What Is New in Docker Engine 1.5
Docker Engine 1.5 introduces significant updates to image handling, security, and system capabilities. This release focuses on providing developers with more control and better tools for building and managing containers.
| Category | Key Changes |
|---|---|
| New Features | Image fingerprints, Docker content trust, User Namespace support, OverlayFS storage driver |
| Improvements | Enhanced docker logs command, Better Windows Client support |
| Security | Security options for docker run, Official image security updates |
| Deprecations | Deprecated LXC execution driver |
How does image signing improve security?
Docker 1.5 introduces content trust through image fingerprints, providing cryptographic verification of image authenticity. This ensures that the images you pull are exactly what the publisher created, without any tampering.
In practice, this means you can verify the publisher of official images and prevent man-in-the-middle attacks during image distribution. The system uses digital signatures to establish trust from the publisher to the consumer.
What are the benefits of User Namespace support?
User Namespace support allows containers to run as root while mapping to a non-root user on the host system. This significantly improves security by reducing the impact of container breakout vulnerabilities.
This matters because even if an attacker gains root access inside a container, they won't have root privileges on the host machine. It's a fundamental security layer that separates container privileges from host system privileges.
Why is OverlayFS storage driver important?
The OverlayFS storage driver provides better performance and stability compared to previous storage options. It uses a copy-on-write mechanism that's more efficient for container operations.
You'll notice faster container start times and reduced disk space usage with OverlayFS. This driver became the foundation for future storage improvements in Docker, making it a significant addition to the 1.5 release.
What logging improvements were introduced?
The docker logs command received significant enhancements in version 1.5. You can now use docker logs --tail to follow log output and docker logs --since to get logs from a specific time.
These improvements make debugging containers much easier without needing to enter the container itself. The enhanced logging capabilities provide better visibility into container behavior during development and production.
What changed for Windows developers?
Docker Engine 1.5 improved support for Windows clients through better compatibility and installation packages. While the engine itself still ran on Linux, Windows users got better tools to interact with Docker hosts.
This update made Docker more accessible to developers working in mixed environments. The Windows client improvements paved the way for future native Windows container support that came later.
FAQ
How do I enable User Namespaces in Docker 1.5?
You need to start the Docker daemon with the --userns-remap flag. This activates the user namespace mapping feature that separates container root from host root privileges.
Does content trust work with all Docker images?
Content trust primarily benefits official images and those from publishers who implement the signing mechanism. It's optional but recommended for production environments where image integrity is critical.
What replaced the deprecated LXC execution driver?
The native libcontainer driver replaced LXC as the default execution environment. This change provided better performance and tighter integration with the Docker ecosystem.
Can I use OverlayFS with all Linux distributions?
OverlayFS requires kernel version 3.18 or higher and proper filesystem support. Some distributions needed additional configuration or kernel modules to use this storage driver effectively.
How do the new security options for docker run work?
The added security options allow finer control over container capabilities and security policies. You can use flags like --security-opt to customize SELinux or AppArmor profiles for specific containers.