This repository was archived by the owner on Oct 7, 2025. It is now read-only.
chore(deps): update dependency docker to v27 #287
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v26.1.4->v27.1.1Release Notes
moby/moby (docker)
v27.1.1Compare Source
27.1.1
Security
This release contains a fix for CVE-2024-41110 / GHSA-v23v-6jw2-98fq
that impacted setups using authorization plugins (AuthZ)
for access control. No other changes are included in this release, and this
release is otherwise identical for users not using AuthZ plugins.
Packaging updates
Full Changelog: moby/moby@v27.1.0...v27.1.1
v27.1.0Compare Source
27.1.0
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Bug fixes and enhancements
Requires=dbus.socketto prevent errors when starting the daemon on a cgroup v2 host with systemd moby/moby#48141image tagevent is now properly emitted when building images with BuildKit moby/moby#48182docker image rm,docker image history, anddocker image inspectmoby/moby#5261docker service createanddocker stackdocker/cli#5274DOCKER_CUSTOM_HEADERSenvironment variable (experimental) docker/cli#5271docker pushdefaulting the--platformflag to a value ofDOCKER_DEFAULT_PLATFORMenvironment variable on unsupported API versions docker/cli#5248loginprompt docker/cli#5260Deprecated
pkg/rootless/specconvpackage is deprecated, and will be removed in the next release moby/moby#48185pkg/containerfspackage is deprecated, and will be removed in the next release moby/moby#48185pkg/directorypackage is deprecated, and will be removed in the next release moby/moby#48185api/types/system: remove deprecatedInfo.ExecutionDrivermoby/moby#48184Packaging updates
Full Changelog: moby/moby@v27.0.3...v27.1.0
v27.0.3Compare Source
27.0.3
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Bug fixes and enhancements
v27.0.2Compare Source
27.0.2
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Bug fixes and enhancements
Removed
ContainerJSONBase.Nodefield andContainerNodetype. These definitions were used by the standalone ("classic") Swarm API, but never implemented in the Docker Engine itself. moby/moby#48055v27.0.1Compare Source
27.0.1
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
New
--platformflag todocker image pushand improve the default behavior when not all platforms of the multi-platform image are available locally. docker/cli#4984, moby/moby#47679docker stack deployfordriver_optsin a service's networks. docker/cli#5125/usr/local/libexecand/usr/libexecpaths when looking up the userland proxy binaries by a name with adocker-prefix. moby/moby#47804Bug fixes and enhancements
*client.Clientinstances are now always safe for concurrent use by multiple goroutines. Previously, this could lead to data races when theWithAPIVersionNegotiation()option is used. moby/moby#47961$TMPDIRin some cases. docker/cli#5146--privileged. moby/moby#47500StartIntervaldefault value of healthcheck to reflect the documented value of 5s. moby/moby#47799docker saveanddocker loadnot ending on the daemon side when the operation was cancelled by the user, for example with Ctrl+C. moby/moby#47629StartedAtproperty of containers is now recorded before container startup, guaranteeing that theStartedAtis always beforeFinishedAt. moby/moby#47003nslookupto resolve external hostnames. This behaviour can be disabled viadaemon.json, using"features": { "windows-dns-proxy": false }. The configuration option will be removed in a future release. moby/moby#47826Networking
For example, on the command line in a
docker runcommand,--network mynet --sysctl net.ipv4.conf.eth0.log_martians=1will be rejected.Instead, you must use
--network name=mynet,driver-opt=com.docker.network.endpoint.sysctls=net.ipv4.conf.IFNAME.log_martians=1.IPv6
ip6tablesis no longer experimental. You may remove theexperimentalconfiguration option and continue to use IPv6, if it is not required by any other features.ip6tablesis now enabled for Linux bridge networks by default. moby/moby#47747ip6tablesenabled (new default).ip6tables, this is likely a breaking change. Only published container ports (-por--publish) are accessible from outside the Docker bridge network, and outgoing connections masquerade as the host.ip6tablesat all, set"ip6tables": falseindaemon.json, or use the CLI option--ip6tables=false. Alternatively, leaveip6tablesenabled, publish ports, and enable direct routing.ip6tablesenabled, ifip6tablesis not functional on your host, Docker Engine will start but it will not be possible to create an IPv6-enabled network.IPv6 network configuration improvements
default-address-poolsif this parameter wasn't manually configured, or if it contains no IPv6 prefixes. moby/moby#47853--subnetoption to specify an IPv6 subnet, or add IPv6 ranges todefault-address-poolsindaemon.json.--ipv6and no IPv6 subnet is defined by those options, an IPv6 Unique Local Address (ULA) base prefix is used.default-address-pools. moby/moby#47768"default-network-opts": { "bridge": {"com.docker.network.enable_ipv6": "true"}}indaemon.json, ordockerd --default-network-opt=bridge=com.docker.network.enable_ipv6=trueon the comand line. moby/moby#47867ip6tablesenabled. moby/moby#47871com.docker.network.bridge.gateway_mode_ipv6=<nat|routed>.nat, is unchanged from previous releases running withip6tablesenabled. NAT and masquerading rules are set up for each published container port.routed, no NAT or masquerading rules are configured for published ports. This enables direct IPv6 access to the container, if the host's network can route packets for the container's address to the host. Published ports will be opened in the container's firewall.routedmode, only addresses0.0.0.0or::are allowed and a host port must not be given.natorroutedmode, are accessible from any remote address if routing is set up in the network, unless the Docker host's firewall has additional restrictions. For example:docker network create --ipv6 -o com.docker.network.bridge.gateway_mode_ipv6=routed mynet.com.docker.network.bridge.gateway_mode_ipv4=<nat|routed>is also available, with the same behavior but for IPv4.docker-forwardingto allow forwarding from any zone to thedockerzone. This makes it possible to configure a bridge network with a routable IPv6 address, and no NAT or masquerading. moby/moby#47745-p 80will result in the same ephemeral port being allocated for0.0.0.0and::, and-p 8080-8083:80will pick the same port from the range for both address families.-p 127.0.0.1::80 -p '[::1]::80'.DOCKER_ALLOW_IPV6_ON_IPV4_INTERFACE, introduced in release 26.1.1, no longer has any effect. moby/moby#47963/proc/sys/net, the environment variable allowed the container to start anyway.--ipv6when creating it. Other workarounds are to configure the OS to disable IPv6 by default on new interfaces, mount/proc/sys/netread-write, or use a kernel with no IPv6 support.fe80::1. moby/moby#47787Removed
NewTempArchiveandTempArchive. These types were only used in tests and will be removed in the next release. moby/moby#48002CanonicalTarNameForPathmoby/moby#48001pkg/stringid.ValidateIDandpkg/stringid.IsShortIDmoby/moby#47995SetDefaultNetModeIfBlankand moveContainerConfigWrappertoapi/types/containermoby/moby#48007DefaultDaemonNetworkModeand move todaemon/networkmoby/moby#48008opts.ConvertKVStringsToMap. This utility is no longer used, and will be removed in the next release. moby/moby#48016IsPreDefinedNetwork. moby/moby#48011API
POST /images/{name}/pushnow supports aplatformparameter (JSON encoded OCI Platform type) that allows selecting a specific platform-manifest from the multi-platform image. This is experimental and may change in future API versions. moby/moby#47679POST /services/createandPOST /services/{id}/updatenow supportOomScoreAdj. moby/moby#47950ContainerListapi returns container annotations. moby/moby#47866POST /containers/createandPOST /services/createnow takeOptionsas part ofHostConfig.Mounts.TmpfsOptionsallowing to set options for tmpfs mounts. moby/moby#46809Healthcheck.StartIntervalproperty is now correctly ignored when updating a Swarm service using API versions less than v1.44. moby/moby#47991GET /eventsnow supports imagecreateevent that is emitted when a new image is built regardless if it was tagged or not. moby/moby#47929GET /infonow includes aContainerdfield containing information about the location of the containerd API socket and containerd namespaces used by the daemon to run containers and plugins. moby/moby#47239Configfield returned by this endpoint (used fordocker image inspect) returned additional fields that are not part of the image's configuration and not part of the Docker Image Spec and the OCI Image Spec. These fields are never set (and always return the default value for the type), but are not omitted in the response when left empty. As these fields were not intended to be part of the image configuration response, they are deprecated, and will be removed in the future API versions.--api-cors-headerand the correspondingdaemon.jsonconfiguration option. These will be removed in the next major release. moby/moby#45313The following deprecated fields are currently included in the API response, but are not part of the underlying image's
Config: moby/moby#47941HostnameDomainnameAttachStdinAttachStdoutAttachStderrTtyOpenStdinStdinOnceImageNetworkDisabled(already omitted unless set)MacAddress(already omitted unless set)StopTimeout(already omitted unless set)Go SDK changes
Client API callback for the following functions now require a context parameter. moby/moby#47536
client.RequestPrivilegeFuncclient.ImageSearchOptions.AcceptPermissionsFuncimage.ImportOptions.PrivilegeFuncRemove deprecated aliases for Image types. moby/moby#47900
ImageImportOptionsImageCreateOptionsImagePullOptionsImagePushOptionsImageListOptionsImageRemoveOptionsIntroduce
Ulimittype alias forgithub.com/docker/go-units.Ulimit.The
Ulimittype as used in the API is defined in a Go module that will transition to a new location in future.A type alias is added to reduce the friction that comes with moving the type to a new location.
The alias makes sure that existing code continues to work, but its definition may change in future.
Users are recommended to use this alias instead of the
units.Ulimitdirectly. moby/moby#48023Move and rename types, changing their import paths and exported names. moby/moby#47936, moby/moby#47873, moby/moby#47887, moby/moby#47882, moby/moby#47921, moby/moby#48040:
api/types/container:BlkioStatEntryBlkioStatsCPUStatsCPUUsageContainerExecInspectContainerPathStatContainerStatsContainersPruneReportCopyToContainerOptionsExecConfigExecStartCheckMemoryStatsNetworkStatsPidsStatsStatsJSONStatsStorageStatsThrottlingDataapi/types/image:ImagesPruneReportImageImportSourceImageLoadResponseExecStartOptionstype toapi/types/backend.VolumesPruneReporttype toapi/types/volume.EventsOptionstype toapi/types/events.ImageSearchOptionstype toapi/types/registry.Networkprefix and move the following types toapi/types/network:NetworkCreateResponseNetworkConnectNetworkDisconnectNetworkInspectOptionsEndpointResourceNetworkListOptionsNetworkCreateOptionsNetworkCreateRequestNetworksPruneReportNetworkResourcetoapi/types/network.Packaging updates
v26.1.5Compare Source
26.1.5
Security
This release contains a fix for CVE-2024-41110 / GHSA-v23v-6jw2-98fq
that impacted setups using authorization plugins (AuthZ)
for access control. No other changes are included in this release, and this
release is otherwise identical for users not using AuthZ plugins.
Full Changelog: moby/moby@v26.1.4...v26.1.5
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.