moby/moby
The Moby Project - a collaborative project for the container ecosystem to assemble container-based systems
How moby is put together
Moby is the upstream codebase for Docker Engine and related container tooling, written almost entirely in Go. It is organized as a multi-module repository: a root module (github.com/moby/moby/v2) that builds the engine binaries, plus independently versioned 'api' (shared API types and the swagger.yaml contract) and 'client' (Go SDK for the Docker Engine HTTP API) modules. Data flow: clients issue HTTP requests against the Engine's REST-style API (container/image/network/swarm/plugin endpoints), which the engine services via containerd, BuildKit, SwarmKit, and OS primitives (Linux namespaces/cgroups, Windows HCS). The client package wraps each endpoint in typed methods with per-call option structs and decodes JSON responses into api/types structures.
Languages
Frameworks
Datastores
Infrastructure
Major components
client (github.com/moby/moby/client)
Go SDK exposing typed methods for every Docker Engine API endpoint (containers, images, networks, volumes, plugins, swarm objects) with option/result structs and mock-testable transport.
api (github.com/moby/moby/api)
Shared API types and the canonical swagger.yaml specification consumed by both client and server.
Root engine module (github.com/moby/moby/v2)
The engine codebase producing daemon binaries; not intended for import as a library and carries no API stability guarantees.
Container lifecycle client APIs
Create/start/stop/kill/exec/attach/stats/logs/copy/wait operations for containers, including hijacked streaming connections (client/hijack.go).
Image & build client APIs
Pull/push/import/save/load/tag/build/prune plus attestations handling for images and builds.
Swarm orchestration client APIs
Node, service, task, config, and secret management calls against the swarm-mode control plane (e.g., ConfigCreate/ConfigInspect).
Network client APIs
Network create/connect/disconnect/list/prune operations backed by libnetwork-style drivers.
man (github.com/docker/docker/man)
Generates manual pages from markdown using cpuguy83/go-md2man.
A quieter week centered on routine dependency updates plus a small clarity fix in daemon info output.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A quieter week centered on routine dependency updates plus a small clarity fix in daemon info output.
Week of 2026-08-17
A busy week with 48 commits: image size reporting improved, the API bumped to 1.56, and many dependencies upgraded.
Week of 2026-08-10
Security hardening against path traversal via checkpoint IDs, major cleanup of the containerd supervisor internals, and a Go update led the week.
Week of 2026-08-03
Networking got attention this week: a data race fix in NetworkDB, new Swarm service tests, and safer publishing of images using OIDC.
Week of 2026-07-27
The busiest week (95 commits) featured a patch release prep (v29.7.1), extensive API documentation syncing, and broad internal cleanup.
Over the past month, Docker Engine development (moby/moby) focused heavily on internal cleanups—simplifying how the embedded containerd supervisor works, removing legacy code paths, and upgrading dozens of dependencies. Security and correctness fixes shipped too, including protection against checkpoint ID path traversal, a NetworkDB DNS race fix, and clearer documentation for API behavior changes as the API version moved to 1.56 ahead of a v29.8.0 release milestone. Routine maintenance like CI updates, test reliability fixes, and dependency bumps continued throughout.
Week by week
2026-08-24A quieter week centered on routine dependency updates plus a small clarity fix in daemon info output.latest3 changes
Fix
Clearer notice about embedded containerd fallback
The 'docker info' command now explains more clearly when Docker falls back to its built-in containerd runtime.
Chore
Dependency updates across AWS, swarmkit, and CI tools
Automated updates bumped libraries like aws/smithy-go and refreshed build and security-scanning actions.
Refactor
Supervisor cleanup merged
Internal cleanup of the containerd supervisor component landed as part of ongoing simplification work.
2026-08-17A busy week with 48 commits: image size reporting improved, the API bumped to 1.56, and many dependencies upgraded.6 changes
Feature
More accurate image size in inspect
'docker inspect' now includes unpacked layer usage when reporting an image's size on containerd-backed setups.
Chore
API version bumped to 1.56
The Docker Engine's programmatic interface version was raised to prepare for upcoming features.
Fix
Swarm DNS no longer returns spurious errors
A fix in the networking database prevents incorrect 'name not found' responses in Swarm mode.
Chore
Go and containerd updated
The project moved to Go 1.26.7 and containerd v2.3.4 to pick up bug fixes and improvements.
Refactor
Removed OpenCensus tracing bridge
Older tracing instrumentation was removed in favor of the newer OpenTelemetry standard.
Fix
Checkpoint ID validation tightened
Checkpoint IDs are now sanitized to prevent unsafe characters from being used.
2026-08-10Security hardening against path traversal via checkpoint IDs, major cleanup of the containerd supervisor internals, and a Go update led the week.6 changes
Fix
Checkpoint ID path traversal prevented
A vulnerability allowing crafted checkpoint names to escape their storage folder was closed, with docs explaining behavior in older APIs.
Refactor
Containerd supervisor simplified
The component that manages Docker's built-in containerd was rewritten to use a simpler concrete type with clearer startup and shutdown handling.
Refactor
Embedded daemon code cleaned up
Internal configuration and logging in the bundled containerd setup were streamlined and made less error-prone.
Chore
Updated to Go 1.26.6
The programming language runtime used to build Docker was refreshed for stability fixes.
Chore
CI moved to Ubuntu 26.04 runners
Continuous integration testing now runs on a newer Ubuntu base image.
Chore
Batch of library upgrades
Core libraries for networking, compression, and cryptography were all brought up to current versions.
2026-08-03Networking got attention this week: a data race fix in NetworkDB, new Swarm service tests, and safer publishing of images using OIDC.6 changes
Fix
Fixed data race in NetworkDB node leaving state
A concurrency bug that could corrupt cluster networking state under stress was corrected, with new convergence tests added.
Chore
New Swarm service mesh tests
Automated tests now verify that service virtual IPs keep working correctly during rolling updates.
Refactor
Dropped legacy network scope fallback
An outdated compatibility path in network handling was removed to simplify the codebase.
Chore
Secure publishing to Docker Hub via OIDC
The automated image-publishing pipeline now uses short-lived credentials instead of long-lived tokens.
Chore
Flaky Windows health check test fixed
An unreliable test that intermittently failed on Windows was stabilized.
Chore
Dependency refreshes
OpenTelemetry, gRPC, rootlesskit, and other core libraries were updated to newer releases.
2026-07-27The busiest week (95 commits) featured a patch release prep (v29.7.1), extensive API documentation syncing, and broad internal cleanup.6 changes
Docs
API documentation synced across versions
Documentation for every API release from 1.25 through 1.55 was brought up to date, including documenting address formats.
Chore
Version set to 29.7.1 and milestone planned
The next patch release was prepared while the following milestone was bumped to v29.8.0.
Chore
Security test re-enabled and flaky tests fixed
A previously skipped symlink-escape build test was unskipped, and an unreliable container-stop timeout test was repaired.
Fix
Windows containerd network stats fixed
Network statistics collection for containers running on Windows with containerd was corrected.
Refactor
Events subscription made safer
Cancelling event subscriptions is now safe to call multiple times, avoiding crashes from duplicate cancels.
Chore
Wide dependency updates
gRPC, go-archive, docker client, and several GitHub Actions were upgraded throughout the week.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required