feat(deps)!: Update dependency docker to v28 (main) #1566
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
| datasource | package | from | to | | --------------- | --------- | ------- | ------- | | github-releases | moby/moby | v27.5.1 | v28.0.0 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v27.5.1->v28.0.0Release Notes
moby/moby (docker)
v28.0.0Compare Source
28.0.0
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
New
--mount type=image. moby/moby#48798--mount type=image,image-subpath=[subpath],...option to mount a specific path from the image. docker/cli#5755docker images --treenow shows metadata badges. docker/cli#5744docker load,docker save, anddocker historynow support a--platformflag allowing you to choose a specific platform for single-platform operations on multi-platform images. docker/cli#5331OOMScoreAdjtodocker service createanddocker stack. docker/cli#5145docker buildx prunenow supportsreserved-space,max-used-space,min-free-spaceandkeep-bytesfilters. moby/moby#48720Networking
docker-proxybinary has been updated, older versions will not work with the updateddockerd. moby/moby#48132docker-proxy) could accept TCP connections, that would then fail afteriptablesNAT rules were set up.rootlesskit-docker-proxyis no longer used, it has been removed from the build and distribution./etc/resolv.confare now always accessed from the host's network namespace. moby/moby#48290/etc/resolv.confcontains no nameservers and there are no--dnsoverrides, Google's DNS servers are no longer used, apart from by the default bridge network and in build containers.prestarthook is now only used by build containers. For other containers, network interfaces are added to the network namespace after task creation is complete, before the container task is started. moby/moby#47406gw-priorityoption todocker run,docker container create, anddocker network connect. This option will be used by the Engine to determine which network provides the default gateway for a container. Ondocker run, this option is only available through the extended--networksyntax. docker/cli#5664com.docker.network.endpoint.ifnameto customize the interface name used when connecting a container to a network. It's supported by all built-in network drivers on Linux. moby/moby#49155eth, the container might fail to start.en0, or a numerical suffix high enough to never collide, for exampleeth100.docker network connectvia the--driver-optflag, for exampledocker network connect --driver-opt=com.docker.network.endpoint.ifname=foobar ….--networkflag ondocker run, for exampledocker run --network=name=bridge,driver-opt=com.docker.network.endpoint.ifname=foobar …GwAllocCheckerthen, before a network is created, it will get aGwAllocCheckerRequestwith the network's options. The custom driver may then reply that no gateway IP address should be allocated. moby/moby#49372Port publishing in bridge networks
dockerdnow requiresipsetsupport in the Linux kernel. moby/moby#48596iptablesandip6tablesrules used to implement port publishing and network isolation have been extensively modified. This enables some of the following functional changes, and is a first step in refactoring to enable nativenftablessupport in a future release. moby/moby#48815iptables -Fandip6tables -Fto flush all existingiptablesrules from thefiltertable before starting the older version of the daemon. When that is not possible, run the following commands as root:iptables -D FORWARD -m set --match-set docker-ext-bridges-v4 dst -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT; ip6tables -D FORWARD -m set --match-set docker-ext-bridges-v6 dst -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTiptables -D FORWARD -m set --match-set docker-ext-bridges-v4 dst -j DOCKER; ip6tables -D FORWARD -m set --match-set docker-ext-bridges-v6 dst -j DOCKERACCEPTand need to restore access to unpublished ports, also delete per-bridge-network rules from theDOCKERchains. For example,iptables -D DOCKER ! -i docker0 -o docker0 -j DROP.ip6tablespolicy for theFORWARDchain in thefiltertable toDROPif it enables IP forwarding on the host itself (sysctlsnet.ipv6.conf.all.forwardingandnet.ipv6.conf.default.forwarding). This is now aligned with existing IPv4 behaviour. moby/moby#48594DROP, you may need to update your host's configuration to make sure it is secure.p/-publishis now blocked in theDOCKERiptables chain. moby/moby#48724ACCEPTon your host, and direct routed access to a container's unpublished ports from a remote host is still required, options are:gateway_mode_ipv[46]=nat-unprotected, described below.gateway_mode_ipv[46]=routedare now accessible from other bridge networks running on the same Docker host, as well as from outside the host. moby/moby#48596com.docker.network.bridge.gateway_mode_ipv4andcom.docker.network.bridge.gateway_mode_ipv6now accept modenat-unprotected. moby/moby#48597nat-unprotectedis similar to the defaultnatmode, but no per port/protocol rules are set up. This means any port on a container can be accessed by direct-routing from a remote host.com.docker.network.bridge.gateway_mode_ipv4andcom.docker.network.bridge.gateway_mode_ipv6now accept modeisolated, when the network is alsointernal. moby/moby#49262internalnetwork. So, processes on the Docker host can access the network, and containers in the network can access host services listening on that bridge address (including services listening on "any" host address,0.0.0.0or::).internalbridge network created with gateway modeisolateddoes not have an address on the Docker host.--gateway_mode_ipv[46], container creation will no longer fail. The unused fields may be needed if the gateway endpoint changes when networks are connected or disconnected. A message about the unused fields will be logged. moby/moby#48575IPv6
docker network createoption--ipv4. To disable IPv4 address assignment for a network, usedocker network create --ipv4=false [...]. docker/cli#5599--ipv6("ipv6": trueindaemon.json) can now be used withoutfixed-cidr-v6. moby/moby#48319host-gateway, for compatibility with IPv6-only networks. moby/moby#48807host-gatewayis used in an--add-hostoption in place of an address, it's replaced by an address on the Docker host to make it possible to refer to the host by name. The address used belongs to the default bridge (normallydocker0). Until now it's always been an IPv4 address, because all containers on bridge networks had IPv4 addresses./etc/hostsentries will be created for IPv4 and IPv6 addresses. So, a container that's only connected to IPv6-only networks can access the host by name.--host-gateway-ipoption overrides the address used to replacehost-gateway. Two of these options are now allowed on the command line, for one IPv4 gateway and one IPv6.daemon.jsonfile, to provide two addresses, use"host-gateway-ips". For example,"host-gateway-ips": ["192.0.2.1", "2001:db8::1111"].Bug fixes and enhancements
dockerd. moby/moby#49339systemdauto-start on boot moby/moby#48812volume.subpathdocker/cli#5833docker exportcontinuing the export after the operation is canceled. moby/moby#49265docker exportnot releasing the container's writable layer after a failure. moby/moby#48517docker images --treeunnecessary truncating long image names when multiple names are available docker/cli#5757docker psto be properly bracketed docker/cli#5468docker run. docker/cli#5645docker runto be inconsistent when using--attach stdoutor--attach stderrversusstdin.docker run --attach stdinnow exits if the container exits. docker/cli#5662subidbacked by NSS modules. moby/moby#49036docker psin port bindings are now bracketed docker/cli#5363exec-optsin daemon configuration. moby/moby#48979--gpus=0flag to be consistent with the NVIDIA Container Runtime. moby/moby#48482client.ContainerCreatenow normalizesCapAddandCapDropfields inHostConfigto their canonical form. moby/moby#48551docker image savenow produces stable timestamps. moby/moby#48611docker inspectnow lets you inspect Swarm configs docker/cli#5573Extractinglayer status indocker pull. moby/moby#49064commit,import, andbuildnot preserving a replaced image as a dangling image. moby/moby#48316docker load --platformreturn an error when the requested platform isn't loaded. moby/moby#48718--linkoption. docker/cli#5739com.docker.network.bridge.inhibit_ipv4,ipvlanormacvlannetworks with no parent interface, and L3 IPvlan modes. moby/moby#49261GwAllocCheckerthen, before a network is created, it will get aGwAllocCheckerRequestwith the network's options. The custom driver may then reply that no gateway IP address should be allocated. moby/moby#49372/etc/hostsentries when disconnecting a container from a network. moby/moby#48857fixed-cidrfordocker0, and inferring configuration from a user-managed default bridge (--bridge). moby/moby#48319windows-dns-proxy, introduced in release 26.1.0 to control forwarding to external DNS resolvers from Windows containers, to makenslookupwork. It was enabled by default in release 27.0.0. moby/moby#48738iptablesmangle rule for checksumming SCTP. The rule can be re-enabled by settingDOCKER_IPTABLES_SCTP_CHECKSUM=1in the daemon's environment. This override will be removed in a future release. moby/moby#48149Packaging updates
runcto v1.2.5 (static binaries only). moby/moby#49464dockerd(8)man page has been moved back to themoby/mobyrepository itself. moby/moby#48298Go SDK
Client.ImageBuild()now omits default values from the API request's query string. moby/moby#48651api/types/container: MergeStatsandStatsResponsemoby/moby#49287client.WithVersion: Strip v-prefix when setting API version moby/moby#49352client: AddWithTraceOptionsallowing to specify custom OTe1 trace options. moby/moby#49415client: AddHijackDialerinterface. moby/moby#49388client: AddSwarmManagementAPIClientinterface to describe all API client methods related to Swarm-specific objects. moby/moby#49388client: AddWithTraceOptionsallowing to specify custom OTel trace options. moby/moby#49415client:ImageHistory,ImageLoadandImageSavenow use variadic functional options moby/moby#49466pkg/containerfs: Move to internal moby/moby#48097pkg/reexec: Can now be used on platforms other than Linux, Windows, macOS and FreeBSD moby/moby#49118api/types/container: introduceCommitResponsetype. This is currently an alias forIDResponse, but may become a distinct type in a future release. moby/moby#49444api/types/container: introduceExecCreateResponsetype. This is currently an alias forIDResponse, but may become a distinct type in a future release. moby/moby#49444API
GET /images/{name}/jsonresponse now returns theManifestsfield containing information about the sub-manifests contained in the image index. This includes things like platform-specific manifests and build attestations. moby/moby#48264POST /containers/createnow supportsMountof typeimagefor mounting an image inside a container. moby/moby#48798GET /images/{name}/historynow supports aplatformparameter (JSON encoded OCI Platform type) that lets you specify a platform to show the history of. moby/moby#48295POST /images/{name}/loadandGET /images/{name}/getnow supports aplatformparameter (JSON encoded OCI Platform type) that lets you specify a platform to load/save. Not passing this parameter results in loading/saving the full multi-platform image. moby/moby#48295POST /containers/createendpoint now includes a warning in the response when setting the container-wideVolumeDriveroption in combination with volumes defined throughMountsbecause theVolumeDriveroption has no effect on those volumes. This warning was previously generated by the CLI. moby/moby#48789GET /images/jsonandGET /images/{name}/jsonresponses now includesDescriptorfield, which contains an OCI descriptor of the image target. The new field is only populated if the daemon provides a multi-platform image store. moby/moby#48894GET /containers/{name}/jsonnow returns anImageManifestDescriptorfield containing the OCI descriptor of the platform-specific image manifest of the image that was used to create the container. moby/moby#48855GET /debug/vars,GET /debug/pprof/,GET /debug/pprof/cmdline,GET /debug/pprof/profile,GET /debug/pprof/symbol,GET /debug/pprof/trace,GET /debug/pprof/{name}) are now also accessible through the versioned-API paths (/v<API-version>/<endpoint>). moby/moby#49051500status code instead of400for validation errors. moby/moby#49217HEAD /containers/{name:.*}/archive,GET /containers/{name:.*}/archive,PUT /containers/{name:.*}/archivereturning a500status instead of a400status. moby/moby#49219POST /containers/createnow accepts awritable-cgroups=trueoption inHostConfig.SecurityOptto mount the container's cgroups writable. This provides a more granular approach thanHostConfig.Privileged. moby/moby#48828POST /build/prunerenameskeep-bytestoreserved-spaceand now supports additional prune parametersmax-used-spaceandmin-free-space. moby/moby#48720POST /networks/createnow has anEnableIPv4field. Setting it tofalsedisables IPv4 IPAM for the network. moby/moby#48271GET /networks/{id}now returns anEnableIPv4field showing whether the network has IPv4 IPAM enabled. moby/moby#48271docker0). moby/moby#48323macvlanandipvlannetworks can be created with address assignment disabled for IPv4, IPv6, or both address families. moby/moby#48299POST /networks/{id}/connectandPOST /containers/createnow accept aGwPriorityfield inEndpointsConfig. This value is used to determine which network endpoint provides the default gateway for the container. The endpoint with the highest priority is selected. If multiple endpoints have the same priority, endpoints are sorted lexicographically by their network name, and the one that sorts first is picked. moby/moby#48746GET /containers/jsonnow returns aGwPriorityfield inNetworkSettingsfor each network endpoint. TheGwPriorityfield is used by the CLI’s newgw-priorityoption fordocker runanddocker network connect. moby/moby#48746eth0in--sysctloptions are no longer automatically migrated to the network endpoint. moby/moby#48746docker run --network mynet --sysctl net.ipv4.conf.eth0.log_martians=1 ...is rejected. Instead, you must usedocker run --network name=mynet,driver-opt=com.docker.network.endpoint.sysctls=net.ipv4.conf.IFNAME.log_martians=1 ...GET /containers/jsonnow returns anImageManifestDescriptorfield matching the same field in/containers/{name}/json. This field is only populated if the daemon provides a multi-platform image store. moby/moby#49407Removed
fluentd-async-connecthas been deprecated in v20.10 and is now removed. moby/moby#46114--timeoption ondocker stopanddocker restartis deprecated and renamed to--timeout. docker/cli#5485pkg/ioutils: RemoveNewReaderErrWrapperas it was never used. moby/moby#49258pkg/ioutils: Remove deprecatedBytesPipe,NewBytesPipe,ErrClosed,WriteCounter,NewWriteCounter,NewReaderErrWrapper,NopFlusher. moby/moby#49245pkg/ioutils: Remove deprecatedNopWriterandNopWriteCloser. moby/moby#49256pkg/sysinfo: Remove deprecated NumCPU. moby/moby#49242pkg/broadcaster, as it was only used internally moby/moby#49172cli.Errorstype docker/cli#5549pkg/ioutils.ReadCloserWrapper, as it was only used in tests. moby/moby#49237api-cors-headerconfig parameter and thedockerd--api-cors-headeroption moby/moby#48209APIEndpoint.Versionfield,APIVersiontype, andAPIVersion1andAPIVersion2consts. moby/moby#49004api-cors-headerconfig parameter and the Docker daemon's--api-cors-headeroption. docker/cli#5437pkg/directorypackage moby/moby#48779pkg/dmsg.Dmesg()moby/moby#48109github.jparrowsec.cn/moby/docker-image-spec) moby/moby#48460logentrieslogging driver. moby/moby#48891api/types: Remove deprecatedcontainer.ContainerNodeandContainerJSONBase.Nodefield. moby/moby#48107api/types: Remove deprecated aliases:ImagesPruneReport,VolumesPruneReport,NetworkCreateRequest,NetworkCreate,NetworkListOptions,NetworkCreateResponse,NetworkInspectOptions,NetworkConnect,NetworkDisconnect,EndpointResource,NetworkResource,NetworksPruneReport,ExecConfig,ExecStartCheck,ContainerExecInspect,ContainersPruneReport,ContainerPathStat,CopyToContainerOptions,ContainerStats,ImageSearchOptions,ImageImportSource,ImageLoadResponse,ContainerNode. moby/moby#48107libnetwork/iptables: Remove deprecatedIPV,Iptables,IP6TablesandPassthrough(). moby/moby#49121pkg/archive: Remove deprecatedCanonicalTarNameForPath,NewTempArchive,TempArchivemoby/moby#48708pkg/fileutils: Remove deprecatedGetTotalUsedFdsmoby/moby#49210pkg/ioutils: RemoveOnEOFReader, which was only used internally moby/moby#49170pkg/longpath: Remove deprecatedPrefixconstant. moby/moby#48779pkg/stringid: Remove deprecatedIsShortIDandValidateIDfunctions moby/moby#48705runconfig/opts: Remove deprecatedConvertKVStringsToMapmoby/moby#48102runconfig: Remove deprecatedContainerConfigWrapper,SetDefaultNetModeIfBlank,DefaultDaemonNetworkMode,IsPreDefinedNetworkmoby/moby#48102container: Remove deprecatedErrNameReserved,ErrNameNotReserved. moby/moby#48728Daemon.ContainerInspectCurrent()method and changeDaemon.ContainerInspect()signature to accept abackend.ContainerInspectOptionsstruct moby/moby#48672Daemon.Exists()andDaemon.IsPaused()methods. moby/moby#48723Deprecations
BridgeNfIptablesandBridgeNfIp6tablesfields in theGET /inforesponse are now always befalseand will be omitted in API v1.49. The netfilter module is now loaded on-demand, and no longer during daemon startup, making these fields obsolete. moby/moby#49114errorandprogressfields in streaming responses for endpoints that return a JSON progress response, such asPOST /images/create,POST /images/{name}/push, andPOST /buildare deprecated. moby/moby#49447errorDetailandprogressDetailfields instead.Daemon.Register(). This function is unused and will be removed in the next release. moby/moby#48702client.ImageInspectWithRawfunction in favor of the newclient.ImageInspect. moby/moby#48264daemon/config.Config.ValidatePlatformConfig(). This method was used as helper forconfig.Validate, which should be used instead. moby/moby#48985pkg/reexec. This package is deprecated and moved to a separate module. Usegithub.jparrowsec.cn/moby/sys/reexecinstead. moby/moby#49129--allow-nondistributable-artifactsdaemon flag and correspondingallow-nondistributable-artifactsfield indaemon.json. Setting either option will no longer take an effect, but a deprecation warning log is added. moby/moby#49065RegistryConfig.AllowNondistributableArtifactsCIDRsandRegistryConfig.AllowNondistributableArtifactsHostnamesfields in theGET /infoAPI response. For API version v1.48 and older, the fields are still included in the response, but alwaysnull. In API version v1.49 and later, the field will be omitted entirely. moby/moby#49065registry.ServiceOptions.AllowNondistributableArtifactsfield. moby/moby#49065BridgeNfIptables,BridgeNfIp6tablesfields inapi/types/system.InfoandBridgeNFCallIPTablesDisabled,BridgeNFCallIP6TablesDisabledfields inpkg/sysinfo.SysInfoare deprecated and will be removed in the next release. moby/moby#49114client: DeprecateCommonAPIClientinterface in favor of theAPIClientinterface. TheCommonAPIClientwill be changed to an alias forAPIClientin the next release, and removed in the release after. moby/moby#49388client: DeprecateErrorConnectionFailedhelper. This function was only used internally, and will be removed in the next release. moby/moby#49389pkg/ioutils: DeprecateNewAtomicFileWriter,AtomicWriteFile,AtomicWriteSet,NewAtomicWriteSetin favor ofpkg/atomicwriterequivalents. moby/moby#49171pkg/sysinfo: DeprecateNumCPU. This utility has the same behavior asruntime.NumCPU. moby/moby#49241pkg/system: DeprecateMkdirAll. This function provided custom handling for Windows GUID volume paths. Handling for such paths is now supported by Go standard library in go1.22 and newer, and this function is now an alias foros.MkdirAll, which should be used instead. This alias will be removed in the next release. moby/moby#49162pkg/parsers.ParseKeyValueOpt. moby/moby#49177pkg/parsers.ParseUintListMaximum,pkg/parsers.ParseUintList. These utilities were only used internally and will be removed in the next release. moby/moby#49222api/type.IDResponsein favor ofcontainer.CommitResponseandcontainer.ExecCreateResponse, which are currently an alias, but may become distinct types in a future release. This type will be removed in the next release. moby/moby#49446api/types/container.ContainerUpdateOKBodyin favor ofUpdateResponse. This type will be removed in the next release. moby/moby#49442api/types/container.ContainerTopOKBodyin favor ofTopResponse. This type will be removed in the next release. moby/moby#49442pkg/jsonmessage: Fix deprecation ofProgressMessage,ErrorMessage, which were deprecated in Docker v0.6.0 and v0.7.1 respectively. moby/moby#49447GraphDriverDatafromapi/typestoapi/types/storage. The old type is deprecated and will be removed in the next release. moby/moby#48108RequestPrivilegeFuncfromapi/typestoapi/types/registry. The old type is deprecated and will be removed in the next release. moby/moby#48119api/typestoapi/types/container-NetworkSettings,NetworkSettingsBase,DefaultNetworkSettings,SummaryNetworkSettings,Health,HealthcheckResult,NoHealthcheck,Starting,Healthy, andUnhealthyconstants,MountPoint,Port,ContainerState,Container,ContainerJSONBase,ContainerJSON,ContainerNode. The old types are deprecated and will be removed in the next release. moby/moby#48108api/typestoapi/types/image-ImageInspect,RootFS. The old types are deprecated and will be removed in the next release. moby/moby#48108ContainerdCommit.Expected,RuncCommit.Expected, andInitCommit.Expectedfields in theGET /infoendpoint are deprecated and will be omitted in API v1.49. moby/moby#48478api/types/registry: DeprecateServiceConfig.AllowNondistributableArtifactsCIDRsandServiceConfig.AllowNondistributableArtifactsHostnamesfields. These fields will be removed in the next release. moby/moby#49065api/types/system/Commit.Expectedfield is deprecated and should no longer be used. moby/moby#48478daemon/graphdriver: DeprecateGetDriver()moby/moby#48079libnetwork/iptables: DeprecatePassthrough. This function was only used internally, and will be removed in the next release. moby/moby#49115pkg/directory.Size()function is deprecated, an will be removed in the next release. moby/moby#48057registry: DeprecateAPIEndpoint.TrimHostName; hostname is now trimmed unconditionally for remote names. This field will be removed in the next release. moby/moby#49005allow-nondistributable-artifactsfield indaemon.json. Setting either option will no longer take effect, but a deprecation warning log is added to raise awareness about the deprecation. This warning is planned to become an error in the next release. moby/moby#49065Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.