docker: update to 28.5.2 for runc security fixes #7

Merged

sbelikov merged 2 commits from update-docker-28.5.2 into niceos-5.2

2026-05-02 14:37:58 +03:00

sbelikov commented

2026-05-02 14:00:57 +03:00

Owner

Upstream moby/moby v28.5.2 is a security-driven maintenance release.

Highlights:

fixes CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881 in runc;
updates runc to v1.3.3 and Go runtime to 1.24.9;
changes rootless behavior so dockerd-rootless.sh tries pasta (passt) when slirp4netns is not installed.

NiceOS assessment:

risk level: high;
decision: manual review before merge;
main compatibility concern is the rootless behavior change and the critical container-escape fix path through runc.

Required validation:

rebuild in a clean mock/chroot environment;
run docker daemon and CLI smoke tests;
test rootless startup and fallback behavior;
verify package metadata, source tarballs, and file manifests.

References:

Upstream moby/moby v28.5.2 is a security-driven maintenance release. Highlights: - fixes CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881 in runc; - updates runc to v1.3.3 and Go runtime to 1.24.9; - changes rootless behavior so dockerd-rootless.sh tries pasta (passt) when slirp4netns is not installed. NiceOS assessment: - risk level: high; - decision: manual review before merge; - main compatibility concern is the rootless behavior change and the critical container-escape fix path through runc. Required validation: - rebuild in a clean mock/chroot environment; - run docker daemon and CLI smoke tests; - test rootless startup and fallback behavior; - verify package metadata, source tarballs, and file manifests. References: - https://github.com/moby/moby/releases/tag/v28.5.2 - https://github.com/moby/moby/compare/v28.3.3...v28.5.2 - https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2 - https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r - https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm

sbelikov added 1 commit

2026-05-02 14:00:57 +03:00