Docker

Engine 29.6.0 shipped per-device blkio updates and image attestation retrieval, while Compose v5.3.0 added native init containers.

Engine 29.6.1 fixed four security vulnerabilities. A malicious image could supply crafted /etc/passwd or /etc/group files causing excessive memory consumption and potential OOM termination. A custom frontend could also send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even without the security.insecure entitlement. Engine 29.6.0 also fixed docker system prune to include unpacked image data in reclaimed space reporting on the containerd image store, corrected COPY --chmod permissions being filtered by the daemon umask, and fixed image selection on amd64 hosts when images provide variant-specific manifests.

Compose v5.3.0 introduced native init container support. Containers defined as pre-start init containers now run before service containers, offering a native Compose syntax. The release also fixed OCI authorizer token routing and scoped running events to project services. The v5.2.0 reconciliation algorithm (comparing observed vs. expected state) was refined in v5.3.0 with hashed resolved service refs.

Desktop 4.80.0 shipped. No notable new features were called out for this release. Desktop 4.79.0 preceded it without major changes. Desktop 4.78.0 fixed VNC-alt remote sessions not being cleaned up on Mac, a crash on M-series Macs with IPv6 Docker socket, and a Git credential issue for non-AD MS Entra ID users authenticating with ACR. Desktop 4.77.0 fixed a DNS bug where the 127.0.0.1 nameserver in WSL caused pod startup failures.

Buildx v0.35.0 added a destructive local output mode. The mode=delete attribute for build and bake commands replaces the destination directory with the build result (like rsync --delete). Restricted to subdirectories of the working directory by default; other destinations require --allow=buildx.local.delete or TUI confirmation. Source policies now support BuildKit's new exec proxy feature.