Is Docker Engine version 23.0.x still supported? Will it get fixes for Leaky Vessels vulnerabilities?

[wojciech-kopras]

Hi everyone,

Is Docker Engine 23.0.x still supported? Here I can see, that yes, it is supported. But here there is no info about releases newer than 23.0.6. And on github the newest is 23.0.9.

And if 23.0.x is supported, will it get fixes for Leaky Vessels vulnerabilities? Versions 24.0.x and 25.0.x got these fixes.

[thaJeztah]

The 23.0 release branch is still maintained an an upstream source for LTS releases distributed by some parties (for example, Mirantis container runtime).

However, Docker no longer publishes updated "docker-ce" packages for the 23.0 release on download.docker.com, so if you are depending on those packages, no updates will be provided. Some of the CVEs affected the runc binary, which is provided as part of the containerd.io package on docker.com, and updates to that package are available.

The remaining CVEs affect;

• The classic builder; patches for that CVE have been backported to the 23.0 and 24.0 release branches (for 24.0, those patches have been included in the 24.0.9 release).
• The BuildKit builder included in 24.0 and 23.0: these CVEs have not been patched for the 24.0 and 23.0 release-branches. The BuildKit versions used in those branches (BuildKit v0.11 and v0.10 respectively) have been marked EOL by the BuildKit maintainers, and have not been patched, but conversations are ongoing to accept contributions to that effort, in which case the BuildKit dependency may be updated in 24.0 and 23.0