Docker Engine Release Notes (19.03.6

- builder-next: Allow modern sign hashes for ssh forwarding. [docker/engine#453](https://github.com/docker/engine/pull/453) - builder-next: Clear onbuild rules after triggering. [docker/engine#453](https://github.com/docker/engine/pull/453) - builder-next: Fix issue with directory permissions when usernamespaces is enabled. [moby/moby#40440](https://github.com/moby/moby/pull/40440) - Bump hcsshim to fix docker build failing on Windows 1903. [docker/engine#429](https://github.com/docker/engine/pull/429) ### Networking - Shorten controller ID in exec-root to not hit UNIX_PATH_MAX. [docker/engine#424](https://github.com/docker/engine/pull/424) - Fix panic in drivers/overlay/encryption.go. [docker/engine#424](https://github.com/docker/engine/pull/424) - Fix hwaddr set race between us and udev. [docker/engine#439](https://github.com/docker/engine/pull/439) ### Runtime * Bump Golang 1.12.16. [moby/moby#40433](https://github.com/moby/moby/pull/40433) * Update containerd binary to v1.2.12. [moby/moby#40433](https://github.com/moby/moby/pull/40453) * Update to runc v1.0.0-rc10. [moby/moby#40433](https://github.com/moby/moby/pull/40453) - Fix possible runtime panic in Lgetxattr. [docker/engine#454](https://github.com/docker/engine/pull/454) - rootless: fix proxying UDP packets. [docker/engine#434](https://github.com/docker/engine/pull/434) ## 19.03.5 2019-11-14 ### Builder * builder-next: Added `entitlements` in builder config. [docker/engine#412](https://github.com/docker/engine/pull/412) * Fix builder-next: permission errors on using build secrets or ssh forwarding with userns-remap. [docker/engine#420](https://github.com/docker/engine/pull/420) * Fix builder-next: copying a symlink inside an already copied directory. [docker/engine#420](https://github.com/docker/engine/pull/420) ### Packaging * Support RHEL 8 packages ### Runtime * Bump Golang to 1.12.12. [docker/engine#418](https://github.com/docker/engine/pull/418) * Update to RootlessKit to v0.7.0 to harden slirp4netns with mount namespace and seccomp. [docker/engine#397](https://github.com/docker/engine/pull/397) * Fix to propagate GetContainer error from event processor. [docker/engine#407](https://github.com/docker/engine/pull/407) * Fix push of OCI image. [docker/engine#405](https://github.com/docker/engine/pull/405) ## 19.03.4 2019-10-17 ### Networking * Rollback libnetwork changes to fix `DOCKER-USER` iptables chain issue. [docker/engine#404](https://github.com/docker/engine/pull/404) ### Known Issues #### Existing * In some circumstances with large clusters, Docker information might, as part of the Swarm section, include the error `code = ResourceExhausted desc = grpc: received message larger than max (5351376 vs. 4194304)`. This does not indicate any failure or misconfiguration by the user, and requires no response. * Orchestrator port conflict can occur when redeploying all services as new. Due to many Swarm manager requests in a short amount of time, some services are not able to receive traffic and are causing a `404` error after being deployed. - **Workaround:** restart all tasks via `docker service update --force`. * [CVE-2018-15664](https://nvd.nist.gov/vuln/detail/CVE-2018-15664) symlink-exchange attack with directory traversal. Workaround until proper fix is available in upcoming patch release: `docker pause` container before doing file operations. [moby/moby#39252](https://github.com/moby/moby/pull/39252) * `docker cp` regression due to CVE mitigation. An error is produced when the source of `docker cp` is set to `/`. ## 19.03.3 2019-10-08 ### Security * Patched `runc` in containerd. [CVE-2017-18367](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18367) ### Builder * Fix builder-next: resolve digest for third party registries. [docker/engine#339](https://github.com/docker/engine/pull/339) * Fix builder-next: user namespace builds when daemon started with socket activation. [docker/engine#373](https://github.com/docker/engine/pull/373)

These release notes cover Docker Engine versions 19.03.6 through 19.03.3, detailing fixes and enhancements. Builder updates involve allowing modern sign hashes, clearing ONBUILD rules, fixing directory permission issues with usernamespaces, and resolving build failures on Windows 1903. Networking improvements include shortening controller IDs, fixing panics in overlay encryption, and resolving hardware address races. Runtime updates include bumping Golang and containerd versions, updating to runc v1.0.0-rc10, and fixing potential panics and UDP packet proxying in rootless mode. Packaging now supports RHEL 8. Security updates address CVE-2017-18367 with a patched `runc` in containerd. Known issues and workarounds for Docker information display, orchestrator port conflicts, symlink-exchange attacks (CVE-2018-15664), and `docker cp` regressions are also mentioned.