Docker Engine 29.7: What Home Server Users Need to Know

What happened

Docker Engine 29.6.1 fixed security issues involving malicious image metadata and custom build frontends. Version 29.6.2 fixed five more vulnerabilities affecting Git source bundles, BuildKit frontends, LLB file operations and local-source handling.

Docker 29.7.0 then fixed CVE-2026-17106 by updating its archive-handling dependency. Docker 29.7.1 and 29.7.2 followed quickly to repair regressions introduced in 29.7.0.

As of 24 August 2026, the current documented Engine 29 patch is 29.7.2. Version 29.6.2 remains an important security milestone, but it should not be treated as the permanent latest target.

The follow-up fixes cover image layers with unusual directory structures, docker cp paths that cross absolute symbolic links, absolute hardlink targets, permission application on older kernels and nftables compatibility. If a pull or copy operation broke directly after installing 29.7.0 or 29.7.1, check the Engine version before changing the container or deleting Docker data.

Who is affected

Review this update if the host:

• runs an older Docker Engine 29 patch
• builds images with BuildKit
• builds from Git sources
• uploads local build contexts
• uses custom build frontends
• uses docker cp
• pulls images from sources outside your direct control

What to do

1. Record Engine, CLI, containerd, Buildx and Compose versions.
2. Confirm the Apt package source.
3. Read every release note from the installed version to the current 29.x patch.
4. Back up Compose definitions, secrets and persistent application data.
5. Preview the Apt transaction.
6. Update the supported Docker package set together.
7. Verify the daemon and every existing container without refreshing application images.

Check the daemon-side version with:

docker version --format 'client={{.Client.Version}} server={{.Server.Version}}'

If 29.7.0 or 29.7.1 is installed, review the 29.7.2 notes and update the complete supported Docker package set from the same repository. Do not delete /var/lib/docker, remove volumes or run a broad prune to work around these regressions.

Do not combine the Engine update with a broad docker compose pull or application migration.

Extra care for Docker 28 and older

Moving from Engine 28 or earlier to 29 is a major-version upgrade. Docker 29.0 includes breaking changes and deprecations, so follow the complete 29 release notes rather than only the latest security section.

Further reading

Use Docker Image Pull Failed After an Update? when pulls or docker cp began failing after 29.7.0 or 29.7.1.

Use the official release notes linked below for the exact vulnerabilities, regression notes and current patch level.

Keep the permanent fix nearby

Affected SmallGrid guides