Skip to content

Commit 0842025

Browse files
chelnakaevesdocker
andauthored
Update permission requirements for Docker Desktop on Windows (#22863)
<!--Delete sections as needed --> ## Description This change updates permission requirements for Docker Desktop on Windows. It should explain that membership of the `docker-users` group is no longer required for running Docker Desktop, unless the privileged helper service is required. <!-- Tell us what you did and why --> ## Related issues or tickets <!-- Related issues, pull requests, or Jira tickets --> ## Reviews <!-- Notes for reviewers here --> <!-- List applicable reviews (optionally @tag reviewers) --> - [ ] Technical review - [ ] Editorial review - [ ] Product review --------- Co-authored-by: Allie Sadler <102604716+aevesdocker@users.noreply.github.com>
1 parent d8d4edc commit 0842025

File tree

3 files changed

+19
-5
lines changed

3 files changed

+19
-5
lines changed

content/manuals/desktop/setup/install/enterprise-deployment/msi-install-and-configure.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ The MSI package supports various MDM (Mobile Device Management) solutions, makin
3434
7. Follow the instructions on the installation wizard to authorize the installer and proceed with the install.
3535
8. When the installation is successful, select **Finish** to complete the installation process.
3636

37-
If your administrator account is different from your user account, you must add the user to the **docker-users** group:
37+
If your administrator account is different from your user account, you must add the user to the **docker-users** group to access features that require higher privileges, such as creating and managing the Hyper-V VM, or using Windows containers:
3838
1. Run **Computer Management** as an **administrator**.
3939
2. Navigate to **Local Users and Groups** > **Groups** > **docker-users**.
4040
3. Right-click to add the user to the group.

content/manuals/desktop/setup/install/windows-install.md

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -180,7 +180,8 @@ again when you switch back.
180180

181181
6. [Start Docker Desktop](#start-docker-desktop).
182182

183-
If your administrator account is different to your user account, you must add the user to the **docker-users** group:
183+
If your administrator account is different to your user account, you must add the user to the **docker-users** group to access features that require higher privileges, such as creating and managing the Hyper-V VM, or using Windows containers:
184+
184185
1. Run **Computer Management** as an **administrator**.
185186
2. Navigate to **Local Users and Groups** > **Groups** > **docker-users**.
186187
3. Right-click to add the user to the group.
@@ -218,7 +219,9 @@ By default, Docker Desktop is installed at `C:\Program Files\Docker\Docker`.
218219
> Start-Process 'Docker Desktop Installer.exe' -Wait -ArgumentList 'install', '--accept-license'
219220
> ```
220221
221-
If your admin account is different to your user account, you must add the user to the **docker-users** group:
222+
If your admin account is different to your user account, you must add the user to the **docker-users** group to access features that require higher privileges, such as creating and managing the Hyper-V VM, or using Windows containers.
223+
224+
```powershell
222225
223226
```console
224227
$ net localgroup docker-users <user> /add

content/manuals/desktop/setup/install/windows-permission-requirements.md

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,23 @@ Docker Desktop on Windows is designed with security in mind. Administrative righ
1818

1919
## Permission requirements
2020

21-
While Docker Desktop on Windows can be run without having `Administrator` privileges, it does require them during installation. On installation you receive a UAC prompt which allows a privileged helper service to be installed. After that, Docker Desktop can be run without administrator privileges, provided you are members of the `docker-users` group. If you performed the installation, you are automatically added to this group, but other users must be added manually. This allows the administrator to control who has access to Docker Desktop.
21+
While Docker Desktop on Windows can be run without having `Administrator` privileges, it does require them during installation. On installation you receive a UAC prompt which allows a privileged helper service to be installed. After that, Docker Desktop can be run without administrator privileges.
2222

23-
The reason for this approach is that Docker Desktop needs to perform a limited set of privileged operations which are conducted by the privileged helper process `com.docker.service`. This approach allows, following the principle of least privilege, `Administrator` access to be used only for the operations for which it is absolutely necessary, while still being able to use Docker Desktop as an unprivileged user.
23+
Running Docker Desktop on Windows without the privileged helper does not require users to have `docker-users` group membership. However,
24+
some features that require privileged operations will have this requirement.
25+
26+
If you performed the installation, you are automatically added to this group, but other users must be added manually. This allows the administrator to control who has access to features that require higher privileges, such as creating and managing the Hyper-V VM, or using Windows containers.
27+
28+
When Docker Desktop launches, all non-privileged named pipes are created so that only the following users can access them:
29+
- The user that launched Docker Desktop.
30+
- Members of the local `Administrators` group.
31+
- The `LOCALSYSTEM` account.
2432

2533
## Privileged helper
2634

35+
Docker Desktop needs to perform a limited set of privileged operations which are conducted by the privileged helper process `com.docker.service`. This approach allows, following the principle of least privilege, `Administrator` access to be used only for the operations for which it is absolutely necessary, while still being able to use Docker Desktop as an unprivileged user.
36+
37+
2738
The privileged helper `com.docker.service` is a Windows service which runs in the background with `SYSTEM` privileges. It listens on the named pipe `//./pipe/dockerBackendV2`. The developer runs the Docker Desktop application, which connects to the named pipe and sends commands to the service. This named pipe is protected, and only users that are part of the `docker-users` group can have access to it.
2839

2940
The service performs the following functionalities:

0 commit comments

Comments
 (0)