Docker Engine 17.04.0-ce: Further Runtime and Swarm Mode Updates, Windows Support

- Do not allow sub second in healthcheck options in Dockerfile [#31177](https://github.com/docker/docker/pull/31177) * Support name and id prefix in `secret update` [#30856](https://github.com/docker/docker/pull/30856) * Use binary frame for websocket attach endpoint [#30460](https://github.com/docker/docker/pull/30460) * Fix linux mount calls not applying propagation type changes [#30416](https://github.com/docker/docker/pull/30416) * Fix ExecIds leak on failed `exec -i` [#30340](https://github.com/docker/docker/pull/30340) * Prune named but untagged images if `danglingOnly=true` [#30330](https://github.com/docker/docker/pull/30330) + Add daemon flag to set `no_new_priv` as default for unprivileged containers [#29984](https://github.com/docker/docker/pull/29984) + Add daemon option `--default-shm-size` [#29692](https://github.com/docker/docker/pull/29692) + Support registry mirror config reload [#29650](https://github.com/docker/docker/pull/29650) - Ignore the daemon log config when building images [#29552](https://github.com/docker/docker/pull/29552) * Move secret name or ID prefix resolving from client to daemon [#29218](https://github.com/docker/docker/pull/29218) + Allow adding rules to `cgroup devices.allow` on container create/run [#22563](https://github.com/docker/docker/pull/22563) - Fix `cpu.cfs_quota_us` being reset when running `systemd daemon-reload` [#31736](https://github.com/docker/docker/pull/31736) ### Swarm Mode + Topology-aware scheduling [#30725](https://github.com/docker/docker/pull/30725) + Automatic service rollback on failure [#31108](https://github.com/docker/docker/pull/31108) + Worker and manager on the same node are now connected through a UNIX socket [docker/swarmkit#1828](https://github.com/docker/swarmkit/pull/1828), [docker/swarmkit#1850](https://github.com/docker/swarmkit/pull/1850), [docker/swarmkit#1851](https://github.com/docker/swarmkit/pull/1851) * Improve raft transport package [docker/swarmkit#1748](https://github.com/docker/swarmkit/pull/1748) * No automatic manager shutdown on demotion/removal [docker/swarmkit#1829](https://github.com/docker/swarmkit/pull/1829) * Use TransferLeadership to make leader demotion safer [docker/swarmkit#1939](https://github.com/docker/swarmkit/pull/1939) * Decrease default monitoring period [docker/swarmkit#1967](https://github.com/docker/swarmkit/pull/1967) + Add Service logs formatting [#31672](https://github.com/docker/docker/pull/31672) * Fix service logs API to be able to specify stream [#31313](https://github.com/docker/docker/pull/31313) + Add `--stop-signal` for `service create` and `service update` [#30754](https://github.com/docker/docker/pull/30754) + Add `--read-only` for `service create` and `service update` [#30162](https://github.com/docker/docker/pull/30162) + Renew the context after communicating with the registry [#31586](https://github.com/docker/docker/pull/31586) + (experimental) Add `--tail` and `--since` options to `docker service logs` [#31500](https://github.com/docker/docker/pull/31500) + (experimental) Add `--no-task-ids` and `--no-trunc` options to `docker service logs` [#31672](https://github.com/docker/docker/pull/31672) ### Windows * Block pulling Windows images on non-Windows daemons [#29001](https://github.com/docker/docker/pull/29001)

This section covers additional runtime updates, swarm mode improvements, and changes for Windows support in Docker Engine 17.04.0-ce. Runtime updates include fixes for healthchecks, improvements to `secret update`, and new daemon options for security and resource management. Swarm mode features topology-aware scheduling, automatic service rollback, and enhanced manager functionality. Windows support now blocks pulling Windows images on non-Windows daemons.