Moby Files

29.9.1

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

• docker/cli, 29.9.1 milestone
• moby/moby, 29.9.1 milestone

Security

The containerd update to v2.4.2 includes fixes for the following security vulnerabilities:

• CVE-2026-95839: Pulling or importing an image through containerd's transfer service could crash containerd if a child descriptor contained the io.containerd.manifest.subject annotation and a malformed digest.
• GHSA-8647-2jxj-p2rc: An untrusted registry returning a crafted Content-Length header could crash containerd when parallel layer fetching was enabled with concurrent_layer_fetch_buffer.
• GHSA-hc94-p972-ch66: Pulling a crafted image or pulling from a malicious registry could exhaust host disk space because containerd did not limit incoming layer data to the declared size before validation.

Bug fixes and enhancements

• Fix --link-local-ip accepting addresses that are not link-local (169.254.0.0/16 or fe80::/10) when creating a container or connecting it to a network, which made the container fail to start. [#53923]
• Fix COPY --from in the classic builder failing for files not owned by root when userns-remap is enabled. [#53859]
• Fix docker ps -s and container listing with sizes failing entirely when the size of one container cannot be computed. [#53921]
• Fix docker save leaving image layers on disk after the image is removed, when the image contains the same layer more than once (graph-driver image store). [#53927]
• Fix a daemon panic when using the fluentd log driver with a TLS address that cannot be connected to and fluentd-async enabled. [#53922]
• Fix image digest resolution failing when a registry mirror succeeds but a subsequent registry lookup fails. [#53933]
• Fix plugin privilege lookup reporting success when fetching the plugin fails. [#53934]

Packaging updates

• Update containerd (static binaries) to v2.4.2. [#53936]

Networking

• Don't add bridge network interfaces to firewalld's docker zone when iptables and ip6tables are both disabled. [#53907]
• Fix bridge networks failing to restore on daemon startup when their bridge is bound to a firewalld zone other than docker. [#53907]

Rootless

• Fix --domainname with user namespaces and rootless mode; this requires an OCI runtime supporting the domainname field (such as runc >= v1.2.0). [#53899]
• Update RootlessKit to v3.3.0. [#53942]