What Is New in Docker Engine 20.10
Docker Engine 20.10 is a significant release packed with enhancements focused on developer experience, container security, and build system performance. It introduces long-awaited features like build secrets and introduces cgroups v2 support, marking a major step forward.
| Category | Key Changes |
|---|---|
| New Features | BuildKit secrets, cgroups v2 support, docker scan command, docker trust command rewrite |
| Improvements | Faster file copying, improved CLI description formatting, enhanced BuildKit output |
| Deprecations & Removals | AUFS storage driver deprecated, API v1.41 is the current version |
| Runtime & Security | Seccomp, AppArmor, SELinux profile updates, new default seccomp profile |
How does Docker 20.10 improve the build process?
The biggest upgrade is native support for BuildKit, bringing major performance gains and powerful new features. You can now securely pass secrets directly into your build process without leaving them in the final image layer. In practice, this means no more awkward multi-stage workarounds just to handle API keys or certificates during a build.
The new docker scan command, powered by Snyk, is integrated right into the CLI. You can immediately test your local images for known vulnerabilities right after you build them, which streamlines the development feedback loop significantly.
What changes were made to container security?
Security got a substantial update with a new default seccomp profile that blocks over 40 additional system calls, tightening the default container isolation. The AppArmor and SELinux profiles were also updated to improve coverage and compatibility with modern kernels.
The docker trust command was completely rewritten for better reliability and a more intuitive workflow for signing and verifying images. This matters because it makes it harder to accidentally deploy an image that hasn't been properly vetted and signed by your team.
Is cgroups v2 supported in this release?
Yes, Docker Engine 20.10 adds full support for cgroups v2. This is a critical feature for running on newer Linux distributions like Fedora 31+ and Ubuntu 21.04+ that have cgroups v2 enabled by default.
Support is experimental and requires both the host OS and the kernel to be configured for cgroups v2. This paves the way for future enhancements in resource management and container isolation that are built on the new cgroups foundation.
What was deprecated or removed?
The AUFS storage driver has been deprecated. If you're still using it, you should plan a migration to overlay2, which has been the default and recommended driver for years due to its better performance and stability.
API version v1.41 is now the current default version. Always target this version for new automation scripts to ensure future compatibility.
FAQ
How do I use the new BuildKit secrets feature?
You use the --secret flag with docker build. First, pass your secret (e.g., an API key) to the build daemon, then within your Dockerfile, you can access it at a specific mount point without it being written to the image history.docker build --secret id=mysecret,src=./mysecret.txt .
Do I need to enable something to use cgroups v2?
You need a host system that already uses cgroups v2. Docker will automatically detect and use it. You cannot force Docker to use cgroups v2 on a host that is still using cgroups v1.
Is the new `docker scan` command free to use?
Yes, scanning images with docker scan is free. It is powered by Snyk and provides detailed vulnerability information directly in your terminal without requiring a separate tool.
What happens if I'm still using the AUFS storage driver?
Your existing setups will continue to work for now, but you will see deprecation warnings. You should migrate to overlay2 at your earliest convenience, as AUFS will be removed in a future release.
How do the seccomp changes affect my existing containers?
The new default seccomp profile is more restrictive. If your containers rely on system calls that are now blocked, they might break. You can test by running with --security-opt seccomp=unconfined or provide your own custom profile.