Inconsistent behavior between `label` and `label!` filters in `volume prune`

docker volume prune の Docker CLI エントリポイントから開始し、繰り返された label および label!= フィルターがどのように評価されるかを追跡します。issue にあるコマンドを再現し、その後、関連するフィルターテストがあれば調べ、両方の形式で意図した一貫した動作を示すリグレッションカバレッジを追加します。

Description

In docker volume prune, label filters are combined with AND, while label! filters are combined with OR. This seems unexpected, and is not mentioned in the documentation, so I assume it to be a bug.

Reproduce

docker volume create --label a=b --label b=c vol1 && docker volume create --label a=b --label b=c --label d=e vol2 && docker volume create --label b=c --label c=d vol3

docker volume  prune --all --filter label=a=b --filter label=y=y
*no deleted volumes*

docker volume  prune --all --filter label!=a=b --filter label!=y=y
Deleted Volumes:
vol1
vol2
vol3

Expected behavior

I would expect the same logical operation to be used in both cases. By reading only remove volumes with (or without, in case label!=... is used) the specified labels, AND makes more sense, so I would not expect vol1 and vol2 being deleted in the label! example, as they do have the a=b label.

docker version

Client:
 Version:           29.3.1
 API version:       1.54
 Go version:        go1.25.8 X:nodwarf5
 Git commit:        1.fc43
 Built:             Wed Mar 25 00:00:00 2026
 OS/Arch:           linux/amd64
 Context:           default

Server:
 Engine:
  Version:          29.3.1
  API version:      1.54 (minimum version 1.40)
  Go version:       go1.25.8 X:nodwarf5
  Git commit:       1.fc43
  Built:            Wed Mar 25 00:00:00 2026
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          2.1.6
  GitCommit:        1.fc43
 runc:
  Version:          1.4.1
  GitCommit:        
 tini-static:
  Version:          0.19.0
  GitCommit:

docker info

Client:
 Version:    29.3.1
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  0.31.1
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx

Server:
 Containers: 0
  Running: 0
  Paused: 0
  Stopped: 0
 Images: 0
 Server Version: 29.3.1
 Storage Driver: overlayfs
  driver-type: io.containerd.snapshotter.v1
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: /usr/bin/tini-static
 containerd version: 1.fc43
 runc version: 
 init version: 
 Security Options:
  seccomp
   Profile: builtin
  selinux
  cgroupns
 Kernel Version: 6.19.10-200.fc43.x86_64
 Operating System: Fedora Linux 43 (Workstation Edition)
 OSType: linux
 Architecture: x86_64
 CPUs: 14
 Total Memory: 30.76GiB
 Name: sbrauner-thinkpadt14gen6.tpb.csb
 ID: bfa28d86-9769-4985-99a5-75ec2afd61fd
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  ::1/128
  127.0.0.0/8
 Live Restore Enabled: false
 Firewall Backend: iptables+firewalld

Additional Info

No response