Understanding Docker Desktop for Mac Permission Requirements

--- description: Understand permission requirements for Docker Desktop for Mac and the differences between versions keywords: Docker Desktop, mac, security, install, permissions title: Understand permission requirements for Docker Desktop on Mac linkTitle: Mac permission requirements aliases: - /docker-for-mac/privileged-helper/ - /desktop/mac/privileged-helper/ - /desktop/mac/permission-requirements/ - /desktop/install/mac-permission-requirements/ weight: 20 --- This page contains information about the permission requirements for running and installing Docker Desktop on Mac. It also provides clarity on running containers as `root` as opposed to having `root` access on the host. Docker Desktop on Mac is designed with security in mind. Administrative rights are only required when absolutely necessary. ## Permission requirements Docker Desktop for Mac is run as an unprivileged user. However, Docker Desktop requires certain functionalities to perform a limited set of privileged configurations such as: - [Installing symlinks](#installing-symlinks) in`/usr/local/bin`. - [Binding privileged ports](#binding-privileged-ports) that are less than 1024. Although privileged ports (ports below 1024) are not typically used as a security boundary, operating systems still prevent unprivileged processes from binding to them which breaks commands like `docker run -p 127.0.0.1:80:80 docker/getting-started`. - [Ensuring `localhost` and `kubernetes.docker.internal` are defined](#ensuring-localhost-and-kubernetesdockerinternal-are-defined) in `/etc/hosts`. Some old macOS installs don't have `localhost` in `/etc/hosts`, which causes Docker to fail. Defining the DNS name `kubernetes.docker.internal` allows Docker to share Kubernetes contexts with containers. - Securely caching the Registry Access Management policy which is read-only for the developer. Privileged access is granted during installation. The first time Docker Desktop for Mac launches, it presents an installation window where you can choose to either use the default settings, which work for most developers and requires you to grant privileged access, or use advanced settings. If you work in an environment with elevated security requirements, for instance where local administrative access is prohibited, then you can use the advanced settings to remove the need for granting privileged access. You can configure: - The location of the Docker CLI tools either in the system or user directory - The default Docker socket - Privileged port mapping Depending on which advanced settings you configure, you must enter your password to confirm. You can change these configurations at a later date from the **Advanced** page in **Settings**. ### Installing symlinks The Docker binaries are installed by default in `/Applications/Docker.app/Contents/Resources/bin`. Docker Desktop creates symlinks for the binaries in `/usr/local/bin`, which means they're automatically included in `PATH` on most systems. You can choose whether to install symlinks either in `/usr/local/bin` or `$HOME/.docker/bin` during installation of Docker Desktop. If `/usr/local/bin` is chosen, and this location is not writable by unprivileged users, Docker Desktop requires authorization to confirm this choice before the symlinks to Docker binaries are created in `/usr/local/bin`. If `$HOME/.docker/bin` is chosen, authorization is not required, but then you must [manually add `$HOME/.docker/bin`](/manuals/desktop/settings-and-maintenance/settings.md#advanced) to your PATH. You are also given the option to enable the installation of the `/var/run/docker.sock` symlink. Creating this symlink ensures various Docker clients relying on the default Docker socket path work without additional changes. As the `/var/run` is mounted as a tmpfs, its content is deleted on restart, symlink to the Docker socket included. To ensure the Docker socket exists after restart, Docker Desktop sets up a `launchd` startup task that creates the symlink by running `ln -s -f /Users/<user>/.docker/run/docker.sock /var/run/docker.sock`. This ensures the you aren't prompted on each startup to create the symlink. If you don't enable this option at installation, the symlink and the startup task is not created and you may have to explicitly set the `DOCKER_HOST` environment variable to `/Users/<user>/.docker/run/docker.sock` in the clients it is using. The Docker CLI relies on the current context to retrieve the socket path, the current context is set to `desktop-linux` on Docker Desktop startup.

This document details the permission requirements for installing and running Docker Desktop on Mac, emphasizing its design for security. It covers the need for administrative rights only when necessary, such as installing symlinks, binding privileged ports, and ensuring 'localhost' and 'kubernetes.docker.internal' are defined. It also explains advanced settings for environments with elevated security, including configuring the location of Docker CLI tools, the default Docker socket, and privileged port mapping.