Reference

Scope

Look-up facts for Docker Engine, Docker Desktop, Compose, and Docker Hub: component versions, support policy, pricing and limits, daemon configuration keys, default security settings, deprecations, and file locations. For why things work the way they do, see Explanation. For tasks, see How-to Guides.

Component Versions

Current versions as of 2026-09-25. Engine versions come from the Docker Engine v29 release notes; bundled component versions come from the same notes and the Docker Desktop release notes.

Component	Latest version (date)	Notes
Docker Engine (docker-ce, docker-ce-cli)	29.8.1 (2026-09-15)	Minor release 29.8.0 on 2026-09-03
Docker Desktop	4.92.0 (2026-09-21)	Roughly weekly releases in 2026; Engine 29.8.0 bundled since 4.91.0
Docker Compose (CLI plugin)	v5.5.1 (bundled in Desktop 4.91.0, 2026-09-14)	v5.0.0 "Mont Blanc" released 2025-12-02
Docker Buildx	v0.37.1 (bundled in Desktop 4.92.0)	docker buildx CLI plugin
BuildKit (bundled in dockerd)	v0.33.0 (in Engine 29.8.0)	Built-in Dockerfile frontend v1.27.0
containerd (static binaries / Desktop)	v2.3.5 (in Engine 29.8.1)	Distro packages ship containerd.io separately
runc (static binaries)	v1.5.1 (in Engine 29.8.0)	OCI low-level runtime
Go runtime (Engine build)	1.26.8 (in Engine 29.8.0)	Go SDK minimum is Go 1.26 since 29.8.0
Minimum Engine API version accepted by daemon	v1.44 (Docker 25.0+)	Enforced since Engine 29.0.0

Where the version numbers come from

Engine: Docker Engine v29 release notes. Desktop, Compose, Buildx: Docker Desktop release notes. Compose v5.0.0 date: docker/compose v5.0.0 release.

Engine Release History (Majors)

Major	First GA (date)	Last patch in docs	Headline changes
29	29.0.0 (2025-11-10)	29.8.1 (2026-09-15)	containerd image store default on fresh installs; experimental nftables backend; DCT removed from CLI; cgroup v1 deprecated; API min v1.44; Go module moved to github.com/moby/moby/{api,client}
28	28.0.0 (2025-02-19)	28.5.2 (2025-11-05)	--mount type=image; gw-priority; random MAC addresses; hardened port publishing in bridge networks

Since v29 the moby repository tags Engine releases with a docker- prefix (for example docker-v29.0.0).

Support Policy

Docker Engine is an open-source Moby project release. Docker, Inc. supports Docker Desktop, not standalone Engine installs (Engine install docs). Branch status comes from moby project/BRANCHES-AND-TAGS.md (checked 2026-09-25):

Branch	Status	Expected end of maintenance	Known distributors
docker-29.x	Maintained	After docker-30.x ships	Docker, Inc.; Microsoft
docker-28.x	Unmaintained	n/a	n/a
27.x, 26.1, 26.0, 24.0	Unmaintained	n/a	n/a
25.0	Maintained (sponsored)	2026-12-04	Amazon (AL2023), Mirantis (MCR)
23.0 and older	Unmaintained	23.0 ended 2025-05-19	n/a

Only the latest major is maintained upstream

Moby publishes no fixed EOL calendar. In practice only the current major (29.x) gets fixes and security advisories, plus any branch a vendor sponsors (25.0 for Mirantis/Amazon). Plan to follow the current major. Patch releases are backward compatible within their major and minor version.

Subscription Pricing (Docker, Inc.)

Per-user prices from docker.com/pricing (fetched 2026-09-25). They have been in effect since the 2024-12-10 plan consolidation (TechTarget).

Plan	Monthly billing	Annual billing (per month)	Seats	Selected inclusions
Personal	$0	$0	1	1 private Hub repo, 1 Scout-enabled repo, Build Cloud and Testcontainers Cloud trials
Pro	$11	$9	1	Unlimited Hub pulls, 200 Build Cloud min/mo, 100 Testcontainers Cloud min/mo, 2 Scout repos
Team	$16	$15	Up to 100	Unlimited Scout repos and private repos, 500 Build Cloud min/mo, RBAC, audit logs
Business	$24	$24	Unlimited	SSO, SCIM, Hardened Docker Desktop, Enhanced Container Isolation, 1,500 Build Cloud min/mo

Docker Desktop License Terms

Use	Paid subscription required?
Personal use, education, non-commercial open source	No
Commercial use in organizations with fewer than 250 employees and less than $10M USD annual revenue	No
Commercial use in organizations with more than 250 employees or more than $10M USD annual revenue	Yes (Pro, Team, or Business)
Docker Engine installed from packages or binaries (not via Desktop)	No (Apache License 2.0)

Source: Docker Engine install docs, Licensing and Docker Desktop for Linux install page.

Docker Hub Pull Limits

Current limits from Docker Hub usage and limits, subject to fair use:

User type	Pull rate limit per 6 hours	Public repos	Private repos
Business / Team / Pro (authenticated)	Unlimited	Unlimited	Unlimited
Personal (authenticated)	200	Unlimited	Up to 1
Unauthenticated	100 per IPv4 address or IPv6 /64 subnet	n/a	n/a

• A pull of a multi-arch image counts one pull per architecture pulled; version checks (HEAD of manifest) do not count.
• A separate abuse rate limit, on the order of thousands of requests per minute per IP, returns a bare 429 Too Many Requests.

2025 limit change was postponed

Docker announced tighter limits for 2025-04-01 (10 pulls/hour unauthenticated, 100 pulls/hour Personal), then did not enforce them and kept the 6-hour limits above. Docker says it will announce any future enforcement at least 6 months in advance (Docker blog). The marketing pricing page still summarizes Personal pulls as a per-hour figure; the docs table above is the authoritative definition.

Docker Hardened Images (DHI) Tiers

DHI became free and open source (Apache 2.0) on 2025-12-17, with more than 1,000 images built on Debian and Alpine (press release). Images are served from dhi.io and Docker Hub.

Feature	Community (free)	Select (from $5k/repo)	Enterprise (contact sales)
Hardened minimal images, near-zero CVEs	Yes	Yes	Yes
Signed SBOMs, SLSA Build L3 provenance, VEX	Yes	Yes	Yes
FIPS / STIG variants	No	Yes	Yes
Critical/high CVE fix SLA (< 7 days)	No	Yes	Yes
Customizations	No	Up to 5	Unlimited
Hardened System Packages repository, full catalog	No	No	Yes
Extended Lifecycle Support (+5 years)	No	No	Add-on

Source: DHI docs and docker.com/pricing.

Platform Support (Docker Engine Packages)

From Install Docker Engine:

Platform	x86_64 / amd64	arm64	arm (32-bit)	ppc64le	s390x
CentOS	Yes	Yes		Yes
Debian	Yes	Yes	Yes	Yes
Fedora	Yes	Yes		Yes
Raspberry Pi OS (32-bit)			Deprecated (no v29 packages)
RHEL	Yes	Yes			Yes
Ubuntu (22.04, 24.04, 26.04 LTS)	Yes	Yes	Yes	Yes	Yes
Static binaries	Yes	Yes	Yes

• Since 29.0.0, Debian armhf packages target ARMv7 (no ARMv6) and official Raspbian 32-bit packages are no longer provided.
• Docker Desktop runs the Engine in a VM: macOS (Apple Virtualization framework; QEMU option removed in 2025), Windows (WSL 2 or Hyper-V), Linux (KVM required).

Compatibility Matrix

Dimension	Support
Container runtime	containerd 2.x + runc (default); other OCI runtimes via --runtime (crun, Kata, gVisor runsc)
Image format	OCI Image Spec, Docker Image Manifest V2 schema 2 (schema 1 push/pull removed in v28.2)
Storage backend	containerd image store with overlayfs snapshotter (fresh v29 installs); legacy graph drivers overlay2 (default legacy), btrfs, zfs, fuse-overlayfs, vfs
cgroups	v2 recommended; v1 deprecated in v29, supported until at least May 2029
Firewall backend	iptables (default, iptables-nft or iptables-legacy); nftables experimental since v29.0 (not with Swarm)
Network drivers	bridge, host, overlay, macvlan, ipvlan, none, plugins
CPU architectures	amd64, arm64, arm/v7, ppc64le, s390x

Network Drivers

Driver	Scope	Use case	Notes
bridge	Single host	Default container networking	User-defined bridges add embedded DNS (127.0.0.11); default docker0 bridge does not
host	Single host	Maximum network performance	Shares the host network namespace; no port mapping or isolation
overlay	Multi-host	Swarm services	VXLAN; optional IPsec encryption; nftables backend not yet supported
macvlan	Single host / L2	Container needs its own MAC on the LAN	Since v29, no default gateway unless --gateway is set
ipvlan	Single host / L2 or L3	Switch port limits on MAC addresses	L2 mode also needs explicit --gateway since v29
none	n/a	Fully isolated jobs	Loopback only

Storage Types

Type	Example flag	Lifecycle	Where data lives
Container writable layer	(implicit)	Deleted with the container	Snapshotter or graph driver directory
Named volume	-v pgdata:/var/lib/postgresql/data	Independent of containers	/var/lib/docker/volumes/
Bind mount	-v /srv/html:/usr/share/nginx/html:ro	Host-managed	Any host path
tmpfs	--tmpfs /tmp:rw,noexec,size=64m	Memory only, gone on stop	RAM
Image mount	--mount type=image,source=alpine,target=/mnt	Read-only view of an image	Image store (GA in v29.7.0)
Volume plugin	--volume-driver <plugin>	Driver-dependent	NFS, cloud block/file storage, and more
Named pipe (Windows)	-v \\.\pipe\docker_engine:\\.\pipe\docker_engine	Host-managed	Windows host

Daemon Configuration Keys (/etc/docker/daemon.json)

Selected keys with verified behavior. The full list is in the dockerd reference.

Key	Example value	Purpose
features.containerd-snapshotter	true	Use the containerd image store (default on fresh v29 installs)
features.containerd-migration	true	Experimental automatic migration to the containerd image store
firewall-backend	"nftables"	Experimental nftables rules instead of iptables (v29.0+)
ip-forward	false	Skip the IP forwarding check (nftables backend does not enable forwarding)
bridge-accept-fwmark	"0x1"	Accept packets with this firewall mark into bridge networks (v29.0+)
default-ulimits	{"nofile": {"Name": "nofile", "Soft": 1048576, "Hard": 1048576}}	Restore the pre-v29 open-file limit (v29 defaults to 1024 via containerd 2.1.5+)
default-stop-timeout	30	Stop timeout for containers without an explicit one (v29.7.0+)
userns-remap	"default"	Map container root to an unprivileged host UID range (disables containerd image store)
selinux-enabled	true	Enable SELinux labeling; needed for the CVE-2026-31431 SELinux mitigation
storage-driver	"overlay2"	Legacy graph driver selection
log-driver / log-opts	"local"	Default logging driver and options
registry-mirrors	["https://mirror.example.internal"]	Pull-through mirror for Docker Hub
max-concurrent-downloads / max-concurrent-uploads	3 / 5	Daemon-wide limits; honored by containerd store since v29.7.0 (0 = unlimited)
data-root	"/srv/docker"	Docker data directory (containerd has its own root; configure separately)

Default Linux Capabilities

Containers keep this default set; everything else is dropped. Source: docker run reference.

Capability	Purpose
AUDIT_WRITE	Write records to the kernel audit log
CHOWN	Change file UIDs and GIDs
DAC_OVERRIDE	Bypass file read, write, and execute permission checks
FOWNER	Bypass checks that require the file owner UID
FSETID	Keep setuid/setgid bits when a file is modified
KILL	Bypass permission checks for sending signals
MKNOD	Create special files with mknod(2)
NET_BIND_SERVICE	Bind to ports below 1024
NET_RAW	Use RAW and PACKET sockets
SETFCAP	Set file capabilities
SETGID / SETUID	Manipulate process GIDs / UIDs
SETPCAP	Modify process capabilities
SYS_CHROOT	Use chroot(2)

The default seccomp profile disables around 44 of 300+ system calls (seccomp docs). Since 29.4.2 it also blocks AF_ALG sockets (CVE-2026-31431 hardening).

Security Hardening Checklist

Area	Recommendation
Runtime	Use rootless mode or userns-remap
Runtime	Run containers as non-root (USER in the Dockerfile)
Runtime	Drop capabilities (--cap-drop ALL, add back only what is needed)
Runtime	Keep the default seccomp profile; never use seccomp=unconfined as a workaround
Runtime	Enable AppArmor or SELinux (selinux-enabled: true on SELinux hosts)
Runtime	Set --read-only, --pids-limit, memory and CPU limits
Image	Use minimal base images (Docker Hardened Images, distroless, Alpine, Chainguard)
Image	Scan images for CVEs before deployment (Docker Scout, Trivy, Grype)
Image	Sign and verify images with Cosign (Docker Content Trust was removed from the CLI in v29)
Image	Pin image digests, not tags (image@sha256:...)
Network	Use user-defined bridge networks; publish only needed ports
Network	Avoid --privileged and --network host in production
Daemon	Restrict access to /var/run/docker.sock; never mount it into untrusted containers
Daemon	Use mutual TLS (--tlsverify) or SSH for remote daemon access; never plain TCP
Daemon	Stay on the current Engine major (29.x) for security fixes

Notable Security Advisories (2026, Engine 29.x)

From the Engine v29 release notes:

Fixed in	CVE	Summary
29.3.1 (2026-03-25)	CVE-2026-34040	AuthZ plugin authorization bypass
29.3.1 (2026-03-25)	CVE-2026-33997	docker plugin install privilege validation bypass
29.3.1 (2026-03-25)	CVE-2026-33747, CVE-2026-33748	BuildKit: untrusted frontend writes outside state dir; Git URL subdir escape
29.4.2 / 29.4.3 (2026-05)	CVE-2026-31431	Kernel "Copy Fail" (AF_ALG) hardening in seccomp, then AppArmor/SELinux
29.5.0 (2026-05-14)	CVE-2026-32288	Unbounded memory use from crafted sparse tar layers
29.5.1 (2026-05-18)	CVE-2026-41567, CVE-2026-41568, CVE-2026-42306	docker cp host-root binary execution and TOCTOU escapes
29.6.2 (2026-07-16)	CVE-2026-15788 to CVE-2026-15793	BuildKit frontend and Git source issues
29.7.0 (2026-07-30)	CVE-2026-17106	moby/go-archive fix

Deprecated and Removed Features (Recent)

From docker/cli deprecated.md and v29 release notes:

Feature	Deprecated	Removed
Support for cgroup v1	v29.0	Not before May 2029
--pause option on docker commit	v29.0	v30.0 (planned)
Docker Content Trust (docker trust, DOCKER_CONTENT_TRUST) in the CLI	n/a	v29.0 (available as a separately built plugin)
Legacy links environment variables	v28.4	v30.0 (planned); not set by default since v29.0
--time on docker stop / docker restart (use --timeout)	v28.0	n/a
Unauthenticated TCP daemon connections	v26.0	v28.0
Graphdriver plugins (experimental)	v27.0	v28.0
Image manifest v2 schema 1 push/pull	v19.03	v28.2
Legacy builder for Linux images (BuildKit is default since v23.0)	v23.0	n/a
Wasm workloads in Docker Desktop	Desktop 4.55.0 (2025-12-16)	Future Desktop release

Key File Locations

Path	Purpose
/var/run/docker.sock	Docker daemon Unix socket
/etc/docker/daemon.json	Daemon configuration file
/var/lib/docker/	Default data-root (containers, volumes, network state, legacy layers)
/var/lib/docker/overlay2/	Image and container layers (legacy overlay2 driver)
/var/lib/docker/volumes/	Named volumes
/var/lib/docker/network/	Network configuration and state
/var/lib/containerd/	containerd content store and snapshots (containerd image store)
~/.docker/config.json	CLI configuration and credential helper settings
~/.docker/cli-plugins/	Per-user CLI plugins (docker-compose, docker-buildx)
~/.config/systemd/user/docker.service	Rootless daemon unit created by dockerd-rootless-setuptool.sh

Base Image Sizes (Approximate)

Rough figures

Sizes vary by tag, architecture, and date. Check docker image ls for exact numbers.

Base image	Approximate size	Use case
scratch	0 MB	Static Go or Rust binaries
alpine	~8 MB	Minimal Linux with musl libc
gcr.io/distroless/static-debian12	~2 MB	Static binaries, no shell
distroless language images	15-25 MB	Secure runtime, no shell
debian:*-slim	~75-80 MB	glibc compatibility
ubuntu	~77 MB	Full Linux tools
node:22-alpine	~130-160 MB	Node.js apps
python:3.12-slim	~120-150 MB	Python apps

Performance Figures (Unsourced Estimates)

Unsourced performance data

These numbers are engineering estimates, not controlled benchmarks. No hardware, versions, or methodology were recorded. Use them only as rough guidance and benchmark your own workload.

Metric	Docker vs native	Typical overhead
CPU	Near-native	< 1%
Memory	Near-native	10-30 MB per container (shim and runtime)
Network (bridge + NAT)	90-95% of native	5-10%
Network (host)	Near-native	< 1%
Disk I/O (overlay2 writable layer)	85-95% of native	5-15%
Disk I/O (volume or bind mount)	Near-native	< 1%

Build strategy	Cold build	Cached build	Final image size
Single stage	30-120 s	5-30 s	Large (500 MB+)
Multi-stage	60-180 s	10-30 s	Small (50-150 MB)
BuildKit cache mounts	60-180 s	3-10 s	Same as multi-stage
Buildx Bake (parallel targets)	30-90 s	3-10 s	Per target

Compose stack size	Runtime memory	Startup time	Typical case
10 containers	100-500 MB	5-15 s	Dev setup
50 containers	0.5-2 GB	15-45 s	Medium application
100 containers	1-5 GB	30-120 s	Large stack

Sources

• Docker Engine v29 release notes
• Docker Engine v28 release notes
• Docker Desktop release notes
• moby BRANCHES-AND-TAGS.md
• Install Docker Engine
• Docker pricing
• Docker Hub usage and limits
• Docker Hardened Images docs
• containerd image store
• Docker with nftables
• Deprecated Engine features
• docker run reference (capabilities)
• Seccomp security profiles