Docker Engine Releases: 20.10.3, 20.10.2, 20.10.1 and 20.10.0 - Security Fixes, Bug Fixes, and Deprecations

* Prevent the service hanging when stopping by setting systemd KillMode to mixed [moby/moby#41956](https://github.com/moby/moby/pull/41956) * dockerd-rootless.sh: add typo guard [moby/moby#42070](https://github.com/moby/moby/pull/42070) * Update rootlesskit to v0.13.1 to fix handling of IPv6 addresses [moby/moby#42025](https://github.com/moby/moby/pull/42025) * allow mknodding FIFO inside userns [moby/moby#41957](https://github.com/moby/moby/pull/41957) ### Security * profiles: seccomp: update to Linux 5.11 syscall list [moby/moby#41971](https://github.com/moby/moby/pull/41971) ### Swarm * Fix issue with heartbeat not persisting upon restart [moby/moby#42060](https://github.com/moby/moby/pull/42060) * Fix potential stalled tasks [moby/moby#42060](https://github.com/moby/moby/pull/42060) * Fix `--update-order` and `--rollback-order` flags when only `--update-order` or `--rollback-order` is provided [docker/cli#2963](https://github.com/docker/cli/pull/2963) * Fix `docker service rollback` returning a non-zero exit code in some situations [docker/cli#2964](https://github.com/docker/cli/pull/2964) * Fix inconsistent progress-bar direction on `docker service rollback` [docker/cli#2964](https://github.com/docker/cli/pull/2964) ## 20.10.3 2021-02-01 ### Security * [CVE-2021-21285](https://github.com/moby/moby/security/advisories/GHSA-6fj5-m822-rqx8) Prevent an invalid image from crashing docker daemon * [CVE-2021-21284](https://github.com/moby/moby/security/advisories/GHSA-7452-xqpj-6rpc) Lock down file permissions to prevent remapped root from accessing docker state * Ensure AppArmor and SELinux profiles are applied when building with BuildKit ### Client * Check contexts before importing them to reduce risk of extracted files escaping context store * Windows: prevent executing certain binaries from current directory [docker/cli#2950](https://github.com/docker/cli/pull/2950) ## 20.10.2 2021-01-04 ### Runtime - Fix a daemon start up hang when restoring containers with restart policies but that keep failing to start [moby/moby#41729](https://github.com/moby/moby/pull/41729) - overlay2: fix an off-by-one error preventing to build or run containers when data-root is 24-bytes long [moby/moby#41830](https://github.com/moby/moby/pull/41830) - systemd: send `sd_notify STOPPING=1` when shutting down [moby/moby#41832](https://github.com/moby/moby/pull/41832) ### Networking - Fix IPv6 port forwarding [moby/moby#41805](https://github.com/moby/moby/pull/41805) [moby/libnetwork#2604](https://github.com/moby/libnetwork/pull/2604) ### Swarm - Fix filtering for `replicated-job` and `global-job` service modes [moby/moby#41806](https://github.com/moby/moby/pull/41806) ### Packaging - buildx updated to [v0.5.1](https://github.com/docker/buildx/releases/tag/v0.5.1) [docker/docker-ce-packaging#516](https://github.com/docker/docker-ce-packaging/pull/516) ## 20.10.1 2020-12-14 ### Builder - buildkit: updated to [v0.8.1](https://github.com/moby/buildkit/releases/tag/v0.8.1) with various bugfixes [moby/moby#41793](https://github.com/moby/moby/pull/41793) ### Packaging - Revert a change in the systemd unit that could prevent docker from starting due to a startup order conflict [docker/docker-ce-packaging#514](https://github.com/docker/docker-ce-packaging/pull/514) - buildx updated to [v0.5.0](https://github.com/docker/buildx/releases/tag/v0.5.0) [docker/docker-ce-packaging#515](https://github.com/docker/docker-ce-packaging/pull/515) ## 20.10.0 2020-12-08 ### Deprecation / Removal For an overview of all deprecated features, refer to the [Deprecated Engine Features](/engine/deprecated/) page. - Warnings and deprecation notice when `docker pull`-ing from non-compliant registries not supporting pull-by-digest [docker/cli#2872](https://github.com/docker/cli/pull/2872) - Sterner warnings and deprecation notice for unauthenticated tcp access [moby/moby#41285](https://github.com/moby/moby/pull/41285) - Deprecate KernelMemory (`docker run --kernel-memory`) [moby/moby#41254](https://github.com/moby/moby/pull/41254) [docker/cli#2652](https://github.com/docker/cli/pull/2652)

This section provides a summary of Docker Engine releases from 20.10.3 down to 20.10.0. Version 20.10.4 includes fixes for Rootless mode, Security (seccomp profiles), and Swarm (heartbeat persistence, stalled tasks, and update/rollback order flags). 20.10.3 contains security fixes for CVE-2021-21285 and CVE-2021-21284 and enhancements to AppArmor and SELinux. 20.10.2 focuses on runtime (daemon startup hang, overlay2 issues, systemd notifications), networking (IPv6 port forwarding), and swarm (service mode filtering). Version 20.10.1 includes updates to BuildKit and reverts a systemd unit change, along with Buildx update. Version 20.10.0 highlights deprecation and removal of features, including warnings for non-compliant registries and unauthenticated TCP access, as well as deprecation of KernelMemory.