content/manuals/engine/release-notes/19.03.md
2021-02-01
2020-12-01
2020-09-16
--cache-from behavior more reliable moby/moby#412222020-06-18
2020-06-01
Disable IPv6 Router Advertisements to prevent address spoofing. CVE-2020-13401
Description
In the Docker default configuration, the container network interface is a virtual ethernet link going to the host (veth interface).
In this configuration, an attacker able to run a process as root in a container can send and receive arbitrary packets to the host using the CAP_NET_RAW capability (present in the default configuration).
If IPv6 is not totally disabled on the host (via ipv6.disable=1 on the kernel cmdline), it will be either unconfigured or configured on some interfaces, but it’s pretty likely that ipv6 forwarding is disabled, that is, /proc/sys/net/ipv6/conf//forwarding == 0. Also by default, /proc/sys/net/ipv6/conf//accept_ra == 1. The combination of these 2 sysctls means that the host accepts router advertisements and configures the IPv6 stack using them.
By sending “rogue” router advertisements from a container, an attacker can reconfigure the host to redirect part or all of the IPv6 traffic of the host to the attacker-controlled container.
Even if there was no IPv6 traffic before, if the DNS returns A (IPv4) and AAAA (IPv6) records, many HTTP libraries will try to connect via IPv6 first then fallback to IPv4, giving an opportunity to the attacker to respond. If by chance the host has a vulnerability like last year’s RCE in apt (CVE-2019-3462), the attacker can now escalate to the host.
As CAP_NET_ADMIN is not present by default for Docker containers, the attacker can’t configure the IPs they want to MitM, they can’t use iptables to NAT or REDIRECT the traffic, and they can’t use IP_TRANSPARENT.
The attacker can however still use CAP_NET_RAW and implement a tcp/ip stack in user space.
See kubernetes/kubernetes#91507 for related issues.
2020-05-29
2020-05-14
2020-03-10
2020-03-03
2020-02-12
2019-11-14
entitlements in builder config. docker/engine#4122019-10-17
DOCKER-USER iptables chain issue. docker/engine#404code = ResourceExhausted desc = grpc: received message larger than max (5351376 vs. 4194304). This does not indicate any failure or misconfiguration by the user,
and requires no response.404
error after being deployed.
docker service update --force.docker pause container before doing file operations. moby/moby#39252docker cp regression due to CVE mitigation. An error is produced when the source of docker cp is set to /.2019-10-08
runc in containerd. CVE-2017-18367Fix builder-next: resolve digest for third party registries. docker/engine#339
Fix builder-next: user namespace builds when daemon started with socket activation. docker/engine#373
Fix builder-next; session: release forwarded ssh socket connection per connection. docker/engine#373
Fix build-next: llbsolver: error on multiple cache importers. docker/engine#373
Added support for Docker Template 0.1.6.
Mitigate against YAML files that have excessive aliasing. docker/cli#2119
Bump Golang to 1.12.10. docker/engine#387
Bump containerd to 1.2.10. docker/engine#385
Distribution: modify warning logic when pulling v2 schema1 manifests. docker/engine#368
Fix POST /images/create returning a 500 status code when providing an incorrect platform option. docker/engine#365
Fix POST /build returning a 500 status code when providing an incorrect platform option. docker/engine#365
Fix panic on 32-bit ARMv7 caused by misaligned struct member. docker/engine#363
Fix to return "invalid parameter" when linking to non-existing container. docker/engine#352
Fix overlay2: busy error on mount when using kernel >= 5.2. docker/engine#332
Fix docker rmi stuck in certain misconfigured systems, e.g. dead NFS share. docker/engine#335
Fix handling of blocked I/O of exec'd processes. docker/engine#296
Fix jsonfile logger: follow logs stuck when max-size is set and max-file=1. docker/engine#378
DOCKER-USER iptables chain is missing: docker/for-linux#810.
Users cannot perform additional container network traffic filtering on top of
this iptables chain. You are not affected by this issue if you are not
customizing iptable chains on top of DOCKER-USER.
iptables -N DOCKER-USER
iptables -I FORWARD -j DOCKER-USER
iptables -A DOCKER-USER -j RETURN
code = ResourceExhausted desc = grpc: received message larger than max (5351376 vs. 4194304). This does not indicate any failure or misconfiguration by the user,
and requires no response.404
error after being deployed.
docker service update --force.docker pause container before doing file operations. moby/moby#39252docker cp regression due to CVE mitigation. An error is produced when the source of docker cp is set to /.2019-09-03
Fix COPY --from to non-existing directory on Windows. moby/moby#39695
Fix builder-next: metadata commands not having created time in history. moby/moby#39456
Fix builder-next: close progress on layer export error. moby/moby#39782
Update buildkit to 588c73e1e4. moby/moby#39781
Fix Windows absolute path detection on non-Windows docker/cli#1990
Fix to zsh completion script for docker login --username.
Fix context: produce consistent output on context create. docker/cli#1985
Fix support for HTTP proxy env variable. docker/cli#2059
Bump Golang to 1.12.8.
Fix a potential engine panic when using XFS disk quota for containers. moby/moby#39644
In some circumstances with large clusters, docker information might, as part of the Swarm section,
include the error code = ResourceExhausted desc = grpc: received message larger than max (5351376 vs. 4194304). This does not indicate any failure or misconfiguration by the user,
and requires no response.
Orchestrator port conflict can occur when redeploying all services as new. Due to many swarm manager
requests in a short amount of time, some services are not able to receive traffic and are causing a 404
error after being deployed.
docker service update --force.Traffic cannot egress the HOST because of missing Iptables rules in the FORWARD chain The missing rules are :
/sbin/iptables --wait -C FORWARD -o docker_gwbridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables --wait -C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
CVE-2018-15664 symlink-exchange attack with directory traversal. Workaround until proper fix is available in upcoming patch release: docker pause container before doing file operations. moby/moby#39252
docker cp regression due to CVE mitigation. An error is produced when the source of docker cp is set to /.
2019-07-25
In some circumstances, in large clusters, docker information might, as part of the Swarm section,
include the error code = ResourceExhausted desc = grpc: received message larger than max (5351376 vs. 4194304). This does not indicate any failure or misconfiguration by the user,
and requires no response.
Orchestrator port conflict can occur when redeploying all services as new. Due to many swarm manager
requests in a short amount of time, some services are not able to receive traffic and are causing a 404
error after being deployed.
docker service update --force.Traffic cannot egress the HOST because of missing Iptables rules in the FORWARD chain The missing rules are :
/sbin/iptables --wait -C FORWARD -o docker_gwbridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables --wait -C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
CVE-2018-15664 symlink-exchange attack with directory traversal. Workaround until proper fix is available in upcoming patch release: docker pause container before doing file operations. moby/moby#39252
docker cp regression due to CVE mitigation. An error is produced when the source of docker cp is set to /.
2019-07-22
Fixed COPY --from to preserve ownership. moby/moby#38599
builder-next:
--cache-from. docker/engine#215stopprogress called on download error. docker/engine#215resolv.conf. docker/engine#260.docker/dockerfile:1.1 by default.
docker/engine#215--pids-limit flag to docker update. docker/cli#1765template_driver in compose files. docker/cli#1746--device support for Windows. docker/cli#1606--mount type=bind,bind-nonrecursive,... docker/cli#1430--domainname flag. docker/cli#1130docker stack deploy. docker/cli#1783Configs as CredentialSpecs on services.
docker/cli#1781--security-opt systempaths=unconfined support. docker/cli#1808docker run. docker/cli#1767docker system info output now segregates information relevant to the client and daemon.
docker/cli#1638x-pull-secret: some-pull-secret in
compose-files service configs. docker/cli#1617x-pull-policy: <Never|Always|IfNotPresent>
in compose-files service configs. docker/cli#1617/info endpoint, and moved detection to the daemon.
moby/moby#37502/_ping endpoint. moby/moby#38570Cache-Control headers to disable caching /_ping endpoint.
moby/moby#38569containerd, runc, and docker-init versions to /version.
moby/moby#37974/grpc endpoint and registered BuildKit's controller.
moby/moby#38990io_pgetevents(). moby/moby#38895ptrace(2) for 4.8+ kernels now allowed. moby/moby#38137dockerd as a non-root user (Rootless mode) is now allowed.
moby/moby#380050lxc-user-nic SUID binary.
docker/engine#208--device support for Windows. moby/moby#37638memory.kernelTCP support for linux. moby/moby#37043idtools.LookupGroup instead of parsing /etc/group file for docker.sock ownership to
fix: api.go doesn't respect nsswitch.conf. moby/moby#38126containerd to 1.2.6. moby/moby#39016runc to 1.0.0-rc8, opencontainers/selinux v1.2.2. docker/engine#210google.golang.org/grpc to v1.20.1. docker/engine#215docker --init with /dev bind mount. moby/moby#37665--device-read-bps option.
moby/moby#39212Path does not exist error when path definitely exists. moby/moby#39251--network-rm.
docker/engine#213PortBindings to IPv4zero (0.0.0.0).
docker/libnetwork#2376IMAGE_NAME attribute to journald log events. moby/moby#38032aufs storage driver and added warning. moby/moby#38090For more information on deprecated flags and APIs, refer to deprecation information for target removal dates.
In some circumstances with large clusters, docker information might, as part of the Swarm section,
include the error code = ResourceExhausted desc = grpc: received message larger than max (5351376 vs. 4194304). This does not indicate any failure or misconfiguration by the user,
and requires no response.
Orchestrator port conflict can occur when redeploying all services as new. Due to many swarm manager
requests in a short amount of time, some services are not able to receive traffic and are causing a 404
error after being deployed.
docker service update --force.Traffic cannot egress the HOST because of missing Iptables rules in the FORWARD chain The missing rules are :
/sbin/iptables --wait -C FORWARD -o docker_gwbridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables --wait -C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
CVE-2018-15664 symlink-exchange attack with directory traversal. Workaround until proper fix is available in upcoming patch release: docker pause container before doing file operations. moby/moby#39252
docker cp regression due to CVE mitigation. An error is produced when the source of docker cp is set to /.