1. Home
  2. Docker Enterprise products
  3. Mirantis Container Runtime
  4. Mirantis Container Runtime release notes

Mirantis Container Runtime release notes

Mirantis Container Runtime release notes

This document describes the latest changes, additions, known issues, and fixes for Mirantis Container Runtime.

Mirantis Container Runtime builds upon the corresponding Docker Engine - Community that it references. Mirantis Container Runtime includes enterprise features as well as back-ported fixes (security-related and priority defects) from the open source. It also incorporates defect fixes for environments in which new features cannot be adopted as quickly for consistency and compatibility reasons.

Note

The client and container runtime are in separate packages from the daemon. Users should install and update all three packages at the same time to get the latest patch releases. For example, on Ubuntu: sudo apt-get install docker-ee docker-ee-cli containerd.io. See the install instructions for the corresponding linux distro for details.

Version 19.03

19.03.17

(2021-06-29)

Components

Component Version
Mirantis Container Runtime 19.03.17
containerd 1.4.6
runc 1.0.0-rc95

Networking

  • Fixed an issue wherein overlapping IP addresses could occur due to nodes failing to clean up their old load balancer IP addresses (FIELD-3915).

Packaging

  • Updated containerd to version 1.4.6 and runc to version 1.0.0-rc95 to address CVE-2021-30465 (ENGINE-482).

19.03.16

(2021-05-17)

Components

Component Version
Mirantis Container Runtime 19.03.16
containerd 1.3.10
runc 1.0.0-rc10

Packaging

  • Added a technical preview for cri-docker (previously known as dockershim).
  • Fixed an issue wherein killing containerd caused systemd to stop docker.

Networking

  • Fixed an issue wherein swarm service VIPs timed out from Windows containers, resulting in the following error in dockerd event logs:

    Failed to add ILB policy for service service […] failed during
hnsCallRawResponse: hnsCall failed in Win32: The specified port already
exists.

    The Windows Operating System update KB4577668 introduced the issue on October 13, 2020, affecting all versions of MCR (FIELD-3310).

Known issues

  • Centos and RHEL 7.x kernels can experience memory exhaustion due to slab cache usage. Because this is a kernel feature, the issue cannot be resolved with MCR code.

    Workarounds:

    • (Recommended) Update to a kernel that supports setting cgroups.memory=nokmem and apply the change (for customers using Centos or RHEL 7.7 and above).
    • Increase the memory available to the machine for slab usage.

    (FIELD-3466)

19.03.15

(2021-04-12)

Components

Component Version
Mirantis Container Runtime 19.03.15
containerd 1.3.10
runc 1.0.0-rc10

Security

  • Resolved CVE-2021-21285, thereby preventing invalid images from crashing the Docker daemon (ENGINE-437).
  • Resolved CVE-2021-21284, thereby preventing a remapped root from accessing the Docker state by locking down file permissions (ENGINE-437).
  • MCR now confirms that AppArmor and SELinux profiles are applied when building with BuildKit (ENGINE-437).
  • Resolved CVE-2021-21334, and in the process updated containerd to version 1.3.10 (ENGINE-437).

Client

  • MCR now evaluates contexts before import to reduce the risk of extracted files escaping the context store (ENGINE-437).

19.03.14

(2021-03-01)

No changes were made to MCR for the March 1, 2021 software patch (only MKE is affected). As such, the product retains the 19.03.14 version number and there are no new release notes to report.

(2021-02-02)

No changes were made to MCR for the February 2, 2021 software patch (only MKE is affected). As such, the product retains the 19.03.14 version number and there are no new release notes to report.

(2020-12-17)

Components

Component Version
Docker Engine - Enterprise 19.03.14
containerd 1.3.9
runc 1.0.0-rc10

Engine

  • Fixed a memory leak related to the use of gcplogs (ENGINE-317).
  • Bumped libnetwork to address null dereference in error handling (ENGINE-317).

Runtime

  • Resolved an issue wherein containerd 1.7 binaries for RHEL 7.7 and 7.8 were missing (ENGINE-295).

Security

  • Resolved CVE-2020-15257 (ENGINE-322).

19.03.13

(2020-11-12)

Components

Component Version
Mirantis Container Runtime 19.03.13
containerd 1.3.7
runc 1.0.0-rc10

Client

  • Bumped to golang version to 1.13.15 to address CVE-2020-16845.
  • Fixed errors on close in config file write on Windows.
  • Fixed an issue wherein Docker does not gracefully logout for non-default registry.

Engine

  • Bumped to golang version to 1.13.15 to address CVE-2020-16845
  • Fixes an issue where stopping a container did not remove it’s network namespace after running docker network disconnect cmd.
  • Bumped aws-sdk-go to support IMDSv2.

19.03.12

(2020-08-10)

Client

  • Fixed a command-line input regression on Windows
  • Bumped to go1.13.13 to address CVE-2020-14039
  • Bumped golang.org/x/text to address CVE-2020-14040
  • Fix bug preventing logout from registry when using multiple config files (e.g. Windows vs WSL2 when using Docker Desktop)
  • Fix regression preventing context metadata to be read

Engine

  • Bumped to go1.13.13 to address CVE-2020-14039
  • Fixed license warning regression on Windows
  • Fixes to Microsoft/hcsshim to address issues in directory timestamps, log-rotation, and Windows container startup times.
  • Bump vendor x/text to address CVE-2019-19794

19.03.11

(2020-06-24)

Networking

  • Fix for ‘failed to get network during CreateEndpoint’
  • Disable IPv6 Router Advertisements to prevent address spoofing. CVE-2020-13401
  • Fix DNS fallback regression. moby/moby#41009
  • Fix potential panic upon restart. moby/moby#40809
  • Assign the correct network value to the default bridge Subnet field. moby/moby#40565

Client

Runtime

Rootless

Builder

  • buildkit: Fix concurrent map write panic when building multiple images in parallel. moby/moby#40780
  • buildkit: Fix issue preventing chowning of non-root-owned files between stages with userns. moby/moby#40955
  • Avoid creation of irrelevant temporary files on Windows. moby/moby#40877

Logging

  • Avoid situation preventing container logs to rotate due to closing a closed log file. moby/moby#40921

Security

Swarm

  • Fix issue where single swarm manager is stuck in Down state after reboot. moby/moby#40831
  • tasks.db no longer grows indefinitely.

19.03.8

(2020-05-28)

Builder

  • builder-next: Fix deadlock issues in corner cases.
  • builder-next: Allow modern sign hashes for ssh forwarding.
  • builder-next: Clear onbuild rules after triggering.
  • builder-next: Fix issue with directory permissions when usernamespaces is enabled.
  • Bump hcsshim to fix docker build failing on Windows 1903.

Networking

  • Shorten controller ID in exec-root to not hit UNIX_PATH_MAX.
  • Fix panic in drivers/overlay/encryption.go.
  • Fix hwaddr set race between us and udev.

Runtime

  • Fix docker crash when creating namespaces with UID in /etc/subuid and /etc/ subgid
  • Fix rate limiting for logger, increase refill rate
  • seccomp: add 64-bit time_t syscalls
  • libnetwork: cleanup VFP during overlay network removal
  • Improve mitigation for CVE-2019-14271 for some nscd configuration.
  • overlay: remove modprobe execs.
  • selinux: display better error messages when setting file labels.
  • Speed up initial stats collection.
  • rootless: use certs.d from XDG_CONFIG_HOME.
  • Bump Golang 1.12.17.
  • Bump google.golang.org/grpc to v1.23.1.
  • Update containerd binary to v1.2.13.
  • Prevent showing stopped containers as running in an edge case.
  • Prevent potential lock.
  • Update to runc v1.0.0-rc10.
  • Fix possible runtime panic in Lgetxattr.
  • rootless: fix proxying UDP packets.

Client

  • Bump Golang 1.12.17.
  • Bump google.golang.org/grpc to v1.23.1.

19.03.5

2019-11-14

Builder

  • builder-next: Added entitlements in builder config. docker/engine#412
  • Fix builder-next: permission errors on using build secrets or ssh forwarding with userns-remap. docker/engine#420
  • Fix builder-next: copying a symlink inside an already copied directory. docker/engine#420

Packaging

  • Support RHEL 8 packages

Runtime

19.03.4

2019-10-17

Networking

  • Rollback libnetwork changes to fix DOCKER-USER iptables chain issue. docker/engine#404

Known Issues

Existing
  • In some circumstances with large clusters, Docker information might, as part of the Swarm section, include the error code = ResourceExhausted desc = grpc: received message larger than max (5351376 vs. 4194304). This does not indicate any failure or misconfiguration by the user, and requires no response.
  • Orchestrator port conflict can occur when redeploying all services as new. Due to many Swarm manager requests in a short amount of time, some services are not able to receive traffic and are causing a 404 error after being deployed.
    • Workaround: restart all tasks via docker service update --force.
  • CVE-2018-15664 symlink-exchange attack with directory traversal. Workaround until proper fix is available in upcoming patch release: docker pause container before doing file operations. moby/moby#39252
  • docker cp regression due to CVE mitigation. An error is produced when the source of docker cp is set to /.
  • Install Mirantis Container Runtime fails to install on RHEL on Azure. This affects any RHEL version that uses an Extended Update Support (EUS) image. At the time of this writing, known versions affected are RHEL 7.4, 7.5, and 7.6.

19.03.3

2019-10-08

Security

Builder

  • Fix builder-next: resolve digest for third party registries. docker/engine#339
  • Fix builder-next: user namespace builds when daemon started with socket activation. docker/engine#373
  • Fix builder-next; session: release forwarded ssh socket connection per connection. docker/engine#373
  • Fix build-next: llbsolver: error on multiple cache importers. docker/engine#373

Client

  • Added support for Docker Template 0.1.6.
  • Mitigate against YAML files that have excessive aliasing. docker/cli#2119

Runtime

Known Issues

New

  • DOCKER-USER iptables chain is missing: docker/for-linux#810. Users cannot perform additional container network traffic filtering on top of this iptables chain. You are not affected by this issue if you are not customizing iptable chains on top of DOCKER-USER.

    • Workaround: Insert the iptables chain after the docker daemon starts. For example:

      iptables -N DOCKER-USER      iptables -I FORWARD -j DOCKER-USER iptables -A DOCKER-USER -j RETURN

Existing
  • In some circumstances with large clusters, docker information might, as part of the Swarm section, include the error code = ResourceExhausted desc = grpc: received message larger than   max (5351376 vs. 4194304). This does not indicate any failure or misconfiguration by the user, and requires no response.
  • Orchestrator port conflict can occur when redeploying all services as new. Due to many swarm manager requests in a short amount of time, some services are not able to receive traffic and are causing a 404 error after being deployed.
    • Workaround: restart all tasks via docker service update --force.
  • CVE-2018-15664 symlink-exchange attack with directory traversal. Workaround until proper fix is available in upcoming patch release: docker pause container before doing file operations. moby/moby#39252
  • docker cp regression due to CVE mitigation. An error is produced when the source of docker cp is set to /.
  • Install Mirantis Container Runtime fails to install on RHEL on Azure. This affects any RHEL version that uses an Extended Update Support (EUS) image. At the time of this writing, known versions affected are RHEL 7.4, 7.5, and 7.6.

19.03.2

2019-09-03

Builder

Client

  • Fix Windows absolute path detection on non-Windows docker/cli#1990
  • Fix to zsh completion script for docker login --username.
  • Fix context: produce consistent output on context create. docker/cli#1985
  • Fix support for HTTP proxy env variable. docker/cli#2059

Logging

Networking

  • Prevent panic on network attached to a container with disabled networking. moby/moby#39589

Runtime

  • Bump Golang to 1.12.8.
  • Fix a potential engine panic when using XFS disk quota for containers. moby/moby#39644

Swarm

Known issues

  • In some circumstances with large clusters, docker information might, as part of the Swarm section, include the error code = ResourceExhausted desc = grpc: received message larger than   max (5351376 vs. 4194304). This does not indicate any failure or misconfiguration by the user, and requires no response.
  • Orchestrator port conflict can occur when redeploying all services as new. Due to many swarm manager requests in a short amount of time, some services are not able to receive traffic and are causing a 404 error after being deployed.
    • Workaround: restart all tasks via docker service update --force.
  • Traffic cannot egress the HOST because of missing Iptables rules in the FORWARD chain The missing rules are : /sbin/iptables --wait -C FORWARD -o docker_gwbridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT /sbin/iptables --wait -C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    • Workaround: Add these rules back using a script and cron definitions. The script must contain ‘-C’ commands to check for the presence of a rule and ‘-A’ commands to add rules back. Run the script on a cron in regular intervals, for example, every minutes.
    • Affected versions: 17.06.2-ee-16, 18.09.1, 19.03.0
  • CVE-2018-15664 symlink-exchange attack with directory traversal. Workaround until proper fix is available in upcoming patch release: docker pause container before doing file operations. moby/moby#39252
  • docker cp regression due to CVE mitigation. An error is produced when the source of docker cp is set to /.
  • Install Mirantis Container Runtime fails to install on RHEL on Azure. This affects any RHEL version that uses an Extended Update Support (EUS) image. At the time of this writing, known versions affected are RHEL 7.4, 7.5, and 7.6.

19.03.1

2019-07-25

Security

  • Fixed loading of nsswitch based config inside chroot under Glibc. CVE-2019-14271

Known issues

  • In some circumstances, in large clusters, docker information might, as part of the Swarm section, include the error code = ResourceExhausted desc = grpc: received message larger than  max (5351376 vs. 4194304). This does not indicate any failure or misconfiguration by the user, and requires no response.
  • Orchestrator port conflict can occur when redeploying all services as new. Due to many swarm manager requests in a short amount of time, some services are not able to receive traffic and are causing a 404 error after being deployed.
    • Workaround: restart all tasks via docker service update --force.
  • Traffic cannot egress the HOST because of missing Iptables rules in the FORWARD chain The missing rules are : /sbin/iptables --wait -C FORWARD -o docker_gwbridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT /sbin/iptables --wait -C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    • Workaround: Add these rules back using a script and cron definitions. The script must contain ‘-C’ commands to check for the presence of a rule and ‘-A’ commands to add rules back. Run the script on a cron in regular intervals, for example, every minutes.
    • Affected versions: 17.06.2-ee-16, 18.09.1, 19.03.0
  • CVE-2018-15664 symlink-exchange attack with directory traversal. Workaround until proper fix is available in upcoming patch release: docker pause container before doing file operations. moby/moby#39252
  • docker cp regression due to CVE mitigation. An error is produced when the source of docker cp is set to /.
  • Install Mirantis Container Runtime fails to install on RHEL on Azure. This affects any RHEL version that uses an Extended Update Support (EUS) image. At the time of this writing, known versions affected are RHEL 7.4, 7.5, and 7.6.

19.03.0

2019-07-22

Builder

Client

API

Experimental

Security

Runtime

Networking

Swarm

Logging

Deprecation

  • Deprecate image manifest v2 schema1 in favor of v2 schema2. Future version of Docker will remove support for v2 schema1 althogether. moby/moby#39365
  • Removed v1.10 migrator. moby/moby#38265
  • Now skipping deprecated storage-drivers in auto-selection. moby/moby#38019
  • Deprecated aufs storage driver and added warning. moby/moby#38090
  • Removed support for 17.09.
  • SLES12 is deprecated from Docker Enterprise 3.0, and EOL of SLES12 as an operating system will occur in Docker Enterprise 3.1. Upgrade to SLES15 for continued support on Docker Enterprise.
  • Windows 2016 is formally deprecated from Docker Enterprise 3.0. Only non-overlay networks are supported on Windows 2016 in Docker Enterprise 3.0. EOL of Windows Server 2016 support will occur in Docker Enterprise 3.1. Upgrade to Windows Server 2019 for continued support on Docker Enterprise.

Known issues

  • In some circumstances with large clusters, docker information might, as part of the Swarm section, include the error code = ResourceExhausted desc = grpc: received message larger than max (5351376 vs. 4194304). This does not indicate any failure or misconfiguration by the user, and requires no response.
  • Orchestrator port conflict can occur when redeploying all services as new. Due to many swarm manager requests in a short amount of time, some services are not able to receive traffic and are causing a 404 error after being deployed.
    • Workaround: restart all tasks via docker service update --force.
  • Traffic cannot egress the HOST because of missing Iptables rules in the FORWARD chain The missing rules are : /sbin/iptables --wait -C FORWARD -o docker_gwbridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT /sbin/iptables --wait -C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    • Workaround: Add these rules back using a script and cron definitions. The script must contain ‘-C’ commands to check for the presence of a rule and ‘-A’ commands to add rules back. Run the script on a cron in regular intervals, for example, every minutes.
    • Affected versions: 17.06.2-ee-16, 18.09.1, 19.03.0
  • CVE-2018-15664 symlink-exchange attack with directory traversal. Workaround until proper fix is available in upcoming patch release: docker pause container before doing file operations. moby/moby#39252
  • docker cp regression due to CVE mitigation. An error is produced when the source of docker cp is set to /.
  • Install Mirantis Container Runtime fails to install on RHEL on Azure. This affects any RHEL version that uses an Extended Update Support (EUS) image. At the time of this writing, known versions affected are RHEL 7.4, 7.5, and 7.6.
updated: 2023-07-26 11:20