content/manuals/engine/release-notes/25.0.md
This page describes the latest changes, additions, known issues, and fixes for Docker Engine version 25.0.
For more information about:
{{< release-date date="2024-03-19" >}}
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
This release contains a security fix for CVE-2024-29018, a potential data exfiltration from 'internal' networks via authoritative DNS servers.
CVE-2024-29018: Do not forward requests to external DNS servers for a container that is only connected to an 'internal' network. Previously, requests were forwarded if the host's DNS server was running on a loopback address, like systemd's 127.0.0.53. moby/moby#47589
plugin: fix mounting /etc/hosts when running in UserNS. moby/moby#47588
rootless: fix open /etc/docker/plugins: permission denied. moby/moby#47587
Fix multiple parallel docker build runs leaking disk space. moby/moby#47527
{{< release-date date="2024-03-07" >}}
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
docker start failing when used with --checkpoint moby/moby#47466xattrs created on a non-Linux OS moby/moby#47483Pulling fs layer status moby/moby#47484GET /images/{id}/json omits the Created field (previously it was 0001-01-01T00:00:00Z) if the Created field was missing from the image config. moby/moby#47451Created field in GET /images/{id}/json with 0001-01-01T00:00:00Z for API versions <= 1.43. moby/moby#47387NetworkMode name or id is not the same as the name or id used in NetworkSettings.Networks. moby/moby#47510{{< release-date date="2024-02-06" >}}
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
containerd image store: Fix a bug where docker image history would fail if a manifest wasn't found in the content store. moby/moby#47348
Ensure that a generated MAC address is not restored when a container is restarted, but a configured MAC address is preserved. moby/moby#47304
[!NOTE]
- Containers created with Docker Engine version 25.0.0 may have duplicate MAC addresses. They must be re-created.
- Containers with user-defined MAC addresses created with Docker Engine versions 25.0.0 or 25.0.1 receive new MAC addresses when started using Docker Engine version 25.0.2. They must also be re-created.
Fix docker save <image>@<digest> producing an OCI archive with index without manifests. moby/moby#47294
Fix a bug preventing bridge networks from being created with an MTU higher than 1500 on RHEL and CentOS 7. moby/moby#47308, moby/moby#47311
Fix a bug where containers are unable to communicate over an internal network. moby/moby#47303
Fix a bug where the value of the ipv6 daemon option was ignored. moby/moby#47310
Fix a bug where trying to install a pulling using a digest revision would cause a panic. moby/moby#47323
Fix a potential race condition in the managed containerd supervisor. moby/moby#47313
Fix an issue with the journald log driver preventing container logs from being followed correctly with systemd version 255. moby/moby#47243
seccomp: Update the builtin seccomp profile to include syscalls added in kernel v5.17 - v6.7 to align the profile with the profile used by containerd. moby/moby#47341
Windows: Fix cache not being used when building images based on Windows versions older than the host's version. moby/moby#47307, moby/moby#47337
{{< release-date date="2024-01-31" >}}
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
This release contains security fixes for the following CVEs affecting Docker Engine and its components.
| CVE | Component | Fix version | Severity |
|---|---|---|---|
| CVE-2024-21626 | runc | 1.1.12 | High, CVSS 8.6 |
| CVE-2024-23651 | BuildKit | 1.12.5 | High, CVSS 8.7 |
| CVE-2024-23652 | BuildKit | 1.12.5 | High, CVSS 8.7 |
| CVE-2024-23653 | BuildKit | 1.12.5 | High, CVSS 7.7 |
| CVE-2024-23650 | BuildKit | 1.12.5 | Medium, CVSS 5.5 |
| CVE-2024-24557 | Docker Engine | 25.0.2 | Medium, CVSS 6.9 |
The potential impacts of the above vulnerabilities include:
For more information about the security issues addressed in this release, refer to the blog post. For details about each vulnerability, see the relevant security advisory:
{{< release-date date="2024-01-23" >}}
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
host-gateway-ip not working during build when not set through configuration. moby/moby#47192addr or ip mount option. moby/moby#47185start_interval not being passed to the container config. moby/moby#471632.24.2. docker/docker-ce-packaging#981{{< release-date date="2024-01-19" >}}
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
[!NOTE]
In earlier versions of Docker Engine, recursive mounts (submounts) would always be mounted as writable, even when specifying a read-only mount. This behavior has changed in v25.0.0, for hosts running on kernel version 5.12 or later. Now, read-only bind mounts are recursively read-only by default.
To get the same behavior as earlier releases, you can specify the
bind-recursiveoption for the--mountflag.console$ docker run --mount type=bind,src=SRC,dst=DST,readonly,bind-recursive=writable IMAGEThis option isn't supported with the
-vor--volumeflag. For more information, see Recursive mounts.
The daemon now uses systemd's default LimitNOFILE. In earlier versions of
Docker Engine, this limit was set to infinity. This would cause issues with
recent versions of systemd, where the hard limit was increased, causing
programs that adjusted their behaviors based on ulimits to consume a high
amount of memory. moby/moby#45534
The new setting makes containers behave the same way as programs running on
the host, but may cause programs that make incorrect assumptions based on the
soft limit to misbehave. To get the previous behavior, you can set
LimitNOFILE=1048576.
This change currently only affects build containers created with docker build when using BuildKit with the docker driver. Starting with Docker
Engine v29.0 (containerd v2.1.5), this limit applies to all containers, not
only build containers.
If you're experiencing issues with the higher ulimit in systemd v240 or later,
consider adding a system drop-in or override file to configure the ulimit
settings for your setup. The Flatcar Container Linux documentation
has a great article covering this topic in detail.
Add OpenTelemetry tracing. moby/moby#45652, moby/moby#45579
Add support for CDI devices under Linux. moby/moby#45134, docker/cli#4510, moby/moby#46004
Add an additional interval to be used by healthchecks during the container start period. moby/moby#40894, docker/cli#4405, moby/moby#45965
Add a --log-format flag to dockerd to control the logging format: text (default) or JSON. moby/moby#45737
Add support for recursive read-only mounts. moby/moby#45278, moby/moby#46037
Add support for filtering images based on timestamp with docker image ls --filter=until=<timestamp>. moby/moby#46577
ValidateRestartPolicy. moby/moby#46352/info endpoint to use singleflight. moby/moby#45847-f, and also using stdin. docker/cli#4346mac-address and link-local-ip fields in --network long format. docker/cli#4419--network flags with docker container create and docker run. moby/moby#45906docker run --rm) are no longer forcibly removed on engine restart. moby/moby#46857Downloading progress message on image pull. moby/moby#46515NetworkConnect and ContainerCreate with improved data validation, and return all validation errors at once. moby/moby#46183com.docker.network.host_ipv4 option when IPv6 and ip6tables are enabled. moby/moby#46446cleanupContainer if containerd is stopped. moby/moby#46213userland-proxy-path daemon configuration option. Validation now happens during daemon startup, instead of producing an error when starting a container with port-mapping. moby/moby#47000docker image save tarball output is now OCI compliant. moby/moby#44598ACCEPT rules to the end of the INPUT iptables chain for encrypted overlay networks. Depending on firewall configuration, a rule may be needed to permit incoming encrypted overlay network traffic. moby/moby#45280--ip-range is larger than --subnet. moby/moby#45759connect syscall fail-fast. moby/moby#46603push, pull, and save. moby/moby#46405ONBUILD, MAINTAINER, and HEALTHCHECK Dockerfile instructions. moby/moby#46313Pulling from progress message. moby/moby#46494sha256: prefix. moby/moby#46435docker images showing intermediate layers by default. moby/moby#46423ADD or COPY instructions were used with the classic builder. moby/moby#46383docker pull progress output. moby/moby#46412UpdateConfig. moby/moby#46433docker image ls now shows the correct image creation time and date. moby/moby#46719docker pull -a). moby/moby#466182.24.1. docker/docker-ce-packaging#980GET /images/json and GET /images/{id}/json endpoints. moby/moby#45469devicemapper storage driver. moby/moby#43637--oom-score-adjust daemon option. moby/moby#45484~/.dockercfg file. docker/cli#4281logentries logging driver. moby/moby#46925IsAutomated field and is-automated filter for docker search. Deprecation noticeContainer and ContainerConfig properties for /images/{id}/json (docker image inspect). moby/moby#46939In this release, the code that handles tar archives was changed to be more
strict and to produce an error when failing to write extended attributes
(xattr). The tar implementation for macOS generates additional extended
attributes by default when creating tar files. These attribute prefixes aren't
valid Linux xattr namespace prefixes, which causes an error when Docker
attempts to process these files. For example, if you try to use a tar file with
an ADD Dockerfile instruction, you might see an error message similar to the
following:
failed to solve: lsetxattr /sftp_key.ppk: operation not supported
Error messages related to extended attribute validation were improved to
include more context in v25.0.1, but the limitation in Docker being
unable to process the files remains. Tar files created with the macOS tar
using default arguments will produce an error when the tar file is used with
Docker.
As a workaround, if you need to use tar files with Docker generated on macOS, you can either:
Use the --no-xattr flag for the macOS tar command to strip all the
extended attributes. If you want to preserve extended attributes, this isn't
a recommended option.
Install and use gnu-tar to create the tarballs on macOS instead of the
default tar implementation. To install gnu-tar using Homebrew:
$ brew install gnu-tar
After installing, add the gnu-tar binary to your PATH, for example by
updating your .zshrc file:
$ echo 'PATH="/opt/homebrew/opt/gnu-tar/libexec/gnubin:$PATH"' >> ~/.zshrc
$ source ~/.zshrc