---
schema_version: 1
route: /t/docker.md
tool: "docker"
---

# sincecutoff.com /t/docker — Docker Engine and CLI

- name: Docker Engine and CLI
- kind: cli
- children: none
- homepage: <https://docs.docker.com/>

Changes to the tools coding agents drive, since a model's training cutoff, each linked to its first-party source. Check installed versions and limitations before acting; a cutoff date does not establish what a model knows.
Original editorial content: [Apache 2.0](https://sincecutoff.com/v1/data-license.txt), by [0xPatrick](https://0xpatrick.dev). Preserve applicable license and [NOTICE](https://sincecutoff.com/notice.txt) attribution when redistributing. Third-party source text and examples retain their own rights. [License scope and attribution](https://sincecutoff.com/v1/license.json).
To stay current, read the changes feed: [`/v1/changes.md?tool=docker`](https://sincecutoff.com/v1/changes.md?tool=docker) (or `.json`), adding `since=YYYY-MM-DD` for your training cutoff. Entries for registered children are included; the registry itself is `/v1/tools.json`. How to page and save your place: [llms.txt](https://sincecutoff.com/llms.txt).

### docker create/run supports container process umask (2026-09-03)
- slug: docker-create-run-supports-container-process-umask-8551306d57bb
- score: 0.91

How to use it:

When creating or running a container, set its process umask with `--umask <octal>`; the value applies to the entrypoint and, when honored by the OCI runtime, to `docker exec` processes and healthchecks.

Examples:

```
docker run --rm --umask 077 <image> <command> [<arg>...]
```

```
docker create --umask 077 <image> [<command> [<arg>...]]
```

- why_it_matters: Set a container process umask when creating or running a container.
- sources: <https://github.com/moby/moby/releases/tag/docker-v29.8.0>, <https://docs.docker.com/reference/cli/docker/container/run/>, <https://docs.docker.com/reference/cli/docker/container/create/>
- gotchas: "Version: 29.8.0"; "--umask <octal>: Sets the container process umask in octal notation; leading zeros are optional. Without it, the OCI runtime applies its default. The create reference lists this option as API 1.56+."; "IMAGE (required): Image used to create or run the container."; "Prerequisite: The `docker create` reference marks `--umask` as requiring API 1.56+."; "Docs conflict: The release note describes the umask as applying to execs and healthchecks. Docker's run documentation qualifies this: OCI runtime support determines whether it is honored; it says runc honors it for execs and healthchecks."

### Docker Engine API adds image attestations endpoint (2026-06-18)
- slug: docker-engine-api-adds-image-attestations-endpoint-49ef666c5907
- score: 0.94

How to use it:

When reviewing an image’s supply-chain metadata, call the Docker Engine API endpoint to retrieve its in-toto attestations. Set `statement=true` to include verbatim statement bodies; optionally select a platform or filter by predicate type.

Examples:

```
curl --unix-socket /var/run/docker.sock 'http://localhost/v1.55/images/<image>/attestations?statement=true'
```

- why_it_matters: Retrieve in-toto attestation statements attached to an image when reviewing its supply-chain metadata.
- sources: <https://github.com/moby/moby/releases/tag/docker-v29.6.0>, <https://docs.docker.com/reference/api/engine/>, <https://docs.docker.com/reference/api/engine/version/v1.56/>, <https://github.com/moby/moby/blob/docker-v29.6.0/api/docs/CHANGELOG.md>
- gotchas: "Version: 29.6.0"; "name (required): Image name or ID in the endpoint path."; "platform: JSON-encoded OCI platform selecting the image variant; defaults to the daemon’s host platform. Repeatable in the API declaration, but only one value is currently accepted."; "type: In-toto predicate type URI filter. May be repeated; if omitted, all statements are returned."; "statement: Boolean, default `false`. When true, include each verbatim in-toto statement body; otherwise return only its descriptor and predicate type without reading statement blobs."; "Prerequisite: Use Engine API v1.55 or later; the endpoint was added in v1.55."; "Prerequisite: The legacy graphdriver image store does not support attestations and returns HTTP 501."; "Statements include examples such as SLSA provenance and SPDX SBOM."

### Docker local logging driver supports custom attributes (2026-05-14)
- slug: docker-local-logging-driver-supports-custom-attributes-d61274350eb2
- score: 0.90

How to use it:

When creating a container with Docker Engine 29.5.0 or later, use the `local` logging driver and specify the label, environment, or tag options to include custom log attributes.

Examples:

```
docker run -d --name <container> --env=<KEY>=<VALUE> --label=<KEY>=<VALUE> --log-driver=local --log-opt env=<KEY> --log-opt labels=<KEY> --log-opt labels-regex=<REGEX> --log-opt 'tag=<TEMPLATE>' <image>
```

- why_it_matters: Configure a container to use the local logging driver with custom log attributes.
- sources: <https://github.com/moby/moby/releases/tag/docker-v29.5.0>, <https://github.com/moby/moby/pull/52348>, <https://docs.docker.com/engine/logging/drivers/local/>
- gotchas: "Version: 29.5.0"; "--log-driver=local (required): Select the local logging driver."; "--log-opt labels=<KEY>[,<KEY>...]: Include the named container labels in log attributes. The release note calls this option `label`; the merged example uses `labels`."; "--log-opt labels-regex=<REGEX>: Include container labels matching the regular expression. The release note calls this option `label-regex`; the merged example uses `labels-regex`."; "--log-opt env=<KEY>[,<KEY>...]: Include the named container environment variables in log attributes."; "--log-opt env-regex=<REGEX>: Include environment variables matching the regular expression."; "--log-opt tag=<TEMPLATE>: Set the log tag using a template; the merged example uses `{{.ID}}`."; "--env=<KEY>=<VALUE>: Set a container environment variable that can be selected for log attributes."; "--label=<KEY>=<VALUE>: Set a container label that can be selected for log attributes."; "Prerequisite: Docker Engine 29.5.0 or later; this support was included in the 29.5.0 release."; "Docs conflict: The release note names `label` and `label-regex`; the merged PR's runnable example and official Docker logging option documentation use `labels` and `labels-regex`. Use the documented plural spellings."

### Docker `--mount` bind mounts accept `bind-create-src` (2026-03-05)
- slug: docker-mount-bind-mounts-accept-bind-create-src-3222c44a6ee5
- score: 0.96

How to use it:

When creating a bind mount whose source directory may not exist, add the `bind-create-src` option to `docker run --mount`. Docker creates the source directory on the daemon host if needed.

Examples:

```
docker run --mount type=bind,source=<host-path>,target=<container-path>,bind-create-src <image> [command...]
```

- why_it_matters: Create a bind mount whose source directory may not exist yet.
- before: Without `bind-create-src`, `--mount` returns an error when the source path does not exist on the daemon host.
- sources: <https://github.com/moby/moby/releases/tag/docker-v29.3.0>, <https://docs.docker.com/engine/storage/bind-mounts/>
- gotchas: "Version: 29.3.0"; "type=bind (required): Selects a bind mount."; "source (or src)=<host-path> (required): Host path to mount; can be absolute or relative."; "target (or dst, destination)=<container-path> (required): Absolute path where the mount appears in the container."; "bind-create-src: Creates the source directory on the daemon host if it does not exist."; "Prerequisite: The source path is on the Docker daemon host. With a remote daemon, this does not create a path on the client machine."