Trylle

29.7.0

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

New

Add an experimental embedded-containerd feature that runs containerd inside the daemon process instead of as a separate managed process. moby/moby#52898
Mount type image is no longer experimental. moby/moby#52998
Add the default-stop-timeout daemon option to configure the stop timeout assigned to containers without an explicit timeout. moby/moby#53146

Security

This release includes a fix for a security vulnerability affecting Docker Engine and related components.

Update github.com/moby/go-archive to v0.3.0 to fix CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h. moby/moby#53247, docker/cli#7139

Networking

Fix a daemon panic when cleanup of a container's network interface fails while the container is being disconnected from a network. moby/moby#53237
Fix a daemon panic when removing swarm ingress ports after failing to bind an ingress proxy listener. moby/moby#53022

Rootless

Keep the cgroup mount for containers with --net=host. moby/moby#52318

Bug fixes and enhancements

Add shell completion for --filter names and known values to docker service ls, docker service ps, and docker node ps. docker/cli#7124
containerd image store: Fix daemon-wide concurrent download and upload limits for pulls and pushes not being honored. moby/moby#53081
- To preserve the previous unlimited startup behavior, configure "max-concurrent-downloads" and "max-concurrent-uploads" to 0
Fix docker cp -a using the wrong file owner when copying files into containers with user namespace remapping enabled. moby/moby#53084
Fix docker cp from a Windows container silently returning a file instead of an error when the source path ends with a separator but is not a directory. moby/moby#53123
Fix docker stats reporting all zeros for running Windows containers when using the containerd runtime. moby/moby#53101
Fix docker stats reporting empty network stats for running Windows containers when using the containerd runtime. moby/moby#53219
Fix a typo in the docker create --pull flag description. docker/cli#7103
Fix Swarm service updates failing due to "file exists" errors when a VIP IP alias already exists on the LB endpoint interface. moby/moby#51657
Fix Swarm tasks being rejected when their image could not be pulled from the registry but was already present on the node. moby/moby#53212
Improve the error returned when a container hostname exceeds Linux's 64-byte limit. moby/moby#53121
Prevent live-restored volumes from retaining active mount references when containers exit during daemon startup. moby/moby#53115
Suppress the “No such container” error when docker rm --force succeeds for a nonexistent container. docker/cli#7110

Packaging updates

Update Go runtime to 1.26.5. docker/cli#7087
Update BuildKit to v0.32.0. moby/moby#53234
Update containerd (static binaries) to v2.3.3. moby/moby#53050
Update runc (in static binaries) to v1.4.3. moby/moby#50960