Docker CLI

No entries match these filters. Clear filters

1. changelog Oct 12, 2026 · issue 104

   Docker 29.9.0 adds lazy-pull control for containerd image store and confirms IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. Swarm port support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds lazy-pull daemon feature flag to the containerd image store, controlling whether docker pull skips downloading layer content already provided by the snapshotter; enabled by default for nydus, overlaybd, soci, and stargz snapshotters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Published Swarm-service ports are now accessible at the host's IPv6 addresses when the userland proxy is enabled, confirmed as a tested and supported feature as of v29.9.0.
   • Allows IPv6 Neighbour Discovery between containers on a bridge network with inter-container communication disabled, matching existing IPv4 behaviour.
   • Adds lazy-pull daemon feature flag to the containerd image store, controlling whether docker pull skips downloading layer content already provided by the snapshotter; enabled by default for nydus, overlaybd, soci, and stargz snapshotters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   2 more in Everything

2. 29.8.2 Sep 30, 2026 · release notes

   Docker Engine 29.8.2 adds --umask, CloudWatch log attributes, default AppArmorAppArmorA Linux kernel security module, maintained as part of the kernel, that confines programs to a declared set of files, capabilities, and network access — letting cyber tools sandbox processes without writing custom kernel code. profile, annotation filters, and pesto rootless port driver.

   └──▷ USE IT
   Set the umask for a new container's processes to 0o002 (common for group-writable directories).
   shell copy

   docker run --umask 002 <image>

   Filter containers by a specific annotation to identify managed instances.
   shell copy

   docker ps -f "annotation=managed-by=pulumi"

   Enable the pesto port driver for rootless mode to support NAT64/DNS64DNS64A DNS server mechanism that synthesizes AAAA (IPv6) records from A (IPv4) records, letting IPv6-only clients reach IPv4-only hosts without dual-stack infrastructure. Cyber tools use it to handle mixed-protocol environments transparently. networks.
   shell copy

   DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=pesto dockerd-rootless.sh

   • Adds --umask <octal> flag to docker create and docker run commands and the corresponding HostConfig.Umask option to set the umask for a container's main process, execs, and healthchecks
   • Adds support for attaching service names, environments, and custom CloudWatch entity attributes to logs from the awslogs logging driver via configuration options (e.g. awslogs-group, awslogs-creation-rule)
   • Adds daemon support for configuring the default container AppArmor profile template via daemon configuration
   • Adds annotation filter to container listings (docker ps, GET /containers/json) allowing you to filter containers by their annotations using the filter argument with the annotation key
   • Updates RootlessKit to v3.1.0, adding support for the pesto port driver in rootless mode; use it by setting DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=pesto (requires pasta network driver and supports IPv4 only)

   5 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Network names container and 'container:' are now reserved; creating networks with these exact names will fail or be blocked.
   • !Update minimum supported Go version to 1.26.
3. docs update Sep 4, 2026 · issue 064

   Docker Buildx gains a --driver cloud option to connect to Docker Build Cloud builders.

   └──▷ TRY IT
   Connect Buildx to an existing Docker Build Cloud builder so all subsequent docker buildx build invocations run on cloud infrastructure.
   copy

   $ docker buildx create --driver cloud --name cloud-builder --use org/builder

   • Adds --driver cloud to docker buildx create, accepting a builder name as <account>/<builder> or cloud://<account>/<builder> to connect Buildx to a Docker Build Cloud builder group.
   • When --tag is specified and the build targets a single platform on one cloud node, Buildx automatically loads the image locally; untagged builds remain in the cloud build cache.

   2 details in Everything

4. 29.8.0 Sep 3, 2026 · release notes

   Docker CLI 29.8 adds --umask flag and AppArmorAppArmorA Linux kernel security module, maintained as part of the kernel, that confines programs to a declared set of files, capabilities, and network access — letting cyber tools sandbox processes without writing custom kernel code. default profile config via HostConfig.Umask

   └──▷ TRY IT
   Run a container with a restrictive umask (e.g., 077) so created files are private by default.
   copy

   $ docker run --umask 077 alpine ls -l

   • Adds HostConfig.Umask field to the API and --umask <octal> flag to docker create / docker run to set the umask for a container's main process, execs, and healthchecks.
   • Adds daemon support for configuring the default container AppArmor profile template via new configuration options.

   2 details in Everything

5. docs update seen Jul 31, 2026 · issue 031

   New allow-untrusted-image driver option lets you bypass signed-image verification when creating a buildx builder.

   └──▷ TRY IT
   Create a docker-container builder using an unsigned or locally-patched BuildKitBuildKitA build engine for Docker images, maintained by Moby, that replaces the legacy Docker builder with parallel layer execution, cache mounts, and secret handling — giving cyber tools faster, more reproducible container builds. image while BUILDX_DEFAULT_POLICY=1 is enforced in your environment.
   copy

   $ BUILDX_DEFAULT_POLICY=1 docker buildx create --driver docker-container --driver-opt allow-untrusted-image=true

   • Adds allow-untrusted-image=true driver option to docker buildx create to explicitly skip signed moby/buildkit image verification when BUILDX_DEFAULT_POLICY=1 is set.

   1 detail in Everything

6. docs update seen Jul 31, 2026 · issue 031

   Docker Buildx Bake gains file-relative path resolution and inline SSH/secret overrides via --set

   └──▷ TRY IT
   Resolve Bake file build contexts relative to the Bake file location instead of CWD — useful when running bake from a directory other than where the Bake file lives.
   copy

   $ BUILDX_BAKE_FILE_RELATIVE_PATHS=1 docker buildx bake

   Inject SSH keys inline at bake time across all targets without editing the Bake file, including multiple keys for the same agent ID.
   copy

   $ docker buildx bake --set "*.ssh=default=$HOME/.ssh/id_ed25519,$HOME/.ssh/id_rsa"

   Override the source for an existing AWS secret in a specific target at bake time.
   copy

   $ docker buildx bake --set target.secret.aws env AWS

   • New BUILDX_BAKE_FILE_RELATIVE_PATHS=1 env var resolves local directory build contexts relative to the Bake file rather than the current working directory; use cwd:// prefix to keep specific paths CWD-relative.
   • Supports inline SSH key overrides via --set using the same id=path syntax as docker build --ssh, including comma-separated multiple paths for the same ID.
   • Supports overriding secret sources inline via --set target.secret.aws using the same syntax as the corresponding build flag.
   • Clarifies composable attribute override behavior: --set replaces/appends the whole list for fields like ssh and secret; only map-valued fields (e.g., args) support sub-key targeting like --set target.args.MYARG=value.

   4 details in Everything

7. docs update seen Jul 31, 2026 · issue 031

   Buildx gains a built-in source policy to verify signed tags on Docker-managed images via BUILDX_DEFAULT_POLICY=1.

   └──▷ HOW TO FIND IT
   Enforce signed-tag verification on Docker-managed BuildKitBuildKitA build engine for Docker images, maintained by Moby, that replaces the legacy Docker builder with parallel layer execution, cache mounts, and secret handling — giving cyber tools faster, more reproducible container builds. and frontend images before building, without writing a custom policy file.
   📍BUILDX_DEFAULT_POLICY=1 docker buildx build -t myapp:latest .
8. 29.7.0 Jul 30, 2026 · release notes

   Docker CLI 29.7.0 introduces an embedded-containerd experimental mode and the default-stop-timeout daemon option.

   └──▷ TRY IT
   Run containerd as an embedded process for simpler deployment or debugging.
   copy

   $ dockerd --features=embedded-containerd

   Set a global default stop timeout of 60 seconds for containers that don't specify one.
   json copy

   daemon.json: { "default-stop-timeout": "60s" }

   • Add an experimental embedded-containerd feature that runs containerd inside the daemon process instead of as a separate managed process
   • Add the default-stop-timeout daemon option to configure the stop timeout assigned to containers without an explicit timeout

   2 details in Everything

9. 29.6.0 Jun 18, 2026 · release notes

   Docker CLI 29.6 adds in-toto attestations API and per-device blkio update

   └──▷ TRY IT
   Retrieve all SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. statements for an image on linux/amd64 platform
   copy

   $ curl -s http://localhost:2375/images/myimage/attestations?predicate_type=spdx & curl -s "http://localhost:2375/images/myimage/attestations?platform=linux/amd64&predicate_type=spdx" | jq .

   Update container resource limits with specific blkio settings via API
   copy

   $ curl -X POST http://localhost:2375/containers/mycontainer/update -H 'Content-Type: application/json' -d '{"BlkioWeightDevice": [{"Path": "/dev/sda", "Weight": 500}]}'

   • Adds GET /images/{name}/attestations endpoint to retrieve SLSASLSASupply-chain Levels for Software Artifacts, a framework for assessing how software was built and protecting that process from tampering. Provenance records help verify where a build came from. provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. and SPDX SBOM statements with platform, predicate type, and statement query filtering
   • New POST /containers/{id}/update API support for per-device blkio resource settings

   2 details in Everything

10. 29.5.0 May 14, 2026 · release notes

    New rootless gvisor-tap-vsock driver, custom logging attributes, Windows Unix socket, docker ps --format .HealthStatus, and time namespace feature flag in 29.5.0

    • gvisor-tap-vsock is now the default rootless network driver.
    • Add new default gvisor-tap-vsock network driver for Rootless mode.
    • Enable private time namespace for containers by default on supported kernels.
    • Local logging driver now supports custom attributes via label, label-regex, env, env-regex, and tag log options.
    • Windows daemon now supports listening on a Unix socket (-H unix://...) with optional group-based access control via --group.

    +2 more show less

    • docker ps --format now supports a .HealthStatus placeholder to print container health state (starting, healthy, unhealthy) as a dedicated field.
    • Add time-namespaces feature flag to disable time-namespaces.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !slirp4netns is no longer installed via Docker packaging; users should prefer gvisor-tap-vsock.
11. 29.3.0 Mar 5, 2026 · release notes

    Docker CLI 29.3.0 adds bind-create-src mount flag, API v1.40 support, and GET /images/json identity parameter

    └──▷ TRY IT
    Ensure source directory is created automatically when using bind mounts via CLI or compose files.
    copy

    $ docker run --mount type=bind,bind-create-src=true,source=/host/path,target=/container/path alpine ls /container/path

    Query image manifests including trusted identity metadata using the Docker Engine API.
    shell copy

    curl -s http://localhost:2375/v1.40/images/json?identity=true | jq '.[0].Identity'

    • Adds --mount bind-create-src option for bind mounts.
    • CLI plugin hooks now fire on command failure with error-hooks config key.
    • Lower minimum API version from v1.44 to v1.40 (Docker 19.03).
    • GET /images/json now supports identity query parameter for trusted identity and origin information.

    4 details in Everything

12. 29.2.0 Jan 26, 2026 · release notes

    Docker CLI 29.2.0 adds experimental NRI support, image identity metadata, gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. native socket, and new Go SDK option

    • docker info now includes an nri section with experimental NRI support.
    • Inspection output now includes the identity field showing trusted origin information, build ref, remote registry repository, and verified signature info for signed provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. attestation.
    • Go SDK adds WithAPIClientOptions option in cli/command to configure the APIClient.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !On Windows, %PROGRAMDATA%\Docker\cli-plugins is removed from the list of paths used for CLI plugins (replaced by %ProgramFiles%\Docker\cli-plugins).
13. 29.0.0 Nov 10, 2025 · release notes

    Docker CLI 29.0.0 adds nftables firewall backend, multi-platform image save/load, --bridge-accept-fwmark daemon option, and GODEBUG context metadata support

    └──▷ USE IT
    Export images for multiple architectures into a single tarball using the new flag.
    shell copy

    docker image save --platform linux/amd64,linux/arm64 myimage:latest > multi-arch.tar

    Configure the daemon to use nftables for firewall backend via configuration file.
    toml copy

    firewall-backend = "nftables"

    • Adds firewall-backend daemon configuration key to enable experimental nftables network filtering
    • Adds --platform flag to docker image load and docker image save for multi-platform selection
    • Adds --bridge-accept-fwmark daemon option to allow bridge networks to accept packets with specific firewall marks

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Go module github.com/docker/docker is deprecated; use github.com/moby/moby/client and github.com/moby/moby/api instead
    • !Docker Content Trust CLI commands are removed from the Docker CLI binary (built as separate plugin)
    • !Debian armhf packages now target ARMv7 CPUsCPUsThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. and no longer support ARMv6 devices; official Raspbian 32-bit packages are dropped
    • !Daemon API version requirement raised to v1.44 or later (requires Docker engine v25.0+)