Docker Engine 18.09 Release Notes (cont.)

* Fixed nil pointer dereference on failure to connect to containerd. [docker/engine#162](https://github.com/docker/engine/pull/162) * Deleted stale containerd object on start failure. [docker/engine#154](https://github.com/docker/engine/pull/154) ### Known Issues * There are important changes to the upgrade process that, if not correctly followed, can have impact on the availability of applications running on the Swarm during upgrades. These constraints impact any upgrades coming from any version before 18.09 to version 18.09 or greater. ## 18.09.2 2019-02-11 ### Security fixes * Update `runc` to address a critical vulnerability that allows specially-crafted containers to gain administrative privileges on the host. [CVE-2019-5736](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5736) * Ubuntu 14.04 customers using a 3.13 kernel will need to upgrade to a supported Ubuntu 4.x kernel For additional information, [refer to the Docker blog post](https://blog.docker.com/2019/02/docker-security-update-cve-2018-5736-and-container-security-best-practices/). ### Known Issues * There are important changes to the upgrade process that, if not correctly followed, can have impact on the availability of applications running on the Swarm during upgrades. These constraints impact any upgrades coming from any version before 18.09 to version 18.09 or greater. ## 18.09.1 2019-01-09 #### Important notes about this release In Docker versions prior to 18.09, containerd was managed by the Docker engine daemon. In Docker Engine 18.09, containerd is managed by systemd. Since containerd is managed by systemd, any custom configuration to the `docker.service` systemd configuration which changes mount settings (for example, `MountFlags=slave`) breaks interactions between the Docker Engine daemon and containerd, and you will not be able to start containers. Run the following command to get the current value of the `MountFlags` property for the `docker.service`: ```console $ sudo systemctl show --property=MountFlags docker.service MountFlags= ``` Update your configuration if this command prints a non-empty value for `MountFlags`, and restart the docker service. ### Security fixes * Upgraded Go language to 1.10.6 to resolve [CVE-2018-16873](https://nvd.nist.gov/vuln/detail/CVE-2018-16873), [CVE-2018-16874](https://nvd.nist.gov/vuln/detail/CVE-2018-16874), and [CVE-2018-16875](https://nvd.nist.gov/vuln/detail/CVE-2018-16875). * Fixed authz plugin for 0-length content and path validation. * Added `/proc/asound` to masked paths [docker/engine#126](https://github.com/docker/engine/pull/126) ### Improvements * Updated to BuildKit 0.3.3 [docker/engine#122](https://github.com/docker/engine/pull/122) * Updated to containerd 1.2.2 [docker/engine#144](https://github.com/docker/engine/pull/144) * Provided additional warnings for use of deprecated legacy overlay and devicemapper storage drivers [docker/engine#85](https://github.com/docker/engine/pull/85) * prune: perform image pruning before build cache pruning [docker/cli#1532](https://github.com/docker/cli/pull/1532) * Added bash completion for experimental CLI commands (manifest) [docker/cli#1542](https://github.com/docker/cli/pull/1542) * Windows: allow process isolation on Windows 10 [docker/engine#81](https://github.com/docker/engine/pull/81) ### Fixes * Disable kmem accounting in runc on RHEL/CentOS (docker/escalation#614, docker/escalation#692) [docker/engine#121](https://github.com/docker/engine/pull/121) * Fixed inefficient networking configuration [docker/engine#123](https://github.com/docker/engine/pull/123) * Fixed docker system prune doesn't accept until filter [docker/engine#122](https://github.com/docker/engine/pull/122) * Avoid unset credentials in `containerd` [docker/engine#122](https://github.com/docker/engine/pull/122) * Fixed iptables compatibility on Debian [docker/engine#107](https://github.com/docker/engine/pull/107) * Fixed setting default schema to tcp for docker host [docker/cli#1454](https://github.com/docker/cli/pull/1454)

The document continues release notes for Docker Engine, covering versions 18.09.2 and 18.09.1. Version 18.09.2 includes security fixes, notably an update to `runc` to address CVE-2019-5736. Version 18.09.1 highlights important notes about containerd management, urging users to check and update their systemd configuration. It also includes security fixes by upgrading the Go language to resolve CVE-2018-16873, CVE-2018-16874, and CVE-2018-16875. Additionally, it details improvements like BuildKit and containerd updates, and fixes for issues such as networking configuration, system prune, and iptables compatibility. Both versions mention potential upgrade issues for Swarm mode.