Docker asks to create a symlink after every OS restart.

[cperezabo]

• I have tried with the latest version of Docker Desktop
• I have tried disabling enabled experimental features
• I have uploaded Diagnostics
• Diagnostics ID:

Expected behavior

Start at login without asking for permissions

Actual behavior

It asks for permissions to create a symlink

Information

• macOS Version: 13.0.1
• Intel chip or Apple chip: M1 Pro
• Docker Desktop Version: 4.15.0

Output of /Applications/Docker.app/Contents/MacOS/com.docker.diagnose check

Starting diagnostics

[PASS] DD0027: is there available disk space on the host?
[PASS] DD0028: is there available VM disk space?
[PASS] DD0018: does the host support virtualization?
[PASS] DD0001: is the application running?
[PASS] DD0017: can a VM be started?
[PASS] DD0016: is the LinuxKit VM running?
[PASS] DD0011: are the LinuxKit services running?
[PASS] DD0004: is the Docker engine running?
[PASS] DD0015: are the binary symlinks installed?
[PASS] DD0031: does the Docker API work?
[PASS] DD0013: is the $PATH ok?
[PASS] DD0003: is the Docker CLI working?
[PASS] DD0014: are the backend processes running?
[PASS] DD0007: is the backend responding?
[PASS] DD0008: is the native API responding?
[PASS] DD0009: is the vpnkit API responding?
[PASS] DD0010: is the Docker API proxy responding?
[PASS] DD0012: is the VM networking working?
[SKIP] DD0030: is the image access management authorized?
[FAIL] DD0019: is the com.docker.vmnetd process responding? failed to ping vmnetd with error: failed to connect to /var/run/com.docker.vmnetd.sock: is vmnetd running?: dial unix /var/run/com.docker.vmnetd.sock: connect: no such file or directory
[PASS] DD0033: does the host have Internet access?
[PASS] DD0018: does the host support virtualization?
[PASS] DD0001: is the application running?
[PASS] DD0017: can a VM be started?
[PASS] DD0016: is the LinuxKit VM running?
[PASS] DD0011: are the LinuxKit services running?
[PASS] DD0004: is the Docker engine running?
[PASS] DD0015: are the binary symlinks installed?
[PASS] DD0031: does the Docker API work?
[PASS] DD0032: do Docker networks overlap with host IPs?

Please investigate the following 1 issue:

1 : The test: is the com.docker.vmnetd process responding?
    Failed with: failed to ping vmnetd with error: failed to connect to /var/run/com.docker.vmnetd.sock: is vmnetd running?: dial unix /var/run/com.docker.vmnetd.sock: connect: no such file or directory

The com.docker.vmnetd process is needed to create symlinks for CLIs in your path.

Steps to reproduce the behavior

Restart the computer

[aiordache]

Hi @cperezabo!
Can you try setting authDeclinedInstallSettings to true in ~/Library/Group\ Containers/group.com.docker/settings.json and see if you still get the prompt on OS restart? Sorry for this, should be fixed in the next release.

[lesgrieve]

Thank you @aiordache, setting authDeclinedInstallSettings to true worked for me. I reposted your solution to https://stackoverflow.com/questions/74763924/getting-message-about-docker-wanting-to-create-symlink-every-time-i-start-mac

[obriencj]

Does setting authDeclinedInstallSettings to true also prevent it from altering ~/.profile ?

[cperezabo]

I haven't tried, @aiordache said it will be fixed in next release, so I prefer not to touch the installation and let Docker fix itself.

[f-lombardo]

setting authDeclinedInstallSettings to true in ~/Library/Group\ Containers/group.com.docker/settings.json

This removes the dialog at login, but makes docker containers not available from external applications such as PhPStorm, that rises this error Cannot connect to the Docker daemon at unix:///web.archive.org/web/20250826142521/https://var/run/docker.sock

[aiordache]

Hi 👋
To give some context, in Docker Desktop v4.15 we have changed a bit its setup to allow it to run fully unprivileged by default.
Previous versions of Docker Desktop enforced the installation of a privileged process(com.docker.vmnetd) that was handling configurations needing root access. That was a blocker for users that do not have/want to provide privileged access. This requirement was removed in v4.15.
By default, there should not be a privileged process running anymore, but, whenever Docker Desktop runs a configuration that requires privileged access, it prompts for password with a description of what it wants to do. All configurations are documented in here.

We are working on improving the setup and docs to provide more information on what is being configured and what it is needed for. But this may take a bit more time and iterations.

@f-lombardo The prompt you get on startup is triggered by the missing /var/run/docker.sock. The docker socket on MacOS is at ~/.docker/run/docker.sock but as many tools rely on the default socket path of the Docker Engine /var/run/docker.sock, we need to create a symlink /var/run/docker.sock -> ~/.docker/run/docker.sock for backwards compatibility.
The problem is the launch daemon we configure to create this symlink on OS startup is not being fired or may fail. If /var/run/docker.sock does not exist on OS startup, check the status of that launch daemon, run sudo launchctl print system/com.docker.socket. In newer versions of MacOS, you may probably see an ln Launch Item in your system settings. We'll replaced this with a Docker signed wrapper in the next release to make sure it is not being prevented from running due to codesigning issues.

@obriencj You shell profile is updated only if you reject the prompt on the first startup which tries to add symlinks to docker binaries to /usr/local/bin. If you reject, Docker Desktop places the binaries under ~/.docker/bin and updates your shell profile to add this directory to your $PATH. Otherwise, when you run docker commands you'll get errors as the command won't be found.
Setting authDeclinedInstallSettings to true tells Docker Desktop to avoid asking for root access and apply same configurations as when you reject the prompt. Your docker binaries get then symlinked in ~/.docker/bin and your shell profile will be updated.

[obriencj]

Is there not a setting to tell docker desktop "please leave my profile alone" at startup? I notice it's doing it every single time.

[justinpawela]

and your shell profile will be updated.

Is there not a setting to tell docker desktop "please leave my profile alone"

I agree with this sentiment. Unless I am misunderstanding how this works, it seems like either I have to give Docker Desktop privileged access or accept that it's going to help itself to modifying my carefully crafted shell profile. It seems (in a way) like a false choice.

I fully support the work to move Docker Desktop to an unprivileged process. However—and I think in the same spirit—I would prefer some way to opt out of Docker Desktop making changes for me. I understand this presents an avenue for beginners to shoot themselves in the foot and that explaining PATH is an unenviable job. Hopefully the current situation is temporary and some "I actually know what I'm doing" option can be integrated, even if it's not the default and only mentioned on the help page.

[BeInLife]

The question is -> How would it be handled if there are 2 users? I'm using 2 different users on the same machine (both use docker) for different contexts and it's quite annoying to restart docker every time I log in into different profile.

[rfay]

This is a super-serious problem, looking forward to the fix. Every docker restart and every reboot of the computer requires manual intervention with a password, which means that the DDEV test runners all fail on a restart, etc.

[jcosentino]

On Docker Desktop 4.16.1 (95567) on M1 Mac, setting authDeclinedInstallSettings to true does not work for me any longer. The file is still ~/Library/Group\ Containers/group.com.docker/settings.json right?

[romatou]

On Docker Desktop 4.16.1 (95567) on M1 Mac, setting authDeclinedInstallSettings to true does not work for me any longer. The file is still ~/Library/Group\ Containers/group.com.docker/settings.json right?

Yes. It no longer works as explained by @aiordache in comment above

[romatou]

We'll replaced this with a Docker signed wrapper in the next release to make sure it is not being prevented from running due to codesigning issues.

@aiordache, can Docker Inc. and Docker in the Allow in the Background section of Login Items on macOS Ventura to be combined as one application (screenshot attached)?

[aiordache]

Hi👋
Thank you all for your feedback. We are reworking the UX to address most of the concerns you expressed and are aiming to resolve these in the very near future. We want to make Docker Desktop more transparent about the configurations applied on the host and enable you to customize them.

@obriencj @justinpawela Sorry for the shell profile update, we shouldn't do that and we will fix this with the UX rework. Setting authDeclinedInstallSettings to false causes Docker Desktop to apply an unprivileged configuration as when you reject the prompt so you get the profile updated.

@BeInLife We cannot share the same instance of Docker Desktop between two users due to security reasons.

@rfay @jcosentino @romatou Do you still get the prompt on every restart? v4.16.1 should have the fix for the socket setup that was causing the prompts. If you restart your machines, you can check if /var/run/docker.sock symlink is being created before the startup of Docker Desktop. If it is missing, can you check why the launch daemon did not run properly? You can run the command below to retrieve information about it

sudo launchctl print system/com.docker.socket

@romatou We will check how to group the Login items. Thanks for the feedback!

[jcosentino]

/var/run/docker.sock

I do still get that prompt on restart.
Here is the result of sudo launchctl print system/com.docker.socket:

system/com.docker.socket = {
active count = 0
path = /Library/LaunchDaemons/com.docker.socket.plist
type = LaunchDaemon
state = not running

program = /Library/PrivilegedHelperTools/com.docker.socket
arguments = {
/Library/PrivilegedHelperTools/com.docker.socket
/Users/johncosentino/.docker/run/docker.sock
/var/run/docker.sock
}

default environment = {
PATH => /usr/bin:/bin:/usr/sbin:/sbin
}

environment = {
XPC_SERVICE_NAME => com.docker.socket
}

domain = system
minimum runtime = 10
exit timeout = 5
runs = 1
last exit code = 1

spawn type = background (5)
jetsam priority = 40
jetsam memory limit (active) = (unlimited)
jetsam memory limit (inactive) = (unlimited)
jetsamproperties category = daemon
jetsam thread limit = 32
cpumon = default
probabilistic guard malloc policy = {
activation rate = 1/1000
sample rate = 1/0
}

properties = partial import | runatload | managed LWCR | has LWCR
}