mirror of https://github.com/docker/docs.git
Indicate support for ECI Docker socket mount permission on WSL. (#19274)
Support for this feature is being added in Docker Desktop 4.28 and later. Update the docs accordingly. Signed-off-by: Cesar Talledo <cesar.talledo@docker.com> Co-authored-by: Allie Sadler <102604716+aevesdocker@users.noreply.github.com>
This commit is contained in:
parent
c079b156f9
commit
f68f5d2adb
|
@ -39,7 +39,7 @@ Hardened Docker Desktop moves the ownership boundary for Docker Desktop configur
|
||||||
|
|
||||||
It is for security conscious organizations who:
|
It is for security conscious organizations who:
|
||||||
- Don’t give their users root or admin access on their machines
|
- Don’t give their users root or admin access on their machines
|
||||||
- Would like Docker Desktop to be within their organization’s centralized control
|
- Would like Docker Desktop to be within their organization’s centralized control
|
||||||
- Have certain compliance obligations
|
- Have certain compliance obligations
|
||||||
|
|
||||||
### What does Hardened Docker Desktop include?
|
### What does Hardened Docker Desktop include?
|
||||||
|
|
|
@ -6,19 +6,15 @@ keywords: enhanced container isolation, Docker Desktop, Docker socket, bind moun
|
||||||
|
|
||||||
> **Note**
|
> **Note**
|
||||||
>
|
>
|
||||||
> This feature is available with Docker Desktop version 4.27 and later. It's currently in
|
> This feature is currently in [Beta](../../../release-lifecycle.md/#beta).
|
||||||
> [Beta](../../../release-lifecycle.md/#beta).
|
> It's available with Docker Desktop version 4.27 (and later) on Mac, Linux, and Windows (Hyper-V).
|
||||||
|
> For Windows with WSL 2, this feature requires Docker Desktop 4.28 and later.
|
||||||
{ .experimental }
|
{ .experimental }
|
||||||
|
|
||||||
This page describes optional, advanced configurations for ECI, once ECI is enabled.
|
This page describes optional, advanced configurations for ECI, once ECI is enabled.
|
||||||
|
|
||||||
## Docker socket mount permissions
|
## Docker socket mount permissions
|
||||||
|
|
||||||
> **Important**
|
|
||||||
>
|
|
||||||
> It does not yet work on Windows hosts when Docker Desktop configured to use WSL, but does work with Hyper-V.
|
|
||||||
{ .important }
|
|
||||||
|
|
||||||
By default, when ECI is enabled, Docker Desktop does not allow bind-mounting the
|
By default, when ECI is enabled, Docker Desktop does not allow bind-mounting the
|
||||||
Docker Engine socket into containers:
|
Docker Engine socket into containers:
|
||||||
|
|
||||||
|
@ -227,10 +223,6 @@ Whether to configure the list as an allow or deny list depends on the use case.
|
||||||
|
|
||||||
### Caveats and limitations
|
### Caveats and limitations
|
||||||
|
|
||||||
* Docker Socket Mount permissions don't yet work on Docker Desktop on Windows
|
|
||||||
hosts with WSL (but they work on Hyper-V). Support for WSL is expected to be
|
|
||||||
added soon.
|
|
||||||
|
|
||||||
* When Docker Desktop is restarted, it's possible that an image that is allowed
|
* When Docker Desktop is restarted, it's possible that an image that is allowed
|
||||||
to mount the Docker socket is unexpectedly blocked from doing so. This can
|
to mount the Docker socket is unexpectedly blocked from doing so. This can
|
||||||
happen when the image digest changes in the remote repository (e.g., a
|
happen when the image digest changes in the remote repository (e.g., a
|
||||||
|
|
|
@ -13,7 +13,7 @@ Hyper-V to create the Docker Desktop Linux VM. ECI was not supported when Docker
|
||||||
Desktop was configured to use Windows Subsystem for Linux (aka WSL).
|
Desktop was configured to use Windows Subsystem for Linux (aka WSL).
|
||||||
|
|
||||||
Starting with Docker Desktop 4.20, ECI is supported when Docker Desktop is
|
Starting with Docker Desktop 4.20, ECI is supported when Docker Desktop is
|
||||||
configured to use either Hyper-V or WSL version 2.
|
configured to use either Hyper-V or WSL 2.
|
||||||
|
|
||||||
>**Note**
|
>**Note**
|
||||||
>
|
>
|
||||||
|
|
|
@ -35,7 +35,7 @@ Using the `admin-settings.json` file, admins can:
|
||||||
- Configure HTTP proxies
|
- Configure HTTP proxies
|
||||||
- Configure network settings
|
- Configure network settings
|
||||||
- Configure Kubernetes settings
|
- Configure Kubernetes settings
|
||||||
- Enforce the use of WSL2 based engine or Hyper-V
|
- Enforce the use of WSL 2 based engine or Hyper-V
|
||||||
- Configure Docker Engine
|
- Configure Docker Engine
|
||||||
- Turn off Docker Desktop's ability to checks for updates
|
- Turn off Docker Desktop's ability to checks for updates
|
||||||
- Turn off Docker Extensions
|
- Turn off Docker Extensions
|
||||||
|
|
Loading…
Reference in New Issue