ReleaseBytes
docker Docker Engine Releases · · 29.7.0

Docker 29.7.0: Embedded containerd, security fix, and numerous enhancements

securityinfrasecurity-advisory
security feature patch

Docker 29.7.0 introduces an experimental embedded containerd feature, moving it into the daemon process for potentially simpler management. This release also addresses a security vulnerability (CVE-2026-17106) affecting Docker Engine and related components, requiring updates for all users. Several bug fixes and enhancements are included, such as improved networking reliability and updates to underlying dependencies like Go and runc.

  • →Add the default-stop-timeout daemon option to configure the stop timeout assigned to containers without an explicit timeout. moby/moby#53146
  • →Update github.com/moby/go-archive to v0.3.0 to fix CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h. moby/moby#53247, docker/cli#7139
  • →Fix a daemon panic when removing swarm ingress ports after failing to bind an ingress proxy listener. moby/moby#53022
  • →Add shell completion for --filter names and known values to docker service ls, docker service ps, and docker node ps. docker/cli#7124
  • →containerd image store: Fix daemon-wide concurrent download and upload limits for pulls and pushes not being honored. moby/moby#53081
Security (1) ›
  • Update github.com/moby/go-archive to v0.3.0 to fix CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h. moby/moby#53247, docker/cli#7139
Features (2) ›

  • Add an experimental embedded-containerd feature that runs containerd inside the daemon process instead of as a separate managed process. moby/moby#52898

  • Add the default-stop-timeout daemon option to configure the stop timeout assigned to containers without an explicit timeout. moby/moby#53146
Enhancements (4) ›
  • Update Go runtime to 1.26.5. docker/cli#7087
  • Update BuildKit to v0.32.0. moby/moby#53234
  • Update containerd (static binaries) to v2.3.3. moby/moby#53050
  • Update runc (in static binaries) to v1.4.3. moby/moby#50960
Fixes (15) ›

  • Fix a daemon panic when cleanup of a container's network interface fails while the container is being disconnected from a network. moby/moby#53237

  • Fix a daemon panic when removing swarm ingress ports after failing to bind an ingress proxy listener. moby/moby#53022
  • Add shell completion for --filter names and known values to docker service ls, docker service ps, and docker node ps. docker/cli#7124
  • containerd image store: Fix daemon-wide concurrent download and upload limits for pulls and pushes not being honored. moby/moby#53081
  • To preserve the previous unlimited startup behavior, configure "max-concurrent-downloads" and "max-concurrent-uploads" to 0
  • Fix docker cp -a using the wrong file owner when copying files into containers with user namespace remapping enabled. moby/moby#53084

  • Fix docker cp from a Windows container silently returning a file instead of an error when the source path ends with a separator but is not a directory. moby/moby#53123

  • Fix docker stats reporting all zeros for running Windows containers when using the containerd runtime. moby/moby#53101
  • Fix docker stats reporting empty network stats for running Windows containers when using the containerd runtime. moby/moby#53219
  • Fix a typo in the docker create --pull flag description. docker/cli#7103

  • Fix Swarm service updates failing due to "file exists" errors when a VIP IP alias already exists on the LB endpoint interface. moby/moby#51657

  • Fix Swarm tasks being rejected when their image could not be pulled from the registry but was already present on the node. moby/moby#53212
  • Improve the error returned when a container hostname exceeds Linux's 64-byte limit. moby/moby#53121
  • Prevent live-restored volumes from retaining active mount references when containers exit during daemon startup. moby/moby#53115
  • Suppress the “No such container” error when docker rm --force succeeds for a nonexistent container. docker/cli#7110
Read the original announcement →

https://github.com/moby/moby/releases/tag/docker-v29.7.0

Related releases