What happened
Docker Engine 29.6.1 fixed security issues involving malicious image metadata and custom build frontends. Version 29.6.2 fixed five more vulnerabilities affecting Git source bundles, BuildKit frontends, LLB file operations and local-source handling.
Docker 29.7.0 then added another security fix, and 29.7.1 and 29.7.2 repaired regressions introduced in 29.7.0.
As of 13 August 2026, the current documented Engine 29 patch is 29.7.2. Version 29.6.2 remains an important security milestone, but it should not be treated as the permanent latest target.
Who is affected
Review this update if the host:
- runs an older Docker Engine 29 patch
- builds images with BuildKit
- builds from Git sources
- uploads local build contexts
- uses custom build frontends
- uses
docker cp - pulls images from sources outside your direct control
What to do
- Record Engine, CLI, containerd, Buildx and Compose versions.
- Confirm the Apt package source.
- Read every release note from the installed version to the current 29.x patch.
- Back up Compose definitions, secrets and persistent application data.
- Preview the Apt transaction.
- Update the supported Docker package set together.
- Verify the daemon and every existing container without refreshing application images.
Do not combine the Engine update with a broad docker compose pull or application migration.
Extra care for Docker 28 and older
Moving from Engine 28 or earlier to 29 is a major-version upgrade. Docker 29.0 includes breaking changes and deprecations, so follow the complete 29 release notes rather than only the latest security section.
Further reading
Use the official release notes linked below for the exact vulnerabilities, regression notes and current patch level.
Keep the permanent fix nearby
Affected SmallGrid guides
Primary source
This update is based on the official announcement: Docker Engine 29 release notes.