Docker Engine 19.03 Release Notes (19.03.10

If by chance the host has a vulnerability like last year’s RCE in apt (CVE-2019-3462), the attacker can now escalate to the host. As `CAP_NET_ADMIN` is not present by default for Docker containers, the attacker can’t configure the IPs they want to MitM, they can’t use iptables to NAT or REDIRECT the traffic, and they can’t use `IP_TRANSPARENT`. The attacker can however still use `CAP_NET_RAW` and implement a tcp/ip stack in user space. See [kubernetes/kubernetes#91507](https://github.com/kubernetes/kubernetes/issues/91507) for related issues. ## 19.03.10 2020-05-29 ### Client - Fix version negotiation with older engine. [docker/cli#2538](https://github.com/docker/cli/pull/2538) - Avoid setting SSH flags through hostname. [docker/cli#2560](https://github.com/docker/cli/pull/2560) - Fix panic when DOCKER_CLI_EXPERIMENTAL is invalid. [docker/cli#2558](https://github.com/docker/cli/pull/2558) - Avoid potential panic on s390x by upgrading Go to 1.13.11. [docker/cli#2532](https://github.com/docker/cli/pull/2532) ### Networking - Fix DNS fallback regression. [moby/moby#41009](https://github.com/moby/moby/pull/41009) ### Runtime - Avoid potential panic on s390x by upgrading Go to 1.13.11. [moby/moby#40978](https://github.com/moby/moby/pull/40978) ### Packaging - Fix ARM builds on ARM64. [moby/moby#41027](https://github.com/moby/moby/pull/41027) ## 19.03.9 2020-05-14 ### Builder - buildkit: Fix concurrent map write panic when building multiple images in parallel. [moby/moby#40780](https://github.com/moby/moby/pull/40780) - buildkit: Fix issue preventing chowning of non-root-owned files between stages with userns. [moby/moby#40955](https://github.com/moby/moby/pull/40955) - Avoid creation of irrelevant temporary files on Windows. [moby/moby#40877](https://github.com/moby/moby/pull/40877) ### Client - Fix panic on single-character volumes. [docker/cli#2471](https://github.com/docker/cli/pull/2471) - Lazy daemon feature detection to avoid long timeouts on simple commands. [docker/cli#2442](https://github.com/docker/cli/pull/2442) - docker context inspect on Windows is now faster. [docker/cli#2516](https://github.com/docker/cli/pull/2516) - Bump Golang 1.13.10. [docker/cli#2431](https://github.com/docker/cli/pull/2431) - Bump gopkg.in/yaml.v2 to v2.2.8. [docker/cli#2470](https://github.com/docker/cli/pull/2470) ### Logging - Avoid situation preventing container logs to rotate due to closing a closed log file. [moby/moby#40921](https://github.com/moby/moby/pull/40921) ### Networking - Fix potential panic upon restart. [moby/moby#40809](https://github.com/moby/moby/pull/40809) - Assign the correct network value to the default bridge Subnet field. [moby/moby#40565](https://github.com/moby/moby/pull/40565) ### Runtime - Fix docker crash when creating namespaces with UID in /etc/subuid and /etc/subgid. [moby/moby#40562](https://github.com/moby/moby/pull/40562) - Improve ARM platform matching. [moby/moby#40758](https://github.com/moby/moby/pull/40758) - overlay2: show backing filesystem. [moby/moby#40652](https://github.com/moby/moby/pull/40652) - Update CRIU to v3.13 "Silicon Willet". [moby/moby#40850](https://github.com/moby/moby/pull/40850) - Only show registry v2 schema1 deprecation warning upon successful fallback, as opposed to any registry error. [moby/moby#40681](https://github.com/moby/moby/pull/40681) - Use FILE_SHARE_DELETE for log files on Windows. [moby/moby#40563](https://github.com/moby/moby/pull/40563) - Bump Golang 1.13.10. [moby/moby#40803](https://github.com/moby/moby/pull/40803) ### Rootless - Now rootlesskit-docker-proxy returns detailed error message on exposing privileged ports. [moby/moby#40863](https://github.com/moby/moby/pull/40863) - Supports numeric ID in /etc/subuid and /etc/subgid. [moby/moby#40951](https://github.com/moby/moby/pull/40951) ### Security - apparmor: add missing rules for userns. [moby/moby#40564](https://github.com/moby/moby/pull/40564) - SElinux: fix ENOTSUP errors not being detected when relabeling. [moby/moby#40946](https://github.com/moby/moby/pull/40946)

This document summarizes release notes for Docker Engine versions 19.03.10 and 19.03.9. It includes security considerations regarding potential host escalation via IPv6 traffic redirection and mitigation through capabilities management. It also details fixes and improvements across various components, including the client, networking, runtime, packaging, builder, logging, rootless mode, and security (AppArmor and SELinux). Fixes range from addressing panics, improving performance, resolving file handling issues, and updating dependencies such as Go and CRIU.