Docker Engine Release Notes: 20.10.4 and 20.10.5

* Fix a regression in docker 20.10, causing the docker-proxy to not be terminated in all cases [moby/moby#42205](https://github.com/moby/moby/pull/42205) * Fix iptables forwarding rules not being cleaned up upon container removal [moby/moby#42205](https://github.com/moby/moby/pull/42205) ### Packaging * Update containerd to [v1.4.4](https://github.com/containerd/containerd/releases/tag/v1.4.4) for static binaries. The containerd.io package on apt/yum repos already had this update out of band. Includes a fix for [CVE-2021-21334](https://github.com/containerd/containerd/security/advisories/GHSA-6g2q-w5j3-fwh4). [moby/moby#42124](https://github.com/moby/moby/pull/42124) * Packages for Debian/Raspbian 11 Bullseye, Ubuntu 21.04 Hirsute Hippo and Fedora 34 [docker/docker-ce-packaging#521](https://github.com/docker/docker-ce-packaging/pull/521) [docker/docker-ce-packaging#522](https://github.com/docker/docker-ce-packaging/pull/522) [docker/docker-ce-packaging#533](https://github.com/docker/docker-ce-packaging/pull/533) * Provide the [Docker Scan CLI](https://github.com/docker/scan-cli-plugin) plugin on Linux amd64 via a `docker-scan-plugin` package as a recommended dependency for the `docker-ce-cli` package [docker/docker-ce-packaging#537](https://github.com/docker/docker-ce-packaging/pull/537) * Include VPNKit binary for arm64 [moby/moby#42141](https://github.com/moby/moby/pull/42141) ### Plugins * Fix docker plugin create making plugins that were incompatible with older versions of Docker [moby/moby#42256](https://github.com/moby/moby/pull/42256) ### Rootless * Update RootlessKit to [v0.14.1](https://github.com/rootless-containers/rootlesskit/releases/tag/v0.14.1) (see also [v0.14.0](https://github.com/rootless-containers/rootlesskit/releases/tag/v0.14.0) [v0.13.2](https://github.com/rootless-containers/rootlesskit/releases/tag/v0.13.2)) [moby/moby#42186](https://github.com/moby/moby/pull/42186) [moby/moby#42232](https://github.com/moby/moby/pull/42232) * dockerd-rootless-setuptool.sh: create CLI context "rootless" [moby/moby#42109](https://github.com/moby/moby/pull/42109) * dockerd-rootless.sh: prohibit running as root [moby/moby#42072](https://github.com/moby/moby/pull/42072) * Fix "operation not permitted" when bind mounting existing mounts [moby/moby#42233](https://github.com/moby/moby/pull/42233) * overlay2: fix "createDirWithOverlayOpaque(...) ... input/output error" [moby/moby#42235](https://github.com/moby/moby/pull/42235) * overlay2: support "userxattr" option (kernel 5.11) [moby/moby#42168](https://github.com/moby/moby/pull/42168) * btrfs: allow unprivileged user to delete subvolumes (kernel >= 4.18) [moby/moby#42253](https://github.com/moby/moby/pull/42253) * cgroup2: Move cgroup v2 out of experimental [moby/moby#42263](https://github.com/moby/moby/pull/42263) ## 20.10.5 2021-03-02 ### Client * Revert [docker/cli#2960](https://github.com/docker/cli/pull/2960) to fix hanging in `docker start --attach` and remove spurious `Unsupported signal: <nil>. Discarding` messages. [docker/cli#2987](https://github.com/docker/cli/pull/2987). ## 20.10.4 2021-02-26 ### Builder * Fix incorrect cache match for inline cache import with empty layers [moby/moby#42061](https://github.com/moby/moby/pull/42061) * Update BuildKit to v0.8.2 [moby/moby#42061](https://github.com/moby/moby/pull/42061) * resolver: avoid error caching on token fetch * fileop: fix checksum to contain indexes of inputs preventing certain cache misses * Fix reference count issues on typed errors with mount references (fixing `invalid mutable ref` errors) * git: set token only for main remote access allowing cloning submodules with different credentials * Ensure blobs get deleted in /var/lib/docker/buildkit/content/blobs/sha256 after pull. To clean up old state run `builder prune` [moby/moby#42065](https://github.com/moby/moby/pull/42065) * Fix parallel pull synchronization regression [moby/moby#42049](https://github.com/moby/moby/pull/42049) * Ensure libnetwork state files do not leak [moby/moby#41972](https://github.com/moby/moby/pull/41972)

Docker Engine releases 20.10.4 and 20.10.5 include bug fixes and feature updates. Version 20.10.6 resolves issues with docker-proxy termination and iptables cleanup, updates containerd to v1.4.4 for CVE-2021-21334, provides packages for new Linux distributions, includes Docker Scan CLI plugin and VPNKit for arm64, and fixes plugin creation compatibility. It also updates RootlessKit, improves rootless setup, and addresses overlay2 and btrfs issues, along with moving cgroup v2 out of experimental. Version 20.10.5 reverts a change in docker/cli to fix hanging in `docker start --attach`. Version 20.10.4 focuses on builder improvements, including cache matching, BuildKit update to v0.8.2, blob deletion cleanup, parallel pull synchronization fix, and preventing libnetwork state leaks.