Upgrade docker from 24.0.7 to 24.0.8

[MPV]

Release notes:

• https://docs.docker.com/engine/release-notes/24.0/#2408

Which (among other things) includes a fix for the high CVE-2024-21626 (unsure of how exploitable it is in the runner though).

[MPV]

Steps to detect/verify the above mentioned CVE in the image:

$ docker scout cves \
	ghcr.io/actions/actions-runner:2.312.0 \
	--ignore-base --only-fixed \
	--only-package pkg:golang/github.com/opencontainers/runc

    ✓ SBOM of image already cached, 1137 packages indexed
    ✗ Detected 2 vulnerable packages with a total of 1 vulnerability


## Overview

                    │              Analyzed Image
────────────────────┼───────────────────────────────────────────
  Target            │  ghcr.io/actions/actions-runner:2.312.0
    digest          │  35d233155f17
    platform        │ linux/arm64
    vulnerabilities │    0C     2H     0M     0L
    size            │ 316 MB
    packages        │ 3


## Packages and Vulnerabilities

   0C     1H     0M     0L  github.com/opencontainers/runc 1.1.9
pkg:golang/github.com/opencontainers/runc@1.1.9

    ✗ HIGH CVE-2024-21626 [Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')]
      https://scout.docker.com/v/CVE-2024-21626?s=github&n=runc&ns=github.com%2Fopencontainers&t=golang&vr=%3E%3D1.0.0-rc93%2C%3C%3D1.1.11
      Affected range : >=1.0.0-rc93
                     : <=1.1.11
      Fixed version  : 1.1.12
      CVSS Score     : 8.6
      CVSS Vector    : CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H


   0C     1H     0M     0L  github.com/opencontainers/runc 1.1.7
pkg:golang/github.com/opencontainers/runc@1.1.7

    ✗ HIGH CVE-2024-21626 [Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')]
      https://scout.docker.com/v/CVE-2024-21626?s=github&n=runc&ns=github.com%2Fopencontainers&t=golang&vr=%3E%3D1.0.0-rc93%2C%3C%3D1.1.11
      Affected range : >=1.0.0-rc93
                     : <=1.1.11
      Fixed version  : 1.1.12
      CVSS Score     : 8.6
      CVSS Vector    : CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H



2 vulnerabilities found in 2 packages
  LOW       0
  MEDIUM    0
  HIGH      2
  CRITICAL  0

[brian-keebo]

According to this Docker Security Advisory further updates are necessary. I think DOCKER_VERSION needs to be 24.0.9 and BUILDX_VERSION needs to be 0.12.5.

[MPV]

According to this Docker Security Advisory further updates are necessary. I think DOCKER_VERSION needs to be 24.0.9 and BUILDX_VERSION needs to be 0.12.5.

@brian-keebo I made a follow-up PR here (for docker) then:

• Upgrade docker from 24.0.8 to 24.0.9 #3126

But regarding "buildx" 0.12.5 I don't see any such releases published yet (when I look I only see 0.12.1 here yet):

• https://docs.docker.com/build/release-notes/
• https://github.com/docker/buildx/releases

Maybe it's the case that they're waiting on these?

• dockerd vulnerabilities moby/moby#47246
• [0.12] Fix CVE-2023-47108, CVE-2023-45142, CVE-2023-48795 docker/buildx#2221