Docker Engine 19.03.0: API, Experimental, Security, Runtime, and Networking Updates

* Added `containerd`, `runc`, and `docker-init` versions to `/version`. [moby/moby#37974](https://github.com/moby/moby/pull/37974) * Added undocumented `/grpc` endpoint and registered BuildKit's controller. [moby/moby#38990](https://github.com/moby/moby/pull/38990) ### Experimental * Enabled checkpoint/restore of containers with TTY. [moby/moby#38405](https://github.com/moby/moby/pull/38405) * LCOW: Added support for memory and CPU limits. [moby/moby#37296](https://github.com/moby/moby/pull/37296) * Windows: Added ContainerD runtime. [moby/moby#38541](https://github.com/moby/moby/pull/38541) * Windows: LCOW now requires Windows RS5+. [moby/moby#39108](https://github.com/moby/moby/pull/39108) ### Security * mount: added BindOptions.NonRecursive (API v1.40). [moby/moby#38003](https://github.com/moby/moby/pull/38003) * seccomp: whitelisted `io_pgetevents()`. [moby/moby#38895](https://github.com/moby/moby/pull/38895) * seccomp: `ptrace(2)` for 4.8+ kernels now allowed. [moby/moby#38137](https://github.com/moby/moby/pull/38137) ### Runtime * Running `dockerd` as a non-root user (Rootless mode) is now allowed. [moby/moby#380050](https://github.com/moby/moby/pull/38050) * Rootless: optional support provided for `lxc-user-nic` SUID binary. [docker/engine#208](https://github.com/docker/engine/pull/208) * Added DeviceRequests to HostConfig to support NVIDIA GPUs. [moby/moby#38828](https://github.com/moby/moby/pull/38828) * Added `--device` support for Windows. [moby/moby#37638](https://github.com/moby/moby/pull/37638) * Added `memory.kernelTCP` support for linux. [moby/moby#37043](https://github.com/moby/moby/pull/37043) * Windows credential specs can now be passed directly to the engine. [moby/moby#38777](https://github.com/moby/moby/pull/38777) * Added pids-limit support in docker update. [moby/moby#32519](https://github.com/moby/moby/pull/32519) * Added support for exact list of capabilities. [moby/moby#38380](https://github.com/moby/moby/pull/38380) * daemon: Now use 'private' ipc mode by default. [moby/moby#35621](https://github.com/moby/moby/pull/35621) * daemon: switched to semaphore-gated WaitGroup for startup tasks. [moby/moby#38301](https://github.com/moby/moby/pull/38301) * Now use `idtools.LookupGroup` instead of parsing `/etc/group` file for docker.sock ownership to fix: `api.go doesn't respect nsswitch.conf`. [moby/moby#38126](https://github.com/moby/moby/pull/38126) * cli: fixed images filter when using multi reference filter. [moby/moby#38171](https://github.com/moby/moby/pull/38171) * Bumped Golang to 1.12.5. [docker/engine#209](https://github.com/docker/engine/pull/209) * Bumped `containerd` to 1.2.6. [moby/moby#39016](https://github.com/moby/moby/pull/39016) * Bumped `runc` to 1.0.0-rc8, opencontainers/selinux v1.2.2. [docker/engine#210](https://github.com/docker/engine/pull/210) * Bumped `google.golang.org/grpc` to v1.20.1. [docker/engine#215](https://github.com/docker/engine/pull/215) * Performance optimized in aufs and layer store for massively parallel container creation/removal. [moby/moby#39135](https://github.com/moby/moby/pull/39135) [moby/moby#39209](https://github.com/moby/moby/pull/39209) * Root is now passed to chroot for chroot Tar/Untar (CVE-2018-15664) [moby/moby#39292](https://github.com/moby/moby/pull/39292) * Fixed `docker --init` with /dev bind mount. [moby/moby#37665](https://github.com/moby/moby/pull/37665) * The right device number is now fetched when greater than 255 and using the `--device-read-bps` option. [moby/moby#39212](https://github.com/moby/moby/pull/39212) * Fixed `Path does not exist` error when path definitely exists. [moby/moby#39251](https://github.com/moby/moby/pull/39251) ### Networking * Moved IPVLAN driver out of experimental. [moby/moby#38983](https://github.com/moby/moby/pull/38983) * Added support for 'dangling' filter. [moby/moby#31551](https://github.com/moby/moby/pull/31551) [docker/libnetwork#2230](https://github.com/docker/libnetwork/pull/2230) * Load balancer sandbox is now deleted when a service is updated with `--network-rm`.

Docker Engine 19.03.0 introduces updates to the API, experimental features, security measures, runtime functionalities, and networking capabilities. The API now includes `containerd`, `runc`, and `docker-init` versions in `/version` and an undocumented `/grpc` endpoint. Experimental features include checkpoint/restore of containers with TTY, LCOW memory/CPU limits, and Windows ContainerD runtime. Security updates involve mount options and seccomp whitelisting. Runtime improvements include rootless mode, DeviceRequests for NVIDIA GPUs, Windows `--device` support, and pids-limit in docker update. Networking includes moving IPVLAN out of experimental and adding support for the 'dangling' filter.