This document describes the latest changes, additions, known issues, and fixes for Docker Engine.
2022-05-12
This release of Docker Engine fixes a regression in the Docker CLI builds for macOS, fixes an issue with docker stats when using containerd 1.5 and up, and updates the Go runtime to include a fix for CVE-2022-29526.
docker stats was showing empty stats when running with containerd 1.5.0 or up moby/moby#43567.golang.org/x/sys build-time dependency which contains a fix for CVE-2022-29526.docker scan CLI plugin, to prevent a “conflicting requests” error when users performed an off-line installation from downloaded RPM packages docker/docker-ce-packaging#659.2022-05-05
This release of Docker Engine comes with updated versions of the compose, buildx, containerd, and runc components, as well as some minor bug fixes.
Known issues
We’ve identified an issue with the macOS CLI binaries in the 20.10.15 release. This issue has been resolved in the 20.10.16 release.
containerd.io package) to v1.6.4.2022-03-23
This release of Docker Engine updates the default inheritable capabilities for containers to address CVE-2022-24769, a new version of the containerd.io runtime is also included to address the same issue.
2022-03-10
This release of Docker Engine contains some bug-fixes and packaging changes, updates to the docker scan and docker buildx commands, an updated version of the Go runtime, and new versions of the containerd.io runtime. Together with this release, we now also provide .deb and .rpm packages of Docker Compose V2, which can be installed using the (optional) docker-compose-plugin package.
net.ipv4.ping_group_range sysctl moby/moby#43084.fluentd-async-connect=true and the remote server is unreachable moby/moby#43147..deb and .rpm packages for Docker Compose V2. Docker Compose v2.3.3 can now be installed on Linux using the docker-compose-plugin packages, which provides the docker compose subcommand on the Docker CLI. The Docker Compose plugin can also be installed and run standalone to be used as a drop-in replacement for docker-compose (Docker Compose V1) docker/docker-ce-packaging#638. The compose-cli-plugin package can also be used on older version of the Docker CLI with support for CLI plugins (Docker CLI 18.09 and up).docker buildx to v0.8.0.docker scan (docker-scan-plugin) to v0.17.0.containerd.io package) to v1.5.10.2021-12-13
This release of Docker Engine contains changes in packaging only, and provides updates to the docker scan and docker buildx commands. Versions of docker scan before v0.11.0 are not able to detect the Log4j 2 CVE-2021-44228. We are shipping an updated version of docker scan in this release to help you scan your images for this vulnerability.
Note
The
docker scancommand on Linux is currently only supported on x86 platforms. We do not yet provide a package for other hardware architectures on Linux.
The docker scan feature is provided as a separate package and, depending on your upgrade or installation method, ‘docker scan’ may not be updated automatically to the latest version. Use the instructions below to update docker scan to the latest version. You can also use these instructions to install, or upgrade the docker scan package without upgrading the Docker Engine:
On .deb based distros, such as Ubuntu and Debian:
$ apt-get update && apt-get install docker-scan-plugin
On rpm-based distros, such as CentOS or Fedora:
$ yum install docker-scan-plugin
After upgrading, verify you have the latest version of docker scan installed:
$ docker scan --accept-license --version
Version: v0.12.0
Git commit: 1074dd0
Provider: Snyk (1.790.0 (standalone))
Read our blog post on CVE-2021-44228 to learn how to use the docker scan command to check if images are vulnerable.
2021-11-17
IMPORTANT
Due to net/http changes in Go 1.16, HTTP proxies configured through the
$HTTP_PROXYenvironment variable are no longer used for TLS (https://) connections. Make sure you also set an$HTTPS_PROXYenvironment variable for handling requests tohttps://URLs.Refer to the HTTP/HTTPS proxy section to learn how to configure the Docker Daemon to use a proxy server.
2021-10-25
IMPORTANT
Due to net/http changes in Go 1.16, HTTP proxies configured through the
$HTTP_PROXYenvironment variable are no longer used for TLS (https://) connections. Make sure you also set an$HTTPS_PROXYenvironment variable for handling requests tohttps://URLs.Refer to the HTTP/HTTPS proxy section to learn how to configure the Docker Daemon to use a proxy server.
docker build using not finding images in the local image cache on Arm machines when using BuildKit moby/moby#42954
clone3 syscall in the default seccomp policy to support running containers based on recent versions of Fedora and Ubuntu. moby/moby/#42836.docker stop could hang forever moby/moby#42956.docker scan to v0.9.02021-10-04
This release is a security release with security fixes in the CLI, runtime, as well as updated versions of the containerd.io package.
IMPORTANT
Due to net/http changes in Go 1.16, HTTP proxies configured through the
$HTTP_PROXYenvironment variable are no longer used for TLS (https://) connections. Make sure you also set an$HTTPS_PROXYenvironment variable for handling requests tohttps://URLs.Refer to the HTTP/HTTPS proxy section to learn how to configure the Docker Daemon to use a proxy server.
docker cp to prevent a specially crafted container from changing permissions of existing files in the host’s filesystem./var/lib/docker.Known issue
The
ctrbinary shipping with the static packages of this release is not statically linked, and will not run in Docker images using alpine as a base image. Users can install thelibc6-compatpackage, or download a previous version of thectrbinary as a workaround. Refer to the containerd ticket related to this issue for more details: containerd/containerd#5824.
2021-08-03
IMPORTANT
Due to net/http changes in Go 1.16, HTTP proxies configured through the
$HTTP_PROXYenvironment variable are no longer used for TLS (https://) connections. Make sure you also set an$HTTPS_PROXYenvironment variable for handling requests tohttps://URLs.Refer to the HTTP/HTTPS proxy section to learn how to configure the Docker Daemon to use a proxy server.
stack and context commands in the Docker CLI is now marked as deprecated, and will be removed in an upcoming release docker/cli#3174.Invalid standard handle identifier errors on Windows docker/cli#3132.can't open lock file /run/xtables.lock: Permission denied error on SELinux hosts moby/moby#42462.x509: certificate signed by unknown authority error on openSUSE Tumbleweed moby/moby#42462.--platform option to pull a single-arch image that does not match the specified architecture moby/moby#42633.Your kernel does not support swap memory limit warning when running with cgroups v2 moby/moby#42479.HcsShutdownComputeSystem returned an ERROR_PROC_NOT_FOUND error moby/moby#42613
Known issue
The
ctrbinary shipping with the static packages of this release is not statically linked, and will not run in Docker images using alpine as a base image. Users can install thelibc6-compatpackage, or download a previous version of thectrbinary as a workaround. Refer to the containerd ticket related to this issue for more details: containerd/containerd#5824.
2021-06-02
SIGURG signals to container on Linux and macOS. The Go runtime (starting with Go 1.14) uses SIGURG signals internally as an interrupt to support preemptable syscalls. In situations where the Docker CLI was attached to a container, these interrupts were forwarded to the container. This fix changes the Docker CLI to ignore SIGURG signals docker/cli#3107, moby/moby#42421.COPY command with a wildcard. Note that this change invalidates existing build caches for copy commands that use a wildcard. moby/buildkit#2018.FROM image is not cached when using legacy schema 1 images moby/moby#42382.ipv6.disable=1, and to fix a deadlock causing internal DNS lookups to fail moby/moby#42413.slirp4netns port driver moby/moby#42294.docker-scan-plugin) to v0.8 docker/docker-ce-packaging#545.2021-04-12
~/.dockercfg. Support for this file will be removed in a future release docker/cli#3000
docker-scan-plugin package as a recommended dependency for the docker-ce-cli package docker/docker-ce-packaging#537
2021-03-02
docker start --attach and remove spurious Unsupported signal: <nil>. Discarding messages. docker/cli#2987.2021-02-26
invalid mutable ref errors)builder prune moby/moby#42065
docker login if no config file is present docker/cli#2959
WARNING: Error loading config file: .dockercfg: $HOME is not defined docker/cli#2958
labels-regex config even if labels is not set moby/moby#42046
--update-order and --rollback-order flags when only --update-order or --rollback-order is provided docker/cli#2963
docker service rollback returning a non-zero exit code in some situations docker/cli#2964
docker service rollback docker/cli#2964
2021-02-01
2021-01-04
sd_notify STOPPING=1 when shutting down moby/moby#41832
replicated-job and global-job service modes moby/moby#41806
2020-12-14
2020-12-08
For an overview of all deprecated features, refer to the Deprecated Engine Features page.
docker pull-ing from non-compliant registries not supporting pull-by-digest docker/cli#2872
docker run --kernel-memory) moby/moby#41254 docker/cli#2652
aufs storage driver docker/cli#1484
ENV name=value instead docker/cli#2743
DOCKER_API_VERSION moby/moby#39076
docker search --automated and --stars flags docker/cli#2338
GET /events now returns prune events after pruning resources have completed moby/moby#41259 container, network, volume, image, and builder, and have a reclaimed attribute, indicating the amount of space reclaimed (in bytes)one-shot stats option to not prime the stats moby/moby#40478
/info) moby/moby#38349
RUN --mount options without needing to specify experimental dockerfile #syntax directive. moby/buildkit#1717
ARG command now supports defining multiple build args on the same line similarly to ENV moby/buildkit#1692
--chown flag in ADD now allows parameter expansion moby/buildkit#1473
--secret id=foo,env=MY_ENV as an alternative for storing a secret value to a file.--secret id=GIT_AUTH_TOKEN will load env if it exists and the file does not.-a/--all-tags to docker push docker/cli#2220
--pull=missing|always|never to run and create commands docker/cli#1498
--env-file flag to docker exec for parsing environment variables from a file docker/cli#2602
-n for --tail option docker/cli#2646
--cgroupns docker/cli#2024
docker manifest rm command to remove manifest list draft from local storage docker/cli#2449
docker ps --format flag now has a .State placeholder to print the container’s state without additional details about uptime and health check docker/cli#2000
--quiet docker/cli#2197
docker rm -v to clarify the option only removes anonymous (unnamed) volumes docker/cli#2289
--label-add/--label-rm, --container-label-add/--container-label-rm, and --env-add/--env-rm flags on docker service update to allow replacing existing values docker/cli#2668
docker rm --force returning a non-zero exit code if one or more containers did not exist docker/cli#2678
total_inactive_file instead of cache docker/cli#2415
username and password auth even if auth is empty docker/cli#2122
docker logs with all logging drivers (best effort) moby/moby#40543
splunk-index-acknowledgment log option to work with Splunk HECs with index acknowledgment enabled moby/moby#39987
docker push now defaults to latest tag instead of all tags moby/moby#40302
io.containerd.runc.v2 runtime moby/moby#41182
--device flag in docker run will now be honored when the container is started in privileged mode moby/moby#40291
CAP_PERFMON, CAP_BPF, and CAP_CHECKPOINT_RESTORE on supported kernels moby/moby#41460
--ip6tables enables IPv6 iptables rules (only if experimental) moby/moby#41622
--default-address-pool option in certain cases moby/moby#40711
DOCKER-USER chain not created when IPTableEnable=false moby/moby#40808 moby/libnetwork#2471
--exec-opt native.cgroupdriver=systemd moby/moby#40486
clock_adjtime. CAP_SYS_TIME is still required for time adjustment moby/moby#40929
--mount type=bind,bind-nonrecursive moby/moby#38788
docker, docker engine, ce, whats new, release notes
© 2019 Docker, Inc.
Licensed under the Apache License, Version 2.0.
Docker and the Docker logo are trademarks or registered trademarks of Docker, Inc. in the United States and/or other countries.
Docker, Inc. and other parties may also have trademark rights in other terms used herein.
https://docs.docker.com/engine/release-notes/