Docker 28.3.3 (#23183)

<!--Delete sections as needed -->

## Description

<!-- Tell us what you did and why -->

## Related issues or tickets

<!-- Related issues, pull requests, or Jira tickets -->

## Reviews

<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->

- [ ] Technical review
- [ ] Editorial review
- [ ] Product review

---------

Signed-off-by: Paweł Gronowski <[email protected]>
Co-authored-by: Arthur <[email protected]>

Author: vvoland

_vendor/modules.txt

@@ -1,7 +1,7 @@
-# github.com/moby/moby v28.3.2+incompatible
+# github.com/moby/moby v28.3.3+incompatible
 # github.com/moby/buildkit v0.23.2
 # github.com/docker/buildx v0.26.1
-# github.com/docker/cli v28.3.3-0.20250711132746-c69d8bde4adc+incompatible
+# github.com/docker/cli v28.3.3+incompatible
 # github.com/docker/compose/v2 v2.39.1
 # github.com/docker/model-cli v0.1.33-0.20250703103301-d4e4936a9eb2
 # github.com/docker/scout-cli v1.18.1

content/manuals/engine/release-notes/28.md

@@ -23,6 +23,25 @@ For more information about:
 - Deprecated and removed features, see [Deprecated Engine Features](../deprecated.md).
 - Changes to the Engine API, see [Engine API version history](/reference/api/engine/version-history.md).
 
+## 28.3.3
+
+{{< release-date date="2025-07-29" >}}
+
+For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
+
+- [docker/cli, 28.3.3 milestone](https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.3.3)
+- [moby/moby, 28.3.3 milestone](https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.3.3)
+
+### Security
+
+This release fixes an issue where, after a firewalld reload, published container ports could be accessed directly from the local network, even when they were intended to be accessible only via a loopback address. [CVE-2025-54388](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54388) /  [GHSA-x4rx-4gw3-53p4](https://github.com/moby/moby/security/advisories/GHSA-x4rx-4gw3-53p4) / [moby/moby#50506](https://github.com/moby/moby/pull/50506).
+
+### Packaging updates
+
+- Update Buildx to [v0.26.1](https://github.com/docker/buildx/releases/tag/v0.26.1). [docker/docker-ce-packaging#1230](https://github.com/docker/docker-ce-packaging/pull/1230)
+- Update Compose to [v2.39.1](https://github.com/docker/compose/releases/tag/v2.39.1). [docker/docker-ce-packaging#1234](https://github.com/docker/docker-ce-packaging/pull/1234)
+- Update Docker Model CLI plugin to [v0.1.36](https://github.com/docker/model-cli/releases/tag/v0.1.36). [docker/docker-ce-packaging#1233](https://github.com/docker/docker-ce-packaging/pull/1233)
+
 ## 28.3.2
 
 {{< release-date date="2025-07-09" >}}
@@ -723,3 +742,4 @@ For a full list of pull requests and changes in this release, refer to the relev
 - `pkg/directory.Size()` function is deprecated, and will be removed in the next release. [moby/moby#48057](https://github.com/moby/moby/pull/48057)
 - `registry`: Deprecate `APIEndpoint.TrimHostName`; hostname is now trimmed unconditionally for remote names. This field will be removed in the next release. [moby/moby#49005](https://github.com/moby/moby/pull/49005)
 - `allow-nondistributable-artifacts` field in `daemon.json`. Setting either option will no longer take effect, but a deprecation warning log is added to raise awareness about the deprecation. This warning is planned to become an error in the next release. [moby/moby#49065](https://github.com/moby/moby/pull/49065)
+

content/reference/api/engine/_index.md

@@ -73,21 +73,21 @@ To see the highest version of the API your Docker daemon and client support, use
 ```console
 $ docker version
 Client: Docker Engine - Community
- Version:           28.3.2
+ Version:           28.3.3
  API version:       1.51
  Go version:        go1.24.5
- Git commit:        578ccf6
- Built:             Wed Jul  9 16:13:45 2025
+ Git commit:        980b856
+ Built:             Fri Jul 25 11:34:09 2025
  OS/Arch:           linux/amd64
  Context:           default
 
 Server: Docker Engine - Community
  Engine:
-  Version:          28.3.2
+  Version:          28.3.3
   API version:      1.51 (minimum version 1.24)
   Go version:       go1.24.5
-  Git commit:       e77ff99
-  Built:            Wed Jul  9 16:13:45 2025
+  Git commit:       bea959c
+  Built:            Fri Jul 25 11:34:09 2025
   OS/Arch:          linux/amd64
   ...
 ```

go.mod

@@ -4,20 +4,20 @@ go 1.24.0
 
 require (
 	github.com/docker/buildx v0.26.1 // indirect
-	github.com/docker/cli v28.3.3-0.20250711132746-c69d8bde4adc+incompatible // indirect
+	github.com/docker/cli v28.3.3+incompatible // indirect
 	github.com/docker/compose/v2 v2.39.1 // indirect
 	github.com/docker/model-cli v0.1.33-0.20250703103301-d4e4936a9eb2 // indirect
 	github.com/docker/scout-cli v1.18.1 // indirect
 	github.com/moby/buildkit v0.23.2 // indirect
-	github.com/moby/moby v28.3.2+incompatible // indirect
+	github.com/moby/moby v28.3.3+incompatible // indirect
 )
 
 replace (
 	github.com/docker/buildx => github.com/docker/buildx v0.26.1
-	github.com/docker/cli => github.com/docker/cli v28.3.3-0.20250711132746-c69d8bde4adc+incompatible
+	github.com/docker/cli => github.com/docker/cli v28.3.3+incompatible
 	github.com/docker/compose/v2 => github.com/docker/compose/v2 v2.39.1
 	github.com/docker/model-cli => github.com/docker/model-cli v0.1.33-0.20250703103301-d4e4936a9eb2
 	github.com/docker/scout-cli => github.com/docker/scout-cli v1.18.1
 	github.com/moby/buildkit => github.com/moby/buildkit v0.23.2
-	github.com/moby/moby => github.com/moby/moby v28.3.2+incompatible
+	github.com/moby/moby => github.com/moby/moby v28.3.3+incompatible
 )

go.sum

@@ -40,6 +40,8 @@ github.com/docker/cli v28.3.0+incompatible h1:s+ttruVLhB5ayeuf2BciwDVxYdKi+RoUlx
 github.com/docker/cli v28.3.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/cli v28.3.3-0.20250711132746-c69d8bde4adc+incompatible h1:5I561JBDi4n0RKxYNkUVc9xiLnlCfjjm31XRV0r3o98=
 github.com/docker/cli v28.3.3-0.20250711132746-c69d8bde4adc+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v28.3.3+incompatible h1:fp9ZHAr1WWPGdIWBM1b3zLtgCF+83gRdVMTJsUeiyAo=
+github.com/docker/cli v28.3.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/compose/v2 v2.36.2 h1:rxk1PUUbhbAS6HkGsYo9xUmMBpKtVwFMNCQjE4+i5fk=
 github.com/docker/compose/v2 v2.36.2/go.mod h1:mZygkne+MAMu/e1B28PBFmG0Z0WefbxZ/IpcjSFdrw8=
 github.com/docker/compose/v2 v2.37.0 h1:R8Yik9ssiRz7T9BRfdOZy0xHDzOFPIJX40DrxzJ62dQ=
@@ -160,6 +162,8 @@ github.com/moby/moby v28.3.0+incompatible h1:BnZpCciB9dCnfNC+MerxqsHV4I6/gLiZIzz
 github.com/moby/moby v28.3.0+incompatible/go.mod h1:fDXVQ6+S340veQPv35CzDahGBmHsiclFwfEygB/TWMc=
 github.com/moby/moby v28.3.2+incompatible h1:K0SaQiU3VJxzMmHarwIa9MUyYFYC6FzCf0Qs9oQaFI4=
 github.com/moby/moby v28.3.2+incompatible/go.mod h1:fDXVQ6+S340veQPv35CzDahGBmHsiclFwfEygB/TWMc=
+github.com/moby/moby v28.3.3+incompatible h1:nzkZIIn9bQP9S553kNmJ+U8PBhdS2ciFWphV2vX/Zp4=
+github.com/moby/moby v28.3.3+incompatible/go.mod h1:fDXVQ6+S340veQPv35CzDahGBmHsiclFwfEygB/TWMc=
 github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
 github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs=
 github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=

hugo.yaml

@@ -135,10 +135,10 @@ params:
   # Latest version of the Docker Engine API
   latest_engine_api_version: "1.51"
   # Latest version of Docker Engine
-  docker_ce_version: "28.3.2"
+  docker_ce_version: "28.3.3"
   # Previous version of the Docker Engine
   # (Used to show e.g., "latest" and "latest"-1 in engine install examples
-  docker_ce_version_prev: "28.3.1"
+  docker_ce_version_prev: "28.3.2"
   # Latest Docker Compose version
   compose_version: "v2.39.1"
   # Latest BuildKit version