content/manuals/engine/release-notes/23.0.md
[!NOTE]
From Docker Engine version 23.0.0, Buildx is distributed in a separate package:
docker-buildx-plugin. In earlier versions, Buildx was included in thedocker-ce-clipackage. When you upgrade to this version of Docker Engine, make sure you update all packages. For example, on Ubuntu:console$ sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-pluginRefer to the Docker Engine installation instructions for your operating system for more details on upgrading Docker Engine.
This page describes the latest changes, additions, known issues, and fixes for Docker Engine version 23.0.
For more information about:
Starting with the 23.0.0 release, Docker Engine moves away from using CalVer versioning, and starts using the SemVer versioning format. Changing the version format is a stepping-stone towards Go module compatibility, but the repository doesn't yet use Go modules, and still requires using a "+incompatible" version. Work continues towards Go module compatibility in a future release.
{{< release-date date="2023-05-08" >}}
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
1.19.9. docker/docker-ce-packaging#889,
docker/cli#4254, moby/moby#45455containerd to v1.6.21runc to v1.1.7{{< release-date date="2023-04-26" >}}
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
--all / -a option when pruning volumes. docker/cli#4229--format=json for docker info. docker/cli#4320buildx. moby/moby#454102.17.3. docker/docker-ce-packaging#883{{< release-date date="2023-04-17" >}}
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
docker cp not functioning as intended docker/cli#4157.docker compose --file docker/cli#4177.daemon.json moby/moby#45246.1.19.8. docker/docker-ce-packaging#878,
docker/cli#4164, moby/moby#45277,
which contains fixes for CVE-2023-24537,
CVE-2023-24538,
CVE-2023-24534,
and CVE-2023-24536{{< release-date date="2023-04-04" >}}
[!NOTE]
Due to an issue with CentOS 9 Stream's package repositories, packages for CentOS 9 are currently unavailable. Packages for CentOS 9 may be added later, or as part of the next (23.0.4) patch release.
xt_bpf kernel module.{{< release-date date="2023-03-28" >}}
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
apparmor_parser when an AppArmor enabled kernel is detected. containerd/containerd#8087, moby/moby#45043VOLUME line in a Dockerfile being excluded from volume prune. moby/moby#45159COPY --link by disabling mergeop/diffop optimization. moby/moby#45112--dns-opt or --dns-search when systemd-resolved is used outside the container. moby/moby#45000docker ps by allowing users to opt out of size calculations with --size=false. docker/cli#4107docker stack deploy failing on Windows when special environment variables set by cmd.exe are present. docker/cli#4083<none>. docker/cli#40651.19.7. docker/docker-ce-packaging#857, docker/cli#4086, moby/moby#45137containerd to v1.6.19. moby/moby#45084, moby/moby#45099v0.10.4. docker/docker-ce-packaging#855v2.17.2. docker/docker-ce-packaging#867{{< release-date date="2023-02-09" >}}
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
apparmor_parser is not available. moby/moby#44942ipvlan networks created prior to upgrading would prevent the daemon from starting. moby/moby#44937overlay2 storage driver failing early in metacopy testing when initialized on an unsupported backing filesystem. moby/moby#44922exec exit events being misinterpreted as container exits under some runtimes, such as Kata Containers. moby/moby#44892runc compiled using Go 1.20. docker/cli#4004--device-write-bps as a path. docker/cli#4004/etc/docker to RPM and DEB packaging. docker/docker-ce-packaging#842
mkdir -p /etc/docker.v2.16.0. docker/docker-ce-packaging#844{{< release-date date="2023-02-01" >}}
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
docker build to docker buildx build. docker/cli#3314DOCKER_BUILDKIT=0.zstd compressed layers. moby/moby#41759, moby/moby#42862runhcs shim on Windows (off by default). moby/moby#42089dockerd --validate to check the daemon JSON config and exit. moby/moby#42393ipvlan_flag and using the l3s ipvlan_mode in the ipvlan network driver. moby/moby#42542metacopy option for the overlay2 storage driver. moby/moby#43557IDType://ID. moby/moby#43368RootlessKit, slirp4netns, and VPNKit version reporting. moby/moby#42330docker volume. docker/cli#3606docker stack. docker/cli#3662docker stack deploy. docker/cli#2907docker stack config command to output the merged and interpolated config files as utilized by stack deploy. docker/cli#3544docker context show command that prints the name of the current context. docker/cli#3567--format=json shorthand variant of --format="{{ json . }}" to all commands supporting the --format flag. docker/cli#2936--quiet option to docker create and docker run commands to suppress output when pulling an image. docker/cli#3377--force option to docker network rm subcommand. Causes CLI to return a 0 exit code even if the network doesn't exist. Has no effect on the server-side procedure for removing a network. docker/cli#3547--signal option to docker stop and docker restart. docker/cli#3614-v/--version flag to docker-proxy. moby/moby#44703STOPSIGNAL via docker commit. moby/moby#43369awslogs log driver to allow skipping log stream creation in CloudWatch. moby/moby#42132awslogs log driver to specify the log format that's sent to CloudWatch. moby/moby#42838fluentd log driver to set the reconnection interval. moby/moby#43100WithTLSClientConfigFromEnv(), WithHostFromEnv(), and WithVersionFromEnv(). moby/moby#42224docker completion subcommand. docker/cli#3429Swarm header to GET /_ping and HEAD /_ping, allowing single-request detection of Swarm support. moby/moby#42064signal parameter to POST /containers/{id}/stop and POST /containers/{id}/restart to set the signal used. moby/moby#43206CreateMountPoint parameter to POST /containers/create. moby/moby#43484shared-size parameter to GET /images/json to enable shared-size computation of images. moby/moby#42531type parameter to GET /system/df, to control what object types to are considered when computing disk usage. moby/moby#42559docker.service after time-set.target. moby/moby#43107~/.dockercfg. docker/cli#2504
-g and --graph daemon options in favor of --data-root. docker/cli#3739
Experimental client field from docker version. docker/cli#3543
overlay and overlay2 storage drivers on backing filesystems without d_type support. moby/moby#43472
overrideKernelCheck option from the overlay2 storage driver. moby/moby#44279
Deprecation noticeio.containerd.runtime.v1.linux OCI runtime. moby/moby#43695--cluster-xx options from dockerd. moby/moby#40383host-discovery and overlay networks with external k/v stores. moby/moby#42247arm platform fallback. --platform linux/arm/vY will now return a error when arm/vY isn't available instead of pulling the wrong image. moby/moby#44414SetCustomHTTPHeaders(), CustomHTTPHeaders() options-setters from the Go client API. moby/moby#42694WithDialer() option-setter from the Go client API. moby/moby#44022
WithDialContext() instead.opts.QuotedString. The implementation has moved to the CLI. moby/moby#43250KernelMemory option from POST /containers/create on API version >= 1.42. moby/moby#43214
BuilderSize on API version >= 1.42. moby/moby#42608BuildCache.Parent in favor of the newly introduced BuildCache.Parents on API version >= 1.42. moby/moby#43908pkg/urlutil, moving the implementation to builder/remotecontext/urlutil. moby/moby#434771.19.5. docker/cli#3958, moby/moby#44794rootlesskit to v0.14.4. moby/moby#42708buildkit to v0.10.6. moby/moby#43239buildx to v0.10.2. docker/docker-ce-packaging#840swarmkit to v2.0.0-20230119195359-904c221ac281. moby/moby#44858containerd to v1.6.16. moby/moby#44766, moby/moby#44769, moby/moby#44881runc to v1.1.4. moby/moby#44039hcsshim v0.9.6. moby/moby#44658btrfs storage driver now depends on Linux kernel headers (>= 4.12) instead of headers from btrfs-progs. moby/moby#44776hostconfig.json files to 0600 (was 0644). moby/moby#41620--seccomp-profile not accepting unconfined and renamed the default seccomp profile to builtin. moby/moby#42481seccomp build tag. moby/moby#42501riscv64. moby/moby#43553seccomp(2) in seccomp profiles. moby/moby#42648ErrnoRet. moby/moby#42005DefaultErrnoRet in seccomp profiles. moby/moby#42604DefaultErrnoRet field to the default seccomp profile, with no behavior change. moby/moby#42649socket with AF_VSOCK in the default seccomp profile. moby/moby#44563process_vm_readv and process_vm_writev in the default seccomp profile. moby/moby#42083clock_settime64 with CAP_SYS_TIME. moby/moby#43775bpf with CAP_BPF and perf_event_open with CAP_PERFMON. moby/moby#43988clone3 syscall to return ENOSYS in the default seccomp profile, in order to ensure glibc will correctly fallback to using clone. moby/moby#42681overlay2 to be the default storage driver (btrfs and zfs are now opt-in). moby/moby#42661docker cp command. docker/cli#2708ElectAuthServer function, and made it return the default registry without calling the GET /info API endpoint. docker/cli#2819net.JoinHostPort() to fix formatting with IPv6 addresses. docker/cli#2972stderr. docker/cli#3044docker info if a custom --format is used that only uses local information. With this change, the CLI only uses the daemon API if it detects that information from the daemon is needed. docker/cli#3179--stop-signal flag, as it may not reflect the actual default used by the daemon. docker/cli#32453.10 to docker stack; allow omitting the version field (resulting in latest). docker/cli#32573 is now equivalent to 3.x (latest) in docker stack. docker/cli#3445<Ctrl-c> hanging on Windows to exit after running a container in non-interactive mode. docker/cli#3302run command in the -v/--volume and -m/--mount flags. docker/cli#3469docker exec -t now sets the console size for the executed process immediately when it's created. docker/cli#3627docker info to provide more details on installed plugins. docker/cli#3645docker context list and docker context use commands when the context is overridden by the environment. docker/cli#3668aliases annotation that can be used to print all available aliases for a command. docker/cli#3694docker context use and selecting the current context. docker/cli#3721docker context rm --force. docker/cli#37910 in Compose files. docker/cli#3812<Ctrl-c>) now passes through to running containers instead of causing the CLI to exit. docker/cli#3849docker port CONTAINER UX by sorting ports before printing. docker/cli#3892GET /containers/{id}/logs and POST /containers/{id}/attach now report which raw-stream format is in use using the Content-type response header on API version >= 1.42. moby/moby#39812--storage-opts flag applies to all storage on Windows. moby/moby#41636/var/run/docker/containerd/containerd.toml). moby/moby#41675null manifests during tar import. moby/moby#41842btrfs driver. moby/moby#42273--privileged rootless containers. moby/moby#42638**/foo recursive wildcard directory patterns in .dockerignore. moby/moby#42676docker import --platform to allow marking an imported image as a foreign architecture. moby/moby#43103namesgenerator package against new additions. Users will have to be satisfied with the existing 25359 adjective-name combinations. moby/moby#43210containers/{id}/attach/ws only to streams according by stdin, stdout and stderr parameters on API version >= 1.42. moby/moby#43322exec starts on health checks. Check timeout now only applies to the duration that the health check command is running. The time it takes to start the command no longer counts against the timeout. moby/moby#43480tty size is set immediately on creation. moby/moby#43593, moby/moby#43622overlay2 mounts not being cleaned up after failed container starts, or daemon shutdown. moby/moby#43659containerd. moby/moby#43675firewalld for networking when the daemon is running in rootless mode. moby/moby#43813live-restore with restart policies and volume refs. moby/moby#44237all=true to prune named volumes in addition to anonymous. moby/moby#44259GET /system/df endpoint. moby/moby#42715docker logs -f on Windows, and prevent newlines from being dropped in the local log driver. moby/moby#43294--ipc=host wasn't handled correctly when the daemon is running in rootless mode. moby/moby#44863DOCKER-USER ip6tables chain. moby/moby#44845ip6tables command isn't available. moby/moby#44727CreatedAt time of a volume reflecting initialization and not creation. moby/moby#44725docker context when an invalid context is present. docker/cli#3847docker container remove as an alias for docker container rm. docker/cli#3986Some Debian users have reported issues with containers failing to start after upgrading to the 23.0 branch.
The error message indicates that the issue is due to a missing apparmor_parser binary:
Error response from daemon: AppArmor enabled on system but the docker-default profile could not be loaded: running `apparmor_parser apparmor_parser --version` failed with output:
error: exec: "apparmor_parser": executable file not found in $PATH
Error: failed to start containers: somecontainer
The workaround to this issue is to install the apparmor package manually:
apt-get install apparmor
Attempting to build an image with BuildKit's inline cache feature (e.g. docker build --build-arg BUILDKIT_INLINE_CACHE=1 ., docker buildx build --cache-to type=inline .) will result in the daemon unexpectedly exiting:
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x18 pc=0x147ff00]
goroutine 693 [running]:
github.com/docker/docker/vendor/github.com/moby/buildkit/cache.computeBlobChain.func4.1({0x245cca8, 0x4001394960})
/go/src/github.com/docker/docker/vendor/github.com/moby/buildkit/cache/blobs.go:206 +0xc90
github.com/docker/docker/vendor/github.com/moby/buildkit/util/flightcontrol.(*call).run(0x40013c2240)
/go/src/github.com/docker/docker/vendor/github.com/moby/buildkit/util/flightcontrol/flightcontrol.go:121 +0x64
sync.(*Once).doSlow(0x0?, 0x4001328240?)
/usr/local/go/src/sync/once.go:74 +0x100
sync.(*Once).Do(0x4001328240?, 0x0?)
/usr/local/go/src/sync/once.go:65 +0x24
created by github.com/docker/docker/vendor/github.com/moby/buildkit/util/flightcontrol.(*call).wait
The daemon will restart if configured to do so (e.g. via systemd) after such a crash. The only available mitigation in this release is to avoid performing builds with the inline cache feature enabled.
If an image was built with BuildKit on a previous version of the daemon, and is built with a 23.0 daemon, previously cached layers will not be restored correctly. The image may appear to build correctly if no lines are changed in the Dockerfile; however, if partial cache invalidation occurs due to changing some lines in the Dockerfile, the still valid and previously cached layers will not be loaded correctly.
This most often presents as files that should be present in the image not being present in a RUN stage, or any other stage that references files, after changing some lines in the Dockerfile:
[+] Building 0.4s (6/6) FINISHED
=> [internal] load build definition from Dockerfile
=> => transferring dockerfile: 102B
=> [internal] load .dockerignore
=> => transferring context: 2B
=> [internal] load metadata for docker.io/library/node:18-alpine
=> [base 1/2] FROM docker.io/library/node:18-alpine@sha256:bc329c7332cffc30c2d4801e38df03cbfa8dcbae2a7a52a449db104794f168a3
=> CACHED [base 2/2] WORKDIR /app
=> ERROR [stage-1 1/1] RUN uname -a
------
> [stage-1 1/1] RUN uname -a:
#0 0.138 runc run failed: unable to start container process: exec: "/bin/sh": stat /bin/sh: no such file or directory
------
Dockerfile:5
--------------------
3 |
4 | FROM base
5 | >>> RUN uname -a
6 |
--------------------
ERROR: failed to solve: process "/bin/sh -c uname -a" did not complete successfully: exit code: 1
To mitigate this, the previous build cache must be discarded. docker builder prune -a will completely empty the build cache, and allow the affected builds to proceed again by removing the mishandled cache layers.
When upgrading to the 23.0 branch, the existence of any ipvlan networks will prevent the daemon from starting:
panic: interface conversion: interface {} is nil, not string
goroutine 1 [running]:
github.com/docker/docker/libnetwork/drivers/ipvlan.(*configuration).UnmarshalJSON(0x40011533b0, {0x400069c2d0, 0xef, 0xef})
/go/src/github.com/docker/docker/libnetwork/drivers/ipvlan/ipvlan_store.go:196 +0x414
encoding/json.(*decodeState).object(0x4001153440, {0x5597157640?, 0x40011533b0?, 0x559524115c?})
/usr/local/go/src/encoding/json/decode.go:613 +0x650
encoding/json.(*decodeState).value(0x4001153440, {0x5597157640?, 0x40011533b0?, 0x559524005c?})
/usr/local/go/src/encoding/json/decode.go:374 +0x40
encoding/json.(*decodeState).unmarshal(0x4001153440, {0x5597157640?, 0x40011533b0?})
/usr/local/go/src/encoding/json/decode.go:181 +0x204
encoding/json.Unmarshal({0x400069c2d0, 0xef, 0xef}, {0x5597157640, 0x40011533b0})
/usr/local/go/src/encoding/json/decode.go:108 +0xf4
github.com/docker/docker/libnetwork/drivers/ipvlan.(*configuration).SetValue(0x4000d18050?, {0x400069c2d0?, 0x23?, 0x23?})
/go/src/github.com/docker/docker/libnetwork/drivers/ipvlan/ipvlan_store.go:230 +0x38
To mitigate this, affected users can downgrade and remove the network, then upgrade again.
Alternatively, the entire network store can be removed, and networks can be recreated after the upgrade. The network store is located at /var/lib/docker/network/files/local-kv.db. If the daemon is using an alternate --data-root, substitute /var/lib/docker for the alternate path.
The 23.0 branch brings support for alternate containerd shims, such as io.containerd.runsc.v1 (gVisor) and io.containerd.kata.v2 (Kata Containers).
When using the Kata Containers runtime, exiting an exec session stops the running container, and hangs the connected CLI if a TTY was opened. There is no mitigation at this time beyond avoiding execing into containers running on the Kata runtime.
The root cause of this issue is a long-standing bug in Moby. This will be resolved in a future release. Be advised that support for alternate OCI runtimes is a new feature and that similar issues may be discovered as more users start exercising this functionality.