Safeguard
Developer Tools•

How do Docker Desktop updates roll out, and how old is too old?

Docker Desktop releases roll out gradually, and builds older than six months leave the download page. What that means for fleet patching and upgrades.

Safeguard Security Team
3 min read

Docker Desktop releases roll out gradually for quality control, so a new version may not reach you the day it is published; the release notes say updates typically arrive within a week. They also say versions older than six months from the latest release are no longer available to download. Plan your fleet cadence around both facts.

What the release notes say

The Docker Desktop release notes list version 4.95.0 dated 12 October 2026 as the latest at the time of review. Two statements matter for anyone managing laptops:

  • Releases are gradually rolled out to ensure quality control. If the latest version is not available to you yet, wait, since updates typically arrive within a week of the release date.
  • Versions older than six months from the latest release are no longer available for download.

The first means a patch announced today may not be installable today. The second means you cannot keep rolling back to an old build forever, and you cannot rebuild a golden image with an old installer after the window closes.

What to do with a gradual rollout

If a Docker Desktop release fixes a problem you care about, do not assume every developer has it. Ask for the version, not for a promise. A machine inventory that records the installed version answers the question in minutes.

For a team, a sensible approach is:

  1. Wait out the first week after a release unless you are fixing a known issue.
  2. Roll to a small pilot group first.
  3. Roll to everyone within two to four weeks.
  4. Keep the installer you deploy in your own artifact store.

The six-month window and your image

If you build laptop images or onboarding scripts that download a pinned Docker Desktop installer, that link can stop working once the version ages out. Store your approved installer yourself, or pin a version you update on a schedule.

It also gives you a natural ceiling. A machine more than six months behind the latest release is running a build the vendor no longer offers, which is a good trigger for a mandatory update.

Related checks

Docker Desktop has had its own security fixes before. Our write-up of Docker Desktop CVE-2025-9074 shows how a patch response looks in practice. Also remember that the engine, Compose and any Kubernetes feature bundled with it are updated through the same installer.

Track it like any other asset

Developer laptops are assets with software versions that change under you. Safeguard's asset discovery and compliance evidence automation can record what you run and when it was reviewed. A free dependency scan is available at gold.safeguard.sh/scan.

Common mistakes

Teams often block updates after one bad release and then forget to unblock them. Others deploy a pinned installer URL in an onboarding script and discover months later that the link no longer works. A third mistake is treating Docker Desktop as the whole story: base images in your Dockerfiles need their own update path, covered in pinning a base image by tag or digest.

Quick check

Why can't I see the newest Docker Desktop yet?

Releases roll out gradually. The release notes say updates typically arrive within a week of the release date.

Can I download an old Docker Desktop version?

Not if it is older than six months from the latest release, according to the release notes.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.