29.9.0-rc.1

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

• docker/cli, 29.9.0 milestone
• moby/moby, 29.9.0 milestone

Bug fixes and enhancements

• containerd image store: Fix pulls skipping required layer blobs when unpacked layers already exist, leaving images runnable but incomplete for export or push. moby/moby#53615
• Fix docker container create --name reporting a misleading validation error mentioning invalid characters instead of invalid name length. moby/moby#53484
• Fix a connection leak to the RootlessKit API socket on every GET /version request in rootless mode. moby/moby#53836

Packaging updates

• Update BuildKit to v0.34.0-rc1. moby/moby#53830
• Update containerd (static binaries) to v2.4.1. moby/moby#53773

Networking

• Allow IPv6 Neighbour Discovery between containers on a bridge network with inter-container communication disabled, matching the existing IPv4 behaviour. moby/moby#53723
• Fix docker ps and GET /containers/json omitting published ports for networks using routed gateway mode. moby/moby#53693
• Fix a bug where a restarted daemon could be dropped from a peer's service discovery and load balancing until it rejoined the gossip cluster. moby/moby#53688
• Fix a published port being unreachable from another container on the same network when inter-container communication is disabled, including Swarm services published through the routing mesh. moby/moby#53723
• Fix an issue where errors programming the kernel to encrypt the overlay network data-plane could in some circumstances lead to encrypted-overlay-network traffic to some nodes being transmitted in cleartext. As the receiving peer would drop cleartext packets for encrypted overlay networks as spoofed, the loss of confidentiality is limited to unidirectional flows (e.g. UDP DNS queries) and handshake attempts that never proceed (e.g. TCP SYN). moby/moby#53420
• Fix connecting live-restored containers with an implicit host-gateway mapping to additional networks. moby/moby#53093
• Fix overlay peers becoming unreachable after a node rejoins the cluster or a service is redeployed, when the VXLAN device had already learned a dynamic FDB entry for the peer. moby/moby#53663
• Published Swarm-service ports are accessible at the host's IPv6 addresses when the userland proxy is enabled. A change introduced in v29.8.0 incidentally enabled this functionality; it is a tested and supported feature as of v29.9.0. moby/moby#53727
• Release a node's IPsec security associations and policies when the last container leaves an encrypted overlay network, instead of leaking them until the daemon restarts. moby/moby#53420
• Restore the logic to remove the empty DOCKER-INGRESS iptables chain, and the FORWARD rule that jumps to it, left behind by Docker Engine 28.0.0 and earlier. moby/moby#53825

Rootless

• Update RootlessKit (3.2.0). moby/moby#53607