From feeb85369c591213c04d87a844c3fb84ce1df0fa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pawe=C5=82=20Gronowski?= Date: Wed, 14 Oct 2026 20:37:42 +0200 Subject: [PATCH] engine: 29.9.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Paweł Gronowski --- content/manuals/engine/release-notes/29.md | 41 ++++++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/content/manuals/engine/release-notes/29.md b/content/manuals/engine/release-notes/29.md index a514f94bfb..9d7c369f4a 100644 --- a/content/manuals/engine/release-notes/29.md +++ b/content/manuals/engine/release-notes/29.md @@ -22,6 +22,47 @@ For more information about: - Deprecated and removed features, see [Deprecated Engine Features](../deprecated.md). - Changes to the Engine API, see [Engine API version history](/reference/api/engine/version-history/). +## 29.9.1 + +{{< release-date date="2026-10-14" >}} + +For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones: + +- [docker/cli, 29.9.1 milestone](https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A29.9.1) +- [moby/moby, 29.9.1 milestone](https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A29.9.1) + +### Security + +The containerd update to v2.4.2 includes fixes for the following security vulnerabilities: + +- [CVE-2026-95839](https://github.com/containerd/containerd/security/advisories/GHSA-vwhp-8p66-mq4f): Pulling or importing an image through containerd's transfer service could crash containerd if a child descriptor contained the `io.containerd.manifest.subject` annotation and a malformed digest. +- [GHSA-8647-2jxj-p2rc](https://github.com/containerd/containerd/security/advisories/GHSA-8647-2jxj-p2rc): An untrusted registry returning a crafted `Content-Length` header could crash containerd when parallel layer fetching was enabled with `concurrent_layer_fetch_buffer`. +- [GHSA-hc94-p972-ch66](https://github.com/containerd/containerd/security/advisories/GHSA-hc94-p972-ch66): Pulling a crafted image or pulling from a malicious registry could exhaust host disk space because containerd did not limit incoming layer data to the declared size before validation. + +### Bug fixes and enhancements + +- Fix `--link-local-ip` accepting addresses that are not link-local (169.254.0.0/16 or fe80::/10) when creating a container or connecting it to a network, which made the container fail to start. [moby/moby#53923](https://github.com/moby/moby/pull/53923) +- Fix `COPY --from` in the classic builder failing for files not owned by root when userns-remap is enabled. [moby/moby#53859](https://github.com/moby/moby/pull/53859) +- Fix `docker ps -s` and container listing with sizes failing entirely when the size of one container cannot be computed. [moby/moby#53921](https://github.com/moby/moby/pull/53921) +- Fix `docker save` leaving image layers on disk after the image is removed, when the image contains the same layer more than once (graph-driver image store). [moby/moby#53927](https://github.com/moby/moby/pull/53927) +- Fix a daemon panic when using the `fluentd` log driver with a TLS address that cannot be connected to and `fluentd-async` enabled. [moby/moby#53922](https://github.com/moby/moby/pull/53922) +- Fix image digest resolution failing when a registry mirror succeeds but a subsequent registry lookup fails. [moby/moby#53933](https://github.com/moby/moby/pull/53933) +- Fix plugin privilege lookup reporting success when fetching the plugin fails. [moby/moby#53934](https://github.com/moby/moby/pull/53934) + +### Packaging updates + +- Update containerd (static binaries) to [v2.4.2](https://github.com/containerd/containerd/releases/tag/v2.4.2). [moby/moby#53936](https://github.com/moby/moby/pull/53936) + +### Networking + +- Don't add bridge network interfaces to firewalld's `docker` zone when `iptables` and `ip6tables` are both disabled. [moby/moby#53907](https://github.com/moby/moby/pull/53907) +- Fix bridge networks failing to restore on daemon startup when their bridge is bound to a firewalld zone other than `docker`. [moby/moby#53907](https://github.com/moby/moby/pull/53907) + +### Rootless + +- Fix `--domainname` with user namespaces and rootless mode; this requires an OCI runtime supporting the `domainname` field (such as runc >= v1.2.0). [moby/moby#53899](https://github.com/moby/moby/pull/53899) +- Update RootlessKit to [v3.3.0](https://github.com/rootless-containers/rootlesskit/releases/tag/v3.3.0). [moby/moby#53942](https://github.com/moby/moby/pull/53942) + ## 29.9.0 {{< release-date date="2026-10-08" >}}