Skip to content

Auto-negotiate Docker API Version#12256

Merged
traefiker merged 1 commit intotraefik:v3.6from
felixbuenemann:remove-hardcoded-docker-api-version
Nov 12, 2025
Merged

Auto-negotiate Docker API Version#12256
traefiker merged 1 commit intotraefik:v3.6from
felixbuenemann:remove-hardcoded-docker-api-version

Conversation

@felixbuenemann
Copy link
Contributor

@felixbuenemann felixbuenemann commented Nov 11, 2025

What does this PR do?

This PR fixes #12253 by removing the hardcoded docker api version and relying on auto-negotiation between the docker client (sdk) and server using WithAPIVersionNegotiation().

Motivation

Traefik currently fails to work with Docker v29 with the following errors:

2025-11-10T23:03:43Z ERR Failed to retrieve information of the docker client and server host error="Error response from daemon: client version 1.24 is too old. Minimum supported API version is 1.44, please upgrade your client to a newer version" providerName=docker
2025-11-10T23:03:43Z ERR Provider error, retrying in 2.356192979s error="Error response from daemon: client version 1.24 is too old. Minimum supported API version is 1.44, please upgrade your client to a newer version" providerName=docker

Fixes #12253

Additional Notes

  • Tested on production servers with Docker 29.0.0.
  • Test docker image available with tag felixbuenemann/traefik:v3.6 on docker hub (created with make build-image)

@felixbuenemann felixbuenemann force-pushed the remove-hardcoded-docker-api-version branch from f72a9af to 67dae4a Compare November 11, 2025 09:43
@felixbuenemann felixbuenemann changed the title Remove hardcoded docker api version Auto-negotiate Docker API Version Nov 11, 2025
Copy link
Contributor

@thaJeztah thaJeztah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks! A colleague actually noticed the hard-coded value in Traefik, and we were planning to open a PR, but looks like that dropped off our list 🙈

Changes SGTM (with my limited knowledge of this codebase); I left some suggestions / thoughts (but those definitely could be handled separately).

@MarkenJaden
Copy link

Tested the build on our system and can confirm it works.

Copy link
Contributor

@thaJeztah thaJeztah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FWIW, changes in this LGTM (assuming CI is happy)

@thaJeztah
Copy link
Contributor

w.r.t. updating to the new (moby.moby/client, moby/moby/api) modules; #12255 (comment)

It would probably be better to update this PR so the project no longer uses the deprecated API, and replace it with the recommended current one, since the old one is probably no longer supported.

I don't think there's an immediate urgency, and the changes in this PR look good to fix the problem at hand, unless traefik must support features only available in API v1.52 or up.

While the project should transition at some point, the client module is still a v0.x release, and there will be breaking changes in future in the client signatures (we plan to migrate it to functional options, and improve usability of streaming endpoints).

If would be good to update the dependency to the lastest v28.x version (currently at v28.3.3, which is an older minor release), and it won't hurt to explore what changes are needed to transition, but it's fine to keep that for a future exercise.

@thaJeztah
Copy link
Contributor

@rtribotte looks like CI needs a kick / approval to run 😅

@goppinath
Copy link

goppinath commented Nov 12, 2025

Does anyone have an estimate for when this update will be available? I have several instances down because of this issue, and I prefer not to use workarounds.

@sbusch
Copy link

sbusch commented Nov 12, 2025

Until this lands on Docker Hub, you can use the image the PR author @felixbuenemann kindly published instead:

docker.io/felixbuenemann/traefik:v3.6.1

Works for us.

@thaJeztah
Copy link
Contributor

Interesting; was letsencrypt/pebble and existing image?

2025/11/12 10:55:28 🔔 Container is ready: 902ec3d34995
    integration_test.go:261: 
        	Error Trace:	/home/runner/work/traefik/traefik/integration/integration_test.go:261
        	            				/home/runner/work/traefik/traefik/integration/acme_test.go:100
        	            				/home/runner/go/pkg/mod/github.com/stretchr/testify@v1.11.1/suite/suite.go:211
        	            				/home/runner/work/traefik/traefik/integration/acme_test.go:34
        	Error:      	Received unexpected error:
        	            	Error response from daemon: pull access denied for letsencrypt/pebble, repository does not exist or may require 'docker login': denied: requested access to the resource is denied: failed to create container
        	Test:       	TestAcmeSuite

Looks like it's gone from Docker Hub; https://hub.docker.com/r/letsencrypt/pebble

I do see a reference to ghcr.io/letsencrypt/pebble:2.8.0 elsewhere;

image: ghcr.io/letsencrypt/pebble:2.8.0

@marcopaggioro
Copy link

Interesting; was letsencrypt/pebble and existing image?

2025/11/12 10:55:28 🔔 Container is ready: 902ec3d34995
    integration_test.go:261: 
        	Error Trace:	/home/runner/work/traefik/traefik/integration/integration_test.go:261
        	            				/home/runner/work/traefik/traefik/integration/acme_test.go:100
        	            				/home/runner/go/pkg/mod/github.com/stretchr/testify@v1.11.1/suite/suite.go:211
        	            				/home/runner/work/traefik/traefik/integration/acme_test.go:34
        	Error:      	Received unexpected error:
        	            	Error response from daemon: pull access denied for letsencrypt/pebble, repository does not exist or may require 'docker login': denied: requested access to the resource is denied: failed to create container
        	Test:       	TestAcmeSuite

Looks like it's gone from Docker Hub; https://hub.docker.com/r/letsencrypt/pebble

I do see a reference to ghcr.io/letsencrypt/pebble:2.8.0 elsewhere;

image: ghcr.io/letsencrypt/pebble:2.8.0

letsencrypt/pebble#451

@kevinpollet kevinpollet added this to the 3.6 milestone Nov 12, 2025
@kevinpollet kevinpollet force-pushed the remove-hardcoded-docker-api-version branch from 67dae4a to 5663508 Compare November 12, 2025 15:39
@saltydk
Copy link

saltydk commented Nov 12, 2025

Pulling 3.6 but still getting error="Error response from daemon: client version 1.24 is too old. Minimum supported API version is 1.44

I would guess, it's just merged into the VCS, but there is no new release yet?!?

So have to wait for a new release, or can they rebuild 3.6?

https://github.com/traefik/traefik/tags until 3.6.1 appears there nothing will happen.

@MrTengil
Copy link

MrTengil commented Nov 12, 2025

Pulling 3.6 but still getting error="Error response from daemon: client version 1.24 is too old. Minimum supported API version is 1.44

I would guess, it's just merged into the VCS, but there is no new release yet?!?

So have to wait for a new release, or can they rebuild 3.6?

https://github.com/traefik/traefik/tags until 3.6.1 appears there nothing will happen.

Great fix! Do we know when it will be released? @felixbuenemann

@iBros
Copy link

iBros commented Nov 12, 2025

Stuck with this as well - pulled v3.6 image, same issue. I'd argue that the severity and impact of this issue should be enough to create a new release

@ChaosExAnima
Copy link

as a workaround i switched to felixbuenemann/traefik:v3.6.1 as per the description and it works great.

@iBros
Copy link

iBros commented Nov 12, 2025

Until this lands on Docker Hub, you can use the image the PR author @felixbuenemann kindly published instead:

docker.io/felixbuenemann/traefik:v3.6.1

Works for us.

as a workaround i switched to felixbuenemann/traefik:v3.6.1 as per the description and it works great.

I missed it in the thread. great and thx to @felixbuenemann !

gaswirth added a commit to roundhousedesigns/rhdwp-traefik-server that referenced this pull request Nov 13, 2025
gonzaloaune added a commit to stakwork/sphinx-swarm that referenced this pull request Nov 13, 2025
derhuerst added a commit to mobidata-bw/ipl-orchestration that referenced this pull request Nov 13, 2025
derhuerst added a commit to mobidata-bw/ipl-orchestration that referenced this pull request Nov 13, 2025
derhuerst added a commit to mobidata-bw/ipl-orchestration that referenced this pull request Nov 17, 2025
bmah888 pushed a commit to esnet/esnet-smartnic-fw that referenced this pull request Dec 19, 2025
lcottereau added a commit to ARCEP-dev/geocodage_ban that referenced this pull request Feb 5, 2026
Suite à breaking change docker API

traefik/traefik#12256
jdtzmn added a commit to jdtzmn/port that referenced this pull request Feb 18, 2026
traefik:v3.0 ships Docker client API v1.24, but GitHub Actions runners
now require minimum API v1.44. This caused Traefik's Docker provider to
fail silently -- no containers discovered, no routers created, all HTTP
requests returned 404. traefik:v3.6 includes auto-negotiate Docker API
version (traefik/traefik#12256, shipped in v3.6.1).
jdtzmn added a commit to jdtzmn/port that referenced this pull request Feb 18, 2026
* Upgrade Traefik from v3.0 to v3.6

traefik:v3.0 ships Docker client API v1.24, but GitHub Actions runners
now require minimum API v1.44. This caused Traefik's Docker provider to
fail silently -- no containers discovered, no routers created, all HTTP
requests returned 404. traefik:v3.6 includes auto-negotiate Docker API
version (traefik/traefik#12256, shipped in v3.6.1).

* Fix network isolation and Traefik restart behavior

- Preserve default project network alongside traefik-network in override
  so inter-service DNS (e.g. app -> postgres) stays project-scoped and
  avoids cross-project alias collisions on the shared external network
- Use 'docker compose up -d' instead of 'restart' in restartTraefik()
  so container is recreated when compose file changes (new port mappings)

* Harden integration tests with try/finally cleanup and fetch timeouts

- Wrap all integration tests in try/finally to ensure services are
  cleaned up even when assertions fail (prevents leaked containers
  from poisoning subsequent tests)
- Add fetchWithTimeout helper with AbortController to prevent hung
  requests from consuming the entire poll window
- Increase timeouts for CI runners where Docker startup is slower
- Replace setInterval-based polling with while-loop polling for
  cleaner control flow

* Improve sample image reproducibility for CI

- Add image tags so pre-built images are reused across worktrees
  instead of rebuilding from scratch each time
- Switch to npm ci with lockfile for deterministic installs
- Add .dockerignore files to exclude .git, .port, and node_modules
  from build context

* Add CI pre-pull/build step and failure-only Traefik diagnostics

- Pre-pull and build Docker images before tests run so integration
  tests don't spend time on cold image pulls
- Add failure-only diagnostics step that dumps Traefik logs, config,
  routers, and entrypoints when tests fail (makes future CI failures
  much faster to triage)

* Deduplicate fetchWithTimeout into test utils

* Cap vitest workers to half of available cores

Leave headroom for Docker containers, Traefik, and other child
processes spawned by integration tests.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Error response from daemon: client version 1.24 is too old