# Docker Engine: what changed from 25 to 29

- Product: Docker Engine (https://whatsnew.fyi/product/docker)
- Vendor: Docker
- Range: changelog entries numbered after v25.0.17 up to and including v29.8.0, stable releases only
- Entries below: 9 releases (newest first)
- Resolved: 25 is v25.0.17 and 29 is v29.8.0, the newest stable release of each major we track
- Not shown: 5 releases whose versions could not be placed against this range
- Carrying security changes: 4 · CVEs mentioned: 6 · Mentioning breaking changes: 0 · Removing or deprecating something: 1
- Page: https://whatsnew.fyi/product/docker/compare/25...29

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## What changed (83 changes, grouped by kind)

### Added

#### v29.8.0 (2026-09-03)

- Add HostConfig.Umask option and a corresponding --umask <octal> flag to docker create/docker run to set the umask for a container's main process, execs, and healthchecks
- Add support for attaching service names, environments, and custom CloudWatch entity attributes to logs from the awslogs logging driver
- Remote network-driver plugins can now set the container-side interface name via the DstName field in their Join response
- Reserve network names "container" and "container:" to prevent creation of unusable networks
- Add annotation filter to container listings (docker ps, GET /containers/json) allowing to filter containers by their annotations

#### v29.7.0 (2026-07-30)

- Add an experimental embedded-containerd feature that runs containerd inside the daemon process instead of as a separate managed process
- Add the default-stop-timeout daemon option to configure the stop timeout assigned to containers without an explicit timeout
- Add shell completion for --filter names and known values to docker service ls, docker service ps, and docker node ps

#### v29.6.0 (2026-06-18)

- POST /containers/{id}/update endpoint now supports per-device blkio resource settings
- Add GET /images/{name}/attestations endpoint to retrieve in-toto attestation statements such as SLSA provenance and SPDX SBOM attached to an image, with support for optional platform selection, predicate type filtering, and statement query parameter
- The --password flag on docker login now accepts - to pass the password through STDIN as alternative to --password-stdin

### Changed

#### v29.8.0 (2026-09-03)

- Reduce gossip traffic generated by a node that repeatedly disconnects and rejoins the cluster
- Spread the daemon's periodic Swarm overlay network gossip and synchronization work over time, avoiding recurring bursts of CPU and network usage
- Swarm service-mesh published ports now use the same infrastructure as published ports for local containers
- Update RootlessKit to v3.1.0, adding support for the pesto port driver in rootless mode
- Update minimum supported Go version to 1.26

#### v29.7.2 (2026-08-06)

- Update BuildKit to v0.32.2
- Improve compatibility with more nftables releases by terminating base-chain policies with a semicolon

#### v29.7.0 (2026-07-30)

- Mount type image is no longer experimental
- Improve the error returned when a container hostname exceeds Linux's 64-byte limit

#### v29.6.2 (2026-07-16)

- Update containerd (static binaries) to v2.2.6
- Update Go runtime to 1.26.5
- Update RootlessKit to v3.0.2

#### v29.6.1 (2026-06-26)

- Update containerd (static binaries) to v2.2.5
- Update BuildKit to v0.31.1

#### v29.6.0 (2026-06-18)

- Update runc in static binaries to v1.3.6
- Update BuildKit to v0.31.0
- Allow the nftables firewall mode to be used with a daemon linked against libnftables when the nft command is not installed on the system
- Mitigate a crash in libnftables when using nftables as the firewall backend by changing the default build option to execute the nft command instead of linking against libnftables

#### v29.5.3 (2026-06-03)

- Update containerd (static binaries only) to v2.2.4
- Update Go runtime to 1.26.4
- Update RootlessKit to v3.0.1

### Fixed

#### v29.8.0 (2026-09-03)

- Fix docker network inspect failing to find a healthy Swarm network when another Swarm network could not be allocated
- Fix a node gossiping a superseded value for a Swarm service discovery entry after concurrent updates to the same key
- Fix Swarm service names failing to resolve on a node indefinitely after it misses a network membership announcement
- Fix Swarm service names failing to resolve on healthy nodes after a transient node failure
- Prevent dockerd from hanging when the nft command produces enough stderr output to fill its pipe
- Fix --disable-host-loopback not being enforced for the pasta network driver in rootless mode
- Fix docker image inspect reporting a smaller image size than docker image ls with containerd image store
- Fix slower image pulls caused by repeated registry authentication within a single pull with containerd image store

#### v29.7.2 (2026-08-06)

- Fix docker service create and docker service update panicking when the same environment variable is passed more than once
- Fix a regression introduced in Docker Engine 29.7.0 that caused image pulls to reject images containing absolute hardlink targets
- Fix a regression introduced in Docker Engine 29.7.0 that could cause image pulls and docker cp to fail on older Linux kernels when applying file permissions

#### v29.7.1 (2026-07-31)

- Fix a regression that prevented pulling images whose layers contain directories without explicit parent directory entries
- Fix a regression where the CopyToContainer rejects container paths that traverse absolute symlinks, such as /var/run -> /run

#### v29.7.0 (2026-07-30)

- Fix a daemon panic when cleanup of a container's network interface fails while the container is being disconnected from a network
- Fix a daemon panic when removing swarm ingress ports after failing to bind an ingress proxy listener
- Keep the cgroup mount for containers with --net=host
- containerd image store: Fix daemon-wide concurrent download and upload limits for pulls and pushes not being honored
- Fix docker cp -a using the wrong file owner when copying files into containers with user namespace remapping enabled
- Fix docker cp from a Windows container silently returning a file instead of an error when the source path ends with a separator but is not a directory
- Fix docker stats reporting all zeros for running Windows containers when using the containerd runtime
- Fix docker stats reporting empty network stats for running Windows containers when using the containerd runtime
- Fix a typo in the docker create --pull flag description
- Fix Swarm service updates failing due to file exists errors when a VIP IP alias already exists on the LB endpoint interface
- Fix Swarm tasks being rejected when their image could not be pulled from the registry but was already present on the node
- Prevent live-restored volumes from retaining active mount references when containers exit during daemon startup
- Suppress the No such container error when docker rm --force succeeds for a nonexistent container

#### v29.6.0 (2026-06-18)

- docker image push now respects NO_COLOR
- Fix docker system prune with containerd image store to include unpacked image data when reporting reclaimed space
- Fix docker system df image size reporting to count only snapshots directly used by images
- Fix registry authentication failures during worker image pulls being reported as misleading 'No such image' error
- Fix default BuildKit GC policy to prune reproducible cache types as intended
- Fix explicit file modes being filtered by the daemon umask, including COPY --chmod permissions
- Fix image selection with the containerd image store on amd64 hosts when images provide amd64 variant-specific manifests
- Don't publish container ports on host ports listed in net.ipv4.ip_local_reserved_ports when dynamically allocating ports
- Fix a race condition in overlay network bulk sync that caused approximately 30 second DNS resolution delays on newly joined swarm nodes
- Silence the spurious warning 'IPv4 forwarding is disabled' in rootless mode

#### v29.5.3 (2026-06-03)

- Reduce docker system df errors when images are pruned at the same time with the containerd image store
- Fix AWS IMDS access with gvisor-tap-vsock and UDP port forwarding for non-loopback clients
- Fix installation of plugins that require host networking

#### v29.5.2 (2026-05-20)

- Fix docker cp failing with "mkdirat: file exists" when a container has a bind mount whose target traverses an in-container symlink

### Deprecated

#### v29.6.0 (2026-06-18)

- The Engine now returns a deprecation warning when a container connected to the default bridge is created with links specified

### Security

#### v29.8.0 (2026-09-03)

- Add daemon support for configuring the default container AppArmor profile template
- Prevent containers from using the 32-bit socketcall(2) path to create AF_VSOCK sockets and communicate with host virtual machines by adding AppArmor and SELinux policy rules

#### v29.7.0 (2026-07-30)

- Update github.com/moby/go-archive to v0.3.0 to fix CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h

#### v29.6.2 (2026-07-16)

- Fix CVE-2026-15793: Git source checkout from a bundle file could lead to command injection
- Fix CVE-2026-15792: Incorrect parameters sent from a frontend could cause a panic
- Fix CVE-2026-15791: An LLB file operation could be tricked into removing the contents of the /tmp directory
- Fix CVE-2026-15789: A malicious client could bypass destination directory validation when uploading local sources
- Fix CVE-2026-15788: A WCOW cache mount source selector could resolve NTFS junctions outside of the cache root

#### v29.6.1 (2026-06-26)

- Fix a vulnerability where a malicious image could supply a malicious /etc/passwd or /etc/group-style file causing excessive memory consumption, potentially resulting in process termination due to Out Of Memory (OOM) conditions
- Fix a vulnerability where a custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the security.insecure entitlement

## Release notes

### docker-v29.8.0 — v29.8.0

- Date: 2026-09-03
- Version: docker-v29.8.0
- Original notes: https://github.com/moby/moby/releases/tag/docker-v29.8.0
- Permalink: https://whatsnew.fyi/product/docker/releases/docker-v29.8.0

- **added** — Add HostConfig.Umask option and a corresponding --umask <octal> flag to docker create/docker run to set the umask for a container's main process, execs, and healthchecks
- **added** — Add support for attaching service names, environments, and custom CloudWatch entity attributes to logs from the awslogs logging driver
- **security** — Add daemon support for configuring the default container AppArmor profile template
- **security** — Prevent containers from using the 32-bit socketcall(2) path to create AF_VSOCK sockets and communicate with host virtual machines by adding AppArmor and SELinux policy rules
- **fixed** — Fix docker network inspect failing to find a healthy Swarm network when another Swarm network could not be allocated
- **fixed** — Fix a node gossiping a superseded value for a Swarm service discovery entry after concurrent updates to the same key
- **fixed** — Fix Swarm service names failing to resolve on a node indefinitely after it misses a network membership announcement
- **fixed** — Fix Swarm service names failing to resolve on healthy nodes after a transient node failure
- **fixed** — Prevent dockerd from hanging when the nft command produces enough stderr output to fill its pipe
- **changed** — Reduce gossip traffic generated by a node that repeatedly disconnects and rejoins the cluster
- **added** — Remote network-driver plugins can now set the container-side interface name via the DstName field in their Join response
- **added** — Reserve network names "container" and "container:" to prevent creation of unusable networks
- **changed** — Spread the daemon's periodic Swarm overlay network gossip and synchronization work over time, avoiding recurring bursts of CPU and network usage
- **changed** — Swarm service-mesh published ports now use the same infrastructure as published ports for local containers
- **fixed** — Fix --disable-host-loopback not being enforced for the pasta network driver in rootless mode
- **changed** — Update RootlessKit to v3.1.0, adding support for the pesto port driver in rootless mode
- **changed** — Update minimum supported Go version to 1.26
- **added** — Add annotation filter to container listings (docker ps, GET /containers/json) allowing to filter containers by their annotations
- **fixed** — Fix docker image inspect reporting a smaller image size than docker image ls with containerd image store
- **fixed** — Fix slower image pulls caused by repeated registry authentication within a single pull with containerd image store

##### 29.8.0

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

- [docker/cli, 29.8.0 milestone](https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A29.8.0)
- [moby/moby, 29.8.0 milestone](https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A29.8.0)

###### New

- Add `HostConfig.Umask` option and a corresponding `--umask <octal>` flag to `docker create`/`docker run` to set the umask for a container's main process, execs, and healthchecks. [moby/moby#53463](https://github.com/moby/moby/pull/53463), [docker/cli#7108](https://github.com/docker/cli/pull/7108)
- Add support for attaching service names, environments, and custom CloudWatch entity attributes to logs from the `awslogs` logging driver. [moby/moby#52632](https://github.com/moby/moby/pull/52632)

###### Security

- Add daemon support for configuring the default container AppArmor profile template. [moby/moby#52771](https://github.com/moby/moby/pull/52771)
  - See https://docker.docker.com/engine/security/apparmor/#customize-the-default-profile
- Prevent containers from using the 32-bit `socketcall(2)` path to create `AF_VSOCK` sockets and communicate with host virtual machines by adding AppArmor and SELinux policy rules. [moby/moby#53551](https://github.com/moby/moby/pull/53551)

###### Networking

- Fix `docker network inspect` failing to find a healthy Swarm network when another Swarm network could not be allocated. [moby/moby#53325](https://github.com/moby/moby/pull/53325)
- Fix a node gossiping a superseded value for a Swarm service discovery entry after concurrent updates to the same key. [moby/moby#53479](https://github.com/moby/moby/pull/53479)
- Fix Swarm service names failing to resolve on a node indefinitely after it misses a network membership announcement. [moby/moby#53437](https://github.com/moby/moby/pull/53437)
- Fix Swarm service names failing to resolve on healthy nodes after a transient node failure. [moby/moby#53142](https://github.com/moby/moby/pull/53142)
- Prevent dockerd from hanging when the nft command produces enough stderr output to fill its pipe. [moby/moby#53517](https://github.com/moby/moby/pull/53517)
- Reduce gossip traffic generated by a node that repeatedly disconnects and rejoins the cluster. [moby/moby#53479](https://github.com/moby/moby/pull/53479)
- Remote network-driver plugins can now set the container-side interface name via the `DstName` field in their `Join` response. [moby/moby#52866](https://github.com/moby/moby/pull/52866)
- Reserve network names "container" and "container:" to prevent creation of unusable networks. [moby/moby#51973](https://github.com/moby/moby/pull/51973)
- Spread the daemon's periodic Swarm overlay network gossip and synchronization work over time, avoiding recurring bursts of CPU and network usage. [moby/moby#53475](https://github.com/moby/moby/pull/53475)
- Swarm service-mesh published ports now use the same infrastructure as published ports for local containers. [moby/moby#53118](https://github.com/moby/moby/pull/53118)

###### Rootless

- Fix `--disable-host-loopback` not being enforced for the `pasta` network driver in rootless mode. [moby/moby#53358](https://github.com/moby/moby/pull/53358)
- Update RootlessKit to v3.1.0, adding support for the `pesto` port driver in rootless mode. Set `DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=pesto` to use it; it requires the `pasta` network driver and supports IPv4 only. [moby/moby#53358](https://github.com/moby/moby/pull/53358)

###### Go SDK

- Update minimum supported Go version to 1.26. [docker/cli#7258](https://github.com/docker/cli/pull/7258)
###### Bug fixes and enhancements

- Add `annotation` filter to container listings (`docker ps`, `GET /containers/json`) allowing to filter containers by their annotations. [moby/moby#53538](https://github.com/moby/moby/pull/53538)
- containerd image store: Fix `docker image inspect` reporting a smaller ima

_[Truncated at 4000 characters — full notes: https://github.com/moby/moby/releases/tag/docker-v29.8.0]_

### docker-v29.7.2 — v29.7.2

- Date: 2026-08-06
- Version: docker-v29.7.2
- Original notes: https://github.com/moby/moby/releases/tag/docker-v29.7.2
- Permalink: https://whatsnew.fyi/product/docker/releases/docker-v29.7.2

- **fixed** — Fix docker service create and docker service update panicking when the same environment variable is passed more than once
- **fixed** — Fix a regression introduced in Docker Engine 29.7.0 that caused image pulls to reject images containing absolute hardlink targets
- **fixed** — Fix a regression introduced in Docker Engine 29.7.0 that could cause image pulls and docker cp to fail on older Linux kernels when applying file permissions
- **changed** — Update BuildKit to v0.32.2
- **changed** — Improve compatibility with more nftables releases by terminating base-chain policies with a semicolon

##### 29.7.2

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

- [docker/cli, 29.7.2 milestone](https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A29.7.2)
- [moby/moby, 29.7.2 milestone](https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A29.7.2)

###### Bug fixes and enhancements

- Fix `docker service create` and `docker service update` panicking when the same environment variable is passed more than once. [docker/cli#7145](https://github.com/docker/cli/pull/7145)
- Fix a regression introduced in Docker Engine 29.7.0 that caused image pulls to reject images containing absolute hardlink targets, as produced by some image builders. [moby/moby#53305](https://github.com/moby/moby/pull/53305)
- Fix a regression introduced in Docker Engine 29.7.0 that could cause image pulls and `docker cp` to fail on older Linux kernels when applying file permissions, including for device nodes. [moby/moby#53305](https://github.com/moby/moby/pull/53305)

###### Packaging updates

- Update BuildKit to [v0.32.2](https://github.com/moby/buildkit/releases/tag/v0.32.2). [moby/moby#53300](https://github.com/moby/moby/pull/53300)

###### Networking

- Improve compatibility with more nftables releases by terminating base-chain policies with a semicolon. [moby/moby#53303](https://github.com/moby/moby/pull/53303)

### docker-v29.7.1 — v29.7.1

- Date: 2026-07-31
- Version: docker-v29.7.1
- Original notes: https://github.com/moby/moby/releases/tag/docker-v29.7.1
- Permalink: https://whatsnew.fyi/product/docker/releases/docker-v29.7.1

- **fixed** — Fix a regression that prevented pulling images whose layers contain directories without explicit parent directory entries
- **fixed** — Fix a regression where the CopyToContainer rejects container paths that traverse absolute symlinks, such as /var/run -> /run

##### 29.7.1

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

- [docker/cli, 29.7.1 milestone](https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A29.7.1)
- [moby/moby, 29.7.1 milestone](https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A29.7.1)

###### Bug fixes and enhancements

- Fix a regression that prevented pulling images whose layers contain directories without explicit parent directory entries. [moby/moby#53260](https://github.com/moby/moby/pull/53260)
- Fix a regression where the `CopyToContainer` rejects container paths that traverse absolute symlinks, such as `/var/run` -> `/run`. [moby/moby#53261](https://github.com/moby/moby/pull/53261)

### docker-v29.7.0 — v29.7.0

- Date: 2026-07-30
- Version: docker-v29.7.0
- Original notes: https://github.com/moby/moby/releases/tag/docker-v29.7.0
- Permalink: https://whatsnew.fyi/product/docker/releases/docker-v29.7.0

- **added** — Add an experimental embedded-containerd feature that runs containerd inside the daemon process instead of as a separate managed process
- **changed** — Mount type image is no longer experimental
- **added** — Add the default-stop-timeout daemon option to configure the stop timeout assigned to containers without an explicit timeout
- **security** — Update github.com/moby/go-archive to v0.3.0 to fix CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h
- **fixed** — Fix a daemon panic when cleanup of a container's network interface fails while the container is being disconnected from a network
- **fixed** — Fix a daemon panic when removing swarm ingress ports after failing to bind an ingress proxy listener
- **fixed** — Keep the cgroup mount for containers with --net=host
- **added** — Add shell completion for --filter names and known values to docker service ls, docker service ps, and docker node ps
- **fixed** — containerd image store: Fix daemon-wide concurrent download and upload limits for pulls and pushes not being honored
- **fixed** — Fix docker cp -a using the wrong file owner when copying files into containers with user namespace remapping enabled
- **fixed** — Fix docker cp from a Windows container silently returning a file instead of an error when the source path ends with a separator but is not a directory
- **fixed** — Fix docker stats reporting all zeros for running Windows containers when using the containerd runtime
- **fixed** — Fix docker stats reporting empty network stats for running Windows containers when using the containerd runtime
- **fixed** — Fix a typo in the docker create --pull flag description
- **fixed** — Fix Swarm service updates failing due to file exists errors when a VIP IP alias already exists on the LB endpoint interface
- **fixed** — Fix Swarm tasks being rejected when their image could not be pulled from the registry but was already present on the node
- **changed** — Improve the error returned when a container hostname exceeds Linux's 64-byte limit
- **fixed** — Prevent live-restored volumes from retaining active mount references when containers exit during daemon startup
- **fixed** — Suppress the No such container error when docker rm --force succeeds for a nonexistent container

##### 29.7.0

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

- [docker/cli, 29.7.0 milestone](https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A29.7.0)
- [moby/moby, 29.7.0 milestone](https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A29.7.0)

###### New

- Add an experimental `embedded-containerd` feature that runs containerd inside the daemon process instead of as a separate managed process. [moby/moby#52898](https://github.com/moby/moby/pull/52898)
- Mount type `image` is no longer experimental. [moby/moby#52998](https://github.com/moby/moby/pull/52998)
- Add the `default-stop-timeout` daemon option to configure the stop timeout assigned to containers without an explicit timeout. [moby/moby#53146](https://github.com/moby/moby/pull/53146)

###### Security

This release includes a fix for a security vulnerability affecting Docker Engine and related components.

- Update github.com/moby/go-archive to v0.3.0 to fix [CVE-2026-17106](https://www.cve.org/CVERecord?id=CVE-2026-17106) / [GHSA-hfg8-hc9c-6c3h](https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h). [moby/moby#53247](https://github.com/moby/moby/pull/53247), [docker/cli#7139](https://github.com/docker/cli/pull/7139)

###### Networking

- Fix a daemon panic when cleanup of a container's network interface fails while the container is being disconnected from a network. [moby/moby#53237](https://github.com/moby/moby/pull/53237)
- Fix a daemon panic when removing swarm ingress ports after failing to bind an ingress proxy listener. [moby/moby#53022](https://github.com/moby/moby/pull/53022)

###### Rootless

- Keep the cgroup mount for containers with `--net=host`. [moby/moby#52318](https://github.com/moby/moby/pull/52318)

###### Bug fixes and enhancements


- Add shell completion for `--filter` names and known values to `docker service ls`, `docker service ps`, and `docker node ps`. [docker/cli#7124](https://github.com/docker/cli/pull/7124)
- containerd image store: Fix daemon-wide concurrent download and upload limits for pulls and pushes not being honored. [moby/moby#53081](https://github.com/moby/moby/pull/53081)
  - To preserve the previous unlimited startup behavior, configure "max-concurrent-downloads" and "max-concurrent-uploads" to 0
- Fix `docker cp -a` using the wrong file owner when copying files into containers with user namespace remapping enabled. [moby/moby#53084](https://github.com/moby/moby/pull/53084)
- Fix `docker cp` from a Windows container silently returning a file instead of an error when the source path ends with a separator but is not a directory. [moby/moby#53123](https://github.com/moby/moby/pull/53123)
- Fix `docker stats` reporting all zeros for running Windows containers when using the containerd runtime. [moby/moby#53101](https://github.com/moby/moby/pull/53101)
- Fix `docker stats` reporting empty network stats for running Windows containers when using the containerd runtime. [moby/moby#53219](https://github.com/moby/moby/pull/53219)
- Fix a typo in the `docker create --pull` flag description. [docker/cli#7103](https://github.com/docker/cli/pull/7103)
- Fix Swarm service updates failing due to "file exists" errors when a VIP IP alias already exists on the LB endpoint interface. [moby/moby#51657](https://github.com/moby/moby/pull/51657)
- Fix Swarm tasks being rejected when their image could not be pulled from the registry but was already present on the node. [moby/moby#53212](https://github.com/moby/moby/pull/53212)
- Improve the error returned when a container hostname exceeds Linux's 64-byte limit. [moby/moby#53121](https://github.com/moby/moby/pull/53121)
- Prevent live-restored volumes from retaining active mount references when containers exit during daemon startup. [moby/moby#53115](https://github.com/moby/moby/pull/53115)
- Suppress the “No such container” error when `docker rm --force` succee

_[Truncated at 4000 characters — full notes: https://github.com/moby/moby/releases/tag/docker-v29.7.0]_

### docker-v29.6.2 — v29.6.2

- Date: 2026-07-16
- Version: docker-v29.6.2
- Original notes: https://github.com/moby/moby/releases/tag/docker-v29.6.2
- Permalink: https://whatsnew.fyi/product/docker/releases/docker-v29.6.2

- **security** — Fix CVE-2026-15793: Git source checkout from a bundle file could lead to command injection
- **security** — Fix CVE-2026-15792: Incorrect parameters sent from a frontend could cause a panic
- **security** — Fix CVE-2026-15791: An LLB file operation could be tricked into removing the contents of the /tmp directory
- **security** — Fix CVE-2026-15789: A malicious client could bypass destination directory validation when uploading local sources
- **security** — Fix CVE-2026-15788: A WCOW cache mount source selector could resolve NTFS junctions outside of the cache root
- **changed** — Update containerd (static binaries) to v2.2.6
- **changed** — Update Go runtime to 1.26.5
- **changed** — Update RootlessKit to v3.0.2

##### 29.6.2

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

- [docker/cli, 29.6.2 milestone](https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A29.6.2)
- [moby/moby, 29.6.2 milestone](https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A29.6.2)

###### Security

This release includes fixes for multiple security vulnerabilities affecting Docker Engine.

- **CVE-2026-15793**: Git source checkout from a bundle file could lead to command injection. [GHSA-hw3h-2gp9-cxpv](https://github.com/moby/buildkit/security/advisories/GHSA-hw3h-2gp9-cxpv)
- **CVE-2026-15792**: Incorrect parameters sent from a frontend could cause a panic. [GHSA-qx3x-mv6r-52p6](https://github.com/moby/buildkit/security/advisories/GHSA-qx3x-mv6r-52p6)
- **CVE-2026-15791**: An LLB file operation could be tricked into removing the contents of the `/tmp` directory. [GHSA-32pv-7hq5-qhwq](https://github.com/moby/buildkit/security/advisories/GHSA-32pv-7hq5-qhwq)
- **CVE-2026-15789**: A malicious client could bypass destination directory validation when uploading local sources. [GHSA-g2h8-426c-7976](https://github.com/moby/buildkit/security/advisories/GHSA-g2h8-426c-7976)
- **CVE-2026-15788**: A WCOW cache mount source selector could resolve NTFS junctions outside of the cache root. [GHSA-388v-wmr2-g2v2](https://github.com/moby/buildkit/security/advisories/GHSA-388v-wmr2-g2v2)

###### Packaging updates

- Update containerd (static binaries) to [v2.2.6](https://github.com/containerd/containerd/releases/tag/v2.2.6). [moby/moby#53051](https://github.com/moby/moby/pull/53051)
- Update Go runtime to [1.26.5](https://go.dev/doc/devel/release#go1.26.5). [moby/moby#53027](https://github.com/moby/moby/pull/53027)

###### Rootless

- Update RootlessKit to [v3.0.2](https://github.com/rootless-containers/rootlesskit/releases/tag/v3.0.2). [moby/moby#53054](https://github.com/moby/moby/pull/53054)

### docker-v29.6.1 — v29.6.1

- Date: 2026-06-26
- Version: docker-v29.6.1
- Original notes: https://github.com/moby/moby/releases/tag/docker-v29.6.1
- Permalink: https://whatsnew.fyi/product/docker/releases/docker-v29.6.1

- **security** — Fix a vulnerability where a malicious image could supply a malicious /etc/passwd or /etc/group-style file causing excessive memory consumption, potentially resulting in process termination due to Out Of Memory (OOM) conditions
- **security** — Fix a vulnerability where a custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the security.insecure entitlement
- **changed** — Update containerd (static binaries) to v2.2.5
- **changed** — Update BuildKit to v0.31.1

##### 29.6.1

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

- [docker/cli, 29.6.1 milestone](https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A29.6.1)
- [moby/moby, 29.6.1 milestone](https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A29.6.1)

###### Security

This release includes fixes for multiple security vulnerabilities affecting Docker Engine.

- A malicious image could supply a malicious `/etc/passwd` or `/etc/group`-style file causing excessive memory consumption, potentially resulting in process termination due to Out Of Memory (OOM) conditions. [GHSA-mjcv-p78q-w5fw](https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw), [GHSA-jpcc-p29g-p8mq](https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq), [GHSA-72x6-4j93-7w86](https://github.com/moby/buildkit/security/advisories/GHSA-72x6-4j93-7w86)
- A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the security.insecure entitlement. Other security measures, like Linux capabilities were still applied to these containers. [GHSA-7236-3392-c5c6](https://github.com/moby/buildkit/security/advisories/GHSA-7236-3392-c5c6)

###### Bug fixes and enhancements

- Update containerd (static binaries) to [v2.2.5](https://github.com/containerd/containerd/releases/tag/v2.2.5). [moby/moby#52950](https://github.com/moby/moby/pull/52950)

###### Packaging updates

- Update BuildKit to [v0.31.1](https://github.com/moby/buildkit/releases/tag/v0.31.1). [moby/moby#52954](https://github.com/moby/moby/pull/52954)

### docker-v29.6.0 — v29.6.0

- Date: 2026-06-18
- Version: docker-v29.6.0
- Original notes: https://github.com/moby/moby/releases/tag/docker-v29.6.0
- Permalink: https://whatsnew.fyi/product/docker/releases/docker-v29.6.0

- **added** — POST /containers/{id}/update endpoint now supports per-device blkio resource settings
- **added** — Add GET /images/{name}/attestations endpoint to retrieve in-toto attestation statements such as SLSA provenance and SPDX SBOM attached to an image, with support for optional platform selection, predicate type filtering, and statement query parameter
- **fixed** — docker image push now respects NO_COLOR
- **fixed** — Fix docker system prune with containerd image store to include unpacked image data when reporting reclaimed space
- **fixed** — Fix docker system df image size reporting to count only snapshots directly used by images
- **fixed** — Fix registry authentication failures during worker image pulls being reported as misleading 'No such image' error
- **fixed** — Fix default BuildKit GC policy to prune reproducible cache types as intended
- **fixed** — Fix explicit file modes being filtered by the daemon umask, including COPY --chmod permissions
- **fixed** — Fix image selection with the containerd image store on amd64 hosts when images provide amd64 variant-specific manifests
- **added** — The --password flag on docker login now accepts - to pass the password through STDIN as alternative to --password-stdin
- **changed** — Update runc in static binaries to v1.3.6
- **changed** — Update BuildKit to v0.31.0
- **changed** — Allow the nftables firewall mode to be used with a daemon linked against libnftables when the nft command is not installed on the system
- **fixed** — Don't publish container ports on host ports listed in net.ipv4.ip_local_reserved_ports when dynamically allocating ports
- **fixed** — Fix a race condition in overlay network bulk sync that caused approximately 30 second DNS resolution delays on newly joined swarm nodes
- **changed** — Mitigate a crash in libnftables when using nftables as the firewall backend by changing the default build option to execute the nft command instead of linking against libnftables
- **fixed** — Silence the spurious warning 'IPv4 forwarding is disabled' in rootless mode
- **deprecated** — The Engine now returns a deprecation warning when a container connected to the default bridge is created with links specified

##### 29.6.0

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

- [docker/cli, 29.6.0 milestone](https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A29.6.0)
- [moby/moby, 29.6.0 milestone](https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A29.6.0)

###### New

- `POST /containers/{id}/update` now supports per-device blkio resource settings. [moby/moby#52651](https://github.com/moby/moby/pull/52651)
- Add `GET /images/{name}/attestations` endpoint to retrieve in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image. Supports optional platform selection, predicate type filtering, and a statement query parameter for verbatim statement bodies.

###### Bug fixes and enhancements

- `docker image push` now respects `NO_COLOR`. [docker/cli#6957](https://github.com/docker/cli/pull/6957)
- containerd image store: Fix `docker system prune` to include unpacked image data when reporting reclaimed space. [moby/moby#52905](https://github.com/moby/moby/pull/52905)
- Fix `docker system df` image size reporting to count only snapshots directly used by images. [moby/moby#52901](https://github.com/moby/moby/pull/52901)
- Fix a bug where registry authentication failures during worker image pulls were reported as a misleading “No such image” error. [moby/moby#52698](https://github.com/moby/moby/pull/52698)
- Fix default BuildKit GC policy to prune reproducible cache types as intended. [moby/moby#52814](https://github.com/moby/moby/pull/52814)
- Fix explicit file modes being filtered by the daemon umask, including `COPY --chmod` permissions. [moby/moby#52892](https://github.com/moby/moby/pull/52892)
- Fix image selection with the containerd image store on amd64 hosts when images provide amd64 variant-specific manifests. [moby/moby#52773](https://github.com/moby/moby/pull/52773)
- The `--password` flag on `docker login` now accepts `-` to pass the password through STDIN as alternative to `--password-stdin`. [docker/cli#7029](https://github.com/docker/cli/pull/7029)

###### Packaging updates

- Update runc (in static binaries) to [v1.3.6](https://github.com/opencontainers/runc/releases/tag/v1.3.6). [moby/moby#52883](https://github.com/moby/moby/pull/52883)
- Update BuildKit to [v0.31.0](https://github.com/moby/buildkit/releases/tag/v0.31.0). [moby/moby#52904](https://github.com/moby/moby/pull/52904)

###### Networking

- Allow the nftables firewall mode to be used with a daemon that is linked against libnftables when the `nft` command is not installed on the system. [moby/moby#52820](https://github.com/moby/moby/pull/52820)
- Don't publish container ports on host ports listed in `net.ipv4.ip_local_reserved_ports` when dynamically allocating ports. [moby/moby#52818](https://github.com/moby/moby/pull/52818)
- Fix a race condition in overlay network bulk sync that caused ~30s DNS resolution delays on newly joined swarm nodes. [moby/moby#52862](https://github.com/moby/moby/pull/52862)
- Mitigate a crash in libnftables when using nftables as the firewall backend by changing the default build option to execute the `nft` command instead. Users building dockerd from source can opt into linking against libnftables by building with the `libnftables` build tag. [moby/moby#52886](https://github.com/moby/moby/pull/52886)

###### Rootless

- Silence the spurious warning "IPv4 forwarding is disabled". [moby/moby#52742](https://github.com/moby/moby/pull/52742)

###### Deprecations

- The Engine now returns a deprecation warning when a container connected to the default bridge is created with links specified. [moby/moby#47427](https://github.com/moby/moby/pull/47427)

### docker-v29.5.3 — v29.5.3

- Date: 2026-06-03
- Version: docker-v29.5.3
- Original notes: https://github.com/moby/moby/releases/tag/docker-v29.5.3
- Permalink: https://whatsnew.fyi/product/docker/releases/docker-v29.5.3

- **fixed** — Reduce docker system df errors when images are pruned at the same time with the containerd image store
- **changed** — Update containerd (static binaries only) to v2.2.4
- **changed** — Update Go runtime to 1.26.4
- **changed** — Update RootlessKit to v3.0.1
- **fixed** — Fix AWS IMDS access with gvisor-tap-vsock and UDP port forwarding for non-loopback clients
- **fixed** — Fix installation of plugins that require host networking

##### 29.5.3

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

- [docker/cli, 29.5.3 milestone](https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A29.5.3)
- [moby/moby, 29.5.3 milestone](https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A29.5.3)

###### Bug fixes and enhancements

- Reduce `docker system df` errors when images are pruned at the same time with the containerd image store. [moby/moby#52672](https://github.com/moby/moby/pull/52672)

###### Packaging updates

- Update containerd (static binaries only) to [v2.2.4](https://github.com/containerd/containerd/releases/tag/v2.2.4). [moby/moby#52683](https://github.com/moby/moby/pull/52683)
- Update Go runtime to [1.26.4](https://go.dev/doc/devel/release#go1.26.4). [moby/moby#52753](https://github.com/moby/moby/pull/52753), [docker/cli#7025](https://github.com/docker/cli/pull/7025)
- Update RootlessKit to [v3.0.1](https://github.com/rootless-containers/rootlesskit/releases/tag/v3.0.1). [moby/moby#52710](https://github.com/moby/moby/pull/52710)

###### Rootless

- Fix AWS IMDS access with `gvisor-tap-vsock` and UDP port forwarding for non-loopback clients. [moby/moby#52710](https://github.com/moby/moby/pull/52710)
- Fix installation of plugins that require host networking. [moby/moby#52735](https://github.com/moby/moby/pull/52735)

### docker-v29.5.2 — v29.5.2

- Date: 2026-05-20
- Version: docker-v29.5.2
- Original notes: https://github.com/moby/moby/releases/tag/docker-v29.5.2
- Permalink: https://whatsnew.fyi/product/docker/releases/docker-v29.5.2

- **fixed** — Fix docker cp failing with "mkdirat: file exists" when a container has a bind mount whose target traverses an in-container symlink

##### 29.5.2

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

- [docker/cli, 29.5.2 milestone](https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A29.5.2)
- [moby/moby, 29.5.2 milestone](https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A29.5.2)

###### Bug fixes and enhancements

- Fix `docker cp` failing with "mkdirat: file exists" when a container has a bind mount whose target traverses an in-container symlink (e.g. `/var/run -> /run`). [moby/moby#52655](https://github.com/moby/moby/pull/52655)