29.3.1

The following list of components are included with this Toolbox2docker release. If you have a previously installed version of Toolbox2docker, these installers will update the components to these versions.

NOTE: you will have to uninstall any depreciated version of Docker Toolbox as under Windows the install path will change.
Due to the system requirements for go lang, Toolbox2docker only supports macOS 12+ and Windows 10+ as the docker components are now built with go lang 1.25.x.

Included Components:

docker 29.3.1
https://docs.docker.com/engine/release-notes/

CVE-2026-34040 Fix an authorization bypass in AuthZ plugins that could allow authorization plugins to be bypassed under specific conditions. GHSA-x744-4wpc-v9h2

CVE-2026-33997 Fix a flaw in docker plugin install where privilege validation could be partially bypassed, potentially leading to unauthorized privilege escalation. GHSA-pxq6-2prw-chj9

CVE-2026-33748 Fix insufficient validation of Git URL #ref:subdir fragments in BuildKit, which could allow access to files outside the intended repository scope. GHSA-4vrq-3vrq-g6gg

CVE-2026-33747 Fix a vulnerability in BuildKit where an untrusted frontend could cause files to be written outside the BuildKit state directory. GHSA-3c29-8rgm-jvjj

docker-machine 0.16.2-gitlab.43.t2d.22 https://github.com/kaosagnt/docker-machine
docker-machine has now been patched to pull the boot2docker-xfs-ng ISO from the kaosagnt/boot2docker-xfs-ng repository.

This version of docker-machine contains all patches from the GitLab fork and contains other fixes on top. It will continue to pull in patches from GitLab.

docker compose plugin 5.1.1
docker buildx plugin 0.32.1
Boot2Docker-xfs-ng ISO 29.3.1
VirtualBox 7.2.6 macOS
VirtualBox 7.1.14 Windows

Kitematic has been removed from the installer.
docker-compose 1.29.x has been removed from the installer.

SHA256(Toolbox2docker-29.3.1.pkg)= 1958067fa3d5eb20c0663d3741960d636ea5a05a8e03e8e47a4065b20bd46279
SHA256(Toolbox2docker-29.3.1.exe)= 8c65c760b485ef7fcb78de87df14037b637ba971e17039b132d628f6e927f1ce