chore(deps): update docker docker tag to v29.8.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
docker (source)	final	minor	29.6.2-dind → 29.8.0-dind

---

Release Notes

moby/moby (docker)

v29.8.0: v29.8.0

Compare Source

29.8.0

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

• docker/cli, 29.8.0 milestone
• moby/moby, 29.8.0 milestone

New

• Add HostConfig.Umask option and a corresponding --umask <octal> flag to docker create/docker run to set the umask for a container's main process, execs, and healthchecks. moby/moby#53463, docker/cli#7108
• Add support for attaching service names, environments, and custom CloudWatch entity attributes to logs from the awslogs logging driver. moby/moby#52632

Security

• Add daemon support for configuring the default container AppArmor profile template. moby/moby#52771
  • See https://docker.docker.com/engine/security/apparmor/#customize-the-default-profile
• Prevent containers from using the 32-bit socketcall(2) path to create AF_VSOCK sockets and communicate with host virtual machines by adding AppArmor and SELinux policy rules. moby/moby#53551

Networking

• Fix docker network inspect failing to find a healthy Swarm network when another Swarm network could not be allocated. moby/moby#53325
• Fix a node gossiping a superseded value for a Swarm service discovery entry after concurrent updates to the same key. moby/moby#53479
• Fix Swarm service names failing to resolve on a node indefinitely after it misses a network membership announcement. moby/moby#53437
• Fix Swarm service names failing to resolve on healthy nodes after a transient node failure. moby/moby#53142
• Prevent dockerd from hanging when the nft command produces enough stderr output to fill its pipe. moby/moby#53517
• Reduce gossip traffic generated by a node that repeatedly disconnects and rejoins the cluster. moby/moby#53479
• Remote network-driver plugins can now set the container-side interface name via the DstName field in their Join response. moby/moby#52866
• Reserve network names "container" and "container:" to prevent creation of unusable networks. moby/moby#51973
• Spread the daemon's periodic Swarm overlay network gossip and synchronization work over time, avoiding recurring bursts of CPU and network usage. moby/moby#53475
• Swarm service-mesh published ports now use the same infrastructure as published ports for local containers. moby/moby#53118

Rootless

• Fix --disable-host-loopback not being enforced for the pasta network driver in rootless mode. moby/moby#53358
• Update RootlessKit to v3.1.0, adding support for the pesto port driver in rootless mode. Set DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=pesto to use it; it requires the pasta network driver and supports IPv4 only. moby/moby#53358

Go SDK

• Update minimum supported Go version to 1.26. docker/cli#7258

Bug fixes and enhancements

• Add annotation filter to container listings (docker ps, GET /containers/json) allowing to filter containers by their annotations. moby/moby#53538
• containerd image store: Fix docker image inspect reporting a smaller image size than docker image ls. moby/moby#53426
• containerd image store: Fix slower image pulls caused by repeated registry authentication within a single pull. moby/moby#53497
• Do not log expected image signature identity misses as errors for containerd image store images. moby/moby#53495
• dockerd now uses the embedded containerd if no system containerd service is configured and containerd is not installed. moby/moby#53388
• Fix GET /images/{name}/json not including unpacked snapshot usage in Size when using the containerd image store. moby/moby#53426
• Fix classic-builder cache for Dockerfile stages that select a non-host platform with FROM --platform. moby/moby#53503
• Fix CLI panic when DOCKER_HOST or -H specifies an invalid host. docker/cli#7280
• Fix health checks being delayed for too long when the start interval is longer than the start period. moby/moby#52317
• Fix inconsistent mount ordering in docker inspect output (GET /containers/{id}/json) and container listings (docker ps, GET /containers/json). moby/moby#53534
• Fix NRI container metadata so Container.Args includes the resolved executable as argv[0], matching the process launched in the container instead of only the Docker Cmd. moby/moby#53423
• Fix Swarm service creation failing when an automatically generated name is already in use. moby/moby#53468
• Fix the container root directory / being world-writable when using the btrfs storage driver. moby/moby#53500
• Fixed docker ps sorting published ports lexicographically instead of numerically. docker/cli#7144
• Preserve service mount order during forced updates to avoid an unnecessary rollout on the next stack deploy. docker/cli#7227
• Prevent containerd's v2 CRI plugins from loading when CRI is disabled. moby/moby#53564
• Print plugin hook output (e.g. the "What's next:" hint) after the command's error message instead of before it. docker/cli#6976
• Reject checkpoint IDs containing path separators to prevent access outside the container checkpoint directory. moby/moby#53377

Packaging updates

• Update BuildKit to v0.33.0. moby/moby#53554
• Update containerd (static binaries) to v2.3.4. moby/moby#53409
• Update Go runtime to 1.26.8. moby/moby#53550, docker/cli#7274
• Update runc (in static binaries) to v1.5.1. moby/moby#52306

v29.7.2: v29.7.2

Compare Source

29.7.2

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

• docker/cli, 29.7.2 milestone
• moby/moby, 29.7.2 milestone

Bug fixes and enhancements

• Fix docker service create and docker service update panicking when the same environment variable is passed more than once. docker/cli#7145
• Fix a regression introduced in Docker Engine 29.7.0 that caused image pulls to reject images containing absolute hardlink targets, as produced by some image builders. moby/moby#53305
• Fix a regression introduced in Docker Engine 29.7.0 that could cause image pulls and docker cp to fail on older Linux kernels when applying file permissions, including for device nodes. moby/moby#53305

Packaging updates

• Update BuildKit to v0.32.2. moby/moby#53300

Networking

• Improve compatibility with more nftables releases by terminating base-chain policies with a semicolon. moby/moby#53303

v29.7.1: v29.7.1

Compare Source

29.7.1

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

• docker/cli, 29.7.1 milestone
• moby/moby, 29.7.1 milestone

Bug fixes and enhancements

• Fix a regression that prevented pulling images whose layers contain directories without explicit parent directory entries. moby/moby#53260
• Fix a regression where the CopyToContainer rejects container paths that traverse absolute symlinks, such as /var/run -> /run. moby/moby#53261

v29.7.0: v29.7.0

Compare Source

29.7.0

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

• docker/cli, 29.7.0 milestone
• moby/moby, 29.7.0 milestone

New

• Add an experimental embedded-containerd feature that runs containerd inside the daemon process instead of as a separate managed process. moby/moby#52898
• Mount type image is no longer experimental. moby/moby#52998
• Add the default-stop-timeout daemon option to configure the stop timeout assigned to containers without an explicit timeout. moby/moby#53146

Security

This release includes a fix for a security vulnerability affecting Docker Engine and related components.

• Update github.com/moby/go-archive to v0.3.0 to fix CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h. moby/moby#53247, docker/cli#7139

Networking

• Fix a daemon panic when cleanup of a container's network interface fails while the container is being disconnected from a network. moby/moby#53237
• Fix a daemon panic when removing swarm ingress ports after failing to bind an ingress proxy listener. moby/moby#53022

Rootless

• Keep the cgroup mount for containers with --net=host. moby/moby#52318

Bug fixes and enhancements

• Add shell completion for --filter names and known values to docker service ls, docker service ps, and docker node ps. docker/cli#7124
• containerd image store: Fix daemon-wide concurrent download and upload limits for pulls and pushes not being honored. moby/moby#53081
  • To preserve the previous unlimited startup behavior, configure "max-concurrent-downloads" and "max-concurrent-uploads" to 0
• Fix docker cp -a using the wrong file owner when copying files into containers with user namespace remapping enabled. moby/moby#53084
• Fix docker cp from a Windows container silently returning a file instead of an error when the source path ends with a separator but is not a directory. moby/moby#53123
• Fix docker stats reporting all zeros for running Windows containers when using the containerd runtime. moby/moby#53101
• Fix docker stats reporting empty network stats for running Windows containers when using the containerd runtime. moby/moby#53219
• Fix a typo in the docker create --pull flag description. docker/cli#7103
• Fix Swarm service updates failing due to "file exists" errors when a VIP IP alias already exists on the LB endpoint interface. moby/moby#51657
• Fix Swarm tasks being rejected when their image could not be pulled from the registry but was already present on the node. moby/moby#53212
• Improve the error returned when a container hostname exceeds Linux's 64-byte limit. moby/moby#53121
• Prevent live-restored volumes from retaining active mount references when containers exit during daemon startup. moby/moby#53115
• Suppress the “No such container” error when docker rm --force succeeds for a nonexistent container. docker/cli#7110

Packaging updates

• Update Go runtime to 1.26.5. docker/cli#7087
• Update BuildKit to v0.32.0. moby/moby#53234
• Update containerd (static binaries) to v2.3.3. moby/moby#53050
• Update runc (in static binaries) to v1.4.3. moby/moby#50960

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[viceice]

breaks Forgejo runner