Skip to content

Releases: moby/moby

v26.1.0

22 Apr 21:11
@vvoland vvoland
v26.1.0
c8af8eb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v26.1.0 Latest
Latest

26.1.0

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

New

Bug fixes and enhancements

  • Native Windows containers are configured with an internal DNS server for container name resolution, and external DNS servers for other lookups. Not all resolvers, including nslookup, fall back to the external resolvers when they get a SERVFAIL answer from the internal server. So, the internal DNS server can now be configured to forward requests to the external resolvers, by setting "features": {"windows-dns-proxy": true } in the daemon.json file. moby/moby#47584

Note

This will be the new default behavior in Docker Engine 27.0.

Warning

The windows-dns-proxy feature flag will be removed in a future release.

  • Swarm: Fix Subpath not being passed to the container config. moby/moby#47711
  • Classic builder: Fix cache miss on WORKDIR <directory>/ build step (directory with a trailing slash). moby/moby#47723
  • containerd image store: Fix docker images failing when any image in the store has unexpected target. moby/moby#47738
Assets 2
0 Join discussion

v26.0.2

18 Apr 20:35
@vvoland vvoland
v26.0.2
7cef0d9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v26.0.2

26.0.2

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Security

This release contains a security fix for CVE-2024-32473, an unexpected configuration of IPv6 on IPv4-only interfaces.

Bug fixes and enhancements

Assets 2
0 Join discussion

v26.0.1

11 Apr 14:54
@vvoland vvoland
v26.0.1
60b9add
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v26.0.1

26.0.1

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug fixes and enhancements

  • Fix a regression that meant network interface specific --sysctl options prevented container startup. moby/moby#47646
  • Remove erroneous platform from image config OCI descriptor in docker save output. moby/moby#47694
  • containerd image store: OCI archives produced by docker save will now have a non-empty mediaType field in index.json moby/moby#47701
  • Fix a regression that prevented the internal resolver from forwarding requests from IPvlan L3 networks to external resolvers. moby/moby#47705
  • Prevent the use of external resolvers in IPvlan and Macvlan networks created with no parent interface specified. moby/moby#47705

Packaging updates

Assets 2
0 Join discussion

v23.0.10

21 Mar 17:04
@corhere corhere
v23.0.10
548f37a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v23.0.10

23.0.10

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Assets 2

v26.0.0

20 Mar 19:03
@vvoland vvoland
v26.0.0
8b79278
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v26.0.0

26.0.0

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Security

This release contains a security fix for CVE-2024-29018, a potential data exfiltration from 'internal' networks via authoritative DNS servers.

New

  • Add Subpath field to the VolumeOptions making it possible to mount a subpath of a volume. moby/moby#45687
  • Add volume-subpath support to the mount flag (--mount type=volume,...,volume-subpath=<subpath>). docker/cli#4331
  • Accept = separators and [ipv6] in compose files for docker stack deploy. docker/cli#4860
  • rootless: Add support for enabling host loopback by setting the DOCKERD_ROOTLESS_ROOTLESSKIT_DISABLE_HOST_LOOPBACK environment variable to false (defaults to true). This lets containers connect to the host by using IP address 10.0.2.2. moby/moby#47352
  • containerd image store: docker image ls no longer creates duplicates entries for multi-platform images. moby/moby#45967
  • containerd image store: Send Prometheus metrics. moby/moby#47555

Bug fixes and enhancements

  • CVE-2024-29018: Do not forward requests to external DNS servers for a container that is only connected to an 'internal' network. Previously, requests were forwarded if the host's DNS server was running on a loopback address, like systemd's 127.0.0.53. moby/moby#47589
  • Ensure that a generated MAC address is not restored when a container is restarted, but a configured MAC address is preserved. moby/moby#47233

Warning

Containers created using Docker Engine 25.0.0 may have duplicate MAC addresses, they must be re-created.
Containers created using version 25.0.0 or 25.0.1 with user-defined MAC addresses will get generated MAC addresses when they are started using 25.0.2. They must also be re-created.

  • Always attempt to enable IPv6 on a container's loopback interface, and only include IPv6 in /etc/hosts if successful. moby/moby#47062

Note

By default, IPv6 will remain enabled on a container's loopback interface when the container is not connected to an IPv6-enabled network.
For example, containers that are only connected to an IPv4-only network now have the ::1 address on their loopback interface.

To disable IPv6 in a container,
use option --sysctl net.ipv6.conf.all.disable_ipv6=1 in the create or run command,
or the equivalent sysctls option in the service configuration section of a Compose file.

If IPv6 is not available in a container because it has been explicitly disabled for the container,
or the host's networking stack does not have IPv6 enabled (or for any other reason)
the container's /etc/hosts file will not include IPv6 entries.

  • Fix ADD Dockerfile instruction failing with lsetxattr <file>: operation not supported when unpacking archive with xattrs onto a filesystem that doesn't support them. moby/moby#47175
  • Fix docker container start failing when used with --checkpoint. moby/moby#47456
  • Restore IP connectivity between the host and containers on an internal bridge network. moby/moby#47356
  • Do not enforce new validation rules for existing swarm networks. moby/moby#47361
  • Restore DNS names for containers in the default "nat" network on Windows. moby/moby#47375
  • Print hint when invoking docker image ls with ambiguous argument. docker/cli#4849
  • Cleanup @docker_cli_[UUID] files on OpenBSD. docker/cli#4862
  • Add explicit deprecation notice message when using remote TCP connections without TLS. docker/cli#4928, moby/moby#47556
  • Use IPv6 nameservers from the host's resolv.conf as upstream resolvers for Docker Engine's internal DNS, rather than listing them in the container's resolv.conf. moby/moby#47512
  • containerd image store: Isolate images with different containerd namespaces when --userns-remap option is used. moby/moby#46786
  • containerd image store: Fix image pull not emitting Pulling fs layer status. moby/moby#47432

API

  • To preserve backwards compatibility, read-only mounts are not recursive by default when using older clients (API version < v1.44). moby/moby#47391
  • GET /images/{id}/json omits the Created field (previously it was 0001-01-01T00:00:00Z) if the Created field is missing from the image config. moby/moby#47451
  • Populate a missing Created field in GET /images/{id}/json with 0001-01-01T00:00:00Z for API version <= 1.43. moby/moby#47387
  • The is_automated field in the POST /images/search endpoint results is always false now. Consequently, searching for is-automated=true will yield no results, while is-automated=false will be a no-op. moby/moby#47465
  • Remove Container and ContainerConfig fields from the GET /images/{name}/json response. moby/moby#47430

Packaging updates

Removed

  • Remove Container and ContainerConfig fields from the GET /images/{name}/json response. moby/moby#47430
  • Deprecate the ability to accept remote TCP connections without TLS. Deprecation notice docker/cli#4928 moby/moby#47556.
  • Remove deprecated API versions (API < v1.24) moby/moby#47155
  • Disable pulling of deprecated image formats by default. These image formats are deprecated, and support will be removed in a future version. moby/moby#47459
  • image: remove deprecated IDFromDigest moby/moby#47198
  • Remove the deprecated github.com/docker/docker/pkg/loopback package. moby/moby#47128
  • pkg/system: remove deprecated ErrNotSupportedOperatingSystem, IsOSSupported moby/moby#47129
  • pkg/homedir: remove deprecated Key() and GetShortcutString() moby/moby#47130
  • pkg/containerfs: remove deprecated ResolveScopedPath moby/moby#47131
  • The daemon flag --oom-score-adjust was deprecated in v24.0 and is now removed. moby/moby#46113
  • Remove deprecated aliases from the api/types package. These types were deprecated in v25.0.0, which provided temporary aliases. moby/moby#47148
    These aliases are now removed: types.Info, types.Commit, types.PluginsInfo, types.NetworkAddressPool, types.Runtime, types.SecurityOpt, types.KeyValue, types.DecodeSecurityOptions, types.CheckpointCreateOptions, types.CheckpointListOptions, types.CheckpointDeleteOptions, types.Checkpoint, types.ImageDeleteResponseItem, types.ImageSummary, types.ImageMetadata, types.ServiceUpdateResponse, types.ServiceCreateResponse, `types.Resize...
Read more
Assets 2
0 Join discussion

v26.0.0-rc3

20 Mar 00:18
@vvoland vvoland
v26.0.0-rc3
330d777
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v26.0.0-rc3 Pre-release
Pre-release

26.0.0-rc3

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Security

This release contains a security fix for CVE-2024-29018, a potential data exfiltration from 'internal' networks via authoritative DNS servers.

New

Bug fixes and enhancements

  • CVE-2024-29018: Do not forward requests to external DNS servers for a container that is only connected to an 'internal' network. Previously, requests were forwarded if the host's DNS server was running on a loopback address, like systemd's 127.0.0.53. moby/moby#47589
  • containerd image store: Improve docker images performance. moby/moby#47580
  • Add explicit deprecation notice message when using remote TCP connections without TLS. Deprecation notice docker/cli#4928. moby/moby#47556
  • Use IPv6 nameservers from the host's resolv.conf as upstream resolvers for Docker Engine's internal DNS, rather than listing them in the container's resolv.conf. moby/moby#47512
  • rc2 regression: containerd image store: Fix image list not showing images when an image that has no locally available platforms is encountered.
  • rootless: fix open /etc/docker/plugins: permission denied moby/moby#47559
  • plugin: fix mounting /etc/hosts when running in UserNS moby/moby#47558

API

  • Remove Container and ContainerConfig fields from the GET /images/{name}/json response. moby/moby#47430

Packaging updates

Assets 2

v25.0.5

19 Mar 21:36
@vvoland vvoland
v25.0.5
e63daec
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v25.0.5

25.0.5

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Security

This release contains a security fix for CVE-2024-29018, a potential data exfiltration from 'internal' networks via authoritative DNS servers.

Bug fixes and enhancements

  • CVE-2024-29018: Do not forward requests to external DNS servers for a container that is only connected to an 'internal' network. Previously, requests were forwarded if the host's DNS server was running on a loopback address, like systemd's 127.0.0.53. moby/moby#47589
  • plugin: fix mounting /etc/hosts when running in UserNS. moby/moby#47588
  • rootless: fix open /etc/docker/plugins: permission denied. moby/moby#47587
  • Fix multiple parallel docker build runs leaking disk space. moby/moby#47527
Assets 2
0 Join discussion

v26.0.0-rc2

07 Mar 21:16
@vvoland vvoland
v26.0.0-rc2
f4c696e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v26.0.0-rc2 Pre-release
Pre-release

26.0.0-rc2

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

New

  • Allow to enable host loopback by setting DOCKERD_ROOTLESS_ROOTLESSKIT_DISABLE_HOST_LOOPBACK to false, defaults true. It allows to connect to host by using 10.0.2.2 IP moby/moby#47352

Bug fixes and enhancements

  • Fix multiple parallel docker build runs leaking disk space. moby/moby#47523
  • rc1 regression: Fix docker pull regression introduced in rc1 causing a wrong pull progress message moby/moby#47475
  • rc1 regression: Do not attempt to configure an IPv6 address or gateway in a container that's got IPv6 disabled.
  • rc1 regression: Fix build sometimes ending with ERROR: failed to solve: unknown blob <digest> in history. moby/moby#47520

API

  • The is_automated field in the POST /images/search endpoint results is always false now. Consequently, searching for is-automated=true will yield no results, while is-automated=false will be a no-op. moby/moby#47465

Packaging updates

Assets 2
0 Join discussion

v25.0.4

07 Mar 11:01
@vvoland vvoland
v25.0.4
061aa95
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v25.0.4

25.0.4

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug fixes and enhancements

  • Restore DNS names for containers in the default "nat" network on Windows. moby/moby#47490
  • Fix docker start failing when used with --checkpoint moby/moby#47466
  • Don't enforce new validation rules for existing swarm networks moby/moby#47482
  • Restore IP connectivity between the host and containers on an internal bridge network. moby/moby#47481
  • Fix a regression introduced in v25.0 that prevented the classic builder from ADDing a tar archive with xattrs created on a non-Linux OS moby/moby#47483
  • containerd image store: Fix image pull not emitting Pulling fs layer status moby/moby#47484

API

  • To preserve backwards compatibility, make read-only mounts not recursive by default when using older clients (API version < v1.44). moby/moby#47393
  • GET /images/{id}/json omits the Created field (previously it was 0001-01-01T00:00:00Z) if the Created field is missing from the image config. moby/moby#47451
  • Populate a missing Created field in GET /images/{id}/json with 0001-01-01T00:00:00Z for API version <= 1.43. moby/moby#47387
  • Fix a regression that caused API socket connection failures to report an API version negotiation failure instead. moby/moby#47470
  • Preserve supplied endpoint configuration in a container-create API request, when a container-wide MAC address is specified, but NetworkMode name-or-id is not the same as the name-or-id used in NetworkSettings.Networks. moby/moby#47510

Packaging updates

Full Changelog: v25.0.3...v25.0.4

Assets 2

v26.0.0-rc1

29 Feb 09:55
@vvoland vvoland
v26.0.0-rc1
81428bf
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v26.0.0-rc1 Pre-release
Pre-release

26.0.0-rc1

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

New

  • Add Subpath field to the VolumeOptions making it possible to mount a subpath of a volume. moby/moby#45687
  • Add volume-subpath option to mount flag (--mount type=volume,...,volume-subpath=<subpath>) docker/cli#4331
  • containerd image store: image list will no longer produce multiple duplicates image entries for multi-platform images moby/moby#45967
  • Accept = separators and [ipv6] in compose files for docker stack deploy docker/cli#4860

Bug fixes and enhancements

  • Fix ADD Dockerfile instruction failing with lsetxattr <file>: operation not supported when unpacking archive with xattrs onto a filesystem that doesn't support them. moby/moby#47175
  • Fix docker start failing when used with --checkpoint moby/moby#47456
  • Always try to enable IPv6 on a container's loopback interface, and only include IPv6 in '/etc/hosts' if successful. moby/moby#47062
  • Restore IP connectivity between the host and containers on an internal bridge network. moby/moby#47356
  • Do not enforce new validation rules for existing swarm networks moby/moby#47361
  • Restore DNS names for containers in the default "nat" network on Windows. moby/moby#47375
  • Print hint when invoking "docker images" with ambiguous argument docker/cli#4849
  • Cleanup @docker_cli_[UUID] files on OpenBSD docker/cli#4862
  • containerd image store: Isolate images with different containerd namespaces when --userns-remap option is used moby/moby#46786
  • containerd image store: Fix image pull not emitting Pulling fs layer status moby/moby#47432
  • Ensure that a generated MAC address is not restored when a container is restarted, but a configured MAC address is preserved. moby/moby#47233

Note

Containers created using 25.0.0 may have duplicate MAC addresses, they must be re-created.
Containers created using 25.0.0 or 25.0.1 with user-defined MAC addresses will get generated MAC addresses when they are started using 25.0.2. They must also be re-created.

API

  • To preserve backwards compatibility, read-only mounts are not recursive by default when using older clients (API version < v1.44). moby/moby#47391
  • GET /images/{id}/json omits the Created field (previously it was 0001-01-01T00:00:00Z) if the Created field is missing from the image config. moby/moby#47451
  • Populate a missing Created field in GET /images/{id}/json with 0001-01-01T00:00:00Z for API version <= 1.43. moby/moby#47387

Packaging updates

Removed

  • Disable pulling of deprecated image formats by default. These image formats are deprecated, and support will be removed in a future version. moby/moby#47459
  • image: remove deprecated IDFromDigest moby/moby#47198
  • Removed the deprecated github.com/docker/docker/pkg/loopback package. moby/moby#47128
  • pkg/system: remove deprecated ErrNotSupportedOperatingSystem, IsOSSupported moby/moby#47129
  • pkg/homedir: remove deprecated Key() and GetShortcutString() moby/moby#47130
  • pkg/containerfs: remove deprecated ResolveScopedPath moby/moby#47131
  • The daemon flag --oom-score-adjust has been deprecated in v24.0 and is now removed. moby/moby#46113
  • API: remove deprecated API versions (API < v1.24) moby/moby#47155
  • Remove deprecated aliases from the api/types package. These types were deprecated in v25.0.0, which provided temporary aliases. moby/moby#47148
    These aliases are now removed: types.Info, types.Commit, types.PluginsInfo, types.NetworkAddressPool, types.Runtime, types.SecurityOpt, types.KeyValue, types.DecodeSecurityOptions, types.CheckpointCreateOptions, types.CheckpointListOptions, types.CheckpointDeleteOptions, types.Checkpoint, types.ImageDeleteResponseItem, types.ImageSummary, types.ImageMetadata, types.ServiceUpdateResponse, types.ServiceCreateResponse, types.ResizeOptions, types.ContainerAttachOptions, types.ContainerCommitOptions, types.ContainerRemoveOptions, types.ContainerStartOptions, types.ContainerListOptions, types.ContainerLogsOptions
  • cli/command/container: remove deprecated NewStartOptions() docker/cli#4811
  • cli/command: remove deprecated DockerCliOption, InitializeOptdocker/cli#4810
Assets 2
0 Join discussion