Skip to content

Releases: moby/moby

v25.0.5

19 Mar 21:36
@vvoland vvoland
v25.0.5
e63daec
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v25.0.5

25.0.5

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Security

This release contains a security fix for CVE-2024-29018, a potential data exfiltration from 'internal' networks via authoritative DNS servers.

Bug fixes and enhancements

  • CVE-2024-29018: Do not forward requests to external DNS servers for a container that is only connected to an 'internal' network. Previously, requests were forwarded if the host's DNS server was running on a loopback address, like systemd's 127.0.0.53. moby/moby#47589
  • plugin: fix mounting /etc/hosts when running in UserNS. moby/moby#47588
  • rootless: fix open /etc/docker/plugins: permission denied. moby/moby#47587
  • Fix multiple parallel docker build runs leaking disk space. moby/moby#47527
Assets 2
0 Join discussion

v26.0.0-rc2

07 Mar 21:16
@vvoland vvoland
v26.0.0-rc2
f4c696e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v26.0.0-rc2 Pre-release
Pre-release

26.0.0-rc2

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

New

  • Allow to enable host loopback by setting DOCKERD_ROOTLESS_ROOTLESSKIT_DISABLE_HOST_LOOPBACK to false, defaults true. It allows to connect to host by using 10.0.2.2 IP moby/moby#47352

Bug fixes and enhancements

  • Fix multiple parallel docker build runs leaking disk space. moby/moby#47523
  • rc1 regression: Fix docker pull regression introduced in rc1 causing a wrong pull progress message moby/moby#47475
  • rc1 regression: Do not attempt to configure an IPv6 address or gateway in a container that's got IPv6 disabled.
  • rc1 regression: Fix build sometimes ending with ERROR: failed to solve: unknown blob <digest> in history. moby/moby#47520

API

  • The is_automated field in the POST /images/search endpoint results is always false now. Consequently, searching for is-automated=true will yield no results, while is-automated=false will be a no-op. moby/moby#47465

Packaging updates

Assets 2
0 Join discussion

v25.0.4

07 Mar 11:01
@vvoland vvoland
v25.0.4
061aa95
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v25.0.4

25.0.4

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug fixes and enhancements

  • Restore DNS names for containers in the default "nat" network on Windows. moby/moby#47490
  • Fix docker start failing when used with --checkpoint moby/moby#47466
  • Don't enforce new validation rules for existing swarm networks moby/moby#47482
  • Restore IP connectivity between the host and containers on an internal bridge network. moby/moby#47481
  • Fix a regression introduced in v25.0 that prevented the classic builder from ADDing a tar archive with xattrs created on a non-Linux OS moby/moby#47483
  • containerd image store: Fix image pull not emitting Pulling fs layer status moby/moby#47484

API

  • To preserve backwards compatibility, make read-only mounts not recursive by default when using older clients (API version < v1.44). moby/moby#47393
  • GET /images/{id}/json omits the Created field (previously it was 0001-01-01T00:00:00Z) if the Created field is missing from the image config. moby/moby#47451
  • Populate a missing Created field in GET /images/{id}/json with 0001-01-01T00:00:00Z for API version <= 1.43. moby/moby#47387
  • Fix a regression that caused API socket connection failures to report an API version negotiation failure instead. moby/moby#47470
  • Preserve supplied endpoint configuration in a container-create API request, when a container-wide MAC address is specified, but NetworkMode name-or-id is not the same as the name-or-id used in NetworkSettings.Networks. moby/moby#47510

Packaging updates

Full Changelog: v25.0.3...v25.0.4

Assets 2

v26.0.0-rc1

29 Feb 09:55
@vvoland vvoland
v26.0.0-rc1
81428bf
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v26.0.0-rc1 Pre-release
Pre-release

26.0.0-rc1

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

New

  • Add Subpath field to the VolumeOptions making it possible to mount a subpath of a volume. moby/moby#45687
  • Add volume-subpath option to mount flag (--mount type=volume,...,volume-subpath=<subpath>) docker/cli#4331
  • containerd image store: image list will no longer produce multiple duplicates image entries for multi-platform images moby/moby#45967
  • Accept = separators and [ipv6] in compose files for docker stack deploy docker/cli#4860

Bug fixes and enhancements

  • Fix ADD Dockerfile instruction failing with lsetxattr <file>: operation not supported when unpacking archive with xattrs onto a filesystem that doesn't support them. moby/moby#47175
  • Fix docker start failing when used with --checkpoint moby/moby#47456
  • Always try to enable IPv6 on a container's loopback interface, and only include IPv6 in '/etc/hosts' if successful. moby/moby#47062
  • Restore IP connectivity between the host and containers on an internal bridge network. moby/moby#47356
  • Do not enforce new validation rules for existing swarm networks moby/moby#47361
  • Restore DNS names for containers in the default "nat" network on Windows. moby/moby#47375
  • Print hint when invoking "docker images" with ambiguous argument docker/cli#4849
  • Cleanup @docker_cli_[UUID] files on OpenBSD docker/cli#4862
  • containerd image store: Isolate images with different containerd namespaces when --userns-remap option is used moby/moby#46786
  • containerd image store: Fix image pull not emitting Pulling fs layer status moby/moby#47432
  • Ensure that a generated MAC address is not restored when a container is restarted, but a configured MAC address is preserved. moby/moby#47233

Note

Containers created using 25.0.0 may have duplicate MAC addresses, they must be re-created.
Containers created using 25.0.0 or 25.0.1 with user-defined MAC addresses will get generated MAC addresses when they are started using 25.0.2. They must also be re-created.

API

  • To preserve backwards compatibility, read-only mounts are not recursive by default when using older clients (API version < v1.44). moby/moby#47391
  • GET /images/{id}/json omits the Created field (previously it was 0001-01-01T00:00:00Z) if the Created field is missing from the image config. moby/moby#47451
  • Populate a missing Created field in GET /images/{id}/json with 0001-01-01T00:00:00Z for API version <= 1.43. moby/moby#47387

Packaging updates

Removed

  • Disable pulling of deprecated image formats by default. These image formats are deprecated, and support will be removed in a future version. moby/moby#47459
  • image: remove deprecated IDFromDigest moby/moby#47198
  • Removed the deprecated github.com/docker/docker/pkg/loopback package. moby/moby#47128
  • pkg/system: remove deprecated ErrNotSupportedOperatingSystem, IsOSSupported moby/moby#47129
  • pkg/homedir: remove deprecated Key() and GetShortcutString() moby/moby#47130
  • pkg/containerfs: remove deprecated ResolveScopedPath moby/moby#47131
  • The daemon flag --oom-score-adjust has been deprecated in v24.0 and is now removed. moby/moby#46113
  • API: remove deprecated API versions (API < v1.24) moby/moby#47155
  • Remove deprecated aliases from the api/types package. These types were deprecated in v25.0.0, which provided temporary aliases. moby/moby#47148
    These aliases are now removed: types.Info, types.Commit, types.PluginsInfo, types.NetworkAddressPool, types.Runtime, types.SecurityOpt, types.KeyValue, types.DecodeSecurityOptions, types.CheckpointCreateOptions, types.CheckpointListOptions, types.CheckpointDeleteOptions, types.Checkpoint, types.ImageDeleteResponseItem, types.ImageSummary, types.ImageMetadata, types.ServiceUpdateResponse, types.ServiceCreateResponse, types.ResizeOptions, types.ContainerAttachOptions, types.ContainerCommitOptions, types.ContainerRemoveOptions, types.ContainerStartOptions, types.ContainerListOptions, types.ContainerLogsOptions
  • cli/command/container: remove deprecated NewStartOptions() docker/cli#4811
  • cli/command: remove deprecated DockerCliOption, InitializeOptdocker/cli#4810
Assets 2
0 Join discussion

v25.0.3

07 Feb 00:41
@thaJeztah thaJeztah
v25.0.3
f417435
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v25.0.3

25.0.3

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug fixes and enhancements

  • containerd image store: Fix a bug where docker image history would fail if a manifest wasn't found in the content store. moby/moby#47348

  • Ensure that a generated MAC address is not restored when a container is restarted, but a configured MAC address is preserved. moby/moby#47304

    Note

    • Containers created with Docker Engine version 25.0.0 may have duplicate MAC addresses.
      They must be re-created.
    • Containers with user-defined MAC addresses created with Docker Engine versions 25.0.0 or 25.0.1
      receive new MAC addresses when started using Docker Engine version 25.0.2.
      They must also be re-created.
  • Fix docker save <image>@<digest> producing an OCI archive with index without manifests. moby/moby#47294
  • Fix a bug preventing bridge networks from being created with an MTU higher than 1500 on RHEL and CentOS 7. moby/moby#47308, moby/moby#47311
  • Fix a bug where containers are unable to communicate over an internal network. moby/moby#47303
  • Fix a bug where the value of the ipv6 daemon option was ignored. moby/moby#47310
  • Fix a bug where trying to install a pulling using a digest revision would cause a panic. moby/moby#47323
  • Fix a potential race condition in the managed containerd supervisor. moby/moby#47313
  • Fix an issue with the journald log driver preventing container logs from being followed correctly with systemd version 255. moby/moby47243
  • seccomp: Update the builtin seccomp profile to include syscalls added in kernel v5.17 - v6.7 to align the profile with the profile used by containerd. moby/moby#47341
  • Windows: Fix cache not being used when building images based on Windows versions older than the host's version. moby/moby#47307, moby/moby#47337

Packaging updates

Assets 2
0 Join discussion

v25.0.2

01 Feb 02:46
@thaJeztah thaJeztah
v25.0.2
fce6e0c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v25.0.2

25.0.2

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Security

This release contains security fixes for the following CVEs
affecting Docker Engine and its components.

CVE Component Fix version Severity
CVE-2024-21626 runc 1.1.12 High, CVSS 8.6
CVE-2024-23651 BuildKit 1.12.5 High, CVSS 8.7
CVE-2024-23652 BuildKit 1.12.5 High, CVSS 8.7
CVE-2024-23653 BuildKit 1.12.5 High, CVSS 7.7
CVE-2024-23650 BuildKit 1.12.5 Medium, CVSS 5.5
CVE-2024-24557 Docker Engine 25.0.2 Medium, CVSS 6.9

The potential impacts of the above vulnerabilities include:

  • Unauthorized access to the host filesystem
  • Compromising the integrity of the build cache
  • In the case of CVE-2024-21626, a scenario that could lead to full container escape

For more information about the security issues addressed in this release,
refer to the blog post.
For details about each vulnerability, see the relevant security advisory:

Packaging updates

Assets 2
1 Join discussion

v24.0.9

01 Feb 13:58
@thaJeztah thaJeztah
v24.0.9
fca702d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v24.0.9

24.0.9

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Security

This release contains security fixes for the following CVEs affecting Docker Engine and its components.

CVE Component Fix version Severity
CVE-2024-21626 runc 1.1.12 High, CVSS 8.6
CVE-2024-24557 Docker Engine 24.0.9 Medium, CVSS 6.9

Important ⚠️

Note that this release of Docker Engine doesn't include fixes for the following known vulnerabilities in BuildKit:

To address these vulnerabilities, upgrade to Docker Engine v25.0.2.

For more information about the security issues addressed in this release, and the unaddressed vulnerabilities in BuildKit, refer to the
blog post. For details about each vulnerability, see the relevant security advisory:

Packaging updates

Assets 2

v23.0.9

31 Jan 00:19
@corhere corhere
v23.0.9
14e65c6
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v23.0.9

23.0.9

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Assets 2

v24.0.8

25 Jan 22:52
@thaJeztah thaJeztah
v24.0.8
61c51fb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v24.0.8

24.0.8

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug fixes and enhancements

  • Live restore: Containers with auto remove (docker run --rm) are no longer forcibly removed on engine restart. moby/moby#46857

Packaging updates

Assets 2

v25.0.1

24 Jan 10:28
@thaJeztah thaJeztah
v25.0.1
71fa3ab
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v25.0.1

25.0.1

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug fixes and enhancements

  • API: Fix incorrect HTTP status code for containers with an invalid network configuration created before upgrading to Docker Engine v25.0. moby/moby#47159
  • Ensure that a MAC address based on a container's IP address is re-generated when the container is stopped and restarted, in case the generated IP/MAC addresses have been reused. moby/moby#47171
  • Fix host-gateway-ip not working during build when not set through configuration. moby/moby#47192
  • Fix a bug that prevented a container from being renamed twice. moby/moby#47196
  • Fix an issue causing containers to have their short ID added to their network alias when inspecting them. moby/moby#47182
  • Fix an issue in detecting whether a remote build context is a Git repository. moby/moby#47136
  • Fix an issue with layers order in OCI manifests. moby/moby#47150
  • Fix volume mount error when passing an addr or ip mount option. moby/moby#47185
  • Improve error message related to extended attributes that can't be set due to improperly namespaced attribute names. moby/moby#47178
  • Swarm: Fixed start_interval not being passed to the container config. moby/moby#47163

Packaging updates

Assets 2
0 Join discussion