Docker Engine 20.10.27 → 29.9.2

124 releases · 130 breaking changes · 130 security fixes · 11 advisories fixed

130security130breaking173deprecated109feature610fix

Is 20.10.27 affected?

Vulnerabilities fixed by this upgrade

7.6 CVE-2026-92543 Docker Engine insecure-registry fallback via malicious DNS responses
6.9 CVE-2026-92542 Blind VXLAN injection into encrypted overlay networks from cluster peer
7.2 CVE-2026-42306 Race condition in docker cp allows bind mount redirection to host path
6.1 CVE-2026-41568 Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap
7.2 CVE-2026-41567 `PUT /containers/{id}/archive` executes container binary on the host
8.8 CVE-2026-34040 AuthZ plugin bypass with oversized request body
6.8 CVE-2026-33997 Off-by-one error in plugin privilege validation
3.3 CVE-2025-54410 Firewalld reload removes bridge network isolation
9.9 CVE-2024-41110 Authz zero length regression
5.9 CVE-2024-29018 External DNS requests from 'internal' networks could lead to data exfiltration
medium GHSA-jq35-85cj-fj4p /sys/devices/virtual/powercap accessible by default to containers

Breaking changes

breaking Revert a PR breaking external DNS resolution on all custom bridge networks. moby/moby#51615 in 29.1.1
breaking The Go module github.com/docker/docker is deprecated in favor of github.com/moby/moby/client and github.com/moby/moby/api. The github.com/moby/moby module is considered an internal implementation detail - the only supported public modules are client and api. Starting with v29, releases are tagged… in 29.0.0
breaking Debian armhf (32-bit) packages now target ARMv7 CPUs and will not work on ARMv6 devices. in 29.0.0
breaking Official Raspbian (32-bit) packages are no longer provided. Use Debian arm64 packages for 64-bit devices, or Debian armhf packages for 32-bit ARMv7 devices. in 29.0.0
breaking cgroup v1 is deprecated. Support continues until at least May 2029, but migrate to cgroup v2 as soon as possible. See moby#51111. in 29.0.0
breaking Docker Content Trust was removed from the Docker CLI. Can be built as a separate plugin: https://github.com/docker/cli/blob/v29.0.0/cmd/docker-trust/main.go in 29.0.0
breaking The daemon now requires API version v1.44 or later (Docker v25.0+). in 29.0.0
breaking client: remove legacy CBC cipher suites from client config. moby/moby#50126 in 29.0.0
breaking contrib: remove editorconfig as it was unmaintained. moby/moby#50607 in 29.0.0
breaking contrib: remove Dockerfile syntax highlighting files for nano and TextMate (tmbundle) as they were unmaintained and outdated. moby/moby#50606 in 29.0.0
breaking contrib: remove mkimage-xxx scripts as they were unmaintained and not tested. moby/moby#50297 in 29.0.0
breaking Ensure bridge devices are removed when bridge network creation fails. moby/moby#51147 in 29.0.0
breaking The iptables rules for bridge networks have been updated, including removal of the DOCKER-ISOLATION-STAGE-1 and DOCKER-ISOLATION-STAGE-2 chains. With these changes:. moby/moby#49981 in 29.0.0
breaking POST /images/{name:}/push: remove compatibility with API v1.4 auth-config in body. moby/moby#50371 in 29.0.0
breaking api/types/plugin: remove deprecated Config.DockerVersion. moby/moby#51458 in 29.0.0
breaking api/types/swarm: deprecated and dropped support for PortConfigProtocol; use network.IPProtocol instead. moby/moby#51094 in 29.0.0
breaking api/pkg/progress and api/pkg/streamformatter have been removed. moby/moby#51153 in 29.0.0
breaking api: remove unused DefaultVersion, MinSupportedAPIVersion consts. moby/moby#50587 in 29.0.0
breaking client: ContainerCommitOptions: remove Pause field in favor of NoPause. moby/moby#51019 in 29.0.0
breaking client: remove client.ContainerStatsResult.OSType field. moby/moby#51305 in 29.0.0
breaking Remove structs NetworkSettingsBase and DefaultNetworkSettings. Fields in NetworkSettingsBase that were not deprecated are now directly in NetworkSettings. moby/moby#50846 in 29.0.0
breaking Remove support for legacy CBC cipher suites. docker/cli#6474 in 28.5.0
breaking Fix an issue with removal of a --link from a container in the default bridge network. moby/moby#49778 in 28.1.0
breaking cli/command/context: remove temporary ContextType field from JSON output. docker/cli#5981 in 28.1.0
breaking Remove dependency on kernel modules ip_set, ip_set_hash_net and netfilter_xt_set. in 28.0.1
breaking The executable rootlesskit-docker-proxy is no longer used, it has been removed from the build and distribution. in 28.0.0
breaking The Fluent logger option fluentd-async-connect has been deprecated in v20.10 and is now removed. moby/moby#46114 in 28.0.0
breaking The --time option on docker stop and docker restart is deprecated and renamed to --timeout. docker/cli#5485 in 28.0.0
breaking Go-SDK: pkg/ioutils: Remove NewReaderErrWrapper as it was never used. moby/moby#49258 in 28.0.0
breaking Go-SDK: pkg/ioutils: Remove deprecated BytesPipe, NewBytesPipe, ErrClosed, WriteCounter, NewWriteCounter, NewReaderErrWrapper, NopFlusher. moby/moby#49245 in 28.0.0
breaking Go-SDK: pkg/ioutils: Remove deprecated NopWriter and NopWriteCloser. moby/moby#49256 in 28.0.0
breaking Go-SDK: pkg/sysinfo: Remove deprecated NumCPU. moby/moby#49242 in 28.0.0
breaking Go-SDK: Remove pkg/broadcaster, as it was only used internally moby/moby#49172 in 28.0.0
breaking Go-SDK: Remove deprecated cli.Errors type docker/cli#5549 in 28.0.0
breaking Remove pkg/ioutils.ReadCloserWrapper, as it was only used in tests. moby/moby#49237 in 28.0.0
breaking Remove deprecated api-cors-header config parameter and the dockerd --api-cors-header option moby/moby#48209 in 28.0.0
breaking Remove deprecated APIEndpoint.Version field, APIVersion type, and APIVersion1 and APIVersion2 consts. moby/moby#49004 in 28.0.0
breaking Remove deprecated api-cors-header config parameter and the Docker daemon's --api-cors-header option. docker/cli#5437 in 28.0.0
breaking Remove deprecated pkg/directory package moby/moby#48779 in 28.0.0
breaking Remove deprecated pkg/dmsg.Dmesg() moby/moby#48109 in 28.0.0
breaking Remove deprecated image/spec package, which was moved to a separate module (github.com/moby/docker-image-spec) moby/moby#48460 in 28.0.0
breaking Remove migration code and errors for the deprecated logentries logging driver. moby/moby#48891 in 28.0.0
breaking Remove support for deprecated external graph-driver plugins. moby/moby#48072 in 28.0.0
breaking api/types: Remove deprecated container.ContainerNode and ContainerJSONBase.Node field. moby/moby#48107 in 28.0.0
breaking api/types: Remove deprecated aliases: ImagesPruneReport, VolumesPruneReport, NetworkCreateRequest, NetworkCreate, NetworkListOptions, NetworkCreateResponse, NetworkInspectOptions, NetworkConnect, NetworkDisconnect, EndpointResource, NetworkResource, NetworksPruneReport, ExecConfig, ExecStartCheck,… in 28.0.0
breaking libnetwork/iptables: Remove deprecated IPV, Iptables, IP6Tables and Passthrough(). moby/moby#49121 in 28.0.0
breaking pkg/archive: Remove deprecated CanonicalTarNameForPath, NewTempArchive, TempArchive moby/moby#48708 in 28.0.0
breaking pkg/fileutils: Remove deprecated GetTotalUsedFds moby/moby#49210 in 28.0.0
breaking pkg/ioutils: Remove OnEOFReader, which was only used internally moby/moby#49170 in 28.0.0
breaking pkg/longpath: Remove deprecated Prefix constant. moby/moby#48779 in 28.0.0
breaking pkg/stringid: Remove deprecated IsShortID and ValidateID functions moby/moby#48705 in 28.0.0
breaking runconfig/opts: Remove deprecated ConvertKVStringsToMap moby/moby#48102 in 28.0.0
breaking runconfig: Remove deprecated ContainerConfigWrapper, SetDefaultNetModeIfBlank, DefaultDaemonNetworkMode, IsPreDefinedNetwork moby/moby#48102 in 28.0.0
breaking container: Remove deprecated ErrNameReserved, ErrNameNotReserved. moby/moby#48728 in 28.0.0
breaking Remove Daemon.ContainerInspectCurrent() method and change Daemon.ContainerInspect() signature to accept a backend.ContainerInspectOptions struct moby/moby#48672 in 28.0.0
breaking Remove deprecated Daemon.Exists() and Daemon.IsPaused() methods. moby/moby#48723 in 28.0.0
breaking Deprecate Daemon.Exists() and Daemon.IsPaused(). These functions are no longer used and will be removed in the next release. moby/moby#48719 in 27.4.0
breaking Deprecate container.ErrNameReserved and container.ErrNameNotReserved. moby/moby#48697 in 27.4.0
breaking Deprecate pkg/platform - this package is only used internally, and will be removed in the next release. moby/moby#48863 in 27.4.0
breaking Deprecate RepositoryInfo.Class. This field is no longer used, and will be removed in the next release. moby/moby#49013 in 27.4.0
breaking Go SDK: Fix deprecation of cli/command.ConfigureAuth(), which was deprecated since v27.2.1. docker/cli#5552 in 27.4.0
breaking Go SDK: Deprecate cli.Errors type in favour of Go's errors.Join docker/cli#5548 in 27.4.0
breaking Remove unused docker-proxy.exe binary from Windows packages. docker/docker-ce-packaging#1045 in 27.1.2
breaking api/types: deprecate ContainerJSONBase.Node field and ContainerNode type. These definitions were used by the standalone ("classic") Swarm API, but never implemented in the Docker Engine itself. moby/moby#48055 in 27.0.2
breaking If you are using an IPv6-enabled bridge network without ip6tables, this is likely a breaking change. Only published container ports (-p or --publish) are accessible from outside the Docker bridge network, and outgoing connections masquerade as the host. in 27.0.1
breaking Deprecate experimental GraphDriver plugins. moby/moby#48050, docker/cli#5172 in 27.0.1
breaking pkg/archive: deprecate NewTempArchive and TempArchive. These types were only used in tests and will be removed in the next release. moby/moby#48002 in 27.0.1
breaking pkg/archive: deprecate CanonicalTarNameForPath moby/moby#48001 in 27.0.1
breaking Deprecate pkg/dmesg. This package was no longer used, and will be removed in the next release. moby/moby#47999 in 27.0.1
breaking Deprecate pkg/stringid.ValidateID and pkg/stringid.IsShortID moby/moby#47995 in 27.0.1
breaking runconfig: deprecate SetDefaultNetModeIfBlank and move ContainerConfigWrapper to api/types/container moby/moby#48007 in 27.0.1
breaking runconfig: deprecate DefaultDaemonNetworkMode and move to daemon/network moby/moby#48008 in 27.0.1
breaking runconfig: deprecate opts.ConvertKVStringsToMap. This utility is no longer used, and will be removed in the next release. moby/moby#48016 in 27.0.1
breaking runconfig: deprecate IsPreDefinedNetwork. moby/moby#48011 in 27.0.1
breaking Remove deprecated aliases for Image types. moby/moby#47900 in 27.0.1
breaking Remove Container and ContainerConfig fields from the GET /images/{name}/json response. moby/moby#47430 in 26.0.0
breaking Deprecate the ability to accept remote TCP connections without TLS. Deprecation notice docker/cli#4928 moby/moby#47556. in 26.0.0
breaking Remove deprecated API versions (API < v1.24) moby/moby#47155 in 26.0.0
breaking Disable pulling of deprecated image formats by default. These image formats are deprecated, and support will be removed in a future version. moby/moby#47459 in 26.0.0
breaking image: remove deprecated IDFromDigest moby/moby#47198 in 26.0.0
breaking Remove the deprecated github.com/docker/docker/pkg/loopback package. moby/moby#47128 in 26.0.0
breaking pkg/system: remove deprecated ErrNotSupportedOperatingSystem, IsOSSupported moby/moby#47129 in 26.0.0
breaking pkg/homedir: remove deprecated Key() and GetShortcutString() moby/moby#47130 in 26.0.0
breaking pkg/containerfs: remove deprecated ResolveScopedPath moby/moby#47131 in 26.0.0
breaking The daemon flag --oom-score-adjust was deprecated in v24.0 and is now removed. moby/moby#46113 in 26.0.0
breaking Remove deprecated aliases from the api/types package. These types were deprecated in v25.0.0, which provided temporary aliases. moby/moby#47148 These aliases are now removed: types.Info, types.Commit, types.PluginsInfo, types.NetworkAddressPool, types.Runtime, types.SecurityOpt, types.KeyValue,… in 26.0.0
breaking cli/command/container: remove deprecated NewStartOptions() docker/cli#4811 in 26.0.0
breaking cli/command: remove deprecated DockerCliOption, InitializeOpt docker/cli#4810 in 26.0.0
breaking Removed support for Ubuntu Lunar (23.04). docker/ce-packaging#986 in 25.0.3
breaking API: Remove VirtualSize field for the GET /images/json and GET /images/{id}/json endpoints. moby/moby#45469 in 25.0.0
breaking Remove deprecated devicemapper storage driver. moby/moby#43637 in 25.0.0
breaking Remove deprecated orchestrator options. docker/cli#4366 in 25.0.0
breaking Remove support for Debian Upstart init system. moby/moby#45548, moby/moby#45551 in 25.0.0
breaking Remove the --oom-score-adjust daemon option. moby/moby#45484 in 25.0.0
breaking Remove warning for deprecated ~/.dockercfg file. docker/cli#4281 in 25.0.0
breaking Remove logentries logging driver. moby/moby#46925 in 25.0.0
breaking Remove CLI completions for storage drivers removed in the 24.0 major release. docker/cli#4302 in 24.0.1
breaking docker info no longer reports IndexServiceAddress. docker/cli#4204 in 24.0.0
breaking libnetwork: Remove fallback code for obsolete kernel versions. moby/moby#44684, moby/moby#44802 in 24.0.0
breaking libnetwork: Remove unused code related to classic Swarm. moby/moby#44965 in 24.0.0
breaking libnetwork: Remove usage of the xt_u32 kernel module from encrypted Swarm overlay networks. moby/moby#45281 in 24.0.0
breaking Remove support for buildkit's deprecated buildinfo in favor of standard provenance attestations. moby/moby#45097 in 24.0.0
breaking Remove the deprecated AUFS and legacy overlay storage drivers. moby/moby#45342, moby/moby#45359 in 24.0.0
breaking Remove the deprecated overlay2.override_kernel_check storage driver option. moby/moby#45368 in 24.0.0
breaking Remove workarounds for obsolete versions of apparmor_parser from the AppArmor profiles. moby/moby#45500 in 24.0.0
breaking API: GET /images/json no longer represents empty RepoTags and RepoDigests as:/@. Empty arrays are be returned instead on API >= 1.43. moby/moby#45068 in 24.0.0
breaking Remove support for reading configuration from ~/.dockercfg. docker/cli#2504 in 23.0.0
breaking This location has been deprecated since 1.7.0. in 23.0.0
breaking Deprecation notice in 23.0.0
breaking Remove the -g and --graph daemon options in favor of --data-root. docker/cli#3739 in 23.0.0
breaking These options have been hidden and deprecated since 17.05. in 23.0.0
breaking Remove client-side sorting of results, in favor of the order in which the search API returns. docker/cli#3470 in 23.0.0
breaking Remove warnings related to deprecated storage drivers from the CLI. Warnings are now handled by the daemon instead. docker/cli#3542 in 23.0.0
breaking Remove Experimental client field from docker version. docker/cli#3543 in 23.0.0
breaking Require explicit opt-in to use deprecated storage drivers, and don't automatically select them when upgrading. moby/moby#43378 in 23.0.0
breaking Remove deprecated support for overlay and overlay2 storage drivers on backing filesystems without d_type support. moby/moby#43472 in 23.0.0
breaking Remove the deprecated overrideKernelCheck option from the overlay2 storage driver. moby/moby#44279 Deprecation notice in 23.0.0
breaking Remove support for the deprecated io.containerd.runtime.v1.linux OCI runtime. moby/moby#43695 in 23.0.0
breaking Remove LCOW (Linux Containers on Windows). moby/moby#42451, moby/moby#42499, moby/moby#42506, moby/moby#42511, moby/moby#42520, moby/moby#42683, moby/moby#42684, moby/moby#42685, moby/moby#43187 in 23.0.0
breaking LCOW was introduced as a technical preview in 17.09 and deprecated in 20.10. in 23.0.0
breaking Remove daemon options related to legacy overlay networks used with standalone Swarm. in 23.0.0
breaking Remove --cluster-xx options from dockerd. moby/moby#40383 in 23.0.0
breaking Remove host-discovery and overlay networks with external k/v stores. moby/moby#42247 in 23.0.0
breaking Remove a deprecated arm platform fallback. --platform linux/arm/vY will now return a error when arm/vY isn't available instead of pulling the wrong image. moby/moby#44414 in 23.0.0
breaking Remove the deprecated SetCustomHTTPHeaders(), CustomHTTPHeaders() options-setters from the Go client API. moby/moby#42694 in 23.0.0
breaking Remove the deprecated WithDialer() option-setter from the Go client API. moby/moby#44022 in 23.0.0
breaking Use WithDialContext() instead. in 23.0.0
breaking Remove the daemon implementation of opts.QuotedString. The implementation has moved to the CLI. moby/moby#43250 in 23.0.0
breaking Remove separate daemon ID from trust-key in the daemon, and disable generating the trust-key. moby/moby#43555 in 23.0.0
breaking API: Remove the deprecated KernelMemory option from POST /containers/create on API version >= 1.42. moby/moby#43214 in 23.0.0

Security changes

security The Go runtime update addresses CVE-2026-111943 by rejecting certificate chains that include eight revoked eMudhra intermediate certificates. Image pulls and pushes fail TLS certificate verification if a registry's certificate chain relies on one of the affected TLS intermediates. Affected… in 29.9.2
security Domain-validated TLS: EM DV TLS CA - G3B and EM DV TLS CA - G3C in 29.9.2
security Organization-validated TLS: EM OV TLS CA - G3B and EM OV TLS CA - G3C in 29.9.2
security Extended-validation TLS: EM EV TLS CA - G3B and EM EV TLS CA - G3C in 29.9.2
security Code signing: EM OV CS CA - G3B and EM OV CS CA - G3C in 29.9.2
security CVE-2026-95839: Pulling or importing an image through containerd's transfer service could crash containerd if a child descriptor contained the io.containerd.manifest.subject annotation and a malformed digest. in 29.9.1
security GHSA-8647-2jxj-p2rc: An untrusted registry returning a crafted Content-Length header could crash containerd when parallel layer fetching was enabled with concurrent_layer_fetch_buffer. in 29.9.1
security GHSA-hc94-p972-ch66: Pulling a crafted image or pulling from a malicious registry could exhaust host disk space because containerd did not limit incoming layer data to the declared size before validation. in 29.9.1
security CVE-2026-97032: An HTTP/2 client could crash the daemon by changing the HPACK header table size while sending requests. golang/go#81867 in 29.9.0
security CVE-2026-78659: An HTTP/2 client could exhaust daemon memory by declaring a large number of fields in a Trailer header, bypassing the header size limits. golang/go#81857 in 29.9.0
security CVE-2026-78663: An HTTP/2 client could bypass the connection-level flow control limit by resetting streams, making the daemon buffer more request data than the limit allows. golang/go#81743 in 29.9.0
security CVE-2026-78669: An HTTP/2 client could cause excessive daemon CPU use by opening many streams and repeatedly changing the initial window size. golang/go#81742 in 29.9.0
security CVE-2026-56857: On Windows, the daemon could create a directory outside its data root if someone with write access to the data root had placed a junction there. golang/go#81739 in 29.9.0
security Release a node's IPsec security associations and policies when the last container leaves an encrypted overlay network, instead of leaking them until the daemon restarts. moby/moby#53420 in 29.9.0
security CVE-2026-53493: Pulling a crafted OCI image index with deeply nested or widely fanned-out descriptors could cause unbounded CPU and memory use. GHSA-pg57-6jwg-q645 in 29.8.2
security CVE-2026-92543: A malicious DNS response could make registry connections skip TLS certificate verification or fall back to HTTP, exposing registry credentials or allowing image substitution. GHSA-7cfq-22r6-qp73 in 29.8.2
security CVE-2026-92542: Unprivileged users on a Swarm node could inject forged Ethernet frames into encrypted overlay networks on peer nodes. GHSA-6m9p-4h64-m6vh in 29.8.2
security CVE-2026-93315: A build step could redirect proxy CA cleanup outside the build root filesystem, block it with a special file, or let the build succeed when cleanup failed. GHSA-2f5p-x9ph-g97x in 29.8.2
security CVE-2026-93316: A build that requested CDI devices could cause a daemon panic when CDI support was disabled, for example with "features": {"cdi": false} in daemon.json. GHSA-r456-g3gm-cvxf in 29.8.2
security CVE-2026-93317: With the containerd image store, a client using the low-level LLB API could poison the build cache with container blob contents that did not match their claimed digest. GHSA-p3rc-w3hc-pqvv in 29.8.2
security CVE-2026-93318: A malicious image could poison the build cache with layer DiffIDs that did not match the actual layer contents. GHSA-f2v9-hprr-32q3 in 29.8.2
security CVE-2026-93319: A malicious external frontend could crash the daemon through gateway container lifecycle races or malformed requests and definitions. GHSA-4hgw-qrhw-fhg8 in 29.8.2
security CVE-2026-93320: Daemon-side snapshot reads and LLB mkfile operations did not safely handle special files. GHSA-9728-qjrv-2xh2 in 29.8.2
security CVE-2026-93321: A malformed LLB file operation with invalid symlink owner inputs could crash the daemon. GHSA-fjj4-h6vf-m9hj in 29.8.2
security CVE-2026-93322: A malformed LLB merge operation with mismatched input counts could crash the daemon. GHSA-cv6p-7w7g-xjwq in 29.8.2
security CVE-2026-93323: An oversized Dockerfile, .dockerignore, gateway file, or nested LLB definition could exhaust daemon memory. GHSA-mgqf-486f-49vp in 29.8.2
security CVE-2026-93326: A crafted Git build source could bypass source policy rules that match on the repository URL, through a Git bundle locator or a full remote URL that did not match the source identifier. GHSA-66hf-6vf5-87hc in 29.8.2
security Add daemon support for configuring the default container AppArmor profile template. moby/moby#52771 in 29.8.0
security Prevent containers from using the 32-bit socketcall(2) path to create AF_VSOCK sockets and communicate with host virtual machines by adding AppArmor and SELinux policy rules. moby/moby#53551 in 29.8.0
security Update github.com/moby/go-archive to v0.3.0 to fix CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h. moby/moby#53247, docker/cli#7139 in 29.7.0
security CVE-2026-15793: Git source checkout from a bundle file could lead to command injection. GHSA-hw3h-2gp9-cxpv in 29.6.2
security CVE-2026-15792: Incorrect parameters sent from a frontend could cause a panic. GHSA-qx3x-mv6r-52p6 in 29.6.2
security CVE-2026-15791: An LLB file operation could be tricked into removing the contents of the /tmp directory. GHSA-32pv-7hq5-qhwq in 29.6.2
security CVE-2026-15789: A malicious client could bypass destination directory validation when uploading local sources. GHSA-g2h8-426c-7976 in 29.6.2
security CVE-2026-15788: A WCOW cache mount source selector could resolve NTFS junctions outside of the cache root. GHSA-388v-wmr2-g2v2 in 29.6.2
security A malicious image could supply a malicious /etc/passwd or /etc/group-style file causing excessive memory consumption, potentially resulting in process termination due to Out Of Memory (OOM) conditions. GHSA-mjcv-p78q-w5fw, GHSA-jpcc-p29g-p8mq, GHSA-72x6-4j93-7w86 in 29.6.1
security A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the security.insecure entitlement. Other security measures, like Linux capabilities were still applied to these containers.… in 29.6.1
security CVE-2026-41567 Fix a vulnerability in docker cp where archive decompression binaries (e.g. xz, unpigz) were resolved via PATH inside the container filesystem while running as host root, allowing a malicious container to execute arbitrary binaries with host root privileges. GHSA-x86f-5xw2-fm2r in 29.5.1
security CVE-2026-41568 Fix a TOCTOU vulnerability in docker cp that allowed a container process to create files or directories at arbitrary locations on the host filesystem. GHSA-vp62-88p7-qqf5 in 29.5.1
security CVE-2026-42306 Fix a TOCTOU vulnerability in docker cp that allowed a container process to redirect a bind mount to an arbitrary location on the host filesystem. GHSA-rg2x-37c3-w2rh in 29.5.1
security CVE-2026-32288: Fix a denial of service where pulling a maliciously crafted image could cause the daemon to allocate unbounded memory when processing sparse tar archives. GHSA-x4jj-h2v8-hqqv. moby/moby#52478 in 29.5.0
security CVE-2026-31431: Fix the 29.4.2 regression that broke 32-bit programs and i386 images. The broad socketcall(2) seccomp deny is replaced with targeted AppArmor (deny network alg) and SELinux (alg_socket) rules that block AF_ALG at the LSM layer, covering both socket(2) and socketcall(2) paths… in 29.4.3
security This release includes hardening for CVE-2026-31431. in 29.4.2
security Block AF_ALG sockets and the socketcall(2) multiplexer in the default seccomp profile to prevent in-container privilege escalation via the kernel crypto API ("Copy Fail"). moby/moby#52501 in 29.4.2
security If you need a workaround, use the seccomp/v0.2.1 profile from moby/profiles. Make sure you use a kernel that includes the fix for CVE-2026-31431. in 29.4.2
security [!IMPORTANT] Use this workaround only for containers that require it. Containers that use this profile can still exploit CVE-2026-31431 through the socketcall syscall. in 29.4.2
security To use the profile for a specific container when you control the docker run command, use --security-opt: in 29.4.2
security CVE-2026-34040 Fix an authorization bypass in AuthZ plugins that could allow authorization plugins to be bypassed under specific conditions. GHSA-x744-4wpc-v9h2 in 29.3.1
security CVE-2026-33997 Fix a flaw in docker plugin install where privilege validation could be partially bypassed, potentially leading to unauthorized privilege escalation. GHSA-pxq6-2prw-chj9 in 29.3.1
security CVE-2026-33748 Fix insufficient validation of Git URL #ref:subdir fragments in BuildKit, which could allow access to files outside the intended repository scope. GHSA-4vrq-3vrq-g6gg in 29.3.1
security CVE-2026-33747 Fix a vulnerability in BuildKit where an untrusted frontend could cause files to be written outside the BuildKit state directory. GHSA-3c29-8rgm-jvjj in 29.3.1
security Update Go runtime to 1.25.5. moby/moby#51648, docker/cli#6688 in 29.1.2
security Fixes a potential DoS via excessive resource usage when formatting hostname validation errors CVE-2025-61729 in 29.1.2
security Fixes incorrect enforcement of excluded subdomain constraints for wildcard SANs, which could allow improperly trusted certificates CVE-2025-61727 in 29.1.2
security CVE-2025-31133 in 28.5.2
security CVE-2025-52565 in 28.5.2
security CVE-2025-52881 in 28.5.2
security This release fixes an issue where, after a firewalld reload, published container ports could be accessed directly from the local network, even when they were intended to be accessible only via a loopback address. CVE-2025-54388 / GHSA-x4rx-4gw3-53p4 / moby/moby#50506. in 28.3.3
security Add environment variable DOCKER_INSECURE_NO_IPTABLES_RAW=1 to allow Docker to run on systems where the Linux kernel can't provide CONFIG_IP_NF_RAW support. When enabled, Docker will not create rules in the iptables raw table. Warning: This is not recommended for production environments as it… in 28.0.2
security Update github.com/go-jose/go-jose/v4 to v4.0.5 to address. GHSA-c6gw-w398-hv78 / CVE-2025-27144 docker/cli#5867 in 28.0.1
security Fixes CVE-2025-54410: Firewalld reload removes bridge network isolation in 28.0.0
security Fix a security issue that was allowing remote hosts to connect directly to a container on its published ports. moby/moby#49325 in 28.0.0
security Fix a security issue that was allowing neighbor hosts to connect to ports mapped on a loopback address. moby/moby#49325 in 28.0.0
security Update Go runtime to 1.22.11 (fix CVE-2024-45341, CVE-2024-45336). moby/moby#49312, docker/docker-ce-packaging#1147, docker/cli#5762 in 27.5.1
security Update runc to v1.1.14, which contains a fix for CVE-2024-45310. moby/moby#48426 in 27.2.1
security This release contains a fix for CVE-2024-41110 / GHSA-v23v-6jw2-98fq that impacted setups using authorization plugins (AuthZ) for access control. No other changes are included in this release, and this release is otherwise identical for users not using AuthZ plugins. in 27.1.1
security Update Go runtime to 1.21.12, which contains security fixes for CVE-2024-24791 moby/moby#48120 in 27.1.0
security This release contains a fix for CVE-2024-41110 / GHSA-v23v-6jw2-98fq that impacted setups using authorization plugins (AuthZ) for access control. No other changes are included in this release, and this release is otherwise identical for users not using AuthZ plugins. in 26.1.5
security [CVE-2024-24789] in 26.1.4
security [CVE-2024-24790] in 26.1.4
security A symlink time of check to time of use race condition during directory removal reported by Addison Crump (@addisoncrump). in 26.1.4
security [CVE-2024-24789], [CVE-2024-24790]: Update Go runtime to 1.21.11. moby/moby#47904 in 26.1.4
security Update Buildx to v0.14.1. docker/docker-ce-packages#1021 [CVE-2024-24789]: https://github.com/golang/go/issues/66869 [CVE-2024-24790]: https://github.com/golang/go/issues/67680 in 26.1.4
security This release contains a security fix for [CVE-2024-32473], an unexpected configuration of IPv6 on IPv4-only interfaces. in 26.0.2
security [CVE-2024-32473]: Ensure IPv6 is disabled on interfaces only allocated an IPv4 address by the engine. moby#GHSA-x84c-p2g9-rqv9 [CVE-2024-32473]: https://github.com/moby/moby/security/advisories/GHSA-x84c-p2g9-rqv9 in 26.0.2
security This release contains a security fix for [CVE-2024-29018], a potential data exfiltration from 'internal' networks via authoritative DNS servers. in 26.0.0
security [CVE-2024-29018]: Do not forward requests to external DNS servers for a container that is only connected to an 'internal' network. Previously, requests were forwarded if the host's DNS server was running on a loopback address, like systemd's 127.0.0.53. moby/moby#47589 in 26.0.0
security Fix CVE-2026-17106: crafted tar archive can write outside the extraction directory. https://github.com/moby/moby/pull/53470 in 25.0.18
security Fix CVE-2026-41568: symlink escape in mount destination creation. https://github.com/moby/moby/pull/52648 in 25.0.17
security Decompress archives before entering container filesystem, fixing CVE-2026-41567. https://github.com/moby/moby/pull/52647 in 25.0.17
security Fix CVE-2026-42306: bind mount target redirection via symlink swap during docker cp. https://github.com/moby/moby/pull/52657 in 25.0.17
security Vendor github.com/containerd/containerd v1.7.33 to mitigate CVE-2024-40635. https://github.com/moby/moby/pull/49909 in 25.0.17
security [25.0 backport] update to go1.22.11 (fix CVE-2024-45341, CVE-2024-45336) in 25.0.9
security This release contains a fix for [CVE-2024-41110] / GHSA-v23v-6jw2-98fq that impacted setups using authorization plugins (AuthZ) for access control. in 25.0.6
security Update Go runtime to 1.21.12, which contains security fixes for CVE-2024-24791 moby/moby#48146 in 25.0.6
security This release contains a security fix for [CVE-2024-29018], a potential data exfiltration from 'internal' networks via authoritative DNS servers. in 25.0.5
security [CVE-2024-29018]: Do not forward requests to external DNS servers for a container that is only connected to an 'internal' network. Previously, requests were forwarded if the host's DNS server was running on a loopback address, like systemd's 127.0.0.53. moby/moby#47589 in 25.0.5
security Fix multiple parallel docker build runs leaking disk space. moby/moby#47527 [CVE-2024-29018]: https://github.com/moby/moby/security/advisories/GHSA-mq39-4gv4-mvpx in 25.0.5
security Unauthorized access to the host filesystem in 25.0.2
security Compromising the integrity of the build cache in 25.0.2
security In the case of CVE-2024-21626, a scenario that could lead to full container escape in 25.0.2
security CVE-2024-21626 in 25.0.2
security CVE-2024-23651 in 25.0.2
security CVE-2024-23652 in 25.0.2
security CVE-2024-23653 in 25.0.2
security CVE-2024-23650 in 25.0.2
security CVE-2024-24557 in 25.0.2
security CVE-2024-23651 in 24.0.9
security CVE-2024-23652 in 24.0.9
security CVE-2024-23653 in 24.0.9
security CVE-2024-23650 in 24.0.9
security CVE-2024-21626 in 24.0.9
security CVE-2024-24557 in 24.0.9
security Upgrade runc to v1.1.12. moby/moby#47269 in 24.0.9
security Upgrade containerd to v1.7.13 (static binaries only). moby/moby#47280 in 24.0.9
security Deny containers access to /sys/devices/virtual/powercap by default. This change hardens against CVE-2020-8694, CVE-2020-8695, and CVE-2020-12912, and an attack known as the PLATYPUS attack. For more details, see advisory, commit. in 24.0.7
security Fixes CVE-2024-29018: External DNS requests from 'internal' networks could lead to data exfiltration in 23.0.11
security Fixes CVE-2024-24557: Classic builder cache poisoning in 23.0.10
security Deny containers access to /sys/devices/virtual/powercap by default. This change hardens against CVE-2020-8694, CVE-2020-8695, and CVE-2020-12912, and an attack known as the PLATYPUS attack. For more details, see advisory, commit. in 23.0.8
security Upgrade Go to 1.19.8. docker/docker-ce-packaging#878, docker/cli#4164, moby/moby#45277, which contains fixes for CVE-2023-24537, CVE-2023-24538, CVE-2023-24534, and CVE-2023-24536 in 23.0.4
security Fixed a number of issues that can cause Swarm encrypted overlay networks to fail to uphold their guarantees, addressing CVE-2023-28841, CVE-2023-28840, and CVE-2023-28842. in 23.0.3
security Users of Swarm overlay networks should review GHSA-vwm3-crmr-xfxw to ensure that unintentional exposure has not occurred. in 23.0.3
security Ensure that credentials are redacted from Git URLs when generating BuildKit buildinfo. Fixes CVE-2023-26054. moby/moby#45110 in 23.0.2
security Fixes CVE-2023-28840: Encrypted overlay network may be unauthenticated in 23.0.0
security Fixes CVE-2023-28842: Encrypted overlay network with a single endpoint is unauthenticated in 23.0.0
security Fixes CVE-2023-28841: Encrypted overlay network traffic may be unencrypted in 23.0.0
security Change permissions on container hostconfig.json files to 0600 (was 0644). moby/moby#41620 in 23.0.0
security Fix --seccomp-profile not accepting unconfined and renamed the default seccomp profile to builtin. moby/moby#42481 in 23.0.0
security Always build with seccomp support, and remove the seccomp build tag. moby/moby#42501 in 23.0.0
security Add seccomp support on riscv64. moby/moby#43553 in 23.0.0
security Add support for setting flags passed to seccomp(2) in seccomp profiles. moby/moby#42648 in 23.0.0
security Refactor seccomp types to reuse runtime-spec, and add support for ErrnoRet. moby/moby#42005 in 23.0.0
security Add support for DefaultErrnoRet in seccomp profiles. moby/moby#42604 in 23.0.0
security Add an explicit DefaultErrnoRet field to the default seccomp profile, with no behavior change. moby/moby#42649 in 23.0.0
security Block socket with AF_VSOCK in the default seccomp profile. moby/moby#44563 in 23.0.0
security Re-enable process_vm_readv and process_vm_writev in the default seccomp profile. moby/moby#42083 in 23.0.0
security Add syscalls related to PKU to the default seccomp profile. moby/moby#43812 in 23.0.0
security Allow clock_settime64 with CAP_SYS_TIME. moby/moby#43775 in 23.0.0
security Allow bpf with CAP_BPF and perf_event_open with CAP_PERFMON. moby/moby#43988 in 23.0.0
security Explicitly set the clone3 syscall to return ENOSYS in the default seccomp profile, in order to ensure glibc will correctly fallback to using clone. moby/moby#42681 in 23.0.0

Deprecations

deprecated The Engine now returns a deprecation warning when a container connected to the default bridge is created with links specified. moby/moby#47427 in 29.6.0
deprecated cli/command/image/build: remove deprecated DefaultDockerfileName const. docker/cli#6737 in 29.5.0
deprecated cli/command/image/build: remove deprecated DetectArchiveReader util. docker/cli#6737 in 29.5.0
deprecated cli/command/image/build: remove deprecated IsArchive utility. docker/cli#6737 in 29.5.0
deprecated cli/command/image/build: remove deprecated ResolveAndValidateContextPath util. docker/cli#6737 in 29.5.0
deprecated cli/command/image/build: remove deprecated WriteTempDockerfile util. docker/cli#6737 in 29.5.0
deprecated Go SDK: cli-plugins/hooks: deprecate HookMessage and rename to cli-plugins/hooks.Response. docker/cli#6859 in 29.4.0
deprecated Go SDK: cli-plugins/hooks: deprecate HookType and rename to cli-plugins/hooks.ResponseType. docker/cli#6859 in 29.4.0
deprecated Go SDK: cli-plugins/manager: deprecate HookPluginData and move to cli-plugins/hooks.Request. docker/cli#6859 in 29.4.0
deprecated Remove %PROGRAMDATA%\Docker\cli-plugins from the list of paths used for CLI plugins on Windows. This path was present for backward compatibility with old installation, but replaced by %ProgramFiles%\Docker\cli-plugins. docker/cli#6713 in 29.2.0
deprecated api/types/system: deprecated top level DiskUsage fields for type specific fields. moby/moby#51235 in 29.0.0
deprecated Environment variables set on a container using legacy links are deprecated and aren't added automatically anymore. moby/moby#50719 in 29.0.0
deprecated Users are encouraged to stop relying on these as they're deprecated, and the escape hatch will be removed in a later version in 29.0.0
deprecated client/pkg/jsonmessage: remove deprecated ProgressMessage, ErrorMessage, DisplayJSONMessagesToStream and Stream interface. moby/moby#49264 in 29.0.0
deprecated GET /events no longer includes the deprecated status, id, and from fields. These fields were removed in API v1.22, but still included in the response. These fields are now omitted when using API v1.52 or later. moby/moby#50832 in 29.0.0
deprecated api/types/network: CreateRequest: remove deprecated CheckDuplicate field. moby/moby#50998 in 29.0.0
deprecated api/types/plugin: deprecate Config.DockerVersion field. moby/moby#51109 in 29.0.0
deprecated api/types/registry: remove deprecated AuthConfig.Email field. moby/moby#51059 in 29.0.0
deprecated api/types/strslice: deprecate StrSlice in favor of using a regular []string. moby/moby#50292 in 29.0.0
deprecated api/types/sytem: remove deprecated DiskUsage.BuilderSize. moby/moby#51180 in 29.0.0
deprecated api/types: move plugin types to api/types/plugin. moby/moby#48114 in 29.0.0
deprecated API: Deprecation: the Engine was automatically backfilling empty PortBindings lists with a PortBinding with an empty HostIP and HostPort when starting a container. This behavior is deprecated for API 1.52, and will be dropped in API 1.53. moby/moby#50874 in 29.0.0
deprecated build: remove DCT support for classic builder. docker/cli#6195 in 29.0.0
deprecated cli/command: Remove deprecated ResolveDefaultContext. docker/cli#6555 in 29.0.0
deprecated client: ImageBuildResponse: remove OSType field. moby/moby#50995 in 29.0.0
deprecated client: Remove ImageCreate method - useImagePull or ImageImport instead. moby/moby#51366 in 29.0.0
deprecated client: remove deprecated ImageListOptions.ContainerCount. moby/moby#51006 in 29.0.0
deprecated client: remove support for negotiating API version < v1.44 (docker 25.0). moby/moby#51119 in 29.0.0
deprecated client: remove unused Client.HTTPClient() method. moby/moby#51011 in 29.0.0
deprecated daemon/graphdriver: remove deprecated GetDriver(). moby/moby#50377 in 29.0.0
deprecated Go-SDK: cli/command/image/build: deprecate DefaultDockerfileName, DetectArchiveReader, WriteTempDockerfile, ResolveAndValidateContextPath. These utilities were only used internally and will be removed in the next release. docker/cli#6610 in 28.5.2
deprecated Go-SDK: cli/command/image/build: deprecate IsArchive utility. docker/cli#6560 in 28.5.2
deprecated Go-SDK: opts: deprecate ValidateMACAddress. docker/cli#6560 in 28.5.2
deprecated Go-SDK: opts: deprecate ListOpts.Delete(). docker/cli#6560 in 28.5.2
deprecated Deprecated and removed features, see Deprecated Features. in 28.5.1
deprecated api/types/image: InspectResponse: deprecate Parent and DockerVersion fields. moby/moby#51105 in 28.5.1
deprecated api/types/plugin: deprecate Config.DockerVersion field. moby/moby#51110 in 28.5.1
deprecated Deprecated and removed features, see Deprecated Features. in 28.5.0
deprecated Deprecate support for kernel memory TCP accounting (KernelMemoryTCP). moby/moby#51067 in 28.5.0
deprecated Go-SDK: cli/command: deprecate DockerCli.Apply. This method is no longer used and will be removed in the next release if there are no remaining uses. docker/cli#6497 in 28.5.0
deprecated Go-SDK: cli/command: deprecate DockerCli.ContentTrustEnabled. This method is no longer used and will be removed in the next release. docker/cli#6495 in 28.5.0
deprecated Go-SDK: cli/command: deprecate DockerCli.DefaultVersion. This method is no longer used and will be removed in the next release. docker/cli#6491 in 28.5.0
deprecated Go-SDK: cli/command: deprecate ResolveDefaultContext utility. docker/cli#6529 in 28.5.0
deprecated Go-SDK: cli/command: deprecate WithContentTrustFromEnv, WithContentTrust options. These options were used internally, and will be removed in the next release.. docker/cli#6489 in 28.5.0
deprecated Go-SDK: cli/manifest/store: deprecate IsNotFound(). docker/cli#6514 in 28.5.0
deprecated Go-SDK: templates: deprecate NewParse() function. docker/cli#6469 in 28.5.0
deprecated Deprecated and removed features, see Deprecated Features. in 28.4.0
deprecated Update deprecation message for AuthConfig.Email field. moby/moby#50797 in 28.4.0
deprecated Deprecate profiles package which got migrated to github.com/moby/profiles. moby/moby#50513 in 28.4.0
deprecated Deprecate special handling for quoted values for the --tlscacert, --tlscert, and --tlskey command-line flags. docker/cli#6291 in 28.4.0
deprecated Mark legacy links env vars (DOCKER_KEEP_DEPRECATED_LEGACY_LINKS_ENV_VARS) as deprecated in v28.4 and set for removal in v30.0. docker/cli#6309 in 28.4.0
deprecated Go-SDK: Deprecate field NetworkSettingsBase.Bridge, struct NetworkSettingsBase, all the fields of DefaultNetworkSettings, and struct DefaultNetworkSettings. moby/moby#50839 in 28.4.0
deprecated Go-SDK: api/types: build.CacheDiskUsage, container.DiskUsage, images.DiskUsage and volumes.DiskUsage are now deprecated and will be removed in the next major release. moby/moby#50768 in 28.4.0
deprecated Go-SDK: cli-plugins/manager: deprecate ReexecEnvvar. docker/cli#6411 in 28.4.0
deprecated Go-SDK: cli-plugins/manager: deprecate annotation aliases (CommandAnnotationPlugin, CommandAnnotationPluginVendor, CommandAnnotationPluginVersion, CommandAnnotationPluginInvalid, CommandAnnotationPluginCommandPath) in favor of their equivalent in cli-plugins/manager/metadata. docker/cli#6298 in 28.4.0
deprecated Go-SDK: cli-plugins/manager: deprecate metadata aliases (NamePrefix, MetadataSubcommandName, HookSubcommandName, Metadata, ReexecEnvvar) in favor of their equivalent in cli-plugins/manager/metadata. docker/cli#6269 in 28.4.0
deprecated Go-SDK: cli-plugins/manager: remove Candidate interface, which was only for internal use. docker/cli#6269 in 28.4.0
deprecated Go-SDK: cli-plugins/manager: remove NewPluginError function, which was only for internal use. docker/cli#6269 in 28.4.0
deprecated Go-SDK: cli-plugins/manager: remove deprecated ResourceAttributesEnvvar const. docker/cli#6269 in 28.4.0
deprecated Go-SDK: cli/command/builder: deprecate NewBuilderCommand and NewBakeStubCommand. These functions will be removed in the next release. docker/cli#6312 in 28.4.0
deprecated Go-SDK: cli/command/builder: deprecate NewPruneCommand. docker/cli#6343 in 28.4.0
deprecated Go-SDK: cli/command/checkpoint: deprecate NewCheckpointCommand. This function will be removed in the next release. docker/cli#6312 in 28.4.0
deprecated Go-SDK: cli/command/checkpoint: deprecate NewFormat, FormatWrite. docker/cli#6341 in 28.4.0
deprecated Go-SDK: cli/command/completion: deprecate NoComplete. docker/cli#6405 in 28.4.0
deprecated Go-SDK: cli/command/completion: remove deprecated ValidArgsFn. docker/cli#6259 in 28.4.0
deprecated Go-SDK: cli/command/config: deprecate NewConfigCommand. This function will be removed in the next release. docker/cli#6312 in 28.4.0
deprecated Go-SDK: cli/command/config: deprecate NewFormat, FormatWrite, InspectFormatWrite. docker/cli#6341 in 28.4.0
deprecated Go-SDK: cli/command/config: deprecate RunConfigCreate, CreateOptions, RunConfigInspect, InspectOptions, RunConfigList, ListOptions, RunConfigRemove, and RemoveOptions. docker/cli#6369 in 28.4.0
deprecated Go-SDK: cli/command/container: deprecate NewBuildCommand, NewPullCommand, NewPushCommand, NewImagesCommand, NewImageCommand, NewHistoryCommand, NewImportCommand, NewLoadCommand, NewRemoveCommand, NewSaveCommand, NewTagCommand, NewPruneCommand. These functions will be removed in the next release.… in 28.4.0
deprecated Go-SDK: cli/command/container: deprecate NewDiffFormat, DiffFormatWrite. These functions were only used internally and will be removed in the next release. docker/cli#6341 in 28.4.0
deprecated Go-SDK: cli/command/container: deprecate NewRunCommand, NewExecCommand, NewPsCommand, NewContainerCommand, NewAttachCommand, NewCommitCommand, NewCopyCommand, NewCreateCommand, NewDiffCommand, NewExportCommand, NewKillCommand, NewLogsCommand, NewPauseCommand, NewPortCommand, NewRenameCommand,… in 28.4.0
deprecated Go-SDK: cli/command/context: deprecate NewContextCommand. This function will be removed in the next release. docker/cli#6312 in 28.4.0
deprecated Go-SDK: cli/command/context: deprecate RunCreate and CreateOptions. docker/cli#6403 in 28.4.0
deprecated Go-SDK: cli/command/context: deprecate RunExport and ExportOptions. docker/cli#6403 in 28.4.0
deprecated Go-SDK: cli/command/context: deprecate RunImport. docker/cli#6403 in 28.4.0
deprecated Go-SDK: cli/command/context: deprecate RunRemove and RemoveOptions. docker/cli#6403 in 28.4.0
deprecated Go-SDK: cli/command/context: deprecate RunUpdate and UpdateOptions. docker/cli#6403 in 28.4.0
deprecated Go-SDK: cli/command/context: deprecate RunUse. docker/cli#6403 in 28.4.0
deprecated Go-SDK: cli/command/image: deprecate AuthResolver utility. docker/cli#6357 in 28.4.0
deprecated Go-SDK: cli/command/image: deprecate NewHistoryFormat, HistoryWrite. docker/cli#6341, docker/cli#6341 in 28.4.0
deprecated Go-SDK: cli/command/manifest: deprecate NewManifestCommand. This functions will be removed in the next release. docker/cli#6312 in 28.4.0
deprecated Go-SDK: cli/command/network: deprecate NewFormat, FormatWrite. docker/cli#6341 in 28.4.0
deprecated Go-SDK: cli/command/network: deprecate NewNetworkCommand. These functions will be removed in the next release. docker/cli#6312 in 28.4.0
deprecated Go-SDK: cli/command/node: deprecate NewFormat, FormatWrite, InspectFormatWrite. docker/cli#6341 in 28.4.0
deprecated Go-SDK: cli/command/node: deprecate NewNodeCommand. This functions will be removed in the next release. docker/cli#6312 in 28.4.0
deprecated Go-SDK: cli/command/plugin: deprecate NewFormat, FormatWrite. docker/cli#6341 in 28.4.0
deprecated Deprecated and removed features, see Deprecated Features. in 28.3.2
deprecated Deprecated and removed features, see Deprecated Features. in 28.3.1
deprecated Deprecated and removed features, see Deprecated Features. in 28.3.0
deprecated Empty/nil image config fields in the GET /images/{name}/json response are now deprecated and will be removed in v29.0. docker/cli#6129 in 28.3.0
deprecated api/types/container: deprecate ExecOptions.Detach. This field is not used, and will be removed in a future release. moby/moby#50219 in 28.3.0
deprecated pkg/idtools: deprecate IdentityMapping and Identity.Chown. moby/moby#50210 in 28.3.0
deprecated Deprecated and removed features, see Deprecated Features. in 28.2.0
deprecated api/types: deprecate BuildResult, ImageBuildOptions, ImageBuildOutput, ImageBuildResponse, BuilderVersion, BuilderV1, and BuilderBuildKi which were moved to api/types/build. moby/moby#50025 in 28.2.0
deprecated API: Deprecated: GET /images/{name}/json no longer returns the following fields: Config, Hostname, Domainname, AttachStdin, AttachStdout, AttachStderr, Tty, OpenStdin, StdinOnce, Image, NetworkDisabled (already omitted unless set), MacAddress (already omitted unless set), StopTimeout (already… in 28.2.0
deprecated Go-SDK: Deprecate builder/remotecontext.Rel(). This function was needed on older versions of Go, but can now be replaced by filepath.Rel(). moby/moby#49843 in 28.2.0
deprecated Go-SDK: api/types: deprecate BuildCachePruneOptions in favor of api/types/builder.CachePruneOptions. moby/moby#50015 in 28.2.0
deprecated Go-SDK: api/types: deprecate BuildCachePruneReport in favor of api/types/builder.CachePruneReport. moby/moby#50015 in 28.2.0
deprecated Go-SDK: api/types: deprecate NodeListOptions, NodeRemoveOptions, ServiceCreateOptions, ServiceUpdateOptions, RegistryAuthFromSpec, RegistryAuthFromPreviousSpec, ServiceListOptions, ServiceInspectOptions, and SwarmUnlockKeyResponse which were moved to api/types/swarm. moby/moby#50027 in 28.2.0
deprecated Go-SDK: api/types: deprecate SecretCreateResponse, SecretListOptions, ConfigCreateResponse, ConfigListOptions which were moved to api/types/swarm. moby/moby#50024 in 28.2.0
deprecated Go-SDK: client: deprecate IsErrNotFound. moby/moby#50012 in 28.2.0
deprecated Go-SDK: container: deprecate IsValidHealthString in favor of api/types/container.ValidateHealthStatus. moby/moby#49893 in 28.2.0
deprecated Go-SDK: container: deprecate StateStatus, WaitCondition, and the related WaitConditionNotRunning, WaitConditionNextExit, and WaitConditionRemoved consts in favor of their equivalents in api/types/container. moby/moby#49874 in 28.2.0
deprecated Go-SDK: opts: deprecate ListOpts.GetAll in favor of ListOpts.GetSlice. docker/cli#6032 in 28.2.0
deprecated Remove deprecated IsAutomated formatting placeholder from docker search. docker/cli#6091 in 28.2.0
deprecated Remove fallback for pulling images from non-OCI-compliant docker.pkg.github.com registry. moby/moby#50094 in 28.2.0
deprecated Remove support for pulling legacy v2, schema 1 images and remove DOCKER_ENABLE_DEPRECATED_PULL_SCHEMA_1_IMAGE environment-variable. moby/moby#50036, moby/moby#42300 in 28.2.0
deprecated The BridgeNfIptables and BridgeNfIp6tables fields in the GET /info response were deprecated in API v1.48, and are now omitted in API v1.50. moby/moby#49904 in 28.2.0
deprecated errdefs: Deprecate errdefs.FromStatusCode. Use containerd's errhttp.ToNative instead. moby/moby#50030 in 28.2.0
deprecated API: Deprecated AllowNondistributableArtifactsCIDRs and AllowNondistributableArtifactsHostnames fields in the RegistryConfig struct in the GET /info response are omitted in API v1.49. moby/moby#49749 in 28.1.0
deprecated API: Deprecated: The ContainerdCommit.Expected, RuncCommit.Expected, and InitCommit.Expected fields in the GET /info endpoint were deprecated in API v1.48, and are now omitted in API v1.49. moby/moby#48556 in 28.1.0
deprecated Go-SDK: cli/command/image: Deprecate RunPull: this function was only used internally and will be removed in the next release. docker/cli#5975 in 28.1.0
deprecated Go-SDK: cli/config/configfile: deprecate ConfigFile.Experimental field. Experimental CLI features are always enabled since version v20.10 and this field is no longer used. Use ConfigFile.Features instead for optional features. This field will be removed in a future release. docker/cli#5977 in 28.1.0
deprecated Go-SDK: deprecate pkg/archive, which was migrated to github.com/moby/go-archive. moby/moby#49743 in 28.1.0
deprecated Go-SDK: deprecate pkg/atomicwriter, which was migrated to github.com/moby/sys/atomicwriter. moby/moby#49748 in 28.1.0
deprecated Go-SDK: opts: remove deprecated PortOpt, ConfigOpt, SecretOpt aliases. docker/cli#5953 in 28.1.0
deprecated Go-SDK: registry: deprecate APIEndpoint.Official field. moby/moby#49706 in 28.1.0
deprecated Go-SDK: Deprecate cli-plugins/manager.ResourceAttributesEnvvar constant. It was used internally, but holds the OTEL_RESOURCE_ATTRIBUTES name, which is part of the OpenTelemetry specification. Users of this constant should define their own. It will be removed in the next release. docker/cli#5881 in 28.0.2
deprecated Go-SDK: Deprecate opts.PortOpt, opts.ConfigOpt and opts.SecretOpt. These types were moved to the opts/swarmopts package. docker/cli#5907 in 28.0.2
deprecated Go-SDK: Remove service/logs package. docker/cli#5910 in 28.0.2
deprecated Go-SDK: cli/command/image: Deprecate PushTrustedReference and move to cli/trust. docker/cli#5894 in 28.0.2
deprecated Go-SDK: cli/command/image: Deprecate and internalize TrustedPush. docker/cli#5894 in 28.0.2
deprecated Go-SDK: cli/command: deprecate Cli.NotaryClient: use trust.GetNotaryRepository instead. This method is no longer used and will be removed in the next release. docker/cli#5885 in 28.0.2
deprecated Go-SDK: cli/command: deprecate Cli.RegistryClient. This method was only used internally and will be removed in the next release. Use client.NewRegistryClient instead. docker/cli#5889, docker/cli#5889 in 28.0.2
deprecated Go-SDK: registry: Deprecate RepositoryInfo.Official field. moby/moby#49567 in 28.0.2
deprecated Go-SDK: registry: deprecate HostCertsDir: this function was only used internally and will be removed in the next release. moby/moby#49612 in 28.0.2
deprecated Go-SDK: registry: deprecate SetCertsDir: the cert-directory is now automatically selected when running with RootlessKit, and should no longer be set manually. moby/moby#49612 in 28.0.2
deprecated Deprecated and removed features, see Deprecated Features. in 28.0.0
deprecated The deprecated OCI prestart hook is now only used by build containers. For other containers, network interfaces are added to the network namespace after task creation is complete, before the container task is started. moby/moby#47406 in 28.0.0
deprecated API: The BridgeNfIptables and BridgeNfIp6tables fields in the GET /info response are now always be false and will be omitted in API v1.49. The netfilter module is now loaded on-demand, and no longer during daemon startup, making these fields obsolete. moby/moby#49114 in 28.0.0
deprecated API: The error and progress fields in streaming responses for endpoints that return a JSON progress response, such as POST /images/create, POST /images/{name}/push, and POST /build are deprecated. moby/moby#49447 in 28.0.0
deprecated Users should use the information in the errorDetail and progressDetail fields instead. in 28.0.0
deprecated These fields were marked deprecated in API v1.4 (docker v0.6.0) and API v1.8 (docker v0.7.1) respectively, but still returned. in 28.0.0
deprecated These fields will be left empty or will be omitted in a future API version. in 28.0.0
deprecated pkg/sysinfo: deprecate NumCPU. This utility has the same behavior as runtime.NumCPU. moby/moby#49247 in 27.5.0
deprecated pkg/fileutils: deprecate GetTotalUsedFds: this function is only used internally and will be removed in the next release. moby/moby#49209 in 27.5.0
deprecated pkg/ioutils: deprecate BytesPipe, NewBytesPipe, ErrClosed, WriteCounter, NewWriteCounter, NewReaderErrWrapper, NopFlusher, NopWriter, NopWriteCloser. They were only used internally and will be removed in the next release. moby/moby#49246, moby/moby#49255 in 27.5.0
deprecated pkg/reexec: This package is deprecated and moved to a separate module. Use github.com/moby/sys/reexec instead. moby/moby#49135 in 27.5.0
deprecated pkg/system: Deprecate Lstat(), Mkdev(), Mknod(), FromStatT() and Stat() functions, and related StatT types. These were only used internally, and will be removed in the next release. moby/moby#49100 in 27.4.1
deprecated libnetwork/iptables: Deprecate IPV, Iptables and IP6Tables types in favor of IPVersion, IPv4, and IPv6. This type and consts will be removed in the next release. moby/moby#49093 in 27.4.1
deprecated libnetwork/iptables: Deprecate Passthrough. This function was only used internally, and will be removed in the next release. moby/moby#49119 in 27.4.1
deprecated Deprecated and removed features, see Deprecated Features. in 27.2.0
deprecated Deprecated and removed features, see Deprecated Features. in 27.1.2
deprecated Deprecated and removed features, see Deprecated Features. in 27.1.0
deprecated The pkg/rootless/specconv package is deprecated, and will be removed in the next release moby/moby#48185 in 27.1.0
deprecated The pkg/containerfs package is deprecated, and will be removed in the next release moby/moby#48185 in 27.1.0
deprecated The pkg/directory package is deprecated, and will be removed in the next release moby/moby#48185 in 27.1.0
deprecated api/types/system: remove deprecated Info.ExecutionDriver moby/moby#48184 in 27.1.0
deprecated Deprecated and removed features, see Deprecated Features. in 27.0.3
deprecated Deprecated and removed features, see Deprecated Features. in 27.0.2
deprecated Deprecated and removed features, see Deprecated Features. in 27.0.1
deprecated Deprecate non-standard (config) fields in image inspect output. The Config field returned by this endpoint (used for docker image inspect) returned additional fields that are not part of the image's configuration and not part of the [Docker Image Spec] and the [OCI Image Spec]. These fields are… in 27.0.1
deprecated Deprecate the daemon flag --api-cors-header and the corresponding daemon.json configuration option. These will be removed in the next major release. moby/moby#45313 in 27.0.1
deprecated Deprecated and removed features, see Deprecated Features. in 26.1.4
deprecated Deprecated and removed features, see Deprecated Features. in 26.1.3
deprecated Deprecated and removed features, see Deprecated Features. in 26.1.2
deprecated Deprecated and removed features, see Deprecated Features. in 26.1.1
deprecated Deprecated and removed features, see Deprecated Features. in 26.1.0
deprecated Deprecated and removed features, see Deprecated Features. in 26.0.2
deprecated Deprecated and removed features, see Deprecated Features. in 26.0.1
deprecated Deprecated and removed features, see Deprecated Features. in 26.0.0
deprecated Deprecated and removed features, see Deprecated Features. in 25.0.7
deprecated Deprecated and removed features, see Deprecated Features. in 25.0.6
deprecated Deprecated and removed features, see Deprecated Features. in 25.0.5
deprecated Deprecated and removed features, see Deprecated Features. in 25.0.4
deprecated Deprecated and removed features, see Deprecated Features. in 25.0.0
deprecated Deprecate API versions older than 1.24. Deprecation notice in 25.0.0
deprecated Deprecate IsAutomated field and is-automated filter for docker search. Deprecation notice in 25.0.0
deprecated API: Deprecate Container and ContainerConfig properties for /images/{id}/json (docker image inspect). moby/moby#46939 in 25.0.0
deprecated Deprecate the --oom-score-adjust daemon option. moby/moby#45315 in 24.0.0
deprecated API: Deprecate the VirtualSize field in GET /images/json and GET /images/{id}/json. moby/moby#45346 in 24.0.0
deprecated Deprecated and removed features, see Deprecated Engine Features. in 23.0.0
deprecated Require Windows Server RS5 / LTSC 2019 (build 17763) as the minimum to run the daemon. moby/moby#43254 in 23.0.0

Every release in between

29.9.2 Oct 20, 2026 Release notes ↗

otherdocker/cli, 29.9.2 milestone

othermoby/moby, 29.9.2 milestone

securityThe Go runtime update addresses CVE-2026-111943 by rejecting certificate chains that include eight revoked eMudhra intermediate certificates. Image pulls and pushes fail TLS certificate verification if a registry's certificate chain relies on one of the affected TLS intermediates. Affected…

securityDomain-validated TLS: EM DV TLS CA - G3B and EM DV TLS CA - G3C

securityOrganization-validated TLS: EM OV TLS CA - G3B and EM OV TLS CA - G3C

securityExtended-validation TLS: EM EV TLS CA - G3B and EM EV TLS CA - G3C

securityCode signing: EM OV CS CA - G3B and EM OV CS CA - G3C

otherUpdate Go runtime to 1.26.10. moby/moby#53989, docker/cli#7418

29.9.1 Oct 14, 2026 Release notes ↗

otherdocker/cli, 29.9.1 milestone

othermoby/moby, 29.9.1 milestone

securityCVE-2026-95839: Pulling or importing an image through containerd's transfer service could crash containerd if a child descriptor contained the io.containerd.manifest.subject annotation and a malformed digest.

securityGHSA-8647-2jxj-p2rc: An untrusted registry returning a crafted Content-Length header could crash containerd when parallel layer fetching was enabled with concurrent_layer_fetch_buffer.

securityGHSA-hc94-p972-ch66: Pulling a crafted image or pulling from a malicious registry could exhaust host disk space because containerd did not limit incoming layer data to the declared size before validation.

fixFix --link-local-ip accepting addresses that are not link-local (169.254.0.0/16 or fe80::/10) when creating a container or connecting it to a network, which made the container fail to start. moby/moby#53923

fixFix COPY --from in the classic builder failing for files not owned by root when userns-remap is enabled. moby/moby#53859

fixFix docker ps -s and container listing with sizes failing entirely when the size of one container cannot be computed. moby/moby#53921

fixFix docker save leaving image layers on disk after the image is removed, when the image contains the same layer more than once (graph-driver image store). moby/moby#53927

fixFix a daemon panic when using the fluentd log driver with a TLS address that cannot be connected to and fluentd-async enabled. moby/moby#53922

fixFix image digest resolution failing when a registry mirror succeeds but a subsequent registry lookup fails. moby/moby#53933

fixFix plugin privilege lookup reporting success when fetching the plugin fails. moby/moby#53934

otherUpdate containerd (static binaries) to v2.4.2. moby/moby#53936

featureDon't add bridge network interfaces to firewalld's docker zone when iptables and ip6tables are both disabled. moby/moby#53907

fixFix bridge networks failing to restore on daemon startup when their bridge is bound to a firewalld zone other than docker. moby/moby#53907

fixFix --domainname with user namespaces and rootless mode; this requires an OCI runtime supporting the domainname field (such as runc >= v1.2.0). moby/moby#53899

otherUpdate RootlessKit to v3.3.0. moby/moby#53942

29.9.0 Oct 8, 2026 Release notes ↗

otherdocker/cli, 29.9.0 milestone

othermoby/moby, 29.9.0 milestone

securityCVE-2026-97032: An HTTP/2 client could crash the daemon by changing the HPACK header table size while sending requests. golang/go#81867

securityCVE-2026-78659: An HTTP/2 client could exhaust daemon memory by declaring a large number of fields in a Trailer header, bypassing the header size limits. golang/go#81857

securityCVE-2026-78663: An HTTP/2 client could bypass the connection-level flow control limit by resetting streams, making the daemon buffer more request data than the limit allows. golang/go#81743

securityCVE-2026-78669: An HTTP/2 client could cause excessive daemon CPU use by opening many streams and repeatedly changing the initial window size. golang/go#81742

securityCVE-2026-56857: On Windows, the daemon could create a directory outside its data root if someone with write access to the data root had placed a junction there. golang/go#81739

fixcontainerd image store: Add the lazy-pull daemon feature to control whether docker pull skips downloading layer content that the snapshotter already provides. Lazy pulls are enabled by default for known remote snapshotters (nydus, overlaybd, soci, stargz). moby/moby#53877

fixcontainerd image store: Fix pulls skipping required layer blobs when unpacked layers already exist, leaving images runnable but incomplete for export or push. moby/moby#53615

fixFix docker container create --name reporting a misleading validation error mentioning invalid characters instead of invalid name length. moby/moby#53484

fixFix a connection leak to the RootlessKit API socket on every GET /version request in rootless mode. moby/moby#53836

fixImprove Windows service registration and unregistration cleanup, including making service unregistration (--unregister-service) idempotent. moby/moby#53845

otherUpdate BuildKit to v0.34.0. moby/moby#53882

otherUpdate Go runtime to 1.26.9. docker/cli#7363

otherUpdate containerd (static binaries) to v2.4.1. moby/moby#53773

featureAllow IPv6 Neighbour Discovery between containers on a bridge network with inter-container communication disabled, matching the existing IPv4 behaviour. moby/moby#53723

fixFix docker ps and GET /containers/json omitting published ports for networks using routed gateway mode. moby/moby#53693

fixFix a bug where a restarted daemon could be dropped from a peer's service discovery and load balancing until it rejoined the gossip cluster. moby/moby#53688

fixFix a published port being unreachable from another container on the same network when inter-container communication is disabled, including Swarm services published through the routing mesh. moby/moby#53723

fixFix an issue where errors programming the kernel to encrypt the overlay network data-plane could in some circumstances lead to encrypted-overlay-network traffic to some nodes being transmitted in cleartext. As the receiving peer would drop cleartext packets for encrypted overlay networks as…

fixFix connecting live-restored containers with an implicit host-gateway mapping to additional networks. moby/moby#53093

fixFix overlay peers becoming unreachable after a node rejoins the cluster or a service is redeployed, when the VXLAN device had already learned a dynamic FDB entry for the peer. moby/moby#53663

fixFix Swarm tasks on overlay networks being rejected when the daemon can't write to /var/lib/docker. moby/moby#53848

featurePublished Swarm-service ports are accessible at the host's IPv6 addresses when the userland proxy is enabled. A change introduced in v29.8.0 incidentally enabled this functionality; it is a tested and supported feature as of v29.9.0. moby/moby#53727

securityRelease a node's IPsec security associations and policies when the last container leaves an encrypted overlay network, instead of leaking them until the daemon restarts. moby/moby#53420

otherRestore the logic to remove the empty DOCKER-INGRESS iptables chain, and the FORWARD rule that jumps to it, left behind by Docker Engine 28.0.0 and earlier. moby/moby#53825

otherUpdate RootlessKit (3.2.0). moby/moby#53607

29.8.2 Sep 30, 2026 Release notes ↗

otherdocker/cli, 29.8.2 milestone

othermoby/moby, 29.8.2 milestone

securityCVE-2026-53493: Pulling a crafted OCI image index with deeply nested or widely fanned-out descriptors could cause unbounded CPU and memory use. GHSA-pg57-6jwg-q645

securityCVE-2026-92543: A malicious DNS response could make registry connections skip TLS certificate verification or fall back to HTTP, exposing registry credentials or allowing image substitution. GHSA-7cfq-22r6-qp73

securityCVE-2026-92542: Unprivileged users on a Swarm node could inject forged Ethernet frames into encrypted overlay networks on peer nodes. GHSA-6m9p-4h64-m6vh

securityCVE-2026-93315: A build step could redirect proxy CA cleanup outside the build root filesystem, block it with a special file, or let the build succeed when cleanup failed. GHSA-2f5p-x9ph-g97x

securityCVE-2026-93316: A build that requested CDI devices could cause a daemon panic when CDI support was disabled, for example with "features": {"cdi": false} in daemon.json. GHSA-r456-g3gm-cvxf

securityCVE-2026-93317: With the containerd image store, a client using the low-level LLB API could poison the build cache with container blob contents that did not match their claimed digest. GHSA-p3rc-w3hc-pqvv

securityCVE-2026-93318: A malicious image could poison the build cache with layer DiffIDs that did not match the actual layer contents. GHSA-f2v9-hprr-32q3

securityCVE-2026-93319: A malicious external frontend could crash the daemon through gateway container lifecycle races or malformed requests and definitions. GHSA-4hgw-qrhw-fhg8

securityCVE-2026-93320: Daemon-side snapshot reads and LLB mkfile operations did not safely handle special files. GHSA-9728-qjrv-2xh2

securityCVE-2026-93321: A malformed LLB file operation with invalid symlink owner inputs could crash the daemon. GHSA-fjj4-h6vf-m9hj

securityCVE-2026-93322: A malformed LLB merge operation with mismatched input counts could crash the daemon. GHSA-cv6p-7w7g-xjwq

securityCVE-2026-93323: An oversized Dockerfile, .dockerignore, gateway file, or nested LLB definition could exhaust daemon memory. GHSA-mgqf-486f-49vp

securityCVE-2026-93326: A crafted Git build source could bypass source policy rules that match on the repository URL, through a Git bundle locator or a full remote URL that did not match the source identifier. GHSA-66hf-6vf5-87hc

fixFix docker cp failing on a container with a bind-mounted socket nested inside another bind mount. moby/moby#53724

fixFix docker info failing with an “invalid Prefix” error after reloading a daemon with custom default address pools. moby/moby#53812

otherUpdate BuildKit to v0.33.1. moby/moby#53823

otherUpdate containerd (static binaries) to v2.3.6. moby/moby#53778

otherUpdate runc (in static binaries) to v1.5.2. moby/moby#53811

29.8.1 Sep 15, 2026 Release notes ↗

otherdocker/cli, 29.8.1 milestone

othermoby/moby, 29.8.1 milestone

fixcontainerd image store: Fix docker load leaving dangling images after loading an image that already exists. moby/moby#53595

fixFix managed containerd logging a CRI pod-sandbox plugin dependency warning during startup. moby/moby#53585

fixFix user-namespace detection on OpenVZ, where namespace inode numbers are virtualized. moby/moby#53605

fixWindows: Preserve hard links when committing a container, so a file with multiple names is stored once in the resulting image layer instead of once per name. moby/moby#53624

otherUpdate containerd (static binaries) to v2.3.5. moby/moby#53589

fixFix GET /networks returning a 500 status if an invalid 'type' filter was provided. moby/moby#53678

29.8.0 Sep 3, 2026 Release notes ↗

otherdocker/cli, 29.8.0 milestone

othermoby/moby, 29.8.0 milestone

featureAdd HostConfig.Umask option and a corresponding --umask flag to docker create/docker run to set the umask for a container's main process, execs, and healthchecks. moby/moby#53463, docker/cli#7108

featureAdd support for attaching service names, environments, and custom CloudWatch entity attributes to logs from the awslogs logging driver. moby/moby#52632

securityAdd daemon support for configuring the default container AppArmor profile template. moby/moby#52771

securityPrevent containers from using the 32-bit socketcall(2) path to create AF_VSOCK sockets and communicate with host virtual machines by adding AppArmor and SELinux policy rules. moby/moby#53551

fixFix docker network inspect failing to find a healthy Swarm network when another Swarm network could not be allocated. moby/moby#53325

fixFix a node gossiping a superseded value for a Swarm service discovery entry after concurrent updates to the same key. moby/moby#53479

fixFix Swarm service names failing to resolve on a node indefinitely after it misses a network membership announcement. moby/moby#53437

fixFix Swarm service names failing to resolve on healthy nodes after a transient node failure. moby/moby#53142

otherPrevent dockerd from hanging when the nft command produces enough stderr output to fill its pipe. moby/moby#53517

otherReduce gossip traffic generated by a node that repeatedly disconnects and rejoins the cluster. moby/moby#53479

otherRemote network-driver plugins can now set the container-side interface name via the DstName field in their Join response. moby/moby#52866

otherReserve network names "container" and "container:" to prevent creation of unusable networks. moby/moby#51973

otherSpread the daemon's periodic Swarm overlay network gossip and synchronization work over time, avoiding recurring bursts of CPU and network usage. moby/moby#53475

otherSwarm service-mesh published ports now use the same infrastructure as published ports for local containers. moby/moby#53118

fixFix --disable-host-loopback not being enforced for the pasta network driver in rootless mode. moby/moby#53358

featureUpdate RootlessKit to v3.1.0, adding support for the pesto port driver in rootless mode. Set DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=pesto to use it; it requires the pasta network driver and supports IPv4 only. moby/moby#53358

otherUpdate minimum supported Go version to 1.26. docker/cli#7258

fixAdd annotation filter to container listings (docker ps, GET /containers/json) allowing to filter containers by their annotations. moby/moby#53538

fixcontainerd image store: Fix docker image inspect reporting a smaller image size than docker image ls. moby/moby#53426

fixcontainerd image store: Fix slower image pulls caused by repeated registry authentication within a single pull. moby/moby#53497

fixDo not log expected image signature identity misses as errors for containerd image store images. moby/moby#53495

fixdockerd now uses the embedded containerd if no system containerd service is configured and containerd is not installed. moby/moby#53388

fixFix GET /images/{name}/json not including unpacked snapshot usage in Size when using the containerd image store. moby/moby#53426

fixFix classic-builder cache for Dockerfile stages that select a non-host platform with FROM --platform. moby/moby#53503

fixFix CLI panic when DOCKER_HOST or -H specifies an invalid host. docker/cli#7280

fixFix health checks being delayed for too long when the start interval is longer than the start period. moby/moby#52317

fixFix inconsistent mount ordering in docker inspect output (GET /containers/{id}/json) and container listings (docker ps, GET /containers/json). moby/moby#53534

fixFix NRI container metadata so Container.Args includes the resolved executable as argv[0], matching the process launched in the container instead of only the Docker Cmd. moby/moby#53423

fixFix Swarm service creation failing when an automatically generated name is already in use. moby/moby#53468

fixFix the container root directory / being world-writable when using the btrfs storage driver. moby/moby#53500

fixFixed docker ps sorting published ports lexicographically instead of numerically. docker/cli#7144

fixPreserve service mount order during forced updates to avoid an unnecessary rollout on the next stack deploy. docker/cli#7227

fixPrevent containerd's v2 CRI plugins from loading when CRI is disabled. moby/moby#53564

fixPrint plugin hook output (e.g. the "What's next:" hint) after the command's error message instead of before it. docker/cli#6976

fixReject checkpoint IDs containing path separators to prevent access outside the container checkpoint directory. moby/moby#53377

otherUpdate BuildKit to v0.33.0. moby/moby#53554

otherUpdate containerd (static binaries) to v2.3.4. moby/moby#53409

otherUpdate Go runtime to 1.26.8. moby/moby#53550, docker/cli#7274

+1 more item in the release notes

29.7.2 Aug 6, 2026 Release notes ↗

otherdocker/cli, 29.7.2 milestone

othermoby/moby, 29.7.2 milestone

fixFix docker service create and docker service update panicking when the same environment variable is passed more than once. docker/cli#7145

fixFix a regression introduced in Docker Engine 29.7.0 that caused image pulls to reject images containing absolute hardlink targets, as produced by some image builders. moby/moby#53305

fixFix a regression introduced in Docker Engine 29.7.0 that could cause image pulls and docker cp to fail on older Linux kernels when applying file permissions, including for device nodes. moby/moby#53305

otherUpdate BuildKit to v0.32.2. moby/moby#53300

otherImprove compatibility with more nftables releases by terminating base-chain policies with a semicolon. moby/moby#53303

29.7.1 Jul 31, 2026 Release notes ↗

otherdocker/cli, 29.7.1 milestone

othermoby/moby, 29.7.1 milestone

fixFix a regression that prevented pulling images whose layers contain directories without explicit parent directory entries. moby/moby#53260

fixFix a regression where the CopyToContainer rejects container paths that traverse absolute symlinks, such as /var/run -> /run. moby/moby#53261

29.7.0 Jul 30, 2026 Release notes ↗

otherdocker/cli, 29.7.0 milestone

othermoby/moby, 29.7.0 milestone

featureAdd an experimental embedded-containerd feature that runs containerd inside the daemon process instead of as a separate managed process. moby/moby#52898

featureMount type image is no longer experimental. moby/moby#52998

featureAdd the default-stop-timeout daemon option to configure the stop timeout assigned to containers without an explicit timeout. moby/moby#53146

securityUpdate github.com/moby/go-archive to v0.3.0 to fix CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h. moby/moby#53247, docker/cli#7139

fixFix a daemon panic when cleanup of a container's network interface fails while the container is being disconnected from a network. moby/moby#53237

fixFix a daemon panic when removing swarm ingress ports after failing to bind an ingress proxy listener. moby/moby#53022

otherKeep the cgroup mount for containers with --net=host. moby/moby#52318

fixAdd shell completion for --filter names and known values to docker service ls, docker service ps, and docker node ps. docker/cli#7124

fixcontainerd image store: Fix daemon-wide concurrent download and upload limits for pulls and pushes not being honored. moby/moby#53081

fixTo preserve the previous unlimited startup behavior, configure "max-concurrent-downloads" and "max-concurrent-uploads" to 0

fixFix docker cp -a using the wrong file owner when copying files into containers with user namespace remapping enabled. moby/moby#53084

fixFix docker cp from a Windows container silently returning a file instead of an error when the source path ends with a separator but is not a directory. moby/moby#53123

fixFix docker stats reporting all zeros for running Windows containers when using the containerd runtime. moby/moby#53101

fixFix docker stats reporting empty network stats for running Windows containers when using the containerd runtime. moby/moby#53219

fixFix a typo in the docker create --pull flag description. docker/cli#7103

fixFix Swarm service updates failing due to "file exists" errors when a VIP IP alias already exists on the LB endpoint interface. moby/moby#51657

fixFix Swarm tasks being rejected when their image could not be pulled from the registry but was already present on the node. moby/moby#53212

fixImprove the error returned when a container hostname exceeds Linux's 64-byte limit. moby/moby#53121

fixPrevent live-restored volumes from retaining active mount references when containers exit during daemon startup. moby/moby#53115

fixSuppress the “No such container” error when docker rm --force succeeds for a nonexistent container. docker/cli#7110

otherUpdate Go runtime to 1.26.5. docker/cli#7087

otherUpdate BuildKit to v0.32.0. moby/moby#53234

otherUpdate containerd (static binaries) to v2.3.3. moby/moby#53050

otherUpdate runc (in static binaries) to v1.4.3. moby/moby#50960

29.6.2 Jul 16, 2026 Release notes ↗

otherdocker/cli, 29.6.2 milestone

othermoby/moby, 29.6.2 milestone

securityCVE-2026-15793: Git source checkout from a bundle file could lead to command injection. GHSA-hw3h-2gp9-cxpv

securityCVE-2026-15792: Incorrect parameters sent from a frontend could cause a panic. GHSA-qx3x-mv6r-52p6

securityCVE-2026-15791: An LLB file operation could be tricked into removing the contents of the /tmp directory. GHSA-32pv-7hq5-qhwq

securityCVE-2026-15789: A malicious client could bypass destination directory validation when uploading local sources. GHSA-g2h8-426c-7976

securityCVE-2026-15788: A WCOW cache mount source selector could resolve NTFS junctions outside of the cache root. GHSA-388v-wmr2-g2v2

otherUpdate containerd (static binaries) to v2.2.6. moby/moby#53051

otherUpdate Go runtime to 1.26.5. moby/moby#53027

otherUpdate RootlessKit to v3.0.2. moby/moby#53054

29.6.1 Jun 26, 2026 Release notes ↗

otherdocker/cli, 29.6.1 milestone

othermoby/moby, 29.6.1 milestone

securityA malicious image could supply a malicious /etc/passwd or /etc/group-style file causing excessive memory consumption, potentially resulting in process termination due to Out Of Memory (OOM) conditions. GHSA-mjcv-p78q-w5fw, GHSA-jpcc-p29g-p8mq, GHSA-72x6-4j93-7w86

securityA custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the security.insecure entitlement. Other security measures, like Linux capabilities were still applied to these containers.…

fixUpdate containerd (static binaries) to v2.2.5. moby/moby#52950

otherUpdate BuildKit to v0.31.1. moby/moby#52954

29.6.0 Jun 18, 2026 Release notes ↗

otherdocker/cli, 29.6.0 milestone

othermoby/moby, 29.6.0 milestone

featurePOST /containers/{id}/update now supports per-device blkio resource settings. moby/moby#52651

featureAdd GET /images/{name}/attestations endpoint to retrieve in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image. Supports optional platform selection, predicate type filtering, and a statement query parameter for verbatim statement bodies.

fixdocker image push now respects NO_COLOR. docker/cli#6957

fixcontainerd image store: Fix docker system prune to include unpacked image data when reporting reclaimed space. moby/moby#52905

fixFix docker system df image size reporting to count only snapshots directly used by images. moby/moby#52901

fixFix a bug where registry authentication failures during worker image pulls were reported as a misleading “No such image” error. moby/moby#52698

fixFix default BuildKit GC policy to prune reproducible cache types as intended. moby/moby#52814

fixFix explicit file modes being filtered by the daemon umask, including COPY --chmod permissions. moby/moby#52892

fixFix image selection with the containerd image store on amd64 hosts when images provide amd64 variant-specific manifests. moby/moby#52773

fixThe --password flag on docker login now accepts - to pass the password through STDIN as alternative to --password-stdin. docker/cli#7029

otherUpdate runc (in static binaries) to v1.3.6. moby/moby#52883

otherUpdate BuildKit to v0.31.0. moby/moby#52904

featureAllow the nftables firewall mode to be used with a daemon that is linked against libnftables when the nft command is not installed on the system. moby/moby#52820

otherDon't publish container ports on host ports listed in net.ipv4.ip_local_reserved_ports when dynamically allocating ports. moby/moby#52818

fixFix a race condition in overlay network bulk sync that caused ~30s DNS resolution delays on newly joined swarm nodes. moby/moby#52862

fixMitigate a crash in libnftables when using nftables as the firewall backend by changing the default build option to execute the nft command instead. Users building dockerd from source can opt into linking against libnftables by building with the libnftables build tag. moby/moby#52886

otherSilence the spurious warning "IPv4 forwarding is disabled". moby/moby#52742

deprecatedThe Engine now returns a deprecation warning when a container connected to the default bridge is created with links specified. moby/moby#47427

29.5.3 Jun 3, 2026 Release notes ↗

otherdocker/cli, 29.5.3 milestone

othermoby/moby, 29.5.3 milestone

fixReduce docker system df errors when images are pruned at the same time with the containerd image store. moby/moby#52672

otherUpdate containerd (static binaries only) to v2.2.4. moby/moby#52683

otherUpdate Go runtime to 1.26.4. moby/moby#52753, docker/cli#7025

otherUpdate RootlessKit to v3.0.1. moby/moby#52710

fixFix AWS IMDS access with gvisor-tap-vsock and UDP port forwarding for non-loopback clients. moby/moby#52710

fixFix installation of plugins that require host networking. moby/moby#52735

29.5.2 May 20, 2026 Release notes ↗

otherdocker/cli, 29.5.2 milestone

othermoby/moby, 29.5.2 milestone

fixFix docker cp failing with "mkdirat: file exists" when a container has a bind mount whose target traverses an in-container symlink (e.g. /var/run -> /run). moby/moby#52655

29.5.1 May 18, 2026 Release notes ↗

otherdocker/cli, 29.5.1 milestone

othermoby/moby, 29.5.1 milestone

securityCVE-2026-41567 Fix a vulnerability in docker cp where archive decompression binaries (e.g. xz, unpigz) were resolved via PATH inside the container filesystem while running as host root, allowing a malicious container to execute arbitrary binaries with host root privileges. GHSA-x86f-5xw2-fm2r

securityCVE-2026-41568 Fix a TOCTOU vulnerability in docker cp that allowed a container process to create files or directories at arbitrary locations on the host filesystem. GHSA-vp62-88p7-qqf5

securityCVE-2026-42306 Fix a TOCTOU vulnerability in docker cp that allowed a container process to redirect a bind mount to an arbitrary location on the host filesystem. GHSA-rg2x-37c3-w2rh

fixFix UDP conntrack entries not being deleted when not bound to a specific IP address. moby/moby#52640

29.5.0 May 14, 2026 Release notes ↗

otherdocker/cli, 29.5.0 milestone

othermoby/moby, 29.5.0 milestone

featureRootless: Add new default gvisor-tap-vsock network driver. moby/moby#52319

featureEnable private time namespace for containers by default on supported kernels. moby/moby#52326

featureThe local logging driver now has support for custom attributes, adding support for the label, label-regex, env, env-regex, and tag log options. moby/moby#52348

featureWindows: The daemon now supports listening on a Unix socket (-H unix://...), with optional group-based access control via --group. moby/moby#52365

securityCVE-2026-32288: Fix a denial of service where pulling a maliciously crafted image could cause the daemon to allocate unbounded memory when processing sparse tar archives. GHSA-x4jj-h2v8-hqqv. moby/moby#52478

fixdocker ps --format now supports a .HealthStatus placeholder to print container health state (starting, healthy, unhealthy) as a dedicated field. docker/cli#6913

fixAdd "time-namespaces" feature flag to disable time-namespaces. moby/moby#52577

fixcontainerd integration: Fix auth token requests ignoring per-host TLS settings (custom CAs, insecure-registries). moby/moby#52600

fixDaemon reload events now signify that the daemon reload has fully completed. moby/moby#52589

fixExpose diagnostic data about userland proxy in docker info. moby/moby#52321

fixFix docker image ls --filter reference=... (GET /images/json) to also match fully qualified canonical image names (e.g. docker.io/library/alpine), not only the familiar short form. moby/moby#52333

fixFix a bug where leaving an autolock-enabled swarm could leave orphaned state, causing subsequent swarm init to fail with "Swarm is encrypted and needs to be unlocked". moby/moby#52479

fixFix an issue where logging errors appeared as empty strings in the daemon log instead of the message that failed to write. moby/moby#52442

fixFix incorrect SHARED SIZE and UNIQUE SIZE reporting in docker system df -v by including shared content blobs in size calculation. moby/moby#52482

fixFix support for CDI specifications that request additional group IDs. moby/moby#52579

fixFix volume subpath file mounts over an existing file in the image failing container creation with "not a directory". moby/moby#52584

fixSort labels in volume, network, config, and secret formatters for deterministic output. docker/cli#6954

fixSwarm: Prevent corruption of Raft snapshots when swarm state is large. moby/moby#52441

otherUpdate BuildKit to v0.30.0. moby/moby#52618

otherUpdate Go runtime to 1.26.3. moby/moby#52572, docker/cli#6967

fixFix conntrack entries being incorrectly deleted for UDP containers sharing the same port on different IPs when one container is restarted. moby/moby#52423

fixFix stale VIP DNS records for swarm service network aliases not being removed during rolling updates. moby/moby#52236

fixFix the userland proxy silently dropping UDP datagrams when a previous write to an unavailable backend left a stale ECONNREFUSED error on the socket. moby/moby#52483

otherRootless: Properly support --net=host and localhost registries. moby/moby#47103

otherUpdate RootlessKit to v3.0.0. moby/moby#52319

othercli/config/configfile: GetAuthConfig, GetCredentialsStore: normalize hostname when resolving auth. docker/cli#6846

deprecatedcli/command/image/build: remove deprecated DefaultDockerfileName const. docker/cli#6737

deprecatedcli/command/image/build: remove deprecated DetectArchiveReader util. docker/cli#6737

deprecatedcli/command/image/build: remove deprecated IsArchive utility. docker/cli#6737

deprecatedcli/command/image/build: remove deprecated ResolveAndValidateContextPath util. docker/cli#6737

deprecatedcli/command/image/build: remove deprecated WriteTempDockerfile util. docker/cli#6737

29.4.3 May 6, 2026 Release notes ↗

otherdocker/cli, 29.4.3 milestone

othermoby/moby, 29.4.3 milestone

securityCVE-2026-31431: Fix the 29.4.2 regression that broke 32-bit programs and i386 images. The broad socketcall(2) seccomp deny is replaced with targeted AppArmor (deny network alg) and SELinux (alg_socket) rules that block AF_ALG at the LSM layer, covering both socket(2) and socketcall(2) paths…

fixFix the default AppArmor profile not being updated on daemon restart, requiring a system reboot to pick up profile changes from daemon upgrades. moby/moby#52537

29.4.2 May 1, 2026 Release notes ↗

otherdocker/cli, 29.4.2 milestone

othermoby/moby, 29.4.2 milestone

securityThis release includes hardening for CVE-2026-31431.

securityBlock AF_ALG sockets and the socketcall(2) multiplexer in the default seccomp profile to prevent in-container privilege escalation via the kernel crypto API ("Copy Fail"). moby/moby#52501

securityIf you need a workaround, use the seccomp/v0.2.1 profile from moby/profiles. Make sure you use a kernel that includes the fix for CVE-2026-31431.

security[!IMPORTANT] Use this workaround only for containers that require it. Containers that use this profile can still exploit CVE-2026-31431 through the socketcall syscall.

securityTo use the profile for a specific container when you control the docker run command, use --security-opt:

featureTo use the profile as the default for containers created by the daemon, add seccomp-profile to your daemon.json:

29.4.1 Apr 20, 2026 Release notes ↗

otherdocker/cli, 29.4.1 milestone

othermoby/moby, 29.4.1 milestone

fixcontainerd image store: Fix docker image prune --filter label!=key=value incorrectly skipping images that don't have the specified label. moby/moby#52338

fixFix --log-opt "tag={{.ImageID}}" not stripping the digest's algorithm. moby/moby#52343

fixFix intermittent container start failures (EBUSY on secrets/configs remount) on busy Swarm nodes by retrying the read-only remount. moby/moby#52235

otherUpdate containerd (static binaries only) to v2.2.3. moby/moby#52360

otherUpdate Go runtime to 1.26.2. docker/cli#6920, moby/moby#52329

otherif a container has an IPv4-only or an IPv6-only endpoint with higher "gateway priority" than a dual stack endpoint, the single stack endpoint will now be used as the default gateway for its address family. moby/moby#52328

29.4.0 Apr 7, 2026 Release notes ↗

otherdocker/cli, 29.4.0 milestone

othermoby/moby, 29.4.0 milestone

fixdocker cp: report both content size and transferred size. docker/cli#6800

fixFix docker stats --all still showing containers that were removed. docker/cli#6863

fixFix a rare bug that could cause containers to become unremovable. moby/moby#51724

fixFixed privileged containers losing their explicit AppArmor profile (--security-opt apparmor=) after a container restart. moby/moby#52215

fixImproved duplicate container-exit handling by using live containerd task state (not timestamps). moby/moby#52156

fixImproved image pull and push performance by enabling HTTP keep-alive for registry connections, avoiding redundant TCP and TLS handshakes. moby/moby#52198

fixshell completions: add shell completion for docker rm --link and exclude legacy links for container names. docker/cli#6872

fixshell completions: don't provide completions that were already used. docker/cli#6871

fixUpdate runc (in static binaries) to v1.3.5. moby/moby#52244

fixWindows: Fix DOCKER_TMPDIR not being respected. moby/moby#52181

otherUpdate BuildKit to v0.29.0. moby/moby#52272

fixPrevent a daemon crash during startup after upgrading if a container config containers a malformed IP-address. moby/moby#52275

othercli/streams: Out, In: preserve original os.File when available. docker/cli#6906

otherUpdate minimum go version to go1.25. docker/cli#6897

deprecatedGo SDK: cli-plugins/hooks: deprecate HookMessage and rename to cli-plugins/hooks.Response. docker/cli#6859

deprecatedGo SDK: cli-plugins/hooks: deprecate HookType and rename to cli-plugins/hooks.ResponseType. docker/cli#6859

deprecatedGo SDK: cli-plugins/manager: deprecate HookPluginData and move to cli-plugins/hooks.Request. docker/cli#6859

29.3.1 Mar 25, 2026 Release notes ↗

otherdocker/cli, 29.3.1 milestone

othermoby/moby, 29.3.1 milestone

securityCVE-2026-34040 Fix an authorization bypass in AuthZ plugins that could allow authorization plugins to be bypassed under specific conditions. GHSA-x744-4wpc-v9h2

securityCVE-2026-33997 Fix a flaw in docker plugin install where privilege validation could be partially bypassed, potentially leading to unauthorized privilege escalation. GHSA-pxq6-2prw-chj9

securityCVE-2026-33748 Fix insufficient validation of Git URL #ref:subdir fragments in BuildKit, which could allow access to files outside the intended repository scope. GHSA-4vrq-3vrq-g6gg

securityCVE-2026-33747 Fix a vulnerability in BuildKit where an untrusted frontend could cause files to be written outside the BuildKit state directory. GHSA-3c29-8rgm-jvjj

fixFix a daemon crash during docker build if .dockerignore contained an invalid pattern. moby/moby#52214

fixFix a panic when the containerd client uses a closed stream. moby/moby#52211

otherUpdate containerd (static binaries) to v2.2.2. moby/moby#52213

otherUpdate Go runtime to 1.25.8. moby/moby#52210, docker/cli#6883

featureAdd missing build-tag, which could cause cannot range over 10 (untyped int constant) when importing the cli/command package. docker/cli#6884

29.3.0 Mar 5, 2026 Release notes ↗

otherdocker/cli, 29.3.0 milestone

othermoby/moby, 29.3.0 milestone

featureAdd bind-create-src option to --mount flag for bind mounts. docker/cli#6792

featureCLI plugin hooks now fire on command failure (not just success), and plugins can use "error-hooks" to show hints only when commands fail. docker/cli#6794

featureLower minimum API version from v1.44 to v1.40 (Docker 19.03). moby/moby#52067

otherUpdate BuildKit to v0.28.0. moby/moby#52135

fixFix DNS config corruption on daemon reload. moby/moby#52060

featurePOST /networks/{id}/connect now correctly applies the MacAddress field in EndpointSettings. This field was added in API v1.44, but was previously ignored. moby/moby#52040

otherGET /images/json now supports an identity query parameter. When set, the response includes manifest summaries and may include an Identity field for each manifest with trusted identity and origin information. moby/moby#52030

fixThe --gpus option now uses CDI-based injection for AMD GPUs. moby/moby#52048

fixAdd sd_notify "RELOADING" notifications when signalling the daemon to reload its configuration. moby/moby#52041

fixSend sd_notify "READY" and "STOPPING" synchronously to make sure they are sent before we proceed. moby/moby#52041

fixAdd support for the systemd 253 Type=notify-reload service reload protocol. moby/moby#52041

fixDon't log "failed to determine if container is already mounted" warnings for stopped containers during startup. moby/moby#52076

fixFix docker system prune failing with "rw layer snapshot not found" when a container is concurrently removed. moby/moby#52090

fixFix a panic when running docker top on a non-running Windows container. moby/moby#52025

fixFix a regression in v29.2.0 that prevented registering the dockerd service on Windows if system requirements were not yet installed. moby/moby#52006

fixFix shared mount detection for paths mounted multiple times, which caused "not a shared mount" errors when using bind propagation. moby/moby#51787

fixFix spurious "ShouldRestart failed" warning on shutdown. moby/moby#52079

fixPreserve leading and trailing whitespace when storing registry passwords. docker/cli#6784

fixPrevent logging "not found" warnings when calculating volume sizes. moby/moby#52018

fixUpdate Go runtime to 1.25.7. moby/moby#52003, docker/cli#6780

29.2.1 Feb 2, 2026 Release notes ↗

otherdocker/cli, 29.2.1 milestone

othermoby/moby, 29.2.1 milestone

fixUpdate BuildKit to v0.27.1. moby/moby#51962

fixFix docker system df failing when run concurrently with docker system prune. moby/moby#51979

fixFix daemon handling of duplicate container exit events to avoid repeated cleanup and state transitions. moby/moby#51925

fixFix panic after failed daemon initialization. moby/moby#51943

fixFix encrypted overlay networks not passing traffic to containers on v28 and older Engines. Encrypted overlay networks will no longer pass traffic to containers on v29.2.0 thru v29.0.0, v28.2.2, v25.0.14 or v25.0.13. moby/moby#51951

fixFix potential panic on docker network prune. moby/moby#51966

29.2.0 Jan 26, 2026 Release notes ↗

otherdocker/cli, 29.2.0 milestone

othermoby/moby, 29.2.0 milestone

featuredocker info now includes NRI section. docker/cli#6710

featureAdd experimental NRI support. moby/moby#51711, moby/moby#51712, moby/moby#51675, moby/moby#51674, moby/moby#51636, moby/moby#51634

featureNew Identity field has been added to the inspect endpoint to show trusted origin information about the image. This includes build ref for locally built images, remote registry repository for pulled images, and verified signature information for images that contain a valid signed provenance…

fixImprove validation of --detach-keys command-line options. docker/cli#6742

fixPrevent a potential panic on daemon shutdown after an incomplete initialization. moby/moby#51797

fixRemove restriction on anonymous read-only volumes. moby/moby#51682

fixThe --validate flag on dockerd now also verifies system requirements, allowing for system requirements to be checked before starting the daemon. moby/moby#51868

fixHandle --gpus requests for NVIDIA devices using CDI if possible. moby/moby#50228

otherUpdate BuildKit to v0.27.0. moby/moby#51886

otherUpdate containerd (static binaries only) to v2.2.1. moby/moby#51765

otherRootless: Consider $XDG_CONFIG_HOME/cdi and $XDG_RUNTIME_DIR/cdi when looking for CDI devices. moby/moby#51624

otherUpdate RootlessKit to v2.3.6. moby/moby#51757

otherNatively support gRPC on the listening socket. moby/moby#50744

featurecli/command: add WithAPIClientOptions option. docker/cli#6740

deprecatedRemove %PROGRAMDATA%\Docker\cli-plugins from the list of paths used for CLI plugins on Windows. This path was present for backward compatibility with old installation, but replaced by %ProgramFiles%\Docker\cli-plugins. docker/cli#6713

29.1.5 Jan 16, 2026 Release notes ↗

otherdocker/cli, 29.1.5 milestone

othermoby/moby, 29.1.5 milestone

otherUpdate Go runtime to 1.25.6. moby/moby#51860, docker/cli#6750

fixFixed a regression where established network connections could be disrupted during a container's shutdown grace period. moby/moby#51843

29.1.4 Jan 9, 2026 Release notes ↗

otherdocker/cli, 29.1.4 milestone

othermoby/moby, 29.1.4 milestone

fixFix docker run --network none panic on Windows. moby/moby#51830

fixFix image mounts failing with "file name too long" for long mount paths. moby/moby#51829

fixFix potential creation of orphaned overlay2 layers. moby/moby#51826, moby/moby#51824

otherUpdate BuildKit to v0.26.3. moby/moby#51821

29.1.3 Dec 12, 2025 Release notes ↗

otherdocker/cli, 29.1.3 milestone

othermoby/moby, 29.1.3 milestone

fixAdd shell completion for docker stack deploy --compose-file. docker/cli#6690

fixcontainerd image store: Fix a bug causing docker build to ignore the explicitly set unpack image exporter option. moby/moby#51514

fixFix docker image ls dangling image handling. docker/cli#6704

fixFix a bug that could cause the Engine to leave containers with autoremove set in 'dead' state on shutdown, and never reclaim them. moby/moby#51693

fixFix build on i386. moby/moby#51528

fixFix explicit graphdriver configuration ("storage-driver") being treated as containerd snapshotter when prior graphdriver state exists. moby/moby#51516

fixFix potential creation of orphaned overlay2 layers. moby/moby#51703

featureAllow creation of a container with a specific IP address when its networks were not configured with a specific subnet. moby/moby#51583

fixDon't crash when starting a container created via the API before upgrade to v29.1.2, with PublishAll and a nil PortBindings map. moby/moby#51691

fixFix a bug preventing DNS resolution of containers attached to non swarm-scoped networks once the node has joined a Swarm cluster. moby/moby#51515

fixFix an issue that caused daemon crash when using a remote network driver plugin. moby/moby#51558

fixFix an issue that could lead to an "endpoint not found" error when creating a container with multiple network connections, when one of the networks is non-internal but does not have its own external IP connectivity. moby/moby#51538

fixFix an issue that prevented rootless Docker from starting on a host with IPv6 disabled. moby/moby#51543

otherReturn an error when a container is created with a port-mapping pointing to container port 0. moby/moby#51695

29.1.2 Dec 2, 2025 Release notes ↗

otherdocker/cli, 29.1.2 milestone

othermoby/moby, 29.1.2 milestone

securityUpdate Go runtime to 1.25.5. moby/moby#51648, docker/cli#6688

securityFixes a potential DoS via excessive resource usage when formatting hostname validation errors CVE-2025-61729

securityFixes incorrect enforcement of excluded subdomain constraints for wildcard SANs, which could allow improperly trusted certificates CVE-2025-61727

fixcontainerd image store: Fix docker image inspect failing to return available image data in case where not all distributable blobs are available locally. moby/moby#51629

fixdockerd-rootless-setuptool.sh: fix nsenter: no namespace specified. moby/moby#51622

fixFix docker system df showing N/A for shared size and unique size when using graph-drivers as storage. moby/moby#51631

otherUpdate runc (in static binaries) to v1.3.4. moby/moby#51633

fixFix a bug preventing port mappings in rootless mode when slirp4netns is used. moby/moby#51616

fixPrevent a crash when making an API request with HostConfig.PublishAllPorts set (-P), and no port bindings. moby/moby#51621

29.1.1 Nov 28, 2025 Release notes ↗

otherdocker/cli, 29.1.1 milestone

othermoby/moby, 29.1.1 milestone

breakingRevert a PR breaking external DNS resolution on all custom bridge networks. moby/moby#51615

29.1.0 Nov 27, 2025 Release notes ↗

otherdocker/cli, 29.1.0 milestone

othermoby/moby, 29.1.0 milestone

otherUpdate BuildKit to v0.26.1. moby/moby#51551

otherUpdate containerd binary to v2.2.0 (static binaries). moby/moby#51271

otherDo not overwrite user-modified /etc/resolv.conf across container restarts. moby/moby#51507

fixfix --publish-all / -P for Windows containers. moby/moby#51586

fixFix an issue that prevented container restart or network reconnection when gateway configuration failed during container stop or network disconnect. moby/moby#51592

otherWindows containers: don't display an IPv6-mapped IPv4 address in port mappings. For example, [::ffff:0.0.0.0]:8080->80/tcp instead of 0.0.0.0:8080->80/tcp. moby/moby#51587

29.0.4 Nov 24, 2025 Release notes ↗

otherdocker/cli, 29.0.4 milestone

othermoby/moby, 29.0.4 milestone

fixdocker image ls no longer truncates the image names. docker/cli#6675

featureAllow creation of a container with a specific IP address when its networks were not configured with a specific subnet. moby/moby#51583

29.0.3 Nov 24, 2025 Release notes ↗

otherdocker/cli, 29.0.3 milestone

othermoby/moby, 29.0.3 milestone

fixdocker version --format json: restore top-level BuildTime field to use RFC3339Nano format. docker/cli#6668

fixFix docker image ls ignoring a custom imageFormat from docker.json. docker/cli#6667

fixFix an issue that caused daemon crash when using a remote network driver plugin. moby/moby#51558

29.0.2 Nov 17, 2025 Release notes ↗

otherdocker/cli, 29.0.2 milestone

othermoby/moby, 29.0.2 milestone

fixFix an issue that prevented rootless Docker from starting on a host with IPv6 disabled. moby/moby#51543

29.0.1 Nov 14, 2025 Release notes ↗

otherdocker/cli, 29.0.1 milestone

othermoby/moby, 29.0.1 milestone

fixdocker image ls no longer truncates the name width when output is redirect (e.g. for grep). docker/cli#6656

fixdocker image ls now considers the NO_COLOR environment variable for choosing the colored output. docker/cli#6654

fixcontainerd image store: Fix a bug causing docker build to ignore the explicitly set unpack image exporter option. moby/moby#51514

fixFix a bug causing docker image ls --all to not show untagged/dangling images. docker/cli#6657

fixFix build on i386. moby/moby#51528

fixFix explicit graphdriver configuration ("storage-driver") being treated as containerd snapshotter when prior graphdriver state exists. moby/moby#51516

fixFix output format of the ApiVersion and MinApiVersion fields in docker version --format=json to align with previous versions. docker/cli#6648

fixFix a bug preventing DNS resolution of containers attached to non swarm-scoped networks once the node has joined a Swarm cluster. moby/moby#51515

29.0.0 Nov 10, 2025 Release notes ↗

breakingThe Go module github.com/docker/docker is deprecated in favor of github.com/moby/moby/client and github.com/moby/moby/api. The github.com/moby/moby module is considered an internal implementation detail - the only supported public modules are client and api. Starting with v29, releases are tagged…

breakingDebian armhf (32-bit) packages now target ARMv7 CPUs and will not work on ARMv6 devices.

breakingOfficial Raspbian (32-bit) packages are no longer provided. Use Debian arm64 packages for 64-bit devices, or Debian armhf packages for 32-bit ARMv7 devices.

breakingcgroup v1 is deprecated. Support continues until at least May 2029, but migrate to cgroup v2 as soon as possible. See moby#51111.

breakingDocker Content Trust was removed from the Docker CLI. Can be built as a separate plugin: https://github.com/docker/cli/blob/v29.0.0/cmd/docker-trust/main.go

breakingThe daemon now requires API version v1.44 or later (Docker v25.0+).

breakingclient: remove legacy CBC cipher suites from client config. moby/moby#50126

breakingcontrib: remove editorconfig as it was unmaintained. moby/moby#50607

breakingcontrib: remove Dockerfile syntax highlighting files for nano and TextMate (tmbundle) as they were unmaintained and outdated. moby/moby#50606

breakingcontrib: remove mkimage-xxx scripts as they were unmaintained and not tested. moby/moby#50297

deprecatedapi/types/system: deprecated top level DiskUsage fields for type specific fields. moby/moby#51235

breakingEnsure bridge devices are removed when bridge network creation fails. moby/moby#51147

deprecatedEnvironment variables set on a container using legacy links are deprecated and aren't added automatically anymore. moby/moby#50719

deprecatedUsers are encouraged to stop relying on these as they're deprecated, and the escape hatch will be removed in a later version

breakingThe iptables rules for bridge networks have been updated, including removal of the DOCKER-ISOLATION-STAGE-1 and DOCKER-ISOLATION-STAGE-2 chains. With these changes:. moby/moby#49981

breakingPOST /images/{name:}/push: remove compatibility with API v1.4 auth-config in body. moby/moby#50371

breakingapi/types/plugin: remove deprecated Config.DockerVersion. moby/moby#51458

breakingapi/types/swarm: deprecated and dropped support for PortConfigProtocol; use network.IPProtocol instead. moby/moby#51094

breakingapi/pkg/progress and api/pkg/streamformatter have been removed. moby/moby#51153

breakingapi: remove unused DefaultVersion, MinSupportedAPIVersion consts. moby/moby#50587

breakingclient: ContainerCommitOptions: remove Pause field in favor of NoPause. moby/moby#51019

breakingclient: remove client.ContainerStatsResult.OSType field. moby/moby#51305

breakingRemove structs NetworkSettingsBase and DefaultNetworkSettings. Fields in NetworkSettingsBase that were not deprecated are now directly in NetworkSettings. moby/moby#50846

deprecatedclient/pkg/jsonmessage: remove deprecated ProgressMessage, ErrorMessage, DisplayJSONMessagesToStream and Stream interface. moby/moby#49264

deprecatedGET /events no longer includes the deprecated status, id, and from fields. These fields were removed in API v1.22, but still included in the response. These fields are now omitted when using API v1.52 or later. moby/moby#50832

deprecatedapi/types/network: CreateRequest: remove deprecated CheckDuplicate field. moby/moby#50998

deprecatedapi/types/plugin: deprecate Config.DockerVersion field. moby/moby#51109

deprecatedapi/types/registry: remove deprecated AuthConfig.Email field. moby/moby#51059

deprecatedapi/types/strslice: deprecate StrSlice in favor of using a regular []string. moby/moby#50292

deprecatedapi/types/sytem: remove deprecated DiskUsage.BuilderSize. moby/moby#51180

deprecatedapi/types: move plugin types to api/types/plugin. moby/moby#48114

deprecatedAPI: Deprecation: the Engine was automatically backfilling empty PortBindings lists with a PortBinding with an empty HostIP and HostPort when starting a container. This behavior is deprecated for API 1.52, and will be dropped in API 1.53. moby/moby#50874

deprecatedbuild: remove DCT support for classic builder. docker/cli#6195

deprecatedcli/command: Remove deprecated ResolveDefaultContext. docker/cli#6555

deprecatedclient: ImageBuildResponse: remove OSType field. moby/moby#50995

deprecatedclient: Remove ImageCreate method - useImagePull or ImageImport instead. moby/moby#51366

deprecatedclient: remove deprecated ImageListOptions.ContainerCount. moby/moby#51006

deprecatedclient: remove support for negotiating API version < v1.44 (docker 25.0). moby/moby#51119

deprecatedclient: remove unused Client.HTTPClient() method. moby/moby#51011

deprecateddaemon/graphdriver: remove deprecated GetDriver(). moby/moby#50377

+259 more items in the release notes

28.5.2 Nov 5, 2025 Release notes ↗

otherdocker/cli, 28.5.2 milestone

othermoby/moby, 28.5.2 milestone

securityCVE-2025-31133

securityCVE-2025-52565

securityCVE-2025-52881

otherUpdate runc to v1.3.3. moby/moby#51394

fixdockerd-rootless.sh: if slirp4netns is not installed, try using pasta (passt). moby/moby#51162

fixUpdate Go runtime to 1.24.9. moby/moby#51387, docker/cli#6613

deprecatedGo-SDK: cli/command/image/build: deprecate DefaultDockerfileName, DetectArchiveReader, WriteTempDockerfile, ResolveAndValidateContextPath. These utilities were only used internally and will be removed in the next release. docker/cli#6610

deprecatedGo-SDK: cli/command/image/build: deprecate IsArchive utility. docker/cli#6560

deprecatedGo-SDK: opts: deprecate ValidateMACAddress. docker/cli#6560

deprecatedGo-SDK: opts: deprecate ListOpts.Delete(). docker/cli#6560

28.5.1 Oct 8, 2025 Release notes ↗

otherdocker/cli, 28.5.1 milestone

othermoby/moby, 28.5.1 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

fixUpdate BuildKit to v0.25.1. moby/moby#51137

fixUpdate Go runtime to 1.24.8. moby/moby#51133, docker/cli#6541

deprecatedapi/types/image: InspectResponse: deprecate Parent and DockerVersion fields. moby/moby#51105

deprecatedapi/types/plugin: deprecate Config.DockerVersion field. moby/moby#51110

28.5.0 Oct 2, 2025 Release notes ↗

otherdocker/cli, 28.5.0 milestone

othermoby/moby, 28.5.0 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

fixDon't print warnings in docker info for broken symlinks in CLI-plugin directories. docker/cli#6476

fixFix a panic during stats on empty event Actor.ID. docker/cli#6471

breakingRemove support for legacy CBC cipher suites. docker/cli#6474

otherUpdate Buildkit to v0.25.0. moby/moby#51075

otherUpdate Dockerfile syntax to v1.19.0. moby/moby#51075

otherEliminated harmless warning about deletion of endpoint_count from the data store. moby/moby#51064

fixFix a bug causing IPAM plugins to not be loaded on Windows. moby/moby#51035

deprecatedDeprecate support for kernel memory TCP accounting (KernelMemoryTCP). moby/moby#51067

fixFix GET containers/{name}/checkpoints returning null instead of empty JSON array when there are no checkpoints. moby/moby#51052

featurecli-plugins/plugin: Run: allow customizing the CLI. docker/cli#6481

featurecli/command: add WithUserAgent option. docker/cli#6477

deprecatedGo-SDK: cli/command: deprecate DockerCli.Apply. This method is no longer used and will be removed in the next release if there are no remaining uses. docker/cli#6497

deprecatedGo-SDK: cli/command: deprecate DockerCli.ContentTrustEnabled. This method is no longer used and will be removed in the next release. docker/cli#6495

deprecatedGo-SDK: cli/command: deprecate DockerCli.DefaultVersion. This method is no longer used and will be removed in the next release. docker/cli#6491

deprecatedGo-SDK: cli/command: deprecate ResolveDefaultContext utility. docker/cli#6529

deprecatedGo-SDK: cli/command: deprecate WithContentTrustFromEnv, WithContentTrust options. These options were used internally, and will be removed in the next release.. docker/cli#6489

deprecatedGo-SDK: cli/manifest/store: deprecate IsNotFound(). docker/cli#6514

deprecatedGo-SDK: templates: deprecate NewParse() function. docker/cli#6469

28.4.0 Sep 3, 2025 Release notes ↗

deprecatedDeprecated and removed features, see Deprecated Features.

deprecatedUpdate deprecation message for AuthConfig.Email field. moby/moby#50797

deprecatedDeprecate profiles package which got migrated to github.com/moby/profiles. moby/moby#50513

deprecatedDeprecate special handling for quoted values for the --tlscacert, --tlscert, and --tlskey command-line flags. docker/cli#6291

deprecatedMark legacy links env vars (DOCKER_KEEP_DEPRECATED_LEGACY_LINKS_ENV_VARS) as deprecated in v28.4 and set for removal in v30.0. docker/cli#6309

deprecatedGo-SDK: Deprecate field NetworkSettingsBase.Bridge, struct NetworkSettingsBase, all the fields of DefaultNetworkSettings, and struct DefaultNetworkSettings. moby/moby#50839

deprecatedGo-SDK: api/types: build.CacheDiskUsage, container.DiskUsage, images.DiskUsage and volumes.DiskUsage are now deprecated and will be removed in the next major release. moby/moby#50768

deprecatedGo-SDK: cli-plugins/manager: deprecate ReexecEnvvar. docker/cli#6411

deprecatedGo-SDK: cli-plugins/manager: deprecate annotation aliases (CommandAnnotationPlugin, CommandAnnotationPluginVendor, CommandAnnotationPluginVersion, CommandAnnotationPluginInvalid, CommandAnnotationPluginCommandPath) in favor of their equivalent in cli-plugins/manager/metadata. docker/cli#6298

deprecatedGo-SDK: cli-plugins/manager: deprecate metadata aliases (NamePrefix, MetadataSubcommandName, HookSubcommandName, Metadata, ReexecEnvvar) in favor of their equivalent in cli-plugins/manager/metadata. docker/cli#6269

deprecatedGo-SDK: cli-plugins/manager: remove Candidate interface, which was only for internal use. docker/cli#6269

deprecatedGo-SDK: cli-plugins/manager: remove NewPluginError function, which was only for internal use. docker/cli#6269

deprecatedGo-SDK: cli-plugins/manager: remove deprecated ResourceAttributesEnvvar const. docker/cli#6269

deprecatedGo-SDK: cli/command/builder: deprecate NewBuilderCommand and NewBakeStubCommand. These functions will be removed in the next release. docker/cli#6312

deprecatedGo-SDK: cli/command/builder: deprecate NewPruneCommand. docker/cli#6343

deprecatedGo-SDK: cli/command/checkpoint: deprecate NewCheckpointCommand. This function will be removed in the next release. docker/cli#6312

deprecatedGo-SDK: cli/command/checkpoint: deprecate NewFormat, FormatWrite. docker/cli#6341

deprecatedGo-SDK: cli/command/completion: deprecate NoComplete. docker/cli#6405

deprecatedGo-SDK: cli/command/completion: remove deprecated ValidArgsFn. docker/cli#6259

deprecatedGo-SDK: cli/command/config: deprecate NewConfigCommand. This function will be removed in the next release. docker/cli#6312

deprecatedGo-SDK: cli/command/config: deprecate NewFormat, FormatWrite, InspectFormatWrite. docker/cli#6341

deprecatedGo-SDK: cli/command/config: deprecate RunConfigCreate, CreateOptions, RunConfigInspect, InspectOptions, RunConfigList, ListOptions, RunConfigRemove, and RemoveOptions. docker/cli#6369

deprecatedGo-SDK: cli/command/container: deprecate NewBuildCommand, NewPullCommand, NewPushCommand, NewImagesCommand, NewImageCommand, NewHistoryCommand, NewImportCommand, NewLoadCommand, NewRemoveCommand, NewSaveCommand, NewTagCommand, NewPruneCommand. These functions will be removed in the next release.…

deprecatedGo-SDK: cli/command/container: deprecate NewDiffFormat, DiffFormatWrite. These functions were only used internally and will be removed in the next release. docker/cli#6341

deprecatedGo-SDK: cli/command/container: deprecate NewRunCommand, NewExecCommand, NewPsCommand, NewContainerCommand, NewAttachCommand, NewCommitCommand, NewCopyCommand, NewCreateCommand, NewDiffCommand, NewExportCommand, NewKillCommand, NewLogsCommand, NewPauseCommand, NewPortCommand, NewRenameCommand,…

deprecatedGo-SDK: cli/command/context: deprecate NewContextCommand. This function will be removed in the next release. docker/cli#6312

deprecatedGo-SDK: cli/command/context: deprecate RunCreate and CreateOptions. docker/cli#6403

deprecatedGo-SDK: cli/command/context: deprecate RunExport and ExportOptions. docker/cli#6403

deprecatedGo-SDK: cli/command/context: deprecate RunImport. docker/cli#6403

deprecatedGo-SDK: cli/command/context: deprecate RunRemove and RemoveOptions. docker/cli#6403

deprecatedGo-SDK: cli/command/context: deprecate RunUpdate and UpdateOptions. docker/cli#6403

deprecatedGo-SDK: cli/command/context: deprecate RunUse. docker/cli#6403

deprecatedGo-SDK: cli/command/image: deprecate AuthResolver utility. docker/cli#6357

deprecatedGo-SDK: cli/command/image: deprecate NewHistoryFormat, HistoryWrite. docker/cli#6341, docker/cli#6341

deprecatedGo-SDK: cli/command/manifest: deprecate NewManifestCommand. This functions will be removed in the next release. docker/cli#6312

deprecatedGo-SDK: cli/command/network: deprecate NewFormat, FormatWrite. docker/cli#6341

deprecatedGo-SDK: cli/command/network: deprecate NewNetworkCommand. These functions will be removed in the next release. docker/cli#6312

deprecatedGo-SDK: cli/command/node: deprecate NewFormat, FormatWrite, InspectFormatWrite. docker/cli#6341

deprecatedGo-SDK: cli/command/node: deprecate NewNodeCommand. This functions will be removed in the next release. docker/cli#6312

deprecatedGo-SDK: cli/command/plugin: deprecate NewFormat, FormatWrite. docker/cli#6341

+48 more items in the release notes

28.3.3 Jul 29, 2025 Release notes ↗

otherdocker/cli, 28.3.3 milestone

othermoby/moby, 28.3.3 milestone

securityThis release fixes an issue where, after a firewalld reload, published container ports could be accessed directly from the local network, even when they were intended to be accessible only via a loopback address. CVE-2025-54388 / GHSA-x4rx-4gw3-53p4 / moby/moby#50506.

otherUpdate Buildx to v0.26.1. docker/docker-ce-packaging#1230

otherUpdate Compose to v2.39.1. docker/docker-ce-packaging#1234

otherUpdate Docker Model CLI plugin to v0.1.36. docker/docker-ce-packaging#1233

featurecli/command/formatter: add TrunateID() utility as alternative for github.com/docker/docker/pkg/stringid.TrunateID(). docker/cli#6180

28.3.2 Jul 9, 2025 Release notes ↗

otherdocker/cli, 28.3.2 milestone

othermoby/moby, 28.3.2 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

fixFix --use-api-socket not working correctly when targeting a remote daemon. docker/cli#6157

fixFix stray "otel error" logs being printed if debug logging is enabled. docker/cli#6160

fixQuote SSH arguments when connecting to a remote daemon over an SSH connection to avoid unexpected expansion. docker/cli#6147

fixWarn when DOCKER_AUTH_CONFIG is set during docker login and docker logout. docker/cli#6163

otherUpdate Compose to v2.38.2. docker/docker-ce-packaging#1225

otherUpdate Docker Model CLI plugin to v0.1.33. docker/docker-ce-packaging#1227

otherUpdate Go runtime to 1.24.5. moby/moby#50354

28.3.1 Jul 2, 2025 Release notes ↗

otherdocker/cli, 28.3.1 milestone

othermoby/moby, 28.3.1 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

otherUpdate BuildKit to v0.23.2. moby/moby#50309

otherUpdate Compose to v2.38.1. docker/docker-ce-packaging#1221

featureUpdate Model to v0.1.32 which adds the support for the new top-level models: key in Docker Compose. docker/docker-ce-packaging#1222

28.3.0 Jun 25, 2025 Release notes ↗

otherdocker/cli, 28.3.0 milestone

othermoby/moby, 28.3.0 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

featureAdd support for AMD GPUs in docker run --gpus. moby/moby#49952

featureUse DOCKER_AUTH_CONFIG as a credential store. docker/cli#6008

fixEnsure that the state of the container in the daemon database (used by /containers/json API) is up to date when the container is stopped using the /containers/{id}/stop API (before response of API). moby/moby#50136

fixFix docker image inspect inspect omitting empty fields. moby/moby#50135

fixFix docker images --tree not marking images as in-use when the containerd image store is disabled. docker/cli#6140

fixFix docker pull/push hang in non-interactive when authentication is required caused by prompting for login credentials. docker/cli#6141

fixFix a potential resource leak when a node leaves a Swarm. moby/moby#50115

fixFix a regression where a login prompt on docker pull would show Docker Hub-specific hints when logging in on other registries. docker/cli#6135

fixFix an issue where all new tasks in the Swarm could get stuck in the PENDING state forever after scaling up a service with placement preferences. moby/moby#50211

fixRemove an undocumented, hidden, top-level docker remove command that was accidentally introduced in Docker 23.0. docker/cli#6144

fixValidate registry-mirrors configuration as part of dockerd --validate and improve error messages for invalid mirrors. moby/moby#50240

fixdockerd-rootless-setuptool.sh: Fix the script from silently returning with no error message when subuid/subgid system requirements are not satisfied. moby/moby#50059

fixcontainerd image store: Fix docker push not creating a tag on the remote repository. moby/moby#50199

fixcontainerd image store: Improve handling of errors returned by the token server during docker pull/push. moby/moby#50176

featureAllow customizing containerd service name for OpenRC. moby/moby#50156

otherUpdate BuildKit to v0.23.1. moby/moby#50243

otherUpdate Buildx to v0.25.0. docker/docker-ce-packaging#1217

otherUpdate Compose to v2.37.2. docker/docker-ce-packaging#1219

otherUpdate Docker Model CLI plugin to v0.1.30. docker/docker-ce-packaging#1218

otherUpdate Go runtime to 1.24.4. docker/docker-ce-packaging#1213, moby/moby#50153, docker/cli#6124

fixRevert Swarm related changes added in 28.2.x builds, due to a regression reported moby/moby#50169

otherRevert: Fix an issue where docker network inspect --verbose could sometimes crash the daemon (https://github.com/moby/moby/pull/49937).

otherRevert: Fix an issue where the load-balancer IP address for an overlay network would not be released in certain cases if the Swarm was lacking an ingress network (https://github.com/moby/moby/pull/49948).

otherRevert: Improve the reliability of NetworkDB in busy clusters and lossy networks (https://github.com/moby/moby/pull/49932).

otherRevert: Improvements to the reliability and convergence speed of NetworkDB (https://github.com/moby/moby/pull/49939).

fixFix an issue that could cause container startup to fail, or lead to failed UDP port mappings, when some container ports are mapped to 0.0.0.0 and others are mapped to specific host addresses. moby/moby#50054

otherThe network inspect response for an overlay network now reports that EnableIPv4 is true. moby/moby#50147

otherWindows: Improve daemon startup time in cases where the host has networks of type "Mirrored". moby/moby#50155

otherWindows: Make sure docker system prune and docker network prune only remove networks created by Docker. moby/moby#50154

otherUpdate API version to 1.51. moby/moby#50145

otherGET /images/json now sets the value of the Containers field for all images to the count of containers using the image. moby/moby#50146

deprecatedEmpty/nil image config fields in the GET /images/{name}/json response are now deprecated and will be removed in v29.0. docker/cli#6129

deprecatedapi/types/container: deprecate ExecOptions.Detach. This field is not used, and will be removed in a future release. moby/moby#50219

deprecatedpkg/idtools: deprecate IdentityMapping and Identity.Chown. moby/moby#50210

28.2.2 May 30, 2025 Release notes ↗

otherdocker/cli, 28.2.2 milestone

othermoby/moby, 28.2.2 milestone

fixcontainerd image store: Fix a regression causing docker build --push to fail. This reverts the fix for docker build not persisting overridden images as dangling. moby/moby#50105

featureWhen creating the iptables DOCKER-USER chain, do not add an explicit RETURN rule, allowing users to append as well as insert their own rules. Existing rules are not removed on upgrade, but it won't be replaced after a reboot. moby/moby#50098

28.2.1 May 28, 2025 Release notes ↗

fixFix packaging regression in v28.2.0 which broke creating the docker group/user on fresh installations. docker-ce-packaging#1209

28.2.0 May 28, 2025 Release notes ↗

deprecatedDeprecated and removed features, see Deprecated Features.

featureAdd {{.Platform}} as formatting option for docker ps to show the platform of the image the container is running. docker/cli#6042

featureAdd support for relative parent paths (../) on bind mount sources when using docker run/create with -v/--volume or --mount type=bind options. docker/cli#4966

featureCDI is now enabled by default. moby/moby#49963

featureShow discovered CDI devices in docker info. docker/cli#6078

featuredocker image rm: add --platform option to remove a variant from multi-platform images. docker/cli#6109

featurecontainerd image store: Initial BuildKit support for building Windows container images on Windows (requires an opt-in with DOCKER_BUILDKIT=1). moby/moby#49740

fixAdd a new log option for fluentd log driver (fluentd-write-timeout), which enables specifying write timeouts for fluentd connections. moby/moby#49911

fixAdd support for DOCKER_AUTH_CONFIG for the experimental --use-api-socket option. docker/cli#6019

fixFix docker exec waiting for 10 seconds if a non-existing user or group was specified. moby/moby#49868

fixFix docker swarm init ignoring cacert option of --external-ca. docker/cli#5995

fixFix an issue where the CLI would not correctly save the configuration file (~/.docker/config.json) if it was a relative symbolic link. docker/cli#5282

fixFix containers with --restart always policy using CDI devices failing to start on daemon restart. moby/moby#49990

fixFix shell-completion to only complete some flags once, even though they can be set multiple times. docker/cli#6030

fixFix the plugin does not implement PluginAddr interface error for Swarm CSI drivers. moby/moby#49961

fixImprove docker login error messages for invalid options. docker/cli#6036

fixMake sure the terminal state is restored if the CLI is forcefully terminated. docker/cli#6058

fixUpdate the default seccomp profile to match the libseccomp v2.6.0. The new syscalls are: listmount, statmount, lsm_get_self_attr, lsm_list_modules, lsm_set_self_attr, mseal, uretprobe, riscv_hwprobe, getxattrat, listxattrat, removexattrat, and setxattrat. This prevents containers from receiving…

fixdocker inspect: add shell completion, improve flag-description for --type and improve validation. docker/cli#6052

fixcontainerd image store: Enable BuildKit garbage collector by default. moby/moby#49899

fixcontainerd image store: Fix docker build not persisting overridden images as dangling. moby/moby#49702

featureAdd bridge network option "com.docker.network.bridge.trusted_host_interfaces", accepting a colon-separated list of interface names. These interfaces have direct access to published ports on container IP addresses. moby/moby#49832

featureAdd daemon option "allow-direct-routing" to disable filtering of packets from outside the host addressed directly to containers. moby/moby#49832

featureapi/types/container: add ContainerState and constants for container state. moby/moby#49965

deprecatedapi/types: deprecate BuildResult, ImageBuildOptions, ImageBuildOutput, ImageBuildResponse, BuilderVersion, BuilderV1, and BuilderBuildKi which were moved to api/types/build. moby/moby#50025

deprecatedAPI: Deprecated: GET /images/{name}/json no longer returns the following fields: Config, Hostname, Domainname, AttachStdin, AttachStdout, AttachStderr, Tty, OpenStdin, StdinOnce, Image, NetworkDisabled (already omitted unless set), MacAddress (already omitted unless set), StopTimeout (already…

deprecatedGo-SDK: Deprecate builder/remotecontext.Rel(). This function was needed on older versions of Go, but can now be replaced by filepath.Rel(). moby/moby#49843

deprecatedGo-SDK: api/types: deprecate BuildCachePruneOptions in favor of api/types/builder.CachePruneOptions. moby/moby#50015

deprecatedGo-SDK: api/types: deprecate BuildCachePruneReport in favor of api/types/builder.CachePruneReport. moby/moby#50015

deprecatedGo-SDK: api/types: deprecate NodeListOptions, NodeRemoveOptions, ServiceCreateOptions, ServiceUpdateOptions, RegistryAuthFromSpec, RegistryAuthFromPreviousSpec, ServiceListOptions, ServiceInspectOptions, and SwarmUnlockKeyResponse which were moved to api/types/swarm. moby/moby#50027

deprecatedGo-SDK: api/types: deprecate SecretCreateResponse, SecretListOptions, ConfigCreateResponse, ConfigListOptions which were moved to api/types/swarm. moby/moby#50024

deprecatedGo-SDK: client: deprecate IsErrNotFound. moby/moby#50012

deprecatedGo-SDK: container: deprecate IsValidHealthString in favor of api/types/container.ValidateHealthStatus. moby/moby#49893

deprecatedGo-SDK: container: deprecate StateStatus, WaitCondition, and the related WaitConditionNotRunning, WaitConditionNextExit, and WaitConditionRemoved consts in favor of their equivalents in api/types/container. moby/moby#49874

deprecatedGo-SDK: opts: deprecate ListOpts.GetAll in favor of ListOpts.GetSlice. docker/cli#6032

deprecatedRemove deprecated IsAutomated formatting placeholder from docker search. docker/cli#6091

deprecatedRemove fallback for pulling images from non-OCI-compliant docker.pkg.github.com registry. moby/moby#50094

deprecatedRemove support for pulling legacy v2, schema 1 images and remove DOCKER_ENABLE_DEPRECATED_PULL_SCHEMA_1_IMAGE environment-variable. moby/moby#50036, moby/moby#42300

deprecatedThe BridgeNfIptables and BridgeNfIp6tables fields in the GET /info response were deprecated in API v1.48, and are now omitted in API v1.50. moby/moby#49904

deprecatederrdefs: Deprecate errdefs.FromStatusCode. Use containerd's errhttp.ToNative instead. moby/moby#50030

+22 more items in the release notes

28.1.1 Apr 18, 2025 Release notes ↗

otherdocker/cli, 28.1.1 milestone

othermoby/moby, 28.1.1 milestone

fixFix dockerd-rootless-setuptool.sh incorrectly reporting missing iptables. moby/moby#49833

fixcontainerd image store: Fix a potential daemon crash when using docker load with archives containing zero-size tar headers. moby/moby#49837

otherUpdate Buildx to v0.23.0. docker/docker-ce-packaging#1185

otherUpdate Compose to v2.35.1. docker/docker-ce-packaging#1188

featureAdd a warning to a container's /etc/resolv.conf when no upstream DNS servers were found. moby/moby#49827

28.1.0 Apr 17, 2025 Release notes ↗

otherdocker/cli, 28.1.0 milestone

othermoby/moby, 28.1.0 milestone

otherChanges to the Engine API, see API version history.

featureAdd docker bake sub-command as alias for docker buildx bake. docker/cli#5947

featureExperimental: add a new --use-api-socket flag on docker run and docker create to enable access to Docker socket from inside a container and to share credentials from the host with the container. docker/cli#5858

featuredocker image inspect now supports a --platform flag to inspect a specific platform of a multi-platform image. docker/cli#5934

fixAdd CLI shell-completion for context names. docker/cli#6016

fixFix docker images --tree not including non-container images content size in the total image content size. docker/cli#6000

fixFix docker load not preserving replaced images. moby/moby#49650

fixFix docker login hints when logging in to a custom registry. docker/cli#6015

fixFix docker stats not working properly on machines with high CPU core count. moby/moby#49734

fixFix a regression causing docker pull/push to fail when interacting with a private repository. docker/cli#5964

fixFix an issue preventing rootless Docker setup on a host with no ip_tables kernel module. moby/moby#49727

fixFix an issue that could lead to unwanted iptables rules being restored and never deleted following a firewalld reload. moby/moby#49728

fixImprove CLI completion of docker service scale. docker/cli#5968

fixdocker images --tree now hides both untagged and dangling images by default. docker/cli#5924

fixdocker system info will provide an exit code if a connection cannot be established to the Docker daemon. docker/cli#5918

fixcontainerd image store: Fix image tag event not being emitted when building with BuildKit. moby/moby#49678

fixcontainerd image store: Improve docker push/pull handling of remote registry errors. moby/moby#49770

fixcontainerd image store: Show pull progress for non-layer image blobs. moby/moby#49746

featureAdd Debian "Trixie" packages. docker/docker-ce-packaging#1181

featureAdd Fedora 42 packages. docker/containerd-packaging#418, docker/docker-ce-packaging#1169

featureAdd Ubuntu 25.04 "Plucky Puffin" packages. docker/containerd-packaging#419, docker/docker-ce-packaging#1177

otherUpdate BuildKit to v0.21.0. moby/moby#49809

otherUpdate Compose to v2.35.0. docker/docker-ce-packaging#1183

otherUpdate Go runtime to 1.23.8. docker/cli#5986, docker/docker-ce-packaging#1180, moby/moby#49737

fixFix a bug causing host port-mappings on Swarm containers to be duplicated on docker ps and docker inspect. moby/moby#49724

fixFix an issue that caused container network attachment to fail with error "Bridge port not forwarding". moby/moby#49705

breakingFix an issue with removal of a --link from a container in the default bridge network. moby/moby#49778

otherImprove how network-endpoint relationships are tracked to reduce the chance of the "has active endpoints" error to be wrongfully returned. moby/moby#49736

otherImprove the "has active endpoints" error message by including the name of endpoints still connected to the network being deleted. moby/moby#49773

breakingcli/command/context: remove temporary ContextType field from JSON output. docker/cli#5981

deprecatedAPI: Deprecated AllowNondistributableArtifactsCIDRs and AllowNondistributableArtifactsHostnames fields in the RegistryConfig struct in the GET /info response are omitted in API v1.49. moby/moby#49749

deprecatedAPI: Deprecated: The ContainerdCommit.Expected, RuncCommit.Expected, and InitCommit.Expected fields in the GET /info endpoint were deprecated in API v1.48, and are now omitted in API v1.49. moby/moby#48556

deprecatedGo-SDK: cli/command/image: Deprecate RunPull: this function was only used internally and will be removed in the next release. docker/cli#5975

deprecatedGo-SDK: cli/config/configfile: deprecate ConfigFile.Experimental field. Experimental CLI features are always enabled since version v20.10 and this field is no longer used. Use ConfigFile.Features instead for optional features. This field will be removed in a future release. docker/cli#5977

deprecatedGo-SDK: deprecate pkg/archive, which was migrated to github.com/moby/go-archive. moby/moby#49743

deprecatedGo-SDK: deprecate pkg/atomicwriter, which was migrated to github.com/moby/sys/atomicwriter. moby/moby#49748

deprecatedGo-SDK: opts: remove deprecated PortOpt, ConfigOpt, SecretOpt aliases. docker/cli#5953

deprecatedGo-SDK: registry: deprecate APIEndpoint.Official field. moby/moby#49706

+5 more items in the release notes

28.0.4 Mar 25, 2025 Release notes ↗

otherdocker/cli, 28.0.4 milestone

othermoby/moby, 28.0.4 milestone

fixFix a regression causing docker pull/push to fail when interacting with a private repository. docker/cli#5964

28.0.3 Mar 25, 2025 Release notes ↗

otherdocker/cli, 28.0.3 milestone

othermoby/moby, 28.0.3 milestone

fixFix docker run truncating the STDOUT/STDERR prematurely when the container exits before the data is consumed. docker/cli#5957

otherUpdate BuildKit to v0.20.2. moby/moby#49698

otherUpdate runc to v1.2.6 (static packages only). moby/moby#49682

otherUpdate containerd to v1.7.26. docker/containerd-packaging#409

28.0.2 Mar 19, 2025 Release notes ↗

otherdocker/cli, 28.0.2 milestone

othermoby/moby, 28.0.2 milestone

fixFix CLI-specific attributes (docker.cli.*) being unintentionally passed to downstream OTel services. docker/cli#5842

fixFix an issue where user-specified OTEL_RESOURCE_ATTRIBUTES were being overridden by CLI's internal telemetry attributes. The CLI now properly merges user-specified attributes with internal ones, allowing both to coexist. docker/cli#5842

fixFix daemon failing to start on Windows when a container created before v28.0.0 was present. moby/moby#49626

fixFix possible error on docker buildx prune with the --min-free-space. moby/moby#49623

fixFix spurious io: read/write on closed pipe error in the daemon log when closing container. moby/moby#49590

fixFix the Docker daemon failing too early if the containerd socket isn't immediately available. moby/moby#49603

fixMask Linux thermal interrupt info in a container's /proc and /sys by default. moby/moby#49560

fixUpdate contrib/check-config.sh to check for more kernel modules related to iptables. moby/moby#49622

fixcontainerd image store: Fix integer overflow in User ID handling passed via --user. moby/moby#49652

fixcontainerd image store: Fix spurious reference for unknown type: application/vnd.in-toto+json warning being logged to the daemon's log. moby/moby#49652

fixcontainerd image store: Improve performance of docker ps when running large number of containers. moby/moby#49365

otherUpdate BuildKit to v0.20.1. moby/moby#49587

otherUpdate Buildx to v0.22.0. docker/docker-ce-packaging#1175

otherUpdate Compose to v2.34.0. docker/docker-ce-packaging#1172

otherUpdate Go runtime to 1.23.7. docker/cli#5890, docker/docker-ce-packaging#1171, moby/moby#49580

otherUpdate RootlessKit to v2.3.4. moby/moby#49614

otherUpdate containerd (static binaries only) to v1.7.27. moby/moby#49656

securityAdd environment variable DOCKER_INSECURE_NO_IPTABLES_RAW=1 to allow Docker to run on systems where the Linux kernel can't provide CONFIG_IP_NF_RAW support. When enabled, Docker will not create rules in the iptables raw table. Warning: This is not recommended for production environments as it…

featureAllow container startup when an endpoint is attached to a macvlan network where the parent interface is down. moby/moby#49630

otherDo not skip DNAT for packets originating in a gateway_mode=routed network. moby/moby#49577

fixFix a bug causing docker ps to inconsistently report dual-stack port mappings. moby/moby#49657

fixFix a bug that could cause docker-proxy to stop forwarding UDP datagrams to containers. moby/moby#49649

fixFix a bug that was causing docker-proxy to close UDP connections to containers eagerly and resulting in the source address to change needlessly. moby/moby#49649

otherMove various types and consts from cli-plugins/manager to a separate package. docker/cli#5902

otherUpdate minimum required Go version to go1.23. moby/moby#49541

othercli/command: Move PrettyPrint utility to cli/command/formatter. docker/cli#5916

otherrunconfig/errors: split ErrConflictHostNetwork into ErrConflictConnectToHostNetwork and ErrConflictDisconnectFromHostNetwork. moby/moby#49605

deprecatedGo-SDK: Deprecate cli-plugins/manager.ResourceAttributesEnvvar constant. It was used internally, but holds the OTEL_RESOURCE_ATTRIBUTES name, which is part of the OpenTelemetry specification. Users of this constant should define their own. It will be removed in the next release. docker/cli#5881

deprecatedGo-SDK: Deprecate opts.PortOpt, opts.ConfigOpt and opts.SecretOpt. These types were moved to the opts/swarmopts package. docker/cli#5907

deprecatedGo-SDK: Remove service/logs package. docker/cli#5910

deprecatedGo-SDK: cli/command/image: Deprecate PushTrustedReference and move to cli/trust. docker/cli#5894

deprecatedGo-SDK: cli/command/image: Deprecate and internalize TrustedPush. docker/cli#5894

deprecatedGo-SDK: cli/command: deprecate Cli.NotaryClient: use trust.GetNotaryRepository instead. This method is no longer used and will be removed in the next release. docker/cli#5885

deprecatedGo-SDK: cli/command: deprecate Cli.RegistryClient. This method was only used internally and will be removed in the next release. Use client.NewRegistryClient instead. docker/cli#5889, docker/cli#5889

deprecatedGo-SDK: registry: Deprecate RepositoryInfo.Official field. moby/moby#49567

deprecatedGo-SDK: registry: deprecate HostCertsDir: this function was only used internally and will be removed in the next release. moby/moby#49612

deprecatedGo-SDK: registry: deprecate SetCertsDir: the cert-directory is now automatically selected when running with RootlessKit, and should no longer be set manually. moby/moby#49612

28.0.1 Feb 26, 2025 Release notes ↗

otherdocker/cli, 28.0.1 milestone

othermoby/moby, 28.0.1 milestone

breakingRemove dependency on kernel modules ip_set, ip_set_hash_net and netfilter_xt_set.

featureThe dependency was introduced in release 28.0.0 but proved too disruptive. The iptables rules using these modules have been replaced. moby/moby#49530

featureAllow daemon startup on a host with IPv6 disabled without requiring --ip6tables=false. moby/moby#49525

fixFix a bug that was causing containers with --restart=always and a published port already in use to restart in a tight loop. moby/moby#49507

fixFix an issue with Swarm ingress, caused by incorrect ordering of iptables rules. moby/moby#49538

fixFix creation of a swarm-scoped network from a --config-only network. moby/moby#49521

fixFix docker network inspect reporting an IPv6 gateway with CIDR suffix for a newly created network with no specific IPAM config, until a daemon restart. moby/moby#49520

otherImprove the error reported when kernel modules ip_set, ip_set_hash_net and netilter_xt_set are not available. moby/moby#49524

otherMove most of Docker's iptables rules out of the filter-FORWARD chain, so that other applications are free to append rules that must follow Docker's rules. moby/moby#49518

otherUpdate --help output and man page lo state which options only apply to the default bridge network. moby/moby#49522

fixFix docker context create always returning an error when using the "skip-tls-verify" option. docker/cli#5850

fixFix shell completion suggesting IDs instead of names for services and nodes. docker/cli#5848

fixFix unintentionally printing exit status to standard error output when docker exec/run returns a non-zero status. docker/cli#5854

fixFix regression protocol "tcp" is not supported by the RootlessKit port driver "slirp4netns". moby/moby#49514

fixcontainerd image store: Fix docker inspect not being able to show multi-platform images with missing layers for all platforms. moby/moby#49533

fixcontainerd image store: Fix docker images --tree reporting wrong content size. moby/moby#49535

fixFix compilation on i386 moby/moby#49526

securityUpdate github.com/go-jose/go-jose/v4 to v4.0.5 to address. GHSA-c6gw-w398-hv78 / CVE-2025-27144 docker/cli#5867

otherUpdate Buildx to v0.21.1. docker/docker-ce-packaging#1167

otherUpdate Compose to v2.33.1. docker/docker-ce-packaging#1168

fixcontainerd image store: Fix GET /images/json?manifests=1 not filling Manifests for index-only images. moby/moby#49533

fixcontainerd image store: Fix GET /images/json and /images//json Size.Content field including the size of content that's not available locally. moby/moby#49535

28.0.0 Feb 20, 2025 Release notes ↗

securityFixes CVE-2025-54410: Firewalld reload removes bridge network isolation

deprecatedDeprecated and removed features, see Deprecated Features.

breakingThe executable rootlesskit-docker-proxy is no longer used, it has been removed from the build and distribution.

deprecatedThe deprecated OCI prestart hook is now only used by build containers. For other containers, network interfaces are added to the network namespace after task creation is complete, before the container task is started. moby/moby#47406

securityFix a security issue that was allowing remote hosts to connect directly to a container on its published ports. moby/moby#49325

securityFix a security issue that was allowing neighbor hosts to connect to ports mapped on a loopback address. moby/moby#49325

breakingThe Fluent logger option fluentd-async-connect has been deprecated in v20.10 and is now removed. moby/moby#46114

breakingThe --time option on docker stop and docker restart is deprecated and renamed to --timeout. docker/cli#5485

breakingGo-SDK: pkg/ioutils: Remove NewReaderErrWrapper as it was never used. moby/moby#49258

breakingGo-SDK: pkg/ioutils: Remove deprecated BytesPipe, NewBytesPipe, ErrClosed, WriteCounter, NewWriteCounter, NewReaderErrWrapper, NopFlusher. moby/moby#49245

breakingGo-SDK: pkg/ioutils: Remove deprecated NopWriter and NopWriteCloser. moby/moby#49256

breakingGo-SDK: pkg/sysinfo: Remove deprecated NumCPU. moby/moby#49242

breakingGo-SDK: Remove pkg/broadcaster, as it was only used internally moby/moby#49172

breakingGo-SDK: Remove deprecated cli.Errors type docker/cli#5549

breakingRemove pkg/ioutils.ReadCloserWrapper, as it was only used in tests. moby/moby#49237

breakingRemove deprecated api-cors-header config parameter and the dockerd --api-cors-header option moby/moby#48209

breakingRemove deprecated APIEndpoint.Version field, APIVersion type, and APIVersion1 and APIVersion2 consts. moby/moby#49004

breakingRemove deprecated api-cors-header config parameter and the Docker daemon's --api-cors-header option. docker/cli#5437

breakingRemove deprecated pkg/directory package moby/moby#48779

breakingRemove deprecated pkg/dmsg.Dmesg() moby/moby#48109

breakingRemove deprecated image/spec package, which was moved to a separate module (github.com/moby/docker-image-spec) moby/moby#48460

breakingRemove migration code and errors for the deprecated logentries logging driver. moby/moby#48891

breakingRemove support for deprecated external graph-driver plugins. moby/moby#48072

breakingapi/types: Remove deprecated container.ContainerNode and ContainerJSONBase.Node field. moby/moby#48107

breakingapi/types: Remove deprecated aliases: ImagesPruneReport, VolumesPruneReport, NetworkCreateRequest, NetworkCreate, NetworkListOptions, NetworkCreateResponse, NetworkInspectOptions, NetworkConnect, NetworkDisconnect, EndpointResource, NetworkResource, NetworksPruneReport, ExecConfig, ExecStartCheck,…

breakinglibnetwork/iptables: Remove deprecated IPV, Iptables, IP6Tables and Passthrough(). moby/moby#49121

breakingpkg/archive: Remove deprecated CanonicalTarNameForPath, NewTempArchive, TempArchive moby/moby#48708

breakingpkg/fileutils: Remove deprecated GetTotalUsedFds moby/moby#49210

breakingpkg/ioutils: Remove OnEOFReader, which was only used internally moby/moby#49170

breakingpkg/longpath: Remove deprecated Prefix constant. moby/moby#48779

breakingpkg/stringid: Remove deprecated IsShortID and ValidateID functions moby/moby#48705

breakingrunconfig/opts: Remove deprecated ConvertKVStringsToMap moby/moby#48102

breakingrunconfig: Remove deprecated ContainerConfigWrapper, SetDefaultNetModeIfBlank, DefaultDaemonNetworkMode, IsPreDefinedNetwork moby/moby#48102

breakingcontainer: Remove deprecated ErrNameReserved, ErrNameNotReserved. moby/moby#48728

breakingRemove Daemon.ContainerInspectCurrent() method and change Daemon.ContainerInspect() signature to accept a backend.ContainerInspectOptions struct moby/moby#48672

breakingRemove deprecated Daemon.Exists() and Daemon.IsPaused() methods. moby/moby#48723

deprecatedAPI: The BridgeNfIptables and BridgeNfIp6tables fields in the GET /info response are now always be false and will be omitted in API v1.49. The netfilter module is now loaded on-demand, and no longer during daemon startup, making these fields obsolete. moby/moby#49114

deprecatedAPI: The error and progress fields in streaming responses for endpoints that return a JSON progress response, such as POST /images/create, POST /images/{name}/push, and POST /build are deprecated. moby/moby#49447

deprecatedUsers should use the information in the errorDetail and progressDetail fields instead.

deprecatedThese fields were marked deprecated in API v1.4 (docker v0.6.0) and API v1.8 (docker v0.7.1) respectively, but still returned.

+173 more items in the release notes

27.5.1 Jan 22, 2025 Release notes ↗

otherdocker/cli, 27.5.1 milestone

othermoby/moby, 27.5.1 milestone

fixFixed an issue that could persistently prevent daemon startup after failure to initialize the default bridge. moby/moby#49307

fixAdd a DOCKER_IGNORE_BR_NETFILTER_ERROR environment variable. Setting it to 1 allows running on hosts that cannot load br_netfilter. Some things won't work, including disabling inter-container communication in a bridge network. With the userland proxy disabled, it won't be possible to access one…

securityUpdate Go runtime to 1.22.11 (fix CVE-2024-45341, CVE-2024-45336). moby/moby#49312, docker/docker-ce-packaging#1147, docker/cli#5762

otherUpdate RootlessKit to v2.3.2 to support passt >= 2024_10_30.ee7d0b6. moby/moby#49304

otherUpdate Buildx to v0.20.0. docker/docker-ce-packaging#1149

27.5.0 Jan 13, 2025 Release notes ↗

otherdocker/cli, 27.5.0 milestone

othermoby/moby, 27.5.0 milestone

fixcontainerd image store: Fix passing a build context via tarball to the /build endpoint. moby/moby#49194

fixBuilder garbage collection policies without a keepStorage value now inherit the defaultKeepStorage limit as intended. moby/moby#49137

fixPreserve network labels during daemon startup. moby/moby#49200

fixFix a potential race condition error when deleting a container. moby/moby#49239

deprecatedpkg/sysinfo: deprecate NumCPU. This utility has the same behavior as runtime.NumCPU. moby/moby#49247

deprecatedpkg/fileutils: deprecate GetTotalUsedFds: this function is only used internally and will be removed in the next release. moby/moby#49209

deprecatedpkg/ioutils: deprecate BytesPipe, NewBytesPipe, ErrClosed, WriteCounter, NewWriteCounter, NewReaderErrWrapper, NopFlusher, NopWriter, NopWriteCloser. They were only used internally and will be removed in the next release. moby/moby#49246, moby/moby#49255

deprecatedpkg/reexec: This package is deprecated and moved to a separate module. Use github.com/moby/sys/reexec instead. moby/moby#49135

otherUpdate containerd to v1.7.25 moby/moby#49253

otherUpdate runc to v1.2.4 moby/moby#49243

otherUpdate BuildKit to v0.18.2 moby/moby#48949

otherUpdate Compose to v2.32.2 docker/docker-ce-packaging#1140

27.4.1 Dec 18, 2024 Release notes ↗

otherdocker/cli, 27.4.1 milestone

othermoby/moby, 27.4.1 milestone

fixFix excessive memory allocations when OTel is not configured. moby/moby#49079

fixThe docker info command and the corresponding GET /info API endpoint no longer include warnings when bridge-nf-call-iptables or bridge-nf-call-ip6tables are disabled at the daemon is started. The br_netfilter kernel module is now attempted to be loaded when needed, which made those warnings…

fixAttempt to load kernel modules, including ip6_tables and br_netfilter when required, using a method that is likely to succeed inside a Docker-in-Docker container. moby/moby#49043

fixFix a bug that could result in an iptables DOCKER FILTER chain not being cleaned up on failure. moby/moby#49110

deprecatedpkg/system: Deprecate Lstat(), Mkdev(), Mknod(), FromStatT() and Stat() functions, and related StatT types. These were only used internally, and will be removed in the next release. moby/moby#49100

deprecatedlibnetwork/iptables: Deprecate IPV, Iptables and IP6Tables types in favor of IPVersion, IPv4, and IPv6. This type and consts will be removed in the next release. moby/moby#49093

deprecatedlibnetwork/iptables: Deprecate Passthrough. This function was only used internally, and will be removed in the next release. moby/moby#49119

otherUpdate Compose to v2.32.1. docker/docker-ce-packaging#1130

otherUpdate Buildx to v0.19.3. docker/docker-ce-packaging#1132

otherUpdate runc to v1.2.3 (static packages only). moby/moby#49085

27.4.0 Dec 9, 2024 Release notes ↗

otherdocker/cli, 27.4.0 milestone

othermoby/moby, 27.4.0 milestone

otherGET /images/json with the manifests option enabled now preserves the original order in which manifests appeared in the manifest-index. moby/moby#48712

fixWhen reading logs with the jsonfile or local log drivers, any errors while trying to read or parse underlying log files will cause the rest of the file to be skipped and move to the next log file (if one exists) rather than returning an error to the client and closing the stream. The errors are…

fixWhen reading log files, compressed log files are now only decompressed when needed rather than decompressing all files before starting the log stream. moby/moby#48842

fixFix an issue that meant published ports from one container on a bridge network were not accessible from another container on the same network with userland-proxy disabled, if the kernel's br_netfilter module was not loaded and enabled. The daemon will now attempt to load the module and enable…

fixFix loading of bridge and br_netfilter kernel modules. moby/moby#48966

fixcontainerd image store: Fix Docker daemon failing to fully start with a "context deadline exceeded error" with containerd snapshotter and many builds/images. moby/moby#48954

fixcontainerd image-store: Fix partially pulled images not being garbage-collected. moby#48910, moby/moby#48957

fixcontainerd image store: Fix docker image inspect outputting duplicate references in RepoDigests. moby/moby#48785

fixcontainerd image store: Fix not being able to connect to some insecure registries in cases where the HTTPS request failed due to a non-TLS related error. moby/moby#48758

fixcontainerd image store: Remove a confusing warning log when tagging a non-dangling image. moby/moby#49010

fixdockerd-rootless-setuptool.sh: let --force ignore smoke test errors moby/moby#48695

fixDisable IPv6 Duplicate Address Detection (DAD) for addresses assigned to the bridges belonging to bridge networks. moby/moby#48684

fixRemove BuildKit init timeout. moby/moby#48963

fixIgnore "dataset does not exist" error when removing dataset on ZFS. moby/moby#48968

fixClient: Prevent idle connections leaking FDs. moby/moby#48764

fixFix anonymous volumes being created through the --mount option not being marked as anonymous. moby/moby#48755

fixAfter a daemon restart with live-restore, ensure an iptables jump to the DOCKER-USER chain is placed before other rules. moby/moby#48714

fixFix a possible memory leak caused by OTel meters. moby/moby#48693

fixCreate distinct build history db for each store. moby/moby#48688

fixFix an issue that caused excessive memory usage when DNS resolution was made in a tight loop. moby/moby#48840

fixcontainerd image store: Do not underline names in docker image ls --tree. docker/cli#5519

fixcontainerd image store: Change name of USED column in docker image ls --tree to IN USE. docker/cli#5518

fixFix a bug preventing image pulls from being cancelled during docker run. docker/cli#5654

fixPort some completions from the bash completion to the new cobra based completion. docker/cli#5618

fixThe docker login and docker logout command no longer update the configuration file if the credentials didn't change. docker/cli#5569

fixOptimise docker stats to reduce flickering issues. docker/cli#5588, docker/cli#5635

fixFix inaccessible plugins paths preventing plugins from being detected. docker/cli#5652

fixAdd support for events --filter in cobra generated shell completions. docker/cli#5614

fixFix bash completion for events --filter daemon=. docker/cli#5563

fixImprove shell-completion of containers for docker rm. docker/cli#5540

fixAdd shell-completion for --platform flags. docker/cli#5540

fixrootless: Make /etc/cdi and /var/run/cdi accessible by the Container Device Interface (CDI) integration. moby/moby#49027

breakingDeprecate Daemon.Exists() and Daemon.IsPaused(). These functions are no longer used and will be removed in the next release. moby/moby#48719

breakingDeprecate container.ErrNameReserved and container.ErrNameNotReserved. moby/moby#48697

breakingDeprecate pkg/platform - this package is only used internally, and will be removed in the next release. moby/moby#48863

breakingDeprecate RepositoryInfo.Class. This field is no longer used, and will be removed in the next release. moby/moby#49013

breakingGo SDK: Fix deprecation of cli/command.ConfigureAuth(), which was deprecated since v27.2.1. docker/cli#5552

breakingGo SDK: Deprecate cli.Errors type in favour of Go's errors.Join docker/cli#5548

+7 more items in the release notes

27.3.1 Sep 20, 2024 Release notes ↗

otherdocker/cli, 27.3.1 milestone

othermoby/moby, 27.3.1 milestone

fixCLI: Fix issue with command execution metrics not being exported due to the CLI MeterProvider being shutdown too early. docker/cli#5457

otherUpdate Compose to v2.29.7

27.3.0 Sep 19, 2024 Release notes ↗

otherdocker/cli, 27.3.0 milestone

othermoby/moby, 27.3.0 milestone

fixcontainerd image store: Fix docker image prune -a untagging images used by containers started from images referenced by a digested reference. moby/moby#48488

fixAdd a --feature flag to the daemon options. moby/moby#48487

fixUpdated the handling of the --gpus=0 flag to be consistent with the NVIDIA Container Runtime. moby/moby#48483 (https://github.com/docker/cli/pull/5432)

fixSupport WSL2 mirrored-mode networking's use of interface loopback0 for packets from the Windows host. moby/moby#48514

fixFix an issue that prevented communication between containers on an IPv4 bridge network when running with --iptables=false, --ip6tables=true (the default), a firewall with a DROP rule for forwarded packets on hosts where the br_netfilter kernel module was not normally loaded. moby/moby#48511

fixCLI: Fix issue where docker volume update command would cause the CLI to panic if no argument/volume was passed. docker/cli#5426

fixCLI: Properly report metrics when run in WSL environment on Windows. [docker/cli#5432]

otherUpdate containerd (static binaries only) to v1.7.22 moby/moby#48468

otherUpdated Buildkit to v0.16.0

otherUpdate Compose to v2.29.6

otherUpdate Buildx to v0.17.1

27.2.1 Sep 9, 2024 Release notes ↗

otherdocker/cli, 27.2.1 milestone

othermoby/moby, 27.2.1 milestone

fixcontainerd image store: Fix non-container images being hidden in the docker image ls output. moby/moby#48402

fixcontainerd image store: Improve docker pull error message when the image platform doesn't match. moby/moby#48415

fixCLI: Fix issue causing docker login to not remove repository names from passed in registry addresses, resulting in credentials being stored under the wrong key. docker/cli#5385

fixCLI: Fix issue that will sometimes cause the browser-login flow to fail if the CLI process is suspended and then resumed while waiting for the user to authenticate. docker/cli#5376

fixCLI: docker login now returns an error instead of hanging if called non-interactively with --password or --password-stdin but without --user. docker/cli#5402

securityUpdate runc to v1.1.14, which contains a fix for CVE-2024-45310. moby/moby#48426

otherUpdate Go runtime to 1.22.7. moby/moby#48433, docker/cli#5411, docker/docker-ce-packaging#1068

27.2.0 Aug 27, 2024 Release notes ↗

otherdocker/cli, 27.2.0 milestone

othermoby/moby, 27.2.0 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

featureCLI: Add support for device-code flow login when authenticating to the official registry. docker/cli#5349

featurecontainerd image store: docker image ls now supports --tree flag that shows a multiplatform-aware image list. This is experimental and may change at any time without any backwards compatibility. docker/cli#5353

featureGET /images/json response now includes Manifests field, which contains information about the sub-manifests included in the image index. This includes things like platform-specific manifests and build attestations. The new field will only be populated if the request also sets the manifests query…

fixCLI: Fix issue with remote contexts over SSH where the CLI would allocate a pseudoterminal when connecting to the remote host, which causes issues in rare situations. docker/cli#5351

fixFix an issue that prevented network creation with a --ip-range ending on a 64-bit boundary. moby/moby#48326

fixCLI: IPv6 addresses shown by docker ps in port bindings are now bracketed. docker/cli#5365

fixcontainerd image store: Fix early error exit from docker load in cases where unpacking the image would fail. moby/moby#48376

fixcontainerd image store: Fix the previous image not being persisted as dangling after docker pull. moby/moby#48380

otherUpdate BuildKit to v0.15.2. moby/moby#48341

otherUpdate Compose to v2.29.2. docker/docker-ce-packaging#1050

otherThe canonical source for the dockerd(8) man page has been moved back to the same source tree as dockerd itself. moby/moby#48378

otherUpdate containerd to v1.7.21. moby/moby#48383, docker/containerd-packaging#389

27.1.2 Aug 13, 2024 Release notes ↗

otherdocker/cli, 27.1.2 milestone

othermoby/moby, 27.1.2 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

fixFix a regression that could result in a ResourceExhausted desc = grpc: received message larger than max error when building from a large Dockerfile. moby/moby#48245

fixCLI: Fix docker attach printing a spurious context cancelled error message. docker/cli#5296

fixCLI: Fix docker attach exiting on SIGINT instead of forwarding the signal to the container and waiting for it to exit. docker/cli#5302

fixCLI: Fix --device-read-bps and --device-write-bps options not taking effect. docker/cli#5339

fixCLI: Fix a panic happening in some cases while running a plugin. docker/cli#5337

otherUpdate BuildKit to v0.15.1. moby/moby#48246

otherUpdate Buildx to v0.16.2. docker/docker-ce-packaging#1043

otherUpdate Go runtime to 1.21.13. moby/moby#48301, docker/cli#5325, docker/docker-ce-packaging#1046

breakingRemove unused docker-proxy.exe binary from Windows packages. docker/docker-ce-packaging#1045

27.1.1 Jul 23, 2024 Release notes ↗

securityThis release contains a fix for CVE-2024-41110 / GHSA-v23v-6jw2-98fq that impacted setups using authorization plugins (AuthZ) for access control. No other changes are included in this release, and this release is otherwise identical for users not using AuthZ plugins.

otherUpdate Compose to v2.29.1. moby/docker-ce-packaging#1041

27.1.0 Jul 22, 2024 Release notes ↗

otherdocker/cli, 27.1.0 milestone

othermoby/moby, 27.1.0 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

fixrootless: add Requires=dbus.socket to prevent errors when starting the daemon on a cgroup v2 host with systemd moby/moby#48141

fixcontainerd integration: image tag event is now properly emitted when building images with BuildKit moby/moby#48182

fixCLI: enable shell completion for docker image rm, docker image history, and docker image inspect moby/moby#5261

fixCLI: add and improve shell completions for various flags moby/moby#5261

fixCLI: add OOMScoreAdj to docker service create and docker stack docker/cli#5274

fixCLI: add support for DOCKER_CUSTOM_HEADERS environment variable (experimental) docker/cli#5271

fixCLI: containerd-integration: Fix docker push defaulting the --platform flag to a value of DOCKER_DEFAULT_PLATFORM environment variable on unsupported API versions docker/cli#5248

fixCLI: fix: context cancellation on login prompt docker/cli#5260

fixCLI: fix: wait for the container to exit before closing the stream when sending a termination request to the CLI while attached to a container docker/cli#5250

deprecatedThe pkg/rootless/specconv package is deprecated, and will be removed in the next release moby/moby#48185

deprecatedThe pkg/containerfs package is deprecated, and will be removed in the next release moby/moby#48185

deprecatedThe pkg/directory package is deprecated, and will be removed in the next release moby/moby#48185

deprecatedapi/types/system: remove deprecated Info.ExecutionDriver moby/moby#48184

otherUpdate Buildx to v0.16.1. moby/docker-ce-packaging#1039

otherUpdate Compose to v2.29.0. moby/docker-ce-packaging#1038

otherUpdate Containerd (static binaries only) to v1.7.20. moby/moby#48191

otherUpdate BuildKit to v0.15.0. moby/moby#48175

securityUpdate Go runtime to 1.21.12, which contains security fixes for CVE-2024-24791 moby/moby#48120

27.0.3 Jul 1, 2024 Release notes ↗

otherdocker/cli, 27.0.3 milestone

othermoby/moby, 27.0.3 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

fixFix a regression that incorrectly reported a port mapping from a host IPv6 address to an IPv4-only container as an error. moby/moby#48090

fixFix a regression that caused duplicate subnet allocations when creating networks. moby/moby#48089

fixFix a regression resulting in "fail to register layer: failed to Lchown" errors when trying to pull an image with rootless enabled on a system that supports native overlay with user-namespaces. moby/moby#48086

27.0.2 Jun 26, 2024 Release notes ↗

otherdocker/cli, 27.0.2 milestone

othermoby/moby, 27.0.2 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

fixFix a regression that caused port numbers to be ignored when parsing a Docker registry URL. docker/cli#5197, docker/cli#5198

breakingapi/types: deprecate ContainerJSONBase.Node field and ContainerNode type. These definitions were used by the standalone ("classic") Swarm API, but never implemented in the Docker Engine itself. moby/moby#48055

27.0.1 Jun 25, 2024 Release notes ↗

deprecatedDeprecated and removed features, see Deprecated Features.

featurecontainerd image store: Add --platform flag to docker image push and improve the default behavior when not all platforms of the multi-platform image are available locally. docker/cli#4984, moby/moby#47679

featureAdd support to docker stack deploy for driver_opts in a service's networks. docker/cli#5125

featureConsider additional /usr/local/libexec and /usr/libexec paths when looking up the userland proxy binaries by a name with a docker- prefix. moby/moby#47804

featureAllow sysctls to be set per-interface during container creation and network connection. moby/moby#47686

featureThere is no impact if you are running Docker Engine with ip6tables enabled (new default).

breakingIf you are using an IPv6-enabled bridge network without ip6tables, this is likely a breaking change. Only published container ports (-p or --publish) are accessible from outside the Docker bridge network, and outgoing connections masquerade as the host.

featureA Unique Local Address (ULA) base prefix is automatically added to default-address-pools if this parameter wasn't manually configured, or if it contains no IPv6 prefixes. moby/moby#47853

featurePrior to this release, to create an IPv6-enabled network it was necessary to use the --subnet option to specify an IPv6 subnet, or add IPv6 ranges to default-address-pools in daemon.json.

featureStarting in this release, when a bridge network is created with --ipv6 and no IPv6 subnet is defined by those options, an IPv6 Unique Local Address (ULA) base prefix is used.

featureThe ULA prefix is derived from the Engine host ID such that it's unique across hosts and over time.

featureIPv6 address pools of any size can now be added to default-address-pools. moby/moby#47768

featureIPv6 can now be enabled by default on all custom bridge networks using "default-network-opts": { "bridge": {"com.docker.network.enable_ipv6": "true"}} in daemon.json, or dockerd --default-network-opt=bridge=com.docker.network.enable_ipv6=trueon the comand line. moby/moby#47867

featureDirect routing for IPv6 networks, with ip6tables enabled. moby/moby#47871

featureAdded bridge driver option com.docker.network.bridge.gateway_mode_ipv6=.

featureThe default behavior, nat, is unchanged from previous releases running with ip6tables enabled. NAT and masquerading rules are set up for each published container port.

featureWhen set to routed, no NAT or masquerading rules are configured for published ports. This enables direct IPv6 access to the container, if the host's network can route packets for the container's address to the host. Published ports will be opened in the container's firewall.

featureWhen a port mapping only applies to routed mode, only addresses 0.0.0.0 or :: are allowed and a host port must not be given.

featureNote that published container ports, in nat or routed mode, are accessible from any remote address if routing is set up in the network, unless the Docker host's firewall has additional restrictions. For example: docker network create --ipv6 -o com.docker.network.bridge.gateway_mode_ipv6=routed…

featureThe option com.docker.network.bridge.gateway_mode_ipv4= is also available, with the same behavior but for IPv4.

featureIf firewalld is running on the host, Docker creates policy docker-forwarding to allow forwarding from any zone to the docker zone. This makes it possible to configure a bridge network with a routable IPv6 address, and no NAT or masquerading. moby/moby#47745

featureWhen a port is published with no host port specified, or a host port range is given, the same port will be allocated for IPv4 and IPv6. moby/moby#47871

featureFor example -p 80 will result in the same ephemeral port being allocated for 0.0.0.0 and ::, and -p 8080-8083:80 will pick the same port from the range for both address families.

featureSimilarly, ports published to specific addresses will be allocated the same port. For example, -p 127.0.0.1::80 -p '[::1]::80'.

featureIf no port is available on all required addresses, container creation will fail.

featureEnvironment variable DOCKER_ALLOW_IPV6_ON_IPV4_INTERFACE, introduced in release 26.1.1, no longer has any effect. moby/moby#47963

featureIf IPv6 could not be disabled on an interface because of a read-only /proc/sys/net, the environment variable allowed the container to start anyway.

featureIn this release, if IPv4 cannot be disabled for an interface, IPv6 can be explicitly enabled for the network simply by using --ipv6 when creating it. Other workarounds are to configure the OS to disable IPv6 by default on new interfaces, mount /proc/sys/net read-write, or use a kernel with no IPv6…

breakingDeprecate experimental GraphDriver plugins. moby/moby#48050, docker/cli#5172

breakingpkg/archive: deprecate NewTempArchive and TempArchive. These types were only used in tests and will be removed in the next release. moby/moby#48002

breakingpkg/archive: deprecate CanonicalTarNameForPath moby/moby#48001

breakingDeprecate pkg/dmesg. This package was no longer used, and will be removed in the next release. moby/moby#47999

breakingDeprecate pkg/stringid.ValidateID and pkg/stringid.IsShortID moby/moby#47995

breakingrunconfig: deprecate SetDefaultNetModeIfBlank and move ContainerConfigWrapper to api/types/container moby/moby#48007

breakingrunconfig: deprecate DefaultDaemonNetworkMode and move to daemon/network moby/moby#48008

breakingrunconfig: deprecate opts.ConvertKVStringsToMap. This utility is no longer used, and will be removed in the next release. moby/moby#48016

breakingrunconfig: deprecate IsPreDefinedNetwork. moby/moby#48011

deprecatedDeprecate non-standard (config) fields in image inspect output. The Config field returned by this endpoint (used for docker image inspect) returned additional fields that are not part of the image's configuration and not part of the [Docker Image Spec] and the [OCI Image Spec]. These fields are…

deprecatedDeprecate the daemon flag --api-cors-header and the corresponding daemon.json configuration option. These will be removed in the next major release. moby/moby#45313

breakingRemove deprecated aliases for Image types. moby/moby#47900

+97 more items in the release notes

26.1.5 Jul 24, 2024 Release notes ↗

26.1.4 Jun 5, 2024 Release notes ↗

otherdocker/cli, 26.1.4 milestone

othermoby/moby, 26.1.4 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

security[CVE-2024-24789]

security[CVE-2024-24790]

securityA symlink time of check to time of use race condition during directory removal reported by Addison Crump (@addisoncrump).

fixFixed an issue where promoting a node immediately after another node was demoted could cause the promotion to fail. moby/moby#47870

fixPrevent the daemon log from being spammed with superfluous response.WriteHeader call ... messages.. moby/moby#47843

fixDon't show empty hints when plugins return an empty hook message. docker/cli#5083

fixAdded ContextType: "moby" to the context list/inspect output to address a compatibility issue with Visual Studio Container Tools. docker/cli#5095

fixFix a compatibility issue with Visual Studio Container Tools. docker/cli#5095

otherUpdate containerd (static binaries only) to v1.7.17. moby/moby#47841

security[CVE-2024-24789], [CVE-2024-24790]: Update Go runtime to 1.21.11. moby/moby#47904

otherUpdate Compose to v2.27.1. docker/docker-ce-packages#1022

securityUpdate Buildx to v0.14.1. docker/docker-ce-packages#1021 [CVE-2024-24789]: https://github.com/golang/go/issues/66869 [CVE-2024-24790]: https://github.com/golang/go/issues/67680

26.1.3 May 16, 2024 Release notes ↗

otherdocker/cli, 26.1.3 milestone

othermoby/moby, 26.1.3 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

fixFix a regression that prevented the use of DNS servers within a --internal network. moby/moby#47832

fixWhen the internal DNS server's own address is supplied as an external server address, ignore it to avoid unproductive recursion. moby/moby#47833

featureAllow runc to kill containers when confined to the runc profile in AppArmor version 4.0.0 and later. moby/moby#47829

26.1.2 May 9, 2024 Release notes ↗

otherdocker/cli, 26.1.2 milestone

othermoby/moby, 26.1.2 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

fixFix issue where the CLI process would sometimes hang when a container failed to start. docker/cli#5062

otherUpdate Go runtime to 1.21.10. moby/moby#47806

26.1.1 Apr 30, 2024 Release notes ↗

otherdocker/cli, 26.1.1 milestone

othermoby/moby, 26.1.1 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

fixFix docker run -d printing an context canceled spurious error when OTEL is configured. docker/cli#5044

fixExperimental environment variable DOCKER_BRIDGE_PRESERVE_KERNEL_LL=1 will prevent the daemon from removing the kernel-assigned link local address on a Linux bridge. moby/moby#47775

fixResolve an issue preventing container creation on hosts with a read-only /proc/sys/net filesystem. If IPv6 cannot be disabled on an interface due to this, either disable IPv6 by default on the host or ensure /proc/sys/net is read-write. Otherwise, start dockerd with…

otherUpdate BuildKit to v0.13.2. moby/moby#47762

otherUpdate Compose to v2.27.0. docker/docker-ce-packages#1017

26.1.0 Apr 22, 2024 Release notes ↗

otherdocker/cli, 26.1.0 milestone

othermoby/moby, 26.1.0 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

featureAdd configurable OpenTelemetry utilities and basic instrumentation to commands. For more information, see OpenTelemetry for the Docker CLI. docker/cli#4889

fixNative Windows containers are configured with an internal DNS server for container name resolution, and external DNS servers for other lookups. Not all resolvers, including nslookup, fall back to the external resolvers when they get a SERVFAIL answer from the internal server. So, the internal DNS…

fixSwarm: Fix Subpath not being passed to the container config. moby/moby#47711

fixClassic builder: Fix cache miss on WORKDIR / build step (directory with a trailing slash). moby/moby#47723

fixcontainerd image store: Fix docker images failing when any image in the store has unexpected target. moby/moby#47738

26.0.2 Apr 18, 2024 Release notes ↗

otherdocker/cli, 26.0.2 milestone

othermoby/moby, 26.0.2 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

securityThis release contains a security fix for [CVE-2024-32473], an unexpected configuration of IPv6 on IPv4-only interfaces.

security[CVE-2024-32473]: Ensure IPv6 is disabled on interfaces only allocated an IPv4 address by the engine. moby#GHSA-x84c-p2g9-rqv9 [CVE-2024-32473]: https://github.com/moby/moby/security/advisories/GHSA-x84c-p2g9-rqv9

26.0.1 Apr 11, 2024 Release notes ↗

otherdocker/cli, 26.0.1 milestone

othermoby/moby, 26.0.1 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

fixFix a regression that meant network interface specific --sysctl options prevented container startup. moby/moby#47646

fixRemove erroneous platform from image config OCI descriptor in docker save output. moby/moby#47694

fixcontainerd image store: OCI archives produced by docker save will now have a non-empty mediaType field in index.json moby/moby#47701

fixFix a regression that prevented the internal resolver from forwarding requests from IPvlan L3 networks to external resolvers. moby/moby#47705

fixPrevent the use of external resolvers in IPvlan and Macvlan networks created with no parent interface specified. moby/moby#47705

otherUpdate Go runtime to 1.21.9 moby/moby#47671, docker/cli#4987

otherUpdate Compose to v1.26.1 , docker/docker-ce-packaging#1009

otherUpdate containerd to v1.7.15 (static binaries only) moby/moby#47692

26.0.0 Mar 20, 2024 Release notes ↗

otherdocker/cli, 26.0.0 milestone

othermoby/moby, 26.0.0 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

securityThis release contains a security fix for [CVE-2024-29018], a potential data exfiltration from 'internal' networks via authoritative DNS servers.

featureAdd Subpath field to the VolumeOptions making it possible to mount a subpath of a volume. moby/moby#45687

featureAdd volume-subpath support to the mount flag (--mount type=volume,...,volume-subpath=). docker/cli#4331

featureAccept = separators and [ipv6] in compose files for docker stack deploy. docker/cli#4860

featurerootless: Add support for enabling host loopback by setting the DOCKERD_ROOTLESS_ROOTLESSKIT_DISABLE_HOST_LOOPBACK environment variable to false (defaults to true). This lets containers connect to the host by using IP address 10.0.2.2. moby/moby#47352

featurecontainerd image store: docker image ls no longer creates duplicates entries for multi-platform images. moby/moby#45967

featurecontainerd image store: Send Prometheus metrics. moby/moby#47555

security[CVE-2024-29018]: Do not forward requests to external DNS servers for a container that is only connected to an 'internal' network. Previously, requests were forwarded if the host's DNS server was running on a loopback address, like systemd's 127.0.0.53. moby/moby#47589

fixEnsure that a generated MAC address is not restored when a container is restarted, but a configured MAC address is preserved. moby/moby#47233

fixAlways attempt to enable IPv6 on a container's loopback interface, and only include IPv6 in /etc/hosts if successful. moby/moby#47062

fixFix ADD Dockerfile instruction failing with lsetxattr : operation not supported when unpacking archive with xattrs onto a filesystem that doesn't support them. moby/moby#47175

fixFix docker container start failing when used with --checkpoint. moby/moby#47456

fixRestore IP connectivity between the host and containers on an internal bridge network. moby/moby#47356

fixDo not enforce new validation rules for existing swarm networks. moby/moby#47361

fixRestore DNS names for containers in the default "nat" network on Windows. moby/moby#47375

fixPrint hint when invoking docker image ls with ambiguous argument. docker/cli#4849

fixCleanup @docker_cli_[UUID] files on OpenBSD. docker/cli#4862

fixAdd explicit deprecation notice message when using remote TCP connections without TLS. docker/cli#4928, moby/moby#47556

fixUse IPv6 nameservers from the host's resolv.conf as upstream resolvers for Docker Engine's internal DNS, rather than listing them in the container's resolv.conf. moby/moby#47512

fixcontainerd image store: Isolate images with different containerd namespaces when --userns-remap option is used. moby/moby#46786

fixcontainerd image store: Fix image pull not emitting Pulling fs layer status. moby/moby#47432

otherTo preserve backwards compatibility, read-only mounts are not recursive by default when using older clients (API version < v1.44). moby/moby#47391

otherGET /images/{id}/json omits the Created field (previously it was 0001-01-01T00:00:00Z) if the Created field is missing from the image config. moby/moby#47451

breakingRemove Container and ContainerConfig fields from the GET /images/{name}/json response. moby/moby#47430

breakingDeprecate the ability to accept remote TCP connections without TLS. Deprecation notice docker/cli#4928 moby/moby#47556.

breakingRemove deprecated API versions (API < v1.24) moby/moby#47155

breakingDisable pulling of deprecated image formats by default. These image formats are deprecated, and support will be removed in a future version. moby/moby#47459

breakingimage: remove deprecated IDFromDigest moby/moby#47198

breakingRemove the deprecated github.com/docker/docker/pkg/loopback package. moby/moby#47128

breakingpkg/system: remove deprecated ErrNotSupportedOperatingSystem, IsOSSupported moby/moby#47129

breakingpkg/homedir: remove deprecated Key() and GetShortcutString() moby/moby#47130

breakingpkg/containerfs: remove deprecated ResolveScopedPath moby/moby#47131

breakingThe daemon flag --oom-score-adjust was deprecated in v24.0 and is now removed. moby/moby#46113

breakingRemove deprecated aliases from the api/types package. These types were deprecated in v25.0.0, which provided temporary aliases. moby/moby#47148 These aliases are now removed: types.Info, types.Commit, types.PluginsInfo, types.NetworkAddressPool, types.Runtime, types.SecurityOpt, types.KeyValue,…

breakingcli/command/container: remove deprecated NewStartOptions() docker/cli#4811

breakingcli/command: remove deprecated DockerCliOption, InitializeOpt docker/cli#4810

+11 more items in the release notes

25.0.18 Sep 30, 2026 Release notes ↗

othermoby/moby, 25.0.18 milestone

otherChanges to the Engine API, see API version history.

securityFix CVE-2026-17106: crafted tar archive can write outside the extraction directory. https://github.com/moby/moby/pull/53470

25.0.17 Aug 13, 2026 Release notes ↗

othermoby/moby, 25.0.17 milestone

otherChanges to the Engine API, see API version history.

securityFix CVE-2026-41568: symlink escape in mount destination creation. https://github.com/moby/moby/pull/52648

securityDecompress archives before entering container filesystem, fixing CVE-2026-41567. https://github.com/moby/moby/pull/52647

securityFix CVE-2026-42306: bind mount target redirection via symlink swap during docker cp. https://github.com/moby/moby/pull/52657

securityVendor github.com/containerd/containerd v1.7.33 to mitigate CVE-2024-40635. https://github.com/moby/moby/pull/49909

25.0.16 Aug 13, 2026 Release notes ↗

othermoby/moby, 25.0.16 milestone

otherChanges to the Engine API, see API version history.

fixcontainerd image store: Fix duplicate PUT requests when pushing a multi-platform image. https://github.com/moby/moby/pull/52169

fixBump dependencies to patch CVEs. https://github.com/moby/moby/pull/52301

fixReplace github.com/moby/buildkit with github.com/Mirantis/buildkit v0.12.6-m.1 to fix CVEs. https://github.com/moby/moby/pull/52470

25.0.15 Aug 13, 2026 Release notes ↗

othermoby/moby, 25.0.15 milestone

otherChanges to the Engine API, see API version history.

fixFix a regression where established network connections could be disrupted during a container's shutdown grace period. https://github.com/moby/moby/pull/51844

fixFix potential panic on docker network prune https://github.com/moby/moby/pull/51969

25.0.14 Aug 13, 2026 Release notes ↗

othermoby/moby, 25.0.14 milestone

otherChanges to the Engine API, see API version history.

fixDaemon: Added support for the DOCKER_DISABLE_WEAK_CIPHERS environment variable to restrict the Docker daemon to secure TLS cipher suites. https://github.com/moby/moby/pull/51084

fixUpdate Swarmkit internal TLS configuration to exclude known insecure cipher suites. https://github.com/moby/moby/pull/51129

25.0.13 Sep 4, 2025 Release notes ↗

othermoby/moby, 25.0.13 milestone

otherChanges to the Engine API, see API version history.

fixPrevent restoration of iptables rules for deleted networks and containers on firewalld reload. https://github.com/moby/moby/pull/50445

fixFix Swarm services becoming unreachable from published ports after a firewalld reload. https://github.com/moby/moby/pull/50445

fixImprove the reliability of the Swarm overlay network control plane by fixing longstanding issues with NetworkDB. https://github.com/moby/moby/pull/50511

fixImprove the reliability of Swarm overlay container networks by fixing longstanding issues with the overlay network driver. https://github.com/moby/moby/pull/50551

25.0.12 Jul 15, 2025 Release notes ↗

othermoby/moby, 25.0.12 milestone

otherChanges to the Engine API, see API version history.

fixFix an issue where all new tasks in the Swarm could get stuck in the PENDING state forever after scaling up a service with placement preferences. https://github.com/moby/moby/pull/50203

fixFix an issue which made DNS service discovery for Swarm services unreliable. https://github.com/moby/moby/pull/50230

otherUpdate Go toolchain to go1.23.9. https://github.com/moby/moby/pull/50053

25.0.11 Jun 18, 2025 Release notes ↗

othermoby/moby, 25.0.11 milestone

otherChanges to the Engine API, see API version history.

other[25.0] Backport network fixes

otherSome Swarm services are not discoverable over DNS https://github.com/moby/moby/issues/50129

25.0.10 May 15, 2025 Release notes ↗

othermoby/moby, 25.0.10 milestone

otherChanges to the Engine API, see API version history.

other[25.0] vendor: github.com/golang-jwt/jwt/v4 v4.5.2

other[25.0] Update remaining Ubuntu 20.04 GHA uses to 22.04 and 24.04 #49775

other[25.0]Bump golang 1.23

other[25.0] Dockerfile: update containerd binary to v1.7.27

25.0.9 May 15, 2025 Release notes ↗

othermoby/moby, 25.0.9 milestone

otherChanges to the Engine API, see API version history.

other[25.0 backport] ci: update bake-action to v6

other[25.0 backport] ci: switch from jenkins to gha for arm64 build and tests (and set correct go version for branch)

security[25.0 backport] update to go1.22.11 (fix CVE-2024-45341, CVE-2024-45336)

other[25.0 backport] update to go1.22.12

other[25.0 backport] Dockerfile: update runc binary to v1.2.5

25.0.8 Feb 3, 2025 Release notes ↗

otherdocker/cli, 25.0.8 milestone

othermoby/moby, 25.0.8 milestone

otherChanges to the Engine API, see API version history.

fix[25.0 backport] volume/mounts: fix anonymous volume not being labeled

fix[25.0 backport] daemon: use OwnCgroupPath in withCgroups

fix[25.0 backport] Jenkinsfile: modprobe br_netfilter

fix[25.0 backport] c8d/tag: Don't log a warning if the source image is not dangling

fix[25.0 backport] Dockerd rootless: make {/etc,/var/run}/cdi available

fix[25.0 backport] libnetwork/drivers/bridge: setupIPChains: fix defer checking wrong err

other[25.0 backport] vendor: github.com/golang-jwt/jwt/[email protected]

other[25.0 backport] update xx to v1.6.1 for compatibility with alpine 3.21

other[25.0 backport] Dockerfile: update containerd to v1.7.25

other[25.0 backport] Dockerfile: update runc binary to v1.2.4

other[25.0 backport] update to go1.22.10

25.0.7 Dec 5, 2024 Release notes ↗

othermoby/moby, 25.0.7 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

fix[25.0 backport] api: adjust health start interval on swarm update

fix[25.0 backport] Move dockerd man page back from docker/cli

fix[25.0 backport] seccomp: add riscv64 mapping to seccomp_linux.go

fix[25.0 backport] Explicitly disable nvidia device injection for --gpus=0

fix[25.0 backport] man: dockerd: add description for --log-format option

fix[25.0 backport] cmd/dockerd: Add workaround for OTEL meter leak

fix[25.0 backport] Fix: setup user chains during libnetwork controller initialization

other[25.0 backport] bump containerd v1.7.22

other[25.0 backport] update to go1.22.8

25.0.6 Jul 25, 2024 Release notes ↗

otherdocker/cli, 25.0.6 milestone

othermoby/moby, 25.0.6 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

securityThis release contains a fix for [CVE-2024-41110] / GHSA-v23v-6jw2-98fq that impacted setups using authorization plugins (AuthZ) for access control.

fix[25.0] remove erroneous platform from image config OCI descriptor in docker save output. moby/moby#47695

fix[25.0 backport] Fix a nil dereference when getting image history for images having layers without the Created value set. moby/moby#47759

fix[25.0 backport] apparmor: Allow confined runc to kill containers. moby/moby#47830

fix[25.0 backport] Fix an issue where rapidly promoting a Swarm node after another node was demoted could cause the promoted node to fail its promotion. moby/moby#47869

fix[25.0 backport] don't depend on containerd platform.Parse to return a typed error. moby/moby#47890

fix[25.0 backport] builder/mobyexporter: Add missing nil check moby/moby#47987

otherUpdate AWS SDK Go v2 to v1.24.1 for AWS CloudWatch logging driver. moby/moby#47724

securityUpdate Go runtime to 1.21.12, which contains security fixes for CVE-2024-24791 moby/moby#48146

otherUpdate Containerd (static binaries only) to v1.7.20. moby/moby#48199

25.0.5 Mar 19, 2024 Release notes ↗

otherdocker/cli, 25.0.5 milestone

othermoby/moby, 25.0.5 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

securityThis release contains a security fix for [CVE-2024-29018], a potential data exfiltration from 'internal' networks via authoritative DNS servers.

fixplugin: fix mounting /etc/hosts when running in UserNS. moby/moby#47588

fixrootless: fix open /etc/docker/plugins: permission denied. moby/moby#47587

securityFix multiple parallel docker build runs leaking disk space. moby/moby#47527 [CVE-2024-29018]: https://github.com/moby/moby/security/advisories/GHSA-mq39-4gv4-mvpx

25.0.4 Mar 7, 2024 Release notes ↗

otherdocker/cli, 25.0.4 milestone

othermoby/moby, 25.0.4 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

fixRestore DNS names for containers in the default "nat" network on Windows. moby/moby#47490

fixFix docker start failing when used with --checkpoint moby/moby#47466

fixDon't enforce new validation rules for existing swarm networks moby/moby#47482

fixRestore IP connectivity between the host and containers on an internal bridge network. moby/moby#47481

fixFix a regression introduced in v25.0 that prevented the classic builder from ADDing a tar archive with xattrs created on a non-Linux OS moby/moby#47483

fixcontainerd image store: Fix image pull not emitting Pulling fs layer status moby/moby#47484

otherTo preserve backwards compatibility, make read-only mounts not recursive by default when using older clients (API version < v1.44). moby/moby#47393

otherGET /images/{id}/json omits the Created field (previously it was 0001-01-01T00:00:00Z) if the Created field is missing from the image config. moby/moby#47451

otherPopulate a missing Created field in GET /images/{id}/json with 0001-01-01T00:00:00Z for API version <= 1.43. moby/moby#47387

fixFix a regression that caused API socket connection failures to report an API version negotiation failure instead. moby/moby#47470

otherPreserve supplied endpoint configuration in a container-create API request, when a container-wide MAC address is specified, but NetworkMode name-or-id is not the same as the name-or-id used in NetworkSettings.Networks. moby/moby#47510

otherUpgrade Go runtime to 1.21.8. moby/moby#47503

otherUpgrade RootlessKit to v2.0.2. moby/moby#47508

otherUpgrade Compose to v2.24.7. https://github.com/docker/docker-ce-packaging/pull/998

otherUpgrade Buildx to v0.13.0. https://github.com/docker/docker-ce-packaging/pull/997

25.0.3 Feb 7, 2024 Release notes ↗

otherdocker/cli, 25.0.3 milestone

othermoby/moby, 25.0.3 milestone

fixcontainerd image store: Fix a bug where docker image history would fail if a manifest wasn't found in the content store. moby/moby#47348

fixEnsure that a generated MAC address is not restored when a container is restarted, but a configured MAC address is preserved. moby/moby#47304 > Note > > - Containers created with Docker Engine version 25.0.0 may have duplicate MAC addresses. > They must be re-created. > - Containers with…

fixFix docker save @ producing an OCI archive with index without manifests. moby/moby#47294

fixFix a bug preventing bridge networks from being created with an MTU higher than 1500 on RHEL and CentOS 7. moby/moby#47308, moby/moby#47311

fixFix a bug where containers are unable to communicate over an internal network. moby/moby#47303

fixFix a bug where the value of the ipv6 daemon option was ignored. moby/moby#47310

fixFix a bug where trying to install a pulling using a digest revision would cause a panic. moby/moby#47323

fixFix a potential race condition in the managed containerd supervisor. moby/moby#47313

fixFix an issue with the journald log driver preventing container logs from being followed correctly with systemd version 255. moby/moby47243

fixseccomp: Update the builtin seccomp profile to include syscalls added in kernel v5.17 - v6.7 to align the profile with the profile used by containerd. moby/moby#47341

fixWindows: Fix cache not being used when building images based on Windows versions older than the host's version. moby/moby#47307, moby/moby#47337

breakingRemoved support for Ubuntu Lunar (23.04). docker/ce-packaging#986

25.0.2 Feb 1, 2024 Release notes ↗

otherdocker/cli, 25.0.2 milestone

othermoby/moby, 25.0.2 milestone

securityUnauthorized access to the host filesystem

securityCompromising the integrity of the build cache

securityIn the case of CVE-2024-21626, a scenario that could lead to full container escape

securityCVE-2024-21626

securityCVE-2024-23651

securityCVE-2024-23652

securityCVE-2024-23653

securityCVE-2024-23650

securityCVE-2024-24557

otherUpgrade containerd to v1.6.28.

otherUpgrade containerd to v1.7.13 (static binaries only). moby/moby#47280

otherUpgrade runc to v1.1.12. moby/moby#47269

otherUpgrade Compose to v2.24.5. docker/docker-ce-packaging#985

otherUpgrade BuildKit to v0.12.5. moby/moby#47273

25.0.1 Jan 24, 2024 Release notes ↗

otherdocker/cli, 25.0.1 milestone

othermoby/moby, 25.0.1 milestone

fixAPI: Fix incorrect HTTP status code for containers with an invalid network configuration created before upgrading to Docker Engine v25.0. moby/moby#47159

fixEnsure that a MAC address based on a container's IP address is re-generated when the container is stopped and restarted, in case the generated IP/MAC addresses have been reused. moby/moby#47171

fixFix host-gateway-ip not working during build when not set through configuration. moby/moby#47192

fixFix a bug that prevented a container from being renamed twice. moby/moby#47196

fixFix an issue causing containers to have their short ID added to their network alias when inspecting them. moby/moby#47182

fixFix an issue in detecting whether a remote build context is a Git repository. moby/moby#47136

fixFix an issue with layers order in OCI manifests. moby/moby#47150

fixFix volume mount error when passing an addr or ip mount option. moby/moby#47185

fixImprove error message related to extended attributes that can't be set due to improperly namespaced attribute names. moby/moby#47178

fixSwarm: Fixed start_interval not being passed to the container config. moby/moby#47163

otherUpgrade Compose to 2.24.2. docker/docker-ce-packaging#981

25.0.0 Jan 19, 2024 Release notes ↗

deprecatedDeprecated and removed features, see Deprecated Features.

featureAdd OpenTelemetry tracing. moby/moby#45652, moby/moby#45579

featureAdd support for CDI devices under Linux. moby/moby#45134, docker/cli#4510, moby/moby#46004

featureAdd an additional interval to be used by healthchecks during the container start period. moby/moby#40894, docker/cli#4405, moby/moby#45965

featureAdd a --log-format flag to dockerd to control the logging format: text (default) or JSON. moby/moby#45737

featureAdd support for recursive read-only mounts. moby/moby#45278, moby/moby#46037

featureAdd support for filtering images based on timestamp with docker image ls --filter=until=. moby/moby#46577

fixAPI: Fix error message for invalid policies at ValidateRestartPolicy. moby/moby#46352

fixAPI: Update /info endpoint to use singleflight. moby/moby#45847

fixAdd an error message for when specifying a Dockerfile filename with -f, and also using stdin. docker/cli#4346

fixAdd support for mac-address and link-local-ip fields in --network long format. docker/cli#4419

fixAdd support for specifying multiple --network flags with docker container create and docker run. moby/moby#45906

fixAutomatically enable IPv6 on a network when an IPv6 subnet is specified. moby/moby#46455

fixAdd support for overlay networks over IPv6 transport. moby/moby#46790

fixConfiguration reloading is now more robust: if there's an error during the configuration reload process, no configuration changes are applied. moby/moby#43980

fixLive restore: Containers with auto remove (docker run --rm) are no longer forcibly removed on engine restart. moby/moby#46857

fixLive restore: containers that are live-restored will now be given another health-check start period when the daemon restarts. moby/moby#47051

fixContainer health status is flushed to disk less frequently, reducing wear on flash storage. moby/moby#47044

fixEnsure network names are unique. moby/moby#46251

fixEnsure that overlay2 layer metadata is correct. moby/moby#46471

fixFix Downloading progress message on image pull. moby/moby#46515

fixFix NetworkConnect and ContainerCreate with improved data validation, and return all validation errors at once. moby/moby#46183

fixFix com.docker.network.host_ipv4 option when IPv6 and ip6tables are enabled. moby/moby#46446

fixFix daemon's cleanupContainer if containerd is stopped. moby/moby#46213

fixFix returning incorrect HTTP status codes for libnetwork errors. moby/moby#46146

fixFix various issues with images/json API filters and image list. moby/moby#46034

fixCIFS volumes now resolves FQDN correctly. moby/moby#46863

fixImprove validation of the userland-proxy-path daemon configuration option. Validation now happens during daemon startup, instead of producing an error when starting a container with port-mapping. moby/moby#47000

fixSet the MAC address of container's interface when network mode is a short network ID. moby/moby#46406

fixSort unconsumed build arguments before display in build output. moby/moby#45917

breakingAPI: Remove VirtualSize field for the GET /images/json and GET /images/{id}/json endpoints. moby/moby#45469

breakingRemove deprecated devicemapper storage driver. moby/moby#43637

breakingRemove deprecated orchestrator options. docker/cli#4366

breakingRemove support for Debian Upstart init system. moby/moby#45548, moby/moby#45551

breakingRemove the --oom-score-adjust daemon option. moby/moby#45484

breakingRemove warning for deprecated ~/.dockercfg file. docker/cli#4281

breakingRemove logentries logging driver. moby/moby#46925

deprecatedDeprecate API versions older than 1.24. Deprecation notice

deprecatedDeprecate IsAutomated field and is-automated filter for docker search. Deprecation notice

deprecatedAPI: Deprecate Container and ContainerConfig properties for /images/{id}/json (docker image inspect). moby/moby#46939

+35 more items in the release notes

24.0.9 Feb 1, 2024 Release notes ↗

otherdocker/cli, 24.0.9 milestone

othermoby/moby, 24.0.9 milestone

securityCVE-2024-23651

securityCVE-2024-23652

securityCVE-2024-23653

securityCVE-2024-23650

securityCVE-2024-21626

securityCVE-2024-24557

securityUpgrade runc to v1.1.12. moby/moby#47269

securityUpgrade containerd to v1.7.13 (static binaries only). moby/moby#47280

24.0.8 Jan 25, 2024 Release notes ↗

otherdocker/cli, 24.0.8 milestone

othermoby/moby, 24.0.8 milestone

fixLive restore: Containers with auto remove (docker run --rm) are no longer forcibly removed on engine restart. moby/moby#46857

otherUpgrade Go to go1.20.13. moby/moby#47054, docker/cli#4826, docker/docker-ce-packaging#975

otherUpgrade containerd (static binaries only) to v1.7.12 moby/moby#47096

otherUpgrade runc to v1.1.11. moby/moby#47010

24.0.7 Oct 27, 2023 Release notes ↗

otherdocker/cli, 24.0.7 milestone

othermoby/moby, 24.0.7 milestone

fixWrite overlay2 layer metadata atomically. moby/moby#46703

fixFix "Rootful-in-Rootless" Docker-in-Docker on systemd version 250 and later. moby/moby#46626

fixFix dockerd-rootless-setuptools.sh when username contains a backslash. moby/moby#46407

fixFix a bug that would prevent network sandboxes to be fully deleted when stopping containers with no network attachments and when dockerd --bridge=none is used. moby/moby#46702

fixFix a bug where cancelling an API request could interrupt container restart. moby/moby#46697

fixFix an issue where containers would fail to start when providing --ip-range with a range larger than the subnet. docker/for-mac#6870

fixFix data corruption with zstd output. moby/moby#46709

fixFix the conditions under which the container's MAC address is applied. moby/moby#46478

fixImprove the performance of the stats collector. moby/moby#46448

fixFix an issue with source policy rules ending up in the wrong order. moby/moby#46441

featureAdd support for Fedora 39 and Ubuntu 23.10. docker/docker-ce-packaging#940, docker/docker-ce-packaging#955

fixFix docker.socket not getting disabled when uninstalling the docker-ce RPM package. docker/docker-ce-packaging#852

otherUpgrade Go to go1.20.10. docker/docker-ce-packaging#951

otherUpgrade containerd to v1.7.6 (static binaries only). moby/moby#46103

otherUpgrade the containerd.io package to v1.6.24.

securityDeny containers access to /sys/devices/virtual/powercap by default. This change hardens against CVE-2020-8694, CVE-2020-8695, and CVE-2020-12912, and an attack known as the PLATYPUS attack. For more details, see advisory, commit.

24.0.6 Sep 5, 2023 Release notes ↗

otherdocker/cli, 24.0.6 milestone

othermoby/moby, 24.0.6 milestone

fixcontainerd storage backend: Fix docker ps failing when a container image is no longer present in the content store. moby/moby#46095

fixcontainerd storage backend: Fix docker ps -s -a and docker container prune failing when a container image config is no longer present in the content store. moby/moby#46097

fixcontainerd storage backend: Fix docker inspect failing when a container image config is no longer (or was never) present in the content store. moby/moby#46244

fixcontainerd storage backend: Fix diff and export with the overlayfs snapshotter by using reference-counted rootfs mounts. moby/moby#46266

fixcontainerd storage backend: Fix a misleading error message when the image platforms available locally do not match the desired platform. moby/moby#46300

fixcontainerd storage backend: Fix the FROM scratch Dockerfile instruction with the classic builder. moby/moby#46302

fixcontainerd storage backend: Fix mismatched image rootfs and manifest layers errors with the classic builder. moby/moby#46310

fixWarn when pulling Docker Image Format v1, and Docker Image manifest version 2, schema 1 images from all registries. moby/moby#46290

fixFix live-restore of volumes with custom volume options. moby/moby#46366

fixFix incorrectly dropping capabilities bits when running a container as a non-root user (note: this change was already effectively present due to a regression). moby/moby#46221

fixFix network isolation iptables rules preventing IPv6 Neighbor Solicitation packets from being exchanged between containers. moby/moby#46214

fixFix dockerd.exe --register-service not working when the binary is in the current directory on Windows. moby/moby#46215

fixAdd a hint suggesting the use of a PAT to docker login against Docker Hub. docker/cli#4500

fixImprove shell startup time for users of Bash completion for the CLI. docker/cli#4517

fixImprove the speed of some commands by skipping GET /_ping when possible. docker/cli#4508

fixFix credential scopes when using a PAT to docker manifest inspect an image on Docker Hub. docker/cli#4512

fixFix docker events not supporting --format=json. docker/cli#4544

otherUpgrade Go to go1.20.7. moby/moby#46140, docker/cli#4476, docker/docker-ce-packaging#932

otherUpgrade containerd to v1.7.3 (static binaries only). moby/moby#46103

otherUpgrade Compose to v2.21.0. docker/docker-ce-packaging#936

24.0.5 Jul 24, 2023 Release notes ↗

otherdocker/cli, 24.0.5 milestone

othermoby/moby, 24.0.5 milestone

fixThe Go client now avoids using UNIX socket paths in the HTTP Host: header, in order to be compatible with changes introduced in go1.20.6. moby/moby#45962, moby/moby#45990

fixcontainerd storage backend: Fix Variant not being included in docker image inspect and GET /images/{name}/json. moby/moby#46025

fixcontainerd storage backend: Prevent potential garbage collection of content during image export. moby/moby#46021

fixcontainerd storage backend: Prevent duplicate digest entries in RepoDigests. moby/moby#46014

fixcontainerd storage backend: Fix operations taking place against the incorrect tag when working with an image referenced by tag and digest. moby/moby#46013

fixcontainerd storage backend: Fix a panic caused by EXPOSE when building containers with the legacy builder. moby/moby#45921

fixFix a regression causing unintuitive errors to be returned when attempting to create an overlay network on a non-Swarm node. moby/moby#45974

fixProperly report errors parsing volume specifications from the command line. docker/cli#4423

fixFix a panic caused when auths: null is found in the CLI config file. docker/cli#4450

otherUse init scripts as provided by moby/moby contrib/init. docker/docker-ce-packaging#914, docker/docker-ce-packaging#926

otherDrop Upstart from contrib/init. moby/moby#46044

otherUpgrade Go to go1.20.6. docker/cli#4428, moby/moby#45970, docker/docker-ce-packaging#921

otherUpgrade Compose to v2.20.2. docker/docker-ce-packaging#924

otherUpgrade buildx to v0.11.2. docker/docker-ce-packaging#922

24.0.4 Jul 7, 2023 Release notes ↗

otherdocker/cli, 24.0.4 milestone

othermoby/moby, 24.0.4 milestone

fixFix a regression introduced during 24.0.3 that causes a panic during live-restore of containers with bind mounts. moby/moby#45903

24.0.3 Jul 6, 2023 Release notes ↗

otherdocker/cli, 24.0.3 milestone

othermoby/moby, 24.0.3 milestone

fixcontainerd image store: Fix an issue where multi-platform images that did not include a manifest for the default platform could not be interacted with. moby/moby#45849

fixcontainerd image store: Fix specious attempts to cache FROM scratch in container builds. moby/moby#45822

fixcontainerd image store: Fix docker cp with snapshotters that cannot mount the same content multiple times. moby/moby#45780, moby/moby#45786

fixcontainerd image store: Fix builds with type=image not being correctly unpacked/stored. moby/moby#45692

fixcontainerd image store: Fix incorrectly attempting to unpack pseudo-images (including attestations) in docker load. moby/moby#45688

fixcontainerd image store: Correctly set the user agent, and include additional information like the snapshotter when interacting with registries. moby/moby#45671, moby/moby#45684

fixcontainerd image store: Fix a failure to unpack already-pulled content after switching between snapshotters. moby/moby#45678

fixcontainerd image store: Fix images that have been re-tagged or with all tags removed being pruned while still in use. moby/moby#45857

fixFix a Swarm CSI issue where the Topology field was not propagated into NodeCSIInfo. moby/moby#45810

fixFix failures to add new Swarm managers caused by a very large raft log. moby/moby#45703, moby/swarmkit#3122, moby/swarmkit#3128

fixname_to_handle_at(2) is now always allowed in the default seccomp profile. moby/moby#45833

fixFix an issue that prevented encrypted Swarm overlay networks from working on ports other than the default (4789). moby/moby#45637

fixFix a failure to restore mount reference-counts during live-restore. moby/moby#45824

fixFix various networking-related failures during live-restore. moby/moby#45658, moby/moby#45659

fixFix running containers restoring with a zero (successful) exit status when the daemon is unexpectedly terminated. moby/moby#45801

fixFix a potential panic while executing healthcheck probes. moby/moby#45798

fixFix a panic caused by a race condition in container exec start. moby/moby#45794

fixFix an exception caused by attaching a terminal to an exec with a non-existant command. moby/moby#45643

fixFix host-gateway with BuildKit by passing the IP as a label (also requires docker/buildx#1894). moby/moby#45790

fixFix an issue where POST /containers/{id}/stop would forcefully terminate the container when the request was canceled, instead of waiting until the specified timeout for a 'graceful' stop. moby/moby#45774

fixFix an issue where docker cp -a from the root (/) directory would fail. moby/moby#45748

fixImprove compatibility with non-runc container runtimes by more correctly setting resource constraint parameters in the OCI config. moby/moby#45746

fixFix an issue caused by overlapping subuid/subgid ranges in certain configurations (e.g. LDAP) in rootless mode. moby/moby#45747, rootless-containers/rootlesskit#369

fixGreatly reduce CPU and memory usage while populating the Debug section of GET /info. moby/moby#45856

fixFix an issue where debug information was not correctly printed during docker info when only the client is in debug mode. docker/cli#4393

fixFix issues related to hung connections when connecting to hosts over a SSH connection. docker/cli#4395

otherUpgrade Go to go1.20.5. moby/moby#45745, docker/cli#4351, docker/docker-ce-packaging#904

otherUpgrade Compose to v2.19.1. docker/docker-ce-packaging#916

otherUpgrade buildx to v0.11.1. docker/docker-ce-packaging#918

24.0.2 May 26, 2023 Release notes ↗

otherdocker/cli, 24.0.2 milestone

othermoby/moby, 24.0.2 milestone

fixFix a panic during build when referencing locally tagged images. moby/buildkit#3899, moby/moby#45582

fixFix builds potentially failing with exit code: 4294967295 when performing many concurrent build stages. moby/moby#45620

fixFix DNS resolution on Windows ignoring etc/hosts (%WINDIR%\System32\Drivers\etc\hosts), including resolution of localhost. moby/moby#45562

fixApply a workaround for a containerd bug that causes concurrent docker exec commands to take significantly longer than expected. moby/moby#45625

fixcontainerd image store: Fix an issue where the image Created field would contain an incorrect value. moby/moby#45623

fixcontainerd image store: Adjust the output of image pull progress so that the output has the same format regardless of whether the containerd image store is enabled. moby/moby#45602

fixcontainerd image store: Switching between the default and containerd image store now requires a daemon restart. moby/moby#45616

24.0.1 May 19, 2023 Release notes ↗

otherdocker/cli, 24.0.1 milestone

othermoby/moby, 24.0.1 milestone

breakingRemove CLI completions for storage drivers removed in the 24.0 major release. docker/cli#4302

fixFix an issue where DNS query NXDOMAIN replies from external servers were forwarded to the client as SERVFAIL. moby/moby#45573

fixFix an issue where docker pull --platform would report No such image regarding another tag pointing to the same image. moby/moby#45562

fixFix an issue where insecure registry configuration would be forgotten during config reload. moby/moby#45571

fixcontainerd image store: Fix an issue where images which have no layers would not be listed in docker images -a moby/moby#45588

fixAPI: Fix an issue where GET /images/{id}/json would return null instead of empty RepoTags and RepoDigests. moby/moby#45564

fixAPI: Fix an issue where POST /commit did not accept an empty request body. moby/moby#45568

otherUpgrade Compose to v2.18.1. docker/docker-ce-packaging#896

24.0.0 May 16, 2023 Release notes ↗

otherdocker/cli, 24.0.0 milestone

othermoby/moby, 24.0.0 milestone

featureIntroduce experimental support for containerd as the content store (replacing the existing storage drivers). moby/moby#43735, other moby/moby pull requests

featureThe --host CLI flag now supports a path component in a ssh:// host address, allowing use of an alternate socket path without configuration on the remote host. docker/cli#4073

featureThe docker info CLI command now reports a version and platform field. docker/cli#4180

featureIntroduce the daemon flag --default-network-opt to configure options for newly created networks. moby/moby#43197

featureRestrict access to AF_VSOCK in the socket(2) family of syscalls in the default seccomp profile. moby/moby#44562

featureIntroduce support for setting OCI runtime annotations on containers. docker/cli#45025, moby/moby#45025

featureAlternative runtimes can now be configured in daemon.json, enabling runtime names to be aliased and options to be passed. moby/moby#45032

featureThe docker-init binary will now be discovered in FHS-compliant libexec directories, in addition to the PATH. moby/moby#45198

featureAPI: Surface the daemon-level --no-new-privileges in GET /info. moby/moby#45320

breakingdocker info no longer reports IndexServiceAddress. docker/cli#4204

breakinglibnetwork: Remove fallback code for obsolete kernel versions. moby/moby#44684, moby/moby#44802

breakinglibnetwork: Remove unused code related to classic Swarm. moby/moby#44965

breakinglibnetwork: Remove usage of the xt_u32 kernel module from encrypted Swarm overlay networks. moby/moby#45281

breakingRemove support for buildkit's deprecated buildinfo in favor of standard provenance attestations. moby/moby#45097

breakingRemove the deprecated AUFS and legacy overlay storage drivers. moby/moby#45342, moby/moby#45359

breakingRemove the deprecated overlay2.override_kernel_check storage driver option. moby/moby#45368

breakingRemove workarounds for obsolete versions of apparmor_parser from the AppArmor profiles. moby/moby#45500

breakingAPI: GET /images/json no longer represents empty RepoTags and RepoDigests as:/@. Empty arrays are be returned instead on API >= 1.43. moby/moby#45068

deprecatedDeprecate the --oom-score-adjust daemon option. moby/moby#45315

deprecatedAPI: Deprecate the VirtualSize field in GET /images/json and GET /images/{id}/json. moby/moby#45346

fixThe docker stack command no longer validates the build section of Compose files. docker/cli#4214

fixFix lingering healthcheck processes after timeout is reached. moby/moby#43739

fixReduce the overhead of container startup when using the overlay2 storage driver. moby/moby#44285

fixAPI: Handle multiple before= and since= filters in GET /images. moby/moby#44503

fixFix numerous bugs in the embedded DNS resolver implementation used by user-defined networks. moby/moby#44664

fixAdd execDuration field to the map of event attributes. moby/moby#45494

fixSwarm-level networks can now be created with the Windows internal, l2bridge, and nat drivers. moby/swarmkit#3121, moby/moby#45291

otherUpdate Go to 1.20.4. docker/cli#4253, moby/moby#45456

otherUpdate containerd to v1.7.1. moby/moby#45537

otherUpdate buildkit to v0.11.6. moby/moby#45367

23.0.18 May 15, 2025 Release notes ↗

othermoby/moby, 23.0.18 milestone

other[23.0] Update GHA, Containerd, CI image, and Golang to the actual status

23.0.17 May 15, 2025 Release notes ↗

othermoby/moby, 23.0.17 milestone

other[23.0 backport] Jenkinsfile: modprobe br_netfilter

other[23.0 backport] update xx to v1.6.1 for compatibility with alpine 3.21

other[23.0 backport] update actions

23.0.16 Dec 5, 2024 Release notes ↗

othermoby/moby, 23.0.16 milestone

23.0.15 Oct 7, 2024 Release notes ↗

othermoby/moby, 23.0.15 milestone

23.0.14 Aug 19, 2024 Release notes ↗

othermoby/moby, 23.0.14 milestone

23.0.13 Jun 20, 2024 Release notes ↗

othermoby/moby, 23.0.13 milestone

23.0.12 May 29, 2024 Release notes ↗

othermoby/moby, 23.0.12 milestone

23.0.11 May 6, 2024 Release notes ↗

securityFixes CVE-2024-29018: External DNS requests from 'internal' networks could lead to data exfiltration

othermoby/moby, 23.0.11 milestone

23.0.10 Mar 21, 2024 Release notes ↗

securityFixes CVE-2024-24557: Classic builder cache poisoning

otherdocker/cli, 23.0.10 milestone

othermoby/moby, 23.0.10 milestone

23.0.9 Jan 31, 2024 Release notes ↗

otherdocker/cli, 23.0.9 milestone

othermoby/moby, 23.0.9 milestone

23.0.8 Dec 1, 2023 Release notes ↗

otherdocker/cli, 23.0.8 milestone

othermoby/moby, 23.0.8 milestone

fixMake one-shot stats faster. https://github.com/moby/moby/pull/46617

fixFix "Rootful-in-Rootless" Docker-in-Docker on systemd >= 250. https://github.com/moby/moby/pull/46627

fixAdd IP_NF_MANGLE to the "generally required" list in check-config.sh because it is required by Swarm. https://github.com/moby/moby/pull/46675

fixWrite overlay2 layer metadata atomically. https://github.com/moby/moby/pull/46704

fixUpdate github.com/klauspost/compress to v1.17.2 to fix data corruption with zstd output in "best". https://github.com/moby/moby/pull/46710

otherUpdate Go to 1.20.10. https://github.com/moby/moby/pull/46625

otherUpdate golang.org/x/net to v0.17.0. https://github.com/moby/moby/pull/46691

23.0.7 Sep 27, 2023 Release notes ↗

otherdocker/cli, 23.0.7 milestone

othermoby/moby, 23.0.7 milestone

fixFix reloading the insecure-registries daemon configuration. https://github.com/moby/moby/pull/45572

fixAllow empty body for POST /commit again. https://github.com/moby/moby/pull/45569

fixFix an issue which prevented encrypted overlay networks from functioning when the Swarm data path port is not set to 4789. https://github.com/moby/moby/pull/45638

fixFix an issue with graceful container shutdown. https://github.com/moby/moby/pull/45775

fixFix host-gateway support in docker build. https://github.com/moby/moby/pull/45791

fixFix missing Topology in Swarm cluster volume NodeCSIInfo. https://github.com/moby/moby/pull/45809

fixseccomp: always allow name_to_handle_at(2). https://github.com/moby/moby/pull/45834

fixFix an issue which prevented volumes mounted to a live-restored container from being removed. https://github.com/moby/moby/pull/45825

fixclient: resolve an incompatibility with Go 1.20.6, Go 1.20.7, Go 1.19.11 and Go 1.19.12. https://github.com/moby/moby/pull/45971

fixFix an issue which prevented process capabilities from being retained when starting a container as a non-root user with --security-opt=no-new-privileges. https://github.com/moby/moby/pull/46222

fixFixed a bug which caused named volumes that set custom device or type volume option to be unmounted when restarting the daemon and not live-restoring it properly. https://github.com/moby/moby/pull/46367

fixwindows: fix --register-service when executed from within binary directory. https://github.com/moby/moby/pull/46216

fixFix dockerd-rootless-setuptools.sh when user name contains a backslash. https://github.com/moby/moby/pull/46408

otherUpdate Go to 1.20.7. https://github.com/moby/moby/pull/46141

otherUpdate containerd to v1.6.22. https://github.com/moby/moby/pull/46104

otherUpdate runc to v1.1.9. https://github.com/moby/moby/pull/46229

otherDelete Upstart init scripts and clean up sysvinit. https://github.com/moby/moby/pull/46046

23.0.6 May 8, 2023 Release notes ↗

otherdocker/cli, 23.0.6 milestone

othermoby/moby, 23.0.6 milestone

fixFix vfs storage driver not working on NFS. moby/moby#45465

otherUpgrade Go to 1.19.9. docker/docker-ce-packaging#889, docker/cli#4254, moby/moby#45455

otherUpgrade containerd to v1.6.21

otherUpgrade runc to v1.1.7

23.0.5 Apr 26, 2023 Release notes ↗

otherdocker/cli, 23.0.5 milestone

othermoby/moby, 23.0.5 milestone

fixAdd the --all / -a option when pruning volumes. docker/cli#4229

fixAdd --format=json for docker info. docker/cli#4320

fixFix log loss with the AWSLogs log driver. moby/moby#45350

fixFix a regression introduced in v23.0.4 where dockerd would refuse to start if the fixed-cidr config parameter is provided but not bip. moby/moby#45403

fixFix a panic in libnetwork during daemon start moby/moby#45376

fixFix "tag" event not being sent when an image is built with buildx. moby/moby#45410

otherUpgrade Compose to 2.17.3. docker/docker-ce-packaging#883

23.0.4 Apr 17, 2023 Release notes ↗

otherdocker/cli, 23.0.4 milestone

othermoby/moby, 23.0.4 milestone

fixFix a performance regression in Docker CLI 23.0.0 docker/cli#4141.

fixFix progress indicator on docker cp not functioning as intended docker/cli#4157.

fixFix shell completion for docker compose --file docker/cli#4177.

fixFix an error caused by incorrect handling of "default-address-pools" in daemon.json moby/moby#45246.

fixFix missing packages for CentOS 9 Stream.

securityUpgrade Go to 1.19.8. docker/docker-ce-packaging#878, docker/cli#4164, moby/moby#45277, which contains fixes for CVE-2023-24537, CVE-2023-24538, CVE-2023-24534, and CVE-2023-24536

23.0.3 Apr 5, 2023 Release notes ↗

securityFixed a number of issues that can cause Swarm encrypted overlay networks to fail to uphold their guarantees, addressing CVE-2023-28841, CVE-2023-28840, and CVE-2023-28842.

fixA lack of kernel support for encrypted overlay networks now reports as an error.

fixEncrypted overlay networks are eagerly set up, rather than waiting for multiple nodes to attach.

fixEncrypted overlay networks are now usable on Red Hat Enterprise Linux 9 through the use of the xt_bpf kernel module.

securityUsers of Swarm overlay networks should review GHSA-vwm3-crmr-xfxw to ensure that unintentional exposure has not occurred.

otherUpdate containerd to v1.6.20.

otherUpdate runc to v1.1.5.

23.0.2 Mar 28, 2023 Release notes ↗

otherdocker/cli, 23.0.2 milestone

othermoby/moby, 23.0.2 milestone

fixFully resolve missing checks for apparmor_parser when an AppArmor enabled kernel is detected. containerd/containerd#8087, moby/moby#45043

securityEnsure that credentials are redacted from Git URLs when generating BuildKit buildinfo. Fixes CVE-2023-26054. moby/moby#45110

fixFix anonymous volumes created by a VOLUME line in a Dockerfile being excluded from volume prune. moby/moby#45159

fixFix a failure to properly propagate errors during removal of volumes on a Swarm node. moby/moby#45155

fixTemporarily work around a bug in BuildKit COPY --link by disabling mergeop/diffop optimization. moby/moby#45112

fixProperly clean up child tasks when a parent Swarm job is removed. moby/swarmkit#3112, moby/moby#45107

fixFix Swarm service creation logic so that both a GenericResource and a non-default network can be used together. moby/swarmkit#3082, moby/moby#45107

fixFix Swarm CSI support requiring the CSI plugin to offer staging endpoints in order to publish a volume. moby/swarmkit#3116, moby/moby#45107

fixFix a panic caused by log buffering in some configurations. containerd/fifo#47, moby/moby#45051

fixLog errors in the REST to Swarm gRPC API translation layer at the debug level to reduce redundancy and noise. moby/moby#45016

fixFix a DNS resolution issue affecting containers created with --dns-opt or --dns-search when systemd-resolved is used outside the container. moby/moby#45000

fixFix a panic when logging errors in handling DNS queries originating from inside a container. moby/moby#44980

fixImprove the speed of docker ps by allowing users to opt out of size calculations with --size=false. docker/cli#4107

fixExtend support for Bash completion to all plugins. docker/cli#4092

fixFix docker stack deploy failing on Windows when special environment variables set by cmd.exe are present. docker/cli#4083

fixAdd forward compatibility for future API versions by considering empty image tags to be the same as . docker/cli#4065

fixAtomically write context files to greatly reduce the probability of corruption, and improve the error message for a corrupt context. docker/cli#4063

otherUpgrade Go to 1.19.7. docker/docker-ce-packaging#857, docker/cli#4086, moby/moby#45137

otherUpgrade containerd to v1.6.19. moby/moby#45084, moby/moby#45099

otherUpgrade Buildx to v0.10.4. docker/docker-ce-packaging#855

otherUpgrade Compose to v2.17.2. docker/docker-ce-packaging#867

23.0.1 Feb 10, 2023 Release notes ↗

otherdocker/cli, 23.0.1 milestone

othermoby/moby, 23.0.1 milestone

fixFix containers not starting if the kernel has AppArmor enabled, but apparmor_parser is not available. moby/moby#44942

fixFix BuildKit-enabled builds with inline caching causing the daemon to crash. moby/moby#44944

fixFix BuildKit improperly loading cached layers created by previous versions. moby/moby#44959

fixFix an issue where ipvlan networks created prior to upgrading would prevent the daemon from starting. moby/moby#44937

fixFix the overlay2 storage driver failing early in metacopy testing when initialized on an unsupported backing filesystem. moby/moby#44922

fixFix exec exit events being misinterpreted as container exits under some runtimes, such as Kata Containers. moby/moby#44892

fixImprove the error message returned by the CLI when recieving a truncated JSON response caused by the API hanging up mid-request. docker/cli#4004

fixFix an incorrect CLI exit code when attempting to execute a directory with a runc compiled using Go 1.20. docker/cli#4004

fixFix mishandling the size argument to --device-write-bps as a path. docker/cli#4004

featureAdd /etc/docker to RPM and DEB packaging. docker/docker-ce-packaging#842

otherNot all use cases will benefit; if you depend on this, you should explicitly mkdir -p /etc/docker.

otherUpgrade Compose to v2.16.0. docker/docker-ce-packaging#844

23.0.0 Feb 2, 2023 Release notes ↗

securityFixes CVE-2023-28840: Encrypted overlay network may be unauthenticated

securityFixes CVE-2023-28842: Encrypted overlay network with a single endpoint is unauthenticated

securityFixes CVE-2023-28841: Encrypted overlay network traffic may be unencrypted

deprecatedDeprecated and removed features, see Deprecated Engine Features.

breakingRemove support for reading configuration from ~/.dockercfg. docker/cli#2504

breakingThis location has been deprecated since 1.7.0.

breakingDeprecation notice

breakingRemove the -g and --graph daemon options in favor of --data-root. docker/cli#3739

breakingThese options have been hidden and deprecated since 17.05.

breakingRemove client-side sorting of results, in favor of the order in which the search API returns. docker/cli#3470

breakingRemove warnings related to deprecated storage drivers from the CLI. Warnings are now handled by the daemon instead. docker/cli#3542

breakingRemove Experimental client field from docker version. docker/cli#3543

breakingRequire explicit opt-in to use deprecated storage drivers, and don't automatically select them when upgrading. moby/moby#43378

breakingRemove deprecated support for overlay and overlay2 storage drivers on backing filesystems without d_type support. moby/moby#43472

breakingRemove the deprecated overrideKernelCheck option from the overlay2 storage driver. moby/moby#44279 Deprecation notice

breakingRemove support for the deprecated io.containerd.runtime.v1.linux OCI runtime. moby/moby#43695

breakingRemove LCOW (Linux Containers on Windows). moby/moby#42451, moby/moby#42499, moby/moby#42506, moby/moby#42511, moby/moby#42520, moby/moby#42683, moby/moby#42684, moby/moby#42685, moby/moby#43187

breakingLCOW was introduced as a technical preview in 17.09 and deprecated in 20.10.

breakingRemove daemon options related to legacy overlay networks used with standalone Swarm.

breakingRemove --cluster-xx options from dockerd. moby/moby#40383

breakingRemove host-discovery and overlay networks with external k/v stores. moby/moby#42247

breakingRemove a deprecated arm platform fallback. --platform linux/arm/vY will now return a error when arm/vY isn't available instead of pulling the wrong image. moby/moby#44414

breakingRemove the deprecated SetCustomHTTPHeaders(), CustomHTTPHeaders() options-setters from the Go client API. moby/moby#42694

breakingRemove the deprecated WithDialer() option-setter from the Go client API. moby/moby#44022

breakingUse WithDialContext() instead.

breakingRemove the daemon implementation of opts.QuotedString. The implementation has moved to the CLI. moby/moby#43250

breakingRemove separate daemon ID from trust-key in the daemon, and disable generating the trust-key. moby/moby#43555

breakingAPI: Remove the deprecated KernelMemory option from POST /containers/create on API version >= 1.42. moby/moby#43214

deprecatedRequire Windows Server RS5 / LTSC 2019 (build 17763) as the minimum to run the daemon. moby/moby#43254

securityChange permissions on container hostconfig.json files to 0600 (was 0644). moby/moby#41620

securityFix --seccomp-profile not accepting unconfined and renamed the default seccomp profile to builtin. moby/moby#42481

securityAlways build with seccomp support, and remove the seccomp build tag. moby/moby#42501

securityAdd seccomp support on riscv64. moby/moby#43553

securityAdd support for setting flags passed to seccomp(2) in seccomp profiles. moby/moby#42648

securityRefactor seccomp types to reuse runtime-spec, and add support for ErrnoRet. moby/moby#42005

securityAdd support for DefaultErrnoRet in seccomp profiles. moby/moby#42604

securityAdd an explicit DefaultErrnoRet field to the default seccomp profile, with no behavior change. moby/moby#42649

securityBlock socket with AF_VSOCK in the default seccomp profile. moby/moby#44563

securityRe-enable process_vm_readv and process_vm_writev in the default seccomp profile. moby/moby#42083

securityAdd syscalls related to PKU to the default seccomp profile. moby/moby#43812

+123 more items in the release notes