Docker Engine 19.03: What's New, Release History & Support Lifecycle

What Is New in Docker Engine 19.03

Docker Engine 19.03 introduces significant enhancements focused on runtime capabilities and developer experience. The update brings GPU support to the core runtime, improves build performance, and refines container management. These changes streamline workflows for developers working with demanding applications and complex build pipelines.

How does native GPU support change container development?

Docker 19.03 integrates NVIDIA GPU support directly into the core runtime without needing the nvidia-docker2 package. This simplifies the setup for machine learning, data science, and graphics workloads. You can now use the --gpus flag with docker run to specify GPU resources.

In practice, this means you can run a CUDA container with a simple command like docker run --gpus all nvidia/cuda:10.0-base nvidia-smi. The engine handles the necessary device and library mappings automatically, reducing configuration overhead and potential errors.

What build improvements were introduced?

Builds are faster and more secure in 19.03. The docker build command saw performance optimizations, particularly around context handling and layer caching. More importantly, the new --secret flag allows you to pass sensitive information during build time without persisting it in the final image.

This is a game-changer for not leaking API keys or credentials into your image layers. You can use it by mounting a secret file during the build process, which is only available to the specific RUN command that needs it, and is not committed to the image history.

# syntax=docker/dockerfile:1.0-experimental
FROM alpine
RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret

What is Rootless mode and why does it matter?

Rootless mode allows the Docker daemon to run as a non-root user, greatly enhancing security by mitigating potential privilege escalation attacks. This is an experimental feature in 19.03 that lets users install and run Docker without requiring root privileges.

This matters because it fundamentally changes the security model. Even if a container runtime is compromised, the attack surface is limited to the user's privileges instead of full root access on the host machine. It's a significant step towards safer container deployments, especially in multi-user environments.

What was deprecated and what should I use instead?

Several legacy features were marked for removal. The AUFS storage driver was deprecated in favor of overlay2, which has become the default and offers better performance. Legacy overlay networks were also deprecated, so you should migrate to the newer overlay network implementation with Swarm mode.

The docker engine subcommand was deprecated. For managing Docker Engine installations, you should use your system's package manager (like apt or yum) instead. It's a good time to audit your scripts and configurations to ensure they don't rely on these deprecated features.