Skip to content

Update docker Docker tag to v25

GitLab Dependency Bot requested to merge gitlab-renovate-forks/CNG:renovate/docker-25.x into master

This MR contains the following updates:

Package Update Change
docker major 23.0.6 -> 25.0.3

MR created with the help of gitlab-org/frontend/renovate-gitlab-bot

Release Notes

moby/moby

v25.0.3

Compare Source

25.0.3

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

What's Changed

Full Changelog: https://github.com/moby/moby/compare/v25.0.2...v25.0.3

v25.0.2

Compare Source

25.0.2

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Security

This release contains security fixes for the following CVEs affecting Docker Engine and its components.

CVE Component Fix version Severity
CVE-2024-21626 runc 1.1.12 High, CVSS 8.6
CVE-2024-23651 BuildKit 1.12.5 High, CVSS 8.7
CVE-2024-23652 BuildKit 1.12.5 High, CVSS 8.7
CVE-2024-23653 BuildKit 1.12.5 High, CVSS 7.7
CVE-2024-23650 BuildKit 1.12.5 Medium, CVSS 5.5
CVE-2024-24557 Docker Engine 25.0.2 Medium, CVSS 6.9

The potential impacts of the above vulnerabilities include:

  • Unauthorized access to the host filesystem
  • Compromising the integrity of the build cache
  • In the case of CVE-2024-21626, a scenario that could lead to full container escape

For more information about the security issues addressed in this release, refer to the blog post. For details about each vulnerability, see the relevant security advisory:

Packaging updates

v25.0.1

Compare Source

25.0.1

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug fixes and enhancements
  • API: Fix incorrect HTTP status code for containers with an invalid network configuration created before upgrading to Docker Engine v25.0. moby/moby#​47159
  • Ensure that a MAC address based on a container's IP address is re-generated when the container is stopped and restarted, in case the generated IP/MAC addresses have been reused. moby/moby#​47171
  • Fix host-gateway-ip not working during build when not set through configuration. moby/moby#​47192
  • Fix a bug that prevented a container from being renamed twice. moby/moby#​47196
  • Fix an issue causing containers to have their short ID added to their network alias when inspecting them. moby/moby#​47182
  • Fix an issue in detecting whether a remote build context is a Git repository. moby/moby#​47136
  • Fix an issue with layers order in OCI manifests. moby/moby#​47150
  • Fix volume mount error when passing an addr or ip mount option. moby/moby#​47185
  • Improve error message related to extended attributes that can't be set due to improperly namespaced attribute names. moby/moby#​47178
  • Swarm: Fixed start_interval not being passed to the container config. moby/moby#​47163
Packaging updates

v25.0.0

Compare Source

25.0.0

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

New
Bug fixes and enhancements
  • API: Fix error message for invalid policies at ValidateRestartPolicy. moby/moby#​46352
  • API: Update /info endpoint to use singleflight. moby/moby#​45847
  • Add an error message for when specifying a Dockerfile filename with -f, and also using stdin. docker/cli#​4346
  • Add support for mac-address and link-local-ip fields in --network long format. docker/cli#​4419
  • Add support for specifying multiple --network flags with docker container create and docker run. moby/moby#​45906
  • Automatically enable IPv6 on a network when an IPv6 subnet is specified. moby/moby#​46455
  • Add support for overlay networks over IPv6 transport. moby/moby#​46790
  • Configuration reloading is now more robust: if there's an error during the configuration reload process, no configuration changes are applied. moby/moby#​43980
  • Live restore: Containers with auto remove (docker run --rm) are no longer forcibly removed on engine restart. moby/moby#​46857
  • Live restore: containers that are live-restored will now be given another health-check start period when the daemon restarts. moby/moby#​47051
  • Container health status is flushed to disk less frequently, reducing wear on flash storage. moby/moby#​47044
  • Ensure network names are unique. moby/moby#​46251
  • Ensure that overlay2 layer metadata is correct. moby/moby#​46471
  • Fix Downloading progress message on image pull. moby/moby#​46515
  • Fix NetworkConnect and ContainerCreate with improved data validation, and return all validation errors at once. moby/moby#​46183
  • Fix com.docker.network.host_ipv4 option when IPv6 and ip6tables are enabled. moby/moby#​46446
  • Fix daemon's cleanupContainer if containerd is stopped. moby/moby#​46213
  • Fix returning incorrect HTTP status codes for libnetwork errors. moby/moby#​46146
  • Fix various issues with images/json API filters and image list. moby/moby#​46034
  • CIFS volumes now resolves FQDN correctly. moby/moby#​46863
  • Improve validation of the userland-proxy-path daemon configuration option. Validation now happens during daemon startup, instead of producing an error when starting a container with port-mapping. moby/moby#​47000
  • Set the MAC address of container's interface when network mode is a short network ID. moby/moby#​46406
  • Sort unconsumed build arguments before display in build output. moby/moby#​45917
  • The docker image save tarball output is now OCI compliant. moby/moby#​44598
  • The daemon no longer appends ACCEPT rules to the end of the INPUT iptables chain for encrypted overlay networks. Depending on firewall configuration, a rule may be needed to permit incoming encrypted overlay network traffic. moby/moby#​45280
  • Unpacking layers with extended attributes onto an incompatible filesystem will now fail instead of silently discarding extended attributes. moby/moby#​45464
  • Update daemon MTU option to BridgeConfig and display warning on Windows. moby/moby#​45887
  • Validate IPAM config when creating a network. Automatically fix networks created prior to this release where --ip-range is larger than --subnet. moby/moby#​45759
  • containerd image store: Add image events for push, pull, and save. moby/moby#​46405
  • containerd image store: Add support for pulling legacy schema1 images. moby/moby#​46513
  • containerd image store: Add support for pushing all tags. moby/moby#​46485
  • containerd image store: Add support for registry token. moby/moby#​46475
  • containerd image store: Add support for showing the number of containers that use an image. moby/moby#​46511
  • containerd image store: Fix a bug related to the ONBUILD, MAINTAINER, and HEALTHCHECK Dockerfile instructions. moby/moby#​46313
  • containerd image store: Fix Pulling from progress message. moby/moby#​46494
  • containerd image store: Add support for referencing images via the truncated ID with sha256: prefix. moby/moby#​46435
  • containerd image store: Fix docker images showing intermediate layers by default. moby/moby#​46423
  • containerd image store: Fix checking if the specified platform exists when getting an image. moby/moby#​46495
  • containerd image store: Fix errors when multiple ADD or COPY instructions were used with the classic builder. moby/moby#​46383
  • containerd image store: Fix stack overflow errors when importing an image. moby/moby#​46418
  • containerd image store: Improve docker pull progress output. moby/moby#​46412
  • containerd image store: Print the tag, digest, and size after pushing an image. moby/moby#​46384
  • containerd image store: Remove panic from UpdateConfig. moby/moby#​46433
  • containerd image store: Return an error when an image tag resembles a digest. moby/moby#​46492
  • containerd image store: docker image ls now shows the correct image creation time and date. moby/moby#​46719
  • containerd image store: Fix an issue handling user namespace settings. moby/moby#​46375
  • containerd image store: Add support for pulling all tags (docker pull -a). moby/moby#​46618
  • containerd image store: Use the domain name in the image reference as the default registry authentication domain. moby/moby#​46779
Packaging updates
Removed
Deprecated
  • Deprecate API versions older than 1.24. Deprecation notice
  • Deprecate IsAutomated field and is-automated filter for docker search. Deprecation notice
  • API: Deprecate Container and ContainerConfig properties for /images/{id}/json (docker image inspect). moby/moby#​46939

v24.0.9

Compare Source

24.0.9

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Security

This release contains security fixes for the following CVEs affecting Docker Engine and its components.

CVE Component Fix version Severity
CVE-2024-21626 runc 1.1.12 High, CVSS 8.6
CVE-2024-24557 Docker Engine 24.0.9 Medium, CVSS 6.9

Important ⚠️

Note that this release of Docker Engine doesn't include fixes for the following known vulnerabilities in BuildKit:

To address these vulnerabilities, upgrade to Docker Engine v25.0.2.

For more information about the security issues addressed in this release, and the unaddressed vulnerabilities in BuildKit, refer to the blog post. For details about each vulnerability, see the relevant security advisory:

Packaging updates

v24.0.8

Compare Source

24.0.8

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug fixes and enhancements
  • Live restore: Containers with auto remove (docker run --rm) are no longer forcibly removed on engine restart. moby/moby#​46857
Packaging updates

v24.0.7

Compare Source

24.0.7

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug fixes and enhancements
  • Write overlay2 layer metadata atomically. moby/moby#​46703
  • Fix "Rootful-in-Rootless" Docker-in-Docker on systemd version 250 and later. moby/moby#​46626
  • Fix dockerd-rootless-setuptools.sh when username contains a backslash. moby/moby#​46407
  • Fix a bug that would prevent network sandboxes to be fully deleted when stopping containers with no network attachments and when dockerd --bridge=none is used. moby/moby#​46702
  • Fix a bug where cancelling an API request could interrupt container restart. moby/moby#​46697
  • Fix an issue where containers would fail to start when providing --ip-range with a range larger than the subnet. docker/for-mac#​6870
  • Fix data corruption with zstd output. moby/moby#​46709
  • Fix the conditions under which the container's MAC address is applied. moby/moby#​46478
  • Improve the performance of the stats collector. moby/moby#​46448
  • Fix an issue with source policy rules ending up in the wrong order. moby/moby#​46441
Packaging updates
Security

v24.0.6

Compare Source

24.0.6

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug fixes and enhancements
  • containerd storage backend: Fix docker ps failing when a container image is no longer present in the content store. moby/moby#​46095
  • containerd storage backend: Fix docker ps -s -a and docker container prune failing when a container image config is no longer present in the content store. moby/moby#​46097
  • containerd storage backend: Fix docker inspect failing when a container image config is no longer (or was never) present in the content store. moby/moby#​46244
  • containerd storage backend: Fix diff and export with the overlayfs snapshotter by using reference-counted rootfs mounts. moby/moby#​46266
  • containerd storage backend: Fix a misleading error message when the image platforms available locally do not match the desired platform. moby/moby#​46300
  • containerd storage backend: Fix the FROM scratch Dockerfile instruction with the classic builder. moby/moby#​46302
  • containerd storage backend: Fix mismatched image rootfs and manifest layers errors with the classic builder. moby/moby#​46310
  • Warn when pulling Docker Image Format v1, and Docker Image manifest version 2, schema 1 images from all registries. moby/moby#​46290
  • Fix live-restore of volumes with custom volume options. moby/moby#​46366
  • Fix incorrectly dropping capabilities bits when running a container as a non-root user (note: this change was already effectively present due to a regression). moby/moby#​46221
  • Fix network isolation iptables rules preventing IPv6 Neighbor Solicitation packets from being exchanged between containers. moby/moby#​46214
  • Fix dockerd.exe --register-service not working when the binary is in the current directory on Windows. moby/moby#​46215
  • Add a hint suggesting the use of a PAT to docker login against Docker Hub. docker/cli#​4500
  • Improve shell startup time for users of Bash completion for the CLI. docker/cli#​4517
  • Improve the speed of some commands by skipping GET /_ping when possible. docker/cli#​4508
  • Fix credential scopes when using a PAT to docker manifest inspect an image on Docker Hub. docker/cli#​4512
  • Fix docker events not supporting --format=json. docker/cli#​4544
Packaging updates

v24.0.5

Compare Source

24.0.5

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug fixes and enhancements
  • The Go client now avoids using UNIX socket paths in the HTTP Host: header, in order to be compatible with changes introduced in go1.20.6. moby/moby#​45962, moby/moby#​45990
  • containerd storage backend: Fix Variant not being included in docker image inspect and GET /images/{name}/json. moby/moby#​46025
  • containerd storage backend: Prevent potential garbage collection of content during image export. moby/moby#​46021
  • containerd storage backend: Prevent duplicate digest entries in RepoDigests. moby/moby#​46014
  • containerd storage backend: Fix operations taking place against the incorrect tag when working with an image referenced by tag and digest. moby/moby#​46013
  • containerd storage backend: Fix a panic caused by EXPOSE when building containers with the legacy builder. moby/moby#​45921
  • Fix a regression causing unintuitive errors to be returned when attempting to create an overlay network on a non-Swarm node. moby/moby#​45974
  • Properly report errors parsing volume specifications from the command line. docker/cli#​4423
  • Fix a panic caused when auths: null is found in the CLI config file. docker/cli#​4450
Packaging updates

v24.0.4

Compare Source

24.0.4

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug fixes and enhancements
  • Fix a regression introduced during 24.0.3 that causes a panic during live-restore of containers with bind mounts. moby/moby#​45903

v24.0.3

Compare Source

24.0.3

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug fixes and enhancements
  • containerd image store: Fix an issue where multi-platform images that did not include a manifest for the default platform could not be interacted with. moby/moby#​45849
  • containerd image store: Fix specious attempts to cache FROM scratch in container builds. moby/moby#​45822
  • containerd image store: Fix docker cp with snapshotters that cannot mount the same content multiple times. moby/moby#​45780, moby/moby#​45786
  • containerd image store: Fix builds with type=image not being correctly unpacked/stored. moby/moby#​45692
  • containerd image store: Fix incorrectly attempting to unpack pseudo-images (including attestations) in docker load. moby/moby#​45688
  • containerd image store: Correctly set the user agent, and include additional information like the snapshotter when interacting with registries. moby/moby#​45671, moby/moby#​45684
  • containerd image store: Fix a failure to unpack already-pulled content after switching between snapshotters. moby/moby#​45678
  • containerd image store: Fix images that have been re-tagged or with all tags removed being pruned while still in use. moby/moby#​45857
  • Fix a Swarm CSI issue where the Topology field was not propagated into NodeCSIInfo. moby/moby#​45810
  • Fix failures to add new Swarm managers caused by a very large raft log. moby/moby#​45703, moby/swarmkit#​3122, moby/swarmkit#​3128
  • name_to_handle_at(2) is now always allowed in the default seccomp profile. moby/moby#​45833
  • Fix an issue that prevented encrypted Swarm overlay networks from working on ports other than the default (4789). moby/moby#​45637
  • Fix a failure to restore mount reference-counts during live-restore. moby/moby#​45824
  • Fix various networking-related failures during live-restore. moby/moby#​45658, moby/moby#​45659
  • Fix running containers restoring with a zero (successful) exit status when the daemon is unexpectedly terminated. moby/moby#​45801
  • Fix a potential panic while executing healthcheck probes. moby/moby#​45798
  • Fix a panic caused by a race condition in container exec start. moby/moby#​45794
  • Fix an exception caused by attaching a terminal to an exec with a non-existant command. moby/moby#​45643
  • Fix host-gateway with BuildKit by passing the IP as a label (also requires docker/buildx#​1894). moby/moby#​45790
  • Fix an issue where POST /containers/{id}/stop would forcefully terminate the container when the request was canceled, instead of waiting until the specified timeout for a 'graceful' stop. moby/moby#​45774
  • Fix an issue where docker cp -a from the root (/) directory would fail. moby/moby#​45748
  • Improve compatibility with non-runc container runtimes by more correctly setting resource constraint parameters in the OCI config. moby/moby#​45746
  • Fix an issue caused by overlapping subuid/subgid ranges in certain configurations (e.g. LDAP) in rootless mode. moby/moby#​45747, rootless-containers/rootlesskit#​369
  • Greatly reduce CPU and memory usage while populating the Debug section of GET /info. moby/moby#​45856
  • Fix an issue where debug information was not correctly printed during docker info when only the client is in debug mode. docker/cli#​4393
  • Fix issues related to hung connections when connecting to hosts over a SSH connection. docker/cli#​4395
Packaging updates

v24.0.2

Compare Source

24.0.2

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug fixes and enhancements
  • Fix a panic during build when referencing locally tagged images. moby/buildkit#​3899, moby/moby#​45582
  • Fix builds potentially failing with exit code: 4294967295 when performing many concurrent build stages. moby/moby#​45620
  • Fix DNS resolution on Windows ignoring etc/hosts (%WINDIR%\System32\Drivers\etc\hosts), including resolution of localhost. moby/moby#​45562
  • Apply a workaround for a containerd bug that causes concurrent docker exec commands to take significantly longer than expected. moby/moby#​45625
  • containerd image store: Fix an issue where the image Created field would contain an incorrect value. moby/moby#​45623
  • containerd image store: Adjust the output of image pull progress so that the output has the same format regardless of whether the containerd image store is enabled. moby/moby#​45602
  • containerd image store: Switching between the default and containerd image store now requires a daemon restart. moby/moby#​45616

v24.0.1

Compare Source

24.0.1

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Removed
  • Remove CLI completions for storage drivers removed in the 24.0 major release. docker/cli#​4302
Bug fixes and enhancements
  • Fix an issue where DNS query NXDOMAIN replies from external servers were forwarded to the client as SERVFAIL. moby/moby#​45573
  • Fix an issue where docker pull --platform would report No such image regarding another tag pointing to the same image. moby/moby#​45562
  • Fix an issue where insecure registry configuration would be forgotten during config reload. moby/moby#​45571
  • containerd image store: Fix an issue where images which have no layers would not be listed in docker images -a moby/moby#​45588
  • API: Fix an issue where GET /images/{id}/json would return null instead of empty RepoTags and RepoDigests. moby/moby#​45564
  • API: Fix an issue where POST /commit did not accept an empty request body. moby/moby#​45568
Packaging updates

v24.0.0

Compare Source

24.0.0

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

New
  • Introduce experimental support for containerd as the content store (replacing the existing storage drivers). moby/moby#​43735, other moby/moby pull requests
  • The --host CLI flag now supports a path component in a ssh:// host address, allowing use of an alternate socket path without configuration on the remote host. docker/cli#​4073
  • The docker info CLI command now reports a version and platform field. docker/cli#​4180
  • Introduce the daemon flag --default-network-opt to configure options for newly created networks. moby/moby#​43197
  • Restrict access to AF_VSOCK in the socket(2) family of syscalls in the default seccomp profile. moby/moby#​44562
  • Introduce support for setting OCI runtime annotations on containers. docker/cli#​45025, moby/moby#​45025
  • Alternative runtimes can now be configured in daemon.json, enabling runtime names to be aliased and options to be passed. moby/moby#​45032
  • The docker-init binary will now be discovered in FHS-compliant libexec directories, in addition to the PATH. moby/moby#​45198
  • API: Surface the daemon-level --no-new-privileges in GET /info. moby/moby#​45320
Removed
Deprecated
Bug fixes and enhancements
Packaging updates

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about this update again.

  • If you want to rebase/retry this MR, check this box

This MR has been generated by Renovate Bot.

Merge request reports