Docker: Update to v29.3.0

[G-M0N3Y-2503]

Maintainer: me / @G-M0N3Y-2503
Compile tested: x86_x64, QEMU/KVM, master
Run tested: x86_x64, QEMU/KVM, master, firewall not working

Description:
Update to v29.3.0

[G-M0N3Y-2503]

#25951
#25952

[schuettecarsten]

Can you update this to latest docker versions?

[schuettecarsten]

Tested on bcm27xx/bcm2711

[G-M0N3Y-2503]

Wait, it works for you?
I can't get it to work on x86_64, assumed it was on all arches.

[schuettecarsten]

Wait, it works for you? I can't get it to work on x86_64, assumed it was on all arches.

Yes, works here on rpi4 (bcm27xx/bcm2711)

root@GatewayDummi:~# docker -v
Docker version 28.3.3, build 980b856

[SquallATF]

bcm2711 work

root@OpenWrt:~# docker info
Client:
 Version:    28.3.3
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.28.0
    Path:     /usr/lib/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.39.2
    Path:     /usr/lib/docker/cli-plugins/docker-compose

Server:
 Containers: 4
  Running: 2
  Paused: 0
  Stopped: 2
 Images: 10
 Server Version: 28.3.3
 Storage Driver: overlay2
  Backing Filesystem: f2fs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version:
 runc version:
 init version: de40ad0
 Security Options:
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.12.43
 Operating System: OpenWrt SNAPSHOT
 OSType: linux
 Architecture: aarch64
 CPUs: 4
 Total Memory: 7.634GiB
 Name: OpenWrt
 ID: eeadca9d-839a-4de2-83d2-9ac78d28e01b
 Docker Root Dir: /opt/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  ::1/128
  127.0.0.0/8
 Registry Mirrors:
 Live Restore Enabled: false

WARNING: No swap limit support

[schuettecarsten]

Needs to be rebased and updated after changes in main branch

[G-M0N3Y-2503]

Yeah, the main issue is I can't merge something that will break supported platforms like x86_64, better something old rather than broken.
I just don't have the time to invest digging into this kind of issue right now and get x86_64 working.

[G-M0N3Y-2503]

It seems the error I was experiencing during testing was to do with my setup.

[GeorgeSapkin]

You need to add commit descriptions to all of the commits. And please start you commit subjects with lower case after the prefix. It's a good idea to add links to all the relevant changelogs as well.

[gladiac]

Good god this PR is being worked on since February? This is really no critique on anyone here as I know very well myself that this work here is done in our freetime. However, we should really get this sorted out in a timely manner as there are several CVEs that need fixing. In the meantime we should probably at least go for version v28.5.2 or make the move to v29. Is there anything that can be done to help with this PR?

[G-M0N3Y-2503]

I was hoping that CI test wasn't necessary, here's hoping it passes this time.

[G-M0N3Y-2503]

Good god this PR is being worked on since February? This is really no critique on anyone here as I know very well myself that this work here is done in our freetime. However, we should really get this sorted out in a timely manner as there are several CVEs that need fixing. In the meantime we should probably at least go for version v28.5.2 or make the move to v29. Is there anything that can be done to help with this PR?

The build catches most of the issues that may arise building docker so it's pretty simple to go through the process if anyone would like to submit another PR, it just takes some time to build and test everything still works.

This PR is almost done so we should probably get it through even if it's just an incremental update.

[schuettecarsten]

Any news?
docker-compose was updated to 5.0.1 on the repo, but docker is quite old.

[SquallATF]

Docker Engine v29 introduced experimental support for using nftables as a firewall backend
https://docs.docker.com/engine/network/firewall-nftables/

root@OpenWrt:~# docker info
Client:
 Version:    29.2.1
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.31.1
    Path:     /usr/lib/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v5.0.2
    Path:     /usr/lib/docker/cli-plugins/docker-compose

Server:
 Containers: 5
  Running: 4
  Paused: 0
  Stopped: 1
 Images: 12
 Server Version: 29.2.1
 Storage Driver: overlay2
  Backing Filesystem: f2fs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Swarm: inactive
 Runtimes: runc io.containerd.runc.v2
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: dea7da592f5d1d2b7755e3a161be07f43fad8f75
 runc version: v1.3.4-0-gd6d73eb8
 init version: de40ad0
 Security Options:
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.18.2
 Operating System: OpenWrt SNAPSHOT
 OSType: linux
 Architecture: aarch64
 CPUs: 4
 Total Memory: 7.645GiB
 Name: OpenWrt
 ID: eeadca9d-839a-4de2-83d2-9ac78d28e01b
 Docker Root Dir: /opt/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  ::1/128
  127.0.0.0/8
 Registry Mirrors:
  https://docker.1ms.run/
 Live Restore Enabled: false
 Firewall Backend: nftables

WARNING: No swap limit support

[schuettecarsten]

Any chance to get this updated to the latest versions of docker, dockerd, runc and containerd?

[schuettecarsten]

@G-M0N3Y-2503
The patch needs to be updated as dockerd Makefile was modified

[G-M0N3Y-2503]

Haven't been able to get networking locally in tests, so probably isn't worth merging as is.
Also some of the docker info appears to be missing.

[schuettecarsten]

Well, it works on my rpi4 (bcm27xx) with kernel 6.18.21 and xtables-addon update (#28167)....

[GeorgeSapkin]

I'm closing this since #29218 has been merged.