Docker Engine 19.03 リリースノート

19.03.15

2021-02-01

セキュリティ

  • CVE-2021-21285 Docker デーモンがクラッシュしても不正なイメージとならないようにしました。
  • CVE-2021-21284 ファイルパーミッションを落とすことで、再マップされたルートが Docker 状態にアクセスできないようにしました。
  • BuildKit 利用によるビルド時に AppArmor や SELinux プロファイルが必ず適用されるようにしました。

クライアント

  • インポート前にコンテキストをチェックするようにし、抽出（解凍）されたファイルがコンテキスト外に保存されるリスクを軽減しました。

19.03.14

2020-12-01

セキュリティ

  • CVE-2020-15257: Update bundled static binaries of containerd to v1.3.9 moby/moby#41731. Package managers should update the containerd.io package.

Builder

  • Beta versions of apparmor are now parsed correctly preventing build failures moby/moby#41542

ネットワーク

ランタイム

Rootless

  • Lock state dir for preventing automatic clean-up by systemd-tmpfiles moby/moby#41635
  • dockerd-rootless.sh: support new containerd shim socket path convention moby/moby#41557

Logging

19.03.13

2020-09-16

Builder

  • buildkit: キャッシュロジックにおける nil 参照を修正しました。 moby/moby#41279
  • buildkit: COPY/ADD の処理中は Unix ソケットを通常ファイルとして取り扱います。 moby/moby#41269
  • buildkit: SELinux 環境であっても、計算処理中はシステムおよびセキュリティ xattrs を無視することで、COPY 時に安定したキャッシングとなるようにしました。 moby/moby#41222
  • buildkit: --cache-from による処理をより安定化させました。 moby/moby#41222
  • buildkit: キャッシュエクスポート時の CPU 無限ループ書き込みを修正しました。 moby/moby#41185

クライアント

  • Golang 1.13.15 へのアップデート。 docker/cli#2674
  • 設定ファイル（~/.docker/config.json）のパーミッション問題を修正しました。 docker/cli#2631
  • build: 高さゼロのターミナルにおける panic を修正しました。 docker/cli#2719
  • windows: コンソール画面での改行文字に関する潜在的な問題を修正しました。 docker/cli#2623

ネットワーク

  • 処理失敗時にネットワークサンドボックスを削除しました。 moby/moby#41081
  • deadline に関するエラーをユーザーにフォワードすることによって、情報量の少ないエラーメッセージを修正しました。 moby/moby#41312
  • ファイルディスクリプター netns の漏れを修正しました。 moby/moby#41287

Rootless

  • port forwarder のリソースリークを修正しました。 moby/moby#41277

ランタイム

Windows

  • servercore イメージ利用時に、Windows コンテナーの起動が遅くなることを修正しました。 moby/moby#41192

19.03.12

2020-06-18

クライアント

  • Fix bug preventing logout from registry when using multiple config files (e.g. Windows vs WSL2 when using Docker Desktop) docker/cli#2592
  • Fix regression preventing context metadata to be read docker/cli#2586
  • Bump Golang 1.13.12 docker/cli#2575

ネットワーク

ランタイム

19.03.11

2020-06-01

ネットワーク

アドレススプーフィングを防止するため、IPv6 ルーター広告（Router Advertisements）を無効にする。 CVE-2020-13401

内容説明

In the Docker default configuration, the container network interface is a virtual ethernet link going to the host (veth interface). In this configuration, an attacker able to run a process as root in a container can send and receive arbitrary packets to the host using the CAP_NET_RAW capability (present in the default configuration).

If IPv6 is not totally disabled on the host (via ipv6.disable=1 on the kernel cmdline), it will be either unconfigured or configured on some interfaces, but it’s pretty likely that ipv6 forwarding is disabled, that is, /proc/sys/net/ipv6/conf//forwarding == 0. Also by default, /proc/sys/net/ipv6/conf//accept_ra == 1. The combination of these 2 sysctls means that the host accepts router advertisements and configures the IPv6 stack using them.

By sending “rogue” router advertisements from a container, an attacker can reconfigure the host to redirect part or all of the IPv6 traffic of the host to the attacker-controlled container.

Even if there was no IPv6 traffic before, if the DNS returns A (IPv4) and AAAA (IPv6) records, many HTTP libraries will try to connect via IPv6 first then fallback to IPv4, giving an opportunity to the attacker to respond. If by chance the host has a vulnerability like last year’s RCE in apt (CVE-2019-3462), the attacker can now escalate to the host.

As CAP_NET_ADMIN is not present by default for Docker containers, the attacker can’t configure the IPs they want to MitM, they can’t use iptables to NAT or REDIRECT the traffic, and they can’t use IP_TRANSPARENT. The attacker can however still use CAP_NET_RAW and implement a tcp/ip stack in user space.

See kubernetes/kubernetes#91507 for related issues.

19.03.10

2020-05-29

クライアント

  • Fix version negotiation with older engine. docker/cli#2538
  • Avoid setting SSH flags through hostname. docker/cli#2560
  • DOCKER_CLI_EXPERIMENTAL が不適切な場合の panic エラーを修正。docker/cli#2558
  • Go 1.13.11 へアップグレードした際、s390x 上での潜在的な panic エラーの回避。docker/cli#2532

Networking

Runtime

  • Avoid potential panic on s390x by upgrading Go to 1.13.11. moby/moby#40978

Packaging

19.03.9

2020-05-14

Builder

  • buildkit: Fix concurrent map write panic when building multiple images in parallel. moby/moby#40780
  • buildkit: Fix issue preventing chowning of non-root-owned files between stages with userns. moby/moby#40955
  • Avoid creation of irrelevant temporary files on Windows. moby/moby#40877

クライアント

Logging

  • Avoid situation preventing container logs to rotate due to closing a closed log file. moby/moby#40921

Networking

Runtime

Rootless

  • Now rootlesskit-docker-proxy returns detailed error message on exposing privileged ports. moby/moby#40863
  • Supports numeric ID in /etc/subuid and /etc/subgid. moby/moby#40951

セキュリティ

Swarm

  • Increase refill rate for logger to avoid hanging on service logs. moby/moby#40628
  • Fix issue where single swarm manager is stuck in Down state after reboot. moby/moby#40831
  • tasks.db no longer grows indefinitely. moby/moby#40831

19.03.8

2020-03-10

Runtime

19.03.7

2020-03-03

Builder

Runtime

クライアント

19.03.6

2020-02-12

Builder

Networking

Runtime

19.03.5

2019-11-14

Builder

  • builder-next: Added entitlements in builder config. docker/engine#412
  • Fix builder-next: permission errors on using build secrets or ssh forwarding with userns-remap. docker/engine#420
  • Fix builder-next: copying a symlink inside an already copied directory. docker/engine#420

Packaging

  • Support RHEL 8 packages

Runtime

19.03.4

2019-10-17

Networking

  • Rollback libnetwork changes to fix DOCKER-USER iptables chain issue. docker/engine#404

Known Issues

Existing

  • In some circumstances with large clusters, Docker information might, as part of the Swarm section, include the error code = ResourceExhausted desc = grpc: received message larger than max (5351376 vs. 4194304). This does not indicate any failure or misconfiguration by the user, and requires no response.
  • Orchestrator port conflict can occur when redeploying all services as new. Due to many Swarm manager requests in a short amount of time, some services are not able to receive traffic and are causing a 404 error after being deployed.
    • Workaround: restart all tasks via docker service update --force.
  • CVE-2018-15664 symlink-exchange attack with directory traversal. Workaround until proper fix is available in upcoming patch release: docker pause container before doing file operations. moby/moby#39252
  • docker cp regression due to CVE mitigation. An error is produced when the source of docker cp is set to /.

19.03.3

2019-10-08

セキュリティ

Builder

  • Fix builder-next: resolve digest for third party registries. docker/engine#339

  • Fix builder-next: user namespace builds when daemon started with socket activation. docker/engine#373

  • Fix builder-next; session: release forwarded ssh socket connection per connection. docker/engine#373

  • Fix build-next: llbsolver: error on multiple cache importers. docker/engine#373

クライアント

  • Added support for Docker Template 0.1.6.

  • Mitigate against YAML files that have excessive aliasing. docker/cli#2119

Runtime

Known Issues

New

  • DOCKER-USER iptables chain is missing: docker/for-linux#810. Users cannot perform additional container network traffic filtering on top of this iptables chain. You are not affected by this issue if you are not customizing iptable chains on top of DOCKER-USER.
    • Workaround: Insert the iptables chain after the docker daemon starts. For example: 
      iptables -N DOCKER-USER
iptables -I FORWARD -j DOCKER-USER
iptables -A DOCKER-USER -j RETURN

Existing

  • In some circumstances with large clusters, docker information might, as part of the Swarm section, include the error code = ResourceExhausted desc = grpc: received message larger than max (5351376 vs. 4194304). This does not indicate any failure or misconfiguration by the user, and requires no response.
  • Orchestrator port conflict can occur when redeploying all services as new. Due to many swarm manager requests in a short amount of time, some services are not able to receive traffic and are causing a 404 error after being deployed.
    • Workaround: restart all tasks via docker service update --force.
  • CVE-2018-15664 symlink-exchange attack with directory traversal. Workaround until proper fix is available in upcoming patch release: docker pause container before doing file operations. moby/moby#39252
  • docker cp regression due to CVE mitigation. An error is produced when the source of docker cp is set to /.

19.03.2

2019-09-03

Builder

クライアント

  • Fix Windows absolute path detection on non-Windows docker/cli#1990

  • Fix to zsh completion script for docker login --username.

  • Fix context: produce consistent output on context create. docker/cli#1985

  • Fix support for HTTP proxy env variable. docker/cli#2059

Logging

Networking

  • Prevent panic on network attached to a container with disabled networking. moby/moby#39589

Runtime

  • Bump Golang to 1.12.8.

  • Fix a potential engine panic when using XFS disk quota for containers. moby/moby#39644

Swarm

Known issues

  • In some circumstances with large clusters, docker information might, as part of the Swarm section, include the error code = ResourceExhausted desc = grpc: received message larger than max (5351376 vs. 4194304). This does not indicate any failure or misconfiguration by the user, and requires no response.
  • Orchestrator port conflict can occur when redeploying all services as new. Due to many swarm manager requests in a short amount of time, some services are not able to receive traffic and are causing a 404 error after being deployed.
    • Workaround: restart all tasks via docker service update --force.
  • Traffic cannot egress the HOST because of missing Iptables rules in the FORWARD chain The missing rules are : 
       /sbin/iptables --wait -C FORWARD -o docker_gwbridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
   /sbin/iptables --wait -C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    • Workaround: Add these rules back using a script and cron definitions. The script must contain ‘-C’ commands to check for the presence of a rule and ‘-A’ commands to add rules back. Run the script on a cron in regular intervals, for example, every minutes.
    • Affected versions: 18.09.1, 19.03.0
  • CVE-2018-15664 symlink-exchange attack with directory traversal. Workaround until proper fix is available in upcoming patch release: docker pause container before doing file operations. moby/moby#39252
  • docker cp regression due to CVE mitigation. An error is produced when the source of docker cp is set to /.

19.03.1

2019-07-25

セキュリティ

  • Fixed loading of nsswitch based config inside chroot under Glibc. CVE-2019-14271

Known issues

  • In some circumstances, in large clusters, docker information might, as part of the Swarm section, include the error code = ResourceExhausted desc = grpc: received message larger than max (5351376 vs. 4194304). This does not indicate any failure or misconfiguration by the user, and requires no response.
  • Orchestrator port conflict can occur when redeploying all services as new. Due to many swarm manager requests in a short amount of time, some services are not able to receive traffic and are causing a 404 error after being deployed.
    • Workaround: restart all tasks via docker service update --force.
  • Traffic cannot egress the HOST because of missing Iptables rules in the FORWARD chain The missing rules are : 
      /sbin/iptables --wait -C FORWARD -o docker_gwbridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  /sbin/iptables --wait -C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    • Workaround: Add these rules back using a script and cron definitions. The script must contain ‘-C’ commands to check for the presence of a rule and ‘-A’ commands to add rules back. Run the script on a cron in regular intervals, for example, every minutes.
    • Affected versions: 18.09.1, 19.03.0
  • CVE-2018-15664 symlink-exchange attack with directory traversal. Workaround until proper fix is available in upcoming patch release: docker pause container before doing file operations. moby/moby#39252
  • docker cp regression due to CVE mitigation. An error is produced when the source of docker cp is set to /.

19.03.0

2019-07-22

Builder

クライアント

API

Experimental

セキュリティ

Runtime

Networking

Swarm

Logging

Deprecation

  • Deprecate image manifest v2 schema1 in favor of v2 schema2. Future version of Docker will remove support for v2 schema1 althogether. moby/moby#39365
  • Removed v1.10 migrator. moby/moby#38265
  • Now skipping deprecated storage-drivers in auto-selection. moby/moby#38019
  • Deprecated aufs storage driver and added warning. moby/moby#38090
  • Removed support for 17.09.

For more information on deprecated flags and APIs, refer to https://docs.docker.com/engine/deprecated/ for target removal dates.

Known issues

  • In some circumstances with large clusters, docker information might, as part of the Swarm section, include the error code = ResourceExhausted desc = grpc: received message larger than max (5351376 vs. 4194304). This does not indicate any failure or misconfiguration by the user, and requires no response.
  • Orchestrator port conflict can occur when redeploying all services as new. Due to many swarm manager requests in a short amount of time, some services are not able to receive traffic and are causing a 404 error after being deployed.
    • Workaround: restart all tasks via docker service update --force.
  • Traffic cannot egress the HOST because of missing Iptables rules in the FORWARD chain The missing rules are : 
      /sbin/iptables --wait -C FORWARD -o docker_gwbridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  /sbin/iptables --wait -C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    • Workaround: Add these rules back using a script and cron definitions. The script must contain ‘-C’ commands to check for the presence of a rule and ‘-A’ commands to add rules back. Run the script on a cron in regular intervals, for example, every minutes.
    • Affected versions: 18.09.1, 19.03.0
  • CVE-2018-15664 symlink-exchange attack with directory traversal. Workaround until proper fix is available in upcoming patch release: docker pause container before doing file operations. moby/moby#39252
  • docker cp regression due to CVE mitigation. An error is produced when the source of docker cp is set to /.