docker.io-app (29.1.3-0ubuntu4.1) resolute-security; urgency=medium

  * SECURITY UPDATE: BuildKit path traversal
    - debian/patches/CVE-2026-33747_1.patch: Validate container IDs centrally
      in engine/vendor/.../buildkit/executor/containerdexecutor/executor.go,
      engine/vendor/.../buildkit/executor/containerid.go,
      engine/vendor/.../buildkit/executor/runcexecutor/executor.go.
    - debian/patches/CVE-2026-33747_2.patch: Sanitize downloaded filenames in
      engine/vendor/.../buildkit/source/http/source.go.
    - debian/patches/CVE-2026-33747_3.patch: Use os.Root for saved file
      operations in engine/vendor/.../buildkit/source/http/source.go.
    - CVE-2026-33747
  * SECURITY UPDATE: BuildKit path traversal
    - debian/patches/CVE-2026-33748_1.patch: Harden ref arg handling in
      engine/vendor/.../buildkit/source/git/source.go.
    - debian/patches/CVE-2026-33748_2.patch: Normalize and validate subdir
      paths in engine/vendor/.../buildkit/client/llb/source.go,
      engine/vendor/.../buildkit/source/git/identifier.go,
      engine/vendor/.../buildkit/source/git/source.go,
      engine/vendor/.../buildkit/util/gitutil/git_url.go.
    - CVE-2026-33748

 -- Edwin Jiang <edwin.jiang@canonical.com>  Wed, 29 Apr 2026 12:40:20 -0400

docker.io-app (29.1.3-0ubuntu4) resolute; urgency=medium

  * d/docker.io.install: install dockerd-rootless* (LP: #2121905)
  * d/control: suggest rootlesskit,needed by the dockerd-rootless* scripts
  * d/NEWS: document rootless mode scripts

 -- Athos Ribeiro <athos@ubuntu.com>  Tue, 31 Mar 2026 10:54:03 -0300

docker.io-app (29.1.3-0ubuntu3) resolute; urgency=medium

  * d/t/docker-in-lxd:
    - Clean up LXD storage
    - Adjust volume path for containerd storage

 -- Athos Ribeiro <athos@ubuntu.com>  Thu, 05 Mar 2026 14:37:51 -0300

docker.io-app (29.1.3-0ubuntu2) resolute; urgency=medium

  * d/p/loosen-tini-cmake-req.patch: loosen minimum cmake
    compatible version to fix FTBFS issue with cmake 4
  * d/t/docker-in-lxd: drop workaround for cloud-init bug (LP #2131809)

 -- Athos Ribeiro <athos@ubuntu.com>  Tue, 03 Mar 2026 14:20:49 -0300

docker.io-app (29.1.3-0ubuntu1) resolute; urgency=medium

  * New upstream version 29.1.3
  * d/manpages/*: update manpages for version 29.1.3
  * d/docker.io.docs: update NOTICE files

 -- Athos Ribeiro <athos@ubuntu.com>  Tue, 06 Jan 2026 14:14:59 -0300

docker.io-app (29.1.2-0ubuntu1) resolute; urgency=medium

  * New upstream version 29.1.2
  * d/watch: accept new upstream tarball format
  * d/h/tini-upstream-version.sh: accept new upstream URL format
  * d/get-orig-source.sh: accept new upstream paths
  * d/manpages/*: update manpages for version 29.1.2
  * d/extra/vendor: vendorize docker-trust dependencies
  * d/copyright: update copyright data
  * d/control: B-D on libnftables-dev
  * d/s/include-binaries: allow vendorized code binary files
  * d/docker.io.docs: update NOTICE files
  * d/docker.io.install: install new docker-trust plugin
  * d/docker.io.lintian-overrides: remove obsolete lintian overrides
  * d/s/lintian-overrides: suppress non-relevant lintian warnings
  * d/rules:
    - Use moby/moby namespace
    - Build docker-trust plugin
  * d/t/docker-in-lxd: workaround cloud-init bug (LP: #2131809)

 -- Athos Ribeiro <athos@ubuntu.com>  Fri, 12 Dec 2025 10:35:58 -0300

docker.io-app (28.2.2-0ubuntu1) questing; urgency=medium

  * New upstream version 28.2.2
  * d/h/build-manpages.sh: adjust manpage build script to upstream changes
  * d/manpages/*: update manpages for version 28.2.2
  * d/docker.io.docs: update NOTICE files
  * d/copyright: update copyright data

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Tue, 17 Jun 2025 14:51:15 -0300

docker.io-app (27.5.1-0ubuntu4) questing; urgency=medium

  * d/control: conflicts/replaces podman-docker (LP: #2037905)

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Tue, 03 Jun 2025 13:35:31 -0300

docker.io-app (27.5.1-0ubuntu3) plucky; urgency=medium

  * d/control: set a version for the docker-cli Provides

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Tue, 25 Feb 2025 08:04:14 -0300

docker.io-app (27.5.1-0ubuntu2) plucky; urgency=medium

  * d/control: provides docker-cli (LP: #2099941)

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Mon, 24 Feb 2025 17:53:24 -0300

docker.io-app (27.5.1-0ubuntu1) plucky; urgency=medium

  * New upstream version 27.5.1 (LP: #2085187)
  * d/control: build with golang 1.24 (LP: #2098661)
  * d/rules: add golang 1.24 to PATH
  * d/patches: drop patches for CVE-2024-41110. Fixed upstream
  * d/helpers/build-manpages.sh: build manpages with Go 1.24
  * d/manpages/*: update manpages for version 27.5.1
  * d/docker.io.docs: update NOTICE files

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Tue, 18 Feb 2025 09:30:29 -0300

docker.io-app (26.1.3-0ubuntu2) plucky; urgency=medium

  * SECURITY UPDATE: authz plugin bypass causes privilege escalation
    - debian/patches/CVE-2024-41110-1.patch: Authz plugin security fixes
      for 0-length content and path validation
    - debian/patches/CVE-2024-41110-2.patch: If url includes scheme,
      urlPath will drop hostname, which would not match the auth check
    - CVE-2024-41110

 -- Vyom Yadav <vyom.yadav@canonical.com>  Thu, 12 Dec 2024 17:32:57 +0530

docker.io-app (26.1.3-0ubuntu1) oracular; urgency=medium

  * New upstream release.
    - Allow runc to kill containers when confined to the runc profile in
      AppArmor version 4.0.0 and later.
  * d/helpers/build-manpages.sh: build manpages with Go 1.21.
  * d/manpages: update them all.
  * d/docker.io.docs: remove NOTICE file of a dependency removed from cli.

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Tue, 04 Jun 2024 18:01:29 -0300

docker.io-app (24.0.7-0ubuntu4) noble; urgency=medium

  * Build with Go 1.22.
    - d/control: b-d on golang-1.22-go instead of golang-1.21-go
    - d/rules: add Go 1.22 to $PATH

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Wed, 17 Apr 2024 17:08:25 -0300

docker.io-app (24.0.7-0ubuntu3) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- William Grant <wgrant@ubuntu.com>  Mon, 01 Apr 2024 16:45:29 +1100

docker.io-app (24.0.7-0ubuntu2) noble; urgency=medium

  * Build with Go 1.21 (LP: #2056154)
    - d/control: b-d on golang-1.21-go instead of golang-1.20-go
    - d/rules: add Go 1.21 to $PATH

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Tue, 12 Mar 2024 11:39:49 -0300

docker.io-app (24.0.7-0ubuntu1) noble; urgency=medium

  * d/get-orig-source.sh: use .gz format instead of .xz
  * New upstream version 24.0.7
  * d/manpages/*: update manpages for version 24.0.7

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Mon, 15 Jan 2024 16:40:29 -0300

docker.io-app (24.0.5-0ubuntu1) mantic; urgency=medium

  * Update the way MUT are pre-processed and imported.
    - d/get-orig-source.sh: create a script to be called by uscan when
      importing a new version. This script is going to fetch all the needed
      components and combine all the tarballs into a single one.
    - d/helpers/{real,tini}-upstream-version.sh: create helper scripts to
      support the d/get-orig-source.sh. They process the upstream version of
      differente components.
    - d/watch: update to track just github.com/moby/moby which is the main
      component of this package, the others are now tracked and fetched by
      d/get-orig-source.sh.
  * New upstream version 24.0.5 (LP: #2030500).
  * The libnetwork component is now shipped inside the engine component.
    - d/rules: update to build proxy from the new path.
    - d/docker.io.docs: do not install NOTICE from the removed libnetwork
      component.
    - d/copyright: remove all entries for libnetwork component.
  * Build CLI manpages before build time to avoid downloading modules from the
    Internet.
    - d/docker.io.manpages: install manpages from debian/manpages.
    - d/helpers/build-manpages.sh: create a wrapper for the upstream script
      to generate manpages and place them in the expected directory.
    - d/rules: do not try to build manpage during build time, instead, check
      if the manpages version matches with the upstream one.
  * Create debian/manpages with debian/helpers/build-manpages.sh.
  * Do not override dh_strip, it works fine with Go binaries nowadays.
    - d/docker.io.lintian-overrides: remove unneeded overrides.
    - d/rules: do not override dh_strip.
  * d/control: use arch:any instead of hard-coded arches.
    The list already contains all the supported architectures in all
    supported releases (non-ESM).
  * d/control: suggests docker-buildx and docker-compose-v2.
  * d/README.source: document how to import a new upstream release.
  * Build with Go 1.20. Let's rely on a fixed version for all supported
    releases.
    - d/control: b-d on golang-1.20-go instead of golang-go.
    - d/rules: add Go 1.20 to $PATH.
  * d/docker.io.lintian-overrides: ignore statically-linked-binary.
    This is not a problem for Go binaries.

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Wed, 16 Aug 2023 18:32:36 -0300

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog docker.io`.
