diff --git a/go.mod b/go.mod
index 011871a5..0655f19b 100644
--- a/go.mod
+++ b/go.mod
@@ -33,7 +33,7 @@ require (
 	github.com/hashicorp/go-getter v1.7.2 // indirect
 	github.com/hashicorp/go-hclog v1.5.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/go-plugin v1.4.10 // indirect
+	github.com/hashicorp/go-plugin v1.5.0 // indirect
 	github.com/hashicorp/go-safetemp v1.0.0 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/go-version v1.6.0 // indirect
diff --git a/go.sum b/go.sum
index 623a046e..184066ff 100644
--- a/go.sum
+++ b/go.sum
@@ -236,6 +236,7 @@ github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d h1:xDfNPAt8lFiC1U
 github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d/go.mod h1:6QX/PXZ00z/TKoufEY6K/a0k6AhaJrQKdFe6OfVXsa4=
 github.com/bgentry/speakeasy v0.1.0 h1:ByYyxL9InA1OWqxJqqp2A5pYHUrCiAL6K3J+LKSsQkY=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
+github.com/bufbuild/protocompile v0.4.0 h1:LbFKd2XowZvQ/kajzguUp2DC9UEIQhIq77fZZlaQsNA=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
@@ -408,8 +409,8 @@ github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHh
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hashicorp/go-plugin v1.3.0/go.mod h1:F9eH4LrE/ZsRdbwhfjs9k9HoDUwAHnYtXdgmf1AVNs0=
-github.com/hashicorp/go-plugin v1.4.10 h1:xUbmA4jC6Dq163/fWcp8P3JuHilrHHMLNRxzGQJ9hNk=
-github.com/hashicorp/go-plugin v1.4.10/go.mod h1:6/1TEzT0eQznvI/gV2CM29DLSkAK/e58mUWKVsPaph0=
+github.com/hashicorp/go-plugin v1.5.0 h1:g6Lj3USwF5LaB8HlvCxPjN2X4nFE08ko2BJNVpl7TIE=
+github.com/hashicorp/go-plugin v1.5.0/go.mod h1:w1sAEES3g3PuV/RzUrgow20W2uErMly84hhD3um1WL4=
 github.com/hashicorp/go-safetemp v1.0.0 h1:2HR189eFNrjHQyENnQMMpCiBAsRxzbTMIgBhEyExpmo=
 github.com/hashicorp/go-safetemp v1.0.0/go.mod h1:oaerMy3BhqiTbVye6QuFhFtIceqFoDHxNAB65b+Rj1I=
 github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
@@ -456,8 +457,8 @@ github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4=
 github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
 github.com/jessevdk/go-flags v1.5.0/go.mod h1:Fw0T6WPc1dYxT4mKEZRfG5kJhaTDP9pj1c2EWnYs/m4=
-github.com/jhump/protoreflect v1.6.0 h1:h5jfMVslIg6l29nsMs0D8Wj17RDVdNYti0vDN/PZZoE=
 github.com/jhump/protoreflect v1.6.0/go.mod h1:eaTn3RZAmMBcV0fifFvlm6VHNz3wSkYyXYWUh7ymB74=
+github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c=
 github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
 github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
diff --git a/vendor/github.com/hashicorp/go-plugin/CHANGELOG.md b/vendor/github.com/hashicorp/go-plugin/CHANGELOG.md
index dbb20c96..3dc843ef 100644
--- a/vendor/github.com/hashicorp/go-plugin/CHANGELOG.md
+++ b/vendor/github.com/hashicorp/go-plugin/CHANGELOG.md
@@ -1,12 +1,30 @@
+## v1.5.0
+
+ENHANCEMENTS:
+
+* client: New `runner.Runner` interface to support clients providing custom plugin command runner implementations [[GH-270](https://github.com/hashicorp/go-plugin/pull/270)]
+    * Accessible via new `ClientConfig` field `RunnerFunc`, which is mutually exclusive with `Cmd` and `Reattach`
+    * Reattaching support via `ReattachConfig` field `ReattachFunc`
+* client: New `ClientConfig` field `SkipHostEnv` allows omitting the client process' own environment variables from the plugin command's environment [[GH-270](https://github.com/hashicorp/go-plugin/pull/270)]
+* client: Add `ID()` method to `Client` for retrieving the pid or other unique ID of a running plugin [[GH-272](https://github.com/hashicorp/go-plugin/pull/272)]
+* server: Support setting the directory to create Unix sockets in with the env var `PLUGIN_UNIX_SOCKET_DIR` [[GH-270](https://github.com/hashicorp/go-plugin/pull/270)]
+* server: Support setting group write permission and a custom group name or gid owner with the env var `PLUGIN_UNIX_SOCKET_GROUP` [[GH-270](https://github.com/hashicorp/go-plugin/pull/270)]
+
+## v1.4.11-rc1
+
+ENHANCEMENTS:
+
+* deps: bump protoreflect to v1.15.1 [[GH-264](https://github.com/hashicorp/go-plugin/pull/264)]
+
 ## v1.4.10
 
 BUG FIXES:
 
-* additional notes: ensure to close files [GH-241](https://github.com/hashicorp/go-plugin/pull/241)]
+* additional notes: ensure to close files [[GH-241](https://github.com/hashicorp/go-plugin/pull/241)]
 
 ENHANCEMENTS:
 
-* deps: Remove direct dependency on golang.org/x/net [GH-240](https://github.com/hashicorp/go-plugin/pull/240)]
+* deps: Remove direct dependency on golang.org/x/net [[GH-240](https://github.com/hashicorp/go-plugin/pull/240)]
 
 ## v1.4.9
 
diff --git a/vendor/github.com/hashicorp/go-plugin/client.go b/vendor/github.com/hashicorp/go-plugin/client.go
index a6a9ffa2..6f293278 100644
--- a/vendor/github.com/hashicorp/go-plugin/client.go
+++ b/vendor/github.com/hashicorp/go-plugin/client.go
@@ -26,17 +26,11 @@ import (
 	"time"
 
 	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-plugin/internal/cmdrunner"
+	"github.com/hashicorp/go-plugin/runner"
 	"google.golang.org/grpc"
 )
 
-const unrecognizedRemotePluginMessage = `Unrecognized remote plugin message: %s
-This usually means
-  the plugin was not compiled for this architecture,
-  the plugin is missing dynamic-link libraries necessary to run,
-  the plugin is not executable by this process due to file permissions, or
-  the plugin failed to negotiate the initial go-plugin protocol handshake
-%s`
-
 // If this is 1, then we've called CleanupClients. This can be used
 // by plugin RPC implementations to change error behavior since you
 // can expected network connection errors at this point. This should be
@@ -52,7 +46,7 @@ var managedClientsLock sync.Mutex
 var (
 	// ErrProcessNotFound is returned when a client is instantiated to
 	// reattach to an existing process and it isn't found.
-	ErrProcessNotFound = errors.New("Reattachment process not found")
+	ErrProcessNotFound = cmdrunner.ErrProcessNotFound
 
 	// ErrChecksumsDoNotMatch is returned when binary's checksum doesn't match
 	// the one provided in the SecureConfig.
@@ -87,7 +81,7 @@ type Client struct {
 	exited            bool
 	l                 sync.Mutex
 	address           net.Addr
-	process           *os.Process
+	runner            runner.AttachedRunner
 	client            ClientProtocol
 	protocol          Protocol
 	logger            hclog.Logger
@@ -106,6 +100,8 @@ type Client struct {
 	// processKilled is used for testing only, to flag when the process was
 	// forcefully killed.
 	processKilled bool
+
+	hostSocketDir string
 }
 
 // NegotiatedVersion returns the protocol version negotiated with the server.
@@ -114,6 +110,19 @@ func (c *Client) NegotiatedVersion() int {
 	return c.negotiatedVersion
 }
 
+// ID returns a unique ID for the running plugin. By default this is the process
+// ID (pid), but it could take other forms if RunnerFunc was provided.
+func (c *Client) ID() string {
+	c.l.Lock()
+	defer c.l.Unlock()
+
+	if c.runner != nil {
+		return c.runner.ID()
+	}
+
+	return ""
+}
+
 // ClientConfig is the configuration used to initialize a new
 // plugin client. After being used to initialize a plugin client,
 // that configuration must not be modified again.
@@ -141,6 +150,13 @@ type ClientConfig struct {
 	Cmd      *exec.Cmd
 	Reattach *ReattachConfig
 
+	// RunnerFunc allows consumers to provide their own implementation of
+	// runner.Runner and control the context within which a plugin is executed.
+	// The cmd argument will have been copied from the config and populated with
+	// environment variables that a go-plugin server expects to read such as
+	// AutoMTLS certs and the magic cookie key.
+	RunnerFunc func(l hclog.Logger, cmd *exec.Cmd, tmpDir string) (runner.Runner, error)
+
 	// SecureConfig is configuration for verifying the integrity of the
 	// executable. It can not be used with Reattach.
 	SecureConfig *SecureConfig
@@ -220,6 +236,10 @@ type ClientConfig struct {
 	// to create gRPC connections. This only affects plugins using the gRPC
 	// protocol.
 	GRPCDialOptions []grpc.DialOption
+
+	// SkipHostEnv allows plugins to run without inheriting the parent process'
+	// environment variables.
+	SkipHostEnv bool
 }
 
 // ReattachConfig is used to configure a client to reattach to an
@@ -231,6 +251,11 @@ type ReattachConfig struct {
 	Addr            net.Addr
 	Pid             int
 
+	// ReattachFunc allows consumers to provide their own implementation of
+	// runner.AttachedRunner and attach to something other than a plain process.
+	// At least one of Pid or ReattachFunc must be set.
+	ReattachFunc runner.ReattachFunc
+
 	// Test is set to true if this is reattaching to to a plugin in "test mode"
 	// (see ServeConfig.Test). In this mode, client.Kill will NOT kill the
 	// process and instead will rely on the plugin to terminate itself. This
@@ -310,7 +335,7 @@ func CleanupClients() {
 // plugin and gets the address for the RPC connection.
 //
 // The client must be cleaned up at some point by calling Kill(). If
-// the client is a managed client (created with NewManagedClient) you
+// the client is a managed client (created with ClientConfig.Managed) you
 // can just call CleanupClients at the end of your program and they will
 // be properly cleaned.
 func NewClient(config *ClientConfig) (c *Client) {
@@ -418,12 +443,13 @@ func (c *Client) killed() bool {
 func (c *Client) Kill() {
 	// Grab a lock to read some private fields.
 	c.l.Lock()
-	process := c.process
+	runner := c.runner
 	addr := c.address
+	hostSocketDir := c.hostSocketDir
 	c.l.Unlock()
 
-	// If there is no process, there is nothing to kill.
-	if process == nil {
+	// If there is no runner or ID, there is nothing to kill.
+	if runner == nil || runner.ID() == "" {
 		return
 	}
 
@@ -431,10 +457,14 @@ func (c *Client) Kill() {
 		// Wait for the all client goroutines to finish.
 		c.clientWaitGroup.Wait()
 
+		if hostSocketDir != "" {
+			os.RemoveAll(hostSocketDir)
+		}
+
 		// Make sure there is no reference to the old process after it has been
 		// killed.
 		c.l.Lock()
-		c.process = nil
+		c.runner = nil
 		c.l.Unlock()
 	}()
 
@@ -477,23 +507,15 @@ func (c *Client) Kill() {
 
 	// If graceful exiting failed, just kill it
 	c.logger.Warn("plugin failed to exit gracefully")
-	process.Kill()
+	if err := runner.Kill(context.Background()); err != nil {
+		c.logger.Debug("error killing plugin", "error", err)
+	}
 
 	c.l.Lock()
 	c.processKilled = true
 	c.l.Unlock()
 }
 
-// peTypes is a list of Portable Executable (PE) machine types from https://learn.microsoft.com/en-us/windows/win32/debug/pe-format
-// mapped to GOARCH types. It is not comprehensive, and only includes machine types that Go supports.
-var peTypes = map[uint16]string{
-	0x14c:  "386",
-	0x1c0:  "arm",
-	0x6264: "loong64",
-	0x8664: "amd64",
-	0xaa64: "arm64",
-}
-
 // Start the underlying subprocess, communicating with it to negotiate
 // a port for RPC connections, and returning the address to connect via RPC.
 //
@@ -512,14 +534,21 @@ func (c *Client) Start() (addr net.Addr, err error) {
 	// this in a {} for scoping reasons, and hopeful that the escape
 	// analysis will pop the stack here.
 	{
-		cmdSet := c.config.Cmd != nil
-		attachSet := c.config.Reattach != nil
-		secureSet := c.config.SecureConfig != nil
-		if cmdSet == attachSet {
-			return nil, fmt.Errorf("Only one of Cmd or Reattach must be set")
+		var mutuallyExclusiveOptions int
+		if c.config.Cmd != nil {
+			mutuallyExclusiveOptions += 1
+		}
+		if c.config.Reattach != nil {
+			mutuallyExclusiveOptions += 1
+		}
+		if c.config.RunnerFunc != nil {
+			mutuallyExclusiveOptions += 1
+		}
+		if mutuallyExclusiveOptions != 1 {
+			return nil, fmt.Errorf("exactly one of Cmd, or Reattach, or RunnerFunc must be set")
 		}
 
-		if secureSet && attachSet {
+		if c.config.SecureConfig != nil && c.config.Reattach != nil {
 			return nil, ErrSecureConfigAndReattach
 		}
 	}
@@ -555,18 +584,17 @@ func (c *Client) Start() (addr net.Addr, err error) {
 	}
 
 	cmd := c.config.Cmd
-	cmd.Env = append(cmd.Env, os.Environ()...)
-	cmd.Env = append(cmd.Env, env...)
-	cmd.Stdin = os.Stdin
-
-	cmdStdout, err := cmd.StdoutPipe()
-	if err != nil {
-		return nil, err
+	if cmd == nil {
+		// It's only possible to get here if RunnerFunc is non-nil, but we'll
+		// still use cmd as a spec to populate metadata for the external
+		// implementation to consume.
+		cmd = exec.Command("")
 	}
-	cmdStderr, err := cmd.StderrPipe()
-	if err != nil {
-		return nil, err
+	if !c.config.SkipHostEnv {
+		cmd.Env = append(cmd.Env, os.Environ()...)
 	}
+	cmd.Env = append(cmd.Env, env...)
+	cmd.Stdin = os.Stdin
 
 	if c.config.SecureConfig != nil {
 		if ok, err := c.config.SecureConfig.Check(cmd.Path); err != nil {
@@ -601,26 +629,44 @@ func (c *Client) Start() (addr net.Addr, err error) {
 		}
 	}
 
-	c.logger.Debug("starting plugin", "path", cmd.Path, "args", cmd.Args)
-	err = cmd.Start()
-	if err != nil {
-		return
+	var runner runner.Runner
+	switch {
+	case c.config.RunnerFunc != nil:
+		c.hostSocketDir, err = os.MkdirTemp("", "")
+		if err != nil {
+			return nil, err
+		}
+		c.logger.Trace("created temporary directory for unix sockets", "dir", c.hostSocketDir)
+		runner, err = c.config.RunnerFunc(c.logger, cmd, c.hostSocketDir)
+		if err != nil {
+			return nil, err
+		}
+	default:
+		runner, err = cmdrunner.NewCmdRunner(c.logger, cmd)
+		if err != nil {
+			return nil, err
+		}
+
 	}
 
-	// Set the process
-	c.process = cmd.Process
-	c.logger.Debug("plugin started", "path", cmd.Path, "pid", c.process.Pid)
+	c.runner = runner
+	startCtx, startCtxCancel := context.WithTimeout(context.Background(), c.config.StartTimeout)
+	defer startCtxCancel()
+	err = runner.Start(startCtx)
+	if err != nil {
+		return nil, err
+	}
 
 	// Make sure the command is properly cleaned up if there is an error
 	defer func() {
-		r := recover()
+		rErr := recover()
 
-		if err != nil || r != nil {
-			cmd.Process.Kill()
+		if err != nil || rErr != nil {
+			runner.Kill(context.Background())
 		}
 
-		if r != nil {
-			panic(r)
+		if rErr != nil {
+			panic(rErr)
 		}
 	}()
 
@@ -631,7 +677,7 @@ func (c *Client) Start() (addr net.Addr, err error) {
 	c.clientWaitGroup.Add(1)
 	c.stderrWaitGroup.Add(1)
 	// logStderr calls Done()
-	go c.logStderr(cmdStderr)
+	go c.logStderr(runner.Name(), runner.Stderr())
 
 	c.clientWaitGroup.Add(1)
 	go func() {
@@ -640,29 +686,17 @@ func (c *Client) Start() (addr net.Addr, err error) {
 
 		defer c.clientWaitGroup.Done()
 
-		// get the cmd info early, since the process information will be removed
-		// in Kill.
-		pid := c.process.Pid
-		path := cmd.Path
-
 		// wait to finish reading from stderr since the stderr pipe reader
 		// will be closed by the subsequent call to cmd.Wait().
 		c.stderrWaitGroup.Wait()
 
 		// Wait for the command to end.
-		err := cmd.Wait()
-
-		msgArgs := []interface{}{
-			"path", path,
-			"pid", pid,
-		}
+		err := runner.Wait(context.Background())
 		if err != nil {
-			msgArgs = append(msgArgs,
-				[]interface{}{"error", err.Error()}...)
-			c.logger.Error("plugin process exited", msgArgs...)
+			c.logger.Error("plugin process exited", "plugin", runner.Name(), "id", runner.ID(), "error", err.Error())
 		} else {
 			// Log and make sure to flush the logs right away
-			c.logger.Info("plugin process exited", msgArgs...)
+			c.logger.Info("plugin process exited", "plugin", runner.Name(), "id", runner.ID())
 		}
 
 		os.Stderr.Sync()
@@ -681,10 +715,13 @@ func (c *Client) Start() (addr net.Addr, err error) {
 		defer c.clientWaitGroup.Done()
 		defer close(linesCh)
 
-		scanner := bufio.NewScanner(cmdStdout)
+		scanner := bufio.NewScanner(runner.Stdout())
 		for scanner.Scan() {
 			linesCh <- scanner.Text()
 		}
+		if scanner.Err() != nil {
+			c.logger.Error("error encountered while scanning stdout", "error", scanner.Err())
+		}
 	}()
 
 	// Make sure after we exit we read the lines from stdout forever
@@ -704,19 +741,27 @@ func (c *Client) Start() (addr net.Addr, err error) {
 	timeout := time.After(c.config.StartTimeout)
 
 	// Start looking for the address
-	c.logger.Debug("waiting for RPC address", "path", cmd.Path)
+	c.logger.Debug("waiting for RPC address", "plugin", runner.Name())
 	select {
 	case <-timeout:
 		err = errors.New("timeout while waiting for plugin to start")
 	case <-c.doneCtx.Done():
 		err = errors.New("plugin exited before we could connect")
-	case line := <-linesCh:
+	case line, ok := <-linesCh:
 		// Trim the line and split by "|" in order to get the parts of
 		// the output.
 		line = strings.TrimSpace(line)
 		parts := strings.SplitN(line, "|", 6)
 		if len(parts) < 4 {
-			err = fmt.Errorf(unrecognizedRemotePluginMessage, line, additionalNotesAboutCommand(cmd.Path))
+			errText := fmt.Sprintf("Unrecognized remote plugin message: %s", line)
+			if !ok {
+				errText += "\n" + "Failed to read any lines from plugin's stdout"
+			}
+			additionalNotes := runner.Diagnose(context.Background())
+			if additionalNotes != "" {
+				errText += "\n" + additionalNotes
+			}
+			err = errors.New(errText)
 			return
 		}
 
@@ -751,13 +796,18 @@ func (c *Client) Start() (addr net.Addr, err error) {
 		c.negotiatedVersion = version
 		c.logger.Debug("using plugin", "version", version)
 
-		switch parts[2] {
+		network, address, err := runner.PluginToHost(parts[2], parts[3])
+		if err != nil {
+			return addr, err
+		}
+
+		switch network {
 		case "tcp":
-			addr, err = net.ResolveTCPAddr("tcp", parts[3])
+			addr, err = net.ResolveTCPAddr("tcp", address)
 		case "unix":
-			addr, err = net.ResolveUnixAddr("unix", parts[3])
+			addr, err = net.ResolveUnixAddr("unix", address)
 		default:
-			err = fmt.Errorf("Unknown address type: %s", parts[3])
+			err = fmt.Errorf("Unknown address type: %s", address)
 		}
 
 		// If we have a server type, then record that. We default to net/rpc
@@ -818,39 +868,30 @@ func (c *Client) loadServerCert(cert string) error {
 }
 
 func (c *Client) reattach() (net.Addr, error) {
-	// Verify the process still exists. If not, then it is an error
-	p, err := os.FindProcess(c.config.Reattach.Pid)
-	if err != nil {
-		// On Unix systems, FindProcess never returns an error.
-		// On Windows, for non-existent pids it returns:
-		// os.SyscallError - 'OpenProcess: the paremter is incorrect'
-		return nil, ErrProcessNotFound
+	reattachFunc := c.config.Reattach.ReattachFunc
+	// For backwards compatibility default to cmdrunner.ReattachFunc
+	if reattachFunc == nil {
+		reattachFunc = cmdrunner.ReattachFunc(c.config.Reattach.Pid, c.config.Reattach.Addr)
 	}
 
-	// Attempt to connect to the addr since on Unix systems FindProcess
-	// doesn't actually return an error if it can't find the process.
-	conn, err := net.Dial(
-		c.config.Reattach.Addr.Network(),
-		c.config.Reattach.Addr.String())
+	r, err := reattachFunc()
 	if err != nil {
-		p.Kill()
-		return nil, ErrProcessNotFound
+		return nil, err
 	}
-	conn.Close()
 
 	// Create a context for when we kill
 	c.doneCtx, c.ctxCancel = context.WithCancel(context.Background())
 
 	c.clientWaitGroup.Add(1)
 	// Goroutine to mark exit status
-	go func(pid int) {
+	go func(r runner.AttachedRunner) {
 		defer c.clientWaitGroup.Done()
 
 		// ensure the context is cancelled when we're done
 		defer c.ctxCancel()
 
 		// Wait for the process to die
-		pidWait(pid)
+		r.Wait(context.Background())
 
 		// Log so we can see it
 		c.logger.Debug("reattached plugin process exited")
@@ -859,7 +900,7 @@ func (c *Client) reattach() (net.Addr, error) {
 		c.l.Lock()
 		defer c.l.Unlock()
 		c.exited = true
-	}(p.Pid)
+	}(r)
 
 	// Set the address and protocol
 	c.address = c.config.Reattach.Addr
@@ -877,7 +918,7 @@ func (c *Client) reattach() (net.Addr, error) {
 	// process being killed (the only purpose we have for c.process), since
 	// in test mode the process is responsible for exiting on its own.
 	if !c.config.Reattach.Test {
-		c.process = p
+		c.runner = r
 	}
 
 	return c.address, nil
@@ -916,6 +957,9 @@ func (c *Client) checkProtoVersion(protoVersion string) (int, PluginSet, error)
 //
 // If this returns nil then the process hasn't been started yet. Please
 // call Start or Client before calling this.
+//
+// Clients who specified a RunnerFunc will need to populate their own
+// ReattachFunc in the returned ReattachConfig before it can be used.
 func (c *Client) ReattachConfig() *ReattachConfig {
 	c.l.Lock()
 	defer c.l.Unlock()
@@ -933,11 +977,16 @@ func (c *Client) ReattachConfig() *ReattachConfig {
 		return c.config.Reattach
 	}
 
-	return &ReattachConfig{
+	reattach := &ReattachConfig{
 		Protocol: c.protocol,
 		Addr:     c.address,
-		Pid:      c.config.Cmd.Process.Pid,
 	}
+
+	if c.config.Cmd != nil && c.config.Cmd.Process != nil {
+		reattach.Pid = c.config.Cmd.Process.Pid
+	}
+
+	return reattach
 }
 
 // Protocol returns the protocol of server on the remote end. This will
@@ -989,10 +1038,10 @@ func (c *Client) dialer(_ string, timeout time.Duration) (net.Conn, error) {
 
 var stdErrBufferSize = 64 * 1024
 
-func (c *Client) logStderr(r io.Reader) {
+func (c *Client) logStderr(name string, r io.Reader) {
 	defer c.clientWaitGroup.Done()
 	defer c.stderrWaitGroup.Done()
-	l := c.logger.Named(filepath.Base(c.config.Cmd.Path))
+	l := c.logger.Named(filepath.Base(name))
 
 	reader := bufio.NewReaderSize(r, stdErrBufferSize)
 	// continuation indicates the previous line was a prefix
diff --git a/vendor/github.com/hashicorp/go-plugin/constants.go b/vendor/github.com/hashicorp/go-plugin/constants.go
new file mode 100644
index 00000000..b66fa799
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-plugin/constants.go
@@ -0,0 +1,9 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package plugin
+
+const (
+	EnvUnixSocketDir   = "PLUGIN_UNIX_SOCKET_DIR"
+	EnvUnixSocketGroup = "PLUGIN_UNIX_SOCKET_GROUP"
+)
diff --git a/vendor/github.com/hashicorp/go-plugin/grpc_broker.go b/vendor/github.com/hashicorp/go-plugin/grpc_broker.go
index 9bf56776..91eee6e6 100644
--- a/vendor/github.com/hashicorp/go-plugin/grpc_broker.go
+++ b/vendor/github.com/hashicorp/go-plugin/grpc_broker.go
@@ -15,6 +15,7 @@ import (
 	"time"
 
 	"github.com/hashicorp/go-plugin/internal/plugin"
+	"github.com/hashicorp/go-plugin/runner"
 
 	"github.com/oklog/run"
 	"google.golang.org/grpc"
@@ -267,6 +268,9 @@ type GRPCBroker struct {
 	doneCh   chan struct{}
 	o        sync.Once
 
+	socketDir      string
+	addrTranslator runner.AddrTranslator
+
 	sync.Mutex
 }
 
@@ -275,12 +279,15 @@ type gRPCBrokerPending struct {
 	doneCh chan struct{}
 }
 
-func newGRPCBroker(s streamer, tls *tls.Config) *GRPCBroker {
+func newGRPCBroker(s streamer, tls *tls.Config, socketDir string, addrTranslator runner.AddrTranslator) *GRPCBroker {
 	return &GRPCBroker{
 		streamer: s,
 		streams:  make(map[uint32]*gRPCBrokerPending),
 		tls:      tls,
 		doneCh:   make(chan struct{}),
+
+		socketDir:      socketDir,
+		addrTranslator: addrTranslator,
 	}
 }
 
@@ -288,15 +295,23 @@ func newGRPCBroker(s streamer, tls *tls.Config) *GRPCBroker {
 //
 // This should not be called multiple times with the same ID at one time.
 func (b *GRPCBroker) Accept(id uint32) (net.Listener, error) {
-	listener, err := serverListener()
+	listener, err := serverListener(b.socketDir)
 	if err != nil {
 		return nil, err
 	}
 
+	advertiseNet := listener.Addr().Network()
+	advertiseAddr := listener.Addr().String()
+	if b.addrTranslator != nil {
+		advertiseNet, advertiseAddr, err = b.addrTranslator.HostToPlugin(advertiseNet, advertiseAddr)
+		if err != nil {
+			return nil, err
+		}
+	}
 	err = b.streamer.Send(&plugin.ConnInfo{
 		ServiceId: id,
-		Network:   listener.Addr().Network(),
-		Address:   listener.Addr().String(),
+		Network:   advertiseNet,
+		Address:   advertiseAddr,
 	})
 	if err != nil {
 		return nil, err
@@ -379,12 +394,20 @@ func (b *GRPCBroker) Dial(id uint32) (conn *grpc.ClientConn, err error) {
 		return nil, fmt.Errorf("timeout waiting for connection info")
 	}
 
+	network, address := c.Network, c.Address
+	if b.addrTranslator != nil {
+		network, address, err = b.addrTranslator.PluginToHost(network, address)
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	var addr net.Addr
-	switch c.Network {
+	switch network {
 	case "tcp":
-		addr, err = net.ResolveTCPAddr("tcp", c.Address)
+		addr, err = net.ResolveTCPAddr("tcp", address)
 	case "unix":
-		addr, err = net.ResolveUnixAddr("unix", c.Address)
+		addr, err = net.ResolveUnixAddr("unix", address)
 	default:
 		err = fmt.Errorf("Unknown address type: %s", c.Address)
 	}
diff --git a/vendor/github.com/hashicorp/go-plugin/grpc_client.go b/vendor/github.com/hashicorp/go-plugin/grpc_client.go
index 6454d426..f11dd0da 100644
--- a/vendor/github.com/hashicorp/go-plugin/grpc_client.go
+++ b/vendor/github.com/hashicorp/go-plugin/grpc_client.go
@@ -63,7 +63,7 @@ func newGRPCClient(doneCtx context.Context, c *Client) (*GRPCClient, error) {
 
 	// Start the broker.
 	brokerGRPCClient := newGRPCBrokerClient(conn)
-	broker := newGRPCBroker(brokerGRPCClient, c.config.TLSConfig)
+	broker := newGRPCBroker(brokerGRPCClient, c.config.TLSConfig, c.hostSocketDir, c.runner)
 	go broker.Run()
 	go brokerGRPCClient.StartStream()
 
diff --git a/vendor/github.com/hashicorp/go-plugin/grpc_server.go b/vendor/github.com/hashicorp/go-plugin/grpc_server.go
index 7203a2cf..303d650a 100644
--- a/vendor/github.com/hashicorp/go-plugin/grpc_server.go
+++ b/vendor/github.com/hashicorp/go-plugin/grpc_server.go
@@ -84,7 +84,7 @@ func (s *GRPCServer) Init() error {
 	// Register the broker service
 	brokerServer := newGRPCBrokerServer()
 	plugin.RegisterGRPCBrokerServer(s.server, brokerServer)
-	s.broker = newGRPCBroker(brokerServer, s.TLS)
+	s.broker = newGRPCBroker(brokerServer, s.TLS, "", nil)
 	go s.broker.Run()
 
 	// Register the controller
diff --git a/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/addr_translator.go b/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/addr_translator.go
new file mode 100644
index 00000000..1854d2dd
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/addr_translator.go
@@ -0,0 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package cmdrunner
+
+// addrTranslator implements stateless identity functions, as the host and plugin
+// run in the same context wrt Unix and network addresses.
+type addrTranslator struct{}
+
+func (*addrTranslator) PluginToHost(pluginNet, pluginAddr string) (string, string, error) {
+	return pluginNet, pluginAddr, nil
+}
+
+func (*addrTranslator) HostToPlugin(hostNet, hostAddr string) (string, string, error) {
+	return hostNet, hostAddr, nil
+}
diff --git a/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/cmd_reattach.go b/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/cmd_reattach.go
new file mode 100644
index 00000000..dce1a86a
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/cmd_reattach.go
@@ -0,0 +1,63 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package cmdrunner
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"os"
+
+	"github.com/hashicorp/go-plugin/runner"
+)
+
+// ReattachFunc returns a function that allows reattaching to a plugin running
+// as a plain process. The process may or may not be a child process.
+func ReattachFunc(pid int, addr net.Addr) runner.ReattachFunc {
+	return func() (runner.AttachedRunner, error) {
+		p, err := os.FindProcess(pid)
+		if err != nil {
+			// On Unix systems, FindProcess never returns an error.
+			// On Windows, for non-existent pids it returns:
+			// os.SyscallError - 'OpenProcess: the paremter is incorrect'
+			return nil, ErrProcessNotFound
+		}
+
+		// Attempt to connect to the addr since on Unix systems FindProcess
+		// doesn't actually return an error if it can't find the process.
+		conn, err := net.Dial(addr.Network(), addr.String())
+		if err != nil {
+			p.Kill()
+			return nil, ErrProcessNotFound
+		}
+		conn.Close()
+
+		return &CmdAttachedRunner{
+			pid:     pid,
+			process: p,
+		}, nil
+	}
+}
+
+// CmdAttachedRunner is mostly a subset of CmdRunner, except the Wait function
+// does not assume the process is a child of the host process, and so uses a
+// different implementation to wait on the process.
+type CmdAttachedRunner struct {
+	pid     int
+	process *os.Process
+
+	addrTranslator
+}
+
+func (c *CmdAttachedRunner) Wait(_ context.Context) error {
+	return pidWait(c.pid)
+}
+
+func (c *CmdAttachedRunner) Kill(_ context.Context) error {
+	return c.process.Kill()
+}
+
+func (c *CmdAttachedRunner) ID() string {
+	return fmt.Sprintf("%d", c.pid)
+}
diff --git a/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/cmd_runner.go b/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/cmd_runner.go
new file mode 100644
index 00000000..b26fea92
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/cmd_runner.go
@@ -0,0 +1,129 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package cmdrunner
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+
+	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-plugin/runner"
+)
+
+var (
+	_ runner.Runner = (*CmdRunner)(nil)
+
+	// ErrProcessNotFound is returned when a client is instantiated to
+	// reattach to an existing process and it isn't found.
+	ErrProcessNotFound = errors.New("Reattachment process not found")
+)
+
+const unrecognizedRemotePluginMessage = `This usually means
+  the plugin was not compiled for this architecture,
+  the plugin is missing dynamic-link libraries necessary to run,
+  the plugin is not executable by this process due to file permissions, or
+  the plugin failed to negotiate the initial go-plugin protocol handshake
+%s`
+
+// CmdRunner implements the runner.Runner interface. It mostly just passes through
+// to exec.Cmd methods.
+type CmdRunner struct {
+	logger hclog.Logger
+	cmd    *exec.Cmd
+
+	stdout io.ReadCloser
+	stderr io.ReadCloser
+
+	// Cmd info is persisted early, since the process information will be removed
+	// after Kill is called.
+	path string
+	pid  int
+
+	addrTranslator
+}
+
+// NewCmdRunner returns an implementation of runner.Runner for running a plugin
+// as a subprocess. It must be passed a cmd that hasn't yet been started.
+func NewCmdRunner(logger hclog.Logger, cmd *exec.Cmd) (*CmdRunner, error) {
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return nil, err
+	}
+
+	stderr, err := cmd.StderrPipe()
+	if err != nil {
+		return nil, err
+	}
+
+	return &CmdRunner{
+		logger: logger,
+		cmd:    cmd,
+		stdout: stdout,
+		stderr: stderr,
+		path:   cmd.Path,
+	}, nil
+}
+
+func (c *CmdRunner) Start(_ context.Context) error {
+	c.logger.Debug("starting plugin", "path", c.cmd.Path, "args", c.cmd.Args)
+	err := c.cmd.Start()
+	if err != nil {
+		return err
+	}
+
+	c.pid = c.cmd.Process.Pid
+	c.logger.Debug("plugin started", "path", c.path, "pid", c.pid)
+	return nil
+}
+
+func (c *CmdRunner) Wait(_ context.Context) error {
+	return c.cmd.Wait()
+}
+
+func (c *CmdRunner) Kill(_ context.Context) error {
+	if c.cmd.Process != nil {
+		err := c.cmd.Process.Kill()
+		// Swallow ErrProcessDone, we support calling Kill multiple times.
+		if !errors.Is(err, os.ErrProcessDone) {
+			return err
+		}
+		return nil
+	}
+
+	return nil
+}
+
+func (c *CmdRunner) Stdout() io.ReadCloser {
+	return c.stdout
+}
+
+func (c *CmdRunner) Stderr() io.ReadCloser {
+	return c.stderr
+}
+
+func (c *CmdRunner) Name() string {
+	return c.path
+}
+
+func (c *CmdRunner) ID() string {
+	return fmt.Sprintf("%d", c.pid)
+}
+
+// peTypes is a list of Portable Executable (PE) machine types from https://learn.microsoft.com/en-us/windows/win32/debug/pe-format
+// mapped to GOARCH types. It is not comprehensive, and only includes machine types that Go supports.
+var peTypes = map[uint16]string{
+	0x14c:  "386",
+	0x1c0:  "arm",
+	0x6264: "loong64",
+	0x8664: "amd64",
+	0xaa64: "arm64",
+}
+
+func (c *CmdRunner) Diagnose(_ context.Context) string {
+	return fmt.Sprintf(unrecognizedRemotePluginMessage, additionalNotesAboutCommand(c.cmd.Path))
+}
diff --git a/vendor/github.com/hashicorp/go-plugin/notes_unix.go b/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/notes_unix.go
similarity index 99%
rename from vendor/github.com/hashicorp/go-plugin/notes_unix.go
rename to vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/notes_unix.go
index 97345575..ce04cfeb 100644
--- a/vendor/github.com/hashicorp/go-plugin/notes_unix.go
+++ b/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/notes_unix.go
@@ -4,7 +4,7 @@
 //go:build !windows
 // +build !windows
 
-package plugin
+package cmdrunner
 
 import (
 	"debug/elf"
diff --git a/vendor/github.com/hashicorp/go-plugin/notes_windows.go b/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/notes_windows.go
similarity index 98%
rename from vendor/github.com/hashicorp/go-plugin/notes_windows.go
rename to vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/notes_windows.go
index 7afcaf3f..39c51dd1 100644
--- a/vendor/github.com/hashicorp/go-plugin/notes_windows.go
+++ b/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/notes_windows.go
@@ -4,7 +4,7 @@
 //go:build windows
 // +build windows
 
-package plugin
+package cmdrunner
 
 import (
 	"debug/elf"
diff --git a/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/process.go b/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/process.go
new file mode 100644
index 00000000..6c34dc77
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/process.go
@@ -0,0 +1,25 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package cmdrunner
+
+import "time"
+
+// pidAlive checks whether a pid is alive.
+func pidAlive(pid int) bool {
+	return _pidAlive(pid)
+}
+
+// pidWait blocks for a process to exit.
+func pidWait(pid int) error {
+	ticker := time.NewTicker(1 * time.Second)
+	defer ticker.Stop()
+
+	for range ticker.C {
+		if !pidAlive(pid) {
+			break
+		}
+	}
+
+	return nil
+}
diff --git a/vendor/github.com/hashicorp/go-plugin/process_posix.go b/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/process_posix.go
similarity index 95%
rename from vendor/github.com/hashicorp/go-plugin/process_posix.go
rename to vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/process_posix.go
index b73a3607..bf3fc5b6 100644
--- a/vendor/github.com/hashicorp/go-plugin/process_posix.go
+++ b/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/process_posix.go
@@ -4,7 +4,7 @@
 //go:build !windows
 // +build !windows
 
-package plugin
+package cmdrunner
 
 import (
 	"os"
diff --git a/vendor/github.com/hashicorp/go-plugin/process_windows.go b/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/process_windows.go
similarity index 97%
rename from vendor/github.com/hashicorp/go-plugin/process_windows.go
rename to vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/process_windows.go
index ffa9b9e0..6c39df28 100644
--- a/vendor/github.com/hashicorp/go-plugin/process_windows.go
+++ b/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/process_windows.go
@@ -1,7 +1,7 @@
 // Copyright (c) HashiCorp, Inc.
 // SPDX-License-Identifier: MPL-2.0
 
-package plugin
+package cmdrunner
 
 import (
 	"syscall"
diff --git a/vendor/github.com/hashicorp/go-plugin/process.go b/vendor/github.com/hashicorp/go-plugin/process.go
index 68b028c6..b8844636 100644
--- a/vendor/github.com/hashicorp/go-plugin/process.go
+++ b/vendor/github.com/hashicorp/go-plugin/process.go
@@ -2,26 +2,3 @@
 // SPDX-License-Identifier: MPL-2.0
 
 package plugin
-
-import (
-	"time"
-)
-
-// pidAlive checks whether a pid is alive.
-func pidAlive(pid int) bool {
-	return _pidAlive(pid)
-}
-
-// pidWait blocks for a process to exit.
-func pidWait(pid int) error {
-	ticker := time.NewTicker(1 * time.Second)
-	defer ticker.Stop()
-
-	for range ticker.C {
-		if !pidAlive(pid) {
-			break
-		}
-	}
-
-	return nil
-}
diff --git a/vendor/github.com/hashicorp/go-plugin/runner/runner.go b/vendor/github.com/hashicorp/go-plugin/runner/runner.go
new file mode 100644
index 00000000..e638ae5f
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-plugin/runner/runner.go
@@ -0,0 +1,72 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package runner
+
+import (
+	"context"
+	"io"
+)
+
+// Runner defines the interface required by go-plugin to manage the lifecycle of
+// of a plugin and attempt to negotiate a connection with it. Note that this
+// is orthogonal to the protocol and transport used, which is negotiated over stdout.
+type Runner interface {
+	// Start should start the plugin and ensure any work required for servicing
+	// other interface methods is done. If the context is cancelled, it should
+	// only abort any attempts to _start_ the plugin. Waiting and shutdown are
+	// handled separately.
+	Start(ctx context.Context) error
+
+	// Diagnose makes a best-effort attempt to return any debug information that
+	// might help users understand why a plugin failed to start and negotiate a
+	// connection.
+	Diagnose(ctx context.Context) string
+
+	// Stdout is used to negotiate the go-plugin protocol.
+	Stdout() io.ReadCloser
+
+	// Stderr is used for forwarding plugin logs to the host process logger.
+	Stderr() io.ReadCloser
+
+	// Name is a human-friendly name for the plugin, such as the path to the
+	// executable. It does not have to be unique.
+	Name() string
+
+	AttachedRunner
+}
+
+// AttachedRunner defines a limited subset of Runner's interface to represent the
+// reduced responsibility for plugin lifecycle when attaching to an already running
+// plugin.
+type AttachedRunner interface {
+	// Wait should wait until the plugin stops running, whether in response to
+	// an out of band signal or in response to calling Kill().
+	Wait(ctx context.Context) error
+
+	// Kill should stop the plugin and perform any cleanup required.
+	Kill(ctx context.Context) error
+
+	// ID is a unique identifier to represent the running plugin. e.g. pid or
+	// container ID.
+	ID() string
+
+	AddrTranslator
+}
+
+// AddrTranslator translates addresses between the execution context of the host
+// process and the plugin. For example, if the plugin is in a container, the file
+// path for a Unix socket may be different between the host and the container.
+//
+// It is only intended to be used by the host process.
+type AddrTranslator interface {
+	// Called before connecting on any addresses received back from the plugin.
+	PluginToHost(pluginNet, pluginAddr string) (hostNet string, hostAddr string, err error)
+
+	// Called on any host process addresses before they are sent to the plugin.
+	HostToPlugin(hostNet, hostAddr string) (pluginNet string, pluginAddr string, err error)
+}
+
+// ReattachFunc can be passed to a client's reattach config to reattach to an
+// already running plugin instead of starting it ourselves.
+type ReattachFunc func() (AttachedRunner, error)
diff --git a/vendor/github.com/hashicorp/go-plugin/server.go b/vendor/github.com/hashicorp/go-plugin/server.go
index 3f4a017d..4e9a22c0 100644
--- a/vendor/github.com/hashicorp/go-plugin/server.go
+++ b/vendor/github.com/hashicorp/go-plugin/server.go
@@ -11,10 +11,10 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net"
 	"os"
 	"os/signal"
+	"os/user"
 	"runtime"
 	"sort"
 	"strconv"
@@ -273,7 +273,7 @@ func Serve(opts *ServeConfig) {
 	}
 
 	// Register a listener so we can accept a connection
-	listener, err := serverListener()
+	listener, err := serverListener(os.Getenv(EnvUnixSocketDir))
 	if err != nil {
 		logger.Error("plugin init error", "error", err)
 		return
@@ -496,12 +496,12 @@ func Serve(opts *ServeConfig) {
 	}
 }
 
-func serverListener() (net.Listener, error) {
+func serverListener(dir string) (net.Listener, error) {
 	if runtime.GOOS == "windows" {
 		return serverListener_tcp()
 	}
 
-	return serverListener_unix()
+	return serverListener_unix(dir)
 }
 
 func serverListener_tcp() (net.Listener, error) {
@@ -546,8 +546,8 @@ func serverListener_tcp() (net.Listener, error) {
 	return nil, errors.New("Couldn't bind plugin TCP listener")
 }
 
-func serverListener_unix() (net.Listener, error) {
-	tf, err := ioutil.TempFile("", "plugin")
+func serverListener_unix(dir string) (net.Listener, error) {
+	tf, err := os.CreateTemp(dir, "plugin")
 	if err != nil {
 		return nil, err
 	}
@@ -567,6 +567,32 @@ func serverListener_unix() (net.Listener, error) {
 		return nil, err
 	}
 
+	// By default, unix sockets are only writable by the owner. Set up a custom
+	// group owner and group write permissions if configured.
+	if groupString := os.Getenv(EnvUnixSocketGroup); groupString != "" {
+		groupID, err := strconv.Atoi(groupString)
+		if err != nil {
+			group, err := user.LookupGroup(groupString)
+			if err != nil {
+				return nil, fmt.Errorf("failed to find group ID from %s=%s environment variable: %w", EnvUnixSocketGroup, groupString, err)
+			}
+			groupID, err = strconv.Atoi(group.Gid)
+			if err != nil {
+				return nil, fmt.Errorf("failed to parse %q group's Gid as an integer: %w", groupString, err)
+			}
+		}
+
+		err = os.Chown(path, -1, groupID)
+		if err != nil {
+			return nil, err
+		}
+
+		err = os.Chmod(path, 0o660)
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	// Wrap the listener in rmListener so that the Unix domain socket file
 	// is removed on close.
 	return &rmListener{
diff --git a/vendor/github.com/hashicorp/go-plugin/testing.go b/vendor/github.com/hashicorp/go-plugin/testing.go
index ffe6fa46..27e05f01 100644
--- a/vendor/github.com/hashicorp/go-plugin/testing.go
+++ b/vendor/github.com/hashicorp/go-plugin/testing.go
@@ -166,7 +166,7 @@ func TestPluginGRPCConn(t testing.T, ps map[string]Plugin) (*GRPCClient, *GRPCSe
 	}
 
 	brokerGRPCClient := newGRPCBrokerClient(conn)
-	broker := newGRPCBroker(brokerGRPCClient, nil)
+	broker := newGRPCBroker(brokerGRPCClient, nil, "", nil)
 	go broker.Run()
 	go brokerGRPCClient.StartStream()
 
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 8bea1d03..01d6e919 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -171,10 +171,12 @@ github.com/hashicorp/go-hclog
 # github.com/hashicorp/go-multierror v1.1.1
 ## explicit; go 1.13
 github.com/hashicorp/go-multierror
-# github.com/hashicorp/go-plugin v1.4.10
+# github.com/hashicorp/go-plugin v1.5.0
 ## explicit; go 1.17
 github.com/hashicorp/go-plugin
+github.com/hashicorp/go-plugin/internal/cmdrunner
 github.com/hashicorp/go-plugin/internal/plugin
+github.com/hashicorp/go-plugin/runner
 # github.com/hashicorp/go-safetemp v1.0.0
 ## explicit
 github.com/hashicorp/go-safetemp