When Docker installs on a machine, it asks the user for root privileges to finish its installation process after you start it the first time. In our environment, we decided that it's best users don't need to enter any sort of credentials to finish the installation of an application. So, via a trail of troubleshooting steps I found online and some trial & error, I was able to put together an installer that does not need root privileges to finish its installation.
Use the following directions to create a version of the installer that does not require Admin Rights. If you are already familiar with making JSS policies and using Composer, check out the TLDR section at the bottom.
- Download Docker For Mac
- Mount the Docker DMG
- Open Composer
- Click on New
- Select Normal Snapshot
- Click Next
- Name the Snapshot and click next
- Once the Snapshot has finished creating, drag the Docker application into the root Applications folder
- Open Applications, and then open Docker
- Docker will post an introductory window, click OK
- Docker will ask for privileged access, click OK
- Enter your Admin credentials and click okay
- Docker will run its final installation steps
- Click Got It after Docker has finished running its post-installation
- In Composer, click Create Package Source
- Drill down Library>LaunchDaemons
- Select the com.docker.vmnetd.plist file
- Ensure that the file's owner is root, and group is wheel.
- Check the box for X (execute) on the Owner row. Verify that it states Mode: 744 (not 644)
- Drill down Users>{username}>Library>Containers>com.docker.docker
- Delete the Data folder within the com.docker.docker folder
- Ensure there are no additional folders unrelated to the Docker installation in the package source. In my case I removed the Saved Application State folder.
- Once you've done this, click on Build as DMG and save to your package build location
- Open Casper Admin and drag the DMG into Casper Admin to upload.
- Change the settings on the DMG to turn on FEU (Fill Existing User Template)
- Categorize the file
- Save
- Log into the JSS and Create the Docker policy.
- Place the DMG in the policy
- Set the policy to restart after install (Restart Options>User Logged In Action> Restart)
- Add Files and Processes, add the following one liner to Execute Command: /bin/launchctl load -Fw /Library/LaunchDaemons/com.docker.vmnetd.plist
- Setup to install from Self Service
TLDR Version;
Install using a composer snapshot as normal.
The only major differences are as follows:
Change /Library/LaunchDaemon/com.docker.vmnetd.plist to 744 and root:wheel
Delete the Data folder found in Users/{username}/Library/Containers/com.docker.docker
Save as DMG, place on Casper Admin with FEU enabled
In Policy: Ensure that the computer restarts after install. Add the following one liner in Execute Command:
/bin/launchctl load -Fw /Library/LaunchDaemons/com.docker.vmnetd.plist
Hey @Jacher - have you had a chance to package / distribute an update? As a test I've successfully packaged Docker Edge and now just packaging the update in preparation to test the distribution of this.
I'd be interested to see if you have investigated how to suppress any update notifications. I've already had a support ticket raised about not being able to install the update without elevated rights.
Thanks!
Greetings Nation,
I was given the task to find out why docker desktop was not working/admin prompt popping up. Our devices are 1 to 1, but I am sure something like Outset could work for shared devices. The version we are using is 2.4.0.0, and it is deployed via Self-Service. The following worked in our case. I am not sure if docker has posted an "official" method. I make no guarantees, and the usual rules apply test, test, test and use at your own risk.
I did not package it but will leave a suspicious package screenshot. The team had made the package with the user similar to the above process. Well, that was problem number one. That user was not on the production Macs, so soft linking did not work.
The next problem was that they did not have a post-install script. So I grabbed the settings.json file, made the below edit to "datafolder" to blank ( it will default to the current logged in user's home folder). I dropped it in /var/tmp and made a package.
Next, I used the following script, with help from all of you. So what this does is check for "/Users/currntloggedinuser/Library/Group Containers/group.com.docker" folder. If it is not present, it creates the folder then copies the settings.json file over to "/Users/currentloggedinuser/Library/Group Containers/group.com.docker". It installs the app Package, then runs the post-install. The last step was to create a PPPC file for the desktop folder, documents folder, and reminders(?) with PPPC Utility. I will tackle updates next.
#!/bin/sh
currentUser=`stat -f "%Su" /dev/console`
/usr/bin/sudo -u $currentUser mkdir /Users/$currentUser/Library/Group Containers/group.com.docker
/usr/bin/sudo -u $currentUser cp /var/tmp/settings.json /Users/$currentUser/Library/Group Containers/group.com.docker/
sleep 5
/usr/bin/sudo defaults write /Users/$currentUser/Library/Preferences/com.docker.docker.plist SUEnableAutomaticChecks 0
/usr/bin/sudo cp /Applications/Docker.app/Contents/Library/LaunchServices/com.docker.vmnetd /Library/PrivilegedHelperTools
/usr/bin/sudo cp /Applications/Docker.app/Contents/Resources/com.docker.vmnetd.plist /Library/LaunchDaemons
/usr/bin/sudo chown root:wheel /Library/LaunchDaemons/com.docker.vmnetd.plist /Library/PrivilegedHelperTools/com.docker.vmnetd
/usr/bin/sudo chmod 744 /Library/LaunchDaemons/com.docker.vmnetd.plist
/usr/bin/sudo launchctl load -Fw /Library/LaunchDaemons/com.docker.vmnetd.plist
/usr/bin/sudo rm -rf /var/tmp/settings.json
