chore(deps): update module github.com/docker/docker to v23 #212
No reviewers
Labels
No labels
Doing
To Do
api::config
api::grpc
bug
component::imctl
component::inetmock
documentation
duplicate
enhancement
good first issue
help wanted
invalid
new_protocol
pcap
protocols::dhcp
protocols::dns_mock
protocols::dns_over_https
protocols::http_mock
protocols::http_proxy
protocols::ntp
protocols::smtp
question
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
inetmock/inetmock!212
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/github.com-docker-docker-23.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
v20.10.3-0.20221013203545-33ab36d6b304+incompatible->v23.0.1⚠ Dependency Lookup Warnings ⚠
Warnings were logged while processing this repo. Please check the Dependency Dashboard for more information.
Release Notes
docker/docker
v23.0.1Compare Source
23.0.1
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Bug fixes and enhancements
apparmor_parseris not available. moby/moby#44942ipvlannetworks created prior to upgrading would prevent the daemon from starting. moby/moby#44937overlay2storage driver failing early inmetacopytesting when initialized on an unsupported backing filesystem. moby/moby#44922execexit events being misinterpreted as container exits under some runtimes, such as Kata Containers. moby/moby#44892runccompiled using Go 1.20. docker/cli#4004--device-write-bpsas a path. docker/cli#4004Packaging
/etc/dockerto RPM and DEB packaging. docker/docker-ce-packaging#842mkdir -p /etc/docker.v2.16.0. docker/docker-ce-packaging#844v23.0.0Compare Source
23.0.0
For more information about:
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
New
docker buildtodocker buildx build. docker/cli#3314DOCKER_BUILDKIT=0.Multi-stage builds.
zstdcompressed layers. moby/moby#41759, moby/moby#42862runhcsshim on Windows (off by default). moby/moby#42089dockerd --validateto check the daemon JSON config and exit. moby/moby#42393ipvlan_flagand using thel3sipvlan_modein theipvlannetwork driver. moby/moby#42542metacopyoption for theoverlay2storage driver. moby/moby#43557IDType://ID. moby/moby#43368RootlessKit,slirp4netns, andVPNKitversion reporting. moby/moby#42330docker volume. docker/cli#3606docker stack. docker/cli#3662docker stack deploy. docker/cli#2907docker stack configcommand to output the merged and interpolated config files as utilized bystack deploy. docker/cli#3544docker context showcommand that prints the name of the current context. docker/cli#3567--format=jsonshorthand variant of--format="{{ json . }}"to all commands supporting the--formatflag. docker/cli#2936--quietoption todocker createanddocker runcommands to suppress output when pulling an image. docker/cli#3377--forceoption todocker network rmsubcommand. Causes CLI to return a 0 exit code even if the network doesn't exist. Has no effect on the server-side procedure for removing a network. docker/cli#3547--signaloption todocker stopanddocker restart. docker/cli#3614-v/--versionflag todocker-proxy. moby/moby#44703STOPSIGNALviadocker commit. moby/moby#43369awslogslog driver to allow skipping log stream creation in CloudWatch. moby/moby#42132awslogslog driver to specify the log format that's sent to CloudWatch. moby/moby#42838fluentdlog driver to set the reconnection interval. moby/moby#43100WithTLSClientConfigFromEnv(),WithHostFromEnv(), andWithVersionFromEnv(). moby/moby#42224docker completionsubcommand. docker/cli#3429Swarmheader toGET /_pingandHEAD /_ping, allowing single-request detection of Swarm support. moby/moby#42064signalparameter toPOST /containers/{id}/stopandPOST /containers/{id}/restartto set the signal used. moby/moby#43206CreateMountPointparameter toPOST /containers/create. moby/moby#43484shared-sizeparameter toGET /images/jsonto enable shared-size computation of images. moby/moby#42531typeparameter toGET /system/df, to control what object types to are considered when computing disk usage. moby/moby#42559docker.serviceaftertime-set.target. moby/moby#43107Removed
~/.dockercfg. docker/cli#2504-gand--graphdaemon options in favor of--data-root. docker/cli#3739Experimentalclient field fromdocker version. docker/cli#3543overlayandoverlay2storage drivers on backing filesystems withoutd_typesupport. moby/moby#43472overrideKernelCheckoption from theoverlay2storage driver. moby/moby#44279Deprecation notice
io.containerd.runtime.v1.linuxOCI runtime. moby/moby#43695--cluster-xxoptions fromdockerd. moby/moby#40383host-discoveryand overlay networks with external k/v stores. moby/moby#42247armplatform fallback.--platform linux/arm/vYwill now return a error whenarm/vYisn't available instead of pulling the wrong image. moby/moby#44414SetCustomHTTPHeaders(),CustomHTTPHeaders()options-setters from the Go client API. moby/moby#42694WithDialer()option-setter from the Go client API. moby/moby#44022WithDialContext()instead.opts.QuotedString. The implementation has moved to the CLI. moby/moby#43250KernelMemoryoption fromPOST /containers/createon API version >= 1.42. moby/moby#43214Deprecated
BuilderSizein API versions >= 1.42 moby/moby#42608BuildCache.Parentin favor of the newly introducedBuildCache.Parentsin API version >= 1.42. moby/moby#43908pkg/urlutil, moving the implementation tobuilder/remotecontext/urlutil. moby/moby#43477Upgrades
1.19.5. docker/cli#3958, moby/moby#44794rootlesskittov0.14.4. moby/moby#42708buildkittov0.10.6. moby/moby#43239buildxtov0.10.2. docker/docker-ce-packaging#840swarmkittov2.0.0-20230119195359-904c221ac281. moby/moby#44858containerdtov1.6.16. moby/moby#44766, moby/moby#44769, moby/moby#44881runctov1.1.4. moby/moby#44039hcsshimv0.9.6. moby/moby#44658btrfsstorage driver now depends on Linux kernel headers (>= 4.12) instead of headers from btrfs-progs. moby/moby#44776Security
hostconfig.jsonfiles to0600(was0644). moby/moby#41620--seccomp-profilenot acceptingunconfinedand renamed the default seccomp profile tobuiltin. moby/moby#42481seccompbuild tag. moby/moby#42501riscv64. moby/moby#43553seccomp(2)in seccomp profiles. moby/moby#42648ErrnoRet. moby/moby#42005DefaultErrnoRetinseccompprofiles. moby/moby#42604DefaultErrnoRetfield to the default seccomp profile, with no behavior change. moby/moby#42649socketwithAF_VSOCKin the default seccomp profile. moby/moby#44563process_vm_readvandprocess_vm_writevin the default seccomp profile. moby/moby#42083clock_settime64withCAP_SYS_TIME. moby/moby#43775bpfwithCAP_BPFandperf_event_openwithCAP_PERFMON. moby/moby#43988clone3syscall to returnENOSYSin the default seccomp profile, in order to ensureglibcwill correctly fallback to usingclone. moby/moby#42681Bug fixes and enhancements
overlay2to be the default storage driver (btrfsandzfsare now opt-in). moby/moby#42661docker cpcommand. docker/cli#2708ElectAuthServerfunction, and made it return the default registry without calling theGET /infoAPI endpoint. docker/cli#2819net.JoinHostPort()to fix formatting with IPv6 addresses docker/cli#2972stderr. docker/cli#3044docker infoif a custom--formatis used that only uses local information. With this change, the CLI only uses the daemon API if it detects that information from the daemon is needed. docker/cli#3179--stop-signalflag, as it may not reflect the actual default used by the daemon. docker/cli#32453.10todocker stack; allow omitting theversionfield (resulting inlatest). docker/cli#32573is now equivalent to3.x(latest) indocker stack. docker/cli#3445<Ctrl-c>hanging on Windows to exit after running a container in non-interactive mode. docker/cli#3302runcommand in the-v/--volumeand-m/--mountflags. docker/cli#3469docker exec -tnow sets the console size for the executed process immediately when it's created. docker/cli#3627docker infoto provide more details on installed plugins. docker/cli#3645docker context listanddocker context usecommands when the context is overridden by the environment. docker/cli#3668aliasesannotation that can be used to print all available aliases for a command. docker/cli#3694docker context useand selecting the current context. docker/cli#3721docker context rm --force. docker/cli#37910in Compose files docker/cli#3812<Ctrl-c>) now passes through to running containers instead of causing the CLI to exit. docker/cli#3849docker port CONTAINERUX by sorting ports before printing. docker/cli#3892GET /containers/{id}/logsandPOST /containers/{id}/attachnow report which raw-stream format is in use using theContent-typeresponse header on API version >= 1.42. moby/moby#39812--storage-optsflag applies to all storage on Windows. moby/moby#41636(/var/run/docker/containerd/containerd.toml). moby/moby#41675nullmanifests during tar import. moby/moby#41842btrfsdriver. moby/moby#42273--privilegedrootless containers. moby/moby#42638**/foorecursive wildcard directory patterns in.dockerignore. moby/moby#42676docker import --platformto allow marking an imported image as a foreign architecture. moby/moby#43103namesgeneratorpackage against new additions. Users will have to be satisfied with the existing 25359 adjective-name combinations. moby/moby#43210containers/{id}/attach/wsonly to streams according bystdin,stdoutandstderrparameters on API version >= 1.42. moby/moby#43322execstarts on health checks. Check timeout now only applies to the duration that the health check command is running. The time it takes to start the command no longer counts against the timeout. moby/moby#43480ttysize is set immediately on creation. moby/moby#43593, moby/moby#43622overlay2mounts not being cleaned up after failed container starts, or daemon shutdown. moby/moby#43659containerd. moby/moby#43675firewalldfor networking when the daemon is running in rootless mode. moby/moby#43813live-restorewith restart policies and volume refs. moby/moby#44237all=trueto prune named volumes in addition to anonymous. moby/moby#44259GET /system/dfendpoint. moby/moby#42715--ipc=hostwasn't handled correctly when the daemon is running in rootless mode. moby/moby#44863DOCKER-USERip6tables chain. moby/moby#44845ip6tablescommand isn't available. moby/moby#44727CreatedAttime of a volume reflecting initialization and not creation. moby/moby#44725docker contextwhen an invalid context is present. docker/cli#3847docker container removeas an alias fordocker container rm. docker/cli#3986v20.10.23Compare Source
Bug fixes and enhancements
Fix an issue where
docker buildwould fail when using--add-host=host.docker.internal:host-gatewaywith BuildKit enabled moby/moby#44650.
Revert seccomp: block socket calls to
AF_VSOCKin default profile moby/moby#44712.This change, while favorable from a security standpoint, caused a change
in behavior for some use-cases. As such, we are reverting it to ensure
stability and compatibility for the affected users.
However, users of
AF_VSOCKin containers should recognize that this(special) address family is not currently namespaced in any version of
the Linux kernel, and may result in unexpected behavior, like containers
communicating directly with host hypervisors.
Future releases, will filter
AF_VSOCK. Users who need to allow containersto communicate over the unnamespaced
AF_VSOCKwill need to turn off seccompconfinement or set a custom seccomp profile.
Packaging Updates
containerd.iopackage) to v1.6.15.docker-compose-clito allow distro version updates docker/docker-ce-packaging#822.v20.10.22Compare Source
Bug fixes and enhancements
ssh: parse error in message type 27errors duringdocker buildon hosts using OpenSSH 8.9 or above (moby/moby#3862).AF_VSOCKin default profile (moby/moby#44564).Packaging Updates
containerd.iopackage) to v1.6.13 to include a fix for CVE-2022-23471.v20.10.21Compare Source
This release of Docker Engine contains updated versions of Docker Compose,
Docker Scan, Containerd, added packages for Ubuntu 22.10, and some minor bug
fixes and enhancements.
Client
Daemon
Invalid standard handle identifiepanic when registering the docker daemon as a service from a legacy CLI on Windows moby/moby#44326.Builder
Packaging
containerd.iopackage) to v1.6.9.v20.10.20Compare Source
This release of Docker Engine contains partial mitigations for a Git vulnerability
(CVE-2022-39253), and has updated handling of
image:tag@digestimage references.The Git vulnerability allows a maliciously crafted Git repository, when used as a
build context, to copy arbitrary filesystem paths into resulting containers/images;
this can occur in both the daemon, and in API clients, depending on the versions and
tools in use.
The mitigations available in this release and in other consumers of the daemon API
are partial and only protect users who build a Git URL context (e.g.
git+protocol://).As the vulnerability could still be exploited by manually run Git commands that interact
with and check out submodules, users should immediately upgrade to a patched version of
Git to protect against this vulernability. Further details are available from the GitHub
blog ("Git security vulnerabilities announced").
Client
when using the classic Builder with a Git URL as the build context.
Daemon
image:tag@digestreferences. When pulling an image usingthe
image:tag@digest("pull by digest"), image resolution happens throughthe content-addressable digest and the
imageandtagare not used. Whilethis is expected, this could lead to confusing behavior, and could potentially
be exploited through social engineering to run an image that is already present
in the local image store. Docker now checks if the digest matches the repository
name used to pull the image, and otherwise will produce an error.
Builder
image:tag@digestreferences. Refer to the "Daemon" sectionabove for details.
for CVE-2022-39253.
v20.10.19Compare Source
This release of Docker Engine comes with some bug-fixes, and an updated version
of Docker Compose.
Builder
docker builder pruneordocker system prunemoby/moby#44122.Daemon
docker volume prunewould remove volumes that werestill in use if the daemon was running with "live restore" and was restarted
moby/moby#44238.
Packaging
and CVE-2022-41715.
v20.10.18Compare Source
This release of Docker Engine comes with a fix for a low-severity security issue,
some minor bug fixes, and updated versions of Docker Compose, Docker Buildx,
containerd, andrunc.Client
Builder
Daemon
could allow a container process to bypass primary group restrictions within the
container CVE-2022-36109, GHSA-rc4r-wh2q-q6c4.
in a redundant round-trip to the image registry moby/moby#44109.
execprocesses and healthchecks were not terminatedwhen they timed out moby/moby#44018.
Packaging
containerd.iopackage) to v1.6.8.which contains fixes for CVE-2022-27664
and CVE-2022-32190.
v20.10.17Compare Source
This release of Docker Engine comes with updated versions of the
compose,containerd, andrunccomponents, as well as some minor bug fixes.Client
Networking
Packaging
containerd.iopackage) to v1.6.6, which contains a fix for CVE-2022-31030v20.10.16Compare Source
This release of Docker Engine fixes a regression in the Docker CLI builds for
macOS, fixes an issue with
docker statswhen using containerd 1.5 and up,and updates the Go runtime to include a fix for CVE-2022-29526.
Client
resulted in a panic docker/cli#43426.
CVE-2022-29526.
Daemon
docker statswas showing empty stats when running withcontainerd 1.5.0 or up moby/moby#43567.
golang.org/x/sysbuild-time dependency which contains a fix for CVE-2022-29526.Packaging
which contains a fix for CVE-2022-29526.
docker scanCLI plugin, to prevent a"conflicting requests" error when users performed an off-line installation from
downloaded RPM packages docker/docker-ce-packaging#659.
v20.10.15Compare Source
This release of Docker Engine comes with updated versions of the
compose,buildx,containerd, andrunccomponents, as well as some minor bugfixes.Daemon
some conditions moby/moby#43360
Packaging
containerd.iopackage) to v1.6.4.v20.10.14Compare Source
This release of Docker Engine updates the default inheritable capabilities for
containers to address CVE-2022-24769,
a new version of the
containerd.ioruntime is also included to address the sameissue.
Daemon
Builder
Packaging
containerd.iopackage) to v1.5.11.docker buildxto v0.8.1.v20.10.13Compare Source
This release of Docker Engine contains some bug-fixes and packaging changes,
updates to the
docker scananddocker buildxcommands, an updated version ofthe Go runtime, and new versions of the
containerd.ioruntime.Together with this release, we now also provide
.deband.rpmpackages ofDocker Compose V2, which can be installed using the (optional)
docker-compose-pluginpackage.
Builder
Daemon
net.ipv4.ping_group_rangesysctl moby/moby#43084.Distribution
pull moby/moby#43333.
Documentation
Logging
a large amount of log messages moby/moby#43165.
containers from hanging when using the
fluentd-async-connect=trueand theremote server is unreachable moby/moby#43147.
Packaging
.deband.rpmpackages for Docker Compose V2. Docker Compose v2.3.3can now be installed on Linux using the
docker-compose-pluginpackages, whichprovides the
docker composesubcommand on the Docker CLI. The Docker Composeplugin can also be installed and run standalone to be used as a drop-in replacement
for
docker-compose(Docker Compose V1) docker/docker-ce-packaging#638.The
compose-cli-pluginpackage can also be used on older version of the DockerCLI with support for CLI plugins (Docker CLI 18.09 and up).
docker buildxto v0.8.0.docker scan(docker-scan-plugin) to v0.17.0.containerd.iopackage) to v1.5.10.v20.10.12Compare Source
Packaging
docker scanto v0.12.0.docker buildxto v0.7.1.v20.10.11Compare Source
20.10.11
Distribution
See GHSA-xmmx-7jpf-fx42 for details.
Windows
Packaging
v20.10.10Compare Source
20.10.10
Builder
docker buildusing not finding images inthe local image cache on Arm machines when using BuildKit moby/moby#42954
Runtime
clone3syscall in the default seccomp policy to support runningcontainers based on recent versions of Fedora and Ubuntu. moby/moby/#42836.
layers, which was exposed by recent changes in Windows moby/moby#42944.
docker stopcould hang forever moby/moby#42956.Swarm
Packaging
docker scanto v0.9.0v20.10.9Compare Source
This release is a security release with security fixes in the CLI, runtime, as
well as updated versions of the containerd.io package and the Go runtime.
Client
Ensure default auth config has address field set, to prevent credentials being
sent to the default registry.
Runtime
Create parent directories inside a chroot during
docker cpto prevent a speciallycrafted container from changing permissions of existing files in the host’s filesystem.
Lock down file permissions to prevent unprivileged users from discovering and
executing programs in
/var/lib/docker.Packaging
and CVE-2021-39293
v1.4.11 and runc v1.0.2 to address CVE-2021-41103.
v20.10.8Compare Source
20.10.8
Deprecation
specified in RFC 1423 is insecure by design. Because it does not authenticate
the ciphertext, it is vulnerable to padding oracle attacks that can let an
attacker recover the plaintext. Support for encrypted TLS private keys is now
marked as deprecated, and will be removed in an upcoming release. docker/cli#3219
support for Kubernetes in the
stackandcontextcommands in the Docker CLIis now marked as deprecated, and will be removed in an upcoming release docker/cli#3174.
Client
Invalid standard handle identifiererrors on Windows docker/cli#3132.Rootless
can't open lock file /run/xtables.lock: Permission deniederror onSELinux hosts moby/moby#42462.
x509: certificate signed by unknown authorityerror on openSUSE Tumbleweed moby/moby#42462.Runtime
--platformoption to pull a single-arch imagethat does not match the specified architecture moby/moby#42633.
Your kernel does not support swap memory limitwarning whenrunning with cgroups v2 moby/moby#42479.
HcsShutdownComputeSystemreturned an
ERROR_PROC_NOT_FOUNDerror moby/moby#42613Swarm
node failing to clean up its old loadbalancer IPs moby/moby#42538
Packaging
v20.10.7Compare Source
20.10.7
Client
SIGURGsignals to container on Linux and macOS. The Go runtime(starting with Go 1.14) uses
SIGURGsignals internally as an interrupt tosupport preemptable syscalls. In situations where the Docker CLI was attached
to a container, these interrupts were forwarded to the container. This fix
changes the Docker CLI to ignore
SIGURGsignals docker/cli#3107,moby/moby#42421.
Builder
a breaking change in runc v1.0.0-rc94 and up. moby/buildkit#2137.
a
COPYcommand with a wildcard. Note that this change invalidatesexisting build caches for copy commands that use a wildcard. moby/buildkit#2018.
FROMimage is not cached when using legacy schema 1 images moby/moby#42382.Logging
Rootless
user-namespaces enabled moby/moby#42352.
Networking
parameter
ipv6.disable=1, and to fix a deadlock causing internal DNS lookupsto fail moby/moby#42413.
Contrib
with the
slirp4netnsport driver moby/moby#42294.daemon moby/moby#42342.
Packaging
moby/moby#42398, moby/moby#42395,
ocker/containerd-packaging#234
moby/moby#42388, docker/containerd-packaging#232.
docker-scan-plugin) to v0.8 docker/docker-ce-packaging#545.v20.10.6Compare Source
release notes: https://docs.docker.com/engine/release-notes/#20106
v20.10.5Compare Source
release notes: https://docs.docker.com/engine/release-notes/#20105
20.10.5
Client
v20.10.4Compare Source
release notes: https://docs.docker.com/engine/release-notes/#20104
20.10.4
Builder
invalid mutable referrors)builder prunemoby/moby#42065Client
docker loginif no config file is present docker/cli#2959WARNING: Error loading config file: .dockercfg: $HOME is not defineddocker/cli#2958Runtime
Logger
labels-regexconfig even iflabelsis not set moby/moby#42046Rootless
Security
Swarm
--update-orderand--rollback-orderflags when only--update-orderor--rollback-orderis provided docker/cli#2963docker service rollbackreturning a non-zero exit code in some situations docker/cli#2964docker service rollbackdocker/cli#2964Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.
⚠ Artifact update problem
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below:
File name: go.sum
dffeb1c08d6783e9ff516783e9ff5132f5b97ff332f5b97ff33c944d86c73c944d86c7d4fdd700e2d4fdd700e2df03fdb709df03fdb7094f76396f4f4f76396f4f3f51ec8dfe3f51ec8dfef9f9822054f9f9822054e6f1993459Edited/Blocked Notification
Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.
You can manually request rebase by checking the rebase/retry box above.
⚠ Warning: custom changes will be lost.
e6f1993459tod3bf1c23e39a384b40d24dbebc8de74dbebc8de7f55684e300f55684e30054790580f854790580f81f661122c4