Docker Engine 29.6.2 → 29.8.2
6 releases · 0 breaking changes · 16 security fixes · 1 advisory fixed
16security0breaking0deprecated6feature50fix
Vulnerabilities fixed by this upgrade
- 7.6 CVE-2026-92543 Docker Engine insecure-registry fallback via malicious DNS responses
Breaking changes
None in the release notes.
Security changes
- security CVE-2026-53493: Pulling a crafted OCI image index with deeply nested or widely fanned-out descriptors could cause unbounded CPU and memory use. GHSA-pg57-6jwg-q645 in 29.8.2
- security CVE-2026-92543: A malicious DNS response could make registry connections skip TLS certificate verification or fall back to HTTP, exposing registry credentials or allowing image substitution. GHSA-7cfq-22r6-qp73 in 29.8.2
- security CVE-2026-92542: Unprivileged users on a Swarm node could inject forged Ethernet frames into encrypted overlay networks on peer nodes. GHSA-6m9p-4h64-m6vh in 29.8.2
- security CVE-2026-93315: A build step could redirect proxy CA cleanup outside the build root filesystem, block it with a special file, or let the build succeed when cleanup failed. GHSA-2f5p-x9ph-g97x in 29.8.2
- security CVE-2026-93316: A build that requested CDI devices could cause a daemon panic when CDI support was disabled, for example with "features": {"cdi": false} in daemon.json. GHSA-r456-g3gm-cvxf in 29.8.2
- security CVE-2026-93317: With the containerd image store, a client using the low-level LLB API could poison the build cache with container blob contents that did not match their claimed digest. GHSA-p3rc-w3hc-pqvv in 29.8.2
- security CVE-2026-93318: A malicious image could poison the build cache with layer DiffIDs that did not match the actual layer contents. GHSA-f2v9-hprr-32q3 in 29.8.2
- security CVE-2026-93319: A malicious external frontend could crash the daemon through gateway container lifecycle races or malformed requests and definitions. GHSA-4hgw-qrhw-fhg8 in 29.8.2
- security CVE-2026-93320: Daemon-side snapshot reads and LLB mkfile operations did not safely handle special files. GHSA-9728-qjrv-2xh2 in 29.8.2
- security CVE-2026-93321: A malformed LLB file operation with invalid symlink owner inputs could crash the daemon. GHSA-fjj4-h6vf-m9hj in 29.8.2
- security CVE-2026-93322: A malformed LLB merge operation with mismatched input counts could crash the daemon. GHSA-cv6p-7w7g-xjwq in 29.8.2
- security CVE-2026-93323: An oversized Dockerfile, .dockerignore, gateway file, or nested LLB definition could exhaust daemon memory. GHSA-mgqf-486f-49vp in 29.8.2
- security CVE-2026-93326: A crafted Git build source could bypass source policy rules that match on the repository URL, through a Git bundle locator or a full remote URL that did not match the source identifier. GHSA-66hf-6vf5-87hc in 29.8.2
- security Add daemon support for configuring the default container AppArmor profile template. moby/moby#52771 in 29.8.0
- security Prevent containers from using the 32-bit socketcall(2) path to create AF_VSOCK sockets and communicate with host virtual machines by adding AppArmor and SELinux policy rules. moby/moby#53551 in 29.8.0
- security Update github.com/moby/go-archive to v0.3.0 to fix CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h. moby/moby#53247, docker/cli#7139 in 29.7.0
Every release in between
otherdocker/cli, 29.8.2 milestone
othermoby/moby, 29.8.2 milestone
securityCVE-2026-53493: Pulling a crafted OCI image index with deeply nested or widely fanned-out descriptors could cause unbounded CPU and memory use. GHSA-pg57-6jwg-q645
securityCVE-2026-92543: A malicious DNS response could make registry connections skip TLS certificate verification or fall back to HTTP, exposing registry credentials or allowing image substitution. GHSA-7cfq-22r6-qp73
securityCVE-2026-92542: Unprivileged users on a Swarm node could inject forged Ethernet frames into encrypted overlay networks on peer nodes. GHSA-6m9p-4h64-m6vh
securityCVE-2026-93315: A build step could redirect proxy CA cleanup outside the build root filesystem, block it with a special file, or let the build succeed when cleanup failed. GHSA-2f5p-x9ph-g97x
securityCVE-2026-93316: A build that requested CDI devices could cause a daemon panic when CDI support was disabled, for example with "features": {"cdi": false} in daemon.json. GHSA-r456-g3gm-cvxf
securityCVE-2026-93317: With the containerd image store, a client using the low-level LLB API could poison the build cache with container blob contents that did not match their claimed digest. GHSA-p3rc-w3hc-pqvv
securityCVE-2026-93318: A malicious image could poison the build cache with layer DiffIDs that did not match the actual layer contents. GHSA-f2v9-hprr-32q3
securityCVE-2026-93319: A malicious external frontend could crash the daemon through gateway container lifecycle races or malformed requests and definitions. GHSA-4hgw-qrhw-fhg8
securityCVE-2026-93320: Daemon-side snapshot reads and LLB mkfile operations did not safely handle special files. GHSA-9728-qjrv-2xh2
securityCVE-2026-93321: A malformed LLB file operation with invalid symlink owner inputs could crash the daemon. GHSA-fjj4-h6vf-m9hj
securityCVE-2026-93322: A malformed LLB merge operation with mismatched input counts could crash the daemon. GHSA-cv6p-7w7g-xjwq
securityCVE-2026-93323: An oversized Dockerfile, .dockerignore, gateway file, or nested LLB definition could exhaust daemon memory. GHSA-mgqf-486f-49vp
securityCVE-2026-93326: A crafted Git build source could bypass source policy rules that match on the repository URL, through a Git bundle locator or a full remote URL that did not match the source identifier. GHSA-66hf-6vf5-87hc
fixFix docker cp failing on a container with a bind-mounted socket nested inside another bind mount. moby/moby#53724
fixFix docker info failing with an “invalid Prefix” error after reloading a daemon with custom default address pools. moby/moby#53812
otherUpdate BuildKit to v0.33.1. moby/moby#53823
otherUpdate containerd (static binaries) to v2.3.6. moby/moby#53778
otherUpdate runc (in static binaries) to v1.5.2. moby/moby#53811
otherdocker/cli, 29.8.1 milestone
othermoby/moby, 29.8.1 milestone
fixcontainerd image store: Fix docker load leaving dangling images after loading an image that already exists. moby/moby#53595
fixFix managed containerd logging a CRI pod-sandbox plugin dependency warning during startup. moby/moby#53585
fixFix user-namespace detection on OpenVZ, where namespace inode numbers are virtualized. moby/moby#53605
fixWindows: Preserve hard links when committing a container, so a file with multiple names is stored once in the resulting image layer instead of once per name. moby/moby#53624
otherUpdate containerd (static binaries) to v2.3.5. moby/moby#53589
fixFix GET /networks returning a 500 status if an invalid 'type' filter was provided. moby/moby#53678
otherdocker/cli, 29.8.0 milestone
othermoby/moby, 29.8.0 milestone
featureAdd HostConfig.Umask option and a corresponding --umask flag to docker create/docker run to set the umask for a container's main process, execs, and healthchecks. moby/moby#53463, docker/cli#7108
featureAdd support for attaching service names, environments, and custom CloudWatch entity attributes to logs from the awslogs logging driver. moby/moby#52632
securityAdd daemon support for configuring the default container AppArmor profile template. moby/moby#52771
securityPrevent containers from using the 32-bit socketcall(2) path to create AF_VSOCK sockets and communicate with host virtual machines by adding AppArmor and SELinux policy rules. moby/moby#53551
fixFix docker network inspect failing to find a healthy Swarm network when another Swarm network could not be allocated. moby/moby#53325
fixFix a node gossiping a superseded value for a Swarm service discovery entry after concurrent updates to the same key. moby/moby#53479
fixFix Swarm service names failing to resolve on a node indefinitely after it misses a network membership announcement. moby/moby#53437
fixFix Swarm service names failing to resolve on healthy nodes after a transient node failure. moby/moby#53142
otherPrevent dockerd from hanging when the nft command produces enough stderr output to fill its pipe. moby/moby#53517
otherReduce gossip traffic generated by a node that repeatedly disconnects and rejoins the cluster. moby/moby#53479
otherRemote network-driver plugins can now set the container-side interface name via the DstName field in their Join response. moby/moby#52866
otherReserve network names "container" and "container:" to prevent creation of unusable networks. moby/moby#51973
otherSpread the daemon's periodic Swarm overlay network gossip and synchronization work over time, avoiding recurring bursts of CPU and network usage. moby/moby#53475
otherSwarm service-mesh published ports now use the same infrastructure as published ports for local containers. moby/moby#53118
fixFix --disable-host-loopback not being enforced for the pasta network driver in rootless mode. moby/moby#53358
featureUpdate RootlessKit to v3.1.0, adding support for the pesto port driver in rootless mode. Set DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=pesto to use it; it requires the pasta network driver and supports IPv4 only. moby/moby#53358
otherUpdate minimum supported Go version to 1.26. docker/cli#7258
fixAdd annotation filter to container listings (docker ps, GET /containers/json) allowing to filter containers by their annotations. moby/moby#53538
fixcontainerd image store: Fix docker image inspect reporting a smaller image size than docker image ls. moby/moby#53426
fixcontainerd image store: Fix slower image pulls caused by repeated registry authentication within a single pull. moby/moby#53497
fixDo not log expected image signature identity misses as errors for containerd image store images. moby/moby#53495
fixdockerd now uses the embedded containerd if no system containerd service is configured and containerd is not installed. moby/moby#53388
fixFix GET /images/{name}/json not including unpacked snapshot usage in Size when using the containerd image store. moby/moby#53426
fixFix classic-builder cache for Dockerfile stages that select a non-host platform with FROM --platform. moby/moby#53503
fixFix CLI panic when DOCKER_HOST or -H specifies an invalid host. docker/cli#7280
fixFix health checks being delayed for too long when the start interval is longer than the start period. moby/moby#52317
fixFix inconsistent mount ordering in docker inspect output (GET /containers/{id}/json) and container listings (docker ps, GET /containers/json). moby/moby#53534
fixFix NRI container metadata so Container.Args includes the resolved executable as argv[0], matching the process launched in the container instead of only the Docker Cmd. moby/moby#53423
fixFix Swarm service creation failing when an automatically generated name is already in use. moby/moby#53468
fixFix the container root directory / being world-writable when using the btrfs storage driver. moby/moby#53500
fixFixed docker ps sorting published ports lexicographically instead of numerically. docker/cli#7144
fixPreserve service mount order during forced updates to avoid an unnecessary rollout on the next stack deploy. docker/cli#7227
fixPrevent containerd's v2 CRI plugins from loading when CRI is disabled. moby/moby#53564
fixPrint plugin hook output (e.g. the "What's next:" hint) after the command's error message instead of before it. docker/cli#6976
fixReject checkpoint IDs containing path separators to prevent access outside the container checkpoint directory. moby/moby#53377
otherUpdate BuildKit to v0.33.0. moby/moby#53554
otherUpdate containerd (static binaries) to v2.3.4. moby/moby#53409
otherUpdate Go runtime to 1.26.8. moby/moby#53550, docker/cli#7274
+1 more item in the release notesotherdocker/cli, 29.7.2 milestone
othermoby/moby, 29.7.2 milestone
fixFix docker service create and docker service update panicking when the same environment variable is passed more than once. docker/cli#7145
fixFix a regression introduced in Docker Engine 29.7.0 that caused image pulls to reject images containing absolute hardlink targets, as produced by some image builders. moby/moby#53305
fixFix a regression introduced in Docker Engine 29.7.0 that could cause image pulls and docker cp to fail on older Linux kernels when applying file permissions, including for device nodes. moby/moby#53305
otherUpdate BuildKit to v0.32.2. moby/moby#53300
otherImprove compatibility with more nftables releases by terminating base-chain policies with a semicolon. moby/moby#53303
otherdocker/cli, 29.7.1 milestone
othermoby/moby, 29.7.1 milestone
fixFix a regression that prevented pulling images whose layers contain directories without explicit parent directory entries. moby/moby#53260
fixFix a regression where the CopyToContainer rejects container paths that traverse absolute symlinks, such as /var/run -> /run. moby/moby#53261
otherdocker/cli, 29.7.0 milestone
othermoby/moby, 29.7.0 milestone
featureAdd an experimental embedded-containerd feature that runs containerd inside the daemon process instead of as a separate managed process. moby/moby#52898
featureMount type image is no longer experimental. moby/moby#52998
featureAdd the default-stop-timeout daemon option to configure the stop timeout assigned to containers without an explicit timeout. moby/moby#53146
securityUpdate github.com/moby/go-archive to v0.3.0 to fix CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h. moby/moby#53247, docker/cli#7139
fixFix a daemon panic when cleanup of a container's network interface fails while the container is being disconnected from a network. moby/moby#53237
fixFix a daemon panic when removing swarm ingress ports after failing to bind an ingress proxy listener. moby/moby#53022
otherKeep the cgroup mount for containers with --net=host. moby/moby#52318
fixAdd shell completion for --filter names and known values to docker service ls, docker service ps, and docker node ps. docker/cli#7124
fixcontainerd image store: Fix daemon-wide concurrent download and upload limits for pulls and pushes not being honored. moby/moby#53081
fixTo preserve the previous unlimited startup behavior, configure "max-concurrent-downloads" and "max-concurrent-uploads" to 0
fixFix docker cp -a using the wrong file owner when copying files into containers with user namespace remapping enabled. moby/moby#53084
fixFix docker cp from a Windows container silently returning a file instead of an error when the source path ends with a separator but is not a directory. moby/moby#53123
fixFix docker stats reporting all zeros for running Windows containers when using the containerd runtime. moby/moby#53101
fixFix docker stats reporting empty network stats for running Windows containers when using the containerd runtime. moby/moby#53219
fixFix a typo in the docker create --pull flag description. docker/cli#7103
fixFix Swarm service updates failing due to "file exists" errors when a VIP IP alias already exists on the LB endpoint interface. moby/moby#51657
fixFix Swarm tasks being rejected when their image could not be pulled from the registry but was already present on the node. moby/moby#53212
fixImprove the error returned when a container hostname exceeds Linux's 64-byte limit. moby/moby#53121
fixPrevent live-restored volumes from retaining active mount references when containers exit during daemon startup. moby/moby#53115
fixSuppress the “No such container” error when docker rm --force succeeds for a nonexistent container. docker/cli#7110
otherUpdate Go runtime to 1.26.5. docker/cli#7087
otherUpdate BuildKit to v0.32.0. moby/moby#53234
otherUpdate containerd (static binaries) to v2.3.3. moby/moby#53050
otherUpdate runc (in static binaries) to v1.4.3. moby/moby#50960