Update dependency docker to v29#4364
Open
govuk-ci wants to merge 1 commit into
Open
Conversation
govuk-ci
added
dependencies
Contributor
|
We can't do this update yet, our current image building process doesn't work with containerd image storage, but we are very shortly going to drop x86 and rewrite the build process, at which point we should be able to perform the update to v29+ |
govuk-ci
force-pushed
the
renovate/docker-29.x
branch
18 times, most recently
from
June 22, 2026 17:03
15e07e4 to
5691f14
Compare
govuk-ci
force-pushed
the
renovate/docker-29.x
branch
6 times, most recently
from
June 26, 2026 13:04
d178225 to
b3610be
Compare
govuk-ci
force-pushed
the
renovate/docker-29.x
branch
23 times, most recently
from
July 8, 2026 16:03
23904e3 to
b9fe102
Compare
govuk-ci
force-pushed
the
renovate/docker-29.x
branch
6 times, most recently
from
July 13, 2026 16:04
a511e0d to
2e68d0e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
version=28.5.2→v29.6.2Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
moby/moby (docker)
v29.6.2: v29.6.2Compare Source
29.6.2
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Security
This release includes fixes for multiple security vulnerabilities affecting Docker Engine.
/tmpdirectory. GHSA-32pv-7hq5-qhwqPackaging updates
Rootless
v29.6.1: v29.6.1Compare Source
29.6.1
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Security
This release includes fixes for multiple security vulnerabilities affecting Docker Engine.
/etc/passwdor/etc/group-style file causing excessive memory consumption, potentially resulting in process termination due to Out Of Memory (OOM) conditions. GHSA-mjcv-p78q-w5fw, GHSA-jpcc-p29g-p8mq, GHSA-72x6-4j93-7w86Bug fixes and enhancements
Packaging updates
v29.6.0: v29.6.0Compare Source
29.6.0
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
New
POST /containers/{id}/updatenow supports per-device blkio resource settings. moby/moby#52651GET /images/{name}/attestationsendpoint to retrieve in-toto attestation statements (such as SLSA provenance and SPDX SBOM) attached to an image. Supports optional platform selection, predicate type filtering, and a statement query parameter for verbatim statement bodies.Bug fixes and enhancements
docker image pushnow respectsNO_COLOR. docker/cli#6957docker system pruneto include unpacked image data when reporting reclaimed space. moby/moby#52905docker system dfimage size reporting to count only snapshots directly used by images. moby/moby#52901COPY --chmodpermissions. moby/moby#52892--passwordflag ondocker loginnow accepts-to pass the password through STDIN as alternative to--password-stdin. docker/cli#7029Packaging updates
Networking
nftcommand is not installed on the system. moby/moby#52820net.ipv4.ip_local_reserved_portswhen dynamically allocating ports. moby/moby#52818nftcommand instead. Users building dockerd from source can opt into linking against libnftables by building with thelibnftablesbuild tag. moby/moby#52886Rootless
Deprecations
v29.5.3: v29.5.3Compare Source
29.5.3
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Bug fixes and enhancements
docker system dferrors when images are pruned at the same time with the containerd image store. moby/moby#52672Packaging updates
Rootless
gvisor-tap-vsockand UDP port forwarding for non-loopback clients. moby/moby#52710v29.5.2: v29.5.2Compare Source
29.5.2
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Bug fixes and enhancements
docker cpfailing with "mkdirat: file exists" when a container has a bind mount whose target traverses an in-container symlink (e.g./var/run -> /run). moby/moby#52655v29.5.1: v29.5.1Compare Source
29.5.1
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Security
This release includes fixes for multiple security vulnerabilities affecting Docker Engine.
CVE-2026-41567 Fix a vulnerability in
docker cpwhere archive decompression binaries (e.g.xz,unpigz) were resolved viaPATHinside the container filesystem while running as host root, allowing a malicious container to execute arbitrary binaries with host root privileges.GHSA-x86f-5xw2-fm2r
CVE-2026-41568 Fix a TOCTOU vulnerability in
docker cpthat allowed a container process to create files or directories at arbitrary locations on the host filesystem.GHSA-vp62-88p7-qqf5
CVE-2026-42306 Fix a TOCTOU vulnerability in
docker cpthat allowed a container process to redirect a bind mount to an arbitrary location on the host filesystem.GHSA-rg2x-37c3-w2rh
Networking
v29.5.0: v29.5.0Compare Source
29.5.0
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
New
gvisor-tap-vsocknetwork driver. moby/moby#52319locallogging driver now has support for custom attributes, adding support for thelabel,label-regex,env,env-regex, andtaglog options. moby/moby#52348-H unix://...), with optional group-based access control via--group. moby/moby#52365Security
Bug fixes and enhancements
docker ps --formatnow supports a.HealthStatusplaceholder to print container health state (starting,healthy,unhealthy) as a dedicated field. docker/cli#6913docker info. moby/moby#52321docker image ls --filter reference=...(GET /images/json) to also match fully qualified canonical image names (e.g.docker.io/library/alpine), not only the familiar short form. moby/moby#52333docker system df -vby including shared content blobs in size calculation. moby/moby#52482volume,network,config, andsecretformatters for deterministic output. docker/cli#6954Packaging updates
Networking
--net=hostand localhost registries. moby/moby#47103Rootless
Go SDK
GetAuthConfig,GetCredentialsStore: normalize hostname when resolving auth. docker/cli#6846Deprecations
DefaultDockerfileNameconst. docker/cli#6737DetectArchiveReaderutil. docker/cli#6737IsArchiveutility. docker/cli#6737ResolveAndValidateContextPathutil. docker/cli#6737WriteTempDockerfileutil. docker/cli#6737v29.4.3: v29.4.3Compare Source
29.4.3
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Bug fixes
CVE-2026-31431: Fix the 29.4.2 regression that broke 32-bit programs and i386 images. The broad socketcall(2) seccomp deny is replaced with targeted AppArmor (deny network alg) and SELinux (alg_socket) rules that block AF_ALG at the LSM layer, covering both socket(2) and socketcall(2) paths without disrupting legitimate 32-bit workloads. moby/moby#52537
On SELinux-based systems, the SELinux mitigation requires the daemon to be configured with
selinux-enabled: true(viadaemon.jsonor the--selinux-enabledCLI flag). This option is not enabled by default.Fix the default AppArmor profile not being updated on daemon restart, requiring a system reboot to pick up profile changes from daemon upgrades. moby/moby#52537
v29.4.2: v29.4.2Compare Source
29.4.2
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Security
This release includes hardening for CVE-2026-31431.
AF_ALGsockets and thesocketcall(2)multiplexer in the default seccomp profile to prevent in-container privilege escalation via the kernel crypto API ("Copy Fail"). moby/moby#52501Known issues
The hardening can break 32-bit programs and i386 images, including SteamCMD and some Wine-based workloads. moby/moby#52506
Workaround
If you need a workaround, use the
seccomp/v0.2.1profile frommoby/profiles.Make sure you use a kernel that includes the fix for CVE-2026-31431.
This profile unblocks
socketcallwhile keepingAF_ALGblocked forsocket.Download the
seccomp/v0.2.1profile:Use one of these options. You don't need both.
docker runcommand, use--security-opt:$ docker run --security-opt seccomp=<path> ...seccomp-profileto yourdaemon.json:{ "seccomp-profile": "/etc/docker/seccomp-profile-v0.2.1.json" }v29.4.1: v29.4.1Compare Source
29.4.1
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Bug fixes and enhancements
docker image prune --filter label!=key=valueincorrectly skipping images that don't have the specified label. moby/moby#52338--log-opt "tag={{.ImageID}}"not stripping the digest's algorithm. moby/moby#52343EBUSYon secrets/configs remount) on busy Swarm nodes by retrying the read-only remount. moby/moby#52235Packaging updates
Networking
v29.4.0: v29.4.0Compare Source
29.4.0
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Bug fixes and enhancements
docker stats --allstill showing containers that were removed. docker/cli#6863--security-opt apparmor=<profile>) after a container restart. moby/moby#52215docker rm --linkand exclude legacy links for container names. docker/cli#6872DOCKER_TMPDIRnot being respected. moby/moby#52181Packaging updates
Networking
Go SDK
Deprecations
HookMessageand rename tocli-plugins/hooks.Response. docker/cli#6859HookTypeand rename tocli-plugins/hooks.ResponseType. docker/cli#6859HookPluginDataand move tocli-plugins/hooks.Request. docker/cli#6859v29.3.1: v29.3.1Compare Source
29.3.1
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Security
This release includes fixes for multiple security vulnerabilities affecting Docker Engine and related components.
CVE-2026-34040 Fix an authorization bypass in AuthZ plugins that could allow authorization plugins to be bypassed under specific conditions.
GHSA-x744-4wpc-v9h2
CVE-2026-33997 Fix a flaw in
docker plugin installwhere privilege validation could be partially bypassed, potentially leading to unauthorized privilege escalation.GHSA-pxq6-2prw-chj9
CVE-2026-33748 Fix insufficient validation of Git URL
#ref:subdirfragments in BuildKit, which could allow access to files outside the intended repository scope.GHSA-4vrq-3vrq-g6gg
CVE-2026-33747 Fix a vulnerability in BuildKit where an untrusted frontend could cause files to be written outside the BuildKit state directory.
GHSA-3c29-8rgm-jvjj
Bug fixes and enhancements
.dockerignorecontained an invalid pattern. moby/moby#52214Packaging updates
Go SDK
cannot range over 10 (untyped int constant)when importing thecli/commandpackage. docker/cli#6884v29.3.0: v29.3.0Compare Source
29.3.0
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
New
bind-create-srcoption to--mountflag for bind mounts. docker/cli#6792Packaging updates
Networking
API
POST /networks/{id}/connectnow correctly applies theMacAddressfield inEndpointSettings. This field was added in API v1.44, but was previously ignored. moby/moby#52040GET /images/jsonnow supports anidentityquery parameter. When set, the response includes manifest summaries and may include anIdentityfield for each manifest with trusted identity and origin information. moby/moby#52030Bug fixes and enhancements
--gpusoption now uses CDI-based injection for AMD GPUs. moby/moby#52048sd_notify"RELOADING" notifications when signalling the daemon to reload its configuration. moby/moby#52041Type=notify-reloadservice reload protocol. moby/moby#52041docker system prunefailing with "rw layer snapshot not found" when a container is concurrently removed. moby/moby#52090docker topon a non-running Windows container. moby/moby#52025v29.2.1: v29.2.1Compare Source
29.2.1
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Bug fixes and enhancements
docker system dffailing when run concurrently withdocker system prune. moby/moby#51979docker network prune. moby/moby#51966v29.2.0: v29.2.0Compare Source
29.2.0
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
New
docker infonow includesNRIsection. docker/cli#6710Identityfield has been added to the inspect endpoint to show trusted origin information about the image. This includes build ref for locally built images, remote registry repository for pulled images, and verified signature information for images that contain a valid signed provenance attestation. moby/moby#51737Bug fixes and enhancements
--detach-keyscommand-line options. docker/cli#6742--validateflag on dockerd now also verifies system requirements, allowing for system requirements to be checked before starting the daemon. moby/moby#51868--gpusrequests for NVIDIA devices using CDI if possible. moby/moby#50228Packaging updates
Rootless
$XDG_CONFIG_HOME/cdiand$XDG_RUNTIME_DIR/cdiwhen looking for CDI devices. moby/moby#51624API
Go SDK
Deprecations
%PROGRAMDATA%\Docker\cli-pluginsfrom the list of paths used for CLI plugins on Windows. This path was present for backward compatibility with old installation, but replaced by%ProgramFiles%\Docker\cli-plugins. docker/cli#6713v29.1.5: v29.1.5Compare Source
29.1.5
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Packaging updates
Networking
v29.1.4: v29.1.4Compare Source
29.1.4
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Bug fixes and enhancements
docker run --network nonepanic on Windows. moby/moby#51830Packaging updates
v29.1.3: v29.1.3Compare Source
29.1.3
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Bug fixes and enhancements
docker stack deploy --compose-file. docker/cli#6690docker buildto ignore the explicitly setunpackimage exporter option. moby/moby#51514docker image lsdangling image handling. docker/cli#6704"storage-driver") being treated as containerd snapshotter when prior graphdriver state exists. moby/moby#51516Networking
PublishAlland a nilPortBindingsmap. moby/moby#51691v29.1.2: v29.1.2Compare Source
29.1.2
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Security
Bug fixes and enhancements
docker image inspectfailing to return available image data in case where not all distributable blobs are available locally. moby/moby#51629nsenter: no namespace specified. moby/moby#51622docker system dfshowingN/Afor shared size and unique size when using graph-drivers as storage. moby/moby#51631Packaging updates
Networking
HostConfig.PublishAllPortsset (-P), and no port bindings. moby/moby#51621v29.1.1: v29.1.1Compare Source
29.1.1
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Networking
v29.1.0: v29.1.0Compare Source
29.1.0
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Packaging updates
Networking
/etc/resolv.confacross container restarts. moby/moby#51507--publish-all/-Pfor Windows containers. moby/moby#51586[::ffff:0.0.0.0]:8080->80/tcpinstead of0.0.0.0:8080->80/tcp. moby/moby#51587v29.0.4: v29.0.4Compare Source
29.0.4
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Bug fixes and enhancements
docker image lsno longer truncates the image names. docker/cli#6675Networking
v29.0.3: v29.0.3Compare Source
29.0.3
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Bug fixes and enhancements
docker version --format json: restore top-levelBuildTimefield to use RFC3339Nano format. docker/cli#6668docker image lsignoring a customimageFormatfromdocker.json. docker/cli#6667Networking
v29.0.2: v29.0.2Compare Source
29.0.2
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Networking
v29.0.1: v29.0.1Compare Source
29.0.1
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Bug fixes and enhancements
docker image lsno longer truncates the name width when output is redirect (e.g. forgrep). docker/cli#6656docker image lsnow considers theNO_COLORenvironment variable for choosing the colored output. docker/cli#6654docker buildto ignore the explicitly setunpackimage exporter option. moby/moby#51514docker image ls --allto not show untagged/dangling images. docker/cli#6657"storage-driver") being treated as containerd snapshotter when prior graphdriver state exists. moby/moby#51516ApiVersionandMinApiVersionfields indocker version --format=jsonto align with previous versions. docker/cli#6648Networking
This PR has been generated by Mend Renovate.