You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Update permission requirements for Docker Desktop on Windows (#22863)
<!--Delete sections as needed -->
## Description
This change updates permission requirements for Docker Desktop on
Windows. It should explain that membership of the `docker-users` group
is no longer required for running Docker Desktop, unless the privileged
helper service is required.
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Co-authored-by: Allie Sadler <102604716+aevesdocker@users.noreply.github.com>
Copy file name to clipboardExpand all lines: content/manuals/desktop/setup/install/enterprise-deployment/msi-install-and-configure.md
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -34,7 +34,7 @@ The MSI package supports various MDM (Mobile Device Management) solutions, makin
34
34
7. Follow the instructions on the installation wizard to authorize the installer and proceed with the install.
35
35
8. When the installation is successful, select **Finish** to complete the installation process.
36
36
37
-
If your administrator account is different from your user account, you must add the user to the **docker-users** group:
37
+
If your administrator account is different from your user account, you must add the user to the **docker-users** group to access features that require higher privileges, such as creating and managing the Hyper-V VM, or using Windows containers:
38
38
1. Run **Computer Management** as an **administrator**.
39
39
2. Navigate to **Local Users and Groups** > **Groups** > **docker-users**.
Copy file name to clipboardExpand all lines: content/manuals/desktop/setup/install/windows-install.md
+5-2Lines changed: 5 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -180,7 +180,8 @@ again when you switch back.
180
180
181
181
6.[Start Docker Desktop](#start-docker-desktop).
182
182
183
-
If your administrator account is different to your user account, you must add the user to the **docker-users** group:
183
+
If your administrator account is different to your user account, you must add the user to the **docker-users** group to access features that require higher privileges, such as creating and managing the Hyper-V VM, or using Windows containers:
184
+
184
185
1. Run **Computer Management** as an **administrator**.
185
186
2. Navigate to **Local Users and Groups** > **Groups** > **docker-users**.
186
187
3. Right-click to add the user to the group.
@@ -218,7 +219,9 @@ By default, Docker Desktop is installed at `C:\Program Files\Docker\Docker`.
If your admin account is different to your user account, you must add the user to the **docker-users** group:
222
+
If your admin account is different to your user account, you must add the user to the **docker-users** group to access features that require higher privileges, such as creating and managing the Hyper-V VM, or using Windows containers.
Copy file name to clipboardExpand all lines: content/manuals/desktop/setup/install/windows-permission-requirements.md
+13-2Lines changed: 13 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -18,12 +18,23 @@ Docker Desktop on Windows is designed with security in mind. Administrative righ
18
18
19
19
## Permission requirements
20
20
21
-
While Docker Desktop on Windows can be run without having `Administrator` privileges, it does require them during installation. On installation you receive a UAC prompt which allows a privileged helper service to be installed. After that, Docker Desktop can be run without administrator privileges, provided you are members of the `docker-users` group. If you performed the installation, you are automatically added to this group, but other users must be added manually. This allows the administrator to control who has access to Docker Desktop.
21
+
While Docker Desktop on Windows can be run without having `Administrator` privileges, it does require them during installation. On installation you receive a UAC prompt which allows a privileged helper service to be installed. After that, Docker Desktop can be run without administrator privileges.
22
22
23
-
The reason for this approach is that Docker Desktop needs to perform a limited set of privileged operations which are conducted by the privileged helper process `com.docker.service`. This approach allows, following the principle of least privilege, `Administrator` access to be used only for the operations for which it is absolutely necessary, while still being able to use Docker Desktop as an unprivileged user.
23
+
Running Docker Desktop on Windows without the privileged helper does not require users to have `docker-users` group membership. However,
24
+
some features that require privileged operations will have this requirement.
25
+
26
+
If you performed the installation, you are automatically added to this group, but other users must be added manually. This allows the administrator to control who has access to features that require higher privileges, such as creating and managing the Hyper-V VM, or using Windows containers.
27
+
28
+
When Docker Desktop launches, all non-privileged named pipes are created so that only the following users can access them:
29
+
- The user that launched Docker Desktop.
30
+
- Members of the local `Administrators` group.
31
+
- The `LOCALSYSTEM` account.
24
32
25
33
## Privileged helper
26
34
35
+
Docker Desktop needs to perform a limited set of privileged operations which are conducted by the privileged helper process `com.docker.service`. This approach allows, following the principle of least privilege, `Administrator` access to be used only for the operations for which it is absolutely necessary, while still being able to use Docker Desktop as an unprivileged user.
36
+
37
+
27
38
The privileged helper `com.docker.service` is a Windows service which runs in the background with `SYSTEM` privileges. It listens on the named pipe `//./pipe/dockerBackendV2`. The developer runs the Docker Desktop application, which connects to the named pipe and sends commands to the service. This named pipe is protected, and only users that are part of the `docker-users` group can have access to it.
28
39
29
40
The service performs the following functionalities:
0 commit comments