cli/command/container: validate --link-local-ip values

The --link-local-ip flag had no validator, and since the move to netip
(v29.0.0) its values are converted with toNetipAddrSlice, which skips
any value it cannot parse. A mistyped address, for example:

    docker run --network mynet --link-local-ip 169.254.1.1000 alpine

was silently dropped, and the container was created without it. Before
v29 the value was sent as-is, and the daemon rejected it.

Validate the flag with opts.ValidateIPAddress, the same validator the
--dns flag uses, so an invalid value fails when the flags are parsed.

Assisted-By: Claude Code
Signed-off-by: breken-ai <312387581+breken-ai@users.noreply.github.com>

Author: breken-ai

cli/command/container/opts.go

@@ -170,7 +170,7 @@ func addFlags(flags *pflag.FlagSet) *containerOptions {
 		groupAdd:          opts.NewListOpts(nil),
 		labels:            opts.NewListOpts(opts.ValidateLabel),
 		labelsFile:        opts.NewListOpts(nil),
-		linkLocalIPs:      opts.NewListOpts(nil),
+		linkLocalIPs:      opts.NewListOpts(opts.ValidateIPAddress),
 		links:             opts.NewListOpts(opts.ValidateLink),
 		loggingOpts:       opts.NewListOpts(nil),
 		publish:           opts.NewListOpts(nil),

cli/command/container/opts_test.go

@@ -766,6 +766,11 @@ func TestParseNetworkConfig(t *testing.T) {
 			flags:       []string{"--network", "net1", "--ip6", "172.20.88.22"},
 			expectedErr: "invalid IPv6 address for --ip6: 172.20.88.22",
 		},
+		{
+			name:        "invalid-link-local-ip",
+			flags:       []string{"--network", "net1", "--link-local-ip", "foobar"},
+			expectedErr: `invalid argument "foobar" for "--link-local-ip" flag: IP address is not correctly formatted: foobar`,
+		},
 	}
 
 	for _, tc := range tests {