engine: 29.9.1

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>

content/manuals/engine/release-notes/29.md

@@ -22,6 +22,47 @@ For more information about:
 - Deprecated and removed features, see [Deprecated Engine Features](../deprecated.md).
 - Changes to the Engine API, see [Engine API version history](/reference/api/engine/version-history/).
 
+## 29.9.1
+
+{{< release-date date="2026-10-14" >}}
+
+For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
+
+- [docker/cli, 29.9.1 milestone](https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A29.9.1)
+- [moby/moby, 29.9.1 milestone](https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A29.9.1)
+
+### Security
+
+The containerd update to v2.4.2 includes fixes for the following security vulnerabilities:
+
+- [CVE-2026-95839](https://github.com/containerd/containerd/security/advisories/GHSA-vwhp-8p66-mq4f): Pulling or importing an image through containerd's transfer service could crash containerd if a child descriptor contained the `io.containerd.manifest.subject` annotation and a malformed digest.
+- [GHSA-8647-2jxj-p2rc](https://github.com/containerd/containerd/security/advisories/GHSA-8647-2jxj-p2rc): An untrusted registry returning a crafted `Content-Length` header could crash containerd when parallel layer fetching was enabled with `concurrent_layer_fetch_buffer`.
+- [GHSA-hc94-p972-ch66](https://github.com/containerd/containerd/security/advisories/GHSA-hc94-p972-ch66): Pulling a crafted image or pulling from a malicious registry could exhaust host disk space because containerd did not limit incoming layer data to the declared size before validation.
+
+### Bug fixes and enhancements
+
+- Fix `--link-local-ip` accepting addresses that are not link-local (169.254.0.0/16 or fe80::/10) when creating a container or connecting it to a network, which  made the container fail to start. [moby/moby#53923](https://github.com/moby/moby/pull/53923)
+- Fix `COPY --from` in the classic builder failing for files not owned by root when userns-remap is enabled. [moby/moby#53859](https://github.com/moby/moby/pull/53859)
+- Fix `docker ps -s` and container listing with sizes failing entirely when the size of one container cannot be computed. [moby/moby#53921](https://github.com/moby/moby/pull/53921)
+- Fix `docker save` leaving image layers on disk after the image is removed, when the image contains the same layer more than once (graph-driver image store). [moby/moby#53927](https://github.com/moby/moby/pull/53927)
+- Fix a daemon panic when using the `fluentd` log driver with a TLS address that cannot be connected to and `fluentd-async` enabled. [moby/moby#53922](https://github.com/moby/moby/pull/53922)
+- Fix image digest resolution failing when a registry mirror succeeds but a subsequent registry lookup fails. [moby/moby#53933](https://github.com/moby/moby/pull/53933)
+- Fix plugin privilege lookup reporting success when fetching the plugin fails. [moby/moby#53934](https://github.com/moby/moby/pull/53934)
+
+### Packaging updates
+
+- Update containerd (static binaries) to [v2.4.2](https://github.com/containerd/containerd/releases/tag/v2.4.2). [moby/moby#53936](https://github.com/moby/moby/pull/53936)
+
+### Networking
+
+- Don't add bridge network interfaces to firewalld's `docker` zone when `iptables` and `ip6tables` are both disabled. [moby/moby#53907](https://github.com/moby/moby/pull/53907)
+- Fix bridge networks failing to restore on daemon startup when their bridge is bound to a firewalld zone other than `docker`. [moby/moby#53907](https://github.com/moby/moby/pull/53907)
+
+### Rootless
+
+- Fix `--domainname` with user namespaces and rootless mode; this requires an OCI runtime supporting the `domainname` field (such as runc >= v1.2.0). [moby/moby#53899](https://github.com/moby/moby/pull/53899)
+- Update RootlessKit to [v3.3.0](https://github.com/rootless-containers/rootlesskit/releases/tag/v3.3.0). [moby/moby#53942](https://github.com/moby/moby/pull/53942)
+
 ## 29.9.0
 
 {{< release-date date="2026-10-08" >}}