moby/moby docker-v29.9.1 on GitHub

29.9.1

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

The containerd update to v2.4.2 includes fixes for the following security vulnerabilities:

CVE-2026-95839: Pulling or importing an image through containerd's transfer service could crash containerd if a child descriptor contained the io.containerd.manifest.subject annotation and a malformed digest.
GHSA-8647-2jxj-p2rc: An untrusted registry returning a crafted Content-Length header could crash containerd when parallel layer fetching was enabled with concurrent_layer_fetch_buffer.
GHSA-hc94-p972-ch66: Pulling a crafted image or pulling from a malicious registry could exhaust host disk space because containerd did not limit incoming layer data to the declared size before validation.

Fix --link-local-ip accepting addresses that are not link-local (169.254.0.0/16 or fe80::/10) when creating a container or connecting it to a network, which made the container fail to start. moby/moby#53923
Fix COPY --from in the classic builder failing for files not owned by root when userns-remap is enabled. moby/moby#53859
Fix docker ps -s and container listing with sizes failing entirely when the size of one container cannot be computed. moby/moby#53921
Fix docker save leaving image layers on disk after the image is removed, when the image contains the same layer more than once (graph-driver image store). moby/moby#53927
Fix a daemon panic when using the fluentd log driver with a TLS address that cannot be connected to and fluentd-async enabled. moby/moby#53922
Fix image digest resolution failing when a registry mirror succeeds but a subsequent registry lookup fails. moby/moby#53933
Fix plugin privilege lookup reporting success when fetching the plugin fails. moby/moby#53934

Don't add bridge network interfaces to firewalld's docker zone when iptables and ip6tables are both disabled. moby/moby#53907
Fix bridge networks failing to restore on daemon startup when their bridge is bound to a firewalld zone other than docker. moby/moby#53907

Fix --domainname with user namespaces and rootless mode; this requires an OCI runtime supporting the domainname field (such as runc >= v1.2.0). moby/moby#53899
Update RootlessKit to v3.3.0. moby/moby#53942