RetrieveAuthTokenFromImage is exported and imported by other projects, so it keeps reading only the configuration file. The commands that pull and push call registryauth.EncodedAuth instead, which asks DOCKER_AUTH_CONFIG, then the Docker Desktop session, then the configuration file. This drops command.EncodedRegistryAuth from the public API.
Each DockerCli owns its Docker Desktop sessions through RegistryAuthProvider, created on first use, instead of package-level sessions shared by every caller. A command.Cli without RegistryAuthProvider uses only its configuration file. The fallback reads the current configuration file, since Initialize replaces it.
Remove the session fields and the constructors that only tests used, move the staging and dhi.io hostnames into internal/secretsengine, and use testing/synctest instead of a fake clock, so that the tests run in parallel. Only the DOCKER_AUTH_CONFIG test still sets the environment.
Signed-off-by: Alano Terblanche <18033717+Benehiko@users.noreply.github.com>
Provider, HubClient, and New were only used inside the package and by FakeCli. FakeCli now returns its configuration file as the auth provider, which is what the signed-out Docker Hub stub fell back to. NewDesktop returns an AuthProvider. Remove DockerCli.RegistryAuthProvider: EncodedRegistryAuth already falls back to RetrieveAuthTokenFromImage, which uses the Docker Desktop session, so the method only added to the public API.
Signed-off-by: Alano Terblanche <18033717+Benehiko@users.noreply.github.com>
Check that the Docker Desktop session is used for Docker Hub and dhi.io, that other registries use the configuration file, and that DOCKER_AUTH_CONFIG takes precedence over Docker Desktop. TestRetrieveAuthTokenFromImage disables the Docker Desktop lookup.
Signed-off-by: Alano Terblanche <18033717+Benehiko@users.noreply.github.com>
Tests that use FakeCli pull, push, and create containers through RetrieveAuthTokenFromImage. Disable the Docker Desktop lookup, so that they never reach the Docker Desktop of the machine they run on.
Signed-off-by: Alano Terblanche <18033717+Benehiko@users.noreply.github.com>
Run lookups against a fake secrets engine on a unix socket: signed in, signed out, no socket, a socket with nothing listening, and an engine that never answers. The benchmarks cover the same cases. BenchmarkExternalEngine runs against the engine at SECRETSENGINE_BENCH_SOCKET when it is set.
Signed-off-by: Alano Terblanche <18033717+Benehiko@users.noreply.github.com>
Cover which registries use the Docker Desktop session, keeping the production and staging sessions apart, caching the session until it expires, the retry interval after a failed lookup, and Disable.
Signed-off-by: Alano Terblanche <18033717+Benehiko@users.noreply.github.com>
When Docker Desktop is running and signed in, read the Docker Hub session from the Docker Desktop secrets engine, and send it as the registry credentials for Docker Hub (docker.io) and Docker Hardened Images (dhi.io) when pulling or pushing images through the daemon: docker pull, push, run, create, plugin install and push, service create and update, and stack deploy.
Credentials in DOCKER_AUTH_CONFIG take precedence for the registries they cover. Without a usable Docker Desktop session (no socket, nothing listening, signed out, or no answer within 5 seconds), the CLI uses its credential store, credential helpers, and configuration file as before. docker login and stored credentials are not changed.
Signed-off-by: Alano Terblanche <18033717+Benehiko@users.noreply.github.com>
Add the Docker secrets engine client, used to read the Docker Desktop session for Docker Hub. It brings in github.com/docker/secrets-engine/x v0.8.5 and connectrpc.com/connect v1.19.1.
The client module requires go1.26.10, which raises the go directive in vendor.mod from 1.26.0.
Signed-off-by: Alano Terblanche <18033717+Benehiko@users.noreply.github.com>
This release includes 1 security fix following the security policy:
- crypto/x509: mitigation for security concerns with a specific Certificate Authority
We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation.
Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller.
We highly recommend immediately upgrading to this release.
This is CVE-2026-111943 and Go issue https://go.dev/issue/82345.
release notes: https://go.dev/doc/devel/release#go1.26.10
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Wrap errors in the OAuth manager instead of logging them, preserving
the underlying cause while allowing callers to detect startup failures.
Log failures at the fallback handler and scope the device-code login
result to its branch.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Remove extra newline before message
- Include the token in the URL (instead of requiring the user to manually
enter it on the website).
- Improve the "call to action"; ENTER can be used to automatically open
the browser (but the user can manually open it instead), and CTRL-C can
be used to cancel the login.
- Remove the "Waiting for authentication in the browser…" message, which
could be confusing if no browser was opened (yet), instead print a message
after successfully requesting the browser to be opened.
When running `docker login`;
docker login
i Info → Using web-based login. To sign in with credentials on the command line, use 'docker login -u <username>'
Your one-time device confirmation code is: NRJL-BLRL
Open this URL to authenticate: https://login.docker.com/activate?user_code=NRJL-BLRL
Press ENTER to open the URL in your browser, or Ctrl+C to cancel.
After pressing `ENTER`, it either prints the "success" message;
Press ENTER to open the URL in your browser, or Ctrl+C to cancel.
Opening browser…
or a failure when unable to launch a browser;
Press ENTER to open the URL in your browser, or Ctrl+C to cancel.
No browser found. Open the URL above manually to continue.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Before this patch, pressing `ENTER` to open the browser would silently
discard the error;
docker login
i Info → Using web-based login. To sign in with credentials on the command line, use 'docker login -u <username>'
Your one-time device confirmation code is: VGTB-VKBG
Press ENTER to open your browser or submit your device code here: https://login.docker.com/activate
Waiting for authentication in the browser…
With this patch, a failure is printed, so that the user can manually open
the URL (or cancel the login);
docker login
i Info → Using web-based login. To sign in with credentials on the command line, use 'docker login -u <username>'
Your one-time device confirmation code is: SZFX-BSGP
Press ENTER to open your browser or submit your device code here: https://login.docker.com/activate
Waiting for authentication in the browser…
No browser found. Open the URL above manually to continue.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Make the output less verbose, and combine the "web-based login" message
with the info message that's already printed.
Before this patch:
docker login
USING WEB-BASED LOGIN
i Info → To sign in with credentials on the command line, use 'docker login -u <username>'
Your one-time device confirmation code is: VVPV-NSSL
Press ENTER to open your browser or submit your device code here: https://login.docker.com/activate
Waiting for authentication in the browser…
With this patch:
docker login
i Info → Using web-based login. To sign in with credentials on the command line, use 'docker login -u <username>'
Your one-time device confirmation code is: QBBD-PQNS
Press ENTER to open your browser or submit your device code here: https://login.docker.com/activate
Waiting for authentication in the browser…
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Check the context after reading stdin to avoid launching the browser
if login was canceled while waiting for ENTER.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Running "docker nonexistent --version" printed the CLI version and
exited 0, so it couldn't be used to check whether a command or plugin
is available. Without "--version" the same invocation fails with an
"unknown command" error.
When no built-in command or plugin matches, runDocker falls through to
executing the root command, and cobra handles the "--version" flag
before the root command reports the unknown command. Unset the root
command's version in that fallback, so the standard unknown-command
error is returned.
A global "--version" flag ("docker --version nonexistent") is parsed
before the command name and still prints the version, as do
"docker --version" and "docker nonexistent --help".
Signed-off-by: Nimesh Kulkarni <167794819+GitNimay@users.noreply.github.com>
The plugin only used lazyregexp for two small, fixed name patterns.
Replaced it with regexp.MustCompile without changing validation.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Both entry points use NewRootCmd, which adds subcommands directly.
Removed the unused registry registration and constructor.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The plugin only needed progress display and an auxiliary callback.
Inlined that use while preserving cancellation and terminal handling.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Explain that variable value is optional and is taken from environment
if not set.
Clarify the meaning of ARG, and mention that ENV overrides ARG of the
same name.
Move example to the end, and refer to the Dockerfile and buildx docs
for more details (replacing the obsolete link).
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Allow plugins to return informational messages without the next-steps heading
or indentation. Invoke each hook once and render generic messages before the
shared next-steps block.
Centralize grouping and formatting in PrintMessages, with a callback for
template evaluation and error handling. This avoids the need for an
intermediate EvaluatedMessage type and simplifies hook collection to return
the original responses.
Skip messages containing only whitespace while preserving empty lines
within non-empty messages. Keep PrintNextSteps as a deprecated wrapper
to preserve existing callers and output.
Update the printer tests and remove the obsolete appendMessages helper
and its tests.
Co-authored-by: Nicolas Beck <nicolas.beck@docker.com>
Signed-off-by: Nicolas Beck <nicolas.beck@docker.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Show installation guidance and a documentation link when the offload
plugin is missing or invalid. Handle this before command execution so
plugin-specific flags and --help also receive the guidance.
Signed-off-by: Nicolas Beck <nicolas.beck@docker.com>
- Treat the remaining invisible format controls as zero width
- Treat bidi isolates and other invisible format characters as zero width
- Measure ambiguous Latin letters as one cell in East Asian locales
- Fix width mismatches found by the Hegel property tests
- Recognise CJK locales regardless of charset spelling
full diff: https://github.com/mattn/go-runewidth/compare/v0.0.30...v0.0.31
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This release includes 15 security fixes following the security policy:
- net/http: HTTP/2 server crash due to HPACK encoder race
HTTP/2 servers could end up crashing due to inadvertently
modifying its HPACK encoder concurrently. This happens because the
server modifies the HPACK encoder from two goroutines without
synchronization: one uses the encoder to encode a HEADERS frame as part
of a response sent to a client and the other modifies the encoder's
table size when handling a SETTINGS frame containing
SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can
repeatedly send a request while changing the header table size to crash
the server.
Fix this issue by not applying SETTINGS_HEADER_TABLE_SIZE immediately.
Instead, buffer any SETTINGS_HEADER_TABLE_SIZE received, and only apply
the new value prior to the next time the server writes a frame.
Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc. for reporting this issue.
This is CVE-2026-97032 and Go issue https://go.dev/issue/81867.
- net/http: HTTP/2 server memory exhaustion due to Trailer headers
When "Trailer" headers are sent by a client, the HTTP server internally
uses the header values to populate the Request.Trailer map passed to the
server handler. Because Request.Trailer is a map, each entry incurs
memory overhead. For HTTP/2 servers, a malicious client can exploit this
by sending a "Trailer" header that declares a large number of fields,
causing the server to allocate a disproportionate amount of memory while
bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits.
This exploit is not applicable for HTTP/1 servers, which do not support
multiplexing a large number of requests over one TCP connection, and
whose Server.MaxHeaderBytes are calculated differently.
Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits are now
applied towards the trailer fields declared in "Trailer" headers.
Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc. for reporting this issue.
This is CVE-2026-78659 and Go issue https://go.dev/issue/81857.
- crypto/tls: reject malformed ECH outer extension references
Multiple ECH outer extension references are not
permitted under RFC 9849; previously, a client
could send a well-crafted packet that could
trigger memory exhaustion in the server process
by specifying multiple references.
We now reject these as malformed and curb the
memory amplification vector as a result.
This is CVE-2026-97031 and Go issue https://go.dev/issue/81855.
- cmd/go: checksum bypass for golang.org/fips140
Previously, a user operating inside of a malicious
Go project that defines a bogus golang.org/fips140
and operates a malicious GOMODPROXY the user chooses
to connect to can serve an arbitrary module in its
place.
We now unpack the trusted ziphash for the bundled
golang.org/fips140 module and construct its entry
in the GOMODCACHE such that it can be verified by
the toolchain.
This is CVE-2026-94444 and Go issue https://go.dev/issue/81833.
- cmd/go: checksum database bypass for golang.org/toolchain
Previously, a user operating inside of a malicious
Go project that defines a bogus golang.org/toolchain
go.sum entry and operates a malicious GOMODPROXY the
user chooses to use can bypass the intended checksum.
We now ensure that golang.org/toolchain always goes
to the network for the canonical checksum.
This is CVE-2026-94447 and Go issue https://go.dev/issue/81834.
- html/template: reset context tracking on consecutive template expressions
When a JavaScript template literal contains
consecutive expressions, the context tracking
state was not properly reset upon entering a
new expression.
We now ensure that template-literal expression
entries correctly reset context variables so all
subsequent regular expression literals are
accurately recognized and escaped.
This is CVE-2026-94448 and Go issue https://go.dev/issue/81821.
- html/template: recognize yield as regexp preceder keyword
A trusted template author may have previously
written a valid template wherein the use of
the yield keyword would not be correctly
escaped.
We now ensure that valid keyword uses are
escaped and non-keyword uses are not escaped.
This is CVE-2026-97030 and Go issue https://go.dev/issue/81823.
- net/textproto, mime/multipart: memory limit bypass when parsing MIME headers
Parsing a multipart form could bypass memory limits and read an
arbitrarily long line into memory when the remaining limit at the
start of a part was less than 400 bytes.
Multipart form memory limits are now properly enforced in this situation.
Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
This is CVE-2026-94440 and Go issue https://go.dev/issue/81741.
- net/http: HTTP/1 client connection desynchronization after CONNECT rejection
When http.Transport sends an HTTP/1 CONNECT request with a non-empty
Request.Body, it writes the body directly to the connection without
framing after the request headers. If the server rejects the CONNECT
request with a non-2xx keep-alive response, Transport returns the
connection to the idle pool. Because CONNECT requests do not have a
request body, the server may interpret the trailing body bytes as a
subsequent pipelined HTTP/1.1 request on the connection, leaving the
pooled connection desynchronized and causing the next caller that reuses
it to read the response to the injected request. In reverse proxies
(including httputil.ReverseProxy) that forward CONNECT requests through
a shared Transport, this can lead to cross-user response poisoning.
The HTTP/1 transport now closes a connection after sending a CONNECT
request, regardless of the response status.
In addition, ReverseProxy now rejects incoming CONNECT requests
with a 405 Method Not Allowed response. ReverseProxy has never handled
CONNECT requests in a useful fashion (it does not convert the
connection into a bidirectional tunnel), so we do not expect this
change to negatively affect any current users.
Thanks to Xclow3n (Rajat Raghav) for reporting this issue.
This is CVE-2026-56866 and Go issue https://go.dev/issue/81740.
- net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response
When an HTTP server handler sent a 2xx response to an HTTP/1 CONNECT request
and returned without hijacking the connection, the server improperly continued
to read and serve requests from the connection. Since a 2xx response to an
HTTP/1 CONNECT converts the connection into a tunnel, the server should not
treat the connection as continuing to contain HTTP.
The impact of this misbehavior is mostly limited to potential request smuggling,
where an intermediate proxy considers the data on the connection to be tunneled
and the server considers it to be HTTP.
The HTTP/1 server now always closes a connection after responding to a CONNECT
request, regardless of the response status.
Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
This is CVE-2026-94439 and Go issue https://go.dev/issue/81744.
- net/http: excessive CPU consumption from repeated initial window changes
A malicious HTTP/2 peer could cause excessive CPU consumption in the
client or server by opening a large number of streams and then sending
many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
The HTTP/2 client and server now efficiently handle changes to the
initial window size (O(1) rather than O(number of streams)).
Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
This is CVE-2026-78669 and Go issue https://go.dev/issue/81742.
- net/http: HTTP/2 transport accepts malformed framing-related headers
Historically, we have been rather lax about malformed framing-related
headers in our HTTP/2 implementation, as they cannot interfere with
HTTP/2 framing. However, this makes it possible for our HTTP/2
implementation to forward responses containing such headers to an HTTP/1
client when acting as a reverse proxy. If the HTTP/1 client also does
not behave strictly enough, this can result in response smuggling.
We now delete malformed framing-related headers when received by our
HTTP/2 transport, so they will not be forwarded to a potentially
vulnerable HTTP/1 client.
Thanks to TJ Barton for reporting this issue.
This is CVE-2026-78660 and Go issue https://go.dev/issue/81115.
- os: Root.Mkdir(All) can follow junctions out of the root on Windows
On Windows, when the target of Root.Mkdir or Root.MkdirAll was a junction
pointing to an empty location, the operation would create a directory at
the junction target even when that target was located outside the root.
This only applies to operations where the last path component is a
junction (path/to/junction, but not path/junction/target).
Root.Mkdir and Root.MkdirAll now correctly avoid resolving junctions.
Thanks to Daniele Ballarini for reporting this issue.
This is CVE-2026-56857 and Go issue https://go.dev/issue/81739.
- net/http: lack of limit on size of parsed Range headers
When parsing a Range header containing a large number of small ranges,
FileServer(FS), ServeContent, and ServeFile(FS) could consume an excessive
amount of CPU.
These functions now ignore Range headers containing more than 200 ranges.
The limit is controlled by the new httpservecontentmaxranges=
GODEBUG setting. Setting GODEBUG=httpservecontentmaxranges=0
disables the limit.
Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
This is CVE-2026-78667 and Go issue https://go.dev/issue/81858.
- net/http: double flow control refund on HTTP/2 server streams
The HTTP/2 server could refund connection-level flow control twice for the same data:
Once when a client resets a stream (refunding data for any sent-but-unread portion
of the stream), and again when a request handler reads the buffered data.
A malicious client could exploit this to bypass the configured connection-level
flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still
limited by the concurrent stream limit and stream-level flow control.
The HTTP/2 server now waits to refund connection-level flow control for reset
streams until after the request handler is complete.
Thanks to Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276/) for reporting this issue.
This is CVE-2026-78663 and Go issue https://go.dev/issue/81743.
release notes: https://go.dev/doc/devel/release#go1.26.9
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Explain how to install the Offload plugin when --cloud cannot find it,
and link to the cloud flag documentation. Preserve diagnostic details
for invalid or incompatible plugins and limit installation guidance
to Offload.
Use standard default-value handling in the resolution tests to satisfy
the lint complexity limit without changing test coverage.
Co-authored-by: Allie Sadler <102604716+aevesdocker@users.noreply.github.com>
Signed-off-by: Nicolas Beck <nicolas.beck@docker.com>
Add a "master" engine-version to the e2e matrix to catch regressions
against the upcoming engine release before it reaches an rc.
There is no "master" dind image, so just copy the engine binary from the
moby/moby-bin:master image and put it into the latest dind image.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
- Wrap: measure grapheme clusters, not runes
- Skip grapheme segmentation for text that cannot form clusters
- Keep strings that are not valid UTF-8 on the segmenter - #111
- Take the rune fast path in the Truncate functions too
full diff: https://github.com/mattn/go-runewidth/compare/v0.0.29...v0.0.30
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Forward stdin and stderr to cloud context providers when both are
terminals, allowing prompts during --cloud resolution. Pass file handles
directly to preserve terminal detection and leave piped or redirected
input available to the requested command.
Use the standard console handles when Windows terminal wrappers hide
their underlying files. Keep stdout reserved for the JSON response.
Signed-off-by: Nicolas Beck <nicolas.beck@docker.com>
docker --cloud build rejected every BuildKit-only flag (--secret, --ssh,
--push, --output, ...) because cloudHelpRequest parsed remaining args
against the legacy build command's flag set before processAliases
rewrites build into a buildx invocation. Treat build/bake/builder/image
build the same as plugin commands: only recognize --help/-h immediately
after the resolved command path instead of validating flags.
Fixes#7350
Signed-off-by: Nick Sieger <nick@nicksieger.com>
Resolve it through the offload plugin by default, with a provider
override in features.cloud in the Docker config.
Require the selected plugin to declare the cloud-context-resolver
feature in its metadata before showing the flag in help and completion
or invoking its __resolve-context operation.
Resolve through WithContextResolver, after the config file and context
store are loaded but before client initialization, without wrapping or
re-executing Docker.
Forward --context to downstream plugins so they need not support
--cloud or repeat provisioning. Skip provisioning for help, version,
and completion requests. Report unknown flags and missing flag values
before provisioning, so a mistyped invocation fails without creating
cloud resources or contacting the engine selected before resolution.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
- Add lzw reader/writer
- ci: test against go1.27.x, drop go1.24.x
- flate: Writer L7-9 with dictionary can emit the dictionary to stream
- gzhttp: limit jitter hash to jitterBuffer bytes
- s2: arm64 assembly encoders, lowered from the amd64 avo program
- s2: clamp the Go EncodeBetter skip to match the assembly
- xpress: add Microsoft XPRESS (MS-XCA) decompression
- xxhash: bound input of non-preemptive assembly
- zstd, huff0: improved arm64 lowering, and narrow two table loads to MOVWQZX
- zstd/huff0: break false partial-register dependencies in seqdec/4X decoders
- zstd/huff0: fold two ISA-gap x86 idioms in the avo arm64 lowering
full diff: https://github.com/klauspost/compress/compare/v1.19.2...v1.20.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Callers that choose the context from configuration had to do it before
Initialize. That meant loading the config file and context store
themselves and handling --config a second time.
WithContextResolver runs a callback inside Initialize after the config
file and context store are loaded, but before telemetry and endpoint
initialization. A non-empty result replaces the selected context, an
empty result keeps normal selection, and an error aborts
initialization.
The API client and endpoint are resolved lazily, so they use the
overridden context.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Plugins had no generic way to declare support for optional CLI
contracts, so each one would need its own top-level metadata field.
Add Features, keyed by feature name. Values are arbitrary JSON so a
feature can carry more than a boolean.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
- cpu: add ppc64le POWER10 detection
- cpu: add basic support for GOARCH=sparc64
- cpu: disable AVX+ on netbsd/amd64
relates to "runtime: async preemption corrupts AVX (YMM) state on netbsd/amd64"
- internal/cpu: detect RISC-V VLENB when the vector extension is available
- unix: add missing HWTSTAMP_* constants
- unix: add pidfd constants and type
- unix: add IoctlPidfdInfo
- unix: add IPMI interface
- unix: align Ifreq so its union accessors cannot fault
- unix: stop generating sparc termbits from the generic header
- windows: add SO_SNDTIMEO constant for socket options
full diff: https://github.com/golang/sys/compare/v0.47.0...v0.48.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Adds Unicode 17 support
- Fast paths for ASCII
- ANSI escape sequences as grapheme clusters
- Implement UTF-8 C1 control sequences
- Implement 8-bit ANSI
Breaking change
The returned iterator type from FromString() and FromBytes() is now a pointer.
This will not present a problem if you are just using it in the typical way,
which is assigning to a local variable and iterating.
If you are embedding this iterator into another object, and therefore declaring
its type, this change might break your compilation. You’ll need to change to a
pointer type. Apologies if so — this seems like a small enough change that a
v3 would be a bit much.
full diff: https://github.com/clipperhouse/uax29/compare/v2.2.0...v2.7.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
When client.New rejects an invalid Docker host or other client option,
it returns a nil concrete client with an error.
Returning that pointer directly as client.APIClient stores a typed-nil
interface, so lazy version checks dereference it.
Return an error instead.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Extract construction of the cluster volume spec from runCreate, and use
struct literals for the individual cluster volume options.
Also simplify topology parsing by reusing ConvertKVStringsToMap, use
slices.SortFunc for deterministic secret ordering, and use max to clamp
negative capacity values to zero.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Use filepath.Rel and filepath.IsLocal instead of comparing path prefixes
as strings when checking that a path stays within the config directory.
Also avoid calling Dir multiple times when constructing and validating
the path.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Inline the sub-slice lookup into stringSliceReplaceAt and use
slices.Equal to compare candidate ranges. When a specific index is
required, check that position directly instead of searching the full
slice.
This also fixes overlapping matches and uses slices.Concat to construct
the replacement result.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
translateV2AuthError only unwraps a url.Error from Do(); a 401
status never went through it. Use errhttp.ToNative so Auth()
treats that 401 as unauthorized and stops.
Signed-off-by: Dean Chen <862469039@qq.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Plugin hook output (such as Gordon's "What's next:" hint) was rendered
before the command's own error message because hooks were invoked inside
runDocker while the error was only printed in main() after runDocker
returned.
Print the error to stderr before invoking the hooks, and replace the
error with a status-only StatusError so main() does not print the same
message a second time. The original error message is captured up-front
and still passed to the plugin hooks.
The inline error-printing block in runDocker is extracted into a
printCommandError helper so the new behavior can be unit-tested
directly without spinning up runDocker.
TestPrintCommandError covers each branch of the helper: nil error,
generic error (printed and replaced with StatusError), StatusError
with/without message, context.Canceled (raw and wrapped), and
errCtxSignalTerminated.
Signed-off-by: Mohammed Olabie <olabiedev@gmail.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Use 'docker plugin ls --format' to extract plugin names and IDs, escaping colons in the plugin name (e.g. repo:tag) so zsh _describe treats the ID correctly as description.
Fixes#2761
Signed-off-by: FrancescoCastaldi <francesco.castaldi@mapsgroup.it>
Client-side login (daemon down) was wrapping a 401 as a plain error, so
Auth() moved on to the next endpoint. That can print Login Succeeded if
the HTTP fallback happens to answer 200.
Fixes#7237
Signed-off-by: Dean Chen <862469039@qq.com>
- Add support for creating timers with custom histogram buckets.
- Update `github.com/prometheus/client_golang` to v1.20.5.
- Update the minimum supported Go version to Go 1.21.
- Improve HTTP handler instrumentation, including minor performance improvements and cleanup.
- Avoid mutating shared label maps when creating namespaces and metrics.
- Encapsulate the Prometheus collector used by `HTTPMetric`.
- Improve package and API documentation.
- Update `golang.org/x/sys` and other dependencies.
full diff: https://github.com/docker/go-metrics/compare/v0.0.1...v0.1.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The DCO policy used here appears to have been derived from the Linux
kernel's guidance. In 2023, that guidance changed to relax the "real
name" requirement to a "known identity".
The DCO sign-off identifies the person certifying that they have the
right to submit a contribution. The previous wording required a "real
name" and rejected pseudonyms, which could discourage contributors
whose preferred or community name is the identity by which they can be
known.
The requirement is not anonymity: the identity in the sign-off must be
known enough for the project to follow up about the contribution if a
question arises. It does not require a legal name or a government-issued
identity. Use the clarified wording from the Linux kernel so known
pseudonyms and preferred names remain acceptable while anonymous
contributions remain excluded.
This also reflects concerns raised in the CNCF community about whether
"real name" means a legal name, a government-issued identity, or a
public identity that is sufficient to identify and contact a
contributor. The discussion emphasized that attribution and future
accountability do not require publishing a legal identity, and that
strict public-name rules can exclude people who cannot safely contribute
under that name.
Source: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d4563201f33a022fc035
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This release includes a fix to address a breakage affecting unencrypted
HTTP/2 (h2c) connections caused by a security patch included in last
patch release.
See go.dev/issue/80876 for details.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Notable changes:
- Add bidirectional `log/slog` integration with a Logrus hook and `slog.Handler`.
- Add minimal, composable logging interfaces for individual log levels.
- Fix reentrant logging deadlocks and improve concurrency safety around formatters, hooks, and entries.
- Fix generic `Log`, `Logf`, `Logln`, and `LogFn` methods unexpectedly panicking at `PanicLevel`.
- Allow `Entry.Caller` to be set explicitly and preserved across derived entries.
- Improve `TextFormatter` performance and reduce allocations significantly.
- Improve common Logger and Entry hot paths and caller-reporting performance.
- Update `TextFormatter` handling for `[]byte`, debug/trace colors, and Windows ANSI terminals.
- Raise the minimum supported Go version to Go 1.23.
- Deprecate `Entry.HasCaller` and `MutexWrap`.
release-notes: https://github.com/sirupsen/logrus/releases/tag/v1.10.0
release-notes: https://github.com/sirupsen/logrus/releases/tag/v1.10.1
full diff: https://github.com/sirupsen/logrus/compare/v1.9.4...v1.10.1
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
A global service is one task per matching node, not one per
node in the swarm. Say that next to --mode and --constraint.
Signed-off-by: Dean Chen <862469039@qq.com>
This release includes 10 security fixes following the security policy:
- x/mod/sumdb/tlog: fix transparency log tile verification bypass
A malicious GOPROXY was previously capable of forging
up to two sumdb tiles that allow for a requested module
to bypass the GOSUMDB check and persist attacker-controlled
module content to a local Go module cache.
This attack allows for a malicious GOPROXY to serve
malicious module content that cannot be detected
by evaluating the transparency log.
All tiles are now correctly verified against their parents.
In order to determine if you have been affected:
rm -r go.sum go.work.sum vendor/ && go mod tidy
Thanks to Filippo Valsorda (Geomys) for reporting this issue.
This is CVE-2026-56865 and Go issue https://go.dev/issue/80744.
- x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup
A malicious GOSUMDB was capable of serving arbitrary
module content not contained within the transparency
log.
This attack allows for a coordinating GOPROXY and
GOSUMDB to serve a client malicious module content
that cannot be detected by evaluating the transparency
log.
In order to determine if you have been affected:
rm -r go.sum go.work.sum vendor/ && go mod tidy
Thanks to mundur for reporting this issue.
This is CVE-2026-56864 and Go issue https://go.dev/issue/80745.
- encoding/xml: add recursion depth guard during decode
Previously, DecodeElement would reset the depth counter
causing it to never fire; this could lead to stack
exhaustion.
This is CVE-2026-56859 and Go issue https://go.dev/issue/80481.
net/http: apply ReadHeaderTimeout when doing unencrypted HTTP/2 check
When a server is configured to support unencrypted HTTP/2, it reads a
few bytes from each new connection to see if they contain the HTTP/2
client preface. Previously, this was being done with no timeout applied.
ReadHeaderTimeout is now applied for this.
This is CVE-2026-56853 and Go issue https://go.dev/issue/80205.
- net/url: avoid quadratic complexity in resolvePath
Previously, resolving relative paths containing parent directory (..) segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.
Now, path resolution operates on a byte buffer using index-based backtracking for .. segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
This is CVE-2026-56860 and Go issue https://go.dev/issue/80494.
- golang.org/x/net/dns/dnsmessage: panic when parsing invalid SVCB record
Parsing an invalid SVCB or HTTPS RR can panic when
the size of a parameter value overflows the message buffer.
Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.
This is CVE-2026-46600 and Go issue https://go.dev/issue/79795.
- crypto/tls: limit handshake messages we are willing to accept post-handshake
Previously, we always counted handshake messages, such as KeyUpdate, as
state-advancing, regardless of whether a handshake has been completed or
not. As a result, a malicious client can keep sending KeyUpdate messages
to force the server to keep performing key derivation operations
indefinitely.
Thanks to Qi Deng of Aurascape.ai for reporting this issue.
This is CVE-2026-56862 and Go issue https://go.dev/issue/80528.
- html/template: fix Javascript regexp context tracking
Previously, pathological inputs could close an
unescaped / early, allowing for attack-controlled
data to inject arbitrary content, potentially
leading to XSS.
Thanks to Ali Sherif for reporting this issue.
This is CVE-2026-56858 and Go issue https://go.dev/issue/80435.
- x/net/idna: failure to reject ASCII-only Punycode-encoded labels
The ToASCII and ToUnicode functions incorrectly accepted Punycode-encoded labels
that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com")
incorrectly returned the name "example.com" rather than an error.
The idna package implements the processing algorithm from UTS 46.
Older versions of UTS 46 included a specification bug which permitted
multiple ASCII labels to decode to the same Unicode label.
UTS 46 revision 33 fixed the specification bug.
The idna package now implements the updated specification.
This behavior can lead to privilege escalation in programs using the idna package.
For example, a program which performs privilege checks on the ASCII hostname
may reject "example.com" but permit "xn--example-.com". If that program subsequently
converts the ASCII hostname to Unicode, it will inadvertently permits access
to the Unicode name "example.com".
Thanks to KC1zs4 (https://github.com/KC1zs4) for reporting this issue.
This is CVE-2026-39821 and Go issue https://go.dev/issue/78760.
- encoding/asn1: enforce maximum recursion depth
Enforce a recursion limit in Unmarshal to prevent stack exhaustion
when parsing deeply-nested, recursive structures.
Thanks to Marwan Atia (marwans...@gmail.com) for reporting this issue.
This is CVE-2026-33818 and Go issue https://go.dev/issue/80405.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
commit 55fcffe743 added normalization
in config/configfile, so it's no longer needed to normalize here as
well.
updates 55fcffe743
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The synopsis only listed containers, networks, images, and volumes,
but the command always prunes unused build cache (including BuildKit
cache mounts). Align the description with the interactive warning.
Signed-off-by: Dean Chen <862469039@qq.com>
`comparePorts` compared host IPs with `i.IP.String() < j.IP.String()`, which
sorts them lexicographically, so "10.0.0.2" ordered before "9.0.0.1" in
`docker ps` output.
This also avoids formatting both addresses as strings on every comparison.
ports before after
64 1540 allocs/op 394 allocs/op
256 5364 allocs/op 1548 allocs/op
That's a ~74% (3.9x) reduction in allocations.
Signed-off-by: Hamir <hirehamir@gmail.com>
Both makeEnv and updateHosts removed elements from a slice while ranging
over that same slice. The range expression is evaluated once, so after a
removal the loop keeps using the original length: it reads stale elements
that shifted down, skips a live element, and can slice past the end of the
shrunken slice, which panics.
In makeEnv, the "no update required" continue also applied to the inner
loop instead of skipping the re-append, so an env-var passed twice with
the same value was stored twice. A third occurrence with a different value
then tried to remove both entries and panicked:
docker service create --env A=1 --env A=1 --env A=2 --name repro nginx
panic: runtime error: slice bounds out of range [2:1]
The same happens with an env-file that lists a variable twice, and the
panic occurs before any API call, so no daemon is needed to hit it.
updateHosts has the same problem when a hostname is listed more than once
in a single entry: --host-rm either leaves a copy behind or panics with
"slice bounds out of range". That needs a spec written through the API or
swarmkit directly, as the CLI does not produce such entries itself, so it
is less likely to be hit in practice.
Use slices.DeleteFunc for both, which removes every match in one pass, and
add tests for makeEnv, which had no coverage.
Signed-off-by: Madan Kumar <winklemad@outlook.com>
full diff: https://github.com/moby/go-archive/compare/v0.2.1...v0.3.0
v0.3.0
This release fixes CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h, where a crafted
tar archive could use links to cause extraction operations to create or
overwrite files outside the intended destination directory.
The issue affected Unpack, UnpackLayer, Untar, UntarUncompressed, and the
ApplyLayer helpers. Users should upgrade and avoid extracting untrusted
archives with earlier versions.
What's Changed
* archive: harden tar extraction against path traversal
* archive: do not follow reparse points in chtimes
* archive: fix creation time updates on Windows
* archive: minor cleanups and godoc touch-up
* archive: RebaseArchiveEntries: fix archive path rebasing
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Relevant changes (in vendor):
- bpf: add security considerations to package docs
- http2: initialize Transport on NewClientConn
fixes: x/net/http2: zero Transport not ready for use
- idna: reject all-ASCII xn-- labels on all Go versions
fixes x/net/idna: ToUnicode accepts Punycode labels encoding pure ASCII labels
full diff: https://github.com/golang/net/compare/v0.56.0...v0.57.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- cpu: handle vendor suffixes in parseRelease
- unix: update glibc to 2.43
- unix: use epoll_pwait rather than epoll_wait
- windows: avoid length overflow in NewNTString
- windows: document safe usage of TrusteeValue
full diff: https://github.com/golang/sys/compare/v0.46.0...v0.47.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The migration to the generated (V2) shell completions dropped the
"--filter" key/value suggestions that the legacy bash completion used to
provide for the swarm commands, so e.g. "docker service ps <service>
--filter <TAB>" no longer completed anything.
Register filter completions for "docker service ps", "docker service
ls", and "docker node ps", following the same approach as the existing
completion for "docker events --filter".
Signed-off-by: Jess Thrysoee <jess@thrysoee.dk>
opts/weightdevice.go and opts/throttledevice.go had no tests, unlike the
sibling opts. Add table-driven coverage for ValidateWeightDevice,
ValidateThrottleBpsDevice, ValidateThrottleIOpsDevice and the Set/GetList
paths, including boundary (weight 0/10/1000/overflow) and error cases.
Signed-off-by: Nikolaus Schuetz <nikolauspschuetz@gmail.com>
The development and e2e containers hard-code /var/run/docker.sock, so
rootless and other local contexts cannot expose their daemon socket.
Resolve the active context's Docker endpoint and strip the unix scheme
before using it as the bind source.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
`workflows` is not a supported GITHUB_TOKEN permission key, so GitHub
rejects the workflow definition. Use the valid `actions` permission
for both jobs.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Without it GitHub rejects the push:
```
refusing to allow a GitHub App to create or update workflow `.github/workflows/build.yml` without `workflows` permission
```
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The workflow previously inferred its target from the dispatch ref,
requiring operators to always sync the release branch with the
workflow/scripts on master.
Accept the release branch as an input, keep the dispatched master
checkout as the script source, and merge in a detached worktree at the
selected release revision.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The project was sunset;
> After more than a decade of serving the ecosystem, the time
> has come to sunset Go Report Card. Following the loss of our
> primary infrastructure sponsor, maintaining the web app is
> no longer sustainable.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Add a manually dispatched workflow for maintainers to sync a Docker
release branch to a selected release tag.
The sync-release-branch job checks out the release branch, computes
the list of unmerged tags up to the requested tag via
scripts/unmerged-tags, merges them in order via scripts/sync-branch
using git merge --no-ff (resolving conflicts by taking the tag's
content), then pushes the result to a temporary branch.
The push-release-branch job runs after manual approval via the
docker-releases environment. It verifies that neither the release
branch nor the temporary branch moved since the sync job ran before
force-advancing the release branch and deleting the temporary branch.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Bumps the go_modules group with 1 update in the /cmd/docker-trust directory: [golang.org/x/crypto](https://github.com/golang/crypto).
Updates `golang.org/x/crypto` from 0.50.0 to 0.52.0
- [Commits](https://github.com/golang/crypto/compare/v0.50.0...v0.52.0)
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-version: 0.52.0
dependency-type: indirect
dependency-group: go_modules
...
Signed-off-by: dependabot[bot] <support@github.com>
go1.26.5 (released 2026-07-07) includes security fixes to the crypto/tls
and os packages, as well as bug fixes to the compiler, the runtime, the
go command, and the net, os, and syscall packages. See the Go 1.26.5
milestone on our issue tracker for details;
- https://github.com/golang/go/issues?q=milestone%3AGo1.26.5+label%3ACherryPickApproved
- full diff: https://github.com/golang/go/compare/go1.26.4...go1.26.5
From the security announcement:
We have just released Go versions 1.26.5 and 1.25.12, minor point releases.
These releases include 2 security fixes following the security policy:
- os: Root escape via symlink plus trailing slash
On Unix systems, opening a file in an os.Root improperly
followed symlinks to locations outside of the Root when
the final path component of the a path is a symbolic link
and the path ends in /.
For example, root.Open("symlink/") would open "symlink"
even when "symlink" is a symbolic link pointing outside of the root.
On Unix, openat(fd, path, O_NOFOLLOW) will follow symlinks
in path when path ends in a /. Root failed to account for
this behavior, permitting paths with a trailing / to escape.
It now properly sanitizes the path parameter provided to openat.
hanks to Mundur for reporting this issue.
This is CVE-2026-39822 and Go issue https://go.dev/issue/79005.
- crypto/tls: Encrypted Client Hello privacy leak
he Encrypted Client Hello implementation would leak the pre-shared key
dentities during the handshake, allowing a passive network observer who can
ollect handshakes to de-anonymize the hostname of the server, even when ECH was
eing used.
Thanks to Coia Prant (github.com/rbqvq) for reporting this issue.
This is CVE-2026-42505 and Go issue https://go.dev/issue/79282.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
PromptUserForCredentials accepted a Cli as argument so that it could swap
the input stream on Windows (cli.SetIn).
Given that we only require this swap for the duration of this function (if
needed at all), we can use a local variable that either uses cli.In() or
os.Stdin (on Windows).
We currently still need to wrap the os.Stdin into a streams.In, but can use
the raw os.Stdin (and/or cli.In().File()) once prompt.DisableInputEcho is
updated.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Add a concurrency group keyed on PR number to prevent duplicate reviews
from simultaneous review_requested events.
Remove the sender.type != 'Bot' guard so Dependabot PRs remain
reviewable — per maintainer feedback, those reviews are useful for
catching behavior changes in dependency updates.
Signed-off-by: Derek Misler <derek.misler@docker.com>
- user: prevent possible DoS via unbounded parsing of user and group
database files in GHSA-mjcv-p78q-w5fw. This fixes a similar issue
as CVE-2026-47262 in containerd.
- user: prevent falling back to looking up numeric usernames
Improve handling of numeric user/group to prevent looking up numeric
values as usernames. This fixes a similar issue as [CVE-2026-46680] in
containerd.
- user: update minimum go version to go1.18
- assorted testing and linting fixes.
[CVE-2026-46680]: https://github.com/advisories/GHSA-fqw6-gf59-qr4w
full diff: https://github.com/moby/sys/compare/user/v0.4.0...user/v0.4.1
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This adds an e2e regression test for authenticated pull/push against a private registry, covering the auth regression reported in docker/cli#5963.
Includes:
- New privateregistry service in the e2e Compose stack with htpasswd auth on port 5001, and --insecure-registry for the engine container.
- TestPullPushPrivateRepository test that verifies authenticated push/pull and rejects unauthenticated operations.
- Auth config and test credentials in e2e/testdata/registry/.
- 90-second retry loop for transient DNS/container startup races.
- Service health wait loop in scripts/test/e2e/run.
- Increase TestProcessTermination timeout from 10s to 20s for connhelper-ssh + engine 25 combination.
- Connhelper-ssh engine Dockerfile for private registry integration.
Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com>
Make sure the symlinks point to the same file; not if both are
identical (absolute or relative symlink); it's only for suppressing
the warning so not critical.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
While the "-modfile=vendor.mod" is slightly more correct, using a
symlink allows for most of the go tools to work "as usual", just
without an acual `go.mod` being committed in the repository.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Follow-up to 8f7dc04070, which updated the
minimum Go version in vendor.mod, but did not adjust this script.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- update minimum go version to 1.24
- use os.OpenFile with O_FILE_FLAG_SEQUENTIAL_SCAN on Go 1.26+
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:
//go:build go1.25
//go:build go1.26
packagenode
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Alano Terblanche
Sebastiaan van Stijn
Sebastiaan van Stijn
Paweł Gronowski
Nimesh Kulkarni
Kir Kolyshkin
dependabot[bot]
Mend Renovate
Nicolas Beck
Tanvir Tian
Nick Sieger
KeelTrace
Youfu Zhang
Dean Chen
Mohammed Olabie
FrancescoCastaldi
Kamyar mofakhami
Hamir
Madan Kumar
CrazyMax
Jess Thrysoee
AmirHossein HajiMohammadi
Nikolaus Schuetz
mickael emirkanian
Derek Misler
Docker Agent
Lohit Kolluri
Alexis Girault
Albin Kerouanton
Ching Wei Kang