Update module github.com/docker/docker to v25 - autoclosed
This MR contains the following updates:
Package | Type | Update | Change |
---|---|---|---|
github.com/docker/docker | require | major |
v24.0.9+incompatible -> v25.0.5
|
Release Notes
docker/docker
v25.0.5
: 25.0.5
25.0.5
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
- docker/cli, 25.0.5 milestone
- moby/moby, 25.0.5 milestone
- Deprecated and removed features, see Deprecated Features.
- Changes to the Engine API, see API version history.
Security
This release contains a security fix for CVE-2024-29018, a potential data exfiltration from 'internal' networks via authoritative DNS servers.
Bug fixes and enhancements
- CVE-2024-29018: Do not forward requests to external DNS servers for a container that is only connected to an 'internal' network. Previously, requests were forwarded if the host's DNS server was running on a loopback address, like systemd's 127.0.0.53. moby/moby#47589
- plugin: fix mounting /etc/hosts when running in UserNS. moby/moby#47588
- rootless: fix
open /etc/docker/plugins: permission denied
. moby/moby#47587 - Fix multiple parallel
docker build
runs leaking disk space. moby/moby#47527
v25.0.4
v25.0.4
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
- docker/cli, 25.0.4 milestone
- moby/moby, 25.0.4 milestone
- Deprecated and removed features, see Deprecated Features.
- Changes to the Engine API, see API version history.
Bug fixes and enhancements
- Restore DNS names for containers in the default "nat" network on Windows. moby/moby#47490
- Fix
docker start
failing when used with--checkpoint
moby/moby#47466 - Don't enforce new validation rules for existing swarm networks moby/moby#47482
- Restore IP connectivity between the host and containers on an internal bridge network. moby/moby#47481
- Fix a regression introduced in v25.0 that prevented the classic builder from ADDing a tar archive with xattrs created on a non-Linux OS moby/moby#47483
- containerd image store: Fix image pull not emitting
Pulling fs layer
status moby/moby#47484
API
- To preserve backwards compatibility, make read-only mounts not recursive by default when using older clients (API version < v1.44). moby/moby#47393
-
GET /images/{id}/json
omits theCreated
field (previously it was0001-01-01T00:00:00Z
) if theCreated
field is missing from the image config. moby/moby#47451 - Populate a missing
Created
field inGET /images/{id}/json
with0001-01-01T00:00:00Z
for API version <= 1.43. moby/moby#47387 - Fix a regression that caused API socket connection failures to report an API version negotiation failure instead. moby/moby#47470
- Preserve supplied endpoint configuration in a container-create API request, when a container-wide MAC address is specified, but
NetworkMode
name-or-id is not the same as the name-or-id used inNetworkSettings.Networks
. moby/moby#47510
Packaging updates
- Upgrade Go runtime to 1.21.8. moby/moby#47503
- Upgrade RootlessKit to v2.0.2. moby/moby#47508
- Upgrade Compose to v2.24.7. https://github.com/docker/docker-ce-packaging/pull/998
- Upgrade Buildx to v0.13.0. https://github.com/docker/docker-ce-packaging/pull/997
Full Changelog: https://github.com/moby/moby/compare/v25.0.3...v25.0.4
v25.0.3
25.0.3
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
What's Changed
- [25.0 backport] pkg/ioutils: Make subsequent Close attempts noop https://github.com/moby/moby/pull/47222
- [25.0 backport] Fix HasResource inverted boolean error - vendor swarmkit v2.0.0-20240125134710-dcda100a8261 https://github.com/moby/moby/pull/47225
- [25.0 backport] gha: update actions to account for node 16 deprecation https://github.com/moby/moby/pull/47291
- [25.0 backport] docs: remove dead links from api verison history https://github.com/moby/moby/pull/47296
- [25.0 backport] Assert temp output directory is not an empty string https://github.com/moby/moby/pull/47298
- [25.0 backport] api: Document
version
in/build
https://github.com/moby/moby/pull/47295 - [25.0 backport] De-flake TestSwarmClusterRotateUnlockKey https://github.com/moby/moby/pull/47201
- [25.0 backport] Add internal n/w bridge to firewalld docker zone https://github.com/moby/moby/pull/47303
- [25.0 backport] Only restore a configured MAC addr on restart. https://github.com/moby/moby/pull/47304
- [25.0 backport] Revert "daemon: automatically set network EnableIPv6 if needed" https://github.com/moby/moby/pull/47310
- [25.0 backport] libnet: bridge: ignore EINVAL when configuring bridge MTU https://github.com/moby/moby/pull/47311
- [25.0 backport] logger/journald: fix tailing logs with systemd 255 https://github.com/moby/moby/pull/47243
- [25.0 backport] add more //go:build directives to prevent downgrading to go1.16 language https://github.com/moby/moby/pull/47220
- [25.0 backport] libcontainerd/supervisor: fix data race https://github.com/moby/moby/pull/47313
- [25.0 backport] plugins: Fix panic when fetching by digest https://github.com/moby/moby/pull/47323
- [25.0 backport] Dockerfile: update docker-cli to v25.0.2, docker compose v2.24.5 https://github.com/moby/moby/pull/47316
- [25.0 backport] image/save: Fix untagged images not present in index.json https://github.com/moby/moby/pull/47294
- [25.0 backport] Dockerfile: update RootlessKit to v2.0.1 https://github.com/moby/moby/pull/47334
- [25.0 backport] image/cache: Ignore Build and Revision on Windows https://github.com/moby/moby/pull/47337
- [25.0 backport] profiles/seccomp: add syscalls for kernel v5.17 - v6.6, match containerd's profile https://github.com/moby/moby/pull/47344
- [25.0 backport] c8d: Use the same logic to get the present images https://github.com/moby/moby/pull/47348
Full Changelog: https://github.com/moby/moby/compare/v25.0.2...v25.0.3
v25.0.2
25.0.2
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Security
This release contains security fixes for the following CVEs affecting Docker Engine and its components.
CVE | Component | Fix version | Severity |
---|---|---|---|
CVE-2024-21626 | runc | 1.1.12 | High, CVSS 8.6 |
CVE-2024-23651 | BuildKit | 1.12.5 | High, CVSS 8.7 |
CVE-2024-23652 | BuildKit | 1.12.5 | High, CVSS 8.7 |
CVE-2024-23653 | BuildKit | 1.12.5 | High, CVSS 7.7 |
CVE-2024-23650 | BuildKit | 1.12.5 | Medium, CVSS 5.5 |
CVE-2024-24557 | Docker Engine | 25.0.2 | Medium, CVSS 6.9 |
The potential impacts of the above vulnerabilities include:
- Unauthorized access to the host filesystem
- Compromising the integrity of the build cache
- In the case of CVE-2024-21626, a scenario that could lead to full container escape
For more information about the security issues addressed in this release, refer to the blog post. For details about each vulnerability, see the relevant security advisory:
Packaging updates
- Upgrade containerd to v1.6.28.
- Upgrade containerd to v1.7.13 (static binaries only). moby/moby#47280
- Upgrade runc to v1.1.12. moby/moby#47269
- Upgrade Compose to v2.24.5. docker/docker-ce-packaging#985
- Upgrade BuildKit to v0.12.5. moby/moby#47273
v25.0.1
25.0.1
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Bug fixes and enhancements
- API: Fix incorrect HTTP status code for containers with an invalid network configuration created before upgrading to Docker Engine v25.0. moby/moby#47159
- Ensure that a MAC address based on a container's IP address is re-generated when the container is stopped and restarted, in case the generated IP/MAC addresses have been reused. moby/moby#47171
- Fix
host-gateway-ip
not working during build when not set through configuration. moby/moby#47192 - Fix a bug that prevented a container from being renamed twice. moby/moby#47196
- Fix an issue causing containers to have their short ID added to their network alias when inspecting them. moby/moby#47182
- Fix an issue in detecting whether a remote build context is a Git repository. moby/moby#47136
- Fix an issue with layers order in OCI manifests. moby/moby#47150
- Fix volume mount error when passing an
addr
orip
mount option. moby/moby#47185 - Improve error message related to extended attributes that can't be set due to improperly namespaced attribute names. moby/moby#47178
- Swarm: Fixed
start_interval
not being passed to the container config. moby/moby#47163
Packaging updates
- Upgrade Compose to
2.24.2
. docker/docker-ce-packaging#981
v25.0.0
25.0.0
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
- docker/cli, 25.0.0 milestone
- moby/moby, 25.0.0 milestone
- Deprecated and removed features, see Deprecated Features.
- Changes to the Engine API, see API version history.
New
- Add OpenTelemetry tracing. moby/moby#45652, moby/moby#45579
- Add support for CDI devices under Linux. moby/moby#45134, docker/cli#4510, moby/moby#46004
- Add an additional interval to be used by healthchecks during the container start period. moby/moby#40894, docker/cli#4405, moby/moby#45965
- Add a
--log-format
flag todockerd
to control the logging format: text (default) or JSON. moby/moby#45737 - Add support for recursive read-only mounts. moby/moby#45278, moby/moby#46037
- Add support for filtering images based on timestamp with
docker image ls --filter=until=<timestamp>
. moby/moby#46577
Bug fixes and enhancements
- API: Fix error message for invalid policies at
ValidateRestartPolicy
. moby/moby#46352 - API: Update
/info
endpoint to use singleflight. moby/moby#45847 - Add an error message for when specifying a Dockerfile filename with
-f
, and also usingstdin
. docker/cli#4346 - Add support for
mac-address
andlink-local-ip
fields in--network
long format. docker/cli#4419 - Add support for specifying multiple
--network
flags withdocker container create
anddocker run
. moby/moby#45906 - Automatically enable IPv6 on a network when an IPv6 subnet is specified. moby/moby#46455
- Add support for overlay networks over IPv6 transport. moby/moby#46790
- Configuration reloading is now more robust: if there's an error during the configuration reload process, no configuration changes are applied. moby/moby#43980
- Live restore: Containers with auto remove (
docker run --rm
) are no longer forcibly removed on engine restart. moby/moby#46857 - Live restore: containers that are live-restored will now be given another health-check start period when the daemon restarts. moby/moby#47051
- Container health status is flushed to disk less frequently, reducing wear on flash storage. moby/moby#47044
- Ensure network names are unique. moby/moby#46251
- Ensure that overlay2 layer metadata is correct. moby/moby#46471
- Fix
Downloading
progress message on image pull. moby/moby#46515 - Fix
NetworkConnect
andContainerCreate
with improved data validation, and return all validation errors at once. moby/moby#46183 - Fix
com.docker.network.host_ipv4
option when IPv6 and ip6tables are enabled. moby/moby#46446 - Fix daemon's
cleanupContainer
if containerd is stopped. moby/moby#46213 - Fix returning incorrect HTTP status codes for libnetwork errors. moby/moby#46146
- Fix various issues with images/json API filters and image list. moby/moby#46034
- CIFS volumes now resolves FQDN correctly. moby/moby#46863
- Improve validation of the
userland-proxy-path
daemon configuration option. Validation now happens during daemon startup, instead of producing an error when starting a container with port-mapping. moby/moby#47000 - Set the MAC address of container's interface when network mode is a short network ID. moby/moby#46406
- Sort unconsumed build arguments before display in build output. moby/moby#45917
- The
docker image save
tarball output is now OCI compliant. moby/moby#44598 - The daemon no longer appends
ACCEPT
rules to the end of theINPUT
iptables chain for encrypted overlay networks. Depending on firewall configuration, a rule may be needed to permit incoming encrypted overlay network traffic. moby/moby#45280 - Unpacking layers with extended attributes onto an incompatible filesystem will now fail instead of silently discarding extended attributes. moby/moby#45464
- Update daemon MTU option to BridgeConfig and display warning on Windows. moby/moby#45887
- Validate IPAM config when creating a network. Automatically fix networks created prior to this release where
--ip-range
is larger than--subnet
. moby/moby#45759 - containerd image store: Add image events for
push
,pull
, andsave
. moby/moby#46405 - containerd image store: Add support for pulling legacy schema1 images. moby/moby#46513
- containerd image store: Add support for pushing all tags. moby/moby#46485
- containerd image store: Add support for registry token. moby/moby#46475
- containerd image store: Add support for showing the number of containers that use an image. moby/moby#46511
- containerd image store: Fix a bug related to the
ONBUILD
,MAINTAINER
, andHEALTHCHECK
Dockerfile instructions. moby/moby#46313 - containerd image store: Fix
Pulling from
progress message. moby/moby#46494 - containerd image store: Add support for referencing images via the truncated ID with
sha256:
prefix. moby/moby#46435 - containerd image store: Fix
docker images
showing intermediate layers by default. moby/moby#46423 - containerd image store: Fix checking if the specified platform exists when getting an image. moby/moby#46495
- containerd image store: Fix errors when multiple
ADD
orCOPY
instructions were used with the classic builder. moby/moby#46383 - containerd image store: Fix stack overflow errors when importing an image. moby/moby#46418
- containerd image store: Improve
docker pull
progress output. moby/moby#46412 - containerd image store: Print the tag, digest, and size after pushing an image. moby/moby#46384
- containerd image store: Remove panic from
UpdateConfig
. moby/moby#46433 - containerd image store: Return an error when an image tag resembles a digest. moby/moby#46492
- containerd image store:
docker image ls
now shows the correct image creation time and date. moby/moby#46719 - containerd image store: Fix an issue handling user namespace settings. moby/moby#46375
- containerd image store: Add support for pulling all tags (
docker pull -a
). moby/moby#46618 - containerd image store: Use the domain name in the image reference as the default registry authentication domain. moby/moby#46779
Packaging updates
- Upgrade API to v1.44. moby/moby#45468
- Upgrade Compose to
2.24.1
. docker/docker-ce-packaging#980 - Upgrade containerd to v1.7.12 (static binaries only). moby/moby#47070
- Upgrade Go runtime to 1.21.6. moby/moby#47053
- Upgrade runc to v1.1.11. moby/moby#47007
- Upgrade BuildKit to v0.12.4. moby/moby#46882
- Upgrade Buildx to v0.12.1. docker/docker-ce-packaging#979
Removed
- API: Remove VirtualSize field for the
GET /images/json
andGET /images/{id}/json
endpoints. moby/moby#45469 - Remove deprecated
devicemapper
storage driver. moby/moby#43637 - Remove deprecated orchestrator options. docker/cli#4366
- Remove support for Debian Upstart init system. moby/moby#45548, moby/moby#45551
- Remove the
--oom-score-adjust
daemon option. moby/moby#45484 - Remove warning for deprecated
~/.dockercfg
file. docker/cli#4281 - Remove
logentries
logging driver. moby/moby#46925
Deprecated
- Deprecate API versions older than 1.24. Deprecation notice
- Deprecate
IsAutomated
field andis-automated
filter fordocker search
. Deprecation notice - API: Deprecate
Container
andContainerConfig
properties for/images/{id}/json
(docker image inspect
). moby/moby#46939
Configuration
-
If you want to rebase/retry this MR, check this box
This MR has been generated by Renovate Bot.