Windows Permission Requirements for Docker Desktop

--- description: Understand permission requirements for Docker Desktop for Windows keywords: Docker Desktop, Windows, security, install title: Understand permission requirements for Windows linkTitle: Windows permission requirements aliases: - /desktop/windows/privileged-helper/ - /desktop/windows/permission-requirements/ - /desktop/install/windows-permission-requirements/ weight: 40 --- This page contains information about the permission requirements for running and installing Docker Desktop on Windows, the functionality of the privileged helper process `com.docker.service`, and the reasoning behind this approach. It also provides clarity on running containers as `root` as opposed to having `Administrator` access on the host and the privileges of the Windows Docker engine and Windows containers. Docker Desktop on Windows is designed with security in mind. Administrative rights are only required when absolutely necessary. ## Permission requirements While Docker Desktop on Windows can be run without having `Administrator` privileges, it does require them during installation. On installation you receive a UAC prompt which allows a privileged helper service to be installed. After that, Docker Desktop can be run without administrator privileges, provided you are members of the `docker-users` group. If you performed the installation, you are automatically added to this group, but other users must be added manually. This allows the administrator to control who has access to Docker Desktop. The reason for this approach is that Docker Desktop needs to perform a limited set of privileged operations which are conducted by the privileged helper process `com.docker.service`. This approach allows, following the principle of least privilege, `Administrator` access to be used only for the operations for which it is absolutely necessary, while still being able to use Docker Desktop as an unprivileged user. ## Privileged helper The privileged helper `com.docker.service` is a Windows service which runs in the background with `SYSTEM` privileges. It listens on the named pipe `//./pipe/dockerBackendV2`. The developer runs the Docker Desktop application, which connects to the named pipe and sends commands to the service. This named pipe is protected, and only users that are part of the `docker-users` group can have access to it. The service performs the following functionalities: - Ensuring that `kubernetes.docker.internal` is defined in the Win32 hosts file. Defining the DNS name `kubernetes.docker.internal` allows Docker to share Kubernetes contexts with containers. - Ensuring that `host.docker.internal` and `gateway.docker.internal` are defined in the Win32 hosts file. They point to the host local IP address and allow an application to resolve the host IP using the same name from either the host itself or a container. - Securely caching the Registry Access Management policy which is read-only for the developer. - Creating the Hyper-V VM `"DockerDesktopVM"` and managing its lifecycle - starting, stopping, and destroying it. The VM name is hard coded in the service code so the service cannot be used for creating or manipulating any other VMs. - Moving the VHDX file or folder. - Starting and stopping the Windows Docker engine and querying whether it's running. - Deleting all Windows containers data files. - Checking if Hyper-V is enabled. - Checking if the bootloader activates Hyper-V. - Checking if required Windows features are both installed and enabled. - Conducting healthchecks and retrieving the version of the service itself.

This document details the permission requirements for installing and running Docker Desktop on Windows. Administrative rights are required during installation to install a privileged helper service, `com.docker.service`. After installation, Docker Desktop can be run by users in the `docker-users` group. The `com.docker.service` runs with `SYSTEM` privileges and handles tasks such as managing the Hyper-V VM, modifying the hosts file for DNS resolution, caching Registry Access Management policies, and managing the Windows Docker engine, ensuring Docker Desktop adheres to the principle of least privilege.