https://cybertoolchain.io/tools/docker-cli New releases and features in Docker CLI, tracked by The Cyber Toolchain. en Mon, 12 Oct 2026 08:07:04 GMT https://docs.docker.com/engine/release-notes/ https://docs.docker.com/engine/release-notes/ Mon, 12 Oct 2026 08:07:04 GMT Docker 29.9.0 adds lazy-pull control for containerd image store and confirms IPv6 Swarm port support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `lazy-pull` daemon feature flag to the containerd image store, controlling whether `docker pull` skips downloading layer content already provided by the snapshotter; enabled by default for `nydus`, `overlaybd`, `soci`, and `stargz` snapshotters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Published Swarm-service ports are now accessible at the host's IPv6 addresses when the userland proxy is enabled, confirmed as a tested and supported feature as of v29.9.0. • Allows IPv6 Neighbour Discovery between containers on a bridge network with inter-container communication disabled, matching existing IPv4 behaviour. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-cli https://docs.docker.com/engine/release-notes/#2960 https://docs.docker.com/engine/release-notes/#2960 Thu, 18 Jun 2026 00:00:00 GMT Docker CLI 29.6 adds in-toto attestations API and per-device blkio update • Adds `GET /images/{name}/attestations` endpoint to retrieve SLSA provenance and SPDX SBOM statements with platform, predicate type, and statement query filtering • New POST `/containers/{id}/update` API support for per-device blkio resource settings Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-cli https://docs.docker.com/engine/release-notes/#2950 https://docs.docker.com/engine/release-notes/#2950 Thu, 14 May 2026 00:00:00 GMT New rootless gvisor-tap-vsock driver, custom logging attributes, Windows Unix socket, `docker ps --format .HealthStatus`, and time namespace feature flag in 29.5.0 • `gvisor-tap-vsock` is now the default rootless network driver. • Add new default `gvisor-tap-vsock` network driver for Rootless mode. • Enable private time namespace for containers by default on supported kernels. • Local logging driver now supports custom attributes via `label`, `label-regex`, `env`, `env-regex`, and `tag` log options. • Windows daemon now supports listening on a Unix socket (`-H unix://...`) with optional group-based access control via `--group`. • `docker ps --format` now supports a `.HealthStatus` placeholder to print container health state (starting, healthy, unhealthy) as a dedicated field. • Add "time-namespaces" feature flag to disable time-namespaces. Breaking changes: • `slirp4netns` is no longer installed via Docker packaging; users should prefer `gvisor-tap-vsock`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-cli https://docs.docker.com/engine/release-notes/#2930 https://docs.docker.com/engine/release-notes/#2930 Thu, 05 Mar 2026 00:00:00 GMT Docker CLI 29.3.0 adds bind-create-src mount flag, API v1.40 support, and GET /images/json identity parameter • Adds `--mount` `bind-create-src` option for bind mounts. • CLI plugin hooks now fire on command failure with `error-hooks` config key. • Lower minimum API version from v1.44 to v1.40 (Docker 19.03). • GET `/images/json` now supports `identity` query parameter for trusted identity and origin information. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-cli https://docs.docker.com/engine/release-notes/#2920 https://docs.docker.com/engine/release-notes/#2920 Mon, 26 Jan 2026 00:00:00 GMT Docker CLI 29.2.0 adds experimental NRI support, image identity metadata, gRPC native socket, and new Go SDK option • `docker info` now includes an `nri` section with experimental NRI support. • Inspection output now includes the `identity` field showing trusted origin information, build ref, remote registry repository, and verified signature info for signed provenance attestation. • Go SDK adds `WithAPIClientOptions` option in `cli/command` to configure the APIClient. Breaking changes: • On Windows, `%PROGRAMDATA%\Docker\cli-plugins` is removed from the list of paths used for CLI plugins (replaced by `%ProgramFiles%\Docker\cli-plugins`). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-cli https://docs.docker.com/engine/release-notes/#2900 https://docs.docker.com/engine/release-notes/#2900 Mon, 10 Nov 2025 00:00:00 GMT Docker CLI 29.0.0 adds nftables firewall backend, multi-platform image save/load, --bridge-accept-fwmark daemon option, and GODEBUG context metadata support • Adds `firewall-backend` daemon configuration key to enable experimental `nftables` network filtering • Adds `--platform` flag to `docker image load` and `docker image save` for multi-platform selection • Adds `--bridge-accept-fwmark` daemon option to allow bridge networks to accept packets with specific firewall marks Breaking changes: • Go module `github.com/docker/docker` is deprecated; use `github.com/moby/moby/client` and `github.com/moby/moby/api` instead • Docker Content Trust CLI commands are removed from the Docker CLI binary (built as separate plugin) • Debian armhf packages now target ARMv7 CPUs and no longer support ARMv6 devices; official Raspbian 32-bit packages are dropped • Daemon API version requirement raised to v1.44 or later (requires Docker engine v25.0+) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-cli