Docker Engine 28.3.2 → 29.9.0

38 releases · 22 breaking changes · 50 security fixes · 6 advisories fixed

50security22breaking86deprecated30feature181fix

Is 28.3.2 affected? · What changed up to 29.9.2

Vulnerabilities fixed by this upgrade

7.6 CVE-2026-92543 Docker Engine insecure-registry fallback via malicious DNS responses
7.2 CVE-2026-42306 Race condition in docker cp allows bind mount redirection to host path
6.1 CVE-2026-41568 Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap
7.2 CVE-2026-41567 `PUT /containers/{id}/archive` executes container binary on the host
8.8 CVE-2026-34040 AuthZ plugin bypass with oversized request body
6.8 CVE-2026-33997 Off-by-one error in plugin privilege validation

Breaking changes

breaking Revert a PR breaking external DNS resolution on all custom bridge networks. moby/moby#51615 in 29.1.1
breaking The Go module github.com/docker/docker is deprecated in favor of github.com/moby/moby/client and github.com/moby/moby/api. The github.com/moby/moby module is considered an internal implementation detail - the only supported public modules are client and api. Starting with v29, releases are tagged… in 29.0.0
breaking Debian armhf (32-bit) packages now target ARMv7 CPUs and will not work on ARMv6 devices. in 29.0.0
breaking Official Raspbian (32-bit) packages are no longer provided. Use Debian arm64 packages for 64-bit devices, or Debian armhf packages for 32-bit ARMv7 devices. in 29.0.0
breaking cgroup v1 is deprecated. Support continues until at least May 2029, but migrate to cgroup v2 as soon as possible. See moby#51111. in 29.0.0
breaking Docker Content Trust was removed from the Docker CLI. Can be built as a separate plugin: https://github.com/docker/cli/blob/v29.0.0/cmd/docker-trust/main.go in 29.0.0
breaking The daemon now requires API version v1.44 or later (Docker v25.0+). in 29.0.0
breaking client: remove legacy CBC cipher suites from client config. moby/moby#50126 in 29.0.0
breaking contrib: remove editorconfig as it was unmaintained. moby/moby#50607 in 29.0.0
breaking contrib: remove Dockerfile syntax highlighting files for nano and TextMate (tmbundle) as they were unmaintained and outdated. moby/moby#50606 in 29.0.0
breaking contrib: remove mkimage-xxx scripts as they were unmaintained and not tested. moby/moby#50297 in 29.0.0
breaking Ensure bridge devices are removed when bridge network creation fails. moby/moby#51147 in 29.0.0
breaking The iptables rules for bridge networks have been updated, including removal of the DOCKER-ISOLATION-STAGE-1 and DOCKER-ISOLATION-STAGE-2 chains. With these changes:. moby/moby#49981 in 29.0.0
breaking POST /images/{name:}/push: remove compatibility with API v1.4 auth-config in body. moby/moby#50371 in 29.0.0
breaking api/types/plugin: remove deprecated Config.DockerVersion. moby/moby#51458 in 29.0.0
breaking api/types/swarm: deprecated and dropped support for PortConfigProtocol; use network.IPProtocol instead. moby/moby#51094 in 29.0.0
breaking api/pkg/progress and api/pkg/streamformatter have been removed. moby/moby#51153 in 29.0.0
breaking api: remove unused DefaultVersion, MinSupportedAPIVersion consts. moby/moby#50587 in 29.0.0
breaking client: ContainerCommitOptions: remove Pause field in favor of NoPause. moby/moby#51019 in 29.0.0
breaking client: remove client.ContainerStatsResult.OSType field. moby/moby#51305 in 29.0.0
breaking Remove structs NetworkSettingsBase and DefaultNetworkSettings. Fields in NetworkSettingsBase that were not deprecated are now directly in NetworkSettings. moby/moby#50846 in 29.0.0
breaking Remove support for legacy CBC cipher suites. docker/cli#6474 in 28.5.0

Security changes

security CVE-2026-97032: An HTTP/2 client could crash the daemon by changing the HPACK header table size while sending requests. golang/go#81867 in 29.9.0
security CVE-2026-78659: An HTTP/2 client could exhaust daemon memory by declaring a large number of fields in a Trailer header, bypassing the header size limits. golang/go#81857 in 29.9.0
security CVE-2026-78663: An HTTP/2 client could bypass the connection-level flow control limit by resetting streams, making the daemon buffer more request data than the limit allows. golang/go#81743 in 29.9.0
security CVE-2026-78669: An HTTP/2 client could cause excessive daemon CPU use by opening many streams and repeatedly changing the initial window size. golang/go#81742 in 29.9.0
security CVE-2026-56857: On Windows, the daemon could create a directory outside its data root if someone with write access to the data root had placed a junction there. golang/go#81739 in 29.9.0
security Release a node's IPsec security associations and policies when the last container leaves an encrypted overlay network, instead of leaking them until the daemon restarts. moby/moby#53420 in 29.9.0
security CVE-2026-53493: Pulling a crafted OCI image index with deeply nested or widely fanned-out descriptors could cause unbounded CPU and memory use. GHSA-pg57-6jwg-q645 in 29.8.2
security CVE-2026-92543: A malicious DNS response could make registry connections skip TLS certificate verification or fall back to HTTP, exposing registry credentials or allowing image substitution. GHSA-7cfq-22r6-qp73 in 29.8.2
security CVE-2026-92542: Unprivileged users on a Swarm node could inject forged Ethernet frames into encrypted overlay networks on peer nodes. GHSA-6m9p-4h64-m6vh in 29.8.2
security CVE-2026-93315: A build step could redirect proxy CA cleanup outside the build root filesystem, block it with a special file, or let the build succeed when cleanup failed. GHSA-2f5p-x9ph-g97x in 29.8.2
security CVE-2026-93316: A build that requested CDI devices could cause a daemon panic when CDI support was disabled, for example with "features": {"cdi": false} in daemon.json. GHSA-r456-g3gm-cvxf in 29.8.2
security CVE-2026-93317: With the containerd image store, a client using the low-level LLB API could poison the build cache with container blob contents that did not match their claimed digest. GHSA-p3rc-w3hc-pqvv in 29.8.2
security CVE-2026-93318: A malicious image could poison the build cache with layer DiffIDs that did not match the actual layer contents. GHSA-f2v9-hprr-32q3 in 29.8.2
security CVE-2026-93319: A malicious external frontend could crash the daemon through gateway container lifecycle races or malformed requests and definitions. GHSA-4hgw-qrhw-fhg8 in 29.8.2
security CVE-2026-93320: Daemon-side snapshot reads and LLB mkfile operations did not safely handle special files. GHSA-9728-qjrv-2xh2 in 29.8.2
security CVE-2026-93321: A malformed LLB file operation with invalid symlink owner inputs could crash the daemon. GHSA-fjj4-h6vf-m9hj in 29.8.2
security CVE-2026-93322: A malformed LLB merge operation with mismatched input counts could crash the daemon. GHSA-cv6p-7w7g-xjwq in 29.8.2
security CVE-2026-93323: An oversized Dockerfile, .dockerignore, gateway file, or nested LLB definition could exhaust daemon memory. GHSA-mgqf-486f-49vp in 29.8.2
security CVE-2026-93326: A crafted Git build source could bypass source policy rules that match on the repository URL, through a Git bundle locator or a full remote URL that did not match the source identifier. GHSA-66hf-6vf5-87hc in 29.8.2
security Add daemon support for configuring the default container AppArmor profile template. moby/moby#52771 in 29.8.0
security Prevent containers from using the 32-bit socketcall(2) path to create AF_VSOCK sockets and communicate with host virtual machines by adding AppArmor and SELinux policy rules. moby/moby#53551 in 29.8.0
security Update github.com/moby/go-archive to v0.3.0 to fix CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h. moby/moby#53247, docker/cli#7139 in 29.7.0
security CVE-2026-15793: Git source checkout from a bundle file could lead to command injection. GHSA-hw3h-2gp9-cxpv in 29.6.2
security CVE-2026-15792: Incorrect parameters sent from a frontend could cause a panic. GHSA-qx3x-mv6r-52p6 in 29.6.2
security CVE-2026-15791: An LLB file operation could be tricked into removing the contents of the /tmp directory. GHSA-32pv-7hq5-qhwq in 29.6.2
security CVE-2026-15789: A malicious client could bypass destination directory validation when uploading local sources. GHSA-g2h8-426c-7976 in 29.6.2
security CVE-2026-15788: A WCOW cache mount source selector could resolve NTFS junctions outside of the cache root. GHSA-388v-wmr2-g2v2 in 29.6.2
security A malicious image could supply a malicious /etc/passwd or /etc/group-style file causing excessive memory consumption, potentially resulting in process termination due to Out Of Memory (OOM) conditions. GHSA-mjcv-p78q-w5fw, GHSA-jpcc-p29g-p8mq, GHSA-72x6-4j93-7w86 in 29.6.1
security A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the security.insecure entitlement. Other security measures, like Linux capabilities were still applied to these containers.… in 29.6.1
security CVE-2026-41567 Fix a vulnerability in docker cp where archive decompression binaries (e.g. xz, unpigz) were resolved via PATH inside the container filesystem while running as host root, allowing a malicious container to execute arbitrary binaries with host root privileges. GHSA-x86f-5xw2-fm2r in 29.5.1
security CVE-2026-41568 Fix a TOCTOU vulnerability in docker cp that allowed a container process to create files or directories at arbitrary locations on the host filesystem. GHSA-vp62-88p7-qqf5 in 29.5.1
security CVE-2026-42306 Fix a TOCTOU vulnerability in docker cp that allowed a container process to redirect a bind mount to an arbitrary location on the host filesystem. GHSA-rg2x-37c3-w2rh in 29.5.1
security CVE-2026-32288: Fix a denial of service where pulling a maliciously crafted image could cause the daemon to allocate unbounded memory when processing sparse tar archives. GHSA-x4jj-h2v8-hqqv. moby/moby#52478 in 29.5.0
security CVE-2026-31431: Fix the 29.4.2 regression that broke 32-bit programs and i386 images. The broad socketcall(2) seccomp deny is replaced with targeted AppArmor (deny network alg) and SELinux (alg_socket) rules that block AF_ALG at the LSM layer, covering both socket(2) and socketcall(2) paths… in 29.4.3
security This release includes hardening for CVE-2026-31431. in 29.4.2
security Block AF_ALG sockets and the socketcall(2) multiplexer in the default seccomp profile to prevent in-container privilege escalation via the kernel crypto API ("Copy Fail"). moby/moby#52501 in 29.4.2
security If you need a workaround, use the seccomp/v0.2.1 profile from moby/profiles. Make sure you use a kernel that includes the fix for CVE-2026-31431. in 29.4.2
security [!IMPORTANT] Use this workaround only for containers that require it. Containers that use this profile can still exploit CVE-2026-31431 through the socketcall syscall. in 29.4.2
security To use the profile for a specific container when you control the docker run command, use --security-opt: in 29.4.2
security CVE-2026-34040 Fix an authorization bypass in AuthZ plugins that could allow authorization plugins to be bypassed under specific conditions. GHSA-x744-4wpc-v9h2 in 29.3.1
security CVE-2026-33997 Fix a flaw in docker plugin install where privilege validation could be partially bypassed, potentially leading to unauthorized privilege escalation. GHSA-pxq6-2prw-chj9 in 29.3.1
security CVE-2026-33748 Fix insufficient validation of Git URL #ref:subdir fragments in BuildKit, which could allow access to files outside the intended repository scope. GHSA-4vrq-3vrq-g6gg in 29.3.1
security CVE-2026-33747 Fix a vulnerability in BuildKit where an untrusted frontend could cause files to be written outside the BuildKit state directory. GHSA-3c29-8rgm-jvjj in 29.3.1
security Update Go runtime to 1.25.5. moby/moby#51648, docker/cli#6688 in 29.1.2
security Fixes a potential DoS via excessive resource usage when formatting hostname validation errors CVE-2025-61729 in 29.1.2
security Fixes incorrect enforcement of excluded subdomain constraints for wildcard SANs, which could allow improperly trusted certificates CVE-2025-61727 in 29.1.2
security CVE-2025-31133 in 28.5.2
security CVE-2025-52565 in 28.5.2
security CVE-2025-52881 in 28.5.2
security This release fixes an issue where, after a firewalld reload, published container ports could be accessed directly from the local network, even when they were intended to be accessible only via a loopback address. CVE-2025-54388 / GHSA-x4rx-4gw3-53p4 / moby/moby#50506. in 28.3.3

Deprecations

deprecated The Engine now returns a deprecation warning when a container connected to the default bridge is created with links specified. moby/moby#47427 in 29.6.0
deprecated cli/command/image/build: remove deprecated DefaultDockerfileName const. docker/cli#6737 in 29.5.0
deprecated cli/command/image/build: remove deprecated DetectArchiveReader util. docker/cli#6737 in 29.5.0
deprecated cli/command/image/build: remove deprecated IsArchive utility. docker/cli#6737 in 29.5.0
deprecated cli/command/image/build: remove deprecated ResolveAndValidateContextPath util. docker/cli#6737 in 29.5.0
deprecated cli/command/image/build: remove deprecated WriteTempDockerfile util. docker/cli#6737 in 29.5.0
deprecated Go SDK: cli-plugins/hooks: deprecate HookMessage and rename to cli-plugins/hooks.Response. docker/cli#6859 in 29.4.0
deprecated Go SDK: cli-plugins/hooks: deprecate HookType and rename to cli-plugins/hooks.ResponseType. docker/cli#6859 in 29.4.0
deprecated Go SDK: cli-plugins/manager: deprecate HookPluginData and move to cli-plugins/hooks.Request. docker/cli#6859 in 29.4.0
deprecated Remove %PROGRAMDATA%\Docker\cli-plugins from the list of paths used for CLI plugins on Windows. This path was present for backward compatibility with old installation, but replaced by %ProgramFiles%\Docker\cli-plugins. docker/cli#6713 in 29.2.0
deprecated api/types/system: deprecated top level DiskUsage fields for type specific fields. moby/moby#51235 in 29.0.0
deprecated Environment variables set on a container using legacy links are deprecated and aren't added automatically anymore. moby/moby#50719 in 29.0.0
deprecated Users are encouraged to stop relying on these as they're deprecated, and the escape hatch will be removed in a later version in 29.0.0
deprecated client/pkg/jsonmessage: remove deprecated ProgressMessage, ErrorMessage, DisplayJSONMessagesToStream and Stream interface. moby/moby#49264 in 29.0.0
deprecated GET /events no longer includes the deprecated status, id, and from fields. These fields were removed in API v1.22, but still included in the response. These fields are now omitted when using API v1.52 or later. moby/moby#50832 in 29.0.0
deprecated api/types/network: CreateRequest: remove deprecated CheckDuplicate field. moby/moby#50998 in 29.0.0
deprecated api/types/plugin: deprecate Config.DockerVersion field. moby/moby#51109 in 29.0.0
deprecated api/types/registry: remove deprecated AuthConfig.Email field. moby/moby#51059 in 29.0.0
deprecated api/types/strslice: deprecate StrSlice in favor of using a regular []string. moby/moby#50292 in 29.0.0
deprecated api/types/sytem: remove deprecated DiskUsage.BuilderSize. moby/moby#51180 in 29.0.0
deprecated api/types: move plugin types to api/types/plugin. moby/moby#48114 in 29.0.0
deprecated API: Deprecation: the Engine was automatically backfilling empty PortBindings lists with a PortBinding with an empty HostIP and HostPort when starting a container. This behavior is deprecated for API 1.52, and will be dropped in API 1.53. moby/moby#50874 in 29.0.0
deprecated build: remove DCT support for classic builder. docker/cli#6195 in 29.0.0
deprecated cli/command: Remove deprecated ResolveDefaultContext. docker/cli#6555 in 29.0.0
deprecated client: ImageBuildResponse: remove OSType field. moby/moby#50995 in 29.0.0
deprecated client: Remove ImageCreate method - useImagePull or ImageImport instead. moby/moby#51366 in 29.0.0
deprecated client: remove deprecated ImageListOptions.ContainerCount. moby/moby#51006 in 29.0.0
deprecated client: remove support for negotiating API version < v1.44 (docker 25.0). moby/moby#51119 in 29.0.0
deprecated client: remove unused Client.HTTPClient() method. moby/moby#51011 in 29.0.0
deprecated daemon/graphdriver: remove deprecated GetDriver(). moby/moby#50377 in 29.0.0
deprecated Go-SDK: cli/command/image/build: deprecate DefaultDockerfileName, DetectArchiveReader, WriteTempDockerfile, ResolveAndValidateContextPath. These utilities were only used internally and will be removed in the next release. docker/cli#6610 in 28.5.2
deprecated Go-SDK: cli/command/image/build: deprecate IsArchive utility. docker/cli#6560 in 28.5.2
deprecated Go-SDK: opts: deprecate ValidateMACAddress. docker/cli#6560 in 28.5.2
deprecated Go-SDK: opts: deprecate ListOpts.Delete(). docker/cli#6560 in 28.5.2
deprecated Deprecated and removed features, see Deprecated Features. in 28.5.1
deprecated api/types/image: InspectResponse: deprecate Parent and DockerVersion fields. moby/moby#51105 in 28.5.1
deprecated api/types/plugin: deprecate Config.DockerVersion field. moby/moby#51110 in 28.5.1
deprecated Deprecated and removed features, see Deprecated Features. in 28.5.0
deprecated Deprecate support for kernel memory TCP accounting (KernelMemoryTCP). moby/moby#51067 in 28.5.0
deprecated Go-SDK: cli/command: deprecate DockerCli.Apply. This method is no longer used and will be removed in the next release if there are no remaining uses. docker/cli#6497 in 28.5.0
deprecated Go-SDK: cli/command: deprecate DockerCli.ContentTrustEnabled. This method is no longer used and will be removed in the next release. docker/cli#6495 in 28.5.0
deprecated Go-SDK: cli/command: deprecate DockerCli.DefaultVersion. This method is no longer used and will be removed in the next release. docker/cli#6491 in 28.5.0
deprecated Go-SDK: cli/command: deprecate ResolveDefaultContext utility. docker/cli#6529 in 28.5.0
deprecated Go-SDK: cli/command: deprecate WithContentTrustFromEnv, WithContentTrust options. These options were used internally, and will be removed in the next release.. docker/cli#6489 in 28.5.0
deprecated Go-SDK: cli/manifest/store: deprecate IsNotFound(). docker/cli#6514 in 28.5.0
deprecated Go-SDK: templates: deprecate NewParse() function. docker/cli#6469 in 28.5.0
deprecated Deprecated and removed features, see Deprecated Features. in 28.4.0
deprecated Update deprecation message for AuthConfig.Email field. moby/moby#50797 in 28.4.0
deprecated Deprecate profiles package which got migrated to github.com/moby/profiles. moby/moby#50513 in 28.4.0
deprecated Deprecate special handling for quoted values for the --tlscacert, --tlscert, and --tlskey command-line flags. docker/cli#6291 in 28.4.0
deprecated Mark legacy links env vars (DOCKER_KEEP_DEPRECATED_LEGACY_LINKS_ENV_VARS) as deprecated in v28.4 and set for removal in v30.0. docker/cli#6309 in 28.4.0
deprecated Go-SDK: Deprecate field NetworkSettingsBase.Bridge, struct NetworkSettingsBase, all the fields of DefaultNetworkSettings, and struct DefaultNetworkSettings. moby/moby#50839 in 28.4.0
deprecated Go-SDK: api/types: build.CacheDiskUsage, container.DiskUsage, images.DiskUsage and volumes.DiskUsage are now deprecated and will be removed in the next major release. moby/moby#50768 in 28.4.0
deprecated Go-SDK: cli-plugins/manager: deprecate ReexecEnvvar. docker/cli#6411 in 28.4.0
deprecated Go-SDK: cli-plugins/manager: deprecate annotation aliases (CommandAnnotationPlugin, CommandAnnotationPluginVendor, CommandAnnotationPluginVersion, CommandAnnotationPluginInvalid, CommandAnnotationPluginCommandPath) in favor of their equivalent in cli-plugins/manager/metadata. docker/cli#6298 in 28.4.0
deprecated Go-SDK: cli-plugins/manager: deprecate metadata aliases (NamePrefix, MetadataSubcommandName, HookSubcommandName, Metadata, ReexecEnvvar) in favor of their equivalent in cli-plugins/manager/metadata. docker/cli#6269 in 28.4.0
deprecated Go-SDK: cli-plugins/manager: remove Candidate interface, which was only for internal use. docker/cli#6269 in 28.4.0
deprecated Go-SDK: cli-plugins/manager: remove NewPluginError function, which was only for internal use. docker/cli#6269 in 28.4.0
deprecated Go-SDK: cli-plugins/manager: remove deprecated ResourceAttributesEnvvar const. docker/cli#6269 in 28.4.0
deprecated Go-SDK: cli/command/builder: deprecate NewBuilderCommand and NewBakeStubCommand. These functions will be removed in the next release. docker/cli#6312 in 28.4.0
deprecated Go-SDK: cli/command/builder: deprecate NewPruneCommand. docker/cli#6343 in 28.4.0
deprecated Go-SDK: cli/command/checkpoint: deprecate NewCheckpointCommand. This function will be removed in the next release. docker/cli#6312 in 28.4.0
deprecated Go-SDK: cli/command/checkpoint: deprecate NewFormat, FormatWrite. docker/cli#6341 in 28.4.0
deprecated Go-SDK: cli/command/completion: deprecate NoComplete. docker/cli#6405 in 28.4.0
deprecated Go-SDK: cli/command/completion: remove deprecated ValidArgsFn. docker/cli#6259 in 28.4.0
deprecated Go-SDK: cli/command/config: deprecate NewConfigCommand. This function will be removed in the next release. docker/cli#6312 in 28.4.0
deprecated Go-SDK: cli/command/config: deprecate NewFormat, FormatWrite, InspectFormatWrite. docker/cli#6341 in 28.4.0
deprecated Go-SDK: cli/command/config: deprecate RunConfigCreate, CreateOptions, RunConfigInspect, InspectOptions, RunConfigList, ListOptions, RunConfigRemove, and RemoveOptions. docker/cli#6369 in 28.4.0
deprecated Go-SDK: cli/command/container: deprecate NewBuildCommand, NewPullCommand, NewPushCommand, NewImagesCommand, NewImageCommand, NewHistoryCommand, NewImportCommand, NewLoadCommand, NewRemoveCommand, NewSaveCommand, NewTagCommand, NewPruneCommand. These functions will be removed in the next release.… in 28.4.0
deprecated Go-SDK: cli/command/container: deprecate NewDiffFormat, DiffFormatWrite. These functions were only used internally and will be removed in the next release. docker/cli#6341 in 28.4.0
deprecated Go-SDK: cli/command/container: deprecate NewRunCommand, NewExecCommand, NewPsCommand, NewContainerCommand, NewAttachCommand, NewCommitCommand, NewCopyCommand, NewCreateCommand, NewDiffCommand, NewExportCommand, NewKillCommand, NewLogsCommand, NewPauseCommand, NewPortCommand, NewRenameCommand,… in 28.4.0
deprecated Go-SDK: cli/command/context: deprecate NewContextCommand. This function will be removed in the next release. docker/cli#6312 in 28.4.0
deprecated Go-SDK: cli/command/context: deprecate RunCreate and CreateOptions. docker/cli#6403 in 28.4.0
deprecated Go-SDK: cli/command/context: deprecate RunExport and ExportOptions. docker/cli#6403 in 28.4.0
deprecated Go-SDK: cli/command/context: deprecate RunImport. docker/cli#6403 in 28.4.0
deprecated Go-SDK: cli/command/context: deprecate RunRemove and RemoveOptions. docker/cli#6403 in 28.4.0
deprecated Go-SDK: cli/command/context: deprecate RunUpdate and UpdateOptions. docker/cli#6403 in 28.4.0
deprecated Go-SDK: cli/command/context: deprecate RunUse. docker/cli#6403 in 28.4.0
deprecated Go-SDK: cli/command/image: deprecate AuthResolver utility. docker/cli#6357 in 28.4.0
deprecated Go-SDK: cli/command/image: deprecate NewHistoryFormat, HistoryWrite. docker/cli#6341, docker/cli#6341 in 28.4.0
deprecated Go-SDK: cli/command/manifest: deprecate NewManifestCommand. This functions will be removed in the next release. docker/cli#6312 in 28.4.0
deprecated Go-SDK: cli/command/network: deprecate NewFormat, FormatWrite. docker/cli#6341 in 28.4.0
deprecated Go-SDK: cli/command/network: deprecate NewNetworkCommand. These functions will be removed in the next release. docker/cli#6312 in 28.4.0
deprecated Go-SDK: cli/command/node: deprecate NewFormat, FormatWrite, InspectFormatWrite. docker/cli#6341 in 28.4.0
deprecated Go-SDK: cli/command/node: deprecate NewNodeCommand. This functions will be removed in the next release. docker/cli#6312 in 28.4.0
deprecated Go-SDK: cli/command/plugin: deprecate NewFormat, FormatWrite. docker/cli#6341 in 28.4.0

Every release in between

29.9.0 Oct 8, 2026 Release notes ↗

otherdocker/cli, 29.9.0 milestone

othermoby/moby, 29.9.0 milestone

securityCVE-2026-97032: An HTTP/2 client could crash the daemon by changing the HPACK header table size while sending requests. golang/go#81867

securityCVE-2026-78659: An HTTP/2 client could exhaust daemon memory by declaring a large number of fields in a Trailer header, bypassing the header size limits. golang/go#81857

securityCVE-2026-78663: An HTTP/2 client could bypass the connection-level flow control limit by resetting streams, making the daemon buffer more request data than the limit allows. golang/go#81743

securityCVE-2026-78669: An HTTP/2 client could cause excessive daemon CPU use by opening many streams and repeatedly changing the initial window size. golang/go#81742

securityCVE-2026-56857: On Windows, the daemon could create a directory outside its data root if someone with write access to the data root had placed a junction there. golang/go#81739

fixcontainerd image store: Add the lazy-pull daemon feature to control whether docker pull skips downloading layer content that the snapshotter already provides. Lazy pulls are enabled by default for known remote snapshotters (nydus, overlaybd, soci, stargz). moby/moby#53877

fixcontainerd image store: Fix pulls skipping required layer blobs when unpacked layers already exist, leaving images runnable but incomplete for export or push. moby/moby#53615

fixFix docker container create --name reporting a misleading validation error mentioning invalid characters instead of invalid name length. moby/moby#53484

fixFix a connection leak to the RootlessKit API socket on every GET /version request in rootless mode. moby/moby#53836

fixImprove Windows service registration and unregistration cleanup, including making service unregistration (--unregister-service) idempotent. moby/moby#53845

otherUpdate BuildKit to v0.34.0. moby/moby#53882

otherUpdate Go runtime to 1.26.9. docker/cli#7363

otherUpdate containerd (static binaries) to v2.4.1. moby/moby#53773

featureAllow IPv6 Neighbour Discovery between containers on a bridge network with inter-container communication disabled, matching the existing IPv4 behaviour. moby/moby#53723

fixFix docker ps and GET /containers/json omitting published ports for networks using routed gateway mode. moby/moby#53693

fixFix a bug where a restarted daemon could be dropped from a peer's service discovery and load balancing until it rejoined the gossip cluster. moby/moby#53688

fixFix a published port being unreachable from another container on the same network when inter-container communication is disabled, including Swarm services published through the routing mesh. moby/moby#53723

fixFix an issue where errors programming the kernel to encrypt the overlay network data-plane could in some circumstances lead to encrypted-overlay-network traffic to some nodes being transmitted in cleartext. As the receiving peer would drop cleartext packets for encrypted overlay networks as…

fixFix connecting live-restored containers with an implicit host-gateway mapping to additional networks. moby/moby#53093

fixFix overlay peers becoming unreachable after a node rejoins the cluster or a service is redeployed, when the VXLAN device had already learned a dynamic FDB entry for the peer. moby/moby#53663

fixFix Swarm tasks on overlay networks being rejected when the daemon can't write to /var/lib/docker. moby/moby#53848

featurePublished Swarm-service ports are accessible at the host's IPv6 addresses when the userland proxy is enabled. A change introduced in v29.8.0 incidentally enabled this functionality; it is a tested and supported feature as of v29.9.0. moby/moby#53727

securityRelease a node's IPsec security associations and policies when the last container leaves an encrypted overlay network, instead of leaking them until the daemon restarts. moby/moby#53420

otherRestore the logic to remove the empty DOCKER-INGRESS iptables chain, and the FORWARD rule that jumps to it, left behind by Docker Engine 28.0.0 and earlier. moby/moby#53825

otherUpdate RootlessKit (3.2.0). moby/moby#53607

29.8.2 Sep 30, 2026 Release notes ↗

otherdocker/cli, 29.8.2 milestone

othermoby/moby, 29.8.2 milestone

securityCVE-2026-53493: Pulling a crafted OCI image index with deeply nested or widely fanned-out descriptors could cause unbounded CPU and memory use. GHSA-pg57-6jwg-q645

securityCVE-2026-92543: A malicious DNS response could make registry connections skip TLS certificate verification or fall back to HTTP, exposing registry credentials or allowing image substitution. GHSA-7cfq-22r6-qp73

securityCVE-2026-92542: Unprivileged users on a Swarm node could inject forged Ethernet frames into encrypted overlay networks on peer nodes. GHSA-6m9p-4h64-m6vh

securityCVE-2026-93315: A build step could redirect proxy CA cleanup outside the build root filesystem, block it with a special file, or let the build succeed when cleanup failed. GHSA-2f5p-x9ph-g97x

securityCVE-2026-93316: A build that requested CDI devices could cause a daemon panic when CDI support was disabled, for example with "features": {"cdi": false} in daemon.json. GHSA-r456-g3gm-cvxf

securityCVE-2026-93317: With the containerd image store, a client using the low-level LLB API could poison the build cache with container blob contents that did not match their claimed digest. GHSA-p3rc-w3hc-pqvv

securityCVE-2026-93318: A malicious image could poison the build cache with layer DiffIDs that did not match the actual layer contents. GHSA-f2v9-hprr-32q3

securityCVE-2026-93319: A malicious external frontend could crash the daemon through gateway container lifecycle races or malformed requests and definitions. GHSA-4hgw-qrhw-fhg8

securityCVE-2026-93320: Daemon-side snapshot reads and LLB mkfile operations did not safely handle special files. GHSA-9728-qjrv-2xh2

securityCVE-2026-93321: A malformed LLB file operation with invalid symlink owner inputs could crash the daemon. GHSA-fjj4-h6vf-m9hj

securityCVE-2026-93322: A malformed LLB merge operation with mismatched input counts could crash the daemon. GHSA-cv6p-7w7g-xjwq

securityCVE-2026-93323: An oversized Dockerfile, .dockerignore, gateway file, or nested LLB definition could exhaust daemon memory. GHSA-mgqf-486f-49vp

securityCVE-2026-93326: A crafted Git build source could bypass source policy rules that match on the repository URL, through a Git bundle locator or a full remote URL that did not match the source identifier. GHSA-66hf-6vf5-87hc

fixFix docker cp failing on a container with a bind-mounted socket nested inside another bind mount. moby/moby#53724

fixFix docker info failing with an “invalid Prefix” error after reloading a daemon with custom default address pools. moby/moby#53812

otherUpdate BuildKit to v0.33.1. moby/moby#53823

otherUpdate containerd (static binaries) to v2.3.6. moby/moby#53778

otherUpdate runc (in static binaries) to v1.5.2. moby/moby#53811

29.8.1 Sep 15, 2026 Release notes ↗

otherdocker/cli, 29.8.1 milestone

othermoby/moby, 29.8.1 milestone

fixcontainerd image store: Fix docker load leaving dangling images after loading an image that already exists. moby/moby#53595

fixFix managed containerd logging a CRI pod-sandbox plugin dependency warning during startup. moby/moby#53585

fixFix user-namespace detection on OpenVZ, where namespace inode numbers are virtualized. moby/moby#53605

fixWindows: Preserve hard links when committing a container, so a file with multiple names is stored once in the resulting image layer instead of once per name. moby/moby#53624

otherUpdate containerd (static binaries) to v2.3.5. moby/moby#53589

fixFix GET /networks returning a 500 status if an invalid 'type' filter was provided. moby/moby#53678

29.8.0 Sep 3, 2026 Release notes ↗

otherdocker/cli, 29.8.0 milestone

othermoby/moby, 29.8.0 milestone

featureAdd HostConfig.Umask option and a corresponding --umask flag to docker create/docker run to set the umask for a container's main process, execs, and healthchecks. moby/moby#53463, docker/cli#7108

featureAdd support for attaching service names, environments, and custom CloudWatch entity attributes to logs from the awslogs logging driver. moby/moby#52632

securityAdd daemon support for configuring the default container AppArmor profile template. moby/moby#52771

securityPrevent containers from using the 32-bit socketcall(2) path to create AF_VSOCK sockets and communicate with host virtual machines by adding AppArmor and SELinux policy rules. moby/moby#53551

fixFix docker network inspect failing to find a healthy Swarm network when another Swarm network could not be allocated. moby/moby#53325

fixFix a node gossiping a superseded value for a Swarm service discovery entry after concurrent updates to the same key. moby/moby#53479

fixFix Swarm service names failing to resolve on a node indefinitely after it misses a network membership announcement. moby/moby#53437

fixFix Swarm service names failing to resolve on healthy nodes after a transient node failure. moby/moby#53142

otherPrevent dockerd from hanging when the nft command produces enough stderr output to fill its pipe. moby/moby#53517

otherReduce gossip traffic generated by a node that repeatedly disconnects and rejoins the cluster. moby/moby#53479

otherRemote network-driver plugins can now set the container-side interface name via the DstName field in their Join response. moby/moby#52866

otherReserve network names "container" and "container:" to prevent creation of unusable networks. moby/moby#51973

otherSpread the daemon's periodic Swarm overlay network gossip and synchronization work over time, avoiding recurring bursts of CPU and network usage. moby/moby#53475

otherSwarm service-mesh published ports now use the same infrastructure as published ports for local containers. moby/moby#53118

fixFix --disable-host-loopback not being enforced for the pasta network driver in rootless mode. moby/moby#53358

featureUpdate RootlessKit to v3.1.0, adding support for the pesto port driver in rootless mode. Set DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=pesto to use it; it requires the pasta network driver and supports IPv4 only. moby/moby#53358

otherUpdate minimum supported Go version to 1.26. docker/cli#7258

fixAdd annotation filter to container listings (docker ps, GET /containers/json) allowing to filter containers by their annotations. moby/moby#53538

fixcontainerd image store: Fix docker image inspect reporting a smaller image size than docker image ls. moby/moby#53426

fixcontainerd image store: Fix slower image pulls caused by repeated registry authentication within a single pull. moby/moby#53497

fixDo not log expected image signature identity misses as errors for containerd image store images. moby/moby#53495

fixdockerd now uses the embedded containerd if no system containerd service is configured and containerd is not installed. moby/moby#53388

fixFix GET /images/{name}/json not including unpacked snapshot usage in Size when using the containerd image store. moby/moby#53426

fixFix classic-builder cache for Dockerfile stages that select a non-host platform with FROM --platform. moby/moby#53503

fixFix CLI panic when DOCKER_HOST or -H specifies an invalid host. docker/cli#7280

fixFix health checks being delayed for too long when the start interval is longer than the start period. moby/moby#52317

fixFix inconsistent mount ordering in docker inspect output (GET /containers/{id}/json) and container listings (docker ps, GET /containers/json). moby/moby#53534

fixFix NRI container metadata so Container.Args includes the resolved executable as argv[0], matching the process launched in the container instead of only the Docker Cmd. moby/moby#53423

fixFix Swarm service creation failing when an automatically generated name is already in use. moby/moby#53468

fixFix the container root directory / being world-writable when using the btrfs storage driver. moby/moby#53500

fixFixed docker ps sorting published ports lexicographically instead of numerically. docker/cli#7144

fixPreserve service mount order during forced updates to avoid an unnecessary rollout on the next stack deploy. docker/cli#7227

fixPrevent containerd's v2 CRI plugins from loading when CRI is disabled. moby/moby#53564

fixPrint plugin hook output (e.g. the "What's next:" hint) after the command's error message instead of before it. docker/cli#6976

fixReject checkpoint IDs containing path separators to prevent access outside the container checkpoint directory. moby/moby#53377

otherUpdate BuildKit to v0.33.0. moby/moby#53554

otherUpdate containerd (static binaries) to v2.3.4. moby/moby#53409

otherUpdate Go runtime to 1.26.8. moby/moby#53550, docker/cli#7274

+1 more item in the release notes

29.7.2 Aug 6, 2026 Release notes ↗

otherdocker/cli, 29.7.2 milestone

othermoby/moby, 29.7.2 milestone

fixFix docker service create and docker service update panicking when the same environment variable is passed more than once. docker/cli#7145

fixFix a regression introduced in Docker Engine 29.7.0 that caused image pulls to reject images containing absolute hardlink targets, as produced by some image builders. moby/moby#53305

fixFix a regression introduced in Docker Engine 29.7.0 that could cause image pulls and docker cp to fail on older Linux kernels when applying file permissions, including for device nodes. moby/moby#53305

otherUpdate BuildKit to v0.32.2. moby/moby#53300

otherImprove compatibility with more nftables releases by terminating base-chain policies with a semicolon. moby/moby#53303

29.7.1 Jul 31, 2026 Release notes ↗

otherdocker/cli, 29.7.1 milestone

othermoby/moby, 29.7.1 milestone

fixFix a regression that prevented pulling images whose layers contain directories without explicit parent directory entries. moby/moby#53260

fixFix a regression where the CopyToContainer rejects container paths that traverse absolute symlinks, such as /var/run -> /run. moby/moby#53261

29.7.0 Jul 30, 2026 Release notes ↗

otherdocker/cli, 29.7.0 milestone

othermoby/moby, 29.7.0 milestone

featureAdd an experimental embedded-containerd feature that runs containerd inside the daemon process instead of as a separate managed process. moby/moby#52898

featureMount type image is no longer experimental. moby/moby#52998

featureAdd the default-stop-timeout daemon option to configure the stop timeout assigned to containers without an explicit timeout. moby/moby#53146

securityUpdate github.com/moby/go-archive to v0.3.0 to fix CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h. moby/moby#53247, docker/cli#7139

fixFix a daemon panic when cleanup of a container's network interface fails while the container is being disconnected from a network. moby/moby#53237

fixFix a daemon panic when removing swarm ingress ports after failing to bind an ingress proxy listener. moby/moby#53022

otherKeep the cgroup mount for containers with --net=host. moby/moby#52318

fixAdd shell completion for --filter names and known values to docker service ls, docker service ps, and docker node ps. docker/cli#7124

fixcontainerd image store: Fix daemon-wide concurrent download and upload limits for pulls and pushes not being honored. moby/moby#53081

fixTo preserve the previous unlimited startup behavior, configure "max-concurrent-downloads" and "max-concurrent-uploads" to 0

fixFix docker cp -a using the wrong file owner when copying files into containers with user namespace remapping enabled. moby/moby#53084

fixFix docker cp from a Windows container silently returning a file instead of an error when the source path ends with a separator but is not a directory. moby/moby#53123

fixFix docker stats reporting all zeros for running Windows containers when using the containerd runtime. moby/moby#53101

fixFix docker stats reporting empty network stats for running Windows containers when using the containerd runtime. moby/moby#53219

fixFix a typo in the docker create --pull flag description. docker/cli#7103

fixFix Swarm service updates failing due to "file exists" errors when a VIP IP alias already exists on the LB endpoint interface. moby/moby#51657

fixFix Swarm tasks being rejected when their image could not be pulled from the registry but was already present on the node. moby/moby#53212

fixImprove the error returned when a container hostname exceeds Linux's 64-byte limit. moby/moby#53121

fixPrevent live-restored volumes from retaining active mount references when containers exit during daemon startup. moby/moby#53115

fixSuppress the “No such container” error when docker rm --force succeeds for a nonexistent container. docker/cli#7110

otherUpdate Go runtime to 1.26.5. docker/cli#7087

otherUpdate BuildKit to v0.32.0. moby/moby#53234

otherUpdate containerd (static binaries) to v2.3.3. moby/moby#53050

otherUpdate runc (in static binaries) to v1.4.3. moby/moby#50960

29.6.2 Jul 16, 2026 Release notes ↗

otherdocker/cli, 29.6.2 milestone

othermoby/moby, 29.6.2 milestone

securityCVE-2026-15793: Git source checkout from a bundle file could lead to command injection. GHSA-hw3h-2gp9-cxpv

securityCVE-2026-15792: Incorrect parameters sent from a frontend could cause a panic. GHSA-qx3x-mv6r-52p6

securityCVE-2026-15791: An LLB file operation could be tricked into removing the contents of the /tmp directory. GHSA-32pv-7hq5-qhwq

securityCVE-2026-15789: A malicious client could bypass destination directory validation when uploading local sources. GHSA-g2h8-426c-7976

securityCVE-2026-15788: A WCOW cache mount source selector could resolve NTFS junctions outside of the cache root. GHSA-388v-wmr2-g2v2

otherUpdate containerd (static binaries) to v2.2.6. moby/moby#53051

otherUpdate Go runtime to 1.26.5. moby/moby#53027

otherUpdate RootlessKit to v3.0.2. moby/moby#53054

29.6.1 Jun 26, 2026 Release notes ↗

otherdocker/cli, 29.6.1 milestone

othermoby/moby, 29.6.1 milestone

securityA malicious image could supply a malicious /etc/passwd or /etc/group-style file causing excessive memory consumption, potentially resulting in process termination due to Out Of Memory (OOM) conditions. GHSA-mjcv-p78q-w5fw, GHSA-jpcc-p29g-p8mq, GHSA-72x6-4j93-7w86

securityA custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the security.insecure entitlement. Other security measures, like Linux capabilities were still applied to these containers.…

fixUpdate containerd (static binaries) to v2.2.5. moby/moby#52950

otherUpdate BuildKit to v0.31.1. moby/moby#52954

29.6.0 Jun 18, 2026 Release notes ↗

otherdocker/cli, 29.6.0 milestone

othermoby/moby, 29.6.0 milestone

featurePOST /containers/{id}/update now supports per-device blkio resource settings. moby/moby#52651

featureAdd GET /images/{name}/attestations endpoint to retrieve in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image. Supports optional platform selection, predicate type filtering, and a statement query parameter for verbatim statement bodies.

fixdocker image push now respects NO_COLOR. docker/cli#6957

fixcontainerd image store: Fix docker system prune to include unpacked image data when reporting reclaimed space. moby/moby#52905

fixFix docker system df image size reporting to count only snapshots directly used by images. moby/moby#52901

fixFix a bug where registry authentication failures during worker image pulls were reported as a misleading “No such image” error. moby/moby#52698

fixFix default BuildKit GC policy to prune reproducible cache types as intended. moby/moby#52814

fixFix explicit file modes being filtered by the daemon umask, including COPY --chmod permissions. moby/moby#52892

fixFix image selection with the containerd image store on amd64 hosts when images provide amd64 variant-specific manifests. moby/moby#52773

fixThe --password flag on docker login now accepts - to pass the password through STDIN as alternative to --password-stdin. docker/cli#7029

otherUpdate runc (in static binaries) to v1.3.6. moby/moby#52883

otherUpdate BuildKit to v0.31.0. moby/moby#52904

featureAllow the nftables firewall mode to be used with a daemon that is linked against libnftables when the nft command is not installed on the system. moby/moby#52820

otherDon't publish container ports on host ports listed in net.ipv4.ip_local_reserved_ports when dynamically allocating ports. moby/moby#52818

fixFix a race condition in overlay network bulk sync that caused ~30s DNS resolution delays on newly joined swarm nodes. moby/moby#52862

fixMitigate a crash in libnftables when using nftables as the firewall backend by changing the default build option to execute the nft command instead. Users building dockerd from source can opt into linking against libnftables by building with the libnftables build tag. moby/moby#52886

otherSilence the spurious warning "IPv4 forwarding is disabled". moby/moby#52742

deprecatedThe Engine now returns a deprecation warning when a container connected to the default bridge is created with links specified. moby/moby#47427

29.5.3 Jun 3, 2026 Release notes ↗

otherdocker/cli, 29.5.3 milestone

othermoby/moby, 29.5.3 milestone

fixReduce docker system df errors when images are pruned at the same time with the containerd image store. moby/moby#52672

otherUpdate containerd (static binaries only) to v2.2.4. moby/moby#52683

otherUpdate Go runtime to 1.26.4. moby/moby#52753, docker/cli#7025

otherUpdate RootlessKit to v3.0.1. moby/moby#52710

fixFix AWS IMDS access with gvisor-tap-vsock and UDP port forwarding for non-loopback clients. moby/moby#52710

fixFix installation of plugins that require host networking. moby/moby#52735

29.5.2 May 20, 2026 Release notes ↗

otherdocker/cli, 29.5.2 milestone

othermoby/moby, 29.5.2 milestone

fixFix docker cp failing with "mkdirat: file exists" when a container has a bind mount whose target traverses an in-container symlink (e.g. /var/run -> /run). moby/moby#52655

29.5.1 May 18, 2026 Release notes ↗

otherdocker/cli, 29.5.1 milestone

othermoby/moby, 29.5.1 milestone

securityCVE-2026-41567 Fix a vulnerability in docker cp where archive decompression binaries (e.g. xz, unpigz) were resolved via PATH inside the container filesystem while running as host root, allowing a malicious container to execute arbitrary binaries with host root privileges. GHSA-x86f-5xw2-fm2r

securityCVE-2026-41568 Fix a TOCTOU vulnerability in docker cp that allowed a container process to create files or directories at arbitrary locations on the host filesystem. GHSA-vp62-88p7-qqf5

securityCVE-2026-42306 Fix a TOCTOU vulnerability in docker cp that allowed a container process to redirect a bind mount to an arbitrary location on the host filesystem. GHSA-rg2x-37c3-w2rh

fixFix UDP conntrack entries not being deleted when not bound to a specific IP address. moby/moby#52640

29.5.0 May 14, 2026 Release notes ↗

otherdocker/cli, 29.5.0 milestone

othermoby/moby, 29.5.0 milestone

featureRootless: Add new default gvisor-tap-vsock network driver. moby/moby#52319

featureEnable private time namespace for containers by default on supported kernels. moby/moby#52326

featureThe local logging driver now has support for custom attributes, adding support for the label, label-regex, env, env-regex, and tag log options. moby/moby#52348

featureWindows: The daemon now supports listening on a Unix socket (-H unix://...), with optional group-based access control via --group. moby/moby#52365

securityCVE-2026-32288: Fix a denial of service where pulling a maliciously crafted image could cause the daemon to allocate unbounded memory when processing sparse tar archives. GHSA-x4jj-h2v8-hqqv. moby/moby#52478

fixdocker ps --format now supports a .HealthStatus placeholder to print container health state (starting, healthy, unhealthy) as a dedicated field. docker/cli#6913

fixAdd "time-namespaces" feature flag to disable time-namespaces. moby/moby#52577

fixcontainerd integration: Fix auth token requests ignoring per-host TLS settings (custom CAs, insecure-registries). moby/moby#52600

fixDaemon reload events now signify that the daemon reload has fully completed. moby/moby#52589

fixExpose diagnostic data about userland proxy in docker info. moby/moby#52321

fixFix docker image ls --filter reference=... (GET /images/json) to also match fully qualified canonical image names (e.g. docker.io/library/alpine), not only the familiar short form. moby/moby#52333

fixFix a bug where leaving an autolock-enabled swarm could leave orphaned state, causing subsequent swarm init to fail with "Swarm is encrypted and needs to be unlocked". moby/moby#52479

fixFix an issue where logging errors appeared as empty strings in the daemon log instead of the message that failed to write. moby/moby#52442

fixFix incorrect SHARED SIZE and UNIQUE SIZE reporting in docker system df -v by including shared content blobs in size calculation. moby/moby#52482

fixFix support for CDI specifications that request additional group IDs. moby/moby#52579

fixFix volume subpath file mounts over an existing file in the image failing container creation with "not a directory". moby/moby#52584

fixSort labels in volume, network, config, and secret formatters for deterministic output. docker/cli#6954

fixSwarm: Prevent corruption of Raft snapshots when swarm state is large. moby/moby#52441

otherUpdate BuildKit to v0.30.0. moby/moby#52618

otherUpdate Go runtime to 1.26.3. moby/moby#52572, docker/cli#6967

fixFix conntrack entries being incorrectly deleted for UDP containers sharing the same port on different IPs when one container is restarted. moby/moby#52423

fixFix stale VIP DNS records for swarm service network aliases not being removed during rolling updates. moby/moby#52236

fixFix the userland proxy silently dropping UDP datagrams when a previous write to an unavailable backend left a stale ECONNREFUSED error on the socket. moby/moby#52483

otherRootless: Properly support --net=host and localhost registries. moby/moby#47103

otherUpdate RootlessKit to v3.0.0. moby/moby#52319

othercli/config/configfile: GetAuthConfig, GetCredentialsStore: normalize hostname when resolving auth. docker/cli#6846

deprecatedcli/command/image/build: remove deprecated DefaultDockerfileName const. docker/cli#6737

deprecatedcli/command/image/build: remove deprecated DetectArchiveReader util. docker/cli#6737

deprecatedcli/command/image/build: remove deprecated IsArchive utility. docker/cli#6737

deprecatedcli/command/image/build: remove deprecated ResolveAndValidateContextPath util. docker/cli#6737

deprecatedcli/command/image/build: remove deprecated WriteTempDockerfile util. docker/cli#6737

29.4.3 May 6, 2026 Release notes ↗

otherdocker/cli, 29.4.3 milestone

othermoby/moby, 29.4.3 milestone

securityCVE-2026-31431: Fix the 29.4.2 regression that broke 32-bit programs and i386 images. The broad socketcall(2) seccomp deny is replaced with targeted AppArmor (deny network alg) and SELinux (alg_socket) rules that block AF_ALG at the LSM layer, covering both socket(2) and socketcall(2) paths…

fixFix the default AppArmor profile not being updated on daemon restart, requiring a system reboot to pick up profile changes from daemon upgrades. moby/moby#52537

29.4.2 May 1, 2026 Release notes ↗

otherdocker/cli, 29.4.2 milestone

othermoby/moby, 29.4.2 milestone

securityThis release includes hardening for CVE-2026-31431.

securityBlock AF_ALG sockets and the socketcall(2) multiplexer in the default seccomp profile to prevent in-container privilege escalation via the kernel crypto API ("Copy Fail"). moby/moby#52501

securityIf you need a workaround, use the seccomp/v0.2.1 profile from moby/profiles. Make sure you use a kernel that includes the fix for CVE-2026-31431.

security[!IMPORTANT] Use this workaround only for containers that require it. Containers that use this profile can still exploit CVE-2026-31431 through the socketcall syscall.

securityTo use the profile for a specific container when you control the docker run command, use --security-opt:

featureTo use the profile as the default for containers created by the daemon, add seccomp-profile to your daemon.json:

29.4.1 Apr 20, 2026 Release notes ↗

otherdocker/cli, 29.4.1 milestone

othermoby/moby, 29.4.1 milestone

fixcontainerd image store: Fix docker image prune --filter label!=key=value incorrectly skipping images that don't have the specified label. moby/moby#52338

fixFix --log-opt "tag={{.ImageID}}" not stripping the digest's algorithm. moby/moby#52343

fixFix intermittent container start failures (EBUSY on secrets/configs remount) on busy Swarm nodes by retrying the read-only remount. moby/moby#52235

otherUpdate containerd (static binaries only) to v2.2.3. moby/moby#52360

otherUpdate Go runtime to 1.26.2. docker/cli#6920, moby/moby#52329

otherif a container has an IPv4-only or an IPv6-only endpoint with higher "gateway priority" than a dual stack endpoint, the single stack endpoint will now be used as the default gateway for its address family. moby/moby#52328

29.4.0 Apr 7, 2026 Release notes ↗

otherdocker/cli, 29.4.0 milestone

othermoby/moby, 29.4.0 milestone

fixdocker cp: report both content size and transferred size. docker/cli#6800

fixFix docker stats --all still showing containers that were removed. docker/cli#6863

fixFix a rare bug that could cause containers to become unremovable. moby/moby#51724

fixFixed privileged containers losing their explicit AppArmor profile (--security-opt apparmor=) after a container restart. moby/moby#52215

fixImproved duplicate container-exit handling by using live containerd task state (not timestamps). moby/moby#52156

fixImproved image pull and push performance by enabling HTTP keep-alive for registry connections, avoiding redundant TCP and TLS handshakes. moby/moby#52198

fixshell completions: add shell completion for docker rm --link and exclude legacy links for container names. docker/cli#6872

fixshell completions: don't provide completions that were already used. docker/cli#6871

fixUpdate runc (in static binaries) to v1.3.5. moby/moby#52244

fixWindows: Fix DOCKER_TMPDIR not being respected. moby/moby#52181

otherUpdate BuildKit to v0.29.0. moby/moby#52272

fixPrevent a daemon crash during startup after upgrading if a container config containers a malformed IP-address. moby/moby#52275

othercli/streams: Out, In: preserve original os.File when available. docker/cli#6906

otherUpdate minimum go version to go1.25. docker/cli#6897

deprecatedGo SDK: cli-plugins/hooks: deprecate HookMessage and rename to cli-plugins/hooks.Response. docker/cli#6859

deprecatedGo SDK: cli-plugins/hooks: deprecate HookType and rename to cli-plugins/hooks.ResponseType. docker/cli#6859

deprecatedGo SDK: cli-plugins/manager: deprecate HookPluginData and move to cli-plugins/hooks.Request. docker/cli#6859

29.3.1 Mar 25, 2026 Release notes ↗

otherdocker/cli, 29.3.1 milestone

othermoby/moby, 29.3.1 milestone

securityCVE-2026-34040 Fix an authorization bypass in AuthZ plugins that could allow authorization plugins to be bypassed under specific conditions. GHSA-x744-4wpc-v9h2

securityCVE-2026-33997 Fix a flaw in docker plugin install where privilege validation could be partially bypassed, potentially leading to unauthorized privilege escalation. GHSA-pxq6-2prw-chj9

securityCVE-2026-33748 Fix insufficient validation of Git URL #ref:subdir fragments in BuildKit, which could allow access to files outside the intended repository scope. GHSA-4vrq-3vrq-g6gg

securityCVE-2026-33747 Fix a vulnerability in BuildKit where an untrusted frontend could cause files to be written outside the BuildKit state directory. GHSA-3c29-8rgm-jvjj

fixFix a daemon crash during docker build if .dockerignore contained an invalid pattern. moby/moby#52214

fixFix a panic when the containerd client uses a closed stream. moby/moby#52211

otherUpdate containerd (static binaries) to v2.2.2. moby/moby#52213

otherUpdate Go runtime to 1.25.8. moby/moby#52210, docker/cli#6883

featureAdd missing build-tag, which could cause cannot range over 10 (untyped int constant) when importing the cli/command package. docker/cli#6884

29.3.0 Mar 5, 2026 Release notes ↗

otherdocker/cli, 29.3.0 milestone

othermoby/moby, 29.3.0 milestone

featureAdd bind-create-src option to --mount flag for bind mounts. docker/cli#6792

featureCLI plugin hooks now fire on command failure (not just success), and plugins can use "error-hooks" to show hints only when commands fail. docker/cli#6794

featureLower minimum API version from v1.44 to v1.40 (Docker 19.03). moby/moby#52067

otherUpdate BuildKit to v0.28.0. moby/moby#52135

fixFix DNS config corruption on daemon reload. moby/moby#52060

featurePOST /networks/{id}/connect now correctly applies the MacAddress field in EndpointSettings. This field was added in API v1.44, but was previously ignored. moby/moby#52040

otherGET /images/json now supports an identity query parameter. When set, the response includes manifest summaries and may include an Identity field for each manifest with trusted identity and origin information. moby/moby#52030

fixThe --gpus option now uses CDI-based injection for AMD GPUs. moby/moby#52048

fixAdd sd_notify "RELOADING" notifications when signalling the daemon to reload its configuration. moby/moby#52041

fixSend sd_notify "READY" and "STOPPING" synchronously to make sure they are sent before we proceed. moby/moby#52041

fixAdd support for the systemd 253 Type=notify-reload service reload protocol. moby/moby#52041

fixDon't log "failed to determine if container is already mounted" warnings for stopped containers during startup. moby/moby#52076

fixFix docker system prune failing with "rw layer snapshot not found" when a container is concurrently removed. moby/moby#52090

fixFix a panic when running docker top on a non-running Windows container. moby/moby#52025

fixFix a regression in v29.2.0 that prevented registering the dockerd service on Windows if system requirements were not yet installed. moby/moby#52006

fixFix shared mount detection for paths mounted multiple times, which caused "not a shared mount" errors when using bind propagation. moby/moby#51787

fixFix spurious "ShouldRestart failed" warning on shutdown. moby/moby#52079

fixPreserve leading and trailing whitespace when storing registry passwords. docker/cli#6784

fixPrevent logging "not found" warnings when calculating volume sizes. moby/moby#52018

fixUpdate Go runtime to 1.25.7. moby/moby#52003, docker/cli#6780

29.2.1 Feb 2, 2026 Release notes ↗

otherdocker/cli, 29.2.1 milestone

othermoby/moby, 29.2.1 milestone

fixUpdate BuildKit to v0.27.1. moby/moby#51962

fixFix docker system df failing when run concurrently with docker system prune. moby/moby#51979

fixFix daemon handling of duplicate container exit events to avoid repeated cleanup and state transitions. moby/moby#51925

fixFix panic after failed daemon initialization. moby/moby#51943

fixFix encrypted overlay networks not passing traffic to containers on v28 and older Engines. Encrypted overlay networks will no longer pass traffic to containers on v29.2.0 thru v29.0.0, v28.2.2, v25.0.14 or v25.0.13. moby/moby#51951

fixFix potential panic on docker network prune. moby/moby#51966

29.2.0 Jan 26, 2026 Release notes ↗

otherdocker/cli, 29.2.0 milestone

othermoby/moby, 29.2.0 milestone

featuredocker info now includes NRI section. docker/cli#6710

featureAdd experimental NRI support. moby/moby#51711, moby/moby#51712, moby/moby#51675, moby/moby#51674, moby/moby#51636, moby/moby#51634

featureNew Identity field has been added to the inspect endpoint to show trusted origin information about the image. This includes build ref for locally built images, remote registry repository for pulled images, and verified signature information for images that contain a valid signed provenance…

fixImprove validation of --detach-keys command-line options. docker/cli#6742

fixPrevent a potential panic on daemon shutdown after an incomplete initialization. moby/moby#51797

fixRemove restriction on anonymous read-only volumes. moby/moby#51682

fixThe --validate flag on dockerd now also verifies system requirements, allowing for system requirements to be checked before starting the daemon. moby/moby#51868

fixHandle --gpus requests for NVIDIA devices using CDI if possible. moby/moby#50228

otherUpdate BuildKit to v0.27.0. moby/moby#51886

otherUpdate containerd (static binaries only) to v2.2.1. moby/moby#51765

otherRootless: Consider $XDG_CONFIG_HOME/cdi and $XDG_RUNTIME_DIR/cdi when looking for CDI devices. moby/moby#51624

otherUpdate RootlessKit to v2.3.6. moby/moby#51757

otherNatively support gRPC on the listening socket. moby/moby#50744

featurecli/command: add WithAPIClientOptions option. docker/cli#6740

deprecatedRemove %PROGRAMDATA%\Docker\cli-plugins from the list of paths used for CLI plugins on Windows. This path was present for backward compatibility with old installation, but replaced by %ProgramFiles%\Docker\cli-plugins. docker/cli#6713

29.1.5 Jan 16, 2026 Release notes ↗

otherdocker/cli, 29.1.5 milestone

othermoby/moby, 29.1.5 milestone

otherUpdate Go runtime to 1.25.6. moby/moby#51860, docker/cli#6750

fixFixed a regression where established network connections could be disrupted during a container's shutdown grace period. moby/moby#51843

29.1.4 Jan 9, 2026 Release notes ↗

otherdocker/cli, 29.1.4 milestone

othermoby/moby, 29.1.4 milestone

fixFix docker run --network none panic on Windows. moby/moby#51830

fixFix image mounts failing with "file name too long" for long mount paths. moby/moby#51829

fixFix potential creation of orphaned overlay2 layers. moby/moby#51826, moby/moby#51824

otherUpdate BuildKit to v0.26.3. moby/moby#51821

29.1.3 Dec 12, 2025 Release notes ↗

otherdocker/cli, 29.1.3 milestone

othermoby/moby, 29.1.3 milestone

fixAdd shell completion for docker stack deploy --compose-file. docker/cli#6690

fixcontainerd image store: Fix a bug causing docker build to ignore the explicitly set unpack image exporter option. moby/moby#51514

fixFix docker image ls dangling image handling. docker/cli#6704

fixFix a bug that could cause the Engine to leave containers with autoremove set in 'dead' state on shutdown, and never reclaim them. moby/moby#51693

fixFix build on i386. moby/moby#51528

fixFix explicit graphdriver configuration ("storage-driver") being treated as containerd snapshotter when prior graphdriver state exists. moby/moby#51516

fixFix potential creation of orphaned overlay2 layers. moby/moby#51703

featureAllow creation of a container with a specific IP address when its networks were not configured with a specific subnet. moby/moby#51583

fixDon't crash when starting a container created via the API before upgrade to v29.1.2, with PublishAll and a nil PortBindings map. moby/moby#51691

fixFix a bug preventing DNS resolution of containers attached to non swarm-scoped networks once the node has joined a Swarm cluster. moby/moby#51515

fixFix an issue that caused daemon crash when using a remote network driver plugin. moby/moby#51558

fixFix an issue that could lead to an "endpoint not found" error when creating a container with multiple network connections, when one of the networks is non-internal but does not have its own external IP connectivity. moby/moby#51538

fixFix an issue that prevented rootless Docker from starting on a host with IPv6 disabled. moby/moby#51543

otherReturn an error when a container is created with a port-mapping pointing to container port 0. moby/moby#51695

29.1.2 Dec 2, 2025 Release notes ↗

otherdocker/cli, 29.1.2 milestone

othermoby/moby, 29.1.2 milestone

securityUpdate Go runtime to 1.25.5. moby/moby#51648, docker/cli#6688

securityFixes a potential DoS via excessive resource usage when formatting hostname validation errors CVE-2025-61729

securityFixes incorrect enforcement of excluded subdomain constraints for wildcard SANs, which could allow improperly trusted certificates CVE-2025-61727

fixcontainerd image store: Fix docker image inspect failing to return available image data in case where not all distributable blobs are available locally. moby/moby#51629

fixdockerd-rootless-setuptool.sh: fix nsenter: no namespace specified. moby/moby#51622

fixFix docker system df showing N/A for shared size and unique size when using graph-drivers as storage. moby/moby#51631

otherUpdate runc (in static binaries) to v1.3.4. moby/moby#51633

fixFix a bug preventing port mappings in rootless mode when slirp4netns is used. moby/moby#51616

fixPrevent a crash when making an API request with HostConfig.PublishAllPorts set (-P), and no port bindings. moby/moby#51621

29.1.1 Nov 28, 2025 Release notes ↗

otherdocker/cli, 29.1.1 milestone

othermoby/moby, 29.1.1 milestone

breakingRevert a PR breaking external DNS resolution on all custom bridge networks. moby/moby#51615

29.1.0 Nov 27, 2025 Release notes ↗

otherdocker/cli, 29.1.0 milestone

othermoby/moby, 29.1.0 milestone

otherUpdate BuildKit to v0.26.1. moby/moby#51551

otherUpdate containerd binary to v2.2.0 (static binaries). moby/moby#51271

otherDo not overwrite user-modified /etc/resolv.conf across container restarts. moby/moby#51507

fixfix --publish-all / -P for Windows containers. moby/moby#51586

fixFix an issue that prevented container restart or network reconnection when gateway configuration failed during container stop or network disconnect. moby/moby#51592

otherWindows containers: don't display an IPv6-mapped IPv4 address in port mappings. For example, [::ffff:0.0.0.0]:8080->80/tcp instead of 0.0.0.0:8080->80/tcp. moby/moby#51587

29.0.4 Nov 24, 2025 Release notes ↗

otherdocker/cli, 29.0.4 milestone

othermoby/moby, 29.0.4 milestone

fixdocker image ls no longer truncates the image names. docker/cli#6675

featureAllow creation of a container with a specific IP address when its networks were not configured with a specific subnet. moby/moby#51583

29.0.3 Nov 24, 2025 Release notes ↗

otherdocker/cli, 29.0.3 milestone

othermoby/moby, 29.0.3 milestone

fixdocker version --format json: restore top-level BuildTime field to use RFC3339Nano format. docker/cli#6668

fixFix docker image ls ignoring a custom imageFormat from docker.json. docker/cli#6667

fixFix an issue that caused daemon crash when using a remote network driver plugin. moby/moby#51558

29.0.2 Nov 17, 2025 Release notes ↗

otherdocker/cli, 29.0.2 milestone

othermoby/moby, 29.0.2 milestone

fixFix an issue that prevented rootless Docker from starting on a host with IPv6 disabled. moby/moby#51543

29.0.1 Nov 14, 2025 Release notes ↗

otherdocker/cli, 29.0.1 milestone

othermoby/moby, 29.0.1 milestone

fixdocker image ls no longer truncates the name width when output is redirect (e.g. for grep). docker/cli#6656

fixdocker image ls now considers the NO_COLOR environment variable for choosing the colored output. docker/cli#6654

fixcontainerd image store: Fix a bug causing docker build to ignore the explicitly set unpack image exporter option. moby/moby#51514

fixFix a bug causing docker image ls --all to not show untagged/dangling images. docker/cli#6657

fixFix build on i386. moby/moby#51528

fixFix explicit graphdriver configuration ("storage-driver") being treated as containerd snapshotter when prior graphdriver state exists. moby/moby#51516

fixFix output format of the ApiVersion and MinApiVersion fields in docker version --format=json to align with previous versions. docker/cli#6648

fixFix a bug preventing DNS resolution of containers attached to non swarm-scoped networks once the node has joined a Swarm cluster. moby/moby#51515

29.0.0 Nov 10, 2025 Release notes ↗

breakingThe Go module github.com/docker/docker is deprecated in favor of github.com/moby/moby/client and github.com/moby/moby/api. The github.com/moby/moby module is considered an internal implementation detail - the only supported public modules are client and api. Starting with v29, releases are tagged…

breakingDebian armhf (32-bit) packages now target ARMv7 CPUs and will not work on ARMv6 devices.

breakingOfficial Raspbian (32-bit) packages are no longer provided. Use Debian arm64 packages for 64-bit devices, or Debian armhf packages for 32-bit ARMv7 devices.

breakingcgroup v1 is deprecated. Support continues until at least May 2029, but migrate to cgroup v2 as soon as possible. See moby#51111.

breakingDocker Content Trust was removed from the Docker CLI. Can be built as a separate plugin: https://github.com/docker/cli/blob/v29.0.0/cmd/docker-trust/main.go

breakingThe daemon now requires API version v1.44 or later (Docker v25.0+).

breakingclient: remove legacy CBC cipher suites from client config. moby/moby#50126

breakingcontrib: remove editorconfig as it was unmaintained. moby/moby#50607

breakingcontrib: remove Dockerfile syntax highlighting files for nano and TextMate (tmbundle) as they were unmaintained and outdated. moby/moby#50606

breakingcontrib: remove mkimage-xxx scripts as they were unmaintained and not tested. moby/moby#50297

deprecatedapi/types/system: deprecated top level DiskUsage fields for type specific fields. moby/moby#51235

breakingEnsure bridge devices are removed when bridge network creation fails. moby/moby#51147

deprecatedEnvironment variables set on a container using legacy links are deprecated and aren't added automatically anymore. moby/moby#50719

deprecatedUsers are encouraged to stop relying on these as they're deprecated, and the escape hatch will be removed in a later version

breakingThe iptables rules for bridge networks have been updated, including removal of the DOCKER-ISOLATION-STAGE-1 and DOCKER-ISOLATION-STAGE-2 chains. With these changes:. moby/moby#49981

breakingPOST /images/{name:}/push: remove compatibility with API v1.4 auth-config in body. moby/moby#50371

breakingapi/types/plugin: remove deprecated Config.DockerVersion. moby/moby#51458

breakingapi/types/swarm: deprecated and dropped support for PortConfigProtocol; use network.IPProtocol instead. moby/moby#51094

breakingapi/pkg/progress and api/pkg/streamformatter have been removed. moby/moby#51153

breakingapi: remove unused DefaultVersion, MinSupportedAPIVersion consts. moby/moby#50587

breakingclient: ContainerCommitOptions: remove Pause field in favor of NoPause. moby/moby#51019

breakingclient: remove client.ContainerStatsResult.OSType field. moby/moby#51305

breakingRemove structs NetworkSettingsBase and DefaultNetworkSettings. Fields in NetworkSettingsBase that were not deprecated are now directly in NetworkSettings. moby/moby#50846

deprecatedclient/pkg/jsonmessage: remove deprecated ProgressMessage, ErrorMessage, DisplayJSONMessagesToStream and Stream interface. moby/moby#49264

deprecatedGET /events no longer includes the deprecated status, id, and from fields. These fields were removed in API v1.22, but still included in the response. These fields are now omitted when using API v1.52 or later. moby/moby#50832

deprecatedapi/types/network: CreateRequest: remove deprecated CheckDuplicate field. moby/moby#50998

deprecatedapi/types/plugin: deprecate Config.DockerVersion field. moby/moby#51109

deprecatedapi/types/registry: remove deprecated AuthConfig.Email field. moby/moby#51059

deprecatedapi/types/strslice: deprecate StrSlice in favor of using a regular []string. moby/moby#50292

deprecatedapi/types/sytem: remove deprecated DiskUsage.BuilderSize. moby/moby#51180

deprecatedapi/types: move plugin types to api/types/plugin. moby/moby#48114

deprecatedAPI: Deprecation: the Engine was automatically backfilling empty PortBindings lists with a PortBinding with an empty HostIP and HostPort when starting a container. This behavior is deprecated for API 1.52, and will be dropped in API 1.53. moby/moby#50874

deprecatedbuild: remove DCT support for classic builder. docker/cli#6195

deprecatedcli/command: Remove deprecated ResolveDefaultContext. docker/cli#6555

deprecatedclient: ImageBuildResponse: remove OSType field. moby/moby#50995

deprecatedclient: Remove ImageCreate method - useImagePull or ImageImport instead. moby/moby#51366

deprecatedclient: remove deprecated ImageListOptions.ContainerCount. moby/moby#51006

deprecatedclient: remove support for negotiating API version < v1.44 (docker 25.0). moby/moby#51119

deprecatedclient: remove unused Client.HTTPClient() method. moby/moby#51011

deprecateddaemon/graphdriver: remove deprecated GetDriver(). moby/moby#50377

+259 more items in the release notes

28.5.2 Nov 5, 2025 Release notes ↗

otherdocker/cli, 28.5.2 milestone

othermoby/moby, 28.5.2 milestone

securityCVE-2025-31133

securityCVE-2025-52565

securityCVE-2025-52881

otherUpdate runc to v1.3.3. moby/moby#51394

fixdockerd-rootless.sh: if slirp4netns is not installed, try using pasta (passt). moby/moby#51162

fixUpdate Go runtime to 1.24.9. moby/moby#51387, docker/cli#6613

deprecatedGo-SDK: cli/command/image/build: deprecate DefaultDockerfileName, DetectArchiveReader, WriteTempDockerfile, ResolveAndValidateContextPath. These utilities were only used internally and will be removed in the next release. docker/cli#6610

deprecatedGo-SDK: cli/command/image/build: deprecate IsArchive utility. docker/cli#6560

deprecatedGo-SDK: opts: deprecate ValidateMACAddress. docker/cli#6560

deprecatedGo-SDK: opts: deprecate ListOpts.Delete(). docker/cli#6560

28.5.1 Oct 8, 2025 Release notes ↗

otherdocker/cli, 28.5.1 milestone

othermoby/moby, 28.5.1 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

fixUpdate BuildKit to v0.25.1. moby/moby#51137

fixUpdate Go runtime to 1.24.8. moby/moby#51133, docker/cli#6541

deprecatedapi/types/image: InspectResponse: deprecate Parent and DockerVersion fields. moby/moby#51105

deprecatedapi/types/plugin: deprecate Config.DockerVersion field. moby/moby#51110

28.5.0 Oct 2, 2025 Release notes ↗

otherdocker/cli, 28.5.0 milestone

othermoby/moby, 28.5.0 milestone

deprecatedDeprecated and removed features, see Deprecated Features.

otherChanges to the Engine API, see API version history.

fixDon't print warnings in docker info for broken symlinks in CLI-plugin directories. docker/cli#6476

fixFix a panic during stats on empty event Actor.ID. docker/cli#6471

breakingRemove support for legacy CBC cipher suites. docker/cli#6474

otherUpdate Buildkit to v0.25.0. moby/moby#51075

otherUpdate Dockerfile syntax to v1.19.0. moby/moby#51075

otherEliminated harmless warning about deletion of endpoint_count from the data store. moby/moby#51064

fixFix a bug causing IPAM plugins to not be loaded on Windows. moby/moby#51035

deprecatedDeprecate support for kernel memory TCP accounting (KernelMemoryTCP). moby/moby#51067

fixFix GET containers/{name}/checkpoints returning null instead of empty JSON array when there are no checkpoints. moby/moby#51052

featurecli-plugins/plugin: Run: allow customizing the CLI. docker/cli#6481

featurecli/command: add WithUserAgent option. docker/cli#6477

deprecatedGo-SDK: cli/command: deprecate DockerCli.Apply. This method is no longer used and will be removed in the next release if there are no remaining uses. docker/cli#6497

deprecatedGo-SDK: cli/command: deprecate DockerCli.ContentTrustEnabled. This method is no longer used and will be removed in the next release. docker/cli#6495

deprecatedGo-SDK: cli/command: deprecate DockerCli.DefaultVersion. This method is no longer used and will be removed in the next release. docker/cli#6491

deprecatedGo-SDK: cli/command: deprecate ResolveDefaultContext utility. docker/cli#6529

deprecatedGo-SDK: cli/command: deprecate WithContentTrustFromEnv, WithContentTrust options. These options were used internally, and will be removed in the next release.. docker/cli#6489

deprecatedGo-SDK: cli/manifest/store: deprecate IsNotFound(). docker/cli#6514

deprecatedGo-SDK: templates: deprecate NewParse() function. docker/cli#6469

28.4.0 Sep 3, 2025 Release notes ↗

deprecatedDeprecated and removed features, see Deprecated Features.

deprecatedUpdate deprecation message for AuthConfig.Email field. moby/moby#50797

deprecatedDeprecate profiles package which got migrated to github.com/moby/profiles. moby/moby#50513

deprecatedDeprecate special handling for quoted values for the --tlscacert, --tlscert, and --tlskey command-line flags. docker/cli#6291

deprecatedMark legacy links env vars (DOCKER_KEEP_DEPRECATED_LEGACY_LINKS_ENV_VARS) as deprecated in v28.4 and set for removal in v30.0. docker/cli#6309

deprecatedGo-SDK: Deprecate field NetworkSettingsBase.Bridge, struct NetworkSettingsBase, all the fields of DefaultNetworkSettings, and struct DefaultNetworkSettings. moby/moby#50839

deprecatedGo-SDK: api/types: build.CacheDiskUsage, container.DiskUsage, images.DiskUsage and volumes.DiskUsage are now deprecated and will be removed in the next major release. moby/moby#50768

deprecatedGo-SDK: cli-plugins/manager: deprecate ReexecEnvvar. docker/cli#6411

deprecatedGo-SDK: cli-plugins/manager: deprecate annotation aliases (CommandAnnotationPlugin, CommandAnnotationPluginVendor, CommandAnnotationPluginVersion, CommandAnnotationPluginInvalid, CommandAnnotationPluginCommandPath) in favor of their equivalent in cli-plugins/manager/metadata. docker/cli#6298

deprecatedGo-SDK: cli-plugins/manager: deprecate metadata aliases (NamePrefix, MetadataSubcommandName, HookSubcommandName, Metadata, ReexecEnvvar) in favor of their equivalent in cli-plugins/manager/metadata. docker/cli#6269

deprecatedGo-SDK: cli-plugins/manager: remove Candidate interface, which was only for internal use. docker/cli#6269

deprecatedGo-SDK: cli-plugins/manager: remove NewPluginError function, which was only for internal use. docker/cli#6269

deprecatedGo-SDK: cli-plugins/manager: remove deprecated ResourceAttributesEnvvar const. docker/cli#6269

deprecatedGo-SDK: cli/command/builder: deprecate NewBuilderCommand and NewBakeStubCommand. These functions will be removed in the next release. docker/cli#6312

deprecatedGo-SDK: cli/command/builder: deprecate NewPruneCommand. docker/cli#6343

deprecatedGo-SDK: cli/command/checkpoint: deprecate NewCheckpointCommand. This function will be removed in the next release. docker/cli#6312

deprecatedGo-SDK: cli/command/checkpoint: deprecate NewFormat, FormatWrite. docker/cli#6341

deprecatedGo-SDK: cli/command/completion: deprecate NoComplete. docker/cli#6405

deprecatedGo-SDK: cli/command/completion: remove deprecated ValidArgsFn. docker/cli#6259

deprecatedGo-SDK: cli/command/config: deprecate NewConfigCommand. This function will be removed in the next release. docker/cli#6312

deprecatedGo-SDK: cli/command/config: deprecate NewFormat, FormatWrite, InspectFormatWrite. docker/cli#6341

deprecatedGo-SDK: cli/command/config: deprecate RunConfigCreate, CreateOptions, RunConfigInspect, InspectOptions, RunConfigList, ListOptions, RunConfigRemove, and RemoveOptions. docker/cli#6369

deprecatedGo-SDK: cli/command/container: deprecate NewBuildCommand, NewPullCommand, NewPushCommand, NewImagesCommand, NewImageCommand, NewHistoryCommand, NewImportCommand, NewLoadCommand, NewRemoveCommand, NewSaveCommand, NewTagCommand, NewPruneCommand. These functions will be removed in the next release.…

deprecatedGo-SDK: cli/command/container: deprecate NewDiffFormat, DiffFormatWrite. These functions were only used internally and will be removed in the next release. docker/cli#6341

deprecatedGo-SDK: cli/command/container: deprecate NewRunCommand, NewExecCommand, NewPsCommand, NewContainerCommand, NewAttachCommand, NewCommitCommand, NewCopyCommand, NewCreateCommand, NewDiffCommand, NewExportCommand, NewKillCommand, NewLogsCommand, NewPauseCommand, NewPortCommand, NewRenameCommand,…

deprecatedGo-SDK: cli/command/context: deprecate NewContextCommand. This function will be removed in the next release. docker/cli#6312

deprecatedGo-SDK: cli/command/context: deprecate RunCreate and CreateOptions. docker/cli#6403

deprecatedGo-SDK: cli/command/context: deprecate RunExport and ExportOptions. docker/cli#6403

deprecatedGo-SDK: cli/command/context: deprecate RunImport. docker/cli#6403

deprecatedGo-SDK: cli/command/context: deprecate RunRemove and RemoveOptions. docker/cli#6403

deprecatedGo-SDK: cli/command/context: deprecate RunUpdate and UpdateOptions. docker/cli#6403

deprecatedGo-SDK: cli/command/context: deprecate RunUse. docker/cli#6403

deprecatedGo-SDK: cli/command/image: deprecate AuthResolver utility. docker/cli#6357

deprecatedGo-SDK: cli/command/image: deprecate NewHistoryFormat, HistoryWrite. docker/cli#6341, docker/cli#6341

deprecatedGo-SDK: cli/command/manifest: deprecate NewManifestCommand. This functions will be removed in the next release. docker/cli#6312

deprecatedGo-SDK: cli/command/network: deprecate NewFormat, FormatWrite. docker/cli#6341

deprecatedGo-SDK: cli/command/network: deprecate NewNetworkCommand. These functions will be removed in the next release. docker/cli#6312

deprecatedGo-SDK: cli/command/node: deprecate NewFormat, FormatWrite, InspectFormatWrite. docker/cli#6341

deprecatedGo-SDK: cli/command/node: deprecate NewNodeCommand. This functions will be removed in the next release. docker/cli#6312

deprecatedGo-SDK: cli/command/plugin: deprecate NewFormat, FormatWrite. docker/cli#6341

+48 more items in the release notes

28.3.3 Jul 29, 2025 Release notes ↗

otherdocker/cli, 28.3.3 milestone

othermoby/moby, 28.3.3 milestone

securityThis release fixes an issue where, after a firewalld reload, published container ports could be accessed directly from the local network, even when they were intended to be accessible only via a loopback address. CVE-2025-54388 / GHSA-x4rx-4gw3-53p4 / moby/moby#50506.

otherUpdate Buildx to v0.26.1. docker/docker-ce-packaging#1230

otherUpdate Compose to v2.39.1. docker/docker-ce-packaging#1234

otherUpdate Docker Model CLI plugin to v0.1.36. docker/docker-ce-packaging#1233

featurecli/command/formatter: add TrunateID() utility as alternative for github.com/docker/docker/pkg/stringid.TrunateID(). docker/cli#6180