Rootless containers are now fully supported

Rootless containers are containers that are created and managed by regular system users without administrative permissions. This allows users to maintain their identity, including such things as credentials to container registries.

You can try rootless containers using the podman and buildah commands. For further information:

fuse-overlayfs now available, might require changes to rootless containers

The fuse-overlayfs package provides an overlayfs FUSE implementation, which can be used in rootless containers. With FUSE, it is possible to implement a fully functional file system in a user-space program.

Due to the changes in storage, you might need to modify your rootless containers when upgrading to RHEL Atomic Host 7.8.0.

The quay registry is not searched by default anymore

Previously, using short image names sometimes pulled incorrect images. To fix this, the quay.io registry has been removed from the default registry search list in /etc/containers/registries.conf.

Now you need to specify the full repository name when pulling an image, for example quay.io/myorg/myimage.

Red Hat Enterprise Linux Atomic Host Retires on August 6, 2020

Red Hat Enterprise Linux Atomic Host will be retired on August 6, 2020 and active support will no longer be provided. Accordingly, Red Hat will no longer provide image or ostree updates, Critical or Important security patches, or Urgent Priority bug fixes for Red Hat Enterprise Linux Atomic Host after August 6, 2020.

We encourage customers to migrate to the most recent version of Red Hat Enterprise Linux that is supported for their environment. As a benefit of the Red Hat subscription model, customers can use their active subscriptions to entitle any system on any currently supported Red Hat Enterprise Linux release. Customers who wish to deploy containers as part of their production are encouraged to evaluate Red Hat OpenShift Container Platform migrate to a supported version of Red Hat Enterprise Linux.

Extras for some architectures and the rhel7-aarch64 image are discontinued

No more Extras content for the POWER9, IBM System z (Structure A), and the 64-bit ARM architectures will be pushed. The Extras content for RHEL architectures, such as AMD64 and Intel 64, the little-endian variant of IBM Power Systems, and IBM Z, remain supported for the duration of support of RHEL7. The rhel7-aarch64 image will not be updated to 7.7.

Rootless containers are available as a technology preview

Rootless containers are containers that are created and managed by regular system users without administrative permissions. This allows users to maintain their identity, including such things as credentials to container registries.

You can try rootless containers using the podman and buildah commands. For further information:

podman, buildah, and scopeo are now available on RHEL Workstation

The podman, buildah, and scopeo tools are available on RHEL 7.7 Workstation. Only UBI images are supported.

See also the RHEL 7.7 Release Notes.

docker-latest no longer available

The docker-latest package is no longer available beginning with RHEL Atomic 7.6.6. Only the docker package is available.

Red Hat Universal Base Images (UBI) are now available

With RHEL Atomic Host 7.6.4, Red Hat Universal Base Images (UBI) are newly available. For now, these UBIs are available: ubi7-init, ubi7-minimal, and ubi7, which are intended to substitute the rhel7-init, rhel7-atomic, and rhel-server images.

Additionally, a set of UBIs is now available that are intended to substitute some of the images currently provided through Red Hat Software Collections.

Unlike older Red Hat images, UBIs are freely redistributable. This means they can be used in any environment and shared anywhere. You can use them even if you are not a Red Hat customer.

For UBI documentation, see Using Red Hat Universal Base Images (standard, minimal, and runtimes).

Podman is now fully supported

With this update, the podman tool has been upgraded from Technology Preview to a fully supported feature.

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods.

For podman documentation, see Using podman to work with containers.

Selected roles of Red Hat Enterprise Linux System Roles are now fully supported

Red Hat Enterprise Linux System Roles have been previously available as a Technology Preview. With this update, the selinux, kdump, network, and timesync roles have been upgraded from Technology Previews to fully supported features. The postfix role continues to be available as a Technology Preview.

RHEL 7.6 Container Image now available for aarch64

The Red Hat Enterprise Linux 7.6 Container Image for the 64-bit ARM architecture is now available. This image is not architecture-aware. To install it, use the following package name:

rhel-server-aarch64-container

instead of the package name for other architectures:

rhel-server-container

Other 64-bit ARM architecture packages will use the same naming convention.

Buildah is now part of the default install

With RHEL Atomic Host 7.5.4, Buildah is part of the default installation. You no longer need to install it using package layering.

L1 Terminal Fault Attack vulnerability fixed in a new 7.5.3 image

The RHEL Atomic Host 7.5.3 image has been updated to include security fixes for the L1 Terminal Fault Attack vulnerability. For more information, see this article.

RHEL Atomic Host will not be supported on OpenShift 4.0 and later

Beginning with Red Hat OpenShift 4.0, RHEL Atomic Host will not be supported on Red Hat OpenShift.

Container images are now available for PowerPC 8 & 9 and s390x

Beginning with RHEL Atomic Host 7.5.3, many of the container images are available not only for AMD64 and Intel 64 (X86_64), but also for the little-endian variant of IBM Power Systems (PowerPC 8 & 9, also known as ppc64le) and IBM z Systems (s390x).

See Supported Architectures for Containers on RHEL if you need:

Distribution of architecture-specific base images will change in 7.6

Currently, the multi-architecture base OS images are available in the rhel7 repository and in the architecture-specific repository, for example rhel7/ppc64le. This will continue until RHEL Atomic Host 7.6.

With RHEL Atomic Host 7.6, base images for all architectures will be available in the rhel7 repository. When you pull the base image, the image for the correct architecture will be pulled automatically based on the architecture you are using. Users of the architecture-specific repositories will need to update the from line in dockerfiles.

Some users might not be able to access certain SRPMs using yum install

For architectures other than AMD64 and Intel 64 (X86_64), installing source RPMs from the Atomic Host and Extras channels is not possible using yum install. On the other hand, the source code is the same for all these architectures, and so is available using AMD64 and Intel 64 SRPMs.

However, depending on your customer subscription, you might not be able to yum install AMD64 and Intel 64 SRPMs. In that case, follow the instructions in How to obtain source for Red Hat products shipped as container images.

Also, if you only have IBM Power Systems (PowerPC 8 & 9, also known as ppc64le) or IBM z Systems (s390x) subscriptions, you might need to request source code for the microdnf package directly from Red Hat.

Distribution of architecture-specific base images will change in 7.6

Currently, the multi-architecture base OS images are available in the rhel7 repository and in the architecture-specific repository, for example rhel7/ppc64le. This will continue until RHEL Atomic Host 7.6.

With RHEL Atomic Host 7.6, base images for all architectures will be available in the rhel7 repository. When you pull the base image, the image for the correct architecture will be pulled automatically based on the architecture you are using. Users of the architecture-specific repositories will need to update the from line in dockerfiles.

overlay2 is now the default storage driver

The default storage driver for Docker has changed from devicemapper to overlay2. In existing installations of versions of Atomic Host prior to 7.5.0, devicemapper remains the default driver. Upgrading such existing installations does not change the configured driver.

For more information on the overlay2 driver and for instructions on switching from devicemapper to overlay2, see Using the Overlay Graph Driver.

Red Hat container registry will require authentication

In future, the Red Hat container registry will move from registry.access.redhat.com to registry.redhat.io. As part of this change, containers will eventually become available only to subscribed and authenticated systems.

For more information, see Red Hat Container Registry Authentication.

Buildah is now fully supported

The buildah tool has been upgraded from a Technology Preview to a fully supported feature.

The buildah tool facilitates building of OCI container images. It enables you to:

See Building container images with buildah for more information and usage instructions.

User namespaces in docker now fully supported

While the user namespaces features is fully supported beginning with the RHEL 7.4 kernel, the implementation of user namespaces associated with the docker service was a Technology Preview until RHEL Atomic Host 7.5. Now it is fully supported.

See User namespaces options for more information and usage instructions.

Manual setup of Kubernetes is deprecated

As announced earlier, beginning with RHEL 7.5 and RHEL Atomic Host 7.5 Red Hat will no longer support the manual setup of Kubernetes. Manual Kubernetes setups from previous releases, likewise, are not supported. Components impacted by this change include the following deprecated Kubernetes RPM packages, images, and associated documentation:

RPM Packages:

Container Images:

Documentation:

From now on, none of the software or documentation listed will be updated. For information on Red Hat’s officially supported Kubernetes-based products, see the following documentations sets:

docker-latest deprecated, to be removed later

The docker-latest version of Docker is still available, but is now deprecated. In a later release, it will be removed.

docker and docker-latest are now the same version (1.13)

docker and docker-latest are now the same version, which is 1.13.

ansible removed from the Extras channel

Ansible and its dependencies have been removed from the Extras channel. Instead, the Red Hat Ansible Engine product has been made available and will provide access to the official Ansible Engine channel. Customers who have previously installed Ansible and its dependencies from the Extras channel are advised to enable and update from the Ansible Engine channel, or uninstall the packages as future errata will not be provided from the Extras channel.

Ansible was previously provided in Extras (for AMD64 and Intel 64 architectures, and IBM POWER, little endian) as a runtime dependency of, and limited in support to, the Red Hat Enterprise Linux (RHEL) System Roles. Ansible Engine is available today for AMD64 and Intel 64 architectures, with IBM POWER, little endian availability coming soon.

Note that Ansible in the Extras channel was not a part of the Red Hat Enterprise Linux FIPS validation process.

The following packages have been deprecated from the Extras channel:

The python2-crypto, libtomcrypt, and libtommath packages are no longer needed as Ansible dependencies in the new Red Hat Ansible Engine product and will probably not be updated. Customers are advised to uninstall them.

For more information and guidance, see this Knowledgebase article.

Note that Red Hat Enterprise Linux System Roles, available as a Technology Preview, continue to be distributed through the Extras channel. Although Red Hat Enterprise Linux System Roles no longer depend on the ansible package, installing ansible from the Ansible Engine repository is still needed to run playbooks that use Red Hat Enterprise Linux System Roles.

docker and docker-latest are now the same version

In RHEL Atomic Host 7.4.5, docker and docker-latest are both version 1.13.1. In RHEL Atomic Host 7.5.0, docker-latest will be available, but deprecated. In a later version of RHEL Atomic Host, docker-latest will be removed.

ansible deprecated in the Extras channel

Ansible and its dependencies are no longer updated through the Extras channel. For more information, see the 7.5.0 release note about Ansible removal.

Enhanced documentation for buildah

Enhanced coverage of the buildah command describes several new features, including how to build containers from scratch. See Building container images with Buildah.

The rpm-ostree command now has several new features. The most notable of them:

have been documented in Package Layering.

For other new rpm-ostree features, see the upstream rpm-ostree release notes.

RHEL Tools Container image is now much smaller

The size of the RHEL Tools Container image (rhel-tools) has been reduced from about 1400MB to about 400MB. These changes took place:

The oci-umount package, which was previously shipped as a subpackage of docker, is now shipped separately.

The oci-umount package provides an OCI hook program. If you add it to the runc JSON data file as a hook, runc will execute the application after the container process is created, but before it is executed, with a prestart flag. Docker adds the oci-umount as a container hook to the runc configuration when it is installed in the $HOOKSDIR directory. To modify the list of file systems to umount, edit the /etc/oci-umount.conf file.

Limited support for containers on little-endian IBM power systems

Now containers have limited support on the little-endian variant of IBM power Systems (PPCle). See the Supported Architectures for Containers on RHEL for details.

Notably, packages from the Extras channel are now provided for the little-endian variant of IBM power Systems, along with the rhel7-ppc64le base container. This enables using containers on these systems with Red Hat Enterprise Linux 7.4.

overlay2 storage driver now available

The overlay2 graph driver has been upgraded from a Technology Preview to a fully supported feature.

The overlay2 graph driver, along with overlay, uses OverlayFS, a copy-on-write union file system that features page-cache sharing between containers. However, overlay2 is the more performant option.

To enable the driver, specify overlay2 in the /etc/sysconfig/docker-storage-setup file:

STORAGE_DRIVER=overlay2

OverlayFS now can be run with SELinux enforced

Previously, SELinux had to be in permissive or disabled mode for OverlayFS to work. Now you can run the OverlayFS file system with SELinux in enforcing mode.

For more information on OverlayFS, see Overlay Graph Driver.

SSSD in a container is now fully supported

The System Security Services Daemon (SSSD) in a container has been upgraded from a Technology Preview to a fully supported feature.

SSSD allows Red Hat Enterprise Linux Atomic Host authentication subsystem to be connected to central identity providers such as Red Hat Identity Management and Microsoft Active Directory.

To install this new image, use the atomic install rhel7/sssd command.

For full documentation on SSSD, see Configuring SSSD.

Package layering is now fully supported

The pkg-add subcommand of the rpm-ostree tool has been upgraded from a Technology Preview to a fully supported feature.

The rpm-ostree install commands installs layered packages that are persistent across reboots. This command can be used to install individual packages that are not part of the original OSTree, such as diagnostics tools. For detailed information about package layering, see Package Layering.

Image signing is now fully supported

The image signing and validation functionality has been upgraded from a Technology Preview to a fully supported feature.

Signing container images on RHEL and RHEL Atomic Host systems provides a means of validating where a container image came from, checking that the image has not been tampered with, and setting policies to determine which validated images you will allow to use on your systems.

The main image signing tasks can be done as follows:

For the current release, image signing is only supported when pushing and pulling between Docker v2 registries (such as the registry software included in the docker-distribution package) and the Docker Hub (docker.io).

To learn more about image signing, see Image Signing.

GPG verification changes for OSTree commits

For new installations of RHEL Atomic Host 7.4.0 and later, the GPG verification of OSTree commits is enabled by default. If you upgrade from RHEL Atomic Host 7.3, you can enable GPG verification manually.

To enable GPG verification, set the gpg-verify directive in the /etc/ostree/remotes.d/redhat.conf file to true.

If GPG verification is enabled, the output of the atomic host status command shows information about the GPG signature of the commit.

docker-storage-setup renamed to container-storage-setup

The docker-storage-setup utility has been renamed to container-storage-setup for RHEL7.4 and RHEL Atomic Host 7.4. Note that:

Red Hat Enterprise Linux 6 Init Container Image is now available

The new Red Hat Enterprise Linux 6 Init Image allows creating containerized services based on RHEL6 init scripts. This container image enables running one or more services in a RHEL6 user space using init scripts.

For details on using rhev6-init, see Using the Atomic RHEL6 Init Container Image in the Managing Containers Guide.

Red Hat Enterprise Linux 7 Init Container Image is now available

The new Red Hat Enterprise Linux 7 Init Image allows creating containerized services based on the systemd init system. This container image configures systemd in an OCI container and enables running one or more services in a RHEL7 user space using unit files, init scripts, or both.

For details on using rhev7-init, see Using the Atomic RHEL7 Init Container Image in the Managing Containers Guide.

Ability to generate initramfs on the client

By default, Atomic Host uses a generic initramfs image built on the server side. This is distinct from the yum-based Red Hat Enterprise Linux, where initramfs is generated for each installation. However, in some situations, additional configuration or content may need to be added, which requires generating initramfs on the client side.

With this update, the Atomic Host component rpm-ostree, which is used for updates of the host, has the new initramfs command. The new command allows generating initramfs on the client side using the dracut program.

For details on using rpm-ostree initramfs, see Generating the initramfs Image on the Client in the Installation and Configuration Guide.

The managed plugin API changed in docker-latest

In Docker 1.13, the managed plugin API changed compared to the experimental version introduced in Docker 1.12. Before upgrading to Docker 1.13, you must uninstall plugins that you installed with Docker 1.12. To uninstall plugins, use the docker plugin rm command.

If you have already upgraded to Docker 1.13 without uninstalling previously installed plugins, you may see this message when the Docker daemon starts:

Error starting daemon: json: cannot unmarshal string into Go value of type
types.PluginEnv

To resolve this problem:

MicroDNF

The microdnf package (microdnf-2-2.el7.1.1) contains a limited functionality package manager written in C. This minimal subscription-manager plugin implementation for microdnf does not enable any repositories by default. As a consequence, all repositories managed by subscription-manager are disabled in container. To enable the necessary repositories, use the --enablerepo option. For example:

    microdnf install --enablerepo rhel-7-server-rpms httpd

This way, you can install packages from repositories managed by subscription-manager by enabling them manually.

The microdnf package is added to the rhel-atomic minimal base image to replace the yum facility. It has a limited number of features from the dnf command that only allow you to enable or disable repositories, install and remove packages, and clean out cache. Run microdnf --help from inside of the rhel-atomic container to see all available options.

the etcd3 package has been deprecated

The etcd3 package and the Red Hat Enterprise Linux Atomic etcd3 Container Image have been deprecated and are no longer available in the Red Hat Enterprise Linux 7 Extras channel. Users that have the etcd3 component installed can update to etcd version 3.0.15 or later, which provides the same functionality and is backwards compatible with etcd3.

Cockpit has been rebased to version 126

Most notable changes:

new gomtree package

The gomtree packages contain a command-line tool and a Go library to support the mtree file system hierarchy validation tooling and format. The gomtree packages are necessary for the functionality of the atomic verify command.

skopeo-containers moved from atomic packages to skopeo packages

The skopeo-containers subpackage which contains configurations files for working with image signatures has now been moved to the skopeo package set.

A bug where docker push did not complete on NFS has been fixed

A regression was introduced in the docker registry 2.4 where file descriptors weren’t closed during blob uploads. This has caused image push failures when the registry was running on top of NFS file system. A new version of upstream docker registry is available with a fix to the leaking file descriptors. As a result, image pushes now succeed on NFS file systems.

*Standardizing labels for Docker-formatted containers"

*Red Hat is trying to standardize the use of Docker-formatted labels in its images. For details on that subject see: Using Labels In Container Images

Cockpit has been rebased to version 122

Most notable changes:

Features, previously available as a Technology Preview, are now fully supported

The following features that have been available as a Technology Preview are now fully supported:

Additionally, the openscap RPM available for Red Hat Enterprise Linux is also now fully supported.

System containers now available as a Technology Preview

System containers provide a way to containerize services that need to run before the docker daemon is running. They use different technologies than the Docker-formatted containers, ostree for storage, runc for runtime, skopeo for searching and systemd for service management. Previously, such services were provided in the system as packages, or as part of the ostree in Atomic Host and containerizing them makes the system itself smaller. Red Hat provides the etcd and flannel services as system containers.

Note that the new etcd system container image replaces the etcd Docker-formatted container that has been available until Red Hat Enterprise Linux Atomic Host 7.3. The new etcd3 container image provided with this release is a Docker-formatted image. For more information on system containers and how to run etcd and flannel, see Running System Containers.

Manual Kubernetes Cluster Configuration No Longer Supported

The Kubernetes software that is available in Red Hat Enterprise Linux and Red Hat Enterprise Linux Atomic Host is packaged and configured differently than the Kubernetes included in OpenShift. We recommend you use the OpenShift version of Kubernetes for permanent setups and production use. The procedure described in Get Started Orchestrating Containers with Kubernetes should only be used as a convenient way to try out Kubernetes on an all-in-one RHEL or RHEL Atomic Host system.

As of RHEL 7.3, support for the procedure for configuring a Kubernetes cluster (separate master and multiple nodes) directly on RHEL and RHEL Atomic Host has ended. For further details on Red Hat support for Kubernetes, see How are container orchestration tools supported with Red Hat Enterprise Linux?.

Cockpit features

There are several new Cockpit features in this release. Some of these features are:

rhevm-guest-agent

The rhevm-guest-agent container image is a Docker-formatted container that is used to run an agent inside of virtual machines on Red Hat Virtualization hosts. Communications between that agent and the Red Hat Virtualization Manager allows that manager to both monitor and change the state of the agent’s virtual machine.

For more information about RHEV Guest Agent, see the RHEV Guest Agent Container section in the Red Hat Enterprise Linux Atomic Host Managing Containers Guide.

docker-latest has been upgraded to version 1.12.1

The docker-latest packages are now version 1.12.1. The following article has been updated to reflect the changes Introducing docker-latest for RHEL 7 and RHEL Atomic Host.

docker 1.12 uses runc as a runtime environment

Since docker version 1.11, runc is used instead of libcontainer for container runtime. The docker-latest packages contain 1.12, and runc can be found in /usr/libexec/docker/docker-runc. However, docker-runc is for internal use only by docker. If you want to use the runc command, you still need the runc package installed on your system. For RHEL Atomic Host, it is part of the OSTree by default, and for Red Hat Enterprise Linux 7, it is available as a separate package.

docker swarm is now available

As of 1.12 release, the upstream Docker project has embedded Docker Swarm in the docker binary. To avoid any unintended bugs, Red Hat has chosen to include Swarm as an unsupported add-on. For container orchestration, Red Hat recommends OpenShift and Kubernetes.

Containerized core Kubernetes master services coming in 7.3 release

The Red Hat Enterprise Linux Atomic Host build will be further optimized for size and improved flexibility of Kubernetes version management starting with the 7.3 release. The core Kubernetes masters services (kube-apiserver, kube-controller-manager and kube-scheduler) will be installed as containers after Atomic Host is booted. Instructions on migrating to a containerized Kubernetes are available here and users should prepare for this in advance.

Cockpit has been rebased to version 0.114

Most notable changes:

ostree admin unlock command now available

Red Hat Enterprise Linux Atomic Host 7.2.5 introduces the new command ostree admin unlock. It allows users to unlock the current ostree deployment and install packages temporarily. This is done by mounting a writable overlayfs on /usr. When a user reboots, the overlayfs is unmounted and the packages are no longer installed. Use the ostree admin unlock --hotfix option for the changes, such as package installs to persist across reboots. This command provides the same capabilities as atomic-pkglayer, which is now deprecated. There are known issues with overlayfs and SELinux, so this functionality is not intended for long term use.

Strict browser security policy for Cockpit is now enforced

This defines what code can be run in a Cockpit session and mitigates a number of browser-based attacks.

Beginning with the Atomic Host 7.2.4 release, two versions of the docker service will be included in the operating system: docker 1.9 and docker 1.10.

The following Knowledgebase article contains all information you need to know about using these two versions of docker: https://access.redhat.com/articles/2317361.

Introduced conflict between docker 1.9 and atomic-openshift 3.1 / origin 1.1 has been removed

Previously, due to stability issues between docker 1.9 and atomic-openshift 3.1 / origin 1.1, docker 1.9 has been packaged to conflict with atomic-openshift versions older than 3.2 and origin versions older than 1.2. As a consequence, running yum update on an OpenShift Enterprise 3.1 system failed due to that introduced conflict. This bug has been fixed, and running yum update now does not cause conflicts, successfully solves the dependencies and installs docker 1.9.

Updated kubernetes packages

Kubernetes updated to ose v3.2.0.16 corresponding to Kubernetes v1.2.0. Additionally, support for exposing secret keys in environment variables introduced.

Cockpit has been rebased to version 0.103

Most notable changes:

Cockpit has been rebased to version 0.96

Cockpit packages that are part of Red Hat Enterprise Linux Atomic Host 7.2.3 include cockpit-bridge, cockpit-shell, cockpit-docker, and cockpit-ostree. Other cockpit-related software can be added to a Red Hat Enterprise Linux Atomic Host via containers (such as the rhel7/cockpit-ws container). Cockpit 0.96 is compatible with docker 1.10.

This version fixes previous bugs with memory leaks, mostly related to DBus, and various navigation and connection issues. Also, you can now limit concurrent authentication similar to ssshd using the MaxStartups setting.

New sub-commands added to the atomic CLI

The atomic command-line tool for managing Atomic systems and containers now includes the "top", "diff" and "migrate" sub-commands. For more information on the syntax and usage, see https://access.redhat.com/documentation/en/red-hat-enterprise-linux-atomic-host/version-7/cli-reference/#cli_commands.

Support for customization of the host system

The new atomic-pkglayer packages contain a tool to install debug packages on Atomic Host systems. It is intended only for use inside the Red Hat Enterprise Linux Atomic Tools container image (rhel7/rhel-tools). It provides a mechanism to add RPM packages to an Atomic Host by allowing you to include them in local ostree layers on the existing system. See Installing RPMs on an Atomic Host with atomic-pkglayer for a description of the atomic-pkglayer tool.

The v1beta3 API is no longer supported in kubernetes

Using v1beta3 in configuration files is no longer supported. Creating a v1beta3-style object with the kubectl command will fail with the following error:

error validating data: the server could not find the requested resource; if you choose to ignore these errors, turn validation off with --validate=false

Using the --validate=false option will create an object, but the object will appear as a v1 object instead.

A separate cockpit-docker subpackage is now shipped

Previously, the Cockpit docker support was shipped with the cockpit-shell subpackage. Now, the cockpit-docker subpackage is available to be installed separately on Red Hat Enterprise Linux and is included in the OSTree available for RHEL Atomic Host.

Cockpit has been rebased to version 0.93

Most notable changes:

docker has been upgraded to version 1.8.2

Notable changes:

flannel has been upgraded to version 0.5.3

Notable changes:

Cockpit has been rebased to version 0.77

Notable changes:

Removed systemd socket activation

For security reasons, systemd socket activation, which was supported in earlier versions of docker, has been removed. Now, it is not recommended to use the docker group as a mechanism for talking to the docker daemon as a non-privileged user. Instead, set up sudo for this type of access. If the docker daemon is not running after the upgrade, create the /etc/sysconfig/docker.rpmnew file, add any local customization to it and replace /etc/sysconfig/docker with it. Additionally, remove the -H fd:// line from /etc/sysconfig/docker if it is present.