Container Mapping fails on recent Docker CLI: can't evaluate field ID in type *events.Message #172

Description

The injected task Microsoft Defender for DevOps Container Mapping End (Microsoft Security DevOps v1.18.2) fails on every pipeline run on our self-hosted Linux agents. The task catches the error and finishes as succeeded, so the pipeline stays green. Container mapping therefore fails silently, also in jobs that build and push images to Azure Container Registry.

Log output

Error in Container Mapping: Error: Unable to fetch Docker events: [command]/usr/bin/docker events --since 2026-10-14T12:21:05.530Z --until 2026-10-14T12:21:56.318Z --filter event=push --filter type=image --format ID={{.ID}}
Error parsing format: template: :1:5: executing "" at <.ID>: can't evaluate field ID in type *events.Message
Error executing command with EC=-1: Error: The process '/usr/bin/docker' failed with exit code 64

Cause

The task passes --format ID={{.ID}} to docker events. Docker Engine 29.0.0 removed the deprecated status, id and from fields from the events API for API v1.52 and later (release notes, moby/moby#50832). On any Docker 29.x host the Go template therefore fails to parse. Since Docker 29 is the current stable release, this probably affects every self-hosted agent that installs Docker from the official repository.

Environment

• Extension: Microsoft Security DevOps 1.18.2, auto-injected through the Defender for Cloud Azure DevOps connector
• Agent: self-hosted Ubuntu 22.04, Docker CE 29.x from download.docker.com (stable channel)
• Defender plans: Defender CSPM, Defender for Containers

Steps to reproduce

On a machine with the same Docker version:

docker events --since 1m --until 0s --filter event=push --filter type=image --format 'ID={{.ID}}'

Expected behavior

The task reads the pushed image events and container mapping works.

Suggested fix

Use the structured field instead of the deprecated one, for example --format 'ID={{.Actor.ID}}', or read --format '{{json .}}' and parse Actor.ID. This works on both older and current Docker versions.

It would also help to surface this failure as a pipeline warning (##vso[task.logissue type=warning]). At the moment mapping fails without anyone noticing.