Docker

containerd is updated to v2.4.2, fixing CVE-2026-95839 and two other crashes or disk-exhaustion issues triggered by malformed manifests and layer fetches. Also fixes bridge networks failing to restore when bound to a non-docker firewalld zone, daemon panic with fluentd TLS and fluentd-async, and docker ps -s failing when one container's size can't be computed.

Fixed the Windows installer deleting the WSL data disk, plus docker info reporting containerized on WSL 3.0.1 which broke docker debug, and an engine restart after start when an admin policy enables Enhanced Container Isolation. Added a docker desktop auth status CLI subcommand with --format pretty|json.

A Go runtime update fixes CVE-2026-97032, CVE-2026-78659, CVE-2026-78663, CVE-2026-78669 (HTTP/2 DoS issues) and CVE-2026-56857, a Windows junction directory creation outside the data root. The containerd image store gains a lazy-pull daemon feature, enabled by default for nydus, overlaybd, soci, and stargz, plus numerous networking fixes including encrypted overlay traffic possibly sent in cleartext.

Bake now supports configuring job execution modes and parallelization limits with the --jobs/-j flag, including defer-error to delay cancellation of failed jobs and defer-output to wait for all jobs before exporting. Added an experimental buildx replay build command that rebuilds historical builds from recorded provenance, and Buildx --set overrides now use singular keys and can clear array values.

Bake --set overrides now support clearing array values with an empty parameter, and Git advice output can be controlled with BUILDKIT_GIT_ADVICE and BUILDX_BAKE_GIT_ADVICE. Updates github.com/moby/buildkit to v0.34.0-rc2 and github.com/docker/cli to v29.8.2.

New Linux containers now default to the local logging driver, and API keys are no longer written in clear text to logs and diagnostics. Also fixed Resource Saver pausing the VM before the API was ready, a multi-gigabyte error file and memory blowup on backend start failure, repeated privileged-access prompts on Mac auto-start after reboot, and Docker Desktop quitting unrelated apps on Linux.

Compose adds partial support for jobs — only manually-triggered jobs work for now, scheduled jobs are not yet available until the corresponding Docker Engine support merges. Also adds provider services with a dedicated network relay link, image distribution on demand, and a warning on unsupported compose-file attributes.

Adds partial support for jobs — only manually-triggered jobs are supported, with scheduled jobs pending Docker Engine support — plus provider service networking including a dedicated network for the relay link and on-demand image distribution. Fixed watch rebuild coalescing during bursts of file changes, logs losing a fast run's output on restart re-attach, and --parallel not being honored across all bulk engine-call fan-outs.

Bake now supports configuring job execution modes and parallelization limits with the --jobs/-j flag, including defer-error and defer-output modes, and a new experiment command docker buildx replay build rebuilds historical builds from recorded provenance. Also fixes a possible panic from result image loading and progress race, Kubernetes driver connection and AppArmor handling, and stale builder feature detection cached data.

Bake with --progress=rawjson now rejects ungranted entitlements instead of skipping the consent check, requiring explicit --allow grants. Secret files selected by an implicit id fallback and local OCI layout named contexts now require fs.read approval.

Docker Engine 29.8.2 fixes 13 security vulnerabilities: a malicious DNS response could make registry connections skip TLS certificate verification or fall back to HTTP, unprivileged users on a Swarm node could inject forged Ethernet frames into encrypted overlay networks, and pulling a crafted OCI image index could cause unbounded CPU and memory use. The BuildKit update addresses build cache poisoning via mismatched layer DiffIDs, daemon crashes from malformed LLB operations, and a source policy bypass in crafted Git build sources, plus fixes for docker cp on nested bind-mounted sockets and docker info failing after daemon reload with custom default address pools.

Fixed a security vulnerability allowing VM-side Unix socket port forwards to expose host paths, and CLI plugin updates are now managed from the app bundle, removing the Automatically update components setting. Plus platform fixes including the Linux kernel update to 7.0.14 for MongoDB 8 containers and a Windows startup crash on UTF-8 BOM config files.

Fixed published ports being unreachable when the host port was momentarily busy, in-app updates failing with a mismatched installer, and Kubernetes getting stuck on Starting. containerd was updated to v2.3.5 addressing CVE-2026-53495, plus platform-specific fixes across macOS and Windows.

containerd image store no longer leaves dangling images when docker load loads an image that already exists, and GET /networks returns a proper error instead of a 500 for an invalid type filter. Windows commits now preserve hard links, user-namespace detection works on OpenVZ, and static containerd binaries are updated to v2.3.5.

Fixed a corrupt network database blocking engine start and Docker Compose rebuilding images on Resource Saver wake. Bundles Docker Engine v29.8.0, containerd v2.3.4, and Docker Compose v5.5.1, plus fixes for inaccurate Last modified timestamps, a Hub image search regression, and spurious MSI failures on Windows.

Fixed failed multi-node image pushes leaving the requested tag pointing to a partial image, newly started container builders not getting a full readiness timeout before first use, and builder removal cleanup being tied to the status timeout. Also fixed linked Bake targets on the Kubernetes driver losing shared clients before the build completes.

Ask Gordon is now accessible as a right-side drawer, with an Ask Gordon diagnosis symbol on container, image, and volume rows with detected issues, and Kubernetes cloud clusters can be started and stopped via Docker Offload. Fixes include VM disk space leaks when replacing files on shared folders, mmap() failing on Synchronized File Share that broke git and pnpm, and a Windows startup hang after WinGet upgrade, plus a Kind cloud provider image update addressing CVE-2026-46595 and CVE-2026-39834.

Docker Compose v5.5.1 fixes docker compose watch syncing into symlinked directories and bake target name collisions for services differing by . vs _. Hook output now surfaces on failure, initial_sync syncs regardless of mtime, and the bridge command confirms before wiping a non-empty convert output dir. Plus a handful of smaller fixes across events, network IPAM, psFormat, Windows TTY, and provenance/SBOM attestation.

Fixed watch sync into symlinked directories, watch exclusion of Dockerfile and compose files on initial sync, and lifecycle hook output now captured and included in errors. Fixed Windows TTY progress display by handing real stdout to buildkit. Plus fixes for IPAM network options, dependency wait timeout surfacing, ps format precedence, and numerous other correctness issues across build, plugins, and display.

New HostConfig.Umask option and docker run/create --umask flag set the umask for a container's main process, execs, and healthchecks. AppArmor and SELinux rules now block containers from using the 32-bit socketcall(2) path to create AF_VSOCK sockets and reach host virtual machines, plus a long tail of Swarm networking and containerd image store fixes.