v29.1.2
Fixed 5
- Fix docker image inspect failing to return available image data in containerd image store when not all distributable blobs are available locally
- Fix nsenter: no namespace specified error in dockerd-rootless-setuptool.sh
- Fix docker system df showing N/A for shared size and unique size when using graph-drivers as storage
- Fix port mappings in rootless mode when slirp4netns is used
- Prevent crash when making an API request with HostConfig.PublishAllPorts set and no port bindings
Security 2
- Fix potential DoS via excessive resource usage when formatting hostname validation errors (CVE-2025-61729)
- Fix incorrect enforcement of excluded subdomain constraints for wildcard SANs which could allow improperly trusted certificates (CVE-2025-61727)
From Docker Engine
29.1.2
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Security
- Update Go runtime to 1.25.5. moby/moby#51648, docker/cli#6688
- Fixes a potential DoS via excessive resource usage when formatting hostname validation errors CVE-2025-61729
- Fixes incorrect enforcement of excluded subdomain constraints for wildcard SANs, which could allow improperly trusted certificates CVE-2025-61727
Bug fixes and enhancements
- containerd image store: Fix
docker image inspectfailing to return available image data in case where not all distributable blobs are available locally. moby/moby#51629 - dockerd-rootless-setuptool.sh: fix
nsenter: no namespace specified. moby/moby#51622 - Fix
docker system dfshowingN/Afor shared size and unique size when using graph-drivers as storage. moby/moby#51631
Packaging updates
- Update runc (in static binaries) to v1.3.4. moby/moby#51633
Networking
- Fix a bug preventing port mappings in rootless mode when slirp4netns is used. moby/moby#51616
- Prevent a crash when making an API request with
HostConfig.PublishAllPortsset (-P), and no port bindings. moby/moby#51621