# Docker Engine docker-v29.8.0 — v29.8.0

- Product: Docker Engine (https://whatsnew.fyi/product/docker)
- Vendor: Docker
- Date: 2026-09-03
- Version: docker-v29.8.0
- Original notes: https://github.com/moby/moby/releases/tag/docker-v29.8.0
- Permalink: https://whatsnew.fyi/product/docker/releases/docker-v29.8.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Add HostConfig.Umask option and a corresponding --umask <octal> flag to docker create/docker run to set the umask for a container's main process, execs, and healthchecks
- **added** — Add support for attaching service names, environments, and custom CloudWatch entity attributes to logs from the awslogs logging driver
- **security** — Add daemon support for configuring the default container AppArmor profile template
- **security** — Prevent containers from using the 32-bit socketcall(2) path to create AF_VSOCK sockets and communicate with host virtual machines by adding AppArmor and SELinux policy rules
- **fixed** — Fix docker network inspect failing to find a healthy Swarm network when another Swarm network could not be allocated
- **fixed** — Fix a node gossiping a superseded value for a Swarm service discovery entry after concurrent updates to the same key
- **fixed** — Fix Swarm service names failing to resolve on a node indefinitely after it misses a network membership announcement
- **fixed** — Fix Swarm service names failing to resolve on healthy nodes after a transient node failure
- **fixed** — Prevent dockerd from hanging when the nft command produces enough stderr output to fill its pipe
- **changed** — Reduce gossip traffic generated by a node that repeatedly disconnects and rejoins the cluster
- **added** — Remote network-driver plugins can now set the container-side interface name via the DstName field in their Join response
- **added** — Reserve network names "container" and "container:" to prevent creation of unusable networks
- **changed** — Spread the daemon's periodic Swarm overlay network gossip and synchronization work over time, avoiding recurring bursts of CPU and network usage
- **changed** — Swarm service-mesh published ports now use the same infrastructure as published ports for local containers
- **fixed** — Fix --disable-host-loopback not being enforced for the pasta network driver in rootless mode
- **changed** — Update RootlessKit to v3.1.0, adding support for the pesto port driver in rootless mode
- **changed** — Update minimum supported Go version to 1.26
- **added** — Add annotation filter to container listings (docker ps, GET /containers/json) allowing to filter containers by their annotations
- **fixed** — Fix docker image inspect reporting a smaller image size than docker image ls with containerd image store
- **fixed** — Fix slower image pulls caused by repeated registry authentication within a single pull with containerd image store

##### 29.8.0

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

- [docker/cli, 29.8.0 milestone](https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A29.8.0)
- [moby/moby, 29.8.0 milestone](https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A29.8.0)

###### New

- Add `HostConfig.Umask` option and a corresponding `--umask <octal>` flag to `docker create`/`docker run` to set the umask for a container's main process, execs, and healthchecks. [moby/moby#53463](https://github.com/moby/moby/pull/53463), [docker/cli#7108](https://github.com/docker/cli/pull/7108)
- Add support for attaching service names, environments, and custom CloudWatch entity attributes to logs from the `awslogs` logging driver. [moby/moby#52632](https://github.com/moby/moby/pull/52632)

###### Security

- Add daemon support for configuring the default container AppArmor profile template. [moby/moby#52771](https://github.com/moby/moby/pull/52771)
  - See https://docker.docker.com/engine/security/apparmor/#customize-the-default-profile
- Prevent containers from using the 32-bit `socketcall(2)` path to create `AF_VSOCK` sockets and communicate with host virtual machines by adding AppArmor and SELinux policy rules. [moby/moby#53551](https://github.com/moby/moby/pull/53551)

###### Networking

- Fix `docker network inspect` failing to find a healthy Swarm network when another Swarm network could not be allocated. [moby/moby#53325](https://github.com/moby/moby/pull/53325)
- Fix a node gossiping a superseded value for a Swarm service discovery entry after concurrent updates to the same key. [moby/moby#53479](https://github.com/moby/moby/pull/53479)
- Fix Swarm service names failing to resolve on a node indefinitely after it misses a network membership announcement. [moby/moby#53437](https://github.com/moby/moby/pull/53437)
- Fix Swarm service names failing to resolve on healthy nodes after a transient node failure. [moby/moby#53142](https://github.com/moby/moby/pull/53142)
- Prevent dockerd from hanging when the nft command produces enough stderr output to fill its pipe. [moby/moby#53517](https://github.com/moby/moby/pull/53517)
- Reduce gossip traffic generated by a node that repeatedly disconnects and rejoins the cluster. [moby/moby#53479](https://github.com/moby/moby/pull/53479)
- Remote network-driver plugins can now set the container-side interface name via the `DstName` field in their `Join` response. [moby/moby#52866](https://github.com/moby/moby/pull/52866)
- Reserve network names "container" and "container:" to prevent creation of unusable networks. [moby/moby#51973](https://github.com/moby/moby/pull/51973)
- Spread the daemon's periodic Swarm overlay network gossip and synchronization work over time, avoiding recurring bursts of CPU and network usage. [moby/moby#53475](https://github.com/moby/moby/pull/53475)
- Swarm service-mesh published ports now use the same infrastructure as published ports for local containers. [moby/moby#53118](https://github.com/moby/moby/pull/53118)

###### Rootless

- Fix `--disable-host-loopback` not being enforced for the `pasta` network driver in rootless mode. [moby/moby#53358](https://github.com/moby/moby/pull/53358)
- Update RootlessKit to v3.1.0, adding support for the `pesto` port driver in rootless mode. Set `DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=pesto` to use it; it requires the `pasta` network driver and supports IPv4 only. [moby/moby#53358](https://github.com/moby/moby/pull/53358)

###### Go SDK

- Update minimum supported Go version to 1.26. [docker/cli#7258](https://github.com/docker/cli/pull/7258)
###### Bug fixes and enhancements

- Add `annotation` filter to container listings (`docker ps`, `GET /containers/json`) allowing to filter containers by their annotations. [moby/moby#53538](https://github.com/moby/moby/pull/53538)
- containerd image store: Fix `docker image inspect` reporting a smaller ima

_[Truncated at 4000 characters — full notes: https://github.com/moby/moby/releases/tag/docker-v29.8.0]_