Upgrade bootstrap base and docker

[BenTheElder]

• debian buster has been the stable debian since ~july
• docker 18.06 was last patched in february, 19.03.X is the current stable docker and has seen very recent patches for security fixes (amongst other things)

there's a lot of fixes in docker in particular, however we should keep an eye on the upgrade for other deps (gcloud?)

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: BenTheElder

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [BenTheElder]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[aojea]

/hold
docker 19.03.3 has a known issue and 19.03.4 was not released yet

https://github.com/docker/docker-ce/releases

maybe we can pin to 19.03.2?

[BenTheElder]

docker 19.03.3 has a known issue and 19.03.4 was not released yet

can you elaborate? docker 18.06 also has known issues...

[aojea]

ups, well, maybe is not impacting us, sorry

DOCKER-USER iptables chain is missing docker/for-linux#810. Users cannot perform additional container network traffic filtering on top of this iptables chain. You are not affected by this issue if you are not customizing iptables chains on top of DOCKER-USER.

[BenTheElder]

we're not customizing those

if we do start at some point (hopefully we don't!) we could apply the known workaround in runner.sh anyhow though.

[aojea]

/hold cancel
/lgtm

sorry for the noise

[hakman]

Hi @BenTheElder. Does this change mean that future patch releases for k8s 1.14-1.16 will also be tested & validated with Docker 19.03?

[BenTheElder]

@hakman no, it does not. this docker is used for image building etc. NOT on the nodes