Docker Engine 29.8 adds --umask flag for containers

Docker Engine 29.8.0, released on 3 September 2026, introduces HostConfig.Umask and a --umask flag for docker create and docker run. The flag applies the umask to the main process, docker exec sessions and healthchecks, unlike the old entrypoint trick that missed exec and healthchecks.

• umask 027 yields file mode 640 instead of the default 644
• The entrypoint workaround never applied to docker exec or healthchecks
• Values with a fourth digit like 1777 are silently truncated to 0777
• docker update and Docker Compose do not support umask yet