ReleaseBytes
docker Docker Engine Releases · · 29.8.0

Docker v29.8.0 Released with Container Umask, Enhanced Security, and Swarm Fixes

infragaengineer
security feature patch

Docker v29.8.0 is now available, introducing new features like a `umask` option for containers and expanded `awslogs` driver attributes for better observability. This release also significantly strengthens container security with improved AppArmor profile configuration and policies to prevent `AF_VSOCK` abuse. Furthermore, it delivers numerous bug fixes and enhancements across Swarm networking, rootless mode, and containerd integration, improving reliability and performance for Docker users.

  • →Add daemon support for configuring the default container AppArmor profile template. moby/moby#52771
  • →See https://docker.docker.com/engine/security/apparmor/#customize-the-default-profile
  • →Fix docker network inspect failing to find a healthy Swarm network when another Swarm network could not be allocated. moby/moby#53325
  • →Fix a node gossiping a superseded value for a Swarm service discovery entry after concurrent updates to the same key. moby/moby#53479
  • →Fix Swarm service names failing to resolve on a node indefinitely after it misses a network membership announcement. moby/moby#53437
Security (3) ›
  • Add daemon support for configuring the default container AppArmor profile template. moby/moby#52771
  • See https://docker.docker.com/engine/security/apparmor/#customize-the-default-profile

  • Prevent containers from using the 32-bit socketcall(2) path to create AF_VSOCK sockets and communicate with host virtual machines by adding AppArmor and SELinux policy rules. moby/moby#53551

Features (2) ›

  • Add HostConfig.Umask option and a corresponding --umask <octal> flag to docker create/docker run to set the umask for a container's main process, execs, and healthchecks. moby/moby#53463, docker/cli#7108

  • Add support for attaching service names, environments, and custom CloudWatch entity attributes to logs from the awslogs logging driver. moby/moby#52632

Enhancements (6) ›

  • Update RootlessKit to v3.1.0, adding support for the pesto port driver in rootless mode. Set DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=pesto to use it; it requires the pasta network driver and supports IPv4 only. moby/moby#53358

  • Update minimum supported Go version to 1.26. docker/cli#7258
  • Update BuildKit to v0.33.0. moby/moby#53554
  • Update containerd (static binaries) to v2.3.4. moby/moby#53409
  • Update Go runtime to 1.26.8. moby/moby#53550, docker/cli#7274
  • Update runc (in static binaries) to v1.5.1. moby/moby#52306
Fixes (23) ›
  • Fix docker network inspect failing to find a healthy Swarm network when another Swarm network could not be allocated. moby/moby#53325
  • Fix a node gossiping a superseded value for a Swarm service discovery entry after concurrent updates to the same key. moby/moby#53479
  • Fix Swarm service names failing to resolve on a node indefinitely after it misses a network membership announcement. moby/moby#53437
  • Fix Swarm service names failing to resolve on healthy nodes after a transient node failure. moby/moby#53142
  • Fix --disable-host-loopback not being enforced for the pasta network driver in rootless mode. moby/moby#53358

  • Add annotation filter to container listings (docker ps, GET /containers/json) allowing to filter containers by their annotations. moby/moby#53538

  • containerd image store: Fix docker image inspect reporting a smaller image size than docker image ls. moby/moby#53426
  • containerd image store: Fix slower image pulls caused by repeated registry authentication within a single pull. moby/moby#53497
  • Do not log expected image signature identity misses as errors for containerd image store images. moby/moby#53495
  • dockerd now uses the embedded containerd if no system containerd service is configured and containerd is not installed. moby/moby#53388
  • Fix GET /images/{name}/json not including unpacked snapshot usage in Size when using the containerd image store. moby/moby#53426
  • Fix classic-builder cache for Dockerfile stages that select a non-host platform with FROM --platform. moby/moby#53503
  • Fix CLI panic when DOCKER_HOST or -H specifies an invalid host. docker/cli#7280
  • Fix health checks being delayed for too long when the start interval is longer than the start period. moby/moby#52317

  • Fix inconsistent mount ordering in docker inspect output (GET /containers/{id}/json) and container listings (docker ps, GET /containers/json). moby/moby#53534

  • Fix NRI container metadata so Container.Args includes the resolved executable as argv[0], matching the process launched in the container instead of only the Docker Cmd. moby/moby#53423

  • Fix Swarm service creation failing when an automatically generated name is already in use. moby/moby#53468
  • Fix the container root directory / being world-writable when using the btrfs storage driver. moby/moby#53500
  • Fixed docker ps sorting published ports lexicographically instead of numerically. docker/cli#7144
  • Preserve service mount order during forced updates to avoid an unnecessary rollout on the next stack deploy. docker/cli#7227
  • Prevent containerd's v2 CRI plugins from loading when CRI is disabled. moby/moby#53564
  • Print plugin hook output (e.g. the "What's next:" hint) after the command's error message instead of before it. docker/cli#6976
  • Reject checkpoint IDs containing path separators to prevent access outside the container checkpoint directory. moby/moby#53377
Read the original announcement →

https://github.com/moby/moby/releases/tag/docker-v29.8.0

Related releases