What’s New

Docker Engine

Developer Tools

The container runtime that packages software into portable images.

Latest client/v0.5.1 · by DockerWebsitemoby/moby

Changelog

docker-v29.7.0-rc.1Pre-release

v29.7.0-rc.1

Added
  • Add an experimental embedded-containerd feature that runs containerd inside the daemon process instead of as a separate managed process
  • Add the default-stop-timeout daemon option to configure the stop timeout assigned to containers without an explicit timeout
Changed
  • Improve the error returned when a container hostname exceeds Linux's 64-byte limit
  • Mount type image is no longer experimental
  • Update Go runtime to 1.26.5
  • Update BuildKit to v0.32.0-rc2
  • Update containerd to v2.3.3
  • Update runc to v1.4.3
Fixed
  • Fix daemon-wide concurrent download and upload limits for pulls and pushes not being honored in containerd image store
  • Fix docker cp -a using the wrong file owner when copying files into containers with user namespace remapping enabled
  • Fix docker stats reporting all zeros for running Windows containers when using the containerd runtime
  • Fix a typo in the docker create --pull flag description
  • Prevent live-restored volumes from retaining active mount references when containers exit during daemon startup
  • Suppress the No such container error when docker rm --force succeeds for a nonexistent container
  • Fix a daemon panic when removing swarm ingress ports after failing to bind an ingress proxy listener
  • Keep the cgroup mount for containers with --net=host in rootless mode
29.7.0-rc.1

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

New
  • Add an experimental embedded-containerd feature that runs containerd inside the daemon process instead of as a separate managed process. moby/moby#52898
Bug fixes and enhancements
  • Add the default-stop-timeout daemon option to configure the stop timeout assigned to containers without an explicit timeout. moby/moby#53146
  • containerd image store: Fix daemon-wide concurrent download and upload limits for pulls and pushes not being honored. moby/moby#53081
    • To preserve the previous unlimited startup behavior, configure "max-concurrent-downloads" and "max-concurrent-uploads" to 0
  • Fix docker cp -a using the wrong file owner when copying files into containers with user namespace remapping enabled. moby/moby#53084
  • Fix docker stats reporting all zeros for running Windows containers when using the containerd runtime. moby/moby#53101
  • Fix a typo in the docker create --pull flag description. docker/cli#7103
  • Improve the error returned when a container hostname exceeds Linux's 64-byte limit. moby/moby#53121
  • Mount type image is no longer experimental. moby/moby#52998
  • Prevent live-restored volumes from retaining active mount references when containers exit during daemon startup. moby/moby#53115
  • Suppress the “No such container” error when docker rm --force succeeds for a nonexistent container. docker/cli#7110
  • Update Go runtime to 1.26.5. docker/cli#7087
Packaging updates
Networking
  • Fix a daemon panic when removing swarm ingress ports after failing to bind an ingress proxy listener. moby/moby#53022
Rootless
View originalPermalink

client/v0.5.1

Fixed
  • ServiceCreate and ServiceUpdate: fix duplicate and unknown platforms
  • ServiceInspect and ContainerCommit: omit optional query args if not set
0.5.1
Changelog
  • client/pkg/jsonmessage: Display: fix godoc link. moby/moby#53070
  • client: ServiceCreate, ServiceUpdate: fix duplicate and 'unkown' platforms. moby/moby#53012
  • client: ServiceInspect, ContainerCommit: omit optional query args if not set. moby/moby#53010
  • golangci-lint: enable perfsprint linter. moby/moby#53016
View originalPermalink
docker-v29.6.2

v29.6.2

Changed
  • Update containerd (static binaries) to v2.2.6
  • Update Go runtime to 1.26.5
  • Update RootlessKit to v3.0.2
Security
  • Fix CVE-2026-15793: Git source checkout from a bundle file could lead to command injection
  • Fix CVE-2026-15792: Incorrect parameters sent from a frontend could cause a panic
  • Fix CVE-2026-15791: An LLB file operation could be tricked into removing the contents of the /tmp directory
  • Fix CVE-2026-15789: A malicious client could bypass destination directory validation when uploading local sources
  • Fix CVE-2026-15788: A WCOW cache mount source selector could resolve NTFS junctions outside of the cache root
29.6.2

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Security

This release includes fixes for multiple security vulnerabilities affecting Docker Engine.

  • CVE-2026-15793: Git source checkout from a bundle file could lead to command injection. GHSA-hw3h-2gp9-cxpv
  • CVE-2026-15792: Incorrect parameters sent from a frontend could cause a panic. GHSA-qx3x-mv6r-52p6
  • CVE-2026-15791: An LLB file operation could be tricked into removing the contents of the /tmp directory. GHSA-32pv-7hq5-qhwq
  • CVE-2026-15789: A malicious client could bypass destination directory validation when uploading local sources. GHSA-g2h8-426c-7976
  • CVE-2026-15788: A WCOW cache mount source selector could resolve NTFS junctions outside of the cache root. GHSA-388v-wmr2-g2v2
Packaging updates
Rootless
View originalPermalink
docker-v29.6.1

v29.6.1

Changed
  • Update containerd (static binaries) to v2.2.5
  • Update BuildKit to v0.31.1
Security
  • Fix a vulnerability where a malicious image could supply a malicious /etc/passwd or /etc/group-style file causing excessive memory consumption, potentially resulting in process termination due to Out Of Memory (OOM) conditions
  • Fix a vulnerability where a custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the security.insecure entitlement
29.6.1

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Security

This release includes fixes for multiple security vulnerabilities affecting Docker Engine.

  • A malicious image could supply a malicious /etc/passwd or /etc/group-style file causing excessive memory consumption, potentially resulting in process termination due to Out Of Memory (OOM) conditions. GHSA-mjcv-p78q-w5fw, GHSA-jpcc-p29g-p8mq, GHSA-72x6-4j93-7w86
  • A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the security.insecure entitlement. Other security measures, like Linux capabilities were still applied to these containers. GHSA-7236-3392-c5c6
Bug fixes and enhancements
Packaging updates
View originalPermalink
docker-v29.6.0

v29.6.0

Added
  • POST /containers/{id}/update endpoint now supports per-device blkio resource settings
  • Add GET /images/{name}/attestations endpoint to retrieve in-toto attestation statements such as SLSA provenance and SPDX SBOM attached to an image, with support for optional platform selection, predicate type filtering, and statement query parameter
  • The --password flag on docker login now accepts - to pass the password through STDIN as alternative to --password-stdin
Changed
  • Update runc in static binaries to v1.3.6
  • Update BuildKit to v0.31.0
  • Allow the nftables firewall mode to be used with a daemon linked against libnftables when the nft command is not installed on the system
  • Mitigate a crash in libnftables when using nftables as the firewall backend by changing the default build option to execute the nft command instead of linking against libnftables
Fixed
  • docker image push now respects NO_COLOR
  • Fix docker system prune with containerd image store to include unpacked image data when reporting reclaimed space
  • Fix docker system df image size reporting to count only snapshots directly used by images
  • Fix registry authentication failures during worker image pulls being reported as misleading 'No such image' error
  • Fix default BuildKit GC policy to prune reproducible cache types as intended
  • Fix explicit file modes being filtered by the daemon umask, including COPY --chmod permissions
  • Fix image selection with the containerd image store on amd64 hosts when images provide amd64 variant-specific manifests
  • Don't publish container ports on host ports listed in net.ipv4.ip_local_reserved_ports when dynamically allocating ports
  • Fix a race condition in overlay network bulk sync that caused approximately 30 second DNS resolution delays on newly joined swarm nodes
  • Silence the spurious warning 'IPv4 forwarding is disabled' in rootless mode
Deprecated
  • The Engine now returns a deprecation warning when a container connected to the default bridge is created with links specified
29.6.0

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

New
  • POST /containers/{id}/update now supports per-device blkio resource settings. moby/moby#52651
  • Add GET /images/{name}/attestations endpoint to retrieve in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image. Supports optional platform selection, predicate type filtering, and a statement query parameter for verbatim statement bodies.
Bug fixes and enhancements
  • docker image push now respects NO_COLOR. docker/cli#6957
  • containerd image store: Fix docker system prune to include unpacked image data when reporting reclaimed space. moby/moby#52905
  • Fix docker system df image size reporting to count only snapshots directly used by images. moby/moby#52901
  • Fix a bug where registry authentication failures during worker image pulls were reported as a misleading “No such image” error. moby/moby#52698
  • Fix default BuildKit GC policy to prune reproducible cache types as intended. moby/moby#52814
  • Fix explicit file modes being filtered by the daemon umask, including COPY --chmod permissions. moby/moby#52892
  • Fix image selection with the containerd image store on amd64 hosts when images provide amd64 variant-specific manifests. moby/moby#52773
  • The --password flag on docker login now accepts - to pass the password through STDIN as alternative to --password-stdin. docker/cli#7029
Packaging updates
Networking
  • Allow the nftables firewall mode to be used with a daemon that is linked against libnftables when the nft command is not installed on the system. moby/moby#52820
  • Don't publish container ports on host ports listed in net.ipv4.ip_local_reserved_ports when dynamically allocating ports. moby/moby#52818
  • Fix a race condition in overlay network bulk sync that caused ~30s DNS resolution delays on newly joined swarm nodes. moby/moby#52862
  • Mitigate a crash in libnftables when using nftables as the firewall backend by changing the default build option to execute the nft command instead. Users building dockerd from source can opt into linking against libnftables by building with the libnftables build tag. moby/moby#52886
Rootless
  • Silence the spurious warning "IPv4 forwarding is disabled". moby/moby#52742
Deprecations
  • The Engine now returns a deprecation warning when a container connected to the default bridge is created with links specified. moby/moby#47427
View originalPermalink
client/v0.5.0

client/0.5.0

Added
  • New GET /images/{name}/attestations endpoint that returns in-toto attestation statements attached to an image, with optional platform selection, predicate type filtering, and statement query parameter for retrieving verbatim statement bodies
0.5.0
Changelog
  • The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636
View originalPermalink

api/v1.55.0

Added
  • POST /containers/{id}/update now supports per-device blkio resource settings
  • Add GET /images/{name}/attestations endpoint to return in-toto attestation statements attached to an image with optional platform selection, predicate type filtering, and statement query parameter
1.55.0
Changelog
  • POST /containers/{id}/update now supports per-device blkio resource settingss. moby/moby#52651
  • The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636
  • docs: clarify swarm join required fields. moby/moby#52763
View originalPermalink
docker-v29.6.0-rc.1Pre-release

v29.6.0-rc.1

Added
  • Add GET /images/{name}/attestations endpoint to retrieve in-toto attestation statements such as SLSA provenance and SPDX SBOM attached to an image, with optional platform selection, predicate type filtering, and statement query parameter
Changed
  • docker image push now respects NO_COLOR
  • The --password flag on docker login now accepts - to pass the password through STDIN as alternative to --password-stdin
  • Allow nftables firewall mode to be used with a daemon linked against libnftables when the nft command is not installed
  • Don't publish container ports on host ports listed in net.ipv4.ip_local_reserved_ports when dynamically allocating ports
Fixed
  • Fix a bug where registry authentication failures during worker image pulls were reported as a misleading "No such image" error
  • Fix default BuildKit GC policy to prune reproducible cache types as intended
  • Silence the spurious warning "IPv4 forwarding is disabled" in rootless mode
Deprecated
  • The Engine now returns a deprecation warning when a container connected to the default bridge is created with links specified
29.6.0-rc.1

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

New
  • Add GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Clients can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636
Bug fixes and enhancements
  • docker image push now respects NO_COLOR. docker/cli#6957
  • Fix a bug where registry authentication failures during worker image pulls were reported as a misleading “No such image” error. moby/moby#52698
  • Fix default BuildKit GC policy to prune reproducible cache types as intended. moby/moby#52814
  • The --password flag on docker login now accepts - to pass the password through STDIN as alternative to --password-stdin. docker/cli#7029
Packaging updates
Networking
  • Allow the nftables firewall mode to be used with a daemon that is linked against libnftables when the nft command is not installed on the system. moby/moby#52820
  • Don't publish container ports on host ports listed in net.ipv4.ip_local_reserved_ports when dynamically allocating ports. moby/moby#52818
Rootless
  • Silence the spurious warning "IPv4 forwarding is disabled". moby/moby#52742
Deprecations
  • The Engine now returns a deprecation warning when a container connected to the default bridge is created with links specified. moby/moby#47427
View originalPermalink

client/v0.5.0-rc.1

Pre-release
Added
  • Add new GET /images/{name}/attestations endpoint that returns in-toto attestation statements attached to an image, with optional platform selection, predicate type filtering, and statement query parameter for retrieving verbatim statement bodies
0.5.0-rc.1
Changelog
  • The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636
View originalPermalink

api/v1.55.0-rc.1

Pre-release
Added
  • POST /containers/{id}/update endpoint now supports per-device blkio resource settings
  • New GET /images/{name}/attestations endpoint returns in-toto attestation statements attached to an image with optional platform selection, predicate type filtering, and statement query parameter for retrieving verbatim statement bodies
1.55.0-rc.1
Changelog
  • POST /containers/{id}/update now supports per-device blkio resource settingss. moby/moby#52651
  • The new GET /images/{name}/attestations endpoint returns in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image, with optional platform selection, predicate type filtering, and an opt-in statement query parameter for retrieving the verbatim statement bodies. Tools can now retrieve attestation metadata and content directly from the daemon instead of performing additional registry round-trips. moby/moby#52636
  • docs: clarify swarm join required fields. moby/moby#52763
View originalPermalink
docker-v29.5.3

v29.5.3

Changed
  • Update containerd (static binaries only) to v2.2.4
  • Update Go runtime to 1.26.4
  • Update RootlessKit to v3.0.1
Fixed
  • Reduce docker system df errors when images are pruned at the same time with the containerd image store
  • Fix AWS IMDS access with gvisor-tap-vsock and UDP port forwarding for non-loopback clients
  • Fix installation of plugins that require host networking
29.5.3

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug fixes and enhancements
  • Reduce docker system df errors when images are pruned at the same time with the containerd image store. moby/moby#52672
Packaging updates
Rootless
  • Fix AWS IMDS access with gvisor-tap-vsock and UDP port forwarding for non-loopback clients. moby/moby#52710
  • Fix installation of plugins that require host networking. moby/moby#52735
View originalPermalink
docker-v29.5.2

v29.5.2

Fixed
  • Fix docker cp failing with "mkdirat: file exists" when a container has a bind mount whose target traverses an in-container symlink
29.5.2

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug fixes and enhancements
  • Fix docker cp failing with "mkdirat: file exists" when a container has a bind mount whose target traverses an in-container symlink (e.g. /var/run -> /run). moby/moby#52655
View originalPermalink