Affected by GO-2022-0390
and 11 other vulnerabilities
GO-2022-0390: Moby (Docker Engine) started with non-empty inheritable Linux process capabilities in github.com/docker/docker
GO-2022-0985: Docker supplementary group permissions not set up properly, allowing attackers to bypass primary group restrictions in github.com/docker/docker
GO-2022-1107: Container build can leak any path on the host into the container in github.com/docker/docker
GO-2024-2521: Moby Docker cp broken with debian containers in github.com/docker/docker
GO-2024-2913: Unexpected chmod of host files via 'docker cp' in Moby Docker Engine in github.com/docker/docker
GO-2024-2914: Moby (Docker Engine) is vulnerable to Ambiguous OCI manifest parsing in github.com/docker/docker
GO-2025-3829: Moby firewalld reload removes bridge network isolation in github.com/docker/docker
GO-2026-4883: Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/docker
GO-2026-4887: Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker
GO-2026-5617: Docker: Race condition in docker cp allows bind mount redirection to host path in github.com/docker/docker
GO-2026-5668: Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap in github.com/docker/docker
GO-2026-5746: Docker: `PUT /containers/{id}/archive` executes container binary on the host in github.com/docker/docker
ApplyLayer parses a diff in the standard layer format from `layer`, and
applies it to the directory `dest`. Returns the size in bytes of the
contents of the layer.
CopyFileWithTar emulates the behavior of the 'cp' command-line
for a single file. It copies a regular file from path `src` to
path `dst`, and preserves all its metadata.
If `dst` ends with a trailing slash '/' ('\' on Windows), the final
destination path will be `dst/base(src)` or `dst\base(src)`
CopyWithTar creates a tar archive of filesystem path `src`, and
unpacks it at filesystem path `dst`.
The archive is streamed directly with fixed buffering and no
intermediary disk IO.
TarUntar is a convenience function which calls Tar and Untar, with the output of one piped into the other.
If either Tar or Untar fails, TarUntar aborts and returns the error.
Untar reads a stream of bytes from `archive`, parses it as a tar archive,
and unpacks it into the directory at `dest`.
The archive may be compressed with one of the following algorithms: