How To: Package a Docker Installer that Does Not Request Admin Privileges

Thanks fore the tip, @cgarvey, I'll give that a shot.

-- Deleted

So I thought I had this but something isn't working.

I made my Docker package with this edited post install script:

#!/bin/bash

# REF: https://forums.docker.com/t/feature-request-cli-tool-for-automated-installation/18334/4
# assumes the following directories exist:
# /usr/local/bin
# /Library/PrivilegedHelperTools

declare -r docker_bundle_dir=/Applications/Docker.app/Contents
declare -r privtools=/Library/PrivilegedHelperTools
declare -r launchDaemon=/Library/LaunchDaemons/com.docker.vmnetd.plist

for tool in com.docker.frontend docker docker-compose docker-diagnose docker-machine notary; do
    /bin/ln -sf "${docker_bundle_dir}"/Resources/bin/${tool} /usr/local/bin
done

[[ ! -d "${privtools}" ]] && /bin/mkdir -p "${privtools}" ; /bin/chmod 1755 "${privtools}"

/usr/bin/install -m 0544 -o root -g wheel "${docker_bundle_dir}"/Library/LaunchServices/com.docker.vmnetd "${privtools}"

# This file no longer exists in the installer. You need to copy a known good plist over now. For an example of the file, see the end.
#/usr/bin/install -m 0644 -o root -g wheel ${docker_bundle_dir}/Resources/com.docker.vmnetd.plist /Library/LaunchDaemons

# Let's get the correct vmnetd version to set the launchDaemon 
VERSION=$(/usr/bin/defaults read /Applications/Docker.app/Contents/Info.plist VmnetdVersion)

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# LAUNCH DAEMON CREATION
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

/bin/cat << EOF > "$launchDaemon"
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.docker.vmnetd</string>
    <key>Program</key>
    <string>/Library/PrivilegedHelperTools/com.docker.vmnetd</string>
    <key>ProgramArguments</key>
    <array>
        <string>/Library/PrivilegedHelperTools/com.docker.vmnetd</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>Sockets</key>
    <dict>
        <key>Listener</key>
        <dict>
            <key>SockPathMode</key>
            <integer>438</integer>
            <key>SockPathName</key>
            <string>/var/run/com.docker.vmnetd.sock</string>
        </dict>
    </dict>
    <key>Version</key>
    <string>$VERSION</string>
</dict>
</plist>
EOF

/usr/bin/plutil -convert xml1 "$launchDaemon"
## Set the permission on the file just made.
/usr/sbin/chown root:wheel "$launchDaemon"
/bin/chmod 0644 "$launchDaemon"
/bin/launchctl load "$launchDaemon"

Running this without a package, works! Docker loads without admin and everything is nice. If I run it from jamf (or as a pkg) it doesn't work. Any ideas?

I have been successful in creating a deployable Docker package....but I'm confused why I had to do it this way, so maybe someone can shed some light on it.

I made a standard package with the Docker app in the Applications folder. I added scripts to the post-install but it didn't work when I put it in the actual package! So what I did was break the scripts out and put them in Jamf and just run those after install. Same script I included in the package..just removed from the package. Why it works this way, i don't know.

First Post-install script:

#!/bin/bash
# Based on https://github.com/autopkg/chilcote-recipes/blob/master/Docker/Docker.munki.recipe
# which in turn is based on:
# <https://forums.docker.com/t/feature-request-cli-tool-for-automated-installation/18334/4>
# Will create:
# /Library/PrivilegedHelperTools
# /usr/local/bin
# if missing

declare -r docker_bundle_dir=/Applications/Docker.app/Contents
declare -r privtools=/Library/PrivilegedHelperTools
declare -r usr_local_bin=/usr/local/bin

[[ ! -d ${usr_local_bin} ]] && /bin/mkdir -p ${usr_local_bin} ; /bin/chmod 1755 ${usr_local_bin}
for tool in docker docker-compose docker-diagnose docker-machine notary; do
    /bin/ln -sf ${docker_bundle_dir}/Resources/bin/${tool} /usr/local/bin
done

[[ ! -d ${privtools} ]] && /bin/mkdir -p ${privtools} ; /bin/chmod 1755 ${privtools}

# unload com.docker.vmnetd if present
if [[ -e /Library/LaunchDaemons/com.docker.vmnetd.plist ]] ; then
    /bin/launchctl unload /Library/LaunchDaemons/com.docker.vmnetd.plist
fi

/usr/bin/install -m 0544 -o root -g wheel ${docker_bundle_dir}/Library/LaunchServices/com.docker.vmnetd ${privtools}

## this bit no longer works because the LD plist is no longer in the app bundle.
## See https://github.com/docker/roadmap/issues/80#issuecomment-853446920
#/usr/bin/install -m 0644 -o root -g wheel #${docker_bundle_dir}/Resources/com.docker.vmnetd.plist /Library/LaunchDaemons
##
## fragile replacement
/bin/cat > /Library/LaunchDaemons/com.docker.vmnetd.plist << EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.docker.vmnetd</string>
    <key>Program</key>
    <string>/Library/PrivilegedHelperTools/com.docker.vmnetd</string>
    <key>ProgramArguments</key>
    <array>
        <string>/Library/PrivilegedHelperTools/com.docker.vmnetd</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>Sockets</key>
    <dict>
        <key>Listener</key>
        <dict>
            <key>SockPathMode</key>
            <integer>438</integer>
            <key>SockPathName</key>
            <string>/var/run/com.docker.vmnetd.sock</string>
        </dict>
    </dict>
</dict>
</plist>
EOF
/bin/chmod 644 /Library/LaunchDaemons/com.docker.vmnetd.plist
## end fragile replacement
VERSION=$(/usr/bin/defaults read /Applications/Docker.app/Contents/Info.plist VmnetdVersion)
/usr/bin/defaults write /Library/LaunchDaemons/com.docker.vmnetd.plist Version -string ${VERSION}
/usr/bin/plutil -convert xml1 /Library/LaunchDaemons/com.docker.vmnetd.plist
/bin/chmod 0644 /Library/LaunchDaemons/com.docker.vmnetd.plist
/bin/launchctl load /Library/LaunchDaemons/com.docker.vmnetd.plist

And then the next one which sets up preferences:

#!/bin/zsh
#
# Description: Script to set Docker Settings.
#
#

# Set variables
JQ="/usr/local/bin/jq"
JQTrigger="${4}"
SettingsVersion="${5}"
# 3.4.0 is version 11
# 3.3.3 is version 10
# 2.5.0.1 is version 6

# Look for JQ for JSON editing
if [[ ! -f "$JQ" ]]; then
    echo "JQ not installed, installing..."
    /usr/local/bin/jamf policy -event "$JQTrigger"
fi

localUsers=( $(dscl . list /Users UniqueID | awk '$2 >= 501 {print $1}' | grep -Ev "^(lms-account|mfe|casperctrl|y_.*)$") )
for usr in ${localUsers[@]}; do
    SettingFile="/Users/$usr/Library/Group Containers/group.com.docker/settings.json"
    TmpSettings="/Users/$usr/Library/Group Containers/group.com.docker/old_settings.json"

    if [[ ! -f "$SettingFile" ]]; then
        echo "Settings file does not exist for $usr, creating..."
        mkdir -p "/Users/$usr/Library/Group Containers/group.com.docker/"
        echo "{}" > "$SettingFile" # Creating a json from scratch
        chmod 755 "/Users/$usr/Library/Group Containers/group.com.docker/"
        chmod 666 "$SettingFile"
        chown -R "$usr" "/Users/$usr/Library/Group Containers/group.com.docker/"
    fi

    # Do the stuff
    $JQ '. + {"checkForUpdates":false, "analyticsEnabled":false, "settingsVersion":'$SettingsVersion'}' "$SettingFile" > "$TmpSettings" && cp "$TmpSettings" "$SettingFile"
    defaults write /Users/$usr/Library/Preferences/com.docker.docker.plist SUEnableAutomaticChecks 0
done

I use JQ to do this and install if it's not already installed. Note that the "settings version" is required for an upgrade to work properly.

With all of this in place, I have successfully deployed 3.3.3 and 3.4.0.

I found that the following command works well.

 /Applications/Docker.app/Contents/MacOS/Docker --install-privileged-components

my install script steps as root:

1. Curl down latest DMG
2. Mount dmg
3. ditto Docker.app to /Applications/Docker.app
4. unmount dmg
5. run the --install-privileged-components command.

I've tested as standard user and Docker launches and works as expected.

This guy @Chris_Potrebka knows what he's talking about

@Chris_Potrebka Does this work with upgrades as well?

Update: It works! Thank you so much, @Chris_Potrebka !

Happy to help!

This is how I discovered docker --install-privileged-components

I started poking around the Docker.app using strings to see if there was any hidden commands and while the docker binary didn't provide anything interesting, the DockerHelper.app revealed what I was hoping for. I found it with the following command.

% strings /Applications/Docker.app/Contents/Library/LoginItems/DockerHelper.app/Contents/MacOS/DockerHelper | grep install

which gave me:

LLVM Profile Warning: Unable to install an exit signal handler for %d (errno = %d).
installPrivilegedComponents
uninstall
--install-privileged-components
installPrivilegedComponents
uninstall

I then tested...

/Applications/Docker.app/Contents/Library/LoginItems/DockerHelper.app/Contents/MacOS/DockerHelper --install-privileged-components

and it failed.

I then tested...

/Applications/Docker.app/Contents/MacOS/Docker --install-privileged-components

and it worked.

Just wanted to mention how perfect the --install-privileged-components command mentioned by @Chris_Potrebka was. Saved my day. You get an extra Kudos!

I'm not sure why Docker doesn't seem to document that from what I can tell. If it is documented, it's not easy to find. Though now that I know the term to search for, it seems to show up on a couple of threads on Docker's forum at least.

Thanks tones for the kudos! Greatly appreciated. 

P.S. l've consolidated my Jamf accounts down to this my original one. 🙂 

This seems broken again with the latest version of Docker:

Beginning on August 31, 2021, you must agree to the Docker Subscription Service Agreement to continue using Docker Desktop. Read the Blog and the Docker subscription FAQs to learn more about the changes.

Using the --install-privileged-components command doesn't bypass needing to accept the new Service Agreement. 

Any thoughts?

 /Applications/Docker.app/Contents/MacOS/Docker --install-privileged-components

@Chris_Potrebka  THANK YOU! ❤️ it works perfectly!

% strings /Applications/Docker.app/Contents/Library/LoginItems/DockerHelper.app/Contents/MacOS/DockerHelper | grep install

LLVM Profile Warning: Unable to install an exit signal handler for %d (errno = %d).
installPrivilegedComponents
uninstall
--install-privileged-components
installPrivilegedComponents
uninstall

/Applications/Docker.app/Contents/Library/LoginItems/DockerHelper.app/Contents/MacOS/DockerHelper --install-privileged-components

/Applications/Docker.app/Contents/MacOS/Docker --install-privileged-components

Hi Chris,

Would you be willing to share your entire script?

Very interested in giving this a go!

My learned colleague has scripted this and has it working (for initial installs and updates) with the attached script. All users are not admins. Tested and working on Intel and Apple Silicon.

https://gist.github.com/SamStenton/716fb44fae9d59b320a4b92108af0beb

% strings /Applications/Docker.app/Contents/Library/LoginItems/DockerHelper.app/Contents/MacOS/DockerHelper | grep install

LLVM Profile Warning: Unable to install an exit signal handler for %d (errno = %d).
installPrivilegedComponents
uninstall
--install-privileged-components
installPrivilegedComponents
uninstall

/Applications/Docker.app/Contents/Library/LoginItems/DockerHelper.app/Contents/MacOS/DockerHelper --install-privileged-components

/Applications/Docker.app/Contents/MacOS/Docker --install-privileged-components

Hi I am new to Jamf and trying to deploy Docker 4.7.1.  I have tried using both execute command or just run as Sudo in terminal with this command and both are giving me error “Permission error” Running Docker Desktop as root is dangerous. Please run it as a regular user.  If I run as regular user it requires me to enter my privilege password.

Appreciate if you can help.

We've taken a bit of a different approach so as not to make it a live download. We are packaging the docker.dmg with a postinstall script that installs and configures based on the Docker docs. The only weird thing is I have to temporarily disable Gatekeeper or the install will fail:

#!/bin/bash

## based on Jamf Nation content:
# https://community.jamf.com/t5/jamf-pro/how-to-package-a-docker-installer-that-does-not-request-admin/m-p/199627

## Docker "Command-line" install
# https://docs.docker.com/desktop/install/mac-install/#install-from-the-command-line

# installed resources in /tmp/docker/*
dockerDMG="Docker.dmg"
mountName="Docker"
currentUser=$( /usr/sbin/scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }' )

#################
# NEED TO DISABLE GATEKEEPER TO INSTALL THIS WAY?!!? Yep. Wow.
/usr/sbin/spctl --master-disable
#################

/usr/bin/xattr -d com.apple.quarantine "/tmp/docker/${dockerDMG}"

echo "Mounting Docker DMG"
/usr/bin/hdiutil attach "/tmp/docker/${dockerDMG}"

echo "DMG attached at /Volumes/${mountName}"
echo
echo "Starting Docker installation"
"/Volumes/${mountName}/Docker.app/Contents/MacOS/install" --accept-license --user="$currentUser"
echo

echo "Setting permissions on Docker.app"
/usr/sbin/chown -R "$currentUser" "/Applications/Docker.app"

echo "Clearing Quarantine Flags"
/usr/bin/xattr -dr com.apple.quarantine /Applications/Docker.app

echo "Installing additional Docker components so users don't need admin rights"
"/Applications/Docker.app/Contents/MacOS/Docker" --install-privileged-components

## Cleanup
/usr/sbin/spctl --master-enable

/bin/echo "Starting cleanup"
echo "Unmounting $dockerDMG"
/usr/bin/hdiutil detach "/Volumes/$mountName"
sleep 5
echo "Removing temp files"
/bin/rm -rf /tmp/docker

exit 0

#!/bin/bash

## based on Jamf Nation content:
# https://community.jamf.com/t5/jamf-pro/how-to-package-a-docker-installer-that-does-not-request-admin/m-p/199627

## Docker "Command-line" install
# https://docs.docker.com/desktop/install/mac-install/#install-from-the-command-line

# installed resources in /tmp/docker/*
dockerDMG="Docker.dmg"
mountName="Docker"
currentUser=$( /usr/sbin/scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }' )

#################
# NEED TO DISABLE GATEKEEPER TO INSTALL THIS WAY?!!? Yep. Wow.
/usr/sbin/spctl --master-disable
#################

/usr/bin/xattr -d com.apple.quarantine "/tmp/docker/${dockerDMG}"

echo "Mounting Docker DMG"
/usr/bin/hdiutil attach "/tmp/docker/${dockerDMG}"

echo "DMG attached at /Volumes/${mountName}"
echo
echo "Starting Docker installation"
"/Volumes/${mountName}/Docker.app/Contents/MacOS/install" --accept-license --user="$currentUser"
echo

echo "Setting permissions on Docker.app"
/usr/sbin/chown -R "$currentUser" "/Applications/Docker.app"

echo "Clearing Quarantine Flags"
/usr/bin/xattr -dr com.apple.quarantine /Applications/Docker.app

echo "Installing additional Docker components so users don't need admin rights"
"/Applications/Docker.app/Contents/MacOS/Docker" --install-privileged-components

## Cleanup
/usr/sbin/spctl --master-enable

/bin/echo "Starting cleanup"
echo "Unmounting $dockerDMG"
/usr/bin/hdiutil detach "/Volumes/$mountName"
sleep 5
echo "Removing temp files"
/bin/rm -rf /tmp/docker

exit 0

Hi I tried the script and not sure what I am doing wrong but I still can’t get pass the issue I am getting when running docker - -install-privileged-components

i get a pop-up

”Permission erro”

Running Docker Desktop as root is dangerous. Please run it as a regular user.

thanks

Hi desperately need help.  Can I asked when you run this command with sudo, are you getting error it’s dangerous to run docker with root?

thanks

@Eric1115 did you get a fix for error you mentioned ?

Hi @Eric1115 or @AquibAS, were you able to bypass that root error you've mentioned?

I started getting tickets with the previous Docker install no longer working. I rewrote my script this morning with the following and it seems to be functioning just fine now. I am by no means a scripting pro but it does the job for me. Feel free to offer up any changes. I also did not write the original script, I made adjustments to the one we were using.

#!/bin/bash

if [[ `uname -m` == 'arm64' ]]; then
# Apple Silicon
echo 'Downloading Apple Silcon release'
curl -o ~/Downloads/Docker.dmg https://desktop.docker.com/mac/main/arm64/Docker.dmg
else
# Intel
echo 'Downloading Apple Intel release'
curl -o ~/Downloads/Docker.dmg https://desktop.docker.com/mac/main/amd64/Docker.dmg
fi

# Mount image
hdiutil attach ~/Downloads/Docker.dmg

# Copy to Applcation folder
rm -rf /Applications/Docker.app # For updates remove the old app
cp -R /Volumes/Docker/Docker.app /Applications
/Applications/Docker.app/Contents/MacOS/install --accept-license --user=$3

# Clean up.
echo 'Cleaning up'
hdiutil unmount /Volumes/Docker/Docker.app
rm ~/Downloads/Docker.dmg

#Configure Docker
cp -R /Applications/Docker.app/Contents/Resources/bin /Users/$3/.docker
ln -s -f /Users/$3/.docker/bin/docker /usr/local/bin
ln -s -f /Users/$3/.docker/run/docker.sock /var/run/docker.sock

Hi @themarkdad, for some reason, I am still having this stubborn issue with getting the --accept-license to work properly. Have you or anyone ever experienced that with your modified script?