Functionality and Start Mode of the Privileged Helper Service

- Ensuring that `kubernetes.docker.internal` is defined in the Win32 hosts file. Defining the DNS name `kubernetes.docker.internal` allows Docker to share Kubernetes contexts with containers. - Ensuring that `host.docker.internal` and `gateway.docker.internal` are defined in the Win32 hosts file. They point to the host local IP address and allow an application to resolve the host IP using the same name from either the host itself or a container. - Securely caching the Registry Access Management policy which is read-only for the developer. - Creating the Hyper-V VM `"DockerDesktopVM"` and managing its lifecycle - starting, stopping, and destroying it. The VM name is hard coded in the service code so the service cannot be used for creating or manipulating any other VMs. - Moving the VHDX file or folder. - Starting and stopping the Windows Docker engine and querying whether it's running. - Deleting all Windows containers data files. - Checking if Hyper-V is enabled. - Checking if the bootloader activates Hyper-V. - Checking if required Windows features are both installed and enabled. - Conducting healthchecks and retrieving the version of the service itself. The service start mode depends on which container engine is selected, and, for WSL, on whether it is needed to maintain `host.docker.internal` and `gateway.docker.internal` in the Win32 hosts file. This is controlled by a setting under `Use the WSL 2 based engine` in the settings page. When this is set, WSL engine behaves the same as Hyper-V. So: - With Windows containers, or Hyper-v Linux containers, the service is started when the system boots and runs all the time, even when Docker Desktop isn't running. This is required so you can launch Docker Desktop without admin privileges. - With WSL2 Linux containers, the service isn't necessary and therefore doesn't run automatically when the system boots. When you switch to Windows containers or Hyper-V Linux containers, or choose to maintain `host.docker.internal` and `gateway.docker.internal` in the Win32 hosts file, a UAC prompt appears asking you to accept the privileged operation to start the service. If accepted, the service is started and set to start automatically upon the next Windows boot. ## Containers running as root within the Linux VM The Linux Docker daemon and containers run in a minimal, special-purpose Linux

The privileged helper service `com.docker.service` performs various functions including managing DNS entries in the Win32 hosts file, caching Registry Access Management policies, managing the Hyper-V VM, controlling the Windows Docker engine, and checking Hyper-V and Windows feature status. Its start mode depends on the selected container engine. For Windows or Hyper-V Linux containers, the service runs continuously. For WSL2 Linux containers, it's not automatically started unless needed to maintain DNS entries, requiring a UAC prompt to start the service and set it to start automatically on boot.