Docker’s latest releases now center security and Compose

What changed in the latest Docker releases, and which updates matter first?

Docker’s newest releases mix security fixes, Compose changes, and API updates that operators should review now.

1. Docker Engine 29.7.2

Docker Engine 29.7.2 is the patch most likely to help teams already seeing runtime trouble. It fixes panics in docker service commands, image pull regressions tied to absolute hardlink targets, and networking issues that could slow down day-to-day work.

The practical value here is stability. If your cluster has been behaving oddly after recent upgrades, this release is the first one to check because it bundles fixes across service control, packaging, and network compatibility.

• Fixes panics in service commands
• Addresses image pull regressions
• Includes networking improvements

2. Docker Compose v5.4.0

Docker Compose v5.4.0 changes how resources are reconciled, with a new model for volumes and networks. That matters if you run multi-container apps where Compose must keep declared state and observed state aligned over time.

It also fixes smaller but useful issues, including zero-replica services during hashing and warnings when service selection is ignored. For teams that treat Compose as infrastructure code, this release is about making state handling more predictable.

• New reconciliation model for resources
• Better handling of volumes and networks
• Fixes zero-replica hashing behavior

3. Docker 29.7.0

Docker 29.7.0 is the headline release in this batch because it introduces experimental embedded containerd inside the daemon. That can simplify management for some environments, but it is still experimental, so it is one to test before rolling out broadly.

This release also patches CVE-2026-17106, which affects Docker Engine and related components. Add in networking reliability fixes and dependency updates for Go and runc, and this becomes the release security teams will want to prioritize.

• Experimental embedded containerd
• Fixes CVE-2026-17106
• Updates Go and runc dependencies

4. Docker Compose v5.3.0

Docker Compose v5.3.0 adds native init container support, which helps when setup tasks must run before main services start. If your stack needs database migrations, config prep, or other ordered startup work, this is the release that expands what Compose can express directly.

Alongside that feature, the release includes bug fixes and internal migrations. The main takeaway is simple: Compose is moving closer to handling more lifecycle steps without extra scripts or wrapper tooling.

• Native init containers
• Better startup ordering
• Useful for setup-first workflows

5. Docker 29.6.0 and Moby API v1.55.0

Docker 29.6.0 and Moby API v1.55.0 add features that matter to platform teams and security tooling. The API now exposes image attestation retrieval, so tools can pull in-toto provenance and SPDX SBOM data directly from the daemon.

That same release line also adds a container resource update endpoint and improves image pruning, push behavior, and rootless networking. If you maintain internal build systems or policy checks, these changes make metadata access and resource control easier to automate.

• New attestation endpoint for images
• Container resource update API
• Better support for SBOM and provenance data

What to pick

If you need immediate operational relief, start with Docker Engine 29.7.2 and 29.7.0, since they target bugs and a security issue that can affect many users. If your work centers on Compose workflows, v5.4.0 is the most interesting change for resource handling, while v5.3.0 is the pick for teams that want init containers without extra glue.

For platform and security teams, Docker 29.6.0 and Moby API v1.55.0 are the releases that expand automation around attestations and resource updates. In short: choose the patch releases for stability, the Compose releases for orchestration behavior, and the API updates when metadata and policy checks are part of your pipeline.