The DCO policy used here appears to have been derived from the Linux
kernel's guidance. In 2023, that guidance changed to relax the "real
name" requirement to a "known identity".
The DCO sign-off identifies the person certifying that they have the
right to submit a contribution. The previous wording required a "real
name" and rejected pseudonyms, which could discourage contributors
whose preferred or community name is the identity by which they can be
known.
The requirement is not anonymity: the identity in the sign-off must be
known enough for the project to follow up about the contribution if a
question arises. It does not require a legal name or a government-issued
identity. Use the clarified wording from the Linux kernel so known
pseudonyms and preferred names remain acceptable while anonymous
contributions remain excluded.
This also reflects concerns raised in the CNCF community about whether
"real name" means a legal name, a government-issued identity, or a
public identity that is sufficient to identify and contact a
contributor. The discussion emphasized that attribution and future
accountability do not require publishing a legal identity, and that
strict public-name rules can exclude people who cannot safely contribute
under that name.
Source: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d4563201f33a022fc035
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This release includes a fix to address a breakage affecting unencrypted
HTTP/2 (h2c) connections caused by a security patch included in last
patch release.
See go.dev/issue/80876 for details.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Notable changes:
- Add bidirectional `log/slog` integration with a Logrus hook and `slog.Handler`.
- Add minimal, composable logging interfaces for individual log levels.
- Fix reentrant logging deadlocks and improve concurrency safety around formatters, hooks, and entries.
- Fix generic `Log`, `Logf`, `Logln`, and `LogFn` methods unexpectedly panicking at `PanicLevel`.
- Allow `Entry.Caller` to be set explicitly and preserved across derived entries.
- Improve `TextFormatter` performance and reduce allocations significantly.
- Improve common Logger and Entry hot paths and caller-reporting performance.
- Update `TextFormatter` handling for `[]byte`, debug/trace colors, and Windows ANSI terminals.
- Raise the minimum supported Go version to Go 1.23.
- Deprecate `Entry.HasCaller` and `MutexWrap`.
release-notes: https://github.com/sirupsen/logrus/releases/tag/v1.10.0
release-notes: https://github.com/sirupsen/logrus/releases/tag/v1.10.1
full diff: https://github.com/sirupsen/logrus/compare/v1.9.4...v1.10.1
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This release includes 10 security fixes following the security policy:
- x/mod/sumdb/tlog: fix transparency log tile verification bypass
A malicious GOPROXY was previously capable of forging
up to two sumdb tiles that allow for a requested module
to bypass the GOSUMDB check and persist attacker-controlled
module content to a local Go module cache.
This attack allows for a malicious GOPROXY to serve
malicious module content that cannot be detected
by evaluating the transparency log.
All tiles are now correctly verified against their parents.
In order to determine if you have been affected:
rm -r go.sum go.work.sum vendor/ && go mod tidy
Thanks to Filippo Valsorda (Geomys) for reporting this issue.
This is CVE-2026-56865 and Go issue https://go.dev/issue/80744.
- x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup
A malicious GOSUMDB was capable of serving arbitrary
module content not contained within the transparency
log.
This attack allows for a coordinating GOPROXY and
GOSUMDB to serve a client malicious module content
that cannot be detected by evaluating the transparency
log.
In order to determine if you have been affected:
rm -r go.sum go.work.sum vendor/ && go mod tidy
Thanks to mundur for reporting this issue.
This is CVE-2026-56864 and Go issue https://go.dev/issue/80745.
- encoding/xml: add recursion depth guard during decode
Previously, DecodeElement would reset the depth counter
causing it to never fire; this could lead to stack
exhaustion.
This is CVE-2026-56859 and Go issue https://go.dev/issue/80481.
net/http: apply ReadHeaderTimeout when doing unencrypted HTTP/2 check
When a server is configured to support unencrypted HTTP/2, it reads a
few bytes from each new connection to see if they contain the HTTP/2
client preface. Previously, this was being done with no timeout applied.
ReadHeaderTimeout is now applied for this.
This is CVE-2026-56853 and Go issue https://go.dev/issue/80205.
- net/url: avoid quadratic complexity in resolvePath
Previously, resolving relative paths containing parent directory (..) segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.
Now, path resolution operates on a byte buffer using index-based backtracking for .. segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
This is CVE-2026-56860 and Go issue https://go.dev/issue/80494.
- golang.org/x/net/dns/dnsmessage: panic when parsing invalid SVCB record
Parsing an invalid SVCB or HTTPS RR can panic when
the size of a parameter value overflows the message buffer.
Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.
This is CVE-2026-46600 and Go issue https://go.dev/issue/79795.
- crypto/tls: limit handshake messages we are willing to accept post-handshake
Previously, we always counted handshake messages, such as KeyUpdate, as
state-advancing, regardless of whether a handshake has been completed or
not. As a result, a malicious client can keep sending KeyUpdate messages
to force the server to keep performing key derivation operations
indefinitely.
Thanks to Qi Deng of Aurascape.ai for reporting this issue.
This is CVE-2026-56862 and Go issue https://go.dev/issue/80528.
- html/template: fix Javascript regexp context tracking
Previously, pathological inputs could close an
unescaped / early, allowing for attack-controlled
data to inject arbitrary content, potentially
leading to XSS.
Thanks to Ali Sherif for reporting this issue.
This is CVE-2026-56858 and Go issue https://go.dev/issue/80435.
- x/net/idna: failure to reject ASCII-only Punycode-encoded labels
The ToASCII and ToUnicode functions incorrectly accepted Punycode-encoded labels
that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com")
incorrectly returned the name "example.com" rather than an error.
The idna package implements the processing algorithm from UTS 46.
Older versions of UTS 46 included a specification bug which permitted
multiple ASCII labels to decode to the same Unicode label.
UTS 46 revision 33 fixed the specification bug.
The idna package now implements the updated specification.
This behavior can lead to privilege escalation in programs using the idna package.
For example, a program which performs privilege checks on the ASCII hostname
may reject "example.com" but permit "xn--example-.com". If that program subsequently
converts the ASCII hostname to Unicode, it will inadvertently permits access
to the Unicode name "example.com".
Thanks to KC1zs4 (https://github.com/KC1zs4) for reporting this issue.
This is CVE-2026-39821 and Go issue https://go.dev/issue/78760.
- encoding/asn1: enforce maximum recursion depth
Enforce a recursion limit in Unmarshal to prevent stack exhaustion
when parsing deeply-nested, recursive structures.
Thanks to Marwan Atia (marwans...@gmail.com) for reporting this issue.
This is CVE-2026-33818 and Go issue https://go.dev/issue/80405.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
commit 55fcffe743 added normalization
in config/configfile, so it's no longer needed to normalize here as
well.
updates 55fcffe743
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
`comparePorts` compared host IPs with `i.IP.String() < j.IP.String()`, which
sorts them lexicographically, so "10.0.0.2" ordered before "9.0.0.1" in
`docker ps` output.
This also avoids formatting both addresses as strings on every comparison.
ports before after
64 1540 allocs/op 394 allocs/op
256 5364 allocs/op 1548 allocs/op
That's a ~74% (3.9x) reduction in allocations.
Signed-off-by: Hamir <hirehamir@gmail.com>
Both makeEnv and updateHosts removed elements from a slice while ranging
over that same slice. The range expression is evaluated once, so after a
removal the loop keeps using the original length: it reads stale elements
that shifted down, skips a live element, and can slice past the end of the
shrunken slice, which panics.
In makeEnv, the "no update required" continue also applied to the inner
loop instead of skipping the re-append, so an env-var passed twice with
the same value was stored twice. A third occurrence with a different value
then tried to remove both entries and panicked:
docker service create --env A=1 --env A=1 --env A=2 --name repro nginx
panic: runtime error: slice bounds out of range [2:1]
The same happens with an env-file that lists a variable twice, and the
panic occurs before any API call, so no daemon is needed to hit it.
updateHosts has the same problem when a hostname is listed more than once
in a single entry: --host-rm either leaves a copy behind or panics with
"slice bounds out of range". That needs a spec written through the API or
swarmkit directly, as the CLI does not produce such entries itself, so it
is less likely to be hit in practice.
Use slices.DeleteFunc for both, which removes every match in one pass, and
add tests for makeEnv, which had no coverage.
Signed-off-by: Madan Kumar <winklemad@outlook.com>
full diff: https://github.com/moby/go-archive/compare/v0.2.1...v0.3.0
v0.3.0
This release fixes CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h, where a crafted
tar archive could use links to cause extraction operations to create or
overwrite files outside the intended destination directory.
The issue affected Unpack, UnpackLayer, Untar, UntarUncompressed, and the
ApplyLayer helpers. Users should upgrade and avoid extracting untrusted
archives with earlier versions.
What's Changed
* archive: harden tar extraction against path traversal
* archive: do not follow reparse points in chtimes
* archive: fix creation time updates on Windows
* archive: minor cleanups and godoc touch-up
* archive: RebaseArchiveEntries: fix archive path rebasing
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Relevant changes (in vendor):
- bpf: add security considerations to package docs
- http2: initialize Transport on NewClientConn
fixes: x/net/http2: zero Transport not ready for use
- idna: reject all-ASCII xn-- labels on all Go versions
fixes x/net/idna: ToUnicode accepts Punycode labels encoding pure ASCII labels
full diff: https://github.com/golang/net/compare/v0.56.0...v0.57.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- cpu: handle vendor suffixes in parseRelease
- unix: update glibc to 2.43
- unix: use epoll_pwait rather than epoll_wait
- windows: avoid length overflow in NewNTString
- windows: document safe usage of TrusteeValue
full diff: https://github.com/golang/sys/compare/v0.46.0...v0.47.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The migration to the generated (V2) shell completions dropped the
"--filter" key/value suggestions that the legacy bash completion used to
provide for the swarm commands, so e.g. "docker service ps <service>
--filter <TAB>" no longer completed anything.
Register filter completions for "docker service ps", "docker service
ls", and "docker node ps", following the same approach as the existing
completion for "docker events --filter".
Signed-off-by: Jess Thrysoee <jess@thrysoee.dk>
opts/weightdevice.go and opts/throttledevice.go had no tests, unlike the
sibling opts. Add table-driven coverage for ValidateWeightDevice,
ValidateThrottleBpsDevice, ValidateThrottleIOpsDevice and the Set/GetList
paths, including boundary (weight 0/10/1000/overflow) and error cases.
Signed-off-by: Nikolaus Schuetz <nikolauspschuetz@gmail.com>
The development and e2e containers hard-code /var/run/docker.sock, so
rootless and other local contexts cannot expose their daemon socket.
Resolve the active context's Docker endpoint and strip the unix scheme
before using it as the bind source.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
`workflows` is not a supported GITHUB_TOKEN permission key, so GitHub
rejects the workflow definition. Use the valid `actions` permission
for both jobs.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Without it GitHub rejects the push:
```
refusing to allow a GitHub App to create or update workflow `.github/workflows/build.yml` without `workflows` permission
```
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The workflow previously inferred its target from the dispatch ref,
requiring operators to always sync the release branch with the
workflow/scripts on master.
Accept the release branch as an input, keep the dispatched master
checkout as the script source, and merge in a detached worktree at the
selected release revision.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The project was sunset;
> After more than a decade of serving the ecosystem, the time
> has come to sunset Go Report Card. Following the loss of our
> primary infrastructure sponsor, maintaining the web app is
> no longer sustainable.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Add a manually dispatched workflow for maintainers to sync a Docker
release branch to a selected release tag.
The sync-release-branch job checks out the release branch, computes
the list of unmerged tags up to the requested tag via
scripts/unmerged-tags, merges them in order via scripts/sync-branch
using git merge --no-ff (resolving conflicts by taking the tag's
content), then pushes the result to a temporary branch.
The push-release-branch job runs after manual approval via the
docker-releases environment. It verifies that neither the release
branch nor the temporary branch moved since the sync job ran before
force-advancing the release branch and deleting the temporary branch.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Bumps the go_modules group with 1 update in the /cmd/docker-trust directory: [golang.org/x/crypto](https://github.com/golang/crypto).
Updates `golang.org/x/crypto` from 0.50.0 to 0.52.0
- [Commits](https://github.com/golang/crypto/compare/v0.50.0...v0.52.0)
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-version: 0.52.0
dependency-type: indirect
dependency-group: go_modules
...
Signed-off-by: dependabot[bot] <support@github.com>
go1.26.5 (released 2026-07-07) includes security fixes to the crypto/tls
and os packages, as well as bug fixes to the compiler, the runtime, the
go command, and the net, os, and syscall packages. See the Go 1.26.5
milestone on our issue tracker for details;
- https://github.com/golang/go/issues?q=milestone%3AGo1.26.5+label%3ACherryPickApproved
- full diff: https://github.com/golang/go/compare/go1.26.4...go1.26.5
From the security announcement:
We have just released Go versions 1.26.5 and 1.25.12, minor point releases.
These releases include 2 security fixes following the security policy:
- os: Root escape via symlink plus trailing slash
On Unix systems, opening a file in an os.Root improperly
followed symlinks to locations outside of the Root when
the final path component of the a path is a symbolic link
and the path ends in /.
For example, root.Open("symlink/") would open "symlink"
even when "symlink" is a symbolic link pointing outside of the root.
On Unix, openat(fd, path, O_NOFOLLOW) will follow symlinks
in path when path ends in a /. Root failed to account for
this behavior, permitting paths with a trailing / to escape.
It now properly sanitizes the path parameter provided to openat.
hanks to Mundur for reporting this issue.
This is CVE-2026-39822 and Go issue https://go.dev/issue/79005.
- crypto/tls: Encrypted Client Hello privacy leak
he Encrypted Client Hello implementation would leak the pre-shared key
dentities during the handshake, allowing a passive network observer who can
ollect handshakes to de-anonymize the hostname of the server, even when ECH was
eing used.
Thanks to Coia Prant (github.com/rbqvq) for reporting this issue.
This is CVE-2026-42505 and Go issue https://go.dev/issue/79282.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
PromptUserForCredentials accepted a Cli as argument so that it could swap
the input stream on Windows (cli.SetIn).
Given that we only require this swap for the duration of this function (if
needed at all), we can use a local variable that either uses cli.In() or
os.Stdin (on Windows).
We currently still need to wrap the os.Stdin into a streams.In, but can use
the raw os.Stdin (and/or cli.In().File()) once prompt.DisableInputEcho is
updated.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Add a concurrency group keyed on PR number to prevent duplicate reviews
from simultaneous review_requested events.
Remove the sender.type != 'Bot' guard so Dependabot PRs remain
reviewable — per maintainer feedback, those reviews are useful for
catching behavior changes in dependency updates.
Signed-off-by: Derek Misler <derek.misler@docker.com>
- user: prevent possible DoS via unbounded parsing of user and group
database files in GHSA-mjcv-p78q-w5fw. This fixes a similar issue
as CVE-2026-47262 in containerd.
- user: prevent falling back to looking up numeric usernames
Improve handling of numeric user/group to prevent looking up numeric
values as usernames. This fixes a similar issue as [CVE-2026-46680] in
containerd.
- user: update minimum go version to go1.18
- assorted testing and linting fixes.
[CVE-2026-46680]: https://github.com/advisories/GHSA-fqw6-gf59-qr4w
full diff: https://github.com/moby/sys/compare/user/v0.4.0...user/v0.4.1
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This adds an e2e regression test for authenticated pull/push against a private registry, covering the auth regression reported in docker/cli#5963.
Includes:
- New privateregistry service in the e2e Compose stack with htpasswd auth on port 5001, and --insecure-registry for the engine container.
- TestPullPushPrivateRepository test that verifies authenticated push/pull and rejects unauthenticated operations.
- Auth config and test credentials in e2e/testdata/registry/.
- 90-second retry loop for transient DNS/container startup races.
- Service health wait loop in scripts/test/e2e/run.
- Increase TestProcessTermination timeout from 10s to 20s for connhelper-ssh + engine 25 combination.
- Connhelper-ssh engine Dockerfile for private registry integration.
Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com>
Make sure the symlinks point to the same file; not if both are
identical (absolute or relative symlink); it's only for suppressing
the warning so not critical.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
While the "-modfile=vendor.mod" is slightly more correct, using a
symlink allows for most of the go tools to work "as usual", just
without an acual `go.mod` being committed in the repository.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Follow-up to 8f7dc04070, which updated the
minimum Go version in vendor.mod, but did not adjust this script.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- update minimum go version to 1.24
- use os.OpenFile with O_FILE_FLAG_SEQUENTIAL_SCAN on Go 1.26+
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This release include 3 security fixes following the security policy:
- mime: quadratic complexity in WordDecoder.DecodeHeader
Decoding a maliciously-crafted MIME header containing many invalid
encoded-words could consume excessive CPU.
The MIME decoder now better handles this case.
Thanks to p4p3r (https://hackerone.com/p4p3r_hak) for reporting this issue.
This is CVE-2026-42504 and Go issue https://go.dev/issue/79217.
- net/textproto: arbitrary input are included in errors without any escaping
When returning errors, functions in the net/textproto package would
include its input as part of the error, without any escaping. Note that
said input is often controlled by external parties when using this
package naturally. For example, a net/http client uses ReadMIMEHeader
when parsing the headers it receive from a server.
As a result, an attacker could inject arbitrary content into the error.
Practically, this can result in an attacker injecting misleading
content, terminal control bytes, etc. into a victim's output or logs.
This is CVE-2026-42507 and Go issue https://go.dev/issue/79346
- crypto/x509: split candidate hostname only once
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop
over all DNS Subject Alternative Name (SAN) entries. This caused
strings.Split(host, ".") to execute repeatedly on the same input hostname.
With a large DNS SAN list, verification costs scaled quadratically based on the
number of SAN entries multiplied by the hostname's label count. Because
x509.Verify validates hostnames before building the certificate chain, this
overhead occurred even for untrusted certificates.
Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
This is CVE-2026-27145 and https://go.dev/issue/79694.
View the release notes for more information:
https://go.dev/doc/devel/release#go1.26.4
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This makes it easier to verify the sha matches the tag, and may help
with dependabot not updating the version-comment correctly.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Reduces the binary size (39810466 - 39289106 => 521360 (521 kb)
We only import google.golang.org/grpc as an indirect dependency, and
do not make gRPC connections.
grpcnotrace avoids importing golang.org/x/net/trace, which in turn enables
dead code elimination, which can yield 10-15% improvements in binary size
when tracing is not needed.
see https://github.com/grpc/grpc-go/blob/v1.81.1/trace_notrace.go#L23-L25
Before:
ls -l ./build/docker-darwin-arm64
-rwxr-xr-x 1 thajeztah staff 39810466 May 22 11:44 ./build/docker-darwin-arm64*
ls -lh ./build/docker-darwin-arm64
-rwxr-xr-x 1 thajeztah staff 38M May 22 11:44 ./build/docker-darwin-arm64*
After:
ls -l ./build/docker-darwin-arm64
-rwxr-xr-x 1 thajeztah staff 39289106 May 22 11:45 ./build/docker-darwin-arm64*
ls -lh ./build/docker-darwin-arm64
-rwxr-xr-x 1 thajeztah staff 37M May 22 11:45 ./build/docker-darwin-arm64*
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
security changes (not used in our code)
- html: escape greater-than symbol in doctype identifiers (CVE-2026-25681)
- html: improve Noah's Ark clause performance (CVE-2026-25680)
- html: properly render fostered elements in foreign content (CVE-2026-42502)
- html: properly check namespace in "in body" any other end tag (CVE-2026-42506)
- html: ignore duplicate attributes during tokenization (CVE-2026-27136)
other changes:
- quic: fix appendMaxDataFrame erroneously accumulating sentLimit
- quic: establish a "happened-before" relationship between stream write and read
- quic: fix buffer slicing when handling overlapping stream data
- http2: avoid API changes when built with go1.27
security announce: https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
full diff: https://github.com/golang/net/compare/v0.54.0...v0.55.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
update contributing guide link and improve PR template formatting in `.github/PULL_REQUEST_TEMPLATE.md`
Signed-off-by: Paulchen <lukas.23022005@gmail.com>
Signed-off-by: Lukas Michael <lukas.23022005@gmail.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The instructions in the file were outdated, and after removing them,
nothing really substantial was remaining, so let's just remove the
file for now.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Use a shorter name, which is more idiomatic, and prevents accidental
shadowing of types or arguments.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
full diff: https://github.com/golang/sys/compare/v0.43.0...v0.44.0
- unix: add CPUSetDynamic for systems with more than 1024 CPUs
- unix: avoid nil pointer dereference in Utime
- unix: automatically remove container created by mkall.sh
- cpu: use IsProcessorFeaturePresent to calculate ARM64 on windows
- windows: add GetIfTable2Ex, GetIpInterface{Entry,Table}, GetUnicastIpAddressTable
- windows: avoid uint16 overflow in NewNTUnicodeString
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- opts.ParseRestartPolicy: use a struct-literal and clarify that this
function only parses, but does not validate invalid combinations.
- cli/compose/convert: convertRestartPolicy: update doc to be more
clear on the order of preference and intent.
- cli/compose/convert: convertRestartPolicy: use a switch based on
known values to allow the exhaustive linter to catch missing options.
- cli/compose/convert: convertRestartPolicy: add validation for negative
values when converting the legacy service.restart policy.
- cli/compose/convert: convertRestartPolicy: always set MaxAttempts
and leave validation to the daemon.
opts: ParseRestartPolicy: improve validation of max restart-counts
Use the new container.ValidateRestartPolicy utility to verify if a max-restart-count
is allowed for the given restart-policy.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Before:
docker run --rm --env-file=./no-such-file alpine
docker: open ./no-such-file: no such file or directory
Run 'docker run --help' for more information
After:
docker run --rm --env-file=./no-such-file alpine
docker: --env-file: open ./no-such-file: no such file or directory
Run 'docker run --help' for more information
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Adds a "Response body size and partial buffering" subsection to
docs/extend/plugins_authorization.md documenting the 64 KiB
maxBufferSize constant in the daemon's internal responseModifier
(pkg/authorization/response.go in moby/moby) and the practical
implications for plugins that use ResponseBody inspection.
The existing docs (lines 81-87) say streaming endpoints such as
logs and events send only the HTTP request to plugins, but don't
explain the underlying mechanism. Plugin authors building
response-body redaction or content-filtering can be surprised when
the same effect happens on non-listed endpoints whose response is
produced through multiple writes exceeding the buffer or via an
io.WriteFlusher.
The 64 KiB buffer is observable from the public moby source, so
this PR is documentation catching up to existing behavior — not
a contract change.
Signed-off-by: Matteo Panzeri <matteo1782@gmail.com>
This release include 11 security fixes:
- cmd/go: malicious module proxy can bypass checksum database
A malicious module proxy could exploit a flaw in the go command's
validation of module checksums to bypass checksum database validation.
This vulnerability affects any user using an untrusted module proxy
(GOMODPROXY) or checksum database (GOSUMDB).
A malicious module proxy can serve altered versions of the Go toolchain.
When selecting a different version of the Go toolchain than the
currently installed toolchain (due to the GOTOOLCHAIN environment variable,
or a go.work or go.mod with a toolchain line), the go command will download
and execute a toolchain provided by the module proxy. A malicious module
proxy can bypass checksum database validation for this downloaded
toolchain.
Since this vulnerability affects the security of toolchain downloads,
setting GOTOOLCHAIN to a fixed version is not sufficient. You must upgrade
your base Go toolchain.
The go tool always validates the hash of a toolchain before executing it,
so fixed versions will refuse to execute any cached, altered versions of the
toolchain.
The go tool trusts go.sum files to contain accurate hashes of the current
module's dependencies. A malicious proxy exploiting this vulnerability to
serve an altered module will have caused an incorrect hash to be recorded
in the go.sum. Users who have configured a non-trusted GOPROXY can determine
if they have been affected by running "rm go.sum ; go mod tidy ; go mod verify",
which will revalidate all dependencies of the current module.
The specific flaw in more detail:
The go command consults the checksum database to validate downloaded modules,
when a module is not listed in the go.sum file. It verifies that the module hash
reported by the checksum database matches the hash of the downloaded module.
If, however, the checksum database returns a successful response that contains
no entry for the module, the go command incorrectly permitted validation to succeed.
A module proxy may mirror or proxy the checksum database, in which case the go
command will not connect to the checksum database directly. Checksums reported
by the checksum database are cryptographically signed, so a malicious proxy
cannot alter the reported checksum for a module. However, a proxy which returns
an empty checksum response, or a checksum response for an unrelated module,
could cause the go command to proceed as if a downloaded module has been validated.
The go command now properly checks checksum database responses to ensure
that the expected module signature is present, not just that if a signature is
present it matches the expectation.
Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.
This is CVE-2026-42501 and Go issue https://go.dev/issue/79070.
- net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams parameters
When used with a Rewrite function, or a Director function which parses query parameters,
ReverseProxy sanitizes the forwarded request to remove query parameters which are not
parsed by url.ParseQuery. ReverseProxy did not take ParseQuery's limit on the total number
of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account.
This could permit ReverseProxy to forward a request containing a query parameter
that was not visible to the Rewrite function.
For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" could forward the parameter
"hidden=y" while hiding it from the proxy's Rewrite function.
ReverseProxy now avoids forwarding parameters that exceed the ParseQuery limit.
This is CVE-2026-39825 and Go issue https://go.dev/issue/78948.
- net: panic in Dial and LookupPort when handling NUL byte on Windows
The Dial and LookupPort functions would panic on Windows when provided
with an input containing a NUL (0). These functions now return an error
rather than panicking.
This is CVE-2026-39836 and Go issue https://go.dev/issue/79006.
- net/mail: quadratic string concatenation in consumePhrase
Pathological inputs could cause DoS through consumePhrase
when parsing an email address according to RFC 5322.
This is CVE-2026-42499 and Go issue https://go.dev/issue/78987.
- net/mail: quadratic string concatentation in consumeComment
Well-crafted inputs reaching ParseAddress, ParseAddressList,
and ParseDate were able to trigger excessive CPU exhaustion
and memory allocations.
This is CVE-2026-39820 and Go issue https://go.dev/issue/78566.
- cmd/go: "go bug" follows symlinks in predictable temporary filenames
The "go bug" command wrote to two files with predictable names in
the system temporary directory (for example, "/tmp").
An attacker with access to the temporary directory could create a
symlink in one of these names, causing "go bug" to overwrite the
target of the symlink.
The "go bug" command now uses os.MkdirTemp to create a safe
working directory.
Thanks to Harshit Gupta (Mr HAX) for reporting this issue.
This is CVE-2026-39819 and Go issue https://go.dev/issue/78584.
- cmd/go: "go tool pack" does not sanitize output paths
The "go tool pack" subcommand is a minimal version of the Unix ar utility.
It is used by the compiler as an internal tool with known-good inputs.
The "pack" subcommand did not sanitize output filenames.
When invoked to extract a malicious archive file, it could write
files to arbitrary locations on the filesystem.
The "pack" subcommand now refuses to extract files with names
containing any directory components.
Thanks to Harshit Gupta (Mr HAX) for reporting this issue.
This is CVE-2026-39817 and Go issue https://go.dev/issue/78778.
- net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of
writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a
value of 0.
This allows potential DoS against a client by a malicious server. HTTP/2
transport now properly checks that the received SETTINGS_MAX_FRAME_SIZE is
valid.
Thanks to Marwan Atia (marwansamir688@gmail.com) for reporting this issue.
This is CVE-2026-33814 and Go issue https://go.dev/issue/78476.
- html/template: escaper bypass leads to XSS
If a trusted template author were to write a
tag containing an empty type attribute or a type
attribute with an ASCII whitespace, the execution of
the template would incorrectly escape any data passed
into the block.
Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.
This is CVE-2026-39826 and Go issue https://go.dev/issue/78981.
- net: crash when handling long CNAME response
When using LookupCNAME with the cgo DNS resolver,
a very long CNAME response could trigger a double-free of C memory
and a crash. The double-free has been fixed.
Thanks to hamayanhamayan for reporting this issue.
This is CVE-2026-33811 and Go issue https://go.dev/issue/78803.
- html/template: bypass of meta content URL escaping causes XSS
CVE-2026-27142 fixed a vulnerability in which URLs were not
correctly escaped inside of a tag's attribute.
If the URL content were to insert ASCII whitespaces around the
= rune inside of the attribute, the escaper would
fail to similarly escape it, leading to XSS.
Dynamic inputs to a tag's attribute are now
whitespace sanitized prior to escaping.
Thanks to Samy Ghannad for reporting this issue.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Previously, normalization was done before calling these functions,
which required implementations to normalize before using.
Move the normalization into the GetAuthConfig, GetCredentialsStore,
so that non-normalized hostnames will be able to resolve the correct
auth.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Several Labels() methods iterated over maps without sorting, producing
non-deterministic output.
In early versions of Go, map iteration order happened to be stable in
practice, so the original code appeared to work correctly.
Since Go 1.12, the runtime intentionally randomizes map iteration order,
making the output unpredictable between runs.
The API response produces sorted labels and the container formatter
already sorted its labels (changed in 5ee17eef).
Apply the same fix to the volume, network, config, and secret
formatters, and update tests to assert exact ordering instead of using
order-independent comparison.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Ensure PRs have a milestone set and that it matches the next release
version declared in the root VERSION file.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
go1.26.2 (released 2026-04-07) includes security fixes to the go command,
the compiler, and the archive/tar, crypto/tls, crypto/x509, html/template,
and os packages, as well as bug fixes to the go command, the go fix command,
the compiler, the linker, the runtime, and the net, net/http, and net/url
packages. See the Go 1.26.2 milestone on our issue tracker for details;
- https://github.com/golang/go/issues?q=milestone%3AGo1.26.2+label%3ACherryPickApproved
- full diff: https://github.com/golang/go/compare/go1.26.1...go1.26.2
From the security announce:
We have just released Go versions 1.26.2 and 1.25.9, minor point releases.
These releases include 10 security fixes following the security policy:
- os: Root.Chmod can follow symlinks out of the root on Linux
On Linux, if the target of Root.Chmod is replaced with a symlink while
the chmod operation is in progress, Chmod could operate on the target
of the symlink, even when the target lies outside the root.
The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag,
which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its
target before acting and returns an error if the target is a symlink
lying outside the root, so the impact is limited to cases where the
target is replaced with a symlink between the check and operation.
On Linux, Root.Chmod now uses the fchmodat2 syscall when available, and
an workaround using /proc/self/fd otherwise.
Thanks to Uuganbayar Lkhamsuren for reporting this issue.
This is CVE-2026-32282 and Go issue https://go.dev/issue/78293.
- html/template: JS template literal context incorrectly tracked
Context was not properly tracked across template branches for JS template
literals, leading to possibly incorrect escaping of content when branches were
used.
Additionally template actions within JS template literals did not properly
track
the brace depth, leading to incorrect escaping being applied.
These issues could cause actions within JS template literals to be incorrectly
or improperly escaped, leading to XSS vulnerabilities.
This only affects templates that use template actions within JS template
literals.
This is CVE-2026-32289 and Go issue https://go.dev/issue/78331.
- crypto/x509: excluded DNS constraints not properly applied to wildcard domains
When verifying a certificate chain containing excluded DNS constraints, these
constraints are not correctly applied to wildcard DNS SANs which use a
different
case than the constraint.
For example, if a certificate contains the DNS name "*.example.com" and the
excluded DNS name "EXAMPLE.COM", the constraint will not be applied.
This only affects validation of otherwise trusted certificate chains, issued
by
a root CA in the VerifyOptions.Roots CertPool, or in the system certificate
pool.
This issue only affects Go 1.26.
Thank you to Riyas from Saintgits College of Engineering, k1rnt, @1seal for
reporting this issue.
This is CVE-2026-33810 and Go issue https://go.dev/issue/78332.
- cmd/compile: no-op interface conversion bypasses overlap checking
Previously, the compiler failed to unwrap pointers contained within
a no-op interface conversion leading to an incorrect determination
of a non-overlapping move.
To prevent unsafe move operations, the compiler will now unwrap all
such conversions before considering a move non-overlapping.
Thank you to Jakub Ciolek - https://ciolek.dev/ for reporting this issue.
This is CVE-2026-27144 and Go issue https://go.dev/issue/78371.
- cmd/compile: possible memory corruption after bound check elimination
Previously, slices and arrays accessed using induction variables
were sometimes incorrectly proved in-bound. If the induction variable
used for indexing were to overflow or underflow, it could allow access
to memory beyond the scope of the original slice or array.
To prevent this behavior, the compiler ensures that any mutated induction
variable that overflows/underflows with respect to its loop condition
is not used for bound check elimination.
Thank you to Jakub Ciolek - https://ciolek.dev/ for reporting this issue.
This is CVE-2026-27143 and Go issue https://go.dev/issue/78333.
- archive/tar: unbounded allocation when parsing old format GNU sparse map
tar.Reader could allocate an unbounded amount of memory when reading
a maliciously-crafted archive containing a large number of sparse
regions encoded in the "old GNU sparse map" format.
We now limit both the number of old GNU sparse map extension blocks,
and the total number of sparse file entries, regardless of encoding.
Thanks to Colin Walters (wal...@verbum.org) who initially reported this issue.
Thanks also to Uuganbayar Lkhamsuren (https://github.com/uug4na) and Jakub
Ciolek
who additionally reported this issue.
This is CVE-2026-32288 and Go issue https://go.dev/issue/78301.
- crypto/tls: multiple key update handshake messages can cause connection to
deadlock
If one side of the TLS connection sends multiple key update messages
post-handshake in a single record, the connection can deadlock, causing
uncontrolled consumption of resources. This can lead to a denial of service.
This only affects TLS 1.3.
Thank you to Jakub Ciolek - https://ciolek.dev/ for reporting this issue.
This is CVE-2026-32283 and Go issue https://go.dev/issue/78334.
- cmd/go: trust layer bypass when using cgo and SWIG
A well-crafted SWIG source file could take advantage
of a file-naming convention used inside the trust
boundary of the cgo compiler. Doing so could result
in arbitrary code execution during build time.
SWIG files are disallowed from using this convention.
Thank you to Juho Forsén of Mattermost for reporting this issue.
This is CVE-2026-27140 and Go issue https://go.dev/issue/78335.
- crypto/x509: unexpected work during chain building
During chain building, the amount of work that is done is not correctly
limited
when a large number of intermediate certificates are passed in
VerifyOptions.Intermediates, which can lead to a denial of service. This
affects
both direct users of crypto/x509 and users of crypto/tls.
Thank you to Jakub Ciolek - https://ciolek.dev/ for reporting this issue.
This is CVE-2026-32280 and Go issue https://go.dev/issue/78282.
- crypto/x509: inefficient policy validation
Validating certificate chains which use policies is unexpectedly inefficient
when certificates in the chain contain a very large number of policy mappings,
possibly causing denial of service.
This only affects validation of otherwise trusted certificate chains, issued
by
a root CA in the VerifyOptions.Roots CertPool, or in the system certificate
pool.
Thank you to Jakub Ciolek - https://ciolek.dev/ for reporting this issue.
This is CVE-2026-32281 and Go issue https://go.dev/issue/78281.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- G306# G306: Expect WriteFile permissions to be 0600 or less (too restrictive; also flags "0o644" permissions)
- G307# G307: Deferring unsafe method "*os.File" on type "Close" (also EXC0008); (TODO: evaluate these and fix where needed: G307: Deferring unsafe method "*os.File" on type "Close")
flags.BoolVarP(&opts.followLink,"follow-link","L",false,"Always follow symbol link in SRC_PATH")
flags.BoolVarP(&opts.followLink,"follow-link","L",false,"Always follow symlinks in SRC_PATH")
flags.BoolVarP(&opts.copyUIDGID,"archive","a",false,"Archive mode (copy all uid/gid information)")
flags.BoolVarP(&opts.quiet,"quiet","q",false,"Suppress progress output during copy. Progress output is automatically suppressed if no terminal is attached")
complete-c docker -A-f-n'__fish_seen_subcommand_from create'-s l -l label -d'Set meta data on a container'
complete-c docker -A-f-n'__fish_seen_subcommand_from create'-l label-file -d'Read in a line delimited file of labels'
complete-c docker -A-f-n'__fish_seen_subcommand_from create'-l link -d'Add link to another container'
@@ -252,7 +251,7 @@ complete -c docker -A -f -n '__fish_seen_subcommand_from create' -s p -l publish
complete-c docker -A-f-n'__fish_seen_subcommand_from create'-s P -l publish-all -d'Publish all exposed ports to random ports'
complete-c docker -A-f-n'__fish_seen_subcommand_from create'-lread-only -d"Mount the container's root filesystem as read only"
complete-c docker -A-f-n'__fish_seen_subcommand_from create'-l restart -d'Restart policy to apply when a container exits'
complete-c docker -A-f-n'__fish_seen_subcommand_from create'-l rm -d'Automatically remove the container when it exits'
complete-c docker -A-f-n'__fish_seen_subcommand_from create'-l rm -d'Automatically remove the container and its associated anonymous volumes when it exits'
complete-c docker -A-f-n'__fish_seen_subcommand_from create'-l runtime -d'Runtime to use for this container'
| Removed | [`-f` flag on `docker tag`](#-f-flag-on-docker-tag) | v1.10 | v1.12 |
| Removed | [HostConfig at API container start](#hostconfig-at-api-container-start) | v1.10 | v1.12 |
@@ -1203,6 +1204,19 @@ The `docker login` no longer automatically registers an account with the target
The flag `--security-opt` doesn't use the colon separator (`:`) anymore to divide keys and values, it uses the equal symbol (`=`) for consistency with other similar flags, like `--storage-opt`.
### Links on the default bridge network
**Deprecated in release: v1.10**
**Target for removal in release: v30.0**
The `--link` option on `docker create` and `docker run`, when used with no
`--network` specified, was deprecated in v1.10 and will be removed in a future
release. Custom networks should be used instead. Docker 29.6 added a deprecation
warning when this option is used for the default bridge network.
Note that the `--link` option is still supported when a non-default network
is used.
### Ambiguous event fields in API
**Deprecated in release: [v1.10.0](https://github.com/docker/docker/releases/tag/v1.10.0)**
| [Azure File Storage plugin](https://github.com/Azure/azurefile-dockervolumedriver) | Lets you mount Microsoft [Azure File Storage](https://azure.microsoft.com/blog/azure-file-storage-now-generally-available/) shares to Docker containers as volumes using the SMB 3.0 protocol. [Learn more](https://azure.microsoft.com/blog/persistent-docker-volumes-with-azure-file-storage/). |
| [Azure File Storage plugin](https://github.com/Azure/azurefile-dockervolumedriver) (archived) | Lets you mount Microsoft [Azure File Storage](https://azure.microsoft.com/blog/azure-file-storage-now-generally-available/) shares to Docker containers as volumes using the SMB 3.0 protocol. [Learn more](https://azure.microsoft.com/blog/persistent-docker-volumes-with-azure-file-storage/). |
| [BeeGFS Volume Plugin](https://github.com/RedCoolBeans/docker-volume-beegfs) | An open source volume plugin to create persistent volumes in a BeeGFS parallel file system. |
| [Blockbridge plugin](https://github.com/blockbridge/blockbridge-docker-volume) | A volume plugin that provides access to an extensible set of container-based persistent storage options. It supports single and multi-host Docker environments with features that include tenant isolation, automated provisioning, encryption, secure deletion, snapshots and QoS. |
| [Contiv Volume Plugin](https://github.com/contiv/volplugin) | An open source volume plugin that provides multi-tenant, persistent, distributed storage with intent based consumption. It has support for Ceph and NFS. |
| [Convoy plugin](https://github.com/rancher/convoy) | A volume plugin for a variety of storage back-ends including device mapper and NFS. It's a simple standalone executable written in Go and provides the framework to support vendor-specific extensions such as snapshots, backups and restore. |
| [Convoy plugin](https://github.com/rancher/convoy) (archived) | A volume plugin for a variety of storage back-ends including device mapper and NFS. It's a simple standalone executable written in Go and provides the framework to support vendor-specific extensions such as snapshots, backups and restore. |
| [DigitalOcean Block Storage plugin](https://github.com/omallo/docker-volume-plugin-dostorage) | Integrates DigitalOcean's [block storage solution](https://www.digitalocean.com/products/storage/) into the Docker ecosystem by automatically attaching a given block storage volume to a DigitalOcean droplet and making the contents of the volume available to Docker containers running on that droplet. |
| [DRBD plugin](https://www.drbd.org/en/supported-projects/docker) | A volume plugin that provides highly available storage replicated by [DRBD](https://www.drbd.org). Data written to the docker volume is replicated in a cluster of DRBD nodes. |
| [Flocker plugin](https://github.com/ScatterHQ/flocker) | A volume plugin that provides multi-host portable volumes for Docker, enabling you to run databases and other stateful containers and move them around across a cluster of machines. |
| [Fuxi Volume Plugin](https://github.com/openstack/fuxi) | A volume plugin that is developed as part of the OpenStack Kuryr project and implements the Docker volume plugin API by utilizing Cinder, the OpenStack block storage service. |
| [gce-docker plugin](https://github.com/mcuadros/gce-docker) | A volume plugin able to attach, format and mount Google Compute [persistent-disks](https://cloud.google.com/compute/docs/disks/persistent-disks). |
| [GlusterFS plugin](https://github.com/calavera/docker-volume-glusterfs) | A volume plugin that provides multi-host volumes management for Docker using GlusterFS. |
| [Flocker plugin](https://github.com/ScatterHQ/flocker) (archived) | A volume plugin that provides multi-host portable volumes for Docker, enabling you to run databases and other stateful containers and move them around across a cluster of machines. |
| [Fuxi Volume Plugin](https://github.com/openstack-archive/fuxi) (archived) | A volume plugin that is developed as part of the OpenStack Kuryr project and implements the Docker volume plugin API by utilizing Cinder, the OpenStack block storage service. |
| [gce-docker plugin](https://github.com/mcuadros/gce-docker) (archived) | A volume plugin able to attach, format and mount Google Compute [persistent-disks](https://cloud.google.com/compute/docs/disks/persistent-disks). |
| [GlusterFS plugin](https://github.com/calavera/docker-volume-glusterfs) (archived) | A volume plugin that provides multi-host volumes management for Docker using GlusterFS. |
| [Horcrux Volume Plugin](https://github.com/muthu-r/horcrux) | A volume plugin that allows on-demand, version controlled access to your data. Horcrux is an open-source plugin, written in Go, and supports SCP, [Minio](https://www.minio.io) and Amazon S3. |
| [HPE 3Par Volume Plugin](https://github.com/hpe-storage/python-hpedockerplugin/) | A volume plugin that supports HPE 3Par and StoreVirtual iSCSI storage arrays. |
| [Infinit volume plugin](https://infinit.sh/documentation/docker/volume-plugin) | A volume plugin that makes it easy to mount and manage Infinit volumes using Docker. |
| [IPFS Volume Plugin](https://github.com/vdemeester/docker-volume-ipfs) | An open source volume plugin that allows using an [ipfs](https://ipfs.io/) filesystem as a volume. |
| [Keywhiz plugin](https://github.com/calavera/docker-volume-keywhiz) | A plugin that provides credentials and secret management using Keywhiz as a central repository. |
| [IPFS Volume Plugin](https://github.com/vdemeester/docker-volume-ipfs) (archived) | An open source volume plugin that allows using an [ipfs](https://ipfs.io/) filesystem as a volume. |
| [Keywhiz plugin](https://github.com/calavera/docker-volume-keywhiz) (archived) | A plugin that provides credentials and secret management using Keywhiz as a central repository. |
| [Linode Volume Plugin](https://github.com/linode/docker-volume-linode) | A plugin that adds the ability to manage Linode Block Storage as Docker Volumes from within a Linode. |
| [Local Persist Plugin](https://github.com/CWSpear/local-persist) | A volume plugin that extends the default `local` driver's functionality by allowing you specify a mountpoint anywhere on the host, which enables the files to *always persist*, even if the volume is removed via `docker volume rm`. |
| [NetApp Plugin](https://github.com/NetApp/netappdvp) (nDVP) | A volume plugin that provides direct integration with the Docker ecosystem for the NetApp storage portfolio. The nDVP package supports the provisioning and management of storage resources from the storage platform to Docker hosts, with a robust framework for adding additional platforms in the future. |
Once the rotation os finished (all the progress bars have completed) the now-current
Once the rotation is finished (all the progress bars have completed) the now-current
CA certificate will be printed:
```console
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
