I ended up installing the Amazon Linux docker package and then overwriting the /usr/bin/docker binary with the 1.8.2 version binary from: https://docs.docker.com/installation/binaries/.

Not exactly elegant - but all of the dependencies are the same, and seeing as my AMI is immutable the package won't be upgraded on top of the current image.

`My EC2 VM currently has Docker version 25.0.5, build 5dc9bcc installed, but this version has a security flaw that has been patched in versions 27.1.1 and above.` Are you referring to CVE-2024-41110? Affected versions include `<= v25.0.5` and `<= v27.1.0` You can refer to Amazon Linux Security Center ALAS-2024-674 which mentions `AWS is aware of CVE-2024-41110, an issue affecting the Moby open source project, packaged in Amazon Linux as "docker". Docker is a component of several open source container management systems.` `Updated docker packages addressing the issue are available for Amazon Linux 2 (docker-20.10.25-1.amzn2.0.5 and docker-25.0.6-1.amzn2.0.1) and for Amazon Linux 2023 (docker-25.0.6-1amzn2023.0.1). AWS recommends that customers using docker upgrade to these or later versions. (CVE-2024-41110)` On my AL2023, docker 25.0.6 is installed ``` $ cat /etc/os-release | grep PRETTY PRETTY_NAME="Amazon Linux 2023.6.20241121" $ dnf info docker Installed Packages Name : docker Version : 25.0.6 Release : 1.amzn2023.0.2 Architecture : aarch64 Size : 150 M Source : docker-25.0.6-1.amzn2023.0.2.src.rpm Repository : @System From repo : amazonlinux Summary : Automates deployment of containerized applications URL : http://www.docker.com License : ASL 2.0 and MIT and BSD and MPLv2.0 and WTFPL Description : Docker is an open-source engine that automates the deployment of any : application as a lightweight, portable, self-sufficient container that will : run virtually anywhere. : : Docker containers can encapsulate any payload, and will run consistently on : and between virtually any server. The same container that a developer builds : and tests on a laptop will run at scale, in production*, on VMs, bare-metal : servers, OpenStack clusters, public instances, or combinations of the above. ```

**Review the Docker Version Change: **Understand the details of the Docker version change, including any new features, bug fixes, and potential compatibility issues. Docker version upgrades often include improvements and security patches, so it's important to stay informed about the changes. **Compatibility with EKS**: Ensure that the new Docker version is compatible with AWS EKS. While AWS EKS is designed to work seamlessly with Docker, it's still recommended to check for any compatibility issues or known limitations. **Test in Non-Production Environment:** Before applying the Docker version update to your production EKS cluster, consider testing it in a non-production environment. Create a test cluster with similar configurations and deploy your applications to verify compatibility and identify any issues proactively. **Backup and Rollback Plan**: Always have a backup and rollback plan in place before making any changes to your production environment. Take snapshots of your EKS cluster, including both control plane and worker nodes, so that you can revert to the previous state if necessary. **Monitor for Service Interruptions: **During the Docker version update, monitor your EKS cluster and applications closely for any service interruptions or performance issues. Use AWS CloudWatch metrics, EKS logs, and application monitoring tools to track the health and performance of your services. **Communicate with Stakeholders:** Keep your team and stakeholders informed about the Docker version update and any planned maintenance windows. Communicate the potential impact on services and outline the steps you're taking to minimize disruptions. https://stackoverflow.com/questions/63279765/docker-how-to-update-your-container-when-your-code-changes

The hardest part to figure all of this out was the container-selinux requirement. Just find the latest version in http://mirror.centos.org/centos/7/extras/x86_64/Packages/ and install that first. In addition EC2 instances may not have a proper entropy generator so haveged may need to be installed.

The rest is taken from https://docs.docker.com/install/linux/docker-ce/centos/ with the addition of haveged and firewalld. All these have to be done as root so sudo appropriately.

yum install -q -y http://mirror.centos.org/centos/7/extras/x86_64/Packages/container-selinux-2.42-1.gitad8f0f7.el7.noarch.rpm
yum install -q -y http://dl.fedoraproject.org/pub/epel/7/x86_64/Packages/h/haveged-1.9.1-1.el7.x86_64.rpm
yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
yum install -q -y firewalld docker-ce
systemctl enable firewalld
systemctl start firewalld
firewall-cmd --add-port=2377/tcp --permanent
firewall-cmd --add-port=2376/tcp --permanent
firewall-cmd --add-port=7946/tcp --permanent
firewall-cmd --add-port=7946/udp --permanent
firewall-cmd --add-port=4789/udp --permanent
firewall-cmd --zone=public --permanent --add-masquerade
firewall-cmd --reload
systemctl enable haveged
systemctl start haveged
systemctl enable docker
systemctl start docker
setenforce 1

Enable SELinux by modifying /etc/sysconfig/selinux to be

SELINUX=enforcing
SELINUXTYPE=targeted

Then reboot your instance by issuing shutdown -r now

Executing sudo docker version should yield as of the time of this posting...

Client:
 Version:       18.03.0-ce
 API version:   1.37
 Go version:    go1.9.4
 Git commit:    0520e24
 Built: Wed Mar 21 23:09:15 2018
 OS/Arch:       linux/amd64
 Experimental:  false
 Orchestrator:  swarm

Server:
 Engine:
  Version:      18.03.0-ce
  API version:  1.37 (minimum version 1.12)
  Go version:   go1.9.4
  Git commit:   0520e24
  Built:        Wed Mar 21 23:13:03 2018
  OS/Arch:      linux/amd64
  Experimental: false

So sorry, it was my misunderstanding. My OS is Redhat Linux. I get to install docker by

yum-config-manager --enable rhui-REGION-rhel-server-extras
sudo yum -y install docker 
systemctl start docker
systemctl enable docker
docker version