The latest version of Docker Desktop implements socket mount permissions to enhance container isolation, updates error management to improve efficiency and reliability, integrates Moby 26, and speeds up file operations thanks to synchronized file shares.
Available only to business subscribers, Enhanced Container Isolation (ECI) mode uses a variety of techniques to harden container isolation, including running all containers unprivileged, ensuring the Docker VM is immutable, vetting some system calls and virtualizing /proc and /sys within container and preventing user console access to the VM. This layer of security helps prevent malicious workloads running in containers from compromising Docker Desktop or the host, says Docker.
With release 4.29, ECI now hardens the Docker Engine Socket by blocking unapproved attempts to bind it into containers. To avoid hampering productivity, though, developers can tweak the admin-settings.json configuration to enable specified images to bind-mount the Docker socket.
The Docker Engine socket, a crucial component for container management, has historically been a vector for potential security risks. Unauthorized access could enable malicious activities, such as supply chain attacks. However, legitimate use cases, like the
Testcontainersframework, require socket access for operational tasks.
Thanks to its new error management system, Docker Desktop can now provide timely and actionable insights into what is causing errors, says Docker, with a significantly improved developer experience. This includes an enhanced error interface that provides both raw error codes and helpful explanatory text, support for uploading diagnostics directly from the error screen, and the ability to reset the application to factory settings for more complex situations.
As mentioned, Docker Desktop 4.29 also integrates Moby 26, bringing in several new features, including the possibility to mount a subdirectory as a named volume, improvements to the stability of the networking subsystem, integration of BuildKit 0.13 with experimental support for Windows Containers, and an improved docker images UX.
Moby is a collection of tools and components originally created for the Docker project, which are now available to other projects as well. These include container build tools, a container registry, orchestration tools, a runtime, and more.
Finally, the new Docker Desktop release also brings 2-10x faster file operation thanks to Synchronized File Shares. In short, Synchronized File Shares are just file caches that are kept in sync with the host file system using the Mutagen file synchronization engine, which enables bidirectional propagation with ultra-low latency. The trade-off for this improved performance is you pay the storage cost twice, on both the host and inside the VM-based cache.
There is much more to Docker Desktop 4.29 than can be covered here, so do not miss the official release notes for the full details.