Skip to content

Update module github.com/docker/docker to v26

John Jarvis requested to merge renovate/github.com-docker-docker-26.x into next

This MR contains the following updates:

Package Type Update Change
github.com/docker/docker require major v24.0.9+incompatible -> v26.1.1

Release Notes

docker/docker

v26.1.1

Compare Source

26.1.1

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug fixes and enhancements
  • Fix docker run -d printing an context canceled spurious error when OTEL is configured. docker/cli#​5044
  • Experimental environment variable DOCKER_BRIDGE_MRESERVE_KERNEL_LL=1 will prevent the daemon from removing the kernel-assigned link local address on a Linux bridge. moby/moby#​47775
  • Resolve an issue preventing container creation on hosts with a read-only /proc/sys/net filesystem. If IPv6 cannot be disabled on an interface due to this, either disable IPv6 by default on the host or ensure /proc/sys/net is read-write. Otherwise, start dockerd with DOCKER_ALLOW_IPV6_ON_IPV4_INTERFACE=1 to bypass the error. moby/moby#​47769

[!NOTE] The DOCKER_ALLOW_IPV6_ON_IPV4_INTERFACE is added as a temporary fix and will be phased out in a future major release after simplifying the IPv6 enablement process.

Packaging updates

v26.1.0

Compare Source

26.1.0

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

New
Bug fixes and enhancements
  • Native Windows containers are configured with an internal DNS server for container name resolution, and external DNS servers for other lookups. Not all resolvers, including nslookup, fall back to the external resolvers when they get a SERVFAIL answer from the internal server. So, the internal DNS server can now be configured to forward requests to the external resolvers, by setting "features": {"windows-dns-proxy": true } in the daemon.json file. moby/moby#​47584

[!NOTE] This will be the new default behavior in Docker Engine 27.0.

[!WARNING] The windows-dns-proxy feature flag will be removed in a future release.

  • Swarm: Fix Subpath not being passed to the container config. moby/moby#​47711
  • Classic builder: Fix cache miss on WORKDIR <directory>/ build step (directory with a trailing slash). moby/moby#​47723
  • containerd image store: Fix docker images failing when any image in the store has unexpected target. moby/moby#​47738

v26.0.2

Compare Source

26.0.2

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Security

This release contains a security fix for CVE-2024-32473, an unexpected configuration of IPv6 on IPv4-only interfaces.

Bug fixes and enhancements

v26.0.1

Compare Source

26.0.1

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug fixes and enhancements
  • Fix a regression that meant network interface specific --sysctl options prevented container startup. moby/moby#​47646
  • Remove erroneous platform from image config OCI descriptor in docker save output. moby/moby#​47694
  • containerd image store: OCI archives produced by docker save will now have a non-empty mediaType field in index.json moby/moby#​47701
  • Fix a regression that prevented the internal resolver from forwarding requests from IPvlan L3 networks to external resolvers. moby/moby#​47705
  • Prevent the use of external resolvers in IPvlan and Macvlan networks created with no parent interface specified. moby/moby#​47705
Packaging updates

v26.0.0

Compare Source

26.0.0

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Security

This release contains a security fix for CVE-2024-29018, a potential data exfiltration from 'internal' networks via authoritative DNS servers.

New
  • Add Subpath field to the VolumeOptions making it possible to mount a subpath of a volume. moby/moby#​45687
  • Add volume-subpath support to the mount flag (--mount type=volume,...,volume-subpath=<subpath>). docker/cli#​4331
  • Accept = separators and [ipv6] in compose files for docker stack deploy. docker/cli#​4860
  • rootless: Add support for enabling host loopback by setting the DOCKERD_ROOTLESS_ROOTLESSKIT_DISABLE_HOST_LOOPBACK environment variable to false (defaults to true). This lets containers connect to the host by using IP address 10.0.2.2. moby/moby#​47352
  • containerd image store: docker image ls no longer creates duplicates entries for multi-platform images. moby/moby#​45967
  • containerd image store: Send Prometheus metrics. moby/moby#​47555
Bug fixes and enhancements
  • CVE-2024-29018: Do not forward requests to external DNS servers for a container that is only connected to an 'internal' network. Previously, requests were forwarded if the host's DNS server was running on a loopback address, like systemd's 127.0.0.53. moby/moby#​47589
  • Ensure that a generated MAC address is not restored when a container is restarted, but a configured MAC address is preserved. moby/moby#​47233

[!WARNING]

Containers created using Docker Engine 25.0.0 may have duplicate MAC addresses, they must be re-created. Containers created using version 25.0.0 or 25.0.1 with user-defined MAC addresses will get generated MAC addresses when they are started using 25.0.2. They must also be re-created.

  • Always attempt to enable IPv6 on a container's loopback interface, and only include IPv6 in /etc/hosts if successful. moby/moby#​47062

[!NOTE]

By default, IPv6 will remain enabled on a container's loopback interface when the container is not connected to an IPv6-enabled network. For example, containers that are only connected to an IPv4-only network now have the ::1 address on their loopback interface.

To disable IPv6 in a container, use option --sysctl net.ipv6.conf.all.disable_ipv6=1 in the create or run command, or the equivalent sysctls option in the service configuration section of a Compose file.

If IPv6 is not available in a container because it has been explicitly disabled for the container, or the host's networking stack does not have IPv6 enabled (or for any other reason) the container's /etc/hosts file will not include IPv6 entries.

  • Fix ADD Dockerfile instruction failing with lsetxattr <file>: operation not supported when unpacking archive with xattrs onto a filesystem that doesn't support them. moby/moby#​47175
  • Fix docker container start failing when used with --checkpoint. moby/moby#​47456
  • Restore IP connectivity between the host and containers on an internal bridge network. moby/moby#​47356
  • Do not enforce new validation rules for existing swarm networks. moby/moby#​47361
  • Restore DNS names for containers in the default "nat" network on Windows. moby/moby#​47375
  • Print hint when invoking docker image ls with ambiguous argument. docker/cli#​4849
  • Cleanup @docker_cli_[UUID] files on OpenBSD. docker/cli#​4862
  • Add explicit deprecation notice message when using remote TCP connections without TLS. docker/cli#​4928, moby/moby#​47556
  • Use IPv6 nameservers from the host's resolv.conf as upstream resolvers for Docker Engine's internal DNS, rather than listing them in the container's resolv.conf. moby/moby#​47512
  • containerd image store: Isolate images with different containerd namespaces when --userns-remap option is used. moby/moby#​46786
  • containerd image store: Fix image pull not emitting Pulling fs layer status. moby/moby#​47432
API
  • To preserve backwards compatibility, read-only mounts are not recursive by default when using older clients (API version < v1.44). moby/moby#​47391
  • GET /images/{id}/json omits the Created field (previously it was 0001-01-01T00:00:00Z) if the Created field is missing from the image config. moby/moby#​47451
  • Populate a missing Created field in GET /images/{id}/json with 0001-01-01T00:00:00Z for API version <= 1.43. moby/moby#​47387
  • The is_automated field in the POST /images/search endpoint results is always false now. Consequently, searching for is-automated=true will yield no results, while is-automated=false will be a no-op. moby/moby#​47465
  • Remove Container and ContainerConfig fields from the GET /images/{name}/json response. moby/moby#​47430
Packaging updates
Removed
  • Remove Container and ContainerConfig fields from the GET /images/{name}/json response. moby/moby#​47430
  • Deprecate the ability to accept remote TCP connections without TLS. Deprecation notice docker/cli#​4928 moby/moby#​47556.
  • Remove deprecated API versions (API < v1.24) moby/moby#​47155
  • Disable pulling of deprecated image formats by default. These image formats are deprecated, and support will be removed in a future version. moby/moby#​47459
  • image: remove deprecated IDFromDigest moby/moby#​47198
  • Remove the deprecated github.com/docker/docker/pkg/loopback package. moby/moby#​47128
  • pkg/system: remove deprecated ErrNotSupportedOperatingSystem, IsOSSupported moby/moby#​47129
  • pkg/homedir: remove deprecated Key() and GetShortcutString() moby/moby#​47130
  • pkg/containerfs: remove deprecated ResolveScopedPath moby/moby#​47131
  • The daemon flag --oom-score-adjust was deprecated in v24.0 and is now removed. moby/moby#​46113
  • Remove deprecated aliases from the api/types package. These types were deprecated in v25.0.0, which provided temporary aliases. moby/moby#​47148 These aliases are now removed: types.Info, types.Commit, types.PluginsInfo, types.NetworkAddressPool, types.Runtime, types.SecurityOpt, types.KeyValue, types.DecodeSecurityOptions, types.CheckpointCreateOptions, types.CheckpointListOptions, types.CheckpointDeleteOptions, types.Checkpoint, types.ImageDeleteResponseItem, types.ImageSummary, types.ImageMetadata, types.ServiceUpdateResponse, types.ServiceCreateResponse, types.ResizeOptions, types.ContainerAttachOptions, types.ContainerCommitOptions, types.ContainerRemoveOptions, types.ContainerStartOptions, types.ContainerListOptions, types.ContainerLogsOptions
  • cli/command/container: remove deprecated NewStartOptions() docker/cli#​4811
  • cli/command: remove deprecated DockerCliOption, InitializeOpt docker/cli#​4810

v25.0.5

Compare Source

25.0.5

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Security

This release contains a security fix for CVE-2024-29018, a potential data exfiltration from 'internal' networks via authoritative DNS servers.

Bug fixes and enhancements
  • CVE-2024-29018: Do not forward requests to external DNS servers for a container that is only connected to an 'internal' network. Previously, requests were forwarded if the host's DNS server was running on a loopback address, like systemd's 127.0.0.53. moby/moby#​47589
  • plugin: fix mounting /etc/hosts when running in UserNS. moby/moby#​47588
  • rootless: fix open /etc/docker/plugins: permission denied. moby/moby#​47587
  • Fix multiple parallel docker build runs leaking disk space. moby/moby#​47527

v25.0.4

Compare Source

25.0.4

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug fixes and enhancements
  • Restore DNS names for containers in the default "nat" network on Windows. moby/moby#​47490
  • Fix docker start failing when used with --checkpoint moby/moby#​47466
  • Don't enforce new validation rules for existing swarm networks moby/moby#​47482
  • Restore IP connectivity between the host and containers on an internal bridge network. moby/moby#​47481
  • Fix a regression introduced in v25.0 that prevented the classic builder from ADDing a tar archive with xattrs created on a non-Linux OS moby/moby#​47483
  • containerd image store: Fix image pull not emitting Pulling fs layer status moby/moby#​47484
API
  • To preserve backwards compatibility, make read-only mounts not recursive by default when using older clients (API version < v1.44). moby/moby#​47393
  • GET /images/{id}/json omits the Created field (previously it was 0001-01-01T00:00:00Z) if the Created field is missing from the image config. moby/moby#​47451
  • Populate a missing Created field in GET /images/{id}/json with 0001-01-01T00:00:00Z for API version <= 1.43. moby/moby#​47387
  • Fix a regression that caused API socket connection failures to report an API version negotiation failure instead. moby/moby#​47470
  • Preserve supplied endpoint configuration in a container-create API request, when a container-wide MAC address is specified, but NetworkMode name-or-id is not the same as the name-or-id used in NetworkSettings.Networks. moby/moby#​47510
Packaging updates

Full Changelog: https://github.com/moby/moby/compare/v25.0.3...v25.0.4

v25.0.3

Compare Source

25.0.3

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug fixes and enhancements

  • containerd image store: Fix a bug where docker image history would fail if a manifest wasn't found in the content store. moby/moby#​47348

  • Ensure that a generated MAC address is not restored when a container is restarted, but a configured MAC address is preserved. moby/moby#​47304

    Note

    • Containers created with Docker Engine version 25.0.0 may have duplicate MAC addresses. They must be re-created.
    • Containers with user-defined MAC addresses created with Docker Engine versions 25.0.0 or 25.0.1 receive new MAC addresses when started using Docker Engine version 25.0.2. They must also be re-created.
  • Fix docker save <image>@&#8203;<digest> producing an OCI archive with index without manifests. moby/moby#​47294
  • Fix a bug preventing bridge networks from being created with an MTU higher than 1500 on RHEL and CentOS 7. moby/moby#​47308, moby/moby#​47311
  • Fix a bug where containers are unable to communicate over an internal network. moby/moby#​47303
  • Fix a bug where the value of the ipv6 daemon option was ignored. moby/moby#​47310
  • Fix a bug where trying to install a pulling using a digest revision would cause a panic. moby/moby#​47323
  • Fix a potential race condition in the managed containerd supervisor. moby/moby#​47313
  • Fix an issue with the journald log driver preventing container logs from being followed correctly with systemd version 255. moby/moby47243
  • seccomp: Update the builtin seccomp profile to include syscalls added in kernel v5.17 - v6.7 to align the profile with the profile used by containerd. moby/moby#​47341
  • Windows: Fix cache not being used when building images based on Windows versions older than the host's version. moby/moby#​47307, moby/moby#​47337
Packaging updates

v25.0.2

Compare Source

25.0.2

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Security

This release contains security fixes for the following CVEs affecting Docker Engine and its components.

CVE Component Fix version Severity
CVE-2024-21626 runc 1.1.12 High, CVSS 8.6
CVE-2024-23651 BuildKit 1.12.5 High, CVSS 8.7
CVE-2024-23652 BuildKit 1.12.5 High, CVSS 8.7
CVE-2024-23653 BuildKit 1.12.5 High, CVSS 7.7
CVE-2024-23650 BuildKit 1.12.5 Medium, CVSS 5.5
CVE-2024-24557 Docker Engine 25.0.2 Medium, CVSS 6.9

The potential impacts of the above vulnerabilities include:

  • Unauthorized access to the host filesystem
  • Compromising the integrity of the build cache
  • In the case of CVE-2024-21626, a scenario that could lead to full container escape

For more information about the security issues addressed in this release, refer to the blog post. For details about each vulnerability, see the relevant security advisory:

Packaging updates

v25.0.1

Compare Source

25.0.1

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Bug fixes and enhancements
  • API: Fix incorrect HTTP status code for containers with an invalid network configuration created before upgrading to Docker Engine v25.0. moby/moby#​47159
  • Ensure that a MAC address based on a container's IP address is re-generated when the container is stopped and restarted, in case the generated IP/MAC addresses have been reused. moby/moby#​47171
  • Fix host-gateway-ip not working during build when not set through configuration. moby/moby#​47192
  • Fix a bug that prevented a container from being renamed twice. moby/moby#​47196
  • Fix an issue causing containers to have their short ID added to their network alias when inspecting them. moby/moby#​47182
  • Fix an issue in detecting whether a remote build context is a Git repository. moby/moby#​47136
  • Fix an issue with layers order in OCI manifests. moby/moby#​47150
  • Fix volume mount error when passing an addr or ip mount option. moby/moby#​47185
  • Improve error message related to extended attributes that can't be set due to improperly namespaced attribute names. moby/moby#​47178
  • Swarm: Fixed start_interval not being passed to the container config. moby/moby#​47163
Packaging updates

v25.0.0

Compare Source

25.0.0

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

New
Bug fixes and enhancements
  • API: Fix error message for invalid policies at ValidateRestartPolicy. moby/moby#​46352
  • API: Update /info endpoint to use singleflight. moby/moby#​45847
  • Add an error message for when specifying a Dockerfile filename with -f, and also using stdin. docker/cli#​4346
  • Add support for mac-address and link-local-ip fields in --network long format. docker/cli#​4419
  • Add support for specifying multiple --network flags with docker container create and docker run. moby/moby#​45906
  • Automatically enable IPv6 on a network when an IPv6 subnet is specified. moby/moby#​46455
  • Add support for overlay networks over IPv6 transport. moby/moby#​46790
  • Configuration reloading is now more robust: if there's an error during the configuration reload process, no configuration changes are applied. moby/moby#​43980
  • Live restore: Containers with auto remove (docker run --rm) are no longer forcibly removed on engine restart. moby/moby#​46857
  • Live restore: containers that are live-restored will now be given another health-check start period when the daemon restarts. moby/moby#​47051
  • Container health status is flushed to disk less frequently, reducing wear on flash storage. moby/moby#​47044
  • Ensure network names are unique. moby/moby#​46251
  • Ensure that overlay2 layer metadata is correct. moby/moby#​46471
  • Fix Downloading progress message on image pull. moby/moby#​46515
  • Fix NetworkConnect and ContainerCreate with improved data validation, and return all validation errors at once. moby/moby#​46183
  • Fix com.docker.network.host_ipv4 option when IPv6 and ip6tables are enabled. moby/moby#​46446
  • Fix daemon's cleanupContainer if containerd is stopped. moby/moby#​46213
  • Fix returning incorrect HTTP status codes for libnetwork errors. moby/moby#​46146
  • Fix various issues with images/json API filters and image list. moby/moby#​46034
  • CIFS volumes now resolves FQDN correctly. moby/moby#​46863
  • Improve validation of the userland-proxy-path daemon configuration option. Validation now happens during daemon startup, instead of producing an error when starting a container with port-mapping. moby/moby#​47000
  • Set the MAC address of container's interface when network mode is a short network ID. moby/moby#​46406
  • Sort unconsumed build arguments before display in build output. moby/moby#​45917
  • The docker image save tarball output is now OCI compliant. moby/moby#​44598
  • The daemon no longer appends ACCEPT rules to the end of the INPUT iptables chain for encrypted overlay networks. Depending on firewall configuration, a rule may be needed to permit incoming encrypted overlay network traffic. moby/moby#​45280
  • Unpacking layers with extended attributes onto an incompatible filesystem will now fail instead of silently discarding extended attributes. moby/moby#​45464
  • Update daemon MTU option to BridgeConfig and display warning on Windows. moby/moby#​45887
  • Validate IPAM config when creating a network. Automatically fix networks created prior to this release where --ip-range is larger than --subnet. moby/moby#​45759
  • containerd image store: Add image events for push, pull, and save. moby/moby#​46405
  • containerd image store: Add support for pulling legacy schema1 images. moby/moby#​46513
  • containerd image store: Add support for pushing all tags. moby/moby#​46485
  • containerd image store: Add support for registry token. moby/moby#​46475
  • containerd image store: Add support for showing the number of containers that use an image. moby/moby#​46511
  • containerd image store: Fix a bug related to the ONBUILD, MAINTAINER, and HEALTHCHECK Dockerfile instructions. moby/moby#​46313
  • containerd image store: Fix Pulling from progress message. moby/moby#​46494
  • containerd image store: Add support for referencing images via the truncated ID with sha256: prefix. moby/moby#​46435
  • containerd image store: Fix docker images showing intermediate layers by default. moby/moby#​46423
  • containerd image store: Fix checking if the specified platform exists when getting an image. moby/moby#​46495
  • containerd image store: Fix errors when multiple ADD or COPY instructions were used with the classic builder. moby/moby#​46383
  • containerd image store: Fix stack overflow errors when importing an image. moby/moby#​46418
  • containerd image store: Improve docker pull progress output. moby/moby#​46412
  • containerd image store: Print the tag, digest, and size after pushing an image. moby/moby#​46384
  • containerd image store: Remove panic from UpdateConfig. moby/moby#​46433
  • containerd image store: Return an error when an image tag resembles a digest. moby/moby#​46492
  • containerd image store: docker image ls now shows the correct image creation time and date. moby/moby#​46719
  • containerd image store: Fix an issue handling user namespace settings. moby/moby#​46375
  • containerd image store: Add support for pulling all tags (docker pull -a). moby/moby#​46618
  • containerd image store: Use the domain name in the image reference as the default registry authentication domain. moby/moby#​46779
Packaging updates
Removed
Deprecated
  • Deprecate API versions older than 1.24. Deprecation notice
  • Deprecate IsAutomated field and is-automated filter for docker search. Deprecation notice
  • API: Deprecate Container and ContainerConfig properties for /images/{id}/json (docker image inspect). moby/moby#​46939

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about this update again.

  • If you want to rebase/retry this MR, check this box

This MR has been generated by Renovate Bot.

Edited by John Jarvis

Merge request reports