publish updates from main

_vendor/modules.txt

@@ -1,6 +1,6 @@
 # github.com/moby/moby v28.0.0+incompatible
 # github.com/moby/buildkit v0.20.0
-# github.com/docker/buildx v0.21.0
+# github.com/docker/buildx v0.21.1
 # github.com/docker/cli v28.0.0+incompatible
 # github.com/docker/compose/v2 v2.33.0
 # github.com/docker/scout-cli v1.15.0

content/manuals/build/buildkit/dockerfile-release-notes.md

@@ -13,6 +13,34 @@ issues, and bug fixes in [Dockerfile reference](/reference/dockerfile.md).
 
 For usage, see the [Dockerfile frontend syntax](frontend.md) page.
 
+## 1.14.0
+
+{{< release-date date="2025-02-19" >}}
+
+The full release note for this release is available
+[on GitHub](https://github.com/moby/buildkit/releases/tag/dockerfile%2F1.14.0).
+
+```dockerfile
+# syntax=docker/dockerfile:1.14.0
+```
+
+- `COPY --chmod` now allows non-octal values. This feature was previously in the labs channel and is now available in the main release. [moby/buildkit#5734](https://github.com/moby/buildkit/pull/5734)
+- Fix handling of OSVersion platform property if one is set by the base image [moby/buildkit#5714](https://github.com/moby/buildkit/pull/5714)
+- Fix errors where a named context metadata could be resolved even if it was not reachable by the current build configuration, leading to build errors [moby/buildkit#5688](https://github.com/moby/buildkit/pull/5688)
+
+## 1.14.0-labs
+
+{{< release-date date="2025-02-19" >}}
+
+The full release note for this release is available
+[on GitHub](https://github.com/moby/buildkit/releases/tag/dockerfile%2F1.14.0-labs).
+
+```dockerfile
+# syntax=docker.io/docker/dockerfile-upstream:1.14.0-labs
+```
+
+- New `RUN --device=name,[required]` flag lets builds request CDI devices are available to the build step. Requires BuildKit v0.20.0+ [moby/buildkit#4056](https://github.com/moby/buildkit/pull/4056), [moby/buildkit#5738](https://github.com/moby/buildkit/pull/5738)
+
 ## 1.13.0
 
 {{< release-date date="2025-01-20" >}}

content/manuals/build/cache/backends/gha.md

@@ -31,8 +31,9 @@ The following table describes the available CSV parameters that you can pass to
 `--cache-to` and `--cache-from`.
 
 | Name           | Option                  | Type        | Default                  | Description                                                          |
-| -------------- | ----------------------- | ----------- | ------------------------ | -------------------------------------------------------------------- |
+|----------------|-------------------------|-------------|--------------------------|----------------------------------------------------------------------|
 | `url`          | `cache-to`,`cache-from` | String      | `$ACTIONS_CACHE_URL`     | Cache server URL, see [authentication][1].                           |
+| `url_v2`       | `cache-to`,`cache-from` | String      | `$ACTIONS_CACHE_URL`     | Cache v2 server URL, see [authentication][1].                        |
 | `token`        | `cache-to`,`cache-from` | String      | `$ACTIONS_RUNTIME_TOKEN` | Access token, see [authentication][1].                               |
 | `scope`        | `cache-to`,`cache-from` | String      | `buildkit`               | Which scope cache object belongs to, see [scope][2]                  |
 | `mode`         | `cache-to`              | `min`,`max` | `min`                    | Cache layers to export, see [cache mode][3].                         |
@@ -47,10 +48,10 @@ The following table describes the available CSV parameters that you can pass to
 
 ## Authentication
 
-If the `url` or `token` parameters are left unspecified, the `gha` cache backend
-will fall back to using environment variables. If you invoke the `docker buildx`
-command manually from an inline step, then the variables must be manually
-exposed. Consider using the
+If the `url`, `url_v2` or `token` parameters are left unspecified, the `gha`
+cache backend will fall back to using environment variables. If you invoke the
+`docker buildx` command manually from an inline step, then the variables must
+be manually exposed. Consider using the
 [`crazy-max/ghaction-github-runtime`](https://github.com/crazy-max/ghaction-github-runtime),
 GitHub Action as a helper for exposing the variables.
 

content/manuals/build/release-notes.md

@@ -10,6 +10,34 @@ toc_max: 2
 This page contains information about the new features, improvements, and bug
 fixes in [Docker Buildx](https://github.com/docker/buildx).
 
+## 0.21.0
+
+{{< release-date date="2025-02-19" >}}
+
+The full release note for this release is available
+[on GitHub](https://github.com/docker/buildx/releases/tag/v0.21.0).
+
+### New
+
+- New command `buildx history trace` lets you inspect traces of a build in a Jaeger UI-based viewer and compare one trace with another. [docker/buildx#2904](https://github.com/docker/buildx/pull/2904)
+
+### Enhancements
+
+- The history inspection command `buildx history inspect` now supports custom formatting with `--format` flag and JSON formatting for machine-readable output. [docker/buildx#2964](https://github.com/docker/buildx/pull/2964) 
+- Support for CDI device entitlement in build and bake. [docker/buildx#2994](https://github.com/docker/buildx/pull/2994)
+- Supported CDI devices are now shown in the builder inspection. [docker/buildx#2983](https://github.com/docker/buildx/pull/2983)
+- When using [GitHub Cache backend `type=gha`](cache/backends/gha.md), the URL for the Version 2 or API is now read from the environment and sent to BuildKit. Version 2 backend requires BuildKit v0.20.0 or later. [docker/buildx#2983](https://github.com/docker/buildx/pull/2983), [docker/buildx#3001](https://github.com/docker/buildx/pull/3001)
+
+### Bug fixes
+
+- Avoid unnecessary warnings and prompts when using `--progress=rawjson`. [docker/buildx#2957](https://github.com/docker/buildx/pull/2957)
+- Fix regression with debug shell sometimes not working correctly on `--on=error`. [docker/buildx#2958](https://github.com/docker/buildx/pull/2958)
+- Fix possible panic errors when using an unknown variable in the Bake definition. [docker/buildx#2960](https://github.com/docker/buildx/pull/2960)
+- Fix invalid duplicate output on JSON format formatting of `buildx ls` command. [docker/buildx#2970](https://github.com/docker/buildx/pull/2970)
+- Fix bake handling cache imports with CSV string containing multiple registry references. [docker/buildx#2944](https://github.com/docker/buildx/pull/2944)
+- Fix issue where error from pulling BuildKit image could be ignored. [docker/buildx#2988](https://github.com/docker/buildx/pull/2988)
+- Fix race on pausing progress on debug shell. [docker/buildx#3003](https://github.com/docker/buildx/pull/3003)
+
 ## 0.20.1
 
 {{< release-date date="2025-01-23" >}}

content/manuals/security/for-admins/hardened-desktop/enhanced-container-isolation/_index.md

@@ -51,9 +51,9 @@ For more information on how Enhanced Container Isolation work, see [How does it
 
 > [!IMPORTANT]
 >
-> Enhanced Container Isolation does not yet fully protect Docker builds,
-> Kubernetes pods and Extension containers. For more information on known
-> limitations and workarounds, see [FAQs](faq.md).
+> ECI protection for Docker builds and [Kubernetes in Docker Desktop](/manuals/desktop/features/kubernetes.md) varies according to the
+> Docker Desktop version. Later versions include more protection than earlier versions. Also, ECI does not yet
+> protect extension containers. For more information on known limitations and workarounds, see [FAQs](faq.md).
 
 ## How do I enable Enhanced Container Isolation?
 

content/reference/api/engine/_index.md

@@ -73,23 +73,22 @@ To see the highest version of the API your Docker daemon and client support, use
 ```console
 $ docker version
 Client: Docker Engine - Community
- Version:           27.4.0
- API version:       1.47
- Go version:        go1.22.10
- Git commit:        bde2b89
- Built:             Sat Dec  7 10:38:33 2024
+ Version:           28.0.0
+ API version:       1.48
+ Go version:        go1.23.6
+ Git commit:        f9ced58
+ Built:             Wed Feb 19 22:11:04 2025
  OS/Arch:           linux/amd64
  Context:           default
 
 Server: Docker Engine - Community
  Engine:
-  Version:          27.4.0
-  API version:      1.47 (minimum version 1.24)
-  Go version:       go1.22.10
-  Git commit:       92a8393
-  Built:            Sat Dec  7 10:38:33 2024
+  Version:          28.0.0
+  API version:      1.48 (minimum version 1.24)
+  Go version:       go1.23.6
+  Git commit:       af898ab
+  Built:            Wed Feb 19 22:11:04 2025
   OS/Arch:          linux/amd64
-  Experimental:     false
   ...
 ```
 
@@ -131,8 +130,10 @@ You can specify the API version to use in any of the following ways:
 
 ### API version matrix
 
-| Docker version | Maximum API version        | Change log                                                                   |
-|:---------------|:---------------------------|:-----------------------------------------------------------------------------|
+| Docker version | Maximum API version                          | Change log                                                         |
+|:---------------|:---------------------------------------------|:-------------------------------------------------------------------|
+| 28.0           | [1.48](/reference/api/engine/version/v1.48/) | [changes](/reference/api/engine/version-history/#v148-api-changes) |
+| 27.5           | [1.47](/reference/api/engine/version/v1.47/) | [changes](/reference/api/engine/version-history/#v147-api-changes) |
 | 27.4           | [1.47](/reference/api/engine/version/v1.47/) | [changes](/reference/api/engine/version-history/#v147-api-changes) |
 | 27.3           | [1.47](/reference/api/engine/version/v1.47/) | [changes](/reference/api/engine/version-history/#v147-api-changes) |
 | 27.2           | [1.47](/reference/api/engine/version/v1.47/) | [changes](/reference/api/engine/version-history/#v147-api-changes) |

go.mod

@@ -3,7 +3,7 @@ module github.com/docker/docs
 go 1.23.1
 
 require (
-	github.com/docker/buildx v0.21.0 // indirect
+	github.com/docker/buildx v0.21.1 // indirect
 	github.com/docker/cli v28.0.0+incompatible // indirect
 	github.com/docker/compose/v2 v2.33.0 // indirect
 	github.com/docker/scout-cli v1.15.0 // indirect
@@ -12,7 +12,7 @@ require (
 )
 
 replace (
-	github.com/docker/buildx => github.com/docker/buildx v0.21.0
+	github.com/docker/buildx => github.com/docker/buildx v0.21.1
 	github.com/docker/cli => github.com/docker/cli v28.0.0+incompatible
 	github.com/docker/compose/v2 => github.com/docker/compose/v2 v2.32.4
 	github.com/docker/scout-cli => github.com/docker/scout-cli v1.15.0

go.sum

@@ -94,6 +94,8 @@ github.com/docker/buildx v0.20.1 h1:q88EfoYwrWEKVqNb9stOFq8fUlFp/OPlDcFE+QUYZBM=
 github.com/docker/buildx v0.20.1/go.mod h1:VVi4Nvo4jd/IkRvwyExbIyW7u82fivK61MRx5I0oKic=
 github.com/docker/buildx v0.21.0 h1:cp++wh60cjMraq8VXM59jV1aolR3eFIkCx1Z7o5Q2ZY=
 github.com/docker/buildx v0.21.0/go.mod h1:8V4UMnlKsaGYwz83BygmIbJIFEAYGHT6KAv8akDZmqo=
+github.com/docker/buildx v0.21.1 h1:YjV2k6CsSDbkDTOMsjARUIrj2xv+zZR+M2dtrRyzXhg=
+github.com/docker/buildx v0.21.1/go.mod h1:8V4UMnlKsaGYwz83BygmIbJIFEAYGHT6KAv8akDZmqo=
 github.com/docker/cli v24.0.2+incompatible h1:QdqR7znue1mtkXIJ+ruQMGQhpw2JzMJLRXp6zpzF6tM=
 github.com/docker/cli v24.0.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/cli v24.0.4+incompatible h1:Y3bYF9ekNTm2VFz5U/0BlMdJy73D+Y1iAAZ8l63Ydzw=