Model Runner on Windows GPUs; three CVE fixes; Microsoft App Store launch

New

• Docker Model Runner is now available on x86 Windows machines with NVIDIA GPUs.
• Push models to Docker Hub with Docker Model Runner.
• Docker Model Runner model management and chat interface in Docker Desktop for Mac and Windows.
• Docker Compose and Testcontainers (Java, Go) now support Docker Model Runner.
• Introducing Docker Desktop in the Microsoft App Store.

Upgrades

• Docker Engine v28.1.1
• Docker Compose v2.35.1
• Docker Buildx v0.23.0
• Docker Scout CLI v1.17.1
• Compose Bridge v0.0.19

Security

• Fixed CVE-2025-3224 allowing elevation of privilege when Docker Desktop updates.
• Fixed CVE-2025-4095 where RAM policies were not enforced when using macOS configuration profiles.
• Fixed CVE-2025-3911 allowing sensitive information disclosure from Docker Desktop log files.

Bug fixes and enhancements

For all platforms

• Fixed excessive open file handles in DockerVMM.
• Fixed Docker Desktop failing to start with optional configurationFileVersion missing.
• Fixed outgoing UDP connections being eagerly closed.
• Enhanced log reading with advanced search and container-level filtering.
• Improved error messages for RAM configuration downloads.
• ICMPv4 socket bind failure now logs and continues.
• Enabled memory protection keys in Linux VM for Oracle database images.
• Fixed /proc/sys/kernel/shm* sysctls with ECI enabled.
• Added kernel module nft_fib_inet for firewalld in containers.
• macOS QEMU Virtualization deprecation announced for July 14, 2025.

For Mac

• Fixed high CPU usage. Fixes docker/for-mac#7643.
• Fixed multi-arch build with Rosetta on M3 Macs.
• Fixed RAM policy restrictions when directory missing.

For Windows

• Windows .exe installer now handles locked files. Fixes docker/for-win#14299 and docker/for-win#14316.
• Fixed Docker Desktop.exe version info after installation. Fixes docker/for-win#14703.

Known issues

For all platforms

• Enforced sign-in with desktop.plist (macOS) or Registry key (Windows) combined with registry.json may cause sign-in failure.

For Windows

• Multiple organizations in allowedOrgs Windows registry key using space-separated format may cause sign-in failure.