This Rancher Desktop 1.25.0, an open source desktop application to bring Kubernetes and container management to macOS, Windows, and Linux.
Installers
New Contributors
Thank you to our new contributors: @srtdog64, @PlayerNguyen, @Harshavardhan-28, and @Juhantam!
Release Notes for 1.25.0
What's New
The interface speaks Vietnamese
Pick Vietnamese under Preferences > Application > General. It joins the eight languages that 1.24.0 added, and like them it is experimental, so feedback from native speakers is welcome. The app's usual font lacks most Vietnamese accented letters, so Vietnamese text uses a font installed on your system instead. Thanks to @PlayerNguyen! (#11004)
Deleting containers and volumes asks first
The Delete action on the Containers and Volumes pages used to run the moment you clicked it; both pages now ask first, in a dialog that counts the containers or volumes and lists them by name. Cancel is the default button, so Esc and Enter both back out. (#10957)
Tables show up to 1000 rows per page
The Containers and Volumes pages showed only 10 rows at a time. Forwarding and Diagnostics showed 100. They now show up to 1000. (#10958)
rdctl start --wait
rdctl start would return as soon as it has launched the app, so a script that runs docker or kubectl next could race the backend coming up. With the new --wait flag, rdctl start returns once the backend has started, and fails if the backend reports an error or --wait-timeout (10 minutes by default) runs out. By then the container engine is ready to use. When Rancher Desktop is already running, --wait has two problems, described under Known Issues. (#6915)
macOS and Linux: new installs forward ports over gRPC
New installs, and installs after a factory reset, now forward published ports and the Docker socket through Lima's gRPC port forwarder instead of SSH. On macOS, the SSH forwarder can hold only about 1000 connections at once. Past that limit, 1.24.0 lost every published port and the Docker socket until Rancher Desktop restarted, while 1.25.0 keeps them working and refuses just the extra connections. The gRPC forwarder keeps those connections in Lima's host agent, where that limit does not apply. Existing installs keep their saved forwarder; to switch, run rdctl set --experimental.virtual-machine.ssh-port-forwarder=false. (#11235)
Bug Fixes
Windows: Docker stopped answering soon after it started
Since 1.23.0, a health check inside the WSL distribution failed on every run when using the moby engine. About a minute after each start, the failed check stopped the proxy that forwards Docker requests from Windows, and on some machines the proxy stayed down until Rancher Desktop restarted. Docker commands from Windows then failed with "timed out dialing Hyper-V socket", and docker.log could grow by a megabyte every few seconds. The health check passes again, and the proxy now restarts after it is stopped. (#10739)
Windows: startup could hang at "Waiting for Kubernetes API"
Rancher Desktop could wait forever for a Kubernetes cluster that was already running, looking for the cluster at an address it worked out from WSL's network settings. That lookup failed for some of the network ranges WSL picks, and always under WSL's VirtioProxy networking mode. WSL picks a new range at each start, so the hang came and went. Rancher Desktop now checks the API at 127.0.0.1, the address Windows uses to reach it. A Kubernetes port other than 6443 also left the API unreachable from Windows; that works now too. (#10657)
Windows: the guest agent log could fill the disk
rancher-desktop-guestagent.log recorded debug messages even with debug mode off, so once containers were running it could grow until the disk was full. The guest agent now logs debug messages only when Enable debug mode is checked on the Troubleshooting page. (#10737)
Windows: a PORT environment variable broke Docker
If the environment that started Rancher Desktop set a PORT variable, the process that forwards Docker requests from Windows took it as its own port, failed, and restarted every second, so Docker never worked from Windows. It ignores the variable now. (#10946)
Windows: published UDP ports answered only on localhost
With a per-machine installation (the one available for all users), other machines could not reach a container's published UDP port. The installer's firewall exception for host-switch.exe allowed only TCP; it now allows UDP too. (#10965)
Windows: ping in a container always got a reply
On Windows, Rancher Desktop's network stack answered every ping from a container itself, so ping reported replies even for addresses where no machine exists. Pings now go out to the real address, and a container sees only the replies that come back. (#11127)
Windows: a 127.0.0.1 port could stop answering after its container restarted
With the moby engine, a container can publish more than one port on 127.0.0.1. When such a container stopped, Rancher Desktop removed the forwarding rule for only one of those ports. If the container then started with a different IP address, connections to its other ports went to the old address and timed out until Rancher Desktop restarted. Rancher Desktop now removes the rules for all of them. (#11138)
macOS: outbound connections failed for about a minute after each Kubernetes start
With the VZ virtual machine type (default) and Kubernetes enabled, Kubernetes tried at startup to reach the metrics server at the address that the server had in the previous boot. When the local network silently dropped those attempts, they filled all ten slots that the virtual machine's network stack has for connections in progress. Every new outbound TCP connection from the virtual machine then failed until the attempts timed out about a minute later, so an image pull in that minute failed with dial tcp ...: i/o timeout. The bundled Lima now allows 128 connections in progress and gives up on each after 30 seconds. (#11136)
Startup errors showed a misleading message
When the virtual machine failed to start on macOS or Linux, the error dialog could say "Invalid state, no container engine client available", and the real cause, such as a failed Kubernetes download, appeared only in the logs. A snapshot taken with rdctl snapshot create right after startup could trigger the same message on any platform. It could also make Rancher Desktop report a failed start, or quit when it was started with --no-modal-dialogs. The dialog now shows the real error, and a snapshot right after startup causes neither problem. (#8525, #11264)
Docker logged "dangling" warnings every few seconds
With Kubernetes enabled and the moby engine using the containerd image store, every Kubernetes start reloaded the bundled images, and Docker kept a stale record of each one. docker.log then gained about six "multiple images have the same target, but one of them is still dangling" warnings every ten seconds. Rancher Desktop now loads only the images that are missing, for every k3s release published since late July 2025; older k3s versions still load everything. Docker cannot remove the records that earlier starts left behind, but a factory reset clears them. The underlying Docker bug is moby/moby#53561. (#10876)
Pods inherited the host's DNS search domains
On macOS and Linux, pods inherited the DNS search domains of the host's network, and they tried those domains before the name itself. Some search domains answer for names that they do not hold, through a public wildcard record or a router that answers for everything under its local domain. So such a search domain sent a pod's lookups of external names to the wrong address, and lookups of full svc.cluster.local names could fail. Pods no longer get the host's search domains, so they can't resolve short names through them either; a pod that needs one can set dnsConfig.searches. (#2227, #6316, #8380)
Turning off Traefik could leave it running
When you turned off Traefik, Rancher Desktop deleted both of its Helm charts at once. If the chart with Traefik's custom resource definitions went first, Helm could not uninstall Traefik, and its pods kept running. Rancher Desktop now deletes only the Traefik chart and leaves the definitions chart to k3s, which removes it a few seconds later; on a slow machine, that can still happen before Traefik is gone. (#11265)
Updates were never offered after a factory reset with Kubernetes disabled
After a factory reset, if Rancher Desktop then ran with Kubernetes disabled, the update check could not save its result and never offered an update; it just retried every ten minutes. Update checks now work whether Kubernetes is on or off. (#10964)
Multi-select on the Containers page was broken
Shift-click and Ctrl-click (Cmd-click on macOS) selection on the Containers page broke in several ways. A modified click on a container's name opened its details page instead of selecting the row, deselecting one row could deselect a different one, Shift-clicking a selected row left the range selected, and the selection vanished whenever the list refreshed, which happens on every container event. Multi-select works again. Thanks to @Juhantam! (#11005)
The Containers page showed a slash before container names
A side effect of the 1.24.0 fix for extensions put a leading slash on every name on the Containers page (/web). The slash is gone again. Thanks to @srtdog64! (#10717)
The Standalone Containers label stayed in English
The Containers page groups the containers that don't belong to a Compose project or a Kubernetes pod under Standalone Containers. That label stayed in English whatever language you picked; it is translated now. Thanks to @Harshavardhan-28! (#11022)
Settings validation let malformed values through
A port of 6443oops became 6443, a CPU count of 2.5 reached the virtual machine's configuration, and null or a list in place of a group of settings was ignored or caused an internal error. Rancher Desktop now rejects these values with a validation error. Thanks to @srtdog64! (#10755, #10784, #10915)
The Tachometer extension could not be installed
The Extensions catalog listed a Tachometer version that is no longer on Docker Hub, and newer versions showed a blank page because they expect the theme that Docker Desktop provides to its extensions. Rancher Desktop now provides that theme, and the catalog offers Tachometer 0.2.6. (#10882)
Linux: AI Workbench could not install Ollama
Ollama 0.14 changed the format of its Linux download, so AI Workbench 0.2.0 failed every time it tried to install Ollama on Linux. The Extensions catalog now offers AI Workbench 0.3.0, which installs it again. (#10980)
Security
macOS: any process running as you could get root through the admin-access prompt
Rancher Desktop copied values from Lima's networks.yaml, a file that your user account can edit, into the sudoers file that it installs as root after the admin-access prompt. So any process running as you could edit networks.yaml to put a line into the sudoers file that gave it root. Rancher Desktop now renames a networks.yaml whose addresses are not all IPv4 to networks.orig.yaml and uses its default networks instead, and it refuses shell syntax in the paths that it passes to commands run as root. (#11137)
Rancher Desktop trusted the compromised eMudhra certificate authorities
Anyone can recover the private keys of eight eMudhra intermediate certificate authorities from their certificates, and so issue TLS certificates that Rancher Desktop 1.24.0 accepted, in the app and inside the virtual machine. 1.25.0 no longer trusts them in the app, in the host CA certificates that it copies into the virtual machine, in the virtual machine image or the WSL distribution, in its Go programs, or in Spin apps. (#11197)
Windows: ports published on 127.0.0.1 could be reachable from other machines
Under WSL's consomme networking mode, other machines could reach a port published on 127.0.0.1 through a random port. WSL falls back to consomme when it cannot create its NAT network, so this could happen without any change to WSL's settings. WSL 3.0.3 reported success for a bind that had failed, so the Rancher Desktop listener that forwards the port to other WSL distributions then listened on all addresses. Rancher Desktop now closes a listener that did not get the address it asked for. (#11244)
Updated components
Rancher Desktop 1.25.0 updates these components to versions that fix security advisories, four of them rated critical.
- Linux kernel 6.18.37 → 6.18.60, in the virtual machine.
- On Windows, the kernel comes from WSL, so run
wsl --updateto get WSL kernel 6.18.58.1 or later.
- On Windows, the kernel comes from WSL, so run
- containerd 2.3.2 → 2.3.7 and Docker Engine 29.5.3 → 29.9.2, in the virtual machine and the WSL distribution.
- Spin 4.0.2 → 4.2.6 and containerd-shim-spin 0.25.1 → 0.27.2.
- docker CLI 29.6.2 → 29.9.3 and docker-buildx 0.35.0 → 0.38.2.
- Lima 2.1.2 → a 2.3.0 development build.
Known Issues
rdctl start --wait when Rancher Desktop is already running
With Rancher Desktop already running, rdctl start --wait without a setting flag fails with start command: no settings to change were given. If you pass a setting that needs a restart while the backend is still starting, it can return before the restart begins. (#11257)
Deprecations
Rancher Desktop 1.26 will drop Kubernetes versions older than 1.32
If you use a Kubernetes version older than 1.32, move to 1.32 or later now, while Rancher Desktop 1.25 still lets you go back. Take a snapshot, pick the new version under Preferences > Kubernetes, and check that your workloads still run; if they don't, restore the snapshot.
When Rancher Desktop 1.26 starts with an older Kubernetes version selected, it will upgrade Kubernetes to the latest 1.32 release. That upgrade can cross several Kubernetes minor versions at once and may break your workloads. Restoring a snapshot taken on an older version triggers the same upgrade, so replace such snapshots with new ones taken on 1.32 or later.
If a deployment profile locks an older version, Kubernetes won't start until you change the profile. (#11300)
Updates to Bundled Utilities (from Rancher Desktop 1.24.0)
- docker
29.6.2→29.9.3 - docker-compose
5.3.1→5.7.0 - docker-buildx
0.35.0→0.38.2 - docker-credential-helpers
0.9.8→0.9.12 - helm
4.2.3→4.3.1 - kuberlr
0.7.0→0.9.0 - trivy
0.72.0→0.76.1 - spin
4.0.2→4.2.6 - spin-shim
0.25.1→0.27.2 - cert-manager
1.21.0→1.21.3
Unchanged:
- nerdctl
2.2.2 - amazon-ecr-credential-helper
0.12.0 - spin-operator
0.6.1 - spin-plugin-kube
0.4.0
Connect with the developers
-
The issue queue
-
Rancher Users Slack in the #rancher-desktop channel
Changelog
The full version changelog, from v1.24.0, can be found using GitHub compare and the details of the release can be found in the v1.25.0 milestone.