Docker Engine 26.1.5 → 29.9.2

67 releases · 75 breaking changes · 67 security fixes · 8 advisories fixed

67security75breaking153deprecated84feature348fix

Is 26.1.5 affected?

Vulnerabilities fixed by this upgrade

7.6 CVE-2026-92543 Docker Engine insecure-registry fallback via malicious DNS responses
7.2 CVE-2026-42306 Race condition in docker cp allows bind mount redirection to host path
6.1 CVE-2026-41568 Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap
7.2 CVE-2026-41567 `PUT /containers/{id}/archive` executes container binary on the host
8.8 CVE-2026-34040 AuthZ plugin bypass with oversized request body
6.8 CVE-2026-33997 Off-by-one error in plugin privilege validation
3.3 CVE-2025-54410 Firewalld reload removes bridge network isolation
9.9 CVE-2024-41110 Authz zero length regression

Breaking changes

breaking Revert a PR breaking external DNS resolution on all custom bridge networks. moby/moby#51615 in 29.1.1
breaking The Go module github.com/docker/docker is deprecated in favor of github.com/moby/moby/client and github.com/moby/moby/api. The github.com/moby/moby module is considered an internal implementation detail - the only supported public modules are client and api. Starting with v29, releases are tagged… in 29.0.0
breaking Debian armhf (32-bit) packages now target ARMv7 CPUs and will not work on ARMv6 devices. in 29.0.0
breaking Official Raspbian (32-bit) packages are no longer provided. Use Debian arm64 packages for 64-bit devices, or Debian armhf packages for 32-bit ARMv7 devices. in 29.0.0
breaking cgroup v1 is deprecated. Support continues until at least May 2029, but migrate to cgroup v2 as soon as possible. See moby#51111. in 29.0.0
breaking Docker Content Trust was removed from the Docker CLI. Can be built as a separate plugin: https://github.com/docker/cli/blob/v29.0.0/cmd/docker-trust/main.go in 29.0.0
breaking The daemon now requires API version v1.44 or later (Docker v25.0+). in 29.0.0
breaking client: remove legacy CBC cipher suites from client config. moby/moby#50126 in 29.0.0
breaking contrib: remove editorconfig as it was unmaintained. moby/moby#50607 in 29.0.0
breaking contrib: remove Dockerfile syntax highlighting files for nano and TextMate (tmbundle) as they were unmaintained and outdated. moby/moby#50606 in 29.0.0
breaking contrib: remove mkimage-xxx scripts as they were unmaintained and not tested. moby/moby#50297 in 29.0.0
breaking Ensure bridge devices are removed when bridge network creation fails. moby/moby#51147 in 29.0.0
breaking The iptables rules for bridge networks have been updated, including removal of the DOCKER-ISOLATION-STAGE-1 and DOCKER-ISOLATION-STAGE-2 chains. With these changes:. moby/moby#49981 in 29.0.0
breaking POST /images/{name:}/push: remove compatibility with API v1.4 auth-config in body. moby/moby#50371 in 29.0.0
breaking api/types/plugin: remove deprecated Config.DockerVersion. moby/moby#51458 in 29.0.0
breaking api/types/swarm: deprecated and dropped support for PortConfigProtocol; use network.IPProtocol instead. moby/moby#51094 in 29.0.0
breaking api/pkg/progress and api/pkg/streamformatter have been removed. moby/moby#51153 in 29.0.0
breaking api: remove unused DefaultVersion, MinSupportedAPIVersion consts. moby/moby#50587 in 29.0.0
breaking client: ContainerCommitOptions: remove Pause field in favor of NoPause. moby/moby#51019 in 29.0.0
breaking client: remove client.ContainerStatsResult.OSType field. moby/moby#51305 in 29.0.0
breaking Remove structs NetworkSettingsBase and DefaultNetworkSettings. Fields in NetworkSettingsBase that were not deprecated are now directly in NetworkSettings. moby/moby#50846 in 29.0.0
breaking Remove support for legacy CBC cipher suites. docker/cli#6474 in 28.5.0
breaking Fix an issue with removal of a --link from a container in the default bridge network. moby/moby#49778 in 28.1.0
breaking cli/command/context: remove temporary ContextType field from JSON output. docker/cli#5981 in 28.1.0
breaking Remove dependency on kernel modules ip_set, ip_set_hash_net and netfilter_xt_set. in 28.0.1
breaking The executable rootlesskit-docker-proxy is no longer used, it has been removed from the build and distribution. in 28.0.0
breaking The Fluent logger option fluentd-async-connect has been deprecated in v20.10 and is now removed. moby/moby#46114 in 28.0.0
breaking The --time option on docker stop and docker restart is deprecated and renamed to --timeout. docker/cli#5485 in 28.0.0
breaking Go-SDK: pkg/ioutils: Remove NewReaderErrWrapper as it was never used. moby/moby#49258 in 28.0.0
breaking Go-SDK: pkg/ioutils: Remove deprecated BytesPipe, NewBytesPipe, ErrClosed, WriteCounter, NewWriteCounter, NewReaderErrWrapper, NopFlusher. moby/moby#49245 in 28.0.0
breaking Go-SDK: pkg/ioutils: Remove deprecated NopWriter and NopWriteCloser. moby/moby#49256 in 28.0.0
breaking Go-SDK: pkg/sysinfo: Remove deprecated NumCPU. moby/moby#49242 in 28.0.0
breaking Go-SDK: Remove pkg/broadcaster, as it was only used internally moby/moby#49172 in 28.0.0
breaking Go-SDK: Remove deprecated cli.Errors type docker/cli#5549 in 28.0.0
breaking Remove pkg/ioutils.ReadCloserWrapper, as it was only used in tests. moby/moby#49237 in 28.0.0
breaking Remove deprecated api-cors-header config parameter and the dockerd --api-cors-header option moby/moby#48209 in 28.0.0
breaking Remove deprecated APIEndpoint.Version field, APIVersion type, and APIVersion1 and APIVersion2 consts. moby/moby#49004 in 28.0.0
breaking Remove deprecated api-cors-header config parameter and the Docker daemon's --api-cors-header option. docker/cli#5437 in 28.0.0
breaking Remove deprecated pkg/directory package moby/moby#48779 in 28.0.0
breaking Remove deprecated pkg/dmsg.Dmesg() moby/moby#48109 in 28.0.0
breaking Remove deprecated image/spec package, which was moved to a separate module (github.com/moby/docker-image-spec) moby/moby#48460 in 28.0.0
breaking Remove migration code and errors for the deprecated logentries logging driver. moby/moby#48891 in 28.0.0
breaking Remove support for deprecated external graph-driver plugins. moby/moby#48072 in 28.0.0
breaking api/types: Remove deprecated container.ContainerNode and ContainerJSONBase.Node field. moby/moby#48107 in 28.0.0
breaking api/types: Remove deprecated aliases: ImagesPruneReport, VolumesPruneReport, NetworkCreateRequest, NetworkCreate, NetworkListOptions, NetworkCreateResponse, NetworkInspectOptions, NetworkConnect, NetworkDisconnect, EndpointResource, NetworkResource, NetworksPruneReport, ExecConfig, ExecStartCheck,… in 28.0.0
breaking libnetwork/iptables: Remove deprecated IPV, Iptables, IP6Tables and Passthrough(). moby/moby#49121 in 28.0.0
breaking pkg/archive: Remove deprecated CanonicalTarNameForPath, NewTempArchive, TempArchive moby/moby#48708 in 28.0.0
breaking pkg/fileutils: Remove deprecated GetTotalUsedFds moby/moby#49210 in 28.0.0
breaking pkg/ioutils: Remove OnEOFReader, which was only used internally moby/moby#49170 in 28.0.0
breaking pkg/longpath: Remove deprecated Prefix constant. moby/moby#48779 in 28.0.0
breaking pkg/stringid: Remove deprecated IsShortID and ValidateID functions moby/moby#48705 in 28.0.0
breaking runconfig/opts: Remove deprecated ConvertKVStringsToMap moby/moby#48102 in 28.0.0
breaking runconfig: Remove deprecated ContainerConfigWrapper, SetDefaultNetModeIfBlank, DefaultDaemonNetworkMode, IsPreDefinedNetwork moby/moby#48102 in 28.0.0
breaking container: Remove deprecated ErrNameReserved, ErrNameNotReserved. moby/moby#48728 in 28.0.0
breaking Remove Daemon.ContainerInspectCurrent() method and change Daemon.ContainerInspect() signature to accept a backend.ContainerInspectOptions struct moby/moby#48672 in 28.0.0
breaking Remove deprecated Daemon.Exists() and Daemon.IsPaused() methods. moby/moby#48723 in 28.0.0
breaking Deprecate Daemon.Exists() and Daemon.IsPaused(). These functions are no longer used and will be removed in the next release. moby/moby#48719 in 27.4.0
breaking Deprecate container.ErrNameReserved and container.ErrNameNotReserved. moby/moby#48697 in 27.4.0
breaking Deprecate pkg/platform - this package is only used internally, and will be removed in the next release. moby/moby#48863 in 27.4.0
breaking Deprecate RepositoryInfo.Class. This field is no longer used, and will be removed in the next release. moby/moby#49013 in 27.4.0
breaking Go SDK: Fix deprecation of cli/command.ConfigureAuth(), which was deprecated since v27.2.1. docker/cli#5552 in 27.4.0
breaking Go SDK: Deprecate cli.Errors type in favour of Go's errors.Join docker/cli#5548 in 27.4.0
breaking Remove unused docker-proxy.exe binary from Windows packages. docker/docker-ce-packaging#1045 in 27.1.2
breaking api/types: deprecate ContainerJSONBase.Node field and ContainerNode type. These definitions were used by the standalone ("classic") Swarm API, but never implemented in the Docker Engine itself. moby/moby#48055 in 27.0.2
breaking If you are using an IPv6-enabled bridge network without ip6tables, this is likely a breaking change. Only published container ports (-p or --publish) are accessible from outside the Docker bridge network, and outgoing connections masquerade as the host. in 27.0.1
breaking Deprecate experimental GraphDriver plugins. moby/moby#48050, docker/cli#5172 in 27.0.1
breaking pkg/archive: deprecate NewTempArchive and TempArchive. These types were only used in tests and will be removed in the next release. moby/moby#48002 in 27.0.1
breaking pkg/archive: deprecate CanonicalTarNameForPath moby/moby#48001 in 27.0.1
breaking Deprecate pkg/dmesg. This package was no longer used, and will be removed in the next release. moby/moby#47999 in 27.0.1
breaking Deprecate pkg/stringid.ValidateID and pkg/stringid.IsShortID moby/moby#47995 in 27.0.1
breaking runconfig: deprecate SetDefaultNetModeIfBlank and move ContainerConfigWrapper to api/types/container moby/moby#48007 in 27.0.1
breaking runconfig: deprecate DefaultDaemonNetworkMode and move to daemon/network moby/moby#48008 in 27.0.1
breaking runconfig: deprecate opts.ConvertKVStringsToMap. This utility is no longer used, and will be removed in the next release. moby/moby#48016 in 27.0.1
breaking runconfig: deprecate IsPreDefinedNetwork. moby/moby#48011 in 27.0.1
breaking Remove deprecated aliases for Image types. moby/moby#47900 in 27.0.1

Security changes

security The Go runtime update addresses CVE-2026-111943 by rejecting certificate chains that include eight revoked eMudhra intermediate certificates. Image pulls and pushes fail TLS certificate verification if a registry's certificate chain relies on one of the affected TLS intermediates. Affected… in 29.9.2
security Domain-validated TLS: EM DV TLS CA - G3B and EM DV TLS CA - G3C in 29.9.2
security Organization-validated TLS: EM OV TLS CA - G3B and EM OV TLS CA - G3C in 29.9.2
security Extended-validation TLS: EM EV TLS CA - G3B and EM EV TLS CA - G3C in 29.9.2
security Code signing: EM OV CS CA - G3B and EM OV CS CA - G3C in 29.9.2
security CVE-2026-95839: Pulling or importing an image through containerd's transfer service could crash containerd if a child descriptor contained the io.containerd.manifest.subject annotation and a malformed digest. in 29.9.1
security GHSA-8647-2jxj-p2rc: An untrusted registry returning a crafted Content-Length header could crash containerd when parallel layer fetching was enabled with concurrent_layer_fetch_buffer. in 29.9.1
security GHSA-hc94-p972-ch66: Pulling a crafted image or pulling from a malicious registry could exhaust host disk space because containerd did not limit incoming layer data to the declared size before validation. in 29.9.1
security CVE-2026-97032: An HTTP/2 client could crash the daemon by changing the HPACK header table size while sending requests. golang/go#81867 in 29.9.0
security CVE-2026-78659: An HTTP/2 client could exhaust daemon memory by declaring a large number of fields in a Trailer header, bypassing the header size limits. golang/go#81857 in 29.9.0
security CVE-2026-78663: An HTTP/2 client could bypass the connection-level flow control limit by resetting streams, making the daemon buffer more request data than the limit allows. golang/go#81743 in 29.9.0
security CVE-2026-78669: An HTTP/2 client could cause excessive daemon CPU use by opening many streams and repeatedly changing the initial window size. golang/go#81742 in 29.9.0
security CVE-2026-56857: On Windows, the daemon could create a directory outside its data root if someone with write access to the data root had placed a junction there. golang/go#81739 in 29.9.0
security Release a node's IPsec security associations and policies when the last container leaves an encrypted overlay network, instead of leaking them until the daemon restarts. moby/moby#53420 in 29.9.0
security CVE-2026-53493: Pulling a crafted OCI image index with deeply nested or widely fanned-out descriptors could cause unbounded CPU and memory use. GHSA-pg57-6jwg-q645 in 29.8.2
security CVE-2026-92543: A malicious DNS response could make registry connections skip TLS certificate verification or fall back to HTTP, exposing registry credentials or allowing image substitution. GHSA-7cfq-22r6-qp73 in 29.8.2
security CVE-2026-92542: Unprivileged users on a Swarm node could inject forged Ethernet frames into encrypted overlay networks on peer nodes. GHSA-6m9p-4h64-m6vh in 29.8.2
security CVE-2026-93315: A build step could redirect proxy CA cleanup outside the build root filesystem, block it with a special file, or let the build succeed when cleanup failed. GHSA-2f5p-x9ph-g97x in 29.8.2
security CVE-2026-93316: A build that requested CDI devices could cause a daemon panic when CDI support was disabled, for example with "features": {"cdi": false} in daemon.json. GHSA-r456-g3gm-cvxf in 29.8.2
security CVE-2026-93317: With the containerd image store, a client using the low-level LLB API could poison the build cache with container blob contents that did not match their claimed digest. GHSA-p3rc-w3hc-pqvv in 29.8.2
security CVE-2026-93318: A malicious image could poison the build cache with layer DiffIDs that did not match the actual layer contents. GHSA-f2v9-hprr-32q3 in 29.8.2
security CVE-2026-93319: A malicious external frontend could crash the daemon through gateway container lifecycle races or malformed requests and definitions. GHSA-4hgw-qrhw-fhg8 in 29.8.2
security CVE-2026-93320: Daemon-side snapshot reads and LLB mkfile operations did not safely handle special files. GHSA-9728-qjrv-2xh2 in 29.8.2
security CVE-2026-93321: A malformed LLB file operation with invalid symlink owner inputs could crash the daemon. GHSA-fjj4-h6vf-m9hj in 29.8.2
security CVE-2026-93322: A malformed LLB merge operation with mismatched input counts could crash the daemon. GHSA-cv6p-7w7g-xjwq in 29.8.2
security CVE-2026-93323: An oversized Dockerfile, .dockerignore, gateway file, or nested LLB definition could exhaust daemon memory. GHSA-mgqf-486f-49vp in 29.8.2
security CVE-2026-93326: A crafted Git build source could bypass source policy rules that match on the repository URL, through a Git bundle locator or a full remote URL that did not match the source identifier. GHSA-66hf-6vf5-87hc in 29.8.2
security Add daemon support for configuring the default container AppArmor profile template. moby/moby#52771 in 29.8.0
security Prevent containers from using the 32-bit socketcall(2) path to create AF_VSOCK sockets and communicate with host virtual machines by adding AppArmor and SELinux policy rules. moby/moby#53551 in 29.8.0
security Update github.com/moby/go-archive to v0.3.0 to fix CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h. moby/moby#53247, docker/cli#7139 in 29.7.0
security CVE-2026-15793: Git source checkout from a bundle file could lead to command injection. GHSA-hw3h-2gp9-cxpv in 29.6.2
security CVE-2026-15792: Incorrect parameters sent from a frontend could cause a panic. GHSA-qx3x-mv6r-52p6 in 29.6.2
security CVE-2026-15791: An LLB file operation could be tricked into removing the contents of the /tmp directory. GHSA-32pv-7hq5-qhwq in 29.6.2
security CVE-2026-15789: A malicious client could bypass destination directory validation when uploading local sources. GHSA-g2h8-426c-7976 in 29.6.2
security CVE-2026-15788: A WCOW cache mount source selector could resolve NTFS junctions outside of the cache root. GHSA-388v-wmr2-g2v2 in 29.6.2
security A malicious image could supply a malicious /etc/passwd or /etc/group-style file causing excessive memory consumption, potentially resulting in process termination due to Out Of Memory (OOM) conditions. GHSA-mjcv-p78q-w5fw, GHSA-jpcc-p29g-p8mq, GHSA-72x6-4j93-7w86 in 29.6.1
security A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the security.insecure entitlement. Other security measures, like Linux capabilities were still applied to these containers.… in 29.6.1
security CVE-2026-41567 Fix a vulnerability in docker cp where archive decompression binaries (e.g. xz, unpigz) were resolved via PATH inside the container filesystem while running as host root, allowing a malicious container to execute arbitrary binaries with host root privileges. GHSA-x86f-5xw2-fm2r in 29.5.1
security CVE-2026-41568 Fix a TOCTOU vulnerability in docker cp that allowed a container process to create files or directories at arbitrary locations on the host filesystem. GHSA-vp62-88p7-qqf5 in 29.5.1
security CVE-2026-42306 Fix a TOCTOU vulnerability in docker cp that allowed a container process to redirect a bind mount to an arbitrary location on the host filesystem. GHSA-rg2x-37c3-w2rh in 29.5.1
security CVE-2026-32288: Fix a denial of service where pulling a maliciously crafted image could cause the daemon to allocate unbounded memory when processing sparse tar archives. GHSA-x4jj-h2v8-hqqv. moby/moby#52478 in 29.5.0
security CVE-2026-31431: Fix the 29.4.2 regression that broke 32-bit programs and i386 images. The broad socketcall(2) seccomp deny is replaced with targeted AppArmor (deny network alg) and SELinux (alg_socket) rules that block AF_ALG at the LSM layer, covering both socket(2) and socketcall(2) paths… in 29.4.3
security This release includes hardening for CVE-2026-31431. in 29.4.2
security Block AF_ALG sockets and the socketcall(2) multiplexer in the default seccomp profile to prevent in-container privilege escalation via the kernel crypto API ("Copy Fail"). moby/moby#52501 in 29.4.2
security If you need a workaround, use the seccomp/v0.2.1 profile from moby/profiles. Make sure you use a kernel that includes the fix for CVE-2026-31431. in 29.4.2
security [!IMPORTANT] Use this workaround only for containers that require it. Containers that use this profile can still exploit CVE-2026-31431 through the socketcall syscall. in 29.4.2
security To use the profile for a specific container when you control the docker run command, use --security-opt: in 29.4.2
security CVE-2026-34040 Fix an authorization bypass in AuthZ plugins that could allow authorization plugins to be bypassed under specific conditions. GHSA-x744-4wpc-v9h2 in 29.3.1
security CVE-2026-33997 Fix a flaw in docker plugin install where privilege validation could be partially bypassed, potentially leading to unauthorized privilege escalation. GHSA-pxq6-2prw-chj9 in 29.3.1
security CVE-2026-33748 Fix insufficient validation of Git URL #ref:subdir fragments in BuildKit, which could allow access to files outside the intended repository scope. GHSA-4vrq-3vrq-g6gg in 29.3.1
security CVE-2026-33747 Fix a vulnerability in BuildKit where an untrusted frontend could cause files to be written outside the BuildKit state directory. GHSA-3c29-8rgm-jvjj in 29.3.1
security Update Go runtime to 1.25.5. moby/moby#51648, docker/cli#6688 in 29.1.2
security Fixes a potential DoS via excessive resource usage when formatting hostname validation errors CVE-2025-61729 in 29.1.2
security Fixes incorrect enforcement of excluded subdomain constraints for wildcard SANs, which could allow improperly trusted certificates CVE-2025-61727 in 29.1.2
security CVE-2025-31133 in 28.5.2
security CVE-2025-52565 in 28.5.2
security CVE-2025-52881 in 28.5.2
security This release fixes an issue where, after a firewalld reload, published container ports could be accessed directly from the local network, even when they were intended to be accessible only via a loopback address. CVE-2025-54388 / GHSA-x4rx-4gw3-53p4 / moby/moby#50506. in 28.3.3
security Add environment variable DOCKER_INSECURE_NO_IPTABLES_RAW=1 to allow Docker to run on systems where the Linux kernel can't provide CONFIG_IP_NF_RAW support. When enabled, Docker will not create rules in the iptables raw table. Warning: This is not recommended for production environments as it… in 28.0.2
security Update github.com/go-jose/go-jose/v4 to v4.0.5 to address. GHSA-c6gw-w398-hv78 / CVE-2025-27144 docker/cli#5867 in 28.0.1
security Fixes CVE-2025-54410: Firewalld reload removes bridge network isolation in 28.0.0
security Fix a security issue that was allowing remote hosts to connect directly to a container on its published ports. moby/moby#49325 in 28.0.0
security Fix a security issue that was allowing neighbor hosts to connect to ports mapped on a loopback address. moby/moby#49325 in 28.0.0
security Update Go runtime to 1.22.11 (fix CVE-2024-45341, CVE-2024-45336). moby/moby#49312, docker/docker-ce-packaging#1147, docker/cli#5762 in 27.5.1
security Update runc to v1.1.14, which contains a fix for CVE-2024-45310. moby/moby#48426 in 27.2.1
security This release contains a fix for CVE-2024-41110 / GHSA-v23v-6jw2-98fq that impacted setups using authorization plugins (AuthZ) for access control. No other changes are included in this release, and this release is otherwise identical for users not using AuthZ plugins. in 27.1.1
security Update Go runtime to 1.21.12, which contains security fixes for CVE-2024-24791 moby/moby#48120 in 27.1.0

Deprecations

deprecated The Engine now returns a deprecation warning when a container connected to the default bridge is created with links specified. moby/moby#47427 in 29.6.0
deprecated cli/command/image/build: remove deprecated DefaultDockerfileName const. docker/cli#6737 in 29.5.0
deprecated cli/command/image/build: remove deprecated DetectArchiveReader util. docker/cli#6737 in 29.5.0
deprecated cli/command/image/build: remove deprecated IsArchive utility. docker/cli#6737 in 29.5.0
deprecated cli/command/image/build: remove deprecated ResolveAndValidateContextPath util. docker/cli#6737 in 29.5.0
deprecated cli/command/image/build: remove deprecated WriteTempDockerfile util. docker/cli#6737 in 29.5.0
deprecated Go SDK: cli-plugins/hooks: deprecate HookMessage and rename to cli-plugins/hooks.Response. docker/cli#6859 in 29.4.0
deprecated Go SDK: cli-plugins/hooks: deprecate HookType and rename to cli-plugins/hooks.ResponseType. docker/cli#6859 in 29.4.0
deprecated Go SDK: cli-plugins/manager: deprecate HookPluginData and move to cli-plugins/hooks.Request. docker/cli#6859 in 29.4.0
deprecated Remove %PROGRAMDATA%\Docker\cli-plugins from the list of paths used for CLI plugins on Windows. This path was present for backward compatibility with old installation, but replaced by %ProgramFiles%\Docker\cli-plugins. docker/cli#6713 in 29.2.0
deprecated api/types/system: deprecated top level DiskUsage fields for type specific fields. moby/moby#51235 in 29.0.0
deprecated Environment variables set on a container using legacy links are deprecated and aren't added automatically anymore. moby/moby#50719 in 29.0.0
deprecated Users are encouraged to stop relying on these as they're deprecated, and the escape hatch will be removed in a later version in 29.0.0
deprecated client/pkg/jsonmessage: remove deprecated ProgressMessage, ErrorMessage, DisplayJSONMessagesToStream and Stream interface. moby/moby#49264 in 29.0.0
deprecated GET /events no longer includes the deprecated status, id, and from fields. These fields were removed in API v1.22, but still included in the response. These fields are now omitted when using API v1.52 or later. moby/moby#50832 in 29.0.0
deprecated api/types/network: CreateRequest: remove deprecated CheckDuplicate field. moby/moby#50998 in 29.0.0
deprecated api/types/plugin: deprecate Config.DockerVersion field. moby/moby#51109 in 29.0.0
deprecated api/types/registry: remove deprecated AuthConfig.Email field. moby/moby#51059 in 29.0.0
deprecated api/types/strslice: deprecate StrSlice in favor of using a regular []string. moby/moby#50292 in 29.0.0
deprecated api/types/sytem: remove deprecated DiskUsage.BuilderSize. moby/moby#51180 in 29.0.0
deprecated api/types: move plugin types to api/types/plugin. moby/moby#48114 in 29.0.0
deprecated API: Deprecation: the Engine was automatically backfilling empty PortBindings lists with a PortBinding with an empty HostIP and HostPort when starting a container. This behavior is deprecated for API 1.52, and will be dropped in API 1.53. moby/moby#50874 in 29.0.0
deprecated build: remove DCT support for classic builder. docker/cli#6195 in 29.0.0
deprecated cli/command: Remove deprecated ResolveDefaultContext. docker/cli#6555 in 29.0.0
deprecated client: ImageBuildResponse: remove OSType field. moby/moby#50995 in 29.0.0
deprecated client: Remove ImageCreate method - useImagePull or ImageImport instead. moby/moby#51366 in 29.0.0
deprecated client: remove deprecated ImageListOptions.ContainerCount. moby/moby#51006 in 29.0.0
deprecated client: remove support for negotiating API version < v1.44 (docker 25.0). moby/moby#51119 in 29.0.0
deprecated client: remove unused Client.HTTPClient() method. moby/moby#51011 in 29.0.0
deprecated daemon/graphdriver: remove deprecated GetDriver(). moby/moby#50377 in 29.0.0
deprecated Go-SDK: cli/command/image/build: deprecate DefaultDockerfileName, DetectArchiveReader, WriteTempDockerfile, ResolveAndValidateContextPath. These utilities were only used internally and will be removed in the next release. docker/cli#6610 in 28.5.2
deprecated Go-SDK: cli/command/image/build: deprecate IsArchive utility. docker/cli#6560 in 28.5.2
deprecated Go-SDK: opts: deprecate ValidateMACAddress. docker/cli#6560 in 28.5.2
deprecated Go-SDK: opts: deprecate ListOpts.Delete(). docker/cli#6560 in 28.5.2
deprecated Deprecated and removed features, see Deprecated Features. in 28.5.1
deprecated api/types/image: InspectResponse: deprecate Parent and DockerVersion fields. moby/moby#51105 in 28.5.1
deprecated api/types/plugin: deprecate Config.DockerVersion field. moby/moby#51110 in 28.5.1
deprecated Deprecated and removed features, see Deprecated Features. in 28.5.0
deprecated Deprecate support for kernel memory TCP accounting (KernelMemoryTCP). moby/moby#51067 in 28.5.0
deprecated Go-SDK: cli/command: deprecate DockerCli.Apply. This method is no longer used and will be removed in the next release if there are no remaining uses. docker/cli#6497 in 28.5.0
deprecated Go-SDK: cli/command: deprecate DockerCli.ContentTrustEnabled. This method is no longer used and will be removed in the next release. docker/cli#6495 in 28.5.0
deprecated Go-SDK: cli/command: deprecate DockerCli.DefaultVersion. This method is no longer used and will be removed in the next release. docker/cli#6491 in 28.5.0
deprecated Go-SDK: cli/command: deprecate ResolveDefaultContext utility. docker/cli#6529 in 28.5.0
deprecated Go-SDK: cli/command: deprecate WithContentTrustFromEnv, WithContentTrust options. These options were used internally, and will be removed in the next release.. docker/cli#6489 in 28.5.0
deprecated Go-SDK: cli/manifest/store: deprecate IsNotFound(). docker/cli#6514 in 28.5.0
deprecated Go-SDK: templates: deprecate NewParse() function. docker/cli#6469 in 28.5.0
deprecated Deprecated and removed features, see Deprecated Features. in 28.4.0
deprecated Update deprecation message for AuthConfig.Email field. moby/moby#50797 in 28.4.0
deprecated Deprecate profiles package which got migrated to github.com/moby/profiles. moby/moby#50513 in 28.4.0
deprecated Deprecate special handling for quoted values for the --tlscacert, --tlscert, and --tlskey command-line flags. docker/cli#6291 in 28.4.0
deprecated Mark legacy links env vars (DOCKER_KEEP_DEPRECATED_LEGACY_LINKS_ENV_VARS) as deprecated in v28.4 and set for removal in v30.0. docker/cli#6309 in 28.4.0
deprecated Go-SDK: Deprecate field NetworkSettingsBase.Bridge, struct NetworkSettingsBase, all the fields of DefaultNetworkSettings, and struct DefaultNetworkSettings. moby/moby#50839 in 28.4.0
deprecated Go-SDK: api/types: build.CacheDiskUsage, container.DiskUsage, images.DiskUsage and volumes.DiskUsage are now deprecated and will be removed in the next major release. moby/moby#50768 in 28.4.0
deprecated Go-SDK: cli-plugins/manager: deprecate ReexecEnvvar. docker/cli#6411 in 28.4.0
deprecated Go-SDK: cli-plugins/manager: deprecate annotation aliases (CommandAnnotationPlugin, CommandAnnotationPluginVendor, CommandAnnotationPluginVersion, CommandAnnotationPluginInvalid, CommandAnnotationPluginCommandPath) in favor of their equivalent in cli-plugins/manager/metadata. docker/cli#6298 in 28.4.0
deprecated Go-SDK: cli-plugins/manager: deprecate metadata aliases (NamePrefix, MetadataSubcommandName, HookSubcommandName, Metadata, ReexecEnvvar) in favor of their equivalent in cli-plugins/manager/metadata. docker/cli#6269 in 28.4.0
deprecated Go-SDK: cli-plugins/manager: remove Candidate interface, which was only for internal use. docker/cli#6269 in 28.4.0
deprecated Go-SDK: cli-plugins/manager: remove NewPluginError function, which was only for internal use. docker/cli#6269 in 28.4.0
deprecated Go-SDK: cli-plugins/manager: remove deprecated ResourceAttributesEnvvar const. docker/cli#6269 in 28.4.0
deprecated Go-SDK: cli/command/builder: deprecate NewBuilderCommand and NewBakeStubCommand. These functions will be removed in the next release. docker/cli#6312 in 28.4.0
deprecated Go-SDK: cli/command/builder: deprecate NewPruneCommand. docker/cli#6343 in 28.4.0
deprecated Go-SDK: cli/command/checkpoint: deprecate NewCheckpointCommand. This function will be removed in the next release. docker/cli#6312 in 28.4.0
deprecated Go-SDK: cli/command/checkpoint: deprecate NewFormat, FormatWrite. docker/cli#6341 in 28.4.0
deprecated Go-SDK: cli/command/completion: deprecate NoComplete. docker/cli#6405 in 28.4.0
deprecated Go-SDK: cli/command/completion: remove deprecated ValidArgsFn. docker/cli#6259 in 28.4.0
deprecated Go-SDK: cli/command/config: deprecate NewConfigCommand. This function will be removed in the next release. docker/cli#6312 in 28.4.0
deprecated Go-SDK: cli/command/config: deprecate NewFormat, FormatWrite, InspectFormatWrite. docker/cli#6341 in 28.4.0
deprecated Go-SDK: cli/command/config: deprecate RunConfigCreate, CreateOptions, RunConfigInspect, InspectOptions, RunConfigList, ListOptions, RunConfigRemove, and RemoveOptions. docker/cli#6369 in 28.4.0
deprecated Go-SDK: cli/command/container: deprecate NewBuildCommand, NewPullCommand, NewPushCommand, NewImagesCommand, NewImageCommand, NewHistoryCommand, NewImportCommand, NewLoadCommand, NewRemoveCommand, NewSaveCommand, NewTagCommand, NewPruneCommand. These functions will be removed in the next release.… in 28.4.0
deprecated Go-SDK: cli/command/container: deprecate NewDiffFormat, DiffFormatWrite. These functions were only used internally and will be removed in the next release. docker/cli#6341 in 28.4.0
deprecated Go-SDK: cli/command/container: deprecate NewRunCommand, NewExecCommand, NewPsCommand, NewContainerCommand, NewAttachCommand, NewCommitCommand, NewCopyCommand, NewCreateCommand, NewDiffCommand, NewExportCommand, NewKillCommand, NewLogsCommand, NewPauseCommand, NewPortCommand, NewRenameCommand,… in 28.4.0
deprecated Go-SDK: cli/command/context: deprecate NewContextCommand. This function will be removed in the next release. docker/cli#6312 in 28.4.0
deprecated Go-SDK: cli/command/context: deprecate RunCreate and CreateOptions. docker/cli#6403 in 28.4.0
deprecated Go-SDK: cli/command/context: deprecate RunExport and ExportOptions. docker/cli#6403 in 28.4.0
deprecated Go-SDK: cli/command/context: deprecate RunImport. docker/cli#6403 in 28.4.0
deprecated Go-SDK: cli/command/context: deprecate RunRemove and RemoveOptions. docker/cli#6403 in 28.4.0
deprecated Go-SDK: cli/command/context: deprecate RunUpdate and UpdateOptions. docker/cli#6403 in 28.4.0
deprecated Go-SDK: cli/command/context: deprecate RunUse. docker/cli#6403 in 28.4.0
deprecated Go-SDK: cli/command/image: deprecate AuthResolver utility. docker/cli#6357 in 28.4.0
deprecated Go-SDK: cli/command/image: deprecate NewHistoryFormat, HistoryWrite. docker/cli#6341, docker/cli#6341 in 28.4.0
deprecated Go-SDK: cli/command/manifest: deprecate NewManifestCommand. This functions will be removed in the next release. docker/cli#6312 in 28.4.0
deprecated Go-SDK: cli/command/network: deprecate NewFormat, FormatWrite. docker/cli#6341 in 28.4.0
deprecated Go-SDK: cli/command/network: deprecate NewNetworkCommand. These functions will be removed in the next release. docker/cli#6312 in 28.4.0
deprecated Go-SDK: cli/command/node: deprecate NewFormat, FormatWrite, InspectFormatWrite. docker/cli#6341 in 28.4.0
deprecated Go-SDK: cli/command/node: deprecate NewNodeCommand. This functions will be removed in the next release. docker/cli#6312 in 28.4.0
deprecated Go-SDK: cli/command/plugin: deprecate NewFormat, FormatWrite. docker/cli#6341 in 28.4.0
deprecated Deprecated and removed features, see Deprecated Features. in 28.3.2
deprecated Deprecated and removed features, see Deprecated Features. in 28.3.1
deprecated Deprecated and removed features, see Deprecated Features. in 28.3.0
deprecated Empty/nil image config fields in the GET /images/{name}/json response are now deprecated and will be removed in v29.0. docker/cli#6129 in 28.3.0
deprecated api/types/container: deprecate ExecOptions.Detach. This field is not used, and will be removed in a future release. moby/moby#50219 in 28.3.0
deprecated pkg/idtools: deprecate IdentityMapping and Identity.Chown. moby/moby#50210 in 28.3.0
deprecated Deprecated and removed features, see Deprecated Features. in 28.2.0
deprecated api/types: deprecate BuildResult, ImageBuildOptions, ImageBuildOutput, ImageBuildResponse, BuilderVersion, BuilderV1, and BuilderBuildKi which were moved to api/types/build. moby/moby#50025 in 28.2.0
deprecated API: Deprecated: GET /images/{name}/json no longer returns the following fields: Config, Hostname, Domainname, AttachStdin, AttachStdout, AttachStderr, Tty, OpenStdin, StdinOnce, Image, NetworkDisabled (already omitted unless set), MacAddress (already omitted unless set), StopTimeout (already… in 28.2.0
deprecated Go-SDK: Deprecate builder/remotecontext.Rel(). This function was needed on older versions of Go, but can now be replaced by filepath.Rel(). moby/moby#49843 in 28.2.0
deprecated Go-SDK: api/types: deprecate BuildCachePruneOptions in favor of api/types/builder.CachePruneOptions. moby/moby#50015 in 28.2.0
deprecated Go-SDK: api/types: deprecate BuildCachePruneReport in favor of api/types/builder.CachePruneReport. moby/moby#50015 in 28.2.0
deprecated Go-SDK: api/types: deprecate NodeListOptions, NodeRemoveOptions, ServiceCreateOptions, ServiceUpdateOptions, RegistryAuthFromSpec, RegistryAuthFromPreviousSpec, ServiceListOptions, ServiceInspectOptions, and SwarmUnlockKeyResponse which were moved to api/types/swarm. moby/moby#50027 in 28.2.0
deprecated Go-SDK: api/types: deprecate SecretCreateResponse, SecretListOptions, ConfigCreateResponse, ConfigListOptions which were moved to api/types/swarm. moby/moby#50024 in 28.2.0
deprecated Go-SDK: client: deprecate IsErrNotFound. moby/moby#50012 in 28.2.0
deprecated Go-SDK: container: deprecate IsValidHealthString in favor of api/types/container.ValidateHealthStatus. moby/moby#49893 in 28.2.0
deprecated Go-SDK: container: deprecate StateStatus, WaitCondition, and the related WaitConditionNotRunning, WaitConditionNextExit, and WaitConditionRemoved consts in favor of their equivalents in api/types/container. moby/moby#49874 in 28.2.0
deprecated Go-SDK: opts: deprecate ListOpts.GetAll in favor of ListOpts.GetSlice. docker/cli#6032 in 28.2.0
deprecated Remove deprecated IsAutomated formatting placeholder from docker search. docker/cli#6091 in 28.2.0
deprecated Remove fallback for pulling images from non-OCI-compliant docker.pkg.github.com registry. moby/moby#50094 in 28.2.0
deprecated Remove support for pulling legacy v2, schema 1 images and remove DOCKER_ENABLE_DEPRECATED_PULL_SCHEMA_1_IMAGE environment-variable. moby/moby#50036, moby/moby#42300 in 28.2.0
deprecated The BridgeNfIptables and BridgeNfIp6tables fields in the GET /info response were deprecated in API v1.48, and are now omitted in API v1.50. moby/moby#49904 in 28.2.0
deprecated errdefs: Deprecate errdefs.FromStatusCode. Use containerd's errhttp.ToNative instead. moby/moby#50030 in 28.2.0
deprecated API: Deprecated AllowNondistributableArtifactsCIDRs and AllowNondistributableArtifactsHostnames fields in the RegistryConfig struct in the GET /info response are omitted in API v1.49. moby/moby#49749 in 28.1.0
deprecated API: Deprecated: The ContainerdCommit.Expected, RuncCommit.Expected, and InitCommit.Expected fields in the GET /info endpoint were deprecated in API v1.48, and are now omitted in API v1.49. moby/moby#48556 in 28.1.0
deprecated Go-SDK: cli/command/image: Deprecate RunPull: this function was only used internally and will be removed in the next release. docker/cli#5975 in 28.1.0
deprecated Go-SDK: cli/config/configfile: deprecate ConfigFile.Experimental field. Experimental CLI features are always enabled since version v20.10 and this field is no longer used. Use ConfigFile.Features instead for optional features. This field will be removed in a future release. docker/cli#5977 in 28.1.0
deprecated Go-SDK: deprecate pkg/archive, which was migrated to github.com/moby/go-archive. moby/moby#49743 in 28.1.0
deprecated Go-SDK: deprecate pkg/atomicwriter, which was migrated to github.com/moby/sys/atomicwriter. moby/moby#49748 in 28.1.0
deprecated Go-SDK: opts: remove deprecated PortOpt, ConfigOpt, SecretOpt aliases. docker/cli#5953 in 28.1.0
deprecated Go-SDK: registry: deprecate APIEndpoint.Official field. moby/moby#49706 in 28.1.0
deprecated Go-SDK: Deprecate cli-plugins/manager.ResourceAttributesEnvvar constant. It was used internally, but holds the OTEL_RESOURCE_ATTRIBUTES name, which is part of the OpenTelemetry specification. Users of this constant should define their own. It will be removed in the next release. docker/cli#5881 in 28.0.2
deprecated Go-SDK: Deprecate opts.PortOpt, opts.ConfigOpt and opts.SecretOpt. These types were moved to the opts/swarmopts package. docker/cli#5907 in 28.0.2
deprecated Go-SDK: Remove service/logs package. docker/cli#5910 in 28.0.2
deprecated Go-SDK: cli/command/image: Deprecate PushTrustedReference and move to cli/trust. docker/cli#5894 in 28.0.2
deprecated Go-SDK: cli/command/image: Deprecate and internalize TrustedPush. docker/cli#5894 in 28.0.2
deprecated Go-SDK: cli/command: deprecate Cli.NotaryClient: use trust.GetNotaryRepository instead. This method is no longer used and will be removed in the next release. docker/cli#5885 in 28.0.2
deprecated Go-SDK: cli/command: deprecate Cli.RegistryClient. This method was only used internally and will be removed in the next release. Use client.NewRegistryClient instead. docker/cli#5889, docker/cli#5889 in 28.0.2
deprecated Go-SDK: registry: Deprecate RepositoryInfo.Official field. moby/moby#49567 in 28.0.2
deprecated Go-SDK: registry: deprecate HostCertsDir: this function was only used internally and will be removed in the next release. moby/moby#49612 in 28.0.2
deprecated Go-SDK: registry: deprecate SetCertsDir: the cert-directory is now automatically selected when running with RootlessKit, and should no longer be set manually. moby/moby#49612 in 28.0.2
deprecated Deprecated and removed features, see Deprecated Features. in 28.0.0
deprecated The deprecated OCI prestart hook is now only used by build containers. For other containers, network interfaces are added to the network namespace after task creation is complete, before the container task is started. moby/moby#47406 in 28.0.0
deprecated API: The BridgeNfIptables and BridgeNfIp6tables fields in the GET /info response are now always be false and will be omitted in API v1.49. The netfilter module is now loaded on-demand, and no longer during daemon startup, making these fields obsolete. moby/moby#49114 in 28.0.0
deprecated API: The error and progress fields in streaming responses for endpoints that return a JSON progress response, such as POST /images/create, POST /images/{name}/push, and POST /build are deprecated. moby/moby#49447 in 28.0.0
deprecated Users should use the information in the errorDetail and progressDetail fields instead. in 28.0.0
deprecated These fields were marked deprecated in API v1.4 (docker v0.6.0) and API v1.8 (docker v0.7.1) respectively, but still returned. in 28.0.0
deprecated These fields will be left empty or will be omitted in a future API version. in 28.0.0
deprecated pkg/sysinfo: deprecate NumCPU. This utility has the same behavior as runtime.NumCPU. moby/moby#49247 in 27.5.0
deprecated pkg/fileutils: deprecate GetTotalUsedFds: this function is only used internally and will be removed in the next release. moby/moby#49209 in 27.5.0
deprecated pkg/ioutils: deprecate BytesPipe, NewBytesPipe, ErrClosed, WriteCounter, NewWriteCounter, NewReaderErrWrapper, NopFlusher, NopWriter, NopWriteCloser. They were only used internally and will be removed in the next release. moby/moby#49246, moby/moby#49255 in 27.5.0
deprecated pkg/reexec: This package is deprecated and moved to a separate module. Use github.com/moby/sys/reexec instead. moby/moby#49135 in 27.5.0
deprecated pkg/system: Deprecate Lstat(), Mkdev(), Mknod(), FromStatT() and Stat() functions, and related StatT types. These were only used internally, and will be removed in the next release. moby/moby#49100 in 27.4.1
deprecated libnetwork/iptables: Deprecate IPV, Iptables and IP6Tables types in favor of IPVersion, IPv4, and IPv6. This type and consts will be removed in the next release. moby/moby#49093 in 27.4.1
deprecated libnetwork/iptables: Deprecate Passthrough. This function was only used internally, and will be removed in the next release. moby/moby#49119 in 27.4.1
deprecated Deprecated and removed features, see Deprecated Features. in 27.2.0
deprecated Deprecated and removed features, see Deprecated Features. in 27.1.2
deprecated Deprecated and removed features, see Deprecated Features. in 27.1.0
deprecated The pkg/rootless/specconv package is deprecated, and will be removed in the next release moby/moby#48185 in 27.1.0
deprecated The pkg/containerfs package is deprecated, and will be removed in the next release moby/moby#48185 in 27.1.0
deprecated The pkg/directory package is deprecated, and will be removed in the next release moby/moby#48185 in 27.1.0
deprecated api/types/system: remove deprecated Info.ExecutionDriver moby/moby#48184 in 27.1.0
deprecated Deprecated and removed features, see Deprecated Features. in 27.0.3
deprecated Deprecated and removed features, see Deprecated Features. in 27.0.2
deprecated Deprecated and removed features, see Deprecated Features. in 27.0.1
deprecated Deprecate non-standard (config) fields in image inspect output. The Config field returned by this endpoint (used for docker image inspect) returned additional fields that are not part of the image's configuration and not part of the [Docker Image Spec] and the [OCI Image Spec]. These fields are… in 27.0.1
deprecated Deprecate the daemon flag --api-cors-header and the corresponding daemon.json configuration option. These will be removed in the next major release. moby/moby#45313 in 27.0.1

Every release in between

29.9.2 Oct 20, 2026 Release notes ↗

otherdocker/cli, 29.9.2 milestone

othermoby/moby, 29.9.2 milestone

securityThe Go runtime update addresses CVE-2026-111943 by rejecting certificate chains that include eight revoked eMudhra intermediate certificates. Image pulls and pushes fail TLS certificate verification if a registry's certificate chain relies on one of the affected TLS intermediates. Affected…

securityDomain-validated TLS: EM DV TLS CA - G3B and EM DV TLS CA - G3C

securityOrganization-validated TLS: EM OV TLS CA - G3B and EM OV TLS CA - G3C

securityExtended-validation TLS: EM EV TLS CA - G3B and EM EV TLS CA - G3C

securityCode signing: EM OV CS CA - G3B and EM OV CS CA - G3C

otherUpdate Go runtime to 1.26.10. moby/moby#53989, docker/cli#7418

29.9.1 Oct 14, 2026 Release notes ↗

otherdocker/cli, 29.9.1 milestone

othermoby/moby, 29.9.1 milestone

securityCVE-2026-95839: Pulling or importing an image through containerd's transfer service could crash containerd if a child descriptor contained the io.containerd.manifest.subject annotation and a malformed digest.

securityGHSA-8647-2jxj-p2rc: An untrusted registry returning a crafted Content-Length header could crash containerd when parallel layer fetching was enabled with concurrent_layer_fetch_buffer.

securityGHSA-hc94-p972-ch66: Pulling a crafted image or pulling from a malicious registry could exhaust host disk space because containerd did not limit incoming layer data to the declared size before validation.

fixFix --link-local-ip accepting addresses that are not link-local (169.254.0.0/16 or fe80::/10) when creating a container or connecting it to a network, which made the container fail to start. moby/moby#53923

fixFix COPY --from in the classic builder failing for files not owned by root when userns-remap is enabled. moby/moby#53859

fixFix docker ps -s and container listing with sizes failing entirely when the size of one container cannot be computed. moby/moby#53921

fixFix docker save leaving image layers on disk after the image is removed, when the image contains the same layer more than once (graph-driver image store). moby/moby#53927

fixFix a daemon panic when using the fluentd log driver with a TLS address that cannot be connected to and fluentd-async enabled. moby/moby#53922

fixFix image digest resolution failing when a registry mirror succeeds but a subsequent registry lookup fails. moby/moby#53933

fixFix plugin privilege lookup reporting success when fetching the plugin fails. moby/moby#53934

otherUpdate containerd (static binaries) to v2.4.2. moby/moby#53936

featureDon't add bridge network interfaces to firewalld's docker zone when iptables and ip6tables are both disabled. moby/moby#53907

fixFix bridge networks failing to restore on daemon startup when their bridge is bound to a firewalld zone other than docker. moby/moby#53907

fixFix --domainname with user namespaces and rootless mode; this requires an OCI runtime supporting the domainname field (such as runc >= v1.2.0). moby/moby#53899

otherUpdate RootlessKit to v3.3.0. moby/moby#53942

29.9.0 Oct 8, 2026 Release notes ↗

otherdocker/cli, 29.9.0 milestone

othermoby/moby, 29.9.0 milestone

securityCVE-2026-97032: An HTTP/2 client could crash the daemon by changing the HPACK header table size while sending requests. golang/go#81867

securityCVE-2026-78659: An HTTP/2 client could exhaust daemon memory by declaring a large number of fields in a Trailer header, bypassing the header size limits. golang/go#81857

securityCVE-2026-78663: An HTTP/2 client could bypass the connection-level flow control limit by resetting streams, making the daemon buffer more request data than the limit allows. golang/go#81743

securityCVE-2026-78669: An HTTP/2 client could cause excessive daemon CPU use by opening many streams and repeatedly changing the initial window size. golang/go#81742

securityCVE-2026-56857: On Windows, the daemon could create a directory outside its data root if someone with write access to the data root had placed a junction there. golang/go#81739

fixcontainerd image store: Add the lazy-pull daemon feature to control whether docker pull skips downloading layer content that the snapshotter already provides. Lazy pulls are enabled by default for known remote snapshotters (nydus, overlaybd, soci, stargz). moby/moby#53877

fixcontainerd image store: Fix pulls skipping required layer blobs when unpacked layers already exist, leaving images runnable but incomplete for export or push. moby/moby#53615

fixFix docker container create --name reporting a misleading validation error mentioning invalid characters instead of invalid name length. moby/moby#53484

fixFix a connection leak to the RootlessKit API socket on every GET /version request in rootless mode. moby/moby#53836

fixImprove Windows service registration and unregistration cleanup, including making service unregistration (--unregister-service) idempotent. moby/moby#53845

otherUpdate BuildKit to v0.34.0. moby/moby#53882

otherUpdate Go runtime to 1.26.9. docker/cli#7363

otherUpdate containerd (static binaries) to v2.4.1. moby/moby#53773

featureAllow IPv6 Neighbour Discovery between containers on a bridge network with inter-container communication disabled, matching the existing IPv4 behaviour. moby/moby#53723

fixFix docker ps and GET /containers/json omitting published ports for networks using routed gateway mode. moby/moby#53693

fixFix a bug where a restarted daemon could be dropped from a peer's service discovery and load balancing until it rejoined the gossip cluster. moby/moby#53688

fixFix a published port being unreachable from another container on the same network when inter-container communication is disabled, including Swarm services published through the routing mesh. moby/moby#53723

fixFix an issue where errors programming the kernel to encrypt the overlay network data-plane could in some circumstances lead to encrypted-overlay-network traffic to some nodes being transmitted in cleartext. As the receiving peer would drop cleartext packets for encrypted overlay networks as…

fixFix connecting live-restored containers with an implicit host-gateway mapping to additional networks. moby/moby#53093

fixFix overlay peers becoming unreachable after a node rejoins the cluster or a service is redeployed, when the VXLAN device had already learned a dynamic FDB entry for the peer. moby/moby#53663

fixFix Swarm tasks on overlay networks being rejected when the daemon can't write to /var/lib/docker. moby/moby#53848

featurePublished Swarm-service ports are accessible at the host's IPv6 addresses when the userland proxy is enabled. A change introduced in v29.8.0 incidentally enabled this functionality; it is a tested and supported feature as of v29.9.0. moby/moby#53727

securityRelease a node's IPsec security associations and policies when the last container leaves an encrypted overlay network, instead of leaking them until the daemon restarts. moby/moby#53420

otherRestore the logic to remove the empty DOCKER-INGRESS iptables chain, and the FORWARD rule that jumps to it, left behind by Docker Engine 28.0.0 and earlier. moby/moby#53825

otherUpdate RootlessKit (3.2.0). moby/moby#53607

29.8.2 Sep 30, 2026 Release notes ↗

otherdocker/cli, 29.8.2 milestone

othermoby/moby, 29.8.2 milestone

securityCVE-2026-53493: Pulling a crafted OCI image index with deeply nested or widely fanned-out descriptors could cause unbounded CPU and memory use. GHSA-pg57-6jwg-q645

securityCVE-2026-92543: A malicious DNS response could make registry connections skip TLS certificate verification or fall back to HTTP, exposing registry credentials or allowing image substitution. GHSA-7cfq-22r6-qp73

securityCVE-2026-92542: Unprivileged users on a Swarm node could inject forged Ethernet frames into encrypted overlay networks on peer nodes. GHSA-6m9p-4h64-m6vh

securityCVE-2026-93315: A build step could redirect proxy CA cleanup outside the build root filesystem, block it with a special file, or let the build succeed when cleanup failed. GHSA-2f5p-x9ph-g97x

securityCVE-2026-93316: A build that requested CDI devices could cause a daemon panic when CDI support was disabled, for example with "features": {"cdi": false} in daemon.json. GHSA-r456-g3gm-cvxf

securityCVE-2026-93317: With the containerd image store, a client using the low-level LLB API could poison the build cache with container blob contents that did not match their claimed digest. GHSA-p3rc-w3hc-pqvv

securityCVE-2026-93318: A malicious image could poison the build cache with layer DiffIDs that did not match the actual layer contents. GHSA-f2v9-hprr-32q3

securityCVE-2026-93319: A malicious external frontend could crash the daemon through gateway container lifecycle races or malformed requests and definitions. GHSA-4hgw-qrhw-fhg8

securityCVE-2026-93320: Daemon-side snapshot reads and LLB mkfile operations did not safely handle special files. GHSA-9728-qjrv-2xh2

securityCVE-2026-93321: A malformed LLB file operation with invalid symlink owner inputs could crash the daemon. GHSA-fjj4-h6vf-m9hj

securityCVE-2026-93322: A malformed LLB merge operation with mismatched input counts could crash the daemon. GHSA-cv6p-7w7g-xjwq

securityCVE-2026-93323: An oversized Dockerfile, .dockerignore, gateway file, or nested LLB definition could exhaust daemon memory. GHSA-mgqf-486f-49vp

securityCVE-2026-93326: A crafted Git build source could bypass source policy rules that match on the repository URL, through a Git bundle locator or a full remote URL that did not match the source identifier. GHSA-66hf-6vf5-87hc

fixFix docker cp failing on a container with a bind-mounted socket nested inside another bind mount. moby/moby#53724

fixFix docker info failing with an “invalid Prefix” error after reloading a daemon with custom default address pools. moby/moby#53812

otherUpdate BuildKit to v0.33.1. moby/moby#53823

otherUpdate containerd (static binaries) to v2.3.6. moby/moby#53778

otherUpdate runc (in static binaries) to v1.5.2. moby/moby#53811

29.8.1 Sep 15, 2026 Release notes ↗

otherdocker/cli, 29.8.1 milestone

othermoby/moby, 29.8.1 milestone

fixcontainerd image store: Fix docker load leaving dangling images after loading an image that already exists. moby/moby#53595

fixFix managed containerd logging a CRI pod-sandbox plugin dependency warning during startup. moby/moby#53585

fixFix user-namespace detection on OpenVZ, where namespace inode numbers are virtualized. moby/moby#53605

fixWindows: Preserve hard links when committing a container, so a file with multiple names is stored once in the resulting image layer instead of once per name. moby/moby#53624

otherUpdate containerd (static binaries) to v2.3.5. moby/moby#53589

fixFix GET /networks returning a 500 status if an invalid 'type' filter was provided. moby/moby#53678

29.8.0 Sep 3, 2026 Release notes ↗

otherdocker/cli, 29.8.0 milestone

othermoby/moby, 29.8.0 milestone

featureAdd HostConfig.Umask option and a corresponding --umask flag to docker create/docker run to set the umask for a container's main process, execs, and healthchecks. moby/moby#53463, docker/cli#7108

featureAdd support for attaching service names, environments, and custom CloudWatch entity attributes to logs from the awslogs logging driver. moby/moby#52632

securityAdd daemon support for configuring the default container AppArmor profile template. moby/moby#52771

securityPrevent containers from using the 32-bit socketcall(2) path to create AF_VSOCK sockets and communicate with host virtual machines by adding AppArmor and SELinux policy rules. moby/moby#53551

fixFix docker network inspect failing to find a healthy Swarm network when another Swarm network could not be allocated. moby/moby#53325

fixFix a node gossiping a superseded value for a Swarm service discovery entry after concurrent updates to the same key. moby/moby#53479

fixFix Swarm service names failing to resolve on a node indefinitely after it misses a network membership announcement. moby/moby#53437

fixFix Swarm service names failing to resolve on healthy nodes after a transient node failure. moby/moby#53142

otherPrevent dockerd from hanging when the nft command produces enough stderr output to fill its pipe. moby/moby#53517

otherReduce gossip traffic generated by a node that repeatedly disconnects and rejoins the cluster. moby/moby#53479

otherRemote network-driver plugins can now set the container-side interface name via the DstName field in their Join response. moby/moby#52866

otherReserve network names "container" and "container:" to prevent creation of unusable networks. moby/moby#51973

otherSpread the daemon's periodic Swarm overlay network gossip and synchronization work over time, avoiding recurring bursts of CPU and network usage. moby/moby#53475

otherSwarm service-mesh published ports now use the same infrastructure as published ports for local containers. moby/moby#53118

fixFix --disable-host-loopback not being enforced for the pasta network driver in rootless mode. moby/moby#53358

featureUpdate RootlessKit to v3.1.0, adding support for the pesto port driver in rootless mode. Set DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=pesto to use it; it requires the pasta network driver and supports IPv4 only. moby/moby#53358

otherUpdate minimum supported Go version to 1.26. docker/cli#7258

fixAdd annotation filter to container listings (docker ps, GET /containers/json) allowing to filter containers by their annotations. moby/moby#53538

fixcontainerd image store: Fix docker image inspect reporting a smaller image size than docker image ls. moby/moby#53426

fixcontainerd image store: Fix slower image pulls caused by repeated registry authentication within a single pull. moby/moby#53497

fixDo not log expected image signature identity misses as errors for containerd image store images. moby/moby#53495

fixdockerd now uses the embedded containerd if no system containerd service is configured and containerd is not installed. moby/moby#53388

fixFix GET /images/{name}/json not including unpacked snapshot usage in Size when using the containerd image store. moby/moby#53426

fixFix classic-builder cache for Dockerfile stages that select a non-host platform with FROM --platform. moby/moby#53503

fixFix CLI panic when DOCKER_HOST or -H specifies an invalid host. docker/cli#7280

fixFix health checks being delayed for too long when the start interval is longer than the start period. moby/moby#52317

fixFix inconsistent mount ordering in docker inspect output (GET /containers/{id}/json) and container listings (docker ps, GET /containers/json). moby/moby#53534

fixFix NRI container metadata so Container.Args includes the resolved executable as argv[0], matching the process launched in the container instead of only the Docker Cmd. moby/moby#53423

fixFix Swarm service creation failing when an automatically generated name is already in use. moby/moby#53468

fixFix the container root directory / being world-writable when using the btrfs storage driver. moby/moby#53500

fixFixed docker ps sorting published ports lexicographically instead of numerically. docker/cli#7144

fixPreserve service mount order during forced updates to avoid an unnecessary rollout on the next stack deploy. docker/cli#7227

fixPrevent containerd's v2 CRI plugins from loading when CRI is disabled. moby/moby#53564

fixPrint plugin hook output (e.g. the "What's next:" hint) after the command's error message instead of before it. docker/cli#6976

fixReject checkpoint IDs containing path separators to prevent access outside the container checkpoint directory. moby/moby#53377

otherUpdate BuildKit to v0.33.0. moby/moby#53554

otherUpdate containerd (static binaries) to v2.3.4. moby/moby#53409

otherUpdate Go runtime to 1.26.8. moby/moby#53550, docker/cli#7274

+1 more item in the release notes

29.7.2 Aug 6, 2026 Release notes ↗

otherdocker/cli, 29.7.2 milestone

othermoby/moby, 29.7.2 milestone

fixFix docker service create and docker service update panicking when the same environment variable is passed more than once. docker/cli#7145

fixFix a regression introduced in Docker Engine 29.7.0 that caused image pulls to reject images containing absolute hardlink targets, as produced by some image builders. moby/moby#53305

fixFix a regression introduced in Docker Engine 29.7.0 that could cause image pulls and docker cp to fail on older Linux kernels when applying file permissions, including for device nodes. moby/moby#53305

otherUpdate BuildKit to v0.32.2. moby/moby#53300

otherImprove compatibility with more nftables releases by terminating base-chain policies with a semicolon. moby/moby#53303

29.7.1 Jul 31, 2026 Release notes ↗

otherdocker/cli, 29.7.1 milestone

othermoby/moby, 29.7.1 milestone

fixFix a regression that prevented pulling images whose layers contain directories without explicit parent directory entries. moby/moby#53260

fixFix a regression where the CopyToContainer rejects container paths that traverse absolute symlinks, such as /var/run -> /run. moby/moby#53261

29.7.0 Jul 30, 2026 Release notes ↗

otherdocker/cli, 29.7.0 milestone

othermoby/moby, 29.7.0 milestone

featureAdd an experimental embedded-containerd feature that runs containerd inside the daemon process instead of as a separate managed process. moby/moby#52898

featureMount type image is no longer experimental. moby/moby#52998

featureAdd the default-stop-timeout daemon option to configure the stop timeout assigned to containers without an explicit timeout. moby/moby#53146

securityUpdate github.com/moby/go-archive to v0.3.0 to fix CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h. moby/moby#53247, docker/cli#7139

fixFix a daemon panic when cleanup of a container's network interface fails while the container is being disconnected from a network. moby/moby#53237

fixFix a daemon panic when removing swarm ingress ports after failing to bind an ingress proxy listener. moby/moby#53022

otherKeep the cgroup mount for containers with --net=host. moby/moby#52318

fixAdd shell completion for --filter names and known values to docker service ls, docker service ps, and docker node ps. docker/cli#7124

fixcontainerd image store: Fix daemon-wide concurrent download and upload limits for pulls and pushes not being honored. moby/moby#53081

fixTo preserve the previous unlimited startup behavior, configure "max-concurrent-downloads" and "max-concurrent-uploads" to 0

fixFix docker cp -a using the wrong file owner when copying files into containers with user namespace remapping enabled. moby/moby#53084

fixFix docker cp from a Windows container silently returning a file instead of an error when the source path ends with a separator but is not a directory. moby/moby#53123

fixFix docker stats reporting all zeros for running Windows containers when using the containerd runtime. moby/moby#53101

fixFix docker stats reporting empty network stats for running Windows containers when using the containerd runtime. moby/moby#53219

fixFix a typo in the docker create --pull flag description. docker/cli#7103

fixFix Swarm service updates failing due to "file exists" errors when a VIP IP alias already exists on the LB endpoint interface. moby/moby#51657

fixFix Swarm tasks being rejected when their image could not be pulled from the registry but was already present on the node. moby/moby#53212

fixImprove the error returned when a container hostname exceeds Linux's 64-byte limit. moby/moby#53121

fixPrevent live-restored volumes from retaining active mount references when containers exit during daemon startup. moby/moby#53115

fixSuppress the “No such container” error when docker rm --force succeeds for a nonexistent container. docker/cli#7110

otherUpdate Go runtime to 1.26.5. docker/cli#7087

otherUpdate BuildKit to v0.32.0. moby/moby#53234

otherUpdate containerd (static binaries) to v2.3.3. moby/moby#53050

otherUpdate runc (in static binaries) to v1.4.3. moby/moby#50960

29.6.2 Jul 16, 2026 Release notes ↗

otherdocker/cli, 29.6.2 milestone

othermoby/moby, 29.6.2 milestone

securityCVE-2026-15793: Git source checkout from a bundle file could lead to command injection. GHSA-hw3h-2gp9-cxpv

securityCVE-2026-15792: Incorrect parameters sent from a frontend could cause a panic. GHSA-qx3x-mv6r-52p6

securityCVE-2026-15791: An LLB file operation could be tricked into removing the contents of the /tmp directory. GHSA-32pv-7hq5-qhwq

securityCVE-2026-15789: A malicious client could bypass destination directory validation when uploading local sources. GHSA-g2h8-426c-7976

securityCVE-2026-15788: A WCOW cache mount source selector could resolve NTFS junctions outside of the cache root. GHSA-388v-wmr2-g2v2

otherUpdate containerd (static binaries) to v2.2.6. moby/moby#53051

otherUpdate Go runtime to 1.26.5. moby/moby#53027

otherUpdate RootlessKit to v3.0.2. moby/moby#53054

29.6.1 Jun 26, 2026 Release notes ↗

otherdocker/cli, 29.6.1 milestone

othermoby/moby, 29.6.1 milestone

securityA malicious image could supply a malicious /etc/passwd or /etc/group-style file causing excessive memory consumption, potentially resulting in process termination due to Out Of Memory (OOM) conditions. GHSA-mjcv-p78q-w5fw, GHSA-jpcc-p29g-p8mq, GHSA-72x6-4j93-7w86

securityA custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the security.insecure entitlement. Other security measures, like Linux capabilities were still applied to these containers.…

fixUpdate containerd (static binaries) to v2.2.5. moby/moby#52950

otherUpdate BuildKit to v0.31.1. moby/moby#52954

29.6.0 Jun 18, 2026 Release notes ↗

otherdocker/cli, 29.6.0 milestone

othermoby/moby, 29.6.0 milestone

featurePOST /containers/{id}/update now supports per-device blkio resource settings. moby/moby#52651

featureAdd GET /images/{name}/attestations endpoint to retrieve in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image. Supports optional platform selection, predicate type filtering, and a statement query parameter for verbatim statement bodies.

fixdocker image push now respects NO_COLOR. docker/cli#6957

fixcontainerd image store: Fix docker system prune to include unpacked image data when reporting reclaimed space. moby/moby#52905

fixFix docker system df image size reporting to count only snapshots directly used by images. moby/moby#52901

fixFix a bug where registry authentication failures during worker image pulls were reported as a misleading “No such image” error. moby/moby#52698

fixFix default BuildKit GC policy to prune reproducible cache types as intended. moby/moby#52814

fixFix explicit file modes being filtered by the daemon umask, including COPY --chmod permissions. moby/moby#52892

fixFix image selection with the containerd image store on amd64 hosts when images provide amd64 variant-specific manifests. moby/moby#52773

fixThe --password flag on docker login now accepts - to pass the password through STDIN as alternative to --password-stdin. docker/cli#7029

otherUpdate runc (in static binaries) to v1.3.6. moby/moby#52883

otherUpdate BuildKit to v0.31.0. moby/moby#52904

featureAllow the nftables firewall mode to be used with a daemon that is linked against libnftables when the nft command is not installed on the system. moby/moby#52820

otherDon't publish container ports on host ports listed in net.ipv4.ip_local_reserved_ports when dynamically allocating ports. moby/moby#52818

fixFix a race condition in overlay network bulk sync that caused ~30s DNS resolution delays on newly joined swarm nodes. moby/moby#52862

fixMitigate a crash in libnftables when using nftables as the firewall backend by changing the default build option to execute the nft command instead. Users building dockerd from source can opt into linking against libnftables by building with the libnftables build tag. moby/moby#52886

otherSilence the spurious warning "IPv4 forwarding is disabled". moby/moby#52742

deprecatedThe Engine now returns a deprecation warning when a container connected to the default bridge is created with links specified. moby/moby#47427

29.5.3 Jun 3, 2026 Release notes ↗

otherdocker/cli, 29.5.3 milestone

othermoby/moby, 29.5.3 milestone

fixReduce docker system df errors when images are pruned at the same time with the containerd image store. moby/moby#52672

otherUpdate containerd (static binaries only) to v2.2.4. moby/moby#52683

otherUpdate Go runtime to 1.26.4. moby/moby#52753, docker/cli#7025

otherUpdate RootlessKit to v3.0.1. moby/moby#52710

fixFix AWS IMDS access with gvisor-tap-vsock and UDP port forwarding for non-loopback clients. moby/moby#52710

fixFix installation of plugins that require host networking. moby/moby#52735

29.5.2 May 20, 2026 Release notes ↗

otherdocker/cli, 29.5.2 milestone

othermoby/moby, 29.5.2 milestone

fixFix docker cp failing with "mkdirat: file exists" when a container has a bind mount whose target traverses an in-container symlink (e.g. /var/run -> /run). moby/moby#52655

29.5.1 May 18, 2026 Release notes ↗

otherdocker/cli, 29.5.1 milestone

othermoby/moby, 29.5.1 milestone

securityCVE-2026-41567 Fix a vulnerability in docker cp where archive decompression binaries (e.g. xz, unpigz) were resolved via PATH inside the container filesystem while running as host root, allowing a malicious container to execute arbitrary binaries with host root privileges. GHSA-x86f-5xw2-fm2r

securityCVE-2026-41568 Fix a TOCTOU vulnerability in docker cp that allowed a container process to create files or directories at arbitrary locations on the host filesystem. GHSA-vp62-88p7-qqf5

securityCVE-2026-42306 Fix a TOCTOU vulnerability in docker cp that allowed a container process to redirect a bind mount to an arbitrary location on the host filesystem. GHSA-rg2x-37c3-w2rh

fixFix UDP conntrack entries not being deleted when not bound to a specific IP address. moby/moby#52640

29.5.0 May 14, 2026 Release notes ↗

otherdocker/cli, 29.5.0 milestone

othermoby/moby, 29.5.0 milestone

featureRootless: Add new default gvisor-tap-vsock network driver. moby/moby#52319

featureEnable private time namespace for containers by default on supported kernels. moby/moby#52326

featureThe local logging driver now has support for custom attributes, adding support for the label, label-regex, env, env-regex, and tag log options. moby/moby#52348

featureWindows: The daemon now supports listening on a Unix socket (-H unix://...), with optional group-based access control via --group. moby/moby#52365

securityCVE-2026-32288: Fix a denial of service where pulling a maliciously crafted image could cause the daemon to allocate unbounded memory when processing sparse tar archives. GHSA-x4jj-h2v8-hqqv. moby/moby#52478

fixdocker ps --format now supports a .HealthStatus placeholder to print container health state (starting, healthy, unhealthy) as a dedicated field. docker/cli#6913

fixAdd "time-namespaces" feature flag to disable time-namespaces. moby/moby#52577

fixcontainerd integration: Fix auth token requests ignoring per-host TLS settings (custom CAs, insecure-registries). moby/moby#52600

fixDaemon reload events now signify that the daemon reload has fully completed. moby/moby#52589

fixExpose diagnostic data about userland proxy in docker info. moby/moby#52321

fixFix docker image ls --filter reference=... (GET /images/json) to also match fully qualified canonical image names (e.g. docker.io/library/alpine), not only the familiar short form. moby/moby#52333

fixFix a bug where leaving an autolock-enabled swarm could leave orphaned state, causing subsequent swarm init to fail with "Swarm is encrypted and needs to be unlocked". moby/moby#52479

fixFix an issue where logging errors appeared as empty strings in the daemon log instead of the message that failed to write. moby/moby#52442

fixFix incorrect SHARED SIZE and UNIQUE SIZE reporting in docker system df -v by including shared content blobs in size calculation. moby/moby#52482

fixFix support for CDI specifications that request additional group IDs. moby/moby#52579

fixFix volume subpath file mounts over an existing file in the image failing container creation with "not a directory". moby/moby#52584

fixSort labels in volume, network, config, and secret formatters for deterministic output. docker/cli#6954

fixSwarm: Prevent corruption of Raft snapshots when swarm state is large. moby/moby#52441

otherUpdate BuildKit to v0.30.0. moby/moby#52618

otherUpdate Go runtime to 1.26.3. moby/moby#52572, docker/cli#6967

fixFix conntrack entries being incorrectly deleted for UDP containers sharing the same port on different IPs when one container is restarted. moby/moby#52423

fixFix stale VIP DNS records for swarm service network aliases not being removed during rolling updates. moby/moby#52236

fixFix the userland proxy silently dropping UDP datagrams when a previous write to an unavailable backend left a stale ECONNREFUSED error on the socket. moby/moby#52483

otherRootless: Properly support --net=host and localhost registries. moby/moby#47103

otherUpdate RootlessKit to v3.0.0. moby/moby#52319

othercli/config/configfile: GetAuthConfig, GetCredentialsStore: normalize hostname when resolving auth. docker/cli#6846

deprecatedcli/command/image/build: remove deprecated DefaultDockerfileName const. docker/cli#6737

deprecatedcli/command/image/build: remove deprecated DetectArchiveReader util. docker/cli#6737

deprecatedcli/command/image/build: remove deprecated IsArchive utility. docker/cli#6737

deprecatedcli/command/image/build: remove deprecated ResolveAndValidateContextPath util. docker/cli#6737

deprecatedcli/command/image/build: remove deprecated WriteTempDockerfile util. docker/cli#6737

29.4.3 May 6, 2026 Release notes ↗

otherdocker/cli, 29.4.3 milestone

othermoby/moby, 29.4.3 milestone

securityCVE-2026-31431: Fix the 29.4.2 regression that broke 32-bit programs and i386 images. The broad socketcall(2) seccomp deny is replaced with targeted AppArmor (deny network alg) and SELinux (alg_socket) rules that block AF_ALG at the LSM layer, covering both socket(2) and socketcall(2) paths…

fixFix the default AppArmor profile not being updated on daemon restart, requiring a system reboot to pick up profile changes from daemon upgrades. moby/moby#52537

29.4.2 May 1, 2026 Release notes ↗

otherdocker/cli, 29.4.2 milestone

othermoby/moby, 29.4.2 milestone

securityThis release includes hardening for CVE-2026-31431.

securityBlock AF_ALG sockets and the socketcall(2) multiplexer in the default seccomp profile to prevent in-container privilege escalation via the kernel crypto API ("Copy Fail"). moby/moby#52501

securityIf you need a workaround, use the seccomp/v0.2.1 profile from moby/profiles. Make sure you use a kernel that includes the fix for CVE-2026-31431.

security[!IMPORTANT] Use this workaround only for containers that require it. Containers that use this profile can still exploit CVE-2026-31431 through the socketcall syscall.

securityTo use the profile for a specific container when you control the docker run command, use --security-opt:

featureTo use the profile as the default for containers created by the daemon, add seccomp-profile to your daemon.json:

29.4.1 Apr 20, 2026 Release notes ↗

otherdocker/cli, 29.4.1 milestone

othermoby/moby, 29.4.1 milestone

fixcontainerd image store: Fix docker image prune --filter label!=key=value incorrectly skipping images that don't have the specified label. moby/moby#52338

fixFix --log-opt "tag={{.ImageID}}" not stripping the digest's algorithm. moby/moby#52343

fixFix intermittent container start failures (EBUSY on secrets/configs remount) on busy Swarm nodes by retrying the read-only remount. moby/moby#52235

otherUpdate containerd (static binaries only) to v2.2.3. moby/moby#52360

otherUpdate Go runtime to 1.26.2. docker/cli#6920, moby/moby#52329

otherif a container has an IPv4-only or an IPv6-only endpoint with higher "gateway priority" than a dual stack endpoint, the single stack endpoint will now be used as the default gateway for its address family. moby/moby#52328

29.4.0 Apr 7, 2026 Release notes ↗

otherdocker/cli, 29.4.0 milestone

othermoby/moby, 29.4.0 milestone

fixdocker cp: report both content size and transferred size. docker/cli#6800

fixFix docker stats --all still showing containers that were removed. docker/cli#6863

fixFix a rare bug that could cause containers to become unremovable. moby/moby#51724

fixFixed privileged containers losing their explicit AppArmor profile (--security-opt apparmor=) after a container restart. moby/moby#52215

fixImproved duplicate container-exit handling by using live containerd task state (not timestamps). moby/moby#52156

fixImproved image pull and push performance by enabling HTTP keep-alive for registry connections, avoiding redundant TCP and TLS handshakes. moby/moby#52198

fixshell completions: add shell completion for docker rm --link and exclude legacy links for container names. docker/cli#6872

fixshell completions: don't provide completions that were already used. docker/cli#6871

fixUpdate runc (in static binaries) to v1.3.5. moby/moby#52244

fixWindows: Fix DOCKER_TMPDIR not being respected. moby/moby#52181

otherUpdate BuildKit to v0.29.0. moby/moby#52272

fixPrevent a daemon crash during startup after upgrading if a container config containers a malformed IP-address. moby/moby#52275

othercli/streams: Out, In: preserve original os.File when available. docker/cli#6906

otherUpdate minimum go version to go1.25. docker/cli#6897

deprecatedGo SDK: cli-plugins/hooks: deprecate HookMessage and rename to cli-plugins/hooks.Response. docker/cli#6859

deprecatedGo SDK: cli-plugins/hooks: deprecate HookType and rename to cli-plugins/hooks.ResponseType. docker/cli#6859

deprecatedGo SDK: cli-plugins/manager: deprecate HookPluginData and move to cli-plugins/hooks.Request. docker/cli#6859

29.3.1 Mar 25, 2026 Release notes ↗

otherdocker/cli, 29.3.1 milestone

othermoby/moby, 29.3.1 milestone

securityCVE-2026-34040 Fix an authorization bypass in AuthZ plugins that could allow authorization plugins to be bypassed under specific conditions. GHSA-x744-4wpc-v9h2

securityCVE-2026-33997 Fix a flaw in docker plugin install where privilege validation could be partially bypassed, potentially leading to unauthorized privilege escalation. GHSA-pxq6-2prw-chj9

securityCVE-2026-33748 Fix insufficient validation of Git URL #ref:subdir fragments in BuildKit, which could allow access to files outside the intended repository scope. GHSA-4vrq-3vrq-g6gg

securityCVE-2026-33747 Fix a vulnerability in BuildKit where an untrusted frontend could cause files to be written outside the BuildKit state directory. GHSA-3c29-8rgm-jvjj

fixFix a daemon crash during docker build if .dockerignore contained an invalid pattern. moby/moby#52214

fixFix a panic when the containerd client uses a closed stream. moby/moby#52211

otherUpdate containerd (static binaries) to v2.2.2. moby/moby#52213

otherUpdate Go runtime to 1.25.8. moby/moby#52210, docker/cli#6883

featureAdd missing build-tag, which could cause cannot range over 10 (untyped int constant) when importing the cli/command package. docker/cli#6884

29.3.0 Mar 5, 2026 Release notes ↗

otherdocker/cli, 29.3.0 milestone

othermoby/moby, 29.3.0 milestone

featureAdd bind-create-src option to --mount flag for bind mounts. docker/cli#6792

featureCLI plugin hooks now fire on command failure (not just success), and plugins can use "error-hooks" to show hints only when commands fail. docker/cli#6794

featureLower minimum API version from v1.44 to v1.40 (Docker 19.03). moby/moby#52067

otherUpdate BuildKit to v0.28.0. moby/moby#52135

fixFix DNS config corruption on daemon reload. moby/moby#52060

featurePOST /networks/{id}/connect now correctly applies the MacAddress field in EndpointSettings. This field was added in API v1.44, but was previously ignored. moby/moby#52040

otherGET /images/json now supports an identity query parameter. When set, the response includes manifest summaries and may include an Identity field for each manifest with trusted identity and origin information. moby/moby#52030

fixThe --gpus option now uses CDI-based injection for AMD GPUs. moby/moby#52048

fixAdd sd_notify "RELOADING" notifications when signalling the daemon to reload its configuration. moby/moby#52041

fixSend sd_notify "READY" and "STOPPING" synchronously to make sure they are sent before we proceed. moby/moby#52041

fixAdd support for the systemd 253 Type=notify-reload service reload protocol. moby/moby#52041

fixDon't log "failed to determine if container is already mounted" warnings for stopped containers during startup. moby/moby#52076

fixFix docker system prune failing with "rw layer snapshot not found" when a container is concurrently removed. moby/moby#52090

fixFix a panic when running docker top on a non-running Windows container. moby/moby#52025

fixFix a regression in v29.2.0 that prevented registering the dockerd service on Windows if system requirements were not yet installed. moby/moby#52006

fixFix shared mount detection for paths mounted multiple times, which caused "not a shared mount" errors when using bind propagation. moby/moby#51787

fixFix spurious "ShouldRestart failed" warning on shutdown. moby/moby#52079

fixPreserve leading and trailing whitespace when storing registry passwords. docker/cli#6784

fixPrevent logging "not found" warnings when calculating volume sizes. moby/moby#52018

fixUpdate Go runtime to 1.25.7. moby/moby#52003, docker/cli#6780

29.2.1 Feb 2, 2026 Release notes ↗

otherdocker/cli, 29.2.1 milestone

othermoby/moby, 29.2.1 milestone

fixUpdate BuildKit to v0.27.1. moby/moby#51962

fixFix docker system df failing when run concurrently with docker system prune. moby/moby#51979

fixFix daemon handling of duplicate container exit events to avoid repeated cleanup and state transitions. moby/moby#51925

fixFix panic after failed daemon initialization. moby/moby#51943

fixFix encrypted overlay networks not passing traffic to containers on v28 and older Engines. Encrypted overlay networks will no longer pass traffic to containers on v29.2.0 thru v29.0.0, v28.2.2, v25.0.14 or v25.0.13. moby/moby#51951

fixFix potential panic on docker network prune. moby/moby#51966

29.2.0 Jan 26, 2026 Release notes ↗

otherdocker/cli, 29.2.0 milestone

othermoby/moby, 29.2.0 milestone

featuredocker info now includes NRI section. docker/cli#6710

featureAdd experimental NRI support. moby/moby#51711, moby/moby#51712, moby/moby#51675, moby/moby#51674, moby/moby#51636, moby/moby#51634

featureNew Identity field has been added to the inspect endpoint to show trusted origin information about the image. This includes build ref for locally built images, remote registry repository for pulled images, and verified signature information for images that contain a valid signed provenance…

fixImprove validation of --detach-keys command-line options. docker/cli#6742

fixPrevent a potential panic on daemon shutdown after an incomplete initialization. moby/moby#51797

fixRemove restriction on anonymous read-only volumes. moby/moby#51682

fixThe --validate flag on dockerd now also verifies system requirements, allowing for system requirements to be checked before starting the daemon. moby/moby#51868

fixHandle --gpus requests for NVIDIA devices using CDI if possible. moby/moby#50228

otherUpdate BuildKit to v0.27.0. moby/moby#51886

otherUpdate containerd (static binaries only) to v2.2.1. moby/moby#51765

otherRootless: Consider $XDG_CONFIG_HOME/cdi and $XDG_RUNTIME_DIR/cdi when looking for CDI devices. moby/moby#51624

otherUpdate RootlessKit to v2.3.6. moby/moby#51757

otherNatively support gRPC on the listening socket. moby/moby#50744

featurecli/command: add WithAPIClientOptions option. docker/cli#6740

deprecatedRemove %PROGRAMDATA%\Docker\cli-plugins from the list of paths used for CLI plugins on Windows. This path was present for backward compatibility with old installation, but replaced by %ProgramFiles%\Docker\cli-plugins. docker/cli#6713

29.1.5 Jan 16, 2026 Release notes ↗

otherdocker/cli, 29.1.5 milestone

othermoby/moby, 29.1.5 milestone

otherUpdate Go runtime to 1.25.6. moby/moby#51860, docker/cli#6750

fixFixed a regression where established network connections could be disrupted during a container's shutdown grace period. moby/moby#51843

29.1.4 Jan 9, 2026 Release notes ↗

otherdocker/cli, 29.1.4 milestone

othermoby/moby, 29.1.4 milestone

fixFix docker run --network none panic on Windows. moby/moby#51830

fixFix image mounts failing with "file name too long" for long mount paths. moby/moby#51829

fixFix potential creation of orphaned overlay2 layers. moby/moby#51826, moby/moby#51824

otherUpdate BuildKit to v0.26.3. moby/moby#51821

29.1.3 Dec 12, 2025 Release notes ↗

otherdocker/cli, 29.1.3 milestone

othermoby/moby, 29.1.3 milestone

fixAdd shell completion for docker stack deploy --compose-file. docker/cli#6690

fixcontainerd image store: Fix a bug causing docker build to ignore the explicitly set unpack image exporter option. moby/moby#51514

fixFix docker image ls dangling image handling. docker/cli#6704

fixFix a bug that could cause the Engine to leave containers with autoremove set in 'dead' state on shutdown, and never reclaim them. moby/moby#51693

fixFix build on i386. moby/moby#51528

fixFix explicit graphdriver configuration ("storage-driver") being treated as containerd snapshotter when prior graphdriver state exists. moby/moby#51516

fixFix potential creation of orphaned overlay2 layers. moby/moby#51703

featureAllow creation of a container with a specific IP address when its networks were not configured with a specific subnet. moby/moby#51583

fixDon't crash when starting a container created via the API before upgrade to v29.1.2, with PublishAll and a nil PortBindings map. moby/moby#51691

fixFix a bug preventing DNS resolution of containers attached to non swarm-scoped networks once the node has joined a Swarm cluster. moby/moby#51515

fixFix an issue that caused daemon crash when using a remote network driver plugin. moby/moby#51558

fixFix an issue that could lead to an "endpoint not found" error when creating a container with multiple network connections, when one of the networks is non-internal but does not have its own external IP connectivity. moby/moby#51538

fixFix an issue that prevented rootless Docker from starting on a host with IPv6 disabled. moby/moby#51543

otherReturn an error when a container is created with a port-mapping pointing to container port 0. moby/moby#51695

29.1.2 Dec 2, 2025 Release notes ↗

otherdocker/cli, 29.1.2 milestone

othermoby/moby, 29.1.2 milestone

securityUpdate Go runtime to 1.25.5. moby/moby#51648, docker/cli#6688

securityFixes a potential DoS via excessive resource usage when formatting hostname validation errors CVE-2025-61729

securityFixes incorrect enforcement of excluded subdomain constraints for wildcard SANs, which could allow improperly trusted certificates CVE-2025-61727

fixcontainerd image store: Fix docker image inspect failing to return available image data in case where not all distributable blobs are available locally. moby/moby#51629

fixdockerd-rootless-setuptool.sh: fix nsenter: no namespace specified. moby/moby#51622

fixFix docker system df showing N/A for shared size and unique size when using graph-drivers as storage. moby/moby#51631

otherUpdate runc (in static binaries) to v1.3.4. moby/moby#51633

fixFix a bug preventing port mappings in rootless mode when slirp4netns is used. moby/moby#51616

fixPrevent a crash when making an API request with HostConfig.PublishAllPorts set (-P), and no port bindings. moby/moby#51621

29.1.1 Nov 28, 2025 Release notes ↗

otherdocker/cli, 29.1.1 milestone

othermoby/moby, 29.1.1 milestone

breakingRevert a PR breaking external DNS resolution on all custom bridge networks. moby/moby#51615

29.1.0 Nov 27, 2025 Release notes ↗

otherdocker/cli, 29.1.0 milestone

othermoby/moby, 29.1.0 milestone

otherUpdate BuildKit to v0.26.1. moby/moby#51551

otherUpdate containerd binary to v2.2.0 (static binaries). moby/moby#51271

otherDo not overwrite user-modified /etc/resolv.conf across container restarts. moby/moby#51507

fixfix --publish-all / -P for Windows containers. moby/moby#51586

fixFix an issue that prevented container restart or network reconnection when gateway configuration failed during container stop or network disconnect. moby/moby#51592

otherWindows containers: don't display an IPv6-mapped IPv4 address in port mappings. For example, [::ffff:0.0.0.0]:8080->80/tcp instead of 0.0.0.0:8080->80/tcp. moby/moby#51587

29.0.4 Nov 24, 2025 Release notes ↗

otherdocker/cli, 29.0.4 milestone

othermoby/moby, 29.0.4 milestone

fixdocker image ls no longer truncates the image names. docker/cli#6675

featureAllow creation of a container with a specific IP address when its networks were not configured with a specific subnet. moby/moby#51583

29.0.3 Nov 24, 2025 Release notes ↗

otherdocker/cli, 29.0.3 milestone

othermoby/moby, 29.0.3 milestone

fixdocker version --format json: restore top-level BuildTime field to use RFC3339Nano format. docker/cli#6668

fixFix docker image ls ignoring a custom imageFormat from docker.json. docker/cli#6667

fixFix an issue that caused daemon crash when using a remote network driver plugin. moby/moby#51558

29.0.2 Nov 17, 2025 Release notes ↗

otherdocker/cli, 29.0.2 milestone

othermoby/moby, 29.0.2 milestone

fixFix an issue that prevented rootless Docker from starting on a host with IPv6 disabled. moby/moby#51543

29.0.1 Nov 14, 2025 Release notes ↗

otherdocker/cli, 29.0.1 milestone

othermoby/moby, 29.0.1 milestone

fixdocker image ls no longer truncates the name width when output is redirect (e.g. for grep). docker/cli#6656

fixdocker image ls now considers the NO_COLOR environment variable for choosing the colored output. docker/cli#6654

fixcontainerd image store: Fix a bug causing docker build to ignore the explicitly set unpack image exporter option. moby/moby#51514

fixFix a bug causing docker image ls --all to not show untagged/dangling images. docker/cli#6657

fixFix build on i386. moby/moby#51528

fixFix explicit graphdriver configuration ("storage-driver") being treated as containerd snapshotter when prior graphdriver state exists. moby/moby#51516

fixFix output format of the ApiVersion and MinApiVersion fields in docker version --format=json to align with previous versions. docker/cli#6648

fixFix a bug preventing DNS resolution of containers attached to non swarm-scoped networks once the node has joined a Swarm cluster. moby/moby#51515

29.0.0 Nov 10, 2025 Release notes ↗

breakingThe Go module github.com/docker/docker is deprecated in favor of github.com/moby/moby/client and github.com/moby/moby/api. The github.com/moby/moby module is considered an internal implementation detail - the only supported public modules are client and api. Starting with v29, releases are tagged…

breakingDebian armhf (32-bit) packages now target ARMv7 CPUs and will not work on ARMv6 devices.

breakingOfficial Raspbian (32-bit) packages are no longer provided. Use Debian arm64 packages for 64-bit devices, or Debian armhf packages for 32-bit ARMv7 devices.

breakingcgroup v1 is deprecated. Support continues until at least May 2029, but migrate to cgroup v2 as soon as possible. See moby#51111.

breakingDocker Content Trust was removed from the Docker CLI. Can be built as a separate plugin: https://github.com/docker/cli/blob/v29.0.0/cmd/docker-trust/main.go

breakingThe daemon now requires API version v1.44 or later (Docker v25.0+).

breakingclient: remove legacy CBC cipher suites from client config. moby/moby#50126

breakingcontrib: remove editorconfig as it was unmaintained. moby/moby#50607

breakingcontrib: remove Dockerfile syntax highlighting files for nano and TextMate (tmbundle) as they were unmaintained and outdated. moby/moby#50606

breakingcontrib: remove mkimage-xxx scripts as they were unmaintained and not tested. moby/moby#50297

deprecatedapi/types/system: deprecated top level DiskUsage fields for type specific fields. moby/moby#51235

breakingEnsure bridge devices are removed when bridge network creation fails. moby/moby#51147

deprecatedEnvironment variables set on a container using legacy links are deprecated and aren't added automatically anymore. moby/moby#50719

deprecatedUsers are encouraged to stop relying on these as they're deprecated, and the escape hatch will be removed in a later version

breakingThe iptables rules for bridge networks have been updated, including removal of the DOCKER-ISOLATION-STAGE-1 and DOCKER-ISOLATION-STAGE-2 chains. With these changes:. moby/moby#49981

breakingPOST /images/{name:}/push: remove compatibility with API v1.4 auth-config in body. moby/moby#50371

breakingapi/types/plugin: remove deprecated Config.DockerVersion. moby/moby#51458

breakingapi/types/swarm: deprecated and dropped support for PortConfigProtocol; use network.IPProtocol instead. moby/moby#51094

breakingapi/pkg/progress and api/pkg/streamformatter have been removed. moby/moby#51153

breakingapi: remove unused DefaultVersion, MinSupportedAPIVersion consts. moby/moby#50587

breakingclient: ContainerCommitOptions: remove Pause field in favor of NoPause. moby/moby#51019

breakingclient: remove client.ContainerStatsResult.OSType field. moby/moby#51305

breakingRemove structs NetworkSettingsBase and DefaultNetworkSettings. Fields in NetworkSettingsBase that were not deprecated are now directly in NetworkSettings. moby/moby#50846

deprecatedclient/pkg/jsonmessage: remove deprecated ProgressMessage, ErrorMessage, DisplayJSONMessagesToStream and Stream interface. moby/moby#49264

deprecatedGET /events no longer includes the deprecated status, id, and from fields. These fields were removed in API v1.22, but still included in the response. These fields are now omitted when using API v1.52 or later. moby/moby#50832

deprecatedapi/types/network: CreateRequest: remove deprecated CheckDuplicate field. moby/moby#50998

deprecatedapi/types/plugin: deprecate Config.DockerVersion field. moby/moby#51109

deprecatedapi/types/registry: remove deprecated AuthConfig.Email field. moby/moby#51059

deprecatedapi/types/strslice: deprecate StrSlice in favor of using a regular []string. moby/moby#50292

deprecatedapi/types/sytem: remove deprecated DiskUsage.BuilderSize. moby/moby#51180

deprecatedapi/types: move plugin types to api/types/plugin. moby/moby#48114

deprecatedAPI: Deprecation: the Engine was automatically backfilling empty PortBindings lists with a PortBinding with an empty HostIP and HostPort when starting a container. This behavior is deprecated for API 1.52, and will be dropped in API 1.53. moby/moby#50874

deprecatedbuild: remove DCT support for classic builder. docker/cli#6195

deprecatedcli/command: Remove deprecated ResolveDefaultContext. docker/cli#6555

deprecatedclient: ImageBuildResponse: remove OSType field. moby/moby#50995

deprecatedclient: Remove ImageCreate method - useImagePull or ImageImport instead. moby/moby#51366

deprecatedclient: remove deprecated ImageListOptions.ContainerCount. moby/moby#51006

deprecatedclient: remove support for negotiating API version < v1.44 (docker 25.0). moby/moby#51119

deprecatedclient: remove unused Client.HTTPClient() method. moby/moby#51011

deprecateddaemon/graphdriver: remove deprecated GetDriver(). moby/moby#50377

+259 more items in the release notes

28.5.2 Nov 5, 2025 Release notes ↗

otherdocker/cli, 28.5.2 milestone

othermoby/moby, 28.5.2 milestone

securityCVE-2025-31133

securityCVE-2025-52565

securityCVE-2025-52881

otherUpdate runc to v1.3.3. moby/moby#51394

fixdockerd-rootless.sh: if slirp4netns is not installed, try using pasta (passt). moby/moby#51162

fixUpdate Go runtime to 1.24.9. moby/moby#51387, docker/cli#6613

deprecatedGo-SDK: cli/command/image/build: deprecate DefaultDockerfileName, DetectArchiveReader, WriteTempDockerfile, ResolveAndValidateContextPath. These utilities were only used internally and will be removed in the next release. docker/cli#6610

deprecatedGo-SDK: cli/command/image/build: deprecate IsArchive utility. docker/cli#6560

deprecatedGo-SDK: opts: deprecate ValidateMACAddress. docker/cli#6560

deprecatedGo-SDK: opts: deprecate ListOpts.Delete(). docker/cli#6560

28.5.1 Oct 8, 2025 Release notes ↗

otherdocker/cli, 28.5.1 milestone

othermoby/moby, 28.5.1 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

fixUpdate BuildKit to v0.25.1. moby/moby#51137

fixUpdate Go runtime to 1.24.8. moby/moby#51133, docker/cli#6541

deprecatedapi/types/image: InspectResponse: deprecate Parent and DockerVersion fields. moby/moby#51105

deprecatedapi/types/plugin: deprecate Config.DockerVersion field. moby/moby#51110

28.5.0 Oct 2, 2025 Release notes ↗

otherdocker/cli, 28.5.0 milestone

othermoby/moby, 28.5.0 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

fixDon't print warnings in docker info for broken symlinks in CLI-plugin directories. docker/cli#6476

fixFix a panic during stats on empty event Actor.ID. docker/cli#6471

breakingRemove support for legacy CBC cipher suites. docker/cli#6474

otherUpdate Buildkit to v0.25.0. moby/moby#51075

otherUpdate Dockerfile syntax to v1.19.0. moby/moby#51075

otherEliminated harmless warning about deletion of endpoint_count from the data store. moby/moby#51064

fixFix a bug causing IPAM plugins to not be loaded on Windows. moby/moby#51035

deprecatedDeprecate support for kernel memory TCP accounting (KernelMemoryTCP). moby/moby#51067

fixFix GET containers/{name}/checkpoints returning null instead of empty JSON array when there are no checkpoints. moby/moby#51052

featurecli-plugins/plugin: Run: allow customizing the CLI. docker/cli#6481

featurecli/command: add WithUserAgent option. docker/cli#6477

deprecatedGo-SDK: cli/command: deprecate DockerCli.Apply. This method is no longer used and will be removed in the next release if there are no remaining uses. docker/cli#6497

deprecatedGo-SDK: cli/command: deprecate DockerCli.ContentTrustEnabled. This method is no longer used and will be removed in the next release. docker/cli#6495

deprecatedGo-SDK: cli/command: deprecate DockerCli.DefaultVersion. This method is no longer used and will be removed in the next release. docker/cli#6491

deprecatedGo-SDK: cli/command: deprecate ResolveDefaultContext utility. docker/cli#6529

deprecatedGo-SDK: cli/command: deprecate WithContentTrustFromEnv, WithContentTrust options. These options were used internally, and will be removed in the next release.. docker/cli#6489

deprecatedGo-SDK: cli/manifest/store: deprecate IsNotFound(). docker/cli#6514

deprecatedGo-SDK: templates: deprecate NewParse() function. docker/cli#6469

28.4.0 Sep 3, 2025 Release notes ↗

deprecatedDeprecated and removed features, see Deprecated Features.

deprecatedUpdate deprecation message for AuthConfig.Email field. moby/moby#50797

deprecatedDeprecate profiles package which got migrated to github.com/moby/profiles. moby/moby#50513

deprecatedDeprecate special handling for quoted values for the --tlscacert, --tlscert, and --tlskey command-line flags. docker/cli#6291

deprecatedMark legacy links env vars (DOCKER_KEEP_DEPRECATED_LEGACY_LINKS_ENV_VARS) as deprecated in v28.4 and set for removal in v30.0. docker/cli#6309

deprecatedGo-SDK: Deprecate field NetworkSettingsBase.Bridge, struct NetworkSettingsBase, all the fields of DefaultNetworkSettings, and struct DefaultNetworkSettings. moby/moby#50839

deprecatedGo-SDK: api/types: build.CacheDiskUsage, container.DiskUsage, images.DiskUsage and volumes.DiskUsage are now deprecated and will be removed in the next major release. moby/moby#50768

deprecatedGo-SDK: cli-plugins/manager: deprecate ReexecEnvvar. docker/cli#6411

deprecatedGo-SDK: cli-plugins/manager: deprecate annotation aliases (CommandAnnotationPlugin, CommandAnnotationPluginVendor, CommandAnnotationPluginVersion, CommandAnnotationPluginInvalid, CommandAnnotationPluginCommandPath) in favor of their equivalent in cli-plugins/manager/metadata. docker/cli#6298

deprecatedGo-SDK: cli-plugins/manager: deprecate metadata aliases (NamePrefix, MetadataSubcommandName, HookSubcommandName, Metadata, ReexecEnvvar) in favor of their equivalent in cli-plugins/manager/metadata. docker/cli#6269

deprecatedGo-SDK: cli-plugins/manager: remove Candidate interface, which was only for internal use. docker/cli#6269

deprecatedGo-SDK: cli-plugins/manager: remove NewPluginError function, which was only for internal use. docker/cli#6269

deprecatedGo-SDK: cli-plugins/manager: remove deprecated ResourceAttributesEnvvar const. docker/cli#6269

deprecatedGo-SDK: cli/command/builder: deprecate NewBuilderCommand and NewBakeStubCommand. These functions will be removed in the next release. docker/cli#6312

deprecatedGo-SDK: cli/command/builder: deprecate NewPruneCommand. docker/cli#6343

deprecatedGo-SDK: cli/command/checkpoint: deprecate NewCheckpointCommand. This function will be removed in the next release. docker/cli#6312

deprecatedGo-SDK: cli/command/checkpoint: deprecate NewFormat, FormatWrite. docker/cli#6341

deprecatedGo-SDK: cli/command/completion: deprecate NoComplete. docker/cli#6405

deprecatedGo-SDK: cli/command/completion: remove deprecated ValidArgsFn. docker/cli#6259

deprecatedGo-SDK: cli/command/config: deprecate NewConfigCommand. This function will be removed in the next release. docker/cli#6312

deprecatedGo-SDK: cli/command/config: deprecate NewFormat, FormatWrite, InspectFormatWrite. docker/cli#6341

deprecatedGo-SDK: cli/command/config: deprecate RunConfigCreate, CreateOptions, RunConfigInspect, InspectOptions, RunConfigList, ListOptions, RunConfigRemove, and RemoveOptions. docker/cli#6369

deprecatedGo-SDK: cli/command/container: deprecate NewBuildCommand, NewPullCommand, NewPushCommand, NewImagesCommand, NewImageCommand, NewHistoryCommand, NewImportCommand, NewLoadCommand, NewRemoveCommand, NewSaveCommand, NewTagCommand, NewPruneCommand. These functions will be removed in the next release.…

deprecatedGo-SDK: cli/command/container: deprecate NewDiffFormat, DiffFormatWrite. These functions were only used internally and will be removed in the next release. docker/cli#6341

deprecatedGo-SDK: cli/command/container: deprecate NewRunCommand, NewExecCommand, NewPsCommand, NewContainerCommand, NewAttachCommand, NewCommitCommand, NewCopyCommand, NewCreateCommand, NewDiffCommand, NewExportCommand, NewKillCommand, NewLogsCommand, NewPauseCommand, NewPortCommand, NewRenameCommand,…

deprecatedGo-SDK: cli/command/context: deprecate NewContextCommand. This function will be removed in the next release. docker/cli#6312

deprecatedGo-SDK: cli/command/context: deprecate RunCreate and CreateOptions. docker/cli#6403

deprecatedGo-SDK: cli/command/context: deprecate RunExport and ExportOptions. docker/cli#6403

deprecatedGo-SDK: cli/command/context: deprecate RunImport. docker/cli#6403

deprecatedGo-SDK: cli/command/context: deprecate RunRemove and RemoveOptions. docker/cli#6403

deprecatedGo-SDK: cli/command/context: deprecate RunUpdate and UpdateOptions. docker/cli#6403

deprecatedGo-SDK: cli/command/context: deprecate RunUse. docker/cli#6403

deprecatedGo-SDK: cli/command/image: deprecate AuthResolver utility. docker/cli#6357

deprecatedGo-SDK: cli/command/image: deprecate NewHistoryFormat, HistoryWrite. docker/cli#6341, docker/cli#6341

deprecatedGo-SDK: cli/command/manifest: deprecate NewManifestCommand. This functions will be removed in the next release. docker/cli#6312

deprecatedGo-SDK: cli/command/network: deprecate NewFormat, FormatWrite. docker/cli#6341

deprecatedGo-SDK: cli/command/network: deprecate NewNetworkCommand. These functions will be removed in the next release. docker/cli#6312

deprecatedGo-SDK: cli/command/node: deprecate NewFormat, FormatWrite, InspectFormatWrite. docker/cli#6341

deprecatedGo-SDK: cli/command/node: deprecate NewNodeCommand. This functions will be removed in the next release. docker/cli#6312

deprecatedGo-SDK: cli/command/plugin: deprecate NewFormat, FormatWrite. docker/cli#6341

+48 more items in the release notes

28.3.3 Jul 29, 2025 Release notes ↗

otherdocker/cli, 28.3.3 milestone

othermoby/moby, 28.3.3 milestone

securityThis release fixes an issue where, after a firewalld reload, published container ports could be accessed directly from the local network, even when they were intended to be accessible only via a loopback address. CVE-2025-54388 / GHSA-x4rx-4gw3-53p4 / moby/moby#50506.

otherUpdate Buildx to v0.26.1. docker/docker-ce-packaging#1230

otherUpdate Compose to v2.39.1. docker/docker-ce-packaging#1234

otherUpdate Docker Model CLI plugin to v0.1.36. docker/docker-ce-packaging#1233

featurecli/command/formatter: add TrunateID() utility as alternative for github.com/docker/docker/pkg/stringid.TrunateID(). docker/cli#6180

28.3.2 Jul 9, 2025 Release notes ↗

otherdocker/cli, 28.3.2 milestone

othermoby/moby, 28.3.2 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

fixFix --use-api-socket not working correctly when targeting a remote daemon. docker/cli#6157

fixFix stray "otel error" logs being printed if debug logging is enabled. docker/cli#6160

fixQuote SSH arguments when connecting to a remote daemon over an SSH connection to avoid unexpected expansion. docker/cli#6147

fixWarn when DOCKER_AUTH_CONFIG is set during docker login and docker logout. docker/cli#6163

otherUpdate Compose to v2.38.2. docker/docker-ce-packaging#1225

otherUpdate Docker Model CLI plugin to v0.1.33. docker/docker-ce-packaging#1227

otherUpdate Go runtime to 1.24.5. moby/moby#50354

28.3.1 Jul 2, 2025 Release notes ↗

otherdocker/cli, 28.3.1 milestone

othermoby/moby, 28.3.1 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

otherUpdate BuildKit to v0.23.2. moby/moby#50309

otherUpdate Compose to v2.38.1. docker/docker-ce-packaging#1221

featureUpdate Model to v0.1.32 which adds the support for the new top-level models: key in Docker Compose. docker/docker-ce-packaging#1222

28.3.0 Jun 25, 2025 Release notes ↗

otherdocker/cli, 28.3.0 milestone

othermoby/moby, 28.3.0 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

featureAdd support for AMD GPUs in docker run --gpus. moby/moby#49952

featureUse DOCKER_AUTH_CONFIG as a credential store. docker/cli#6008

fixEnsure that the state of the container in the daemon database (used by /containers/json API) is up to date when the container is stopped using the /containers/{id}/stop API (before response of API). moby/moby#50136

fixFix docker image inspect inspect omitting empty fields. moby/moby#50135

fixFix docker images --tree not marking images as in-use when the containerd image store is disabled. docker/cli#6140

fixFix docker pull/push hang in non-interactive when authentication is required caused by prompting for login credentials. docker/cli#6141

fixFix a potential resource leak when a node leaves a Swarm. moby/moby#50115

fixFix a regression where a login prompt on docker pull would show Docker Hub-specific hints when logging in on other registries. docker/cli#6135

fixFix an issue where all new tasks in the Swarm could get stuck in the PENDING state forever after scaling up a service with placement preferences. moby/moby#50211

fixRemove an undocumented, hidden, top-level docker remove command that was accidentally introduced in Docker 23.0. docker/cli#6144

fixValidate registry-mirrors configuration as part of dockerd --validate and improve error messages for invalid mirrors. moby/moby#50240

fixdockerd-rootless-setuptool.sh: Fix the script from silently returning with no error message when subuid/subgid system requirements are not satisfied. moby/moby#50059

fixcontainerd image store: Fix docker push not creating a tag on the remote repository. moby/moby#50199

fixcontainerd image store: Improve handling of errors returned by the token server during docker pull/push. moby/moby#50176

featureAllow customizing containerd service name for OpenRC. moby/moby#50156

otherUpdate BuildKit to v0.23.1. moby/moby#50243

otherUpdate Buildx to v0.25.0. docker/docker-ce-packaging#1217

otherUpdate Compose to v2.37.2. docker/docker-ce-packaging#1219

otherUpdate Docker Model CLI plugin to v0.1.30. docker/docker-ce-packaging#1218

otherUpdate Go runtime to 1.24.4. docker/docker-ce-packaging#1213, moby/moby#50153, docker/cli#6124

fixRevert Swarm related changes added in 28.2.x builds, due to a regression reported moby/moby#50169

otherRevert: Fix an issue where docker network inspect --verbose could sometimes crash the daemon (https://github.com/moby/moby/pull/49937).

otherRevert: Fix an issue where the load-balancer IP address for an overlay network would not be released in certain cases if the Swarm was lacking an ingress network (https://github.com/moby/moby/pull/49948).

otherRevert: Improve the reliability of NetworkDB in busy clusters and lossy networks (https://github.com/moby/moby/pull/49932).

otherRevert: Improvements to the reliability and convergence speed of NetworkDB (https://github.com/moby/moby/pull/49939).

fixFix an issue that could cause container startup to fail, or lead to failed UDP port mappings, when some container ports are mapped to 0.0.0.0 and others are mapped to specific host addresses. moby/moby#50054

otherThe network inspect response for an overlay network now reports that EnableIPv4 is true. moby/moby#50147

otherWindows: Improve daemon startup time in cases where the host has networks of type "Mirrored". moby/moby#50155

otherWindows: Make sure docker system prune and docker network prune only remove networks created by Docker. moby/moby#50154

otherUpdate API version to 1.51. moby/moby#50145

otherGET /images/json now sets the value of the Containers field for all images to the count of containers using the image. moby/moby#50146

deprecatedEmpty/nil image config fields in the GET /images/{name}/json response are now deprecated and will be removed in v29.0. docker/cli#6129

deprecatedapi/types/container: deprecate ExecOptions.Detach. This field is not used, and will be removed in a future release. moby/moby#50219

deprecatedpkg/idtools: deprecate IdentityMapping and Identity.Chown. moby/moby#50210

28.2.2 May 30, 2025 Release notes ↗

otherdocker/cli, 28.2.2 milestone

othermoby/moby, 28.2.2 milestone

fixcontainerd image store: Fix a regression causing docker build --push to fail. This reverts the fix for docker build not persisting overridden images as dangling. moby/moby#50105

featureWhen creating the iptables DOCKER-USER chain, do not add an explicit RETURN rule, allowing users to append as well as insert their own rules. Existing rules are not removed on upgrade, but it won't be replaced after a reboot. moby/moby#50098

28.2.1 May 28, 2025 Release notes ↗

fixFix packaging regression in v28.2.0 which broke creating the docker group/user on fresh installations. docker-ce-packaging#1209

28.2.0 May 28, 2025 Release notes ↗

deprecatedDeprecated and removed features, see Deprecated Features.

featureAdd {{.Platform}} as formatting option for docker ps to show the platform of the image the container is running. docker/cli#6042

featureAdd support for relative parent paths (../) on bind mount sources when using docker run/create with -v/--volume or --mount type=bind options. docker/cli#4966

featureCDI is now enabled by default. moby/moby#49963

featureShow discovered CDI devices in docker info. docker/cli#6078

featuredocker image rm: add --platform option to remove a variant from multi-platform images. docker/cli#6109

featurecontainerd image store: Initial BuildKit support for building Windows container images on Windows (requires an opt-in with DOCKER_BUILDKIT=1). moby/moby#49740

fixAdd a new log option for fluentd log driver (fluentd-write-timeout), which enables specifying write timeouts for fluentd connections. moby/moby#49911

fixAdd support for DOCKER_AUTH_CONFIG for the experimental --use-api-socket option. docker/cli#6019

fixFix docker exec waiting for 10 seconds if a non-existing user or group was specified. moby/moby#49868

fixFix docker swarm init ignoring cacert option of --external-ca. docker/cli#5995

fixFix an issue where the CLI would not correctly save the configuration file (~/.docker/config.json) if it was a relative symbolic link. docker/cli#5282

fixFix containers with --restart always policy using CDI devices failing to start on daemon restart. moby/moby#49990

fixFix shell-completion to only complete some flags once, even though they can be set multiple times. docker/cli#6030

fixFix the plugin does not implement PluginAddr interface error for Swarm CSI drivers. moby/moby#49961

fixImprove docker login error messages for invalid options. docker/cli#6036

fixMake sure the terminal state is restored if the CLI is forcefully terminated. docker/cli#6058

fixUpdate the default seccomp profile to match the libseccomp v2.6.0. The new syscalls are: listmount, statmount, lsm_get_self_attr, lsm_list_modules, lsm_set_self_attr, mseal, uretprobe, riscv_hwprobe, getxattrat, listxattrat, removexattrat, and setxattrat. This prevents containers from receiving…

fixdocker inspect: add shell completion, improve flag-description for --type and improve validation. docker/cli#6052

fixcontainerd image store: Enable BuildKit garbage collector by default. moby/moby#49899

fixcontainerd image store: Fix docker build not persisting overridden images as dangling. moby/moby#49702

featureAdd bridge network option "com.docker.network.bridge.trusted_host_interfaces", accepting a colon-separated list of interface names. These interfaces have direct access to published ports on container IP addresses. moby/moby#49832

featureAdd daemon option "allow-direct-routing" to disable filtering of packets from outside the host addressed directly to containers. moby/moby#49832

featureapi/types/container: add ContainerState and constants for container state. moby/moby#49965

deprecatedapi/types: deprecate BuildResult, ImageBuildOptions, ImageBuildOutput, ImageBuildResponse, BuilderVersion, BuilderV1, and BuilderBuildKi which were moved to api/types/build. moby/moby#50025

deprecatedAPI: Deprecated: GET /images/{name}/json no longer returns the following fields: Config, Hostname, Domainname, AttachStdin, AttachStdout, AttachStderr, Tty, OpenStdin, StdinOnce, Image, NetworkDisabled (already omitted unless set), MacAddress (already omitted unless set), StopTimeout (already…

deprecatedGo-SDK: Deprecate builder/remotecontext.Rel(). This function was needed on older versions of Go, but can now be replaced by filepath.Rel(). moby/moby#49843

deprecatedGo-SDK: api/types: deprecate BuildCachePruneOptions in favor of api/types/builder.CachePruneOptions. moby/moby#50015

deprecatedGo-SDK: api/types: deprecate BuildCachePruneReport in favor of api/types/builder.CachePruneReport. moby/moby#50015

deprecatedGo-SDK: api/types: deprecate NodeListOptions, NodeRemoveOptions, ServiceCreateOptions, ServiceUpdateOptions, RegistryAuthFromSpec, RegistryAuthFromPreviousSpec, ServiceListOptions, ServiceInspectOptions, and SwarmUnlockKeyResponse which were moved to api/types/swarm. moby/moby#50027

deprecatedGo-SDK: api/types: deprecate SecretCreateResponse, SecretListOptions, ConfigCreateResponse, ConfigListOptions which were moved to api/types/swarm. moby/moby#50024

deprecatedGo-SDK: client: deprecate IsErrNotFound. moby/moby#50012

deprecatedGo-SDK: container: deprecate IsValidHealthString in favor of api/types/container.ValidateHealthStatus. moby/moby#49893

deprecatedGo-SDK: container: deprecate StateStatus, WaitCondition, and the related WaitConditionNotRunning, WaitConditionNextExit, and WaitConditionRemoved consts in favor of their equivalents in api/types/container. moby/moby#49874

deprecatedGo-SDK: opts: deprecate ListOpts.GetAll in favor of ListOpts.GetSlice. docker/cli#6032

deprecatedRemove deprecated IsAutomated formatting placeholder from docker search. docker/cli#6091

deprecatedRemove fallback for pulling images from non-OCI-compliant docker.pkg.github.com registry. moby/moby#50094

deprecatedRemove support for pulling legacy v2, schema 1 images and remove DOCKER_ENABLE_DEPRECATED_PULL_SCHEMA_1_IMAGE environment-variable. moby/moby#50036, moby/moby#42300

deprecatedThe BridgeNfIptables and BridgeNfIp6tables fields in the GET /info response were deprecated in API v1.48, and are now omitted in API v1.50. moby/moby#49904

deprecatederrdefs: Deprecate errdefs.FromStatusCode. Use containerd's errhttp.ToNative instead. moby/moby#50030

+22 more items in the release notes

28.1.1 Apr 18, 2025 Release notes ↗

otherdocker/cli, 28.1.1 milestone

othermoby/moby, 28.1.1 milestone

fixFix dockerd-rootless-setuptool.sh incorrectly reporting missing iptables. moby/moby#49833

fixcontainerd image store: Fix a potential daemon crash when using docker load with archives containing zero-size tar headers. moby/moby#49837

otherUpdate Buildx to v0.23.0. docker/docker-ce-packaging#1185

otherUpdate Compose to v2.35.1. docker/docker-ce-packaging#1188

featureAdd a warning to a container's /etc/resolv.conf when no upstream DNS servers were found. moby/moby#49827

28.1.0 Apr 17, 2025 Release notes ↗

otherdocker/cli, 28.1.0 milestone

othermoby/moby, 28.1.0 milestone

otherChanges to the Engine API, see API version history.

featureAdd docker bake sub-command as alias for docker buildx bake. docker/cli#5947

featureExperimental: add a new --use-api-socket flag on docker run and docker create to enable access to Docker socket from inside a container and to share credentials from the host with the container. docker/cli#5858

featuredocker image inspect now supports a --platform flag to inspect a specific platform of a multi-platform image. docker/cli#5934

fixAdd CLI shell-completion for context names. docker/cli#6016

fixFix docker images --tree not including non-container images content size in the total image content size. docker/cli#6000

fixFix docker load not preserving replaced images. moby/moby#49650

fixFix docker login hints when logging in to a custom registry. docker/cli#6015

fixFix docker stats not working properly on machines with high CPU core count. moby/moby#49734

fixFix a regression causing docker pull/push to fail when interacting with a private repository. docker/cli#5964

fixFix an issue preventing rootless Docker setup on a host with no ip_tables kernel module. moby/moby#49727

fixFix an issue that could lead to unwanted iptables rules being restored and never deleted following a firewalld reload. moby/moby#49728

fixImprove CLI completion of docker service scale. docker/cli#5968

fixdocker images --tree now hides both untagged and dangling images by default. docker/cli#5924

fixdocker system info will provide an exit code if a connection cannot be established to the Docker daemon. docker/cli#5918

fixcontainerd image store: Fix image tag event not being emitted when building with BuildKit. moby/moby#49678

fixcontainerd image store: Improve docker push/pull handling of remote registry errors. moby/moby#49770

fixcontainerd image store: Show pull progress for non-layer image blobs. moby/moby#49746

featureAdd Debian "Trixie" packages. docker/docker-ce-packaging#1181

featureAdd Fedora 42 packages. docker/containerd-packaging#418, docker/docker-ce-packaging#1169

featureAdd Ubuntu 25.04 "Plucky Puffin" packages. docker/containerd-packaging#419, docker/docker-ce-packaging#1177

otherUpdate BuildKit to v0.21.0. moby/moby#49809

otherUpdate Compose to v2.35.0. docker/docker-ce-packaging#1183

otherUpdate Go runtime to 1.23.8. docker/cli#5986, docker/docker-ce-packaging#1180, moby/moby#49737

fixFix a bug causing host port-mappings on Swarm containers to be duplicated on docker ps and docker inspect. moby/moby#49724

fixFix an issue that caused container network attachment to fail with error "Bridge port not forwarding". moby/moby#49705

breakingFix an issue with removal of a --link from a container in the default bridge network. moby/moby#49778

otherImprove how network-endpoint relationships are tracked to reduce the chance of the "has active endpoints" error to be wrongfully returned. moby/moby#49736

otherImprove the "has active endpoints" error message by including the name of endpoints still connected to the network being deleted. moby/moby#49773

breakingcli/command/context: remove temporary ContextType field from JSON output. docker/cli#5981

deprecatedAPI: Deprecated AllowNondistributableArtifactsCIDRs and AllowNondistributableArtifactsHostnames fields in the RegistryConfig struct in the GET /info response are omitted in API v1.49. moby/moby#49749

deprecatedAPI: Deprecated: The ContainerdCommit.Expected, RuncCommit.Expected, and InitCommit.Expected fields in the GET /info endpoint were deprecated in API v1.48, and are now omitted in API v1.49. moby/moby#48556

deprecatedGo-SDK: cli/command/image: Deprecate RunPull: this function was only used internally and will be removed in the next release. docker/cli#5975

deprecatedGo-SDK: cli/config/configfile: deprecate ConfigFile.Experimental field. Experimental CLI features are always enabled since version v20.10 and this field is no longer used. Use ConfigFile.Features instead for optional features. This field will be removed in a future release. docker/cli#5977

deprecatedGo-SDK: deprecate pkg/archive, which was migrated to github.com/moby/go-archive. moby/moby#49743

deprecatedGo-SDK: deprecate pkg/atomicwriter, which was migrated to github.com/moby/sys/atomicwriter. moby/moby#49748

deprecatedGo-SDK: opts: remove deprecated PortOpt, ConfigOpt, SecretOpt aliases. docker/cli#5953

deprecatedGo-SDK: registry: deprecate APIEndpoint.Official field. moby/moby#49706

+5 more items in the release notes

28.0.4 Mar 25, 2025 Release notes ↗

otherdocker/cli, 28.0.4 milestone

othermoby/moby, 28.0.4 milestone

fixFix a regression causing docker pull/push to fail when interacting with a private repository. docker/cli#5964

28.0.3 Mar 25, 2025 Release notes ↗

otherdocker/cli, 28.0.3 milestone

othermoby/moby, 28.0.3 milestone

fixFix docker run truncating the STDOUT/STDERR prematurely when the container exits before the data is consumed. docker/cli#5957

otherUpdate BuildKit to v0.20.2. moby/moby#49698

otherUpdate runc to v1.2.6 (static packages only). moby/moby#49682

otherUpdate containerd to v1.7.26. docker/containerd-packaging#409

28.0.2 Mar 19, 2025 Release notes ↗

otherdocker/cli, 28.0.2 milestone

othermoby/moby, 28.0.2 milestone

fixFix CLI-specific attributes (docker.cli.*) being unintentionally passed to downstream OTel services. docker/cli#5842

fixFix an issue where user-specified OTEL_RESOURCE_ATTRIBUTES were being overridden by CLI's internal telemetry attributes. The CLI now properly merges user-specified attributes with internal ones, allowing both to coexist. docker/cli#5842

fixFix daemon failing to start on Windows when a container created before v28.0.0 was present. moby/moby#49626

fixFix possible error on docker buildx prune with the --min-free-space. moby/moby#49623

fixFix spurious io: read/write on closed pipe error in the daemon log when closing container. moby/moby#49590

fixFix the Docker daemon failing too early if the containerd socket isn't immediately available. moby/moby#49603

fixMask Linux thermal interrupt info in a container's /proc and /sys by default. moby/moby#49560

fixUpdate contrib/check-config.sh to check for more kernel modules related to iptables. moby/moby#49622

fixcontainerd image store: Fix integer overflow in User ID handling passed via --user. moby/moby#49652

fixcontainerd image store: Fix spurious reference for unknown type: application/vnd.in-toto+json warning being logged to the daemon's log. moby/moby#49652

fixcontainerd image store: Improve performance of docker ps when running large number of containers. moby/moby#49365

otherUpdate BuildKit to v0.20.1. moby/moby#49587

otherUpdate Buildx to v0.22.0. docker/docker-ce-packaging#1175

otherUpdate Compose to v2.34.0. docker/docker-ce-packaging#1172

otherUpdate Go runtime to 1.23.7. docker/cli#5890, docker/docker-ce-packaging#1171, moby/moby#49580

otherUpdate RootlessKit to v2.3.4. moby/moby#49614

otherUpdate containerd (static binaries only) to v1.7.27. moby/moby#49656

securityAdd environment variable DOCKER_INSECURE_NO_IPTABLES_RAW=1 to allow Docker to run on systems where the Linux kernel can't provide CONFIG_IP_NF_RAW support. When enabled, Docker will not create rules in the iptables raw table. Warning: This is not recommended for production environments as it…

featureAllow container startup when an endpoint is attached to a macvlan network where the parent interface is down. moby/moby#49630

otherDo not skip DNAT for packets originating in a gateway_mode=routed network. moby/moby#49577

fixFix a bug causing docker ps to inconsistently report dual-stack port mappings. moby/moby#49657

fixFix a bug that could cause docker-proxy to stop forwarding UDP datagrams to containers. moby/moby#49649

fixFix a bug that was causing docker-proxy to close UDP connections to containers eagerly and resulting in the source address to change needlessly. moby/moby#49649

otherMove various types and consts from cli-plugins/manager to a separate package. docker/cli#5902

otherUpdate minimum required Go version to go1.23. moby/moby#49541

othercli/command: Move PrettyPrint utility to cli/command/formatter. docker/cli#5916

otherrunconfig/errors: split ErrConflictHostNetwork into ErrConflictConnectToHostNetwork and ErrConflictDisconnectFromHostNetwork. moby/moby#49605

deprecatedGo-SDK: Deprecate cli-plugins/manager.ResourceAttributesEnvvar constant. It was used internally, but holds the OTEL_RESOURCE_ATTRIBUTES name, which is part of the OpenTelemetry specification. Users of this constant should define their own. It will be removed in the next release. docker/cli#5881

deprecatedGo-SDK: Deprecate opts.PortOpt, opts.ConfigOpt and opts.SecretOpt. These types were moved to the opts/swarmopts package. docker/cli#5907

deprecatedGo-SDK: Remove service/logs package. docker/cli#5910

deprecatedGo-SDK: cli/command/image: Deprecate PushTrustedReference and move to cli/trust. docker/cli#5894

deprecatedGo-SDK: cli/command/image: Deprecate and internalize TrustedPush. docker/cli#5894

deprecatedGo-SDK: cli/command: deprecate Cli.NotaryClient: use trust.GetNotaryRepository instead. This method is no longer used and will be removed in the next release. docker/cli#5885

deprecatedGo-SDK: cli/command: deprecate Cli.RegistryClient. This method was only used internally and will be removed in the next release. Use client.NewRegistryClient instead. docker/cli#5889, docker/cli#5889

deprecatedGo-SDK: registry: Deprecate RepositoryInfo.Official field. moby/moby#49567

deprecatedGo-SDK: registry: deprecate HostCertsDir: this function was only used internally and will be removed in the next release. moby/moby#49612

deprecatedGo-SDK: registry: deprecate SetCertsDir: the cert-directory is now automatically selected when running with RootlessKit, and should no longer be set manually. moby/moby#49612

28.0.1 Feb 26, 2025 Release notes ↗

otherdocker/cli, 28.0.1 milestone

othermoby/moby, 28.0.1 milestone

breakingRemove dependency on kernel modules ip_set, ip_set_hash_net and netfilter_xt_set.

featureThe dependency was introduced in release 28.0.0 but proved too disruptive. The iptables rules using these modules have been replaced. moby/moby#49530

featureAllow daemon startup on a host with IPv6 disabled without requiring --ip6tables=false. moby/moby#49525

fixFix a bug that was causing containers with --restart=always and a published port already in use to restart in a tight loop. moby/moby#49507

fixFix an issue with Swarm ingress, caused by incorrect ordering of iptables rules. moby/moby#49538

fixFix creation of a swarm-scoped network from a --config-only network. moby/moby#49521

fixFix docker network inspect reporting an IPv6 gateway with CIDR suffix for a newly created network with no specific IPAM config, until a daemon restart. moby/moby#49520

otherImprove the error reported when kernel modules ip_set, ip_set_hash_net and netilter_xt_set are not available. moby/moby#49524

otherMove most of Docker's iptables rules out of the filter-FORWARD chain, so that other applications are free to append rules that must follow Docker's rules. moby/moby#49518

otherUpdate --help output and man page lo state which options only apply to the default bridge network. moby/moby#49522

fixFix docker context create always returning an error when using the "skip-tls-verify" option. docker/cli#5850

fixFix shell completion suggesting IDs instead of names for services and nodes. docker/cli#5848

fixFix unintentionally printing exit status to standard error output when docker exec/run returns a non-zero status. docker/cli#5854

fixFix regression protocol "tcp" is not supported by the RootlessKit port driver "slirp4netns". moby/moby#49514

fixcontainerd image store: Fix docker inspect not being able to show multi-platform images with missing layers for all platforms. moby/moby#49533

fixcontainerd image store: Fix docker images --tree reporting wrong content size. moby/moby#49535

fixFix compilation on i386 moby/moby#49526

securityUpdate github.com/go-jose/go-jose/v4 to v4.0.5 to address. GHSA-c6gw-w398-hv78 / CVE-2025-27144 docker/cli#5867

otherUpdate Buildx to v0.21.1. docker/docker-ce-packaging#1167

otherUpdate Compose to v2.33.1. docker/docker-ce-packaging#1168

fixcontainerd image store: Fix GET /images/json?manifests=1 not filling Manifests for index-only images. moby/moby#49533

fixcontainerd image store: Fix GET /images/json and /images//json Size.Content field including the size of content that's not available locally. moby/moby#49535

28.0.0 Feb 20, 2025 Release notes ↗

securityFixes CVE-2025-54410: Firewalld reload removes bridge network isolation

deprecatedDeprecated and removed features, see Deprecated Features.

breakingThe executable rootlesskit-docker-proxy is no longer used, it has been removed from the build and distribution.

deprecatedThe deprecated OCI prestart hook is now only used by build containers. For other containers, network interfaces are added to the network namespace after task creation is complete, before the container task is started. moby/moby#47406

securityFix a security issue that was allowing remote hosts to connect directly to a container on its published ports. moby/moby#49325

securityFix a security issue that was allowing neighbor hosts to connect to ports mapped on a loopback address. moby/moby#49325

breakingThe Fluent logger option fluentd-async-connect has been deprecated in v20.10 and is now removed. moby/moby#46114

breakingThe --time option on docker stop and docker restart is deprecated and renamed to --timeout. docker/cli#5485

breakingGo-SDK: pkg/ioutils: Remove NewReaderErrWrapper as it was never used. moby/moby#49258

breakingGo-SDK: pkg/ioutils: Remove deprecated BytesPipe, NewBytesPipe, ErrClosed, WriteCounter, NewWriteCounter, NewReaderErrWrapper, NopFlusher. moby/moby#49245

breakingGo-SDK: pkg/ioutils: Remove deprecated NopWriter and NopWriteCloser. moby/moby#49256

breakingGo-SDK: pkg/sysinfo: Remove deprecated NumCPU. moby/moby#49242

breakingGo-SDK: Remove pkg/broadcaster, as it was only used internally moby/moby#49172

breakingGo-SDK: Remove deprecated cli.Errors type docker/cli#5549

breakingRemove pkg/ioutils.ReadCloserWrapper, as it was only used in tests. moby/moby#49237

breakingRemove deprecated api-cors-header config parameter and the dockerd --api-cors-header option moby/moby#48209

breakingRemove deprecated APIEndpoint.Version field, APIVersion type, and APIVersion1 and APIVersion2 consts. moby/moby#49004

breakingRemove deprecated api-cors-header config parameter and the Docker daemon's --api-cors-header option. docker/cli#5437

breakingRemove deprecated pkg/directory package moby/moby#48779

breakingRemove deprecated pkg/dmsg.Dmesg() moby/moby#48109

breakingRemove deprecated image/spec package, which was moved to a separate module (github.com/moby/docker-image-spec) moby/moby#48460

breakingRemove migration code and errors for the deprecated logentries logging driver. moby/moby#48891

breakingRemove support for deprecated external graph-driver plugins. moby/moby#48072

breakingapi/types: Remove deprecated container.ContainerNode and ContainerJSONBase.Node field. moby/moby#48107

breakingapi/types: Remove deprecated aliases: ImagesPruneReport, VolumesPruneReport, NetworkCreateRequest, NetworkCreate, NetworkListOptions, NetworkCreateResponse, NetworkInspectOptions, NetworkConnect, NetworkDisconnect, EndpointResource, NetworkResource, NetworksPruneReport, ExecConfig, ExecStartCheck,…

breakinglibnetwork/iptables: Remove deprecated IPV, Iptables, IP6Tables and Passthrough(). moby/moby#49121

breakingpkg/archive: Remove deprecated CanonicalTarNameForPath, NewTempArchive, TempArchive moby/moby#48708

breakingpkg/fileutils: Remove deprecated GetTotalUsedFds moby/moby#49210

breakingpkg/ioutils: Remove OnEOFReader, which was only used internally moby/moby#49170

breakingpkg/longpath: Remove deprecated Prefix constant. moby/moby#48779

breakingpkg/stringid: Remove deprecated IsShortID and ValidateID functions moby/moby#48705

breakingrunconfig/opts: Remove deprecated ConvertKVStringsToMap moby/moby#48102

breakingrunconfig: Remove deprecated ContainerConfigWrapper, SetDefaultNetModeIfBlank, DefaultDaemonNetworkMode, IsPreDefinedNetwork moby/moby#48102

breakingcontainer: Remove deprecated ErrNameReserved, ErrNameNotReserved. moby/moby#48728

breakingRemove Daemon.ContainerInspectCurrent() method and change Daemon.ContainerInspect() signature to accept a backend.ContainerInspectOptions struct moby/moby#48672

breakingRemove deprecated Daemon.Exists() and Daemon.IsPaused() methods. moby/moby#48723

deprecatedAPI: The BridgeNfIptables and BridgeNfIp6tables fields in the GET /info response are now always be false and will be omitted in API v1.49. The netfilter module is now loaded on-demand, and no longer during daemon startup, making these fields obsolete. moby/moby#49114

deprecatedAPI: The error and progress fields in streaming responses for endpoints that return a JSON progress response, such as POST /images/create, POST /images/{name}/push, and POST /build are deprecated. moby/moby#49447

deprecatedUsers should use the information in the errorDetail and progressDetail fields instead.

deprecatedThese fields were marked deprecated in API v1.4 (docker v0.6.0) and API v1.8 (docker v0.7.1) respectively, but still returned.

+173 more items in the release notes

27.5.1 Jan 22, 2025 Release notes ↗

otherdocker/cli, 27.5.1 milestone

othermoby/moby, 27.5.1 milestone

fixFixed an issue that could persistently prevent daemon startup after failure to initialize the default bridge. moby/moby#49307

fixAdd a DOCKER_IGNORE_BR_NETFILTER_ERROR environment variable. Setting it to 1 allows running on hosts that cannot load br_netfilter. Some things won't work, including disabling inter-container communication in a bridge network. With the userland proxy disabled, it won't be possible to access one…

securityUpdate Go runtime to 1.22.11 (fix CVE-2024-45341, CVE-2024-45336). moby/moby#49312, docker/docker-ce-packaging#1147, docker/cli#5762

otherUpdate RootlessKit to v2.3.2 to support passt >= 2024_10_30.ee7d0b6. moby/moby#49304

otherUpdate Buildx to v0.20.0. docker/docker-ce-packaging#1149

27.5.0 Jan 13, 2025 Release notes ↗

otherdocker/cli, 27.5.0 milestone

othermoby/moby, 27.5.0 milestone

fixcontainerd image store: Fix passing a build context via tarball to the /build endpoint. moby/moby#49194

fixBuilder garbage collection policies without a keepStorage value now inherit the defaultKeepStorage limit as intended. moby/moby#49137

fixPreserve network labels during daemon startup. moby/moby#49200

fixFix a potential race condition error when deleting a container. moby/moby#49239

deprecatedpkg/sysinfo: deprecate NumCPU. This utility has the same behavior as runtime.NumCPU. moby/moby#49247

deprecatedpkg/fileutils: deprecate GetTotalUsedFds: this function is only used internally and will be removed in the next release. moby/moby#49209

deprecatedpkg/ioutils: deprecate BytesPipe, NewBytesPipe, ErrClosed, WriteCounter, NewWriteCounter, NewReaderErrWrapper, NopFlusher, NopWriter, NopWriteCloser. They were only used internally and will be removed in the next release. moby/moby#49246, moby/moby#49255

deprecatedpkg/reexec: This package is deprecated and moved to a separate module. Use github.com/moby/sys/reexec instead. moby/moby#49135

otherUpdate containerd to v1.7.25 moby/moby#49253

otherUpdate runc to v1.2.4 moby/moby#49243

otherUpdate BuildKit to v0.18.2 moby/moby#48949

otherUpdate Compose to v2.32.2 docker/docker-ce-packaging#1140

27.4.1 Dec 18, 2024 Release notes ↗

otherdocker/cli, 27.4.1 milestone

othermoby/moby, 27.4.1 milestone

fixFix excessive memory allocations when OTel is not configured. moby/moby#49079

fixThe docker info command and the corresponding GET /info API endpoint no longer include warnings when bridge-nf-call-iptables or bridge-nf-call-ip6tables are disabled at the daemon is started. The br_netfilter kernel module is now attempted to be loaded when needed, which made those warnings…

fixAttempt to load kernel modules, including ip6_tables and br_netfilter when required, using a method that is likely to succeed inside a Docker-in-Docker container. moby/moby#49043

fixFix a bug that could result in an iptables DOCKER FILTER chain not being cleaned up on failure. moby/moby#49110

deprecatedpkg/system: Deprecate Lstat(), Mkdev(), Mknod(), FromStatT() and Stat() functions, and related StatT types. These were only used internally, and will be removed in the next release. moby/moby#49100

deprecatedlibnetwork/iptables: Deprecate IPV, Iptables and IP6Tables types in favor of IPVersion, IPv4, and IPv6. This type and consts will be removed in the next release. moby/moby#49093

deprecatedlibnetwork/iptables: Deprecate Passthrough. This function was only used internally, and will be removed in the next release. moby/moby#49119

otherUpdate Compose to v2.32.1. docker/docker-ce-packaging#1130

otherUpdate Buildx to v0.19.3. docker/docker-ce-packaging#1132

otherUpdate runc to v1.2.3 (static packages only). moby/moby#49085

27.4.0 Dec 9, 2024 Release notes ↗

otherdocker/cli, 27.4.0 milestone

othermoby/moby, 27.4.0 milestone

otherGET /images/json with the manifests option enabled now preserves the original order in which manifests appeared in the manifest-index. moby/moby#48712

fixWhen reading logs with the jsonfile or local log drivers, any errors while trying to read or parse underlying log files will cause the rest of the file to be skipped and move to the next log file (if one exists) rather than returning an error to the client and closing the stream. The errors are…

fixWhen reading log files, compressed log files are now only decompressed when needed rather than decompressing all files before starting the log stream. moby/moby#48842

fixFix an issue that meant published ports from one container on a bridge network were not accessible from another container on the same network with userland-proxy disabled, if the kernel's br_netfilter module was not loaded and enabled. The daemon will now attempt to load the module and enable…

fixFix loading of bridge and br_netfilter kernel modules. moby/moby#48966

fixcontainerd image store: Fix Docker daemon failing to fully start with a "context deadline exceeded error" with containerd snapshotter and many builds/images. moby/moby#48954

fixcontainerd image-store: Fix partially pulled images not being garbage-collected. moby#48910, moby/moby#48957

fixcontainerd image store: Fix docker image inspect outputting duplicate references in RepoDigests. moby/moby#48785

fixcontainerd image store: Fix not being able to connect to some insecure registries in cases where the HTTPS request failed due to a non-TLS related error. moby/moby#48758

fixcontainerd image store: Remove a confusing warning log when tagging a non-dangling image. moby/moby#49010

fixdockerd-rootless-setuptool.sh: let --force ignore smoke test errors moby/moby#48695

fixDisable IPv6 Duplicate Address Detection (DAD) for addresses assigned to the bridges belonging to bridge networks. moby/moby#48684

fixRemove BuildKit init timeout. moby/moby#48963

fixIgnore "dataset does not exist" error when removing dataset on ZFS. moby/moby#48968

fixClient: Prevent idle connections leaking FDs. moby/moby#48764

fixFix anonymous volumes being created through the --mount option not being marked as anonymous. moby/moby#48755

fixAfter a daemon restart with live-restore, ensure an iptables jump to the DOCKER-USER chain is placed before other rules. moby/moby#48714

fixFix a possible memory leak caused by OTel meters. moby/moby#48693

fixCreate distinct build history db for each store. moby/moby#48688

fixFix an issue that caused excessive memory usage when DNS resolution was made in a tight loop. moby/moby#48840

fixcontainerd image store: Do not underline names in docker image ls --tree. docker/cli#5519

fixcontainerd image store: Change name of USED column in docker image ls --tree to IN USE. docker/cli#5518

fixFix a bug preventing image pulls from being cancelled during docker run. docker/cli#5654

fixPort some completions from the bash completion to the new cobra based completion. docker/cli#5618

fixThe docker login and docker logout command no longer update the configuration file if the credentials didn't change. docker/cli#5569

fixOptimise docker stats to reduce flickering issues. docker/cli#5588, docker/cli#5635

fixFix inaccessible plugins paths preventing plugins from being detected. docker/cli#5652

fixAdd support for events --filter in cobra generated shell completions. docker/cli#5614

fixFix bash completion for events --filter daemon=. docker/cli#5563

fixImprove shell-completion of containers for docker rm. docker/cli#5540

fixAdd shell-completion for --platform flags. docker/cli#5540

fixrootless: Make /etc/cdi and /var/run/cdi accessible by the Container Device Interface (CDI) integration. moby/moby#49027

breakingDeprecate Daemon.Exists() and Daemon.IsPaused(). These functions are no longer used and will be removed in the next release. moby/moby#48719

breakingDeprecate container.ErrNameReserved and container.ErrNameNotReserved. moby/moby#48697

breakingDeprecate pkg/platform - this package is only used internally, and will be removed in the next release. moby/moby#48863

breakingDeprecate RepositoryInfo.Class. This field is no longer used, and will be removed in the next release. moby/moby#49013

breakingGo SDK: Fix deprecation of cli/command.ConfigureAuth(), which was deprecated since v27.2.1. docker/cli#5552

breakingGo SDK: Deprecate cli.Errors type in favour of Go's errors.Join docker/cli#5548

+7 more items in the release notes

27.3.1 Sep 20, 2024 Release notes ↗

otherdocker/cli, 27.3.1 milestone

othermoby/moby, 27.3.1 milestone

fixCLI: Fix issue with command execution metrics not being exported due to the CLI MeterProvider being shutdown too early. docker/cli#5457

otherUpdate Compose to v2.29.7

27.3.0 Sep 19, 2024 Release notes ↗

otherdocker/cli, 27.3.0 milestone

othermoby/moby, 27.3.0 milestone

fixcontainerd image store: Fix docker image prune -a untagging images used by containers started from images referenced by a digested reference. moby/moby#48488

fixAdd a --feature flag to the daemon options. moby/moby#48487

fixUpdated the handling of the --gpus=0 flag to be consistent with the NVIDIA Container Runtime. moby/moby#48483 (https://github.com/docker/cli/pull/5432)

fixSupport WSL2 mirrored-mode networking's use of interface loopback0 for packets from the Windows host. moby/moby#48514

fixFix an issue that prevented communication between containers on an IPv4 bridge network when running with --iptables=false, --ip6tables=true (the default), a firewall with a DROP rule for forwarded packets on hosts where the br_netfilter kernel module was not normally loaded. moby/moby#48511

fixCLI: Fix issue where docker volume update command would cause the CLI to panic if no argument/volume was passed. docker/cli#5426

fixCLI: Properly report metrics when run in WSL environment on Windows. [docker/cli#5432]

otherUpdate containerd (static binaries only) to v1.7.22 moby/moby#48468

otherUpdated Buildkit to v0.16.0

otherUpdate Compose to v2.29.6

otherUpdate Buildx to v0.17.1

27.2.1 Sep 9, 2024 Release notes ↗

otherdocker/cli, 27.2.1 milestone

othermoby/moby, 27.2.1 milestone

fixcontainerd image store: Fix non-container images being hidden in the docker image ls output. moby/moby#48402

fixcontainerd image store: Improve docker pull error message when the image platform doesn't match. moby/moby#48415

fixCLI: Fix issue causing docker login to not remove repository names from passed in registry addresses, resulting in credentials being stored under the wrong key. docker/cli#5385

fixCLI: Fix issue that will sometimes cause the browser-login flow to fail if the CLI process is suspended and then resumed while waiting for the user to authenticate. docker/cli#5376

fixCLI: docker login now returns an error instead of hanging if called non-interactively with --password or --password-stdin but without --user. docker/cli#5402

securityUpdate runc to v1.1.14, which contains a fix for CVE-2024-45310. moby/moby#48426

otherUpdate Go runtime to 1.22.7. moby/moby#48433, docker/cli#5411, docker/docker-ce-packaging#1068

27.2.0 Aug 27, 2024 Release notes ↗

otherdocker/cli, 27.2.0 milestone

othermoby/moby, 27.2.0 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

featureCLI: Add support for device-code flow login when authenticating to the official registry. docker/cli#5349

featurecontainerd image store: docker image ls now supports --tree flag that shows a multiplatform-aware image list. This is experimental and may change at any time without any backwards compatibility. docker/cli#5353

featureGET /images/json response now includes Manifests field, which contains information about the sub-manifests included in the image index. This includes things like platform-specific manifests and build attestations. The new field will only be populated if the request also sets the manifests query…

fixCLI: Fix issue with remote contexts over SSH where the CLI would allocate a pseudoterminal when connecting to the remote host, which causes issues in rare situations. docker/cli#5351

fixFix an issue that prevented network creation with a --ip-range ending on a 64-bit boundary. moby/moby#48326

fixCLI: IPv6 addresses shown by docker ps in port bindings are now bracketed. docker/cli#5365

fixcontainerd image store: Fix early error exit from docker load in cases where unpacking the image would fail. moby/moby#48376

fixcontainerd image store: Fix the previous image not being persisted as dangling after docker pull. moby/moby#48380

otherUpdate BuildKit to v0.15.2. moby/moby#48341

otherUpdate Compose to v2.29.2. docker/docker-ce-packaging#1050

otherThe canonical source for the dockerd(8) man page has been moved back to the same source tree as dockerd itself. moby/moby#48378

otherUpdate containerd to v1.7.21. moby/moby#48383, docker/containerd-packaging#389

27.1.2 Aug 13, 2024 Release notes ↗

otherdocker/cli, 27.1.2 milestone

othermoby/moby, 27.1.2 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

fixFix a regression that could result in a ResourceExhausted desc = grpc: received message larger than max error when building from a large Dockerfile. moby/moby#48245

fixCLI: Fix docker attach printing a spurious context cancelled error message. docker/cli#5296

fixCLI: Fix docker attach exiting on SIGINT instead of forwarding the signal to the container and waiting for it to exit. docker/cli#5302

fixCLI: Fix --device-read-bps and --device-write-bps options not taking effect. docker/cli#5339

fixCLI: Fix a panic happening in some cases while running a plugin. docker/cli#5337

otherUpdate BuildKit to v0.15.1. moby/moby#48246

otherUpdate Buildx to v0.16.2. docker/docker-ce-packaging#1043

otherUpdate Go runtime to 1.21.13. moby/moby#48301, docker/cli#5325, docker/docker-ce-packaging#1046

breakingRemove unused docker-proxy.exe binary from Windows packages. docker/docker-ce-packaging#1045

27.1.1 Jul 23, 2024 Release notes ↗

securityThis release contains a fix for CVE-2024-41110 / GHSA-v23v-6jw2-98fq that impacted setups using authorization plugins (AuthZ) for access control. No other changes are included in this release, and this release is otherwise identical for users not using AuthZ plugins.

otherUpdate Compose to v2.29.1. moby/docker-ce-packaging#1041

27.1.0 Jul 22, 2024 Release notes ↗

otherdocker/cli, 27.1.0 milestone

othermoby/moby, 27.1.0 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

fixrootless: add Requires=dbus.socket to prevent errors when starting the daemon on a cgroup v2 host with systemd moby/moby#48141

fixcontainerd integration: image tag event is now properly emitted when building images with BuildKit moby/moby#48182

fixCLI: enable shell completion for docker image rm, docker image history, and docker image inspect moby/moby#5261

fixCLI: add and improve shell completions for various flags moby/moby#5261

fixCLI: add OOMScoreAdj to docker service create and docker stack docker/cli#5274

fixCLI: add support for DOCKER_CUSTOM_HEADERS environment variable (experimental) docker/cli#5271

fixCLI: containerd-integration: Fix docker push defaulting the --platform flag to a value of DOCKER_DEFAULT_PLATFORM environment variable on unsupported API versions docker/cli#5248

fixCLI: fix: context cancellation on login prompt docker/cli#5260

fixCLI: fix: wait for the container to exit before closing the stream when sending a termination request to the CLI while attached to a container docker/cli#5250

deprecatedThe pkg/rootless/specconv package is deprecated, and will be removed in the next release moby/moby#48185

deprecatedThe pkg/containerfs package is deprecated, and will be removed in the next release moby/moby#48185

deprecatedThe pkg/directory package is deprecated, and will be removed in the next release moby/moby#48185

deprecatedapi/types/system: remove deprecated Info.ExecutionDriver moby/moby#48184

otherUpdate Buildx to v0.16.1. moby/docker-ce-packaging#1039

otherUpdate Compose to v2.29.0. moby/docker-ce-packaging#1038

otherUpdate Containerd (static binaries only) to v1.7.20. moby/moby#48191

otherUpdate BuildKit to v0.15.0. moby/moby#48175

securityUpdate Go runtime to 1.21.12, which contains security fixes for CVE-2024-24791 moby/moby#48120

27.0.3 Jul 1, 2024 Release notes ↗

otherdocker/cli, 27.0.3 milestone

othermoby/moby, 27.0.3 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

fixFix a regression that incorrectly reported a port mapping from a host IPv6 address to an IPv4-only container as an error. moby/moby#48090

fixFix a regression that caused duplicate subnet allocations when creating networks. moby/moby#48089

fixFix a regression resulting in "fail to register layer: failed to Lchown" errors when trying to pull an image with rootless enabled on a system that supports native overlay with user-namespaces. moby/moby#48086

27.0.2 Jun 26, 2024 Release notes ↗

otherdocker/cli, 27.0.2 milestone

othermoby/moby, 27.0.2 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

fixFix a regression that caused port numbers to be ignored when parsing a Docker registry URL. docker/cli#5197, docker/cli#5198

breakingapi/types: deprecate ContainerJSONBase.Node field and ContainerNode type. These definitions were used by the standalone ("classic") Swarm API, but never implemented in the Docker Engine itself. moby/moby#48055

27.0.1 Jun 25, 2024 Release notes ↗

deprecatedDeprecated and removed features, see Deprecated Features.

featurecontainerd image store: Add --platform flag to docker image push and improve the default behavior when not all platforms of the multi-platform image are available locally. docker/cli#4984, moby/moby#47679

featureAdd support to docker stack deploy for driver_opts in a service's networks. docker/cli#5125

featureConsider additional /usr/local/libexec and /usr/libexec paths when looking up the userland proxy binaries by a name with a docker- prefix. moby/moby#47804

featureAllow sysctls to be set per-interface during container creation and network connection. moby/moby#47686

featureThere is no impact if you are running Docker Engine with ip6tables enabled (new default).

breakingIf you are using an IPv6-enabled bridge network without ip6tables, this is likely a breaking change. Only published container ports (-p or --publish) are accessible from outside the Docker bridge network, and outgoing connections masquerade as the host.

featureA Unique Local Address (ULA) base prefix is automatically added to default-address-pools if this parameter wasn't manually configured, or if it contains no IPv6 prefixes. moby/moby#47853

featurePrior to this release, to create an IPv6-enabled network it was necessary to use the --subnet option to specify an IPv6 subnet, or add IPv6 ranges to default-address-pools in daemon.json.

featureStarting in this release, when a bridge network is created with --ipv6 and no IPv6 subnet is defined by those options, an IPv6 Unique Local Address (ULA) base prefix is used.

featureThe ULA prefix is derived from the Engine host ID such that it's unique across hosts and over time.

featureIPv6 address pools of any size can now be added to default-address-pools. moby/moby#47768

featureIPv6 can now be enabled by default on all custom bridge networks using "default-network-opts": { "bridge": {"com.docker.network.enable_ipv6": "true"}} in daemon.json, or dockerd --default-network-opt=bridge=com.docker.network.enable_ipv6=trueon the comand line. moby/moby#47867

featureDirect routing for IPv6 networks, with ip6tables enabled. moby/moby#47871

featureAdded bridge driver option com.docker.network.bridge.gateway_mode_ipv6=.

featureThe default behavior, nat, is unchanged from previous releases running with ip6tables enabled. NAT and masquerading rules are set up for each published container port.

featureWhen set to routed, no NAT or masquerading rules are configured for published ports. This enables direct IPv6 access to the container, if the host's network can route packets for the container's address to the host. Published ports will be opened in the container's firewall.

featureWhen a port mapping only applies to routed mode, only addresses 0.0.0.0 or :: are allowed and a host port must not be given.

featureNote that published container ports, in nat or routed mode, are accessible from any remote address if routing is set up in the network, unless the Docker host's firewall has additional restrictions. For example: docker network create --ipv6 -o com.docker.network.bridge.gateway_mode_ipv6=routed…

featureThe option com.docker.network.bridge.gateway_mode_ipv4= is also available, with the same behavior but for IPv4.

featureIf firewalld is running on the host, Docker creates policy docker-forwarding to allow forwarding from any zone to the docker zone. This makes it possible to configure a bridge network with a routable IPv6 address, and no NAT or masquerading. moby/moby#47745

featureWhen a port is published with no host port specified, or a host port range is given, the same port will be allocated for IPv4 and IPv6. moby/moby#47871

featureFor example -p 80 will result in the same ephemeral port being allocated for 0.0.0.0 and ::, and -p 8080-8083:80 will pick the same port from the range for both address families.

featureSimilarly, ports published to specific addresses will be allocated the same port. For example, -p 127.0.0.1::80 -p '[::1]::80'.

featureIf no port is available on all required addresses, container creation will fail.

featureEnvironment variable DOCKER_ALLOW_IPV6_ON_IPV4_INTERFACE, introduced in release 26.1.1, no longer has any effect. moby/moby#47963

featureIf IPv6 could not be disabled on an interface because of a read-only /proc/sys/net, the environment variable allowed the container to start anyway.

featureIn this release, if IPv4 cannot be disabled for an interface, IPv6 can be explicitly enabled for the network simply by using --ipv6 when creating it. Other workarounds are to configure the OS to disable IPv6 by default on new interfaces, mount /proc/sys/net read-write, or use a kernel with no IPv6…

breakingDeprecate experimental GraphDriver plugins. moby/moby#48050, docker/cli#5172

breakingpkg/archive: deprecate NewTempArchive and TempArchive. These types were only used in tests and will be removed in the next release. moby/moby#48002

breakingpkg/archive: deprecate CanonicalTarNameForPath moby/moby#48001

breakingDeprecate pkg/dmesg. This package was no longer used, and will be removed in the next release. moby/moby#47999

breakingDeprecate pkg/stringid.ValidateID and pkg/stringid.IsShortID moby/moby#47995

breakingrunconfig: deprecate SetDefaultNetModeIfBlank and move ContainerConfigWrapper to api/types/container moby/moby#48007

breakingrunconfig: deprecate DefaultDaemonNetworkMode and move to daemon/network moby/moby#48008

breakingrunconfig: deprecate opts.ConvertKVStringsToMap. This utility is no longer used, and will be removed in the next release. moby/moby#48016

breakingrunconfig: deprecate IsPreDefinedNetwork. moby/moby#48011

deprecatedDeprecate non-standard (config) fields in image inspect output. The Config field returned by this endpoint (used for docker image inspect) returned additional fields that are not part of the image's configuration and not part of the [Docker Image Spec] and the [OCI Image Spec]. These fields are…

deprecatedDeprecate the daemon flag --api-cors-header and the corresponding daemon.json configuration option. These will be removed in the next major release. moby/moby#45313

breakingRemove deprecated aliases for Image types. moby/moby#47900

+97 more items in the release notes