]

@vvoland @robmry ptal 🤗

[thaJeztah]

Thx; did a quick check in docker/packaging and docker/docker-ce-packaging, and I don't think we override the option there. Let me bring this one in.