Skip to content

Commit b698ac9

Browse files
sarahsanders-dockersarahsanders-docker
committed
fix missing section, add security best practices
1 parent d9ce4ea commit b698ac9

File tree

1 file changed

+121
-2
lines changed

1 file changed

+121
-2
lines changed

‎content/manuals/security/for-admins/hardened-desktop/settings-management/settings-reference.md‎

Lines changed: 121 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -168,6 +168,12 @@ is set to `true`, Docker Desktop turns on Rosetta to accelerate
168168
x86_64/amd64 binary emulation on Apple Silicon.
169169
- **OS:** {{< badge color=blue text="Mac only" >}} 13+
170170
- **Use case:** Run Intel-based containers on Apple Silicon hosts.
171+
172+
> [!NOTE]
173+
>
174+
> In hardened environments, disable and lock this setting so only ARM-native
175+
images are permitted.
176+
171177
- **Configure this setting with:**
172178
- **General** settings in [Docker Desktop GUI](/manuals/desktop/settings-and-maintenance/settings.md)
173179
- Settings Management:`useVirtualizationFrameworkRosetta` setting in the [`admin-settings.json` file](/manuals/security/for-admins/hardened-desktop/settings-management/configure-json-file.md)
@@ -196,6 +202,12 @@ mechanism. If both VirtioFS and gRPC are set to `true`, VirtioFS takes
196202
precedence.
197203
- **OS:** {{< badge color=blue text="Mac only" >}} 12.5+
198204
- **Use case:** Improve volume mount performance and compatibility.
205+
206+
> [!NOTE]
207+
>
208+
> In hardened environments, enable and lock this setting for macOS 12.5 and
209+
later.
210+
199211
- **Configure this setting with:**
200212
- **General settings** in [Docker Desktop GUI](/manuals/desktop/settings-and-maintenance/settings.md)
201213
- Settings Management: `useVirtualizationFrameworkVirtioFS` setting in the [`admin-settings.json` file](/manuals/security/for-admins/hardened-desktop/settings-management/configure-json-file.md)
@@ -211,13 +223,31 @@ precedence.
211223
`true`, gRPC Fuse is set as the file sharing mechanism.
212224
- **OS:** {{< badge color=blue text="Mac only" >}}
213225
- **Use case:** Improve performance and compatibility of file mounts.
226+
227+
> [!NOTE]
228+
>
229+
> In hardened environments, disable and lock this setting.
230+
214231
- **Configure this setting with:**
215232
- **General** settings in [Docker Desktop GUI](/manuals/desktop/settings-and-maintenance/settings.md)
216233
- Settings Management: `useGrpcfuse` setting in the [`admin-settings.json` file](/manuals/security/for-admins/hardened-desktop/settings-management/configure-json-file.md)
217234
- Settings Management: **Use gRPC FUSE for file sharing** setting in the [Admin Console](/manuals/security/for-admins/hardened-desktop/settings-management/configure-admin-console.md)
218235

219236
#### osxfs
220237

238+
| Default value | Accepted values | Format |
239+
| ------------- | --------------- | ------- |
240+
| `false` | `true`, `false` | Boolean |
241+
242+
- **Description:** Enable the legacy osxfs file sharing driver for macOS. When
243+
set to true, Docker Desktop uses osxfs instead of VirtioFS or gRPC FUSE to mount
244+
host directories into containers.
245+
- **OS:** {{< badge color=blue text="Mac only" >}}
246+
- **Use case:** Use the original file sharing implementation when compatibility
247+
with older tooling or specific workflows is required.
248+
- **Configure this setting with:**
249+
- **General** settings in [Docker Desktop GUI](/manuals/desktop/settings-and-maintenance/settings.md)
250+
221251
### Send usage statistics
222252

223253
| Default value | Accepted values | Format |
@@ -230,8 +260,15 @@ gathered from the Docker Desktop application itself. It does not affect
230260
server-side telemetry collected via Docker Hub or other backend services, such
231261
as login timestamps, pulls, or builds.
232262
- **OS:** {{< badge color=blue text="All" >}}
233-
- **Use case:** Manage telemetry collection for compliance, privacy, or
234-
visibility in dashboards like Docker Insights.
263+
- **Use case:** Enable analytics to help Docker improve the product based on
264+
usage data.
265+
266+
> [!NOTE]
267+
>
268+
> In hardened environments, disable and lock this setting. This allows you
269+
to control all your data flows and collect support logs via secure channels
270+
if needed.
271+
235272
- **Configure this setting with:**
236273
- **General** settings in [Docker Desktop GUI](/manuals/desktop/settings-and-maintenance/settings.md)
237274
- Settings Management: `analyticsEnabled` setting in the [`admin-settings.json` file](/manuals/security/for-admins/hardened-desktop/settings-management/configure-json-file.md)
@@ -255,6 +292,11 @@ execution.
255292
- **OS:** {{< badge color=blue text="All" >}}
256293
- **Use case:** Prevent containers from modifying configuration or sensitive
257294
host areas.
295+
296+
> [!NOTE]
297+
>
298+
> In hardened environments, disable and lock this setting.
299+
258300
- **Configure this setting with:**
259301
- **General settings** in [Docker Desktop GUI](/manuals/desktop/settings-and-maintenance/settings.md)
260302
- Settings Management: `enhancedContainerIsolation` setting in the [`admin-settings.json` file](/manuals/security/for-admins/hardened-desktop/settings-management/configure-json-file.md)
@@ -281,6 +323,12 @@ host areas.
281323
- **Description:** Enable Docker Scout to generate and display SBOM data for container images.
282324
- **OS:** {{< badge color=blue text="All" >}}
283325
- **Use case:** Turn on Docker Scout analysis features to view vulnerabilities, packages, and metadata associated with images.
326+
327+
> [!NOTE]
328+
>
329+
> In hardened environments, enable and lock this setting to ensure SBOMs are
330+
always built to satisfy compliance scans.
331+
284332
- **Configure this setting with:**
285333
- **General settings** in [Docker Desktop GUI](/manuals/desktop/settings-and-maintenance/settings.md)
286334
- Settings Management: `sbomIndexing` setting in the [`admin-settings.json` file](/manuals/security/for-admins/hardened-desktop/settings-management/configure-json-file.md)
@@ -295,6 +343,11 @@ host areas.
295343
- **Description:** Automatically index SBOM data for images in the background without requiring user interaction.
296344
- **OS:** {{< badge color=blue text="All" >}}
297345
- **Use case:** Keep image metadata up to date by allowing Docker to perform SBOM indexing during idle time or after image pull operations.
346+
347+
> [!NOTE]
348+
>
349+
> In hardened environments, enable and lock this setting.
350+
298351
- **Configure this setting with:**
299352
- **General settings** in [Docker Desktop GUI](/manuals/desktop/settings-and-maintenance/settings.md)
300353

@@ -395,6 +448,12 @@ host areas.
395448
containers. When a path is added, its subdirectories are allowed.
396449
- **OS:** {{< badge color=blue text="All" >}}
397450
- **Use case:** Restrict or define what file paths are available to containers.
451+
452+
> [!NOTE]
453+
>
454+
> In hardened environments, lock to an explicit whitelist and disable end-user
455+
edits.
456+
398457
- **Configure this setting with:**
399458
- **File sharing** Resources settings in [Docker Desktop GUI](/manuals/desktop/settings-and-maintenance/settings.md)
400459
- Settings Management: `filesharingAllowedDirectories` setting in the [`admin-settings.json` file](/manuals/security/for-admins/hardened-desktop/settings-management/configure-json-file.md)
@@ -410,6 +469,11 @@ containers. When a path is added, its subdirectories are allowed.
410469
settings.
411470
- **OS:** {{< badge color=blue text="All" >}}
412471
- **Use case:** Fine-tune proxy exceptions for container networking.
472+
473+
> [!NOTE]
474+
>
475+
> In hardened environments, disable and lock this setting.
476+
413477
- **Configure this setting with:**
414478
- **Proxies** Resources settings in [Docker Desktop GUI](/manuals/desktop/settings-and-maintenance/settings.md)
415479
- Settings Management: `proxy` setting with `manual` and `exclude` modes in the [`admin-settings.json` file](/manuals/security/for-admins/hardened-desktop/settings-management/configure-json-file.md)
@@ -463,6 +527,11 @@ based engine. This overrides anything that may have been set at installation
463527
using the `--backend=<backend name>` flag.
464528
- **OS:** {{< badge color=blue text="Windows only" >}} + WSL
465529
- **Use case:** Enable Linux containers via WSL 2 backend.
530+
531+
> [!NOTE]
532+
>
533+
> In hardened environments, enable and lock this setting.
534+
466535
- **Configure this setting with:**
467536
- **WSL Integration** Resources settings in [Docker Desktop GUI](/manuals/desktop/settings-and-maintenance/settings.md)
468537
- Settings Management: `wslEngineEnabled` setting in the [`admin-settings.json` file](/manuals/security/for-admins/hardened-desktop/settings-management/configure-json-file.md)
@@ -518,6 +587,11 @@ Builders settings lets you manage Buildx builder instances for advanced image-bu
518587
- **Description:** Enable the integrated Kubernetes cluster in Docker Desktop.
519588
- **OS:** {{< badge color=blue text="All" >}}
520589
- **Use case:** Enable or disable Kubernetes support for developers.
590+
591+
> [!NOTE]
592+
>
593+
> In hardened environments, disable and lock this setting.
594+
521595
- **Configure this setting with:**
522596
- **Kubernetes** settings in [Docker Desktop GUI](/manuals/desktop/settings-and-maintenance/settings.md)
523597
- Settings Management: `kubernetes` setting in the [`admin-settings.json` file](/manuals/security/for-admins/hardened-desktop/settings-management/configure-json-file.md)
@@ -569,6 +643,11 @@ compatibility.
569643
- **Description:** Show Kubernetes system containers in the Docker Dashboard container list
570644
- **OS:** {{< badge color=blue text="All" >}}
571645
- **Use case:** Allow developers to view kube-system containers for debugging
646+
647+
> [!NOTE]
648+
>
649+
> In hardened environments, disable and lock this setting.
650+
572651
- **Configure this setting with:**
573652
- **Kubernetes** settings in [Docker Desktop GUI](/manuals/desktop/settings-and-maintenance/settings.md)
574653

@@ -585,6 +664,12 @@ value is set to `true`, checking for updates and notifications about Docker
585664
Desktop updates are disabled.
586665
- **OS:** {{< badge color=blue text="All" >}}
587666
- **Use case:** Freeze the current version in enterprise environments.
667+
668+
> [!NOTE]
669+
>
670+
> In hardened environments, enable this setting and lock. This guarantees that
671+
only internally vetted versions are installed.
672+
588673
- **Configure this setting with:**
589674
- Settings Management: `disableUpdate` setting in the [`admin-settings.json` file](/manuals/security/for-admins/hardened-desktop/settings-management/configure-json-file.md)
590675
- Settings Management: **Disable update** setting in the [Admin Console](/manuals/security/for-admins/hardened-desktop/settings-management/configure-admin-console.md)
@@ -614,6 +699,12 @@ Desktop updates are disabled.
614699
- **OS:** {{< badge color=blue text="All" >}}
615700
- **Use case:** Control access to the Extensions Marketplace and installed
616701
extensions.
702+
703+
> [!NOTE]
704+
>
705+
> In hardened environments, disable and lock this setting. This prevents
706+
third-party or unvetted plugins from being installed.
707+
617708
- **Configure this setting with:**
618709
- **Extensions** settings in [Docker Desktop GUI](/manuals/desktop/settings-and-maintenance/settings.md)
619710
- Settings Management: `extensionsEnabled` setting in the [`admin-settings.json` file](/manuals/security/for-admins/hardened-desktop/settings-management/configure-json-file.md)
@@ -815,6 +906,12 @@ The following settings aren’t shown in the Docker Desktop GUI. You can only co
815906
- **Description:** Prevent users from loading local Docker images using the `docker load` command.
816907
- **OS:** {{< badge color=blue text="All" >}}
817908
- **Use case:** Enforce image provenance by restricting local image imports.
909+
910+
> [!NOTE]
911+
>
912+
> In hardened environments, enable and lock this setting. This forces all images
913+
to come from your secure, scanned registry.
914+
818915
- **Configure this setting with:**
819916
- Settings Management: `blockDockerLoad` setting in the [`admin-settings.json` file](/manuals/security/for-admins/hardened-desktop/settings-management/configure-json-file.md)
820917

@@ -827,6 +924,12 @@ The following settings aren’t shown in the Docker Desktop GUI. You can only co
827924
- **Description:** Exposes the Docker API over an unauthenticated TCP socket on port 2375. Only recommended for isolated and protected environments.
828925
- **OS:** {{< badge color=blue text="Windows only" >}}
829926
- **Use case:** Required for legacy integrations or environments without named pipe support.
927+
928+
> [!NOTE]
929+
>
930+
> In hardened environments, disable and lock this setting. This ensures the
931+
Docker API is only reachable via the secure internal socket.
932+
830933
- **Configure this setting with:**
831934
- Settings Management: `exposeDockerAPIOnTCP2375` in the [`admin-settings.json` file](/manuals/security/for-admins/hardened-desktop/settings-management/configure-json-file.md)
832935

@@ -898,6 +1001,11 @@ Docker socket access control (ECI exceptions)
8981001
- **Description:** Enable access to beta features in Docker Desktop.
8991002
- **OS:** {{< badge color=blue text="All" >}}
9001003
- **Use case:** Give developers early access to features that are in public beta.
1004+
1005+
> [!NOTE]
1006+
>
1007+
> In hardened environments, disable and lock this setting.
1008+
9011009
- **Configure this setting with:**
9021010
- Settings Management: `allowBetaFeatures` setting in the [`admin-settings.json` file](/manuals/security/for-admins/hardened-desktop/settings-management/configure-json-file.md)
9031011

@@ -910,6 +1018,12 @@ Docker socket access control (ECI exceptions)
9101018
- **Description:** Override the Docker daemon configuration used in Linux or Windows containers.
9111019
- **OS:** {{< badge color=blue text="All" >}}
9121020
- **Use case:** Configure low-level Docker daemon options (e.g., logging, storage drivers) without editing the local config files.
1021+
1022+
> [!NOTE]
1023+
>
1024+
> In hardened environments, provide a vetted JSON config and lock it so no
1025+
overrides are possible.
1026+
9131027
- **Configure this setting with:**
9141028
- Settings Management: `linuxVM.dockerDaemonOptions` or `windowsContainers.dockerDaemonOptions` in the [`admin-settings.json` file](/manuals/security/for-admins/hardened-desktop/settings-management/configure-json-file.md)
9151029

@@ -922,6 +1036,11 @@ Docker socket access control (ECI exceptions)
9221036
- **Description:** Set the subnet used for internal VPNKit DHCP/DNS services.
9231037
- **OS:** {{< badge color=blue text="Mac only" >}}
9241038
- **Use case:** Prevent IP conflicts in environments with overlapping subnets.
1039+
1040+
> [!NOTE]
1041+
>
1042+
> In hardened environments, lock to an approved, non-conflicting CIDR.
1043+
9251044
- **Configure this setting with:**
9261045
- Settings Management: `vpnkitCIDR` setting in the [`admin-settings.json` file](/manuals/security/for-admins/hardened-desktop/settings-management/configure-json-file.md)
9271046
- Settings Management: **VPN Kit CIDR** setting in the [Admin Console](/manuals/security/for-admins/hardened-desktop/settings-management/configure-admin-console.md)

0 commit comments

Comments
 (0)