Docker Engine 25 Reaches End-of-Life, Mandating Upgrade to Version 29 for Continued Security

Docker has announced that Docker Engine 25 will reach its end-of-life on December 4, 2026. This means that after this date, Docker will no longer provide security fixes for any newly discovered vulnerabilities in Engine 25, including its bundled components like containerd and runc. The recommended upgrade path is directly to Docker Engine 29, as intermediate versions like 26, 27, and 28 have already reached their end-of-life. This end-of-life announcement is critical for practitioners as it directly impacts the security and stability of their containerized environments. Running an unsupported version of Docker Engine leaves systems vulnerable to exploits, potentially leading to data breaches, service disruptions, or compliance issues. Many organizations may still be running Engine 25 due to its unusually long support period compared to other recent releases, making this a significant operational concern. The move from Docker Engine 25 to 29 is not a simple patch update; it's a major version upgrade that introduces several breaking changes. A notable change in Engine 29 is the default open-files limit inside containers, which has significantly decreased from 1,048,576 to 1,024. This change can severely impact applications, especially databases and busy proxies, that require a high number of open file descriptors. Additionally, the Engine 29 daemon only supports API v1.44 or newer, meaning older CI runners, SDKs, and tools that rely on earlier API versions will cease to function. In practice, organizations should immediately begin planning their migration strategy. This includes identifying all systems running Docker Engine 25, thoroughly testing their applications with Engine 29 in a staging environment, and allocating a maintenance window for the upgrade. It is crucial to back up all data, including `/var/lib/docker`, and consider snapshotting virtual machines before initiating the upgrade. Developers should also review their application configurations for potential issues arising from the reduced file descriptor limit and update any tooling that might be using older Docker API versions. Ignoring this deadline will inevitably lead to increased security risks and potential operational failures.