Skip to content

Update module github.com/docker/docker to v20.10.21 - autoclosed

John Jarvis requested to merge renovate/github.com-docker-docker-20.x into master

This MR contains the following updates:

Package Type Update Change
github.com/docker/docker require patch v20.10.17+incompatible -> v20.10.21

Release Notes

docker/docker

v20.10.21

Compare Source

This release of Docker Engine contains updated versions of Docker Compose, Docker Scan, Containerd, added packages for Ubuntu 22.10, and some minor bug fixes and enhancements.

Client
Daemon
  • Allow "allow-nondistributable-artifacts" to be configured for Docker Hub moby/moby#​44313.
  • Fix an Invalid standard handle identifie panic when registering the docker daemon as a service from a legacy CLI on Windows moby/moby#​44326.
Builder
Packaging
  • Provide packages for Ubuntu 22.10 "Kinetic Kudu".
  • Update Docker Compose to v2.12.2.
  • Update Docker Scan to v0.21.0.
  • Update containerd (containerd.io package) to v1.6.9.

v20.10.20

Compare Source

This release of Docker Engine contains partial mitigations for a Git vulnerability (CVE-2022-39253), and has updated handling of image:tag@digest image references.

The Git vulnerability allows a maliciously crafted Git repository, when used as a build context, to copy arbitrary filesystem paths into resulting containers/images; this can occur in both the daemon, and in API clients, depending on the versions and tools in use.

The mitigations available in this release and in other consumers of the daemon API are partial and only protect users who build a Git URL context (e.g. git+protocol://). As the vulnerability could still be exploited by manually run Git commands that interact with and check out submodules, users should immediately upgrade to a patched version of Git to protect against this vulernability. Further details are available from the GitHub blog ("Git security vulnerabilities announced").

Client
  • Added a mitigation for CVE-2022-39253, when using the classic Builder with a Git URL as the build context.
Daemon
  • Updated handling of image:tag@digest references. When pulling an image using the image:tag@digest ("pull by digest"), image resolution happens through the content-addressable digest and the image and tag are not used. While this is expected, this could lead to confusing behavior, and could potentially be exploited through social engineering to run an image that is already present in the local image store. Docker now checks if the digest matches the repository name used to pull the image, and otherwise will produce an error.
Builder
  • Updated handling of image:tag@digest references. Refer to the "Daemon" section above for details.
  • Added a mitigation to the classic Builder and updated BuildKit to v0.8.3-31-gc0149372, for CVE-2022-39253.

v20.10.19

Compare Source

This release of Docker Engine comes with some bug-fixes, and an updated version of Docker Compose.

Builder
  • Fix an issue that could result in a panic during docker builder prune or docker system prune moby/moby#​44122.
Daemon
  • Fix a bug where using docker volume prune would remove volumes that were still in use if the daemon was running with "live restore" and was restarted moby/moby#​44238.
Packaging

v20.10.18

Compare Source

This release of Docker Engine comes with a fix for a low-severity security issue, some minor bug fixes, and updated versions of Docker Compose, Docker Buildx, containerd, and runc.

Client
Builder
  • Fix an issue where file-capabilities were not preserved during build moby/moby#​43876.
  • Fix an issue that could result in a panic caused by a concurrent map read and map write moby/moby#​44067
Daemon
  • Fix a security vulnerability relating to supplementary group permissions, which could allow a container process to bypass primary group restrictions within the container CVE-2022-36109, GHSA-rc4r-wh2q-q6c4.
  • seccomp: add support for Landlock syscalls in default policy moby/moby#​43991.
  • seccomp: update default policy to support new syscalls introduced in kernel 5.12 - 5.16 moby/moby#​43991.
  • Fix an issue where cache lookup for image manifests would fail, resulting in a redundant round-trip to the image registry moby/moby#​44109.
  • Fix an issue where exec processes and healthchecks were not terminated when they timed out moby/moby#​44018.
Packaging

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about this update again.

  • If you want to rebase/retry this MR, check this box

This MR has been generated by Renovate Bot.

Merge request reports