This document describes the latest changes, additions, known issues, and fixes for Docker Engine - Enterprise (Docker EE).
Docker EE is a superset of all the features in Docker CE. It incorporates defect fixes that you can use in environments where new features cannot be adopted as quickly for consistency and compatibility reasons.
Note
New in 18.09 is an aligned release model for Docker Engine - Enterprise. The new versioning scheme is YY.MM.x where x is an incrementing patch version. The enterprise engine is a superset of the community engine. They will ship concurrently with the same x patch version based on the same code base.
Note
The client and container runtime are now in separate packages from
the daemon in Docker Engine 18.09. Users should install and update
all three packages at the same time to get the latest patch releases.
For example, on Ubuntu:
sudo apt-get install docker-ee docker-ee-cli containerd.io. See
the install instructions for the corresponding linux distro for
details.
(2020-11-12)
(2020-08-10)
(2020-06-24)
2019-11-14
--default-addr-pool for docker swarm init
not picked up by ingress network.
docker/swarmkit#28922019-10-08
docker rmi stuck in case of misconfigured system (such as
dead NFS share).
docker/engine#336max-size is set and
max-file=1.
docker/engine#3772019-09-03
--config-only networks --config-from
networkshave ungracefully exited.
docker/libnetwork#23732019-07-17
docker stack deploy is used to redeploy a stack which includes
non-external secrets, the logs will contain the secret.parallelism and
max_failure_ratio fields.2019-06-27
--network-rm would fail to remove a network.
moby/moby#39174docker service create --limit-cpu.
moby/moby#391902019-05-06
COPY and ADD with multiple <src> to not invalidate
cache if
DOCKER_BUILDKIT=1.moby/moby#389642019-04-11
DOCKER_BUILDKIT=1 docker build --squash ..
docker/engine#176network=host using wrong resolv.conf with
systemd-resolved.
docker/engine#180Restarting.
docker/engine#1812019-03-28
git ref to avoid misinterpretation as a
flag. moby/moby#38944docker cp error for filenames greater than 100 characters.
moby/moby#38634layer/layer_store to ensure NewInputTarStream resources
are released.
moby/moby#38413GetConfigs.
moby/moby#38800containerd 1.2.5.
docker/engine#1732019-02-28
2019-02-11
runc to address a critical vulnerability that allows
specially-crafted containers to gain administrative privileges on the
host.
CVE-2019-5736For additional information, refer to the Docker blog post.
2019-01-09
In Docker versions prior to 18.09, containerd was managed by the Docker
engine daemon. In Docker Engine 18.09, containerd is managed by systemd.
Since containerd is managed by systemd, any custom configuration to the
docker.service systemd configuration which changes mount settings
(for example, MountFlags=slave) breaks interactions between the
Docker Engine daemon and containerd, and you will not be able to start
containers.
Run the following command to get the current value of the MountFlags
property for the docker.service:
sudo systemctl show --property=MountFlags docker.service
MountFlags=
Update your configuration if this command prints a non-empty value for
MountFlags, and restart the docker service.
/proc/asound to masked paths
docker/engine#126containerd
docker/engine#122service update --force
docker/cli#1526docker kill
docker/engine#116containerd is not
upgraded to the correct version on Ubuntu. Learn
more.2018-11-08
In Docker versions prior to 18.09, containerd was managed by the Docker
engine daemon. In Docker Engine 18.09, containerd is managed by systemd.
Since containerd is managed by systemd, any custom configuration to the
docker.service systemd configuration which changes mount settings
(for example, MountFlags=slave) breaks interactions between the
Docker Engine daemon and containerd, and you will not be able to start
containers.
Run the following command to get the current value of the MountFlags
property for the docker.service:
sudo systemctl show --property=MountFlags docker.service
MountFlags=
Update your configuration if this command prints a non-empty value for
MountFlags, and restart the docker service.
/info endpoint, and move detection to the
daemon moby/moby#37502--secret flag when
using BuildKit
docker/cli#1288docker build --ssh $SSHMOUNTID=$SSH_AUTH_SOCK) when using
BuildKit
docker/cli#1438 /
docker/cli#1419--chown flag support for ADD and COPY commands on
Windows moby/moby#35521builder prune subcommand to prune BuildKit build cache
docker/cli#1295
docker/cli#1334docker build --pull ... when using
BuildKit
moby/moby#37613docker engine subcommand to manage the lifecycle of a
Docker Engine running as a privileged container on top of containerd,
and to allow upgrades to Docker Engine Enterprise
docker/cli#1260docker info output
docker/cli#1313docker info output
docker/cli#1225awslogs-endpoint logging option
moby/moby#37374POST /session endpoint out of experimental.
moby/moby#40028<unknown>” in /info response
moby/moby#37472--console=[auto,false,true] to
--progress=[auto,plain,tty]
docker/cli#1276--data-path-addr flags when connected to a daemon that
doesn’t support this option
docker/docker/cli#1240-ce / -ee suffix from version string
docker-ce-packaging#206COPY/ADD.
moby/moby#37563trust inspect typo: “AdminstrativeKeys”
docker/cli#1300docker image prune with a large list of dangling images
docker/cli#1432 /
docker/cli#1423/etc/docker directory to prevent
“permission denied” errors when using docker manifest inspect
docker/engine#56 /
moby/moby#37847cpuset-cpus and
cpuset-mems
docker/engine#70 /
moby/moby#37967--platform to docker import
docker/cli#1375 /
docker/cli#1371--follow
docker/engine#48
moby/moby#37576
moby/moby#37734CAP_SYS_NICE in default
seccomp profile
moby/moby#37242CAP_SYS_ADMIN or
CAP_SYSLOG
docker/engine#64 /
moby/moby#37929There are important changes to the upgrade process that, if not correctly followed, can have impact on the availability of applications running on the Swarm during upgrades. These constraints impact any upgrades coming from any version before 18.09 to version 18.09 or greater.
With https://github.com/boot2docker/boot2docker/releases/download/v18.09.0/boot2docker.iso, connection is being refused from a node on the virtual machine. Any publishing of swarm ports in virtualbox-created docker-machine VM’s will not respond. This is occurring on macOS and Windows 10, using docker-machine version 0.15 and 0.16.
The following docker run command works, allowing access from host
browser:
docker run -d -p 4000:80 nginx
However, the following docker service command fails, resulting in
curl/chrome unable to connect (connection refused):
docker service create -p 5000:80 nginx
This issue is not apparent when provisioning 18.09.0 cloud VM’s using docker-machine.
Workarounds:
docker run is unaffected.This issue is resolved in 18.09.1.
As of EE 2.1, Docker has deprecated support for Device Mapper as a storage driver. It will continue to be supported at this time, but support will be removed in a future release. Docker will continue to support Device Mapper for existing EE 2.0 and 2.1 customers. Please contact Sales for more information.
Docker recommends that existing customers migrate to using Overlay2 for the storage driver. The Overlay2 storage driver is now the default for Docker engine implementations.
As of EE 2.1, Docker has deprecated support for IBM Z (s390x). Refer to the Docker Compatibility Matrix for detailed compatibility information.
For more information on the list of deprecated flags and APIs, have a look at the deprecation information where you can find the target removal dates.
In this release, Docker has also removed support for TLS < 1.2 moby/moby#37660, Ubuntu 14.04 “Trusty Tahr” docker-ce-packaging#255 / docker-ce-packaging#254, and Debian 8 “Jessie” docker-ce-packaging#255 / docker-ce-packaging#254.