Docker Engine 19.03 release notes

もくじ

19.03.15

2021-02-01

Security

  • CVE-2021-21285 Prevent an invalid image from crashing docker daemon
  • CVE-2021-21284 Lock down file permissions to prevent remapped root from accessing docker state
  • Ensure AppArmor and SELinux profiles are applied when building with BuildKit

Client

  • Check contexts before importing them to reduce risk of extracted files escaping context store

19.03.14

2020-12-01

Security

  • CVE-2020-15257: Update bundled static binaries of containerd to v1.3.9 moby/moby#41731. Package managers should update the containerd.io package.

Builder

  • Beta versions of apparmor are now parsed correctly preventing build failures moby/moby#41542

Networking

Runtime

Rootless

  • Lock state dir for preventing automatic clean-up by systemd-tmpfiles moby/moby#41635
  • dockerd-rootless.sh: support new containerd shim socket path convention moby/moby#41557

Logging

19.03.13

2020-09-16

Builder

  • buildkit: Fix nil dereference in cache logic moby/moby#41279
  • buildkit: Treat Unix sockets as regular files during COPY/ADD moby/moby#41269
  • buildkit: Ignore system and security xattrs in calculation to ensure consistent COPY caching regardless of SELinux environment moby/moby#41222
  • buildkit: Make --cache-from behavior more reliable moby/moby#41222
  • buildkit: Fix infinite loop burning CPU when exporting cache moby/moby#41185

Client

Networking

Rootless

Runtime

Windows

  • Fix slow Windows container start time when using servercore image moby/moby#41192

19.03.12

2020-06-18

Client

  • Fix bug preventing logout from registry when using multiple config files (e.g. Windows vs WSL2 when using Docker Desktop) docker/cli#2592
  • Fix regression preventing context metadata to be read docker/cli#2586
  • Bump Golang 1.13.12 docker/cli#2575

Networking

Runtime

19.03.11

2020-06-01

Network

Disable IPv6 Router Advertisements to prevent address spoofing. CVE-2020-13401

Description

In the Docker default configuration, the container network interface is a virtual ethernet link going to the host (veth interface). In this configuration, an attacker able to run a process as root in a container can send and receive arbitrary packets to the host using the CAP_NET_RAW capability (present in the default configuration).

If IPv6 is not totally disabled on the host (via ipv6.disable=1 on the kernel cmdline), it will be either unconfigured or configured on some interfaces, but it’s pretty likely that ipv6 forwarding is disabled, that is, /proc/sys/net/ipv6/conf//forwarding == 0. Also by default, /proc/sys/net/ipv6/conf//accept_ra == 1. The combination of these 2 sysctls means that the host accepts router advertisements and configures the IPv6 stack using them.

By sending “rogue” router advertisements from a container, an attacker can reconfigure the host to redirect part or all of the IPv6 traffic of the host to the attacker-controlled container.

Even if there was no IPv6 traffic before, if the DNS returns A (IPv4) and AAAA (IPv6) records, many HTTP libraries will try to connect via IPv6 first then fallback to IPv4, giving an opportunity to the attacker to respond. If by chance the host has a vulnerability like last year’s RCE in apt (CVE-2019-3462), the attacker can now escalate to the host.

As CAP_NET_ADMIN is not present by default for Docker containers, the attacker can’t configure the IPs they want to MitM, they can’t use iptables to NAT or REDIRECT the traffic, and they can’t use IP_TRANSPARENT. The attacker can however still use CAP_NET_RAW and implement a tcp/ip stack in user space.

See kubernetes/kubernetes#91507 for related issues.

19.03.10

2020-05-29

Client

Networking

Runtime

Packaging

19.03.9

2020-05-14

Builder

  • buildkit: Fix concurrent map write panic when building multiple images in parallel. moby/moby#40780
  • buildkit: Fix issue preventing chowning of non-root-owned files between stages with userns. moby/moby#40955
  • Avoid creation of irrelevant temporary files on Windows. moby/moby#40877

Client

Logging

  • Avoid situation preventing container logs to rotate due to closing a closed log file. moby/moby#40921

Networking

Runtime

Rootless

  • Now rootlesskit-docker-proxy returns detailed error message on exposing privileged ports. moby/moby#40863
  • Supports numeric ID in /etc/subuid and /etc/subgid. moby/moby#40951

Security

Swarm

19.03.8

2020-03-10

Runtime

19.03.7

2020-03-03

Builder

Runtime

Client

19.03.6

2020-02-12

Builder

Networking

Runtime

19.03.5

2019-11-14

Builder

  • builder-next: Added entitlements in builder config. docker/engine#412
  • Fix builder-next: permission errors on using build secrets or ssh forwarding with userns-remap. docker/engine#420
  • Fix builder-next: copying a symlink inside an already copied directory. docker/engine#420

Packaging

  • Support RHEL 8 packages

Runtime

19.03.4

2019-10-17

Networking

  • Rollback libnetwork changes to fix DOCKER-USER iptables chain issue. docker/engine#404

Known Issues

Existing

  • In some circumstances with large clusters, Docker information might, as part of the Swarm section, include the error code = ResourceExhausted desc = grpc: received message larger than max (5351376 vs. 4194304). This does not indicate any failure or misconfiguration by the user, and requires no response.
  • Orchestrator port conflict can occur when redeploying all services as new. Due to many Swarm manager requests in a short amount of time, some services are not able to receive traffic and are causing a 404 error after being deployed.
    • Workaround: restart all tasks via docker service update --force.
  • CVE-2018-15664 symlink-exchange attack with directory traversal. Workaround until proper fix is available in upcoming patch release: docker pause container before doing file operations. moby/moby#39252
  • docker cp regression due to CVE mitigation. An error is produced when the source of docker cp is set to /.

19.03.3

2019-10-08

Security

Builder

  • Fix builder-next: resolve digest for third party registries. docker/engine#339

  • Fix builder-next: user namespace builds when daemon started with socket activation. docker/engine#373

  • Fix builder-next; session: release forwarded ssh socket connection per connection. docker/engine#373

  • Fix build-next: llbsolver: error on multiple cache importers. docker/engine#373

Client

  • Added support for Docker Template 0.1.6.

  • Mitigate against YAML files that have excessive aliasing. docker/cli#2119

Runtime

Known Issues

New

  • DOCKER-USER iptables chain is missing: docker/for-linux#810. Users cannot perform additional container network traffic filtering on top of this iptables chain. You are not affected by this issue if you are not customizing iptable chains on top of DOCKER-USER.
    • Workaround: Insert the iptables chain after the docker daemon starts. For example:
      iptables -N DOCKER-USER
iptables -I FORWARD -j DOCKER-USER
iptables -A DOCKER-USER -j RETURN

Existing

  • In some circumstances with large clusters, docker information might, as part of the Swarm section, include the error code = ResourceExhausted desc = grpc: received message larger than max (5351376 vs. 4194304). This does not indicate any failure or misconfiguration by the user, and requires no response.
  • Orchestrator port conflict can occur when redeploying all services as new. Due to many swarm manager requests in a short amount of time, some services are not able to receive traffic and are causing a 404 error after being deployed.
    • Workaround: restart all tasks via docker service update --force.
  • CVE-2018-15664 symlink-exchange attack with directory traversal. Workaround until proper fix is available in upcoming patch release: docker pause container before doing file operations. moby/moby#39252
  • docker cp regression due to CVE mitigation. An error is produced when the source of docker cp is set to /.

19.03.2

2019-09-03

Builder

Client

  • Fix Windows absolute path detection on non-Windows docker/cli#1990

  • Fix to zsh completion script for docker login --username.

  • Fix context: produce consistent output on context create. docker/cli#1985

  • Fix support for HTTP proxy env variable. docker/cli#2059

Logging

Networking

  • Prevent panic on network attached to a container with disabled networking. moby/moby#39589

Runtime

  • Bump Golang to 1.12.8.

  • Fix a potential engine panic when using XFS disk quota for containers. moby/moby#39644

Swarm

Known issues

  • In some circumstances with large clusters, docker information might, as part of the Swarm section, include the error code = ResourceExhausted desc = grpc: received message larger than max (5351376 vs. 4194304). This does not indicate any failure or misconfiguration by the user, and requires no response.

  • Orchestrator port conflict can occur when redeploying all services as new. Due to many swarm manager requests in a short amount of time, some services are not able to receive traffic and are causing a 404 error after being deployed.

    • Workaround: restart all tasks via docker service update --force.

  • Traffic cannot egress the HOST because of missing Iptables rules in the FORWARD chain The missing rules are :

    /sbin/iptables --wait -C FORWARD -o docker_gwbridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables --wait -C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    • Workaround: Add these rules back using a script and cron definitions. The script must contain '-C' commands to check for the presence of a rule and '-A' commands to add rules back. Run the script on a cron in regular intervals, for example, every minutes.
    • Affected versions: 18.09.1, 19.03.0

  • CVE-2018-15664 symlink-exchange attack with directory traversal. Workaround until proper fix is available in upcoming patch release: docker pause container before doing file operations. moby/moby#39252

  • docker cp regression due to CVE mitigation. An error is produced when the source of docker cp is set to /.

19.03.1

2019-07-25

Security

  • Fixed loading of nsswitch based config inside chroot under Glibc. CVE-2019-14271

Known issues

  • In some circumstances, in large clusters, docker information might, as part of the Swarm section, include the error code = ResourceExhausted desc = grpc: received message larger than max (5351376 vs. 4194304). This does not indicate any failure or misconfiguration by the user, and requires no response.

  • Orchestrator port conflict can occur when redeploying all services as new. Due to many swarm manager requests in a short amount of time, some services are not able to receive traffic and are causing a 404 error after being deployed.

    • Workaround: restart all tasks via docker service update --force.

  • Traffic cannot egress the HOST because of missing Iptables rules in the FORWARD chain The missing rules are :

    /sbin/iptables --wait -C FORWARD -o docker_gwbridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables --wait -C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    • Workaround: Add these rules back using a script and cron definitions. The script must contain '-C' commands to check for the presence of a rule and '-A' commands to add rules back. Run the script on a cron in regular intervals, for example, every minutes.
    • Affected versions: 18.09.1, 19.03.0

  • CVE-2018-15664 symlink-exchange attack with directory traversal. Workaround until proper fix is available in upcoming patch release: docker pause container before doing file operations. moby/moby#39252

  • docker cp regression due to CVE mitigation. An error is produced when the source of docker cp is set to /.

19.03.0

2019-07-22

Builder

Client

API

Experimental

Security

Runtime

Networking

Swarm

Logging

Deprecation

  • Deprecate image manifest v2 schema1 in favor of v2 schema2. Future version of Docker will remove support for v2 schema1 althogether. moby/moby#39365
  • Removed v1.10 migrator. moby/moby#38265
  • Now skipping deprecated storage-drivers in auto-selection. moby/moby#38019
  • Deprecated aufs storage driver and added warning. moby/moby#38090
  • Removed support for 17.09.

For more information on deprecated flags and APIs, refer to deprecation information for target removal dates.

Known issues

  • In some circumstances with large clusters, docker information might, as part of the Swarm section, include the error code = ResourceExhausted desc = grpc: received message larger than max (5351376 vs. 4194304). This does not indicate any failure or misconfiguration by the user, and requires no response.

  • Orchestrator port conflict can occur when redeploying all services as new. Due to many swarm manager requests in a short amount of time, some services are not able to receive traffic and are causing a 404 error after being deployed.

    • Workaround: restart all tasks via docker service update --force.

  • Traffic cannot egress the HOST because of missing Iptables rules in the FORWARD chain The missing rules are :

    /sbin/iptables --wait -C FORWARD -o docker_gwbridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables --wait -C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    • Workaround: Add these rules back using a script and cron definitions. The script must contain '-C' commands to check for the presence of a rule and '-A' commands to add rules back. Run the script on a cron in regular intervals, for example, every minutes.
    • Affected versions: 18.09.1, 19.03.0

  • CVE-2018-15664 symlink-exchange attack with directory traversal. Workaround until proper fix is available in upcoming patch release: docker pause container before doing file operations. moby/moby#39252

  • docker cp regression due to CVE mitigation. An error is produced when the source of docker cp is set to /.