5 ms·

Docker Desktop Broken on Mac OS Update for over a Week

66 points by JohnMakin 2y ago

JohnMakin 2y ago
I wanted to leave the original post unsullied by my ragy commentary: They are listing this as "operational" but the steps they are outlining here are not a proper solution for this problem! I cannot sudo on my work macs. How can a severe problem like this go on for more than a week? This has completely shut down my local development. I'm mad at the situation more than anything, but also a big middle finger to mac OS for not allowing me, a somewhat mature professional adult with expertise in stuff like this, what I want on my machine. My new workstation orders are not going to be macs. Good job! The worst part is, even if you go with the extremely user-hostile un-minimizable prompt wants you to do, which is delete a bunch of files, the popup will still spam you until you are able to follow the instructions on the remediation that docker provided! Completely FUBAR
- nikau 2y ago
  Turn off updates, test things first
- JojoFatsani 2y ago
  John, it's really pretty easy to fix: Take a deep breath. Uninstall docker, including from homebrew if you've ever used that to install it. Reboot Download newest ARM version from Docker. Install it. Reboot again. You should be good.
  - JohnMakin 2y ago
    If it wasn’t clear in my original post, I have to solve this for a fleet of machines. I’ve taken many breaths today, but thanks for your condescending concern. And as I said, for people with typical machine access in an org, this is a completely unacceptable solution. Anything that requires sudo access and a pasted bash script in a doc is a completely unacceptable solution. You cannot turn around and call this solved.
    - honestSysAdmin 2y ago
      What you can do is have a cron job that continuously polls one or more URLs looking for tarballs with Git repos accompanied by GnuPG or Signify signatures. The primary idea is that the tarballs are only unpacked and executed if the signatures are valid and anything received by the machines is only executed after the hashes and signatures are successfully logged, this prevents (or at least documents) any abuse on the part of the IT team. Inside the tarballs are Salt, Ansible, and/or shell commands. In addition to a cron job, we had an active pubsub listener on each machine to poke this process. You can do this on macOS too, or at least, modern macOS "should" be able to do this. We did this on a large fleet of user machines (laptops) running Windows 10/11, macOS, and Linux.
    - zdragnar 2y ago
      On an entirely separate tangent... Why are you remotely managing macs? That seems like a cluster of nightmarish proportions without even getting to this issue. If you don't trust people, give them Windows and use the tools that have been around for decades for this.
      - smithcoin 2y ago
        Remote management is a requirement for SOC other compliance frameworks.
        hedora 2y ago
        That doesn’t sound right. Most of SOC compliance boils down to having a plan to check enterprisey checkboxes. So, you pay someone that can write a report explaining how the boxes will be checked in a way that minimizes the blast radius of security theater stuff like broken approaches to remote management. Consider fixing your soc compliance plan. Anyway, assuming the remote management tool has root, you can use brew to install docker desktop from the cli.
        ghxst 2y ago
        In principle yes. The implementation however is rarely defined (if you have examples, feel free to share). In my experience it's by choice that companies use compliance to turn their dev environments into a micromanaged hell that engineers hate working in (our company went through multiple compliance certifications including SOC1 and SOC2).
- soraminazuki 2y ago
  Judging from the fact that all the workaround does is reinstall a privileged daemon, you needed root to install Docker in the first place. Why are you outraged that you need root again to reinstall? Moreover, how is that even a macOS problem? Being outraged that you need to invoke administrative privileges on a development machine seems unreasonable to me. You can't get far with that kind of restriction.
  - JohnMakin 2y ago
    because modern macOs does not gracefully allow true root, without hacking, in a way that doesnt solve compliance requirements?
    - soraminazuki 2y ago
      macOS obviously has the capability to reinstall Docker. If your company is preventing you from upgrading to the fixed version in timely manner, that's your company's responsibility.
      - JohnMakin 2y ago
        Perhaps you should inform yourself about the actual problem/proposed solution here - the issue isnt installing a fresh new version, it’s the uninstallation steps required to even get there in the first place. and no, mac os will not let me do this, even when I follow the prompts. docker’s elevated permission scripted solution is the only thing that has worked yet.
        soraminazuki 2y ago
        Looking at the incident page, the bash solution was superseded by a proper release the next day. And the linked document specifically instructs to "update directly through the app" if possible [1]. So uninstall not working is completely news for most people reading this thread. Even the title of this thread, "Docker Desktop Broken on Mac OS Update for over a Week," isn't substantiated anywhere else. But even if it is required to manually stop and remove the two daemons, shouldn't that be doable using any device management solution? Perhaps using something like Jamf Self Service? Because it otherwise wouldn't be possible to deploy any changes without that kind of capability. [1]: https://docs.docker.com/desktop/cert-revoke-solution/ https://docs.docker.com/desktop/cert-revoke-solution/
- gunian 2y ago
  used to have a gig where local dev worked on all machines except mine lol if it is only broken when Docker messes up horrible but not the worst it could be if perspective helps in this situation :)
- JohnMakin 2y ago
  Not having sudo on a work managed mac is so completely common that I struggle to take anyone seriously that argues otherwise and I'll just leave that comment here
  - theamk 2y ago
    My sample of 3 shows the Macs in big corp has some way to temporary get sudo. Some sort of proprietary app you run that grants you permissions for a period of time. Sometimes there is a text field for "reason", but no one ever reads it.
  - dacryn 2y ago
    A work managed mac without a sort of helpdesk that can help you fix an update issue of approved software is equally unserious. I have never had sudo on a work managed device, but always had a phone number to call for exactly these types of issues. Explain the problem, point them to the fix. They look it up internally, call me back half an hour later, take over the machine and perform the procedure. Is it frictionless? No. Is it impossible? No, just part of dealing with corporate IT.
    - JohnMakin 2y ago
      Imagine I am the corporate IT here. I don’t even need docker desktop! I’m switching to something else. This is now a huge unnecessary pain that still has yet to be explained.
rvz 2y ago
How can a broken update like this even happen? Surely Docker goes under rigorous testing before actions like this? I'm still waiting for a detailed post mortem, [0] but quite frankly this is a very basic intern mistake, but done by "senior" engineers. In the mean time, I'm using Orbstack. [1] Much faster, lightweight and a native alternative. [0] https://news.ycombinator.com/item?id=42695066 https://news.ycombinator.com/item?id=42695066 [1] https://orbstack.dev https://orbstack.dev
- satoru42 2y ago
  I really like Orbstack, switched to it and never looked back.
  - meagher 2y ago
    +1 OrbStack is incredible
- nomilk 2y ago
  Also odd that it's taking so long to patch. A week is a long time to be without a key part of developer tooling.
- adastra22 2y ago
  Their signing key was revoked by apple. Unclear if this is by accident or in response for something. But the downstream effect is that it breaks updates.
xyst 2y ago
I experienced this earlier in the week. Didn’t realize it was an upstream issue. I ended up re-installing docker which somehow fixed the issue. Work machine is managed by orgs fleet management software (jamf?) and thought it was an issue on their end (bad conf push).
segfaltnh 2y ago
Docker has jumped the shark as a company, good thing the alternatives are maturing quickly. We've had pretty good (not perfect) success with the Colima project.
- tonymet 2y ago
  What did I miss?
  - dev_daftly 2y ago
    They decided they want to actually get paid for their work and changed their pricing structure so large companies need to pay for their software and apparently that's terrible and everybody started being very vocal about alternatives despite still being able to use it for free.
    - tonymet 2y ago
      sounds reasonable
frogperson 2y ago
Colima on MacOS is so much easier and better than Docker Desktoo
cabronerp 2y ago
Thanks for posting this!
gunian 2y ago
is there anything like firecracker that works on macOS/Linux/Windows? or does anyone know if someone is working on one
jbverschoor 2y ago
Orbstack
jamifsud 2y ago
I'm hearing about lots of alternatives lately: Comila, Rancher Desktop, Podman Desktop, OrbStack, etc. Which one do folks like best?
- foobarchu 2y ago
  I'm partial to Rancher Desktop, in my experience it's the most drop in replacement.
- jchw 2y ago
  If you find yourself bottlenecked on IO performance, OrbStack is the best. Also a fan of the fact that it has a very similar VM function to WSL2. Also supports using either Rosetta or Qemu for emulation of Intel architecture, and has some kind of Kubernetes integration that I didn't try. Last I tried Podman Desktop, it was OK, but had worse performance than Docker and was a little rougher around the edges. Still, not bad. Colima is probably fine, but I had issues that were showstoppers for me. Trying to get it to consistently start up correctly in a CI environment seemed oddly challenging, and it doesn't seem to support IPv6 at all. YMMV. Have not tried Rancher Desktop.
  - campbel 2y ago
    I did evals of most of the popular ones for my company and my opinion is OrbStack is best performance and most reliable. The Kubernetes integration is also very nice and resetting it takes about ~10s in case you get in a pickle.
- aaomidi 2y ago
  OrbStack has been great. I'm not affiliated with them but a happy customer. They've had issues where an update broke them in very _weird_ ways, but I've been very impressed with their support engineers on this. I've even had a situation where the support engineer jumped on a call with me to see the repro as it was a very specific/hard to share a simple repro situation.
- commandersaki 2y ago
  Big fan of colima. It's pretty fast (in some cases not on parity with Orbstack), but it's free and doesn't have annoying Electron GUI or any crap like that. Orbstack would be my next choice, but costs money for comercial user and my employer is a tight arse.
iameli 2y ago
Been using and happy with Podman Desktop for a while now on Mac
- betaby 2y ago
  Podman Desktop on Mac uses weird user-pace IP stack which does direct socket allocations on the MAcOS host itself. Additionally, Podman Desktop on Mac always return on ICMP echo, try running `ping 5.5.5.5` or any other non-ping-able IP and see it yourself.
  - rgovostes 2y ago
    Can you elaborate on the direct socket allocations?
    - betaby 2y ago
      You can see `tcp` sessions of the container using `netstat` on the host MacOS if you use Podman Desktop. That's not the case if podman runs on a Linux VM on UTM for example. Additionally, ICMP behaves correctly in the later case.
mrpippy 2y ago
Judging from the script linked here (https://github.com/docker/for-mac/issues/7527 https://github.com/docker/for-mac/issues/7527), Docker’s Developer ID cert was revoked by Apple. Are…they going to explain why/how that happened?
- js2 2y ago
  It's also possible someone with access to the Docker team account on the Apple developer portal revoked it by accident. The access controls on the Apple developer portal are not particularly fine grained, there is no audit trail, and many actions cannot be undone.
  - agsnu 2y ago
    That’s what I thought at first, but actually this seems to be not the case for Developer ID certificates? https://developer.apple.com/help/account/reference/revoking-privileges/ https://developer.apple.com/help/account/reference/revoking-...
    - mrpippy 2y ago
      Correct. Developer ID certs cannot be revoked self-service, you have to email Apple.
  - joshstrange 2y ago
    Gets out soapbox App Store Developer portal is a mess. I manage 10+ accounts and I hate using it so much (Google Play isn’t better, just sucks in different ways). I also have access to an enterprise account and “nerve racking” does not even begin to describe what interacting with the portal is like. A single click with a badly worded confirmation step is the ONLY thing keeping your released app in the field from shutting down until you get a new version out. Let me say that again: if you delete your signing cert then your app will not open on devices anymore. No way to communicate to users to update or let them know anything at all. Just dead. Even if you avoid making that mistake, the cert rotation dance is horrible and terrifying, it doesn’t help that Apple’s docs and help text are completely useless. It doesn’t help that most info you find online is for AppStore certs/signing and not Enterprise certs/signing (the _massive_ difference being you can revoke a cert for an App Store app and it keeps working). There is no wording about max certs on their webpage so in most cases you just have to try something in the portal and see if it fails. It’s even more fun because every click in the cert rotation process is a gamble and so after you’ve worked yourself up to finally clicking the button you then run right into an error and you have to rethink your strategy. Again, your entire business potentially hangs in the balance if you pick wrong, have fun! I understand what Apple is trying to accomplish and that’s fine but they need better messaging. They need to make it clear what the effects of revoking/deleting certs/profiles is. They need to make the connections between certs and profiles more obvious. The whole UI is horrible and flakey on top of that.
jjayj 2y ago
We ran into this, informed our users to reinstall Docker (we use Homebrew), and seemingly have had no further issues. I guess we're the minority? I would be more inclined to blame this on Apple than Docker, but I haven't looked too deeply since things are working for us. Curious about you folks' opinions.
localghost3000 2y ago
Ran into this today. Took me about an hour to figure out. You have to run the script they provide (can’t find the link right now but it’s in the GH issue). But if you are like me and installed it via homebrew, you also you have to uninstall docker fully and you have to do it via homebrew. So instead of upgrading you have to `brew uninstall docker` and THEN brew update & `brew install —cask docker`. Bit of a pain but it does eventually sort itself out.
- jey 2y ago
  looks to be this: https://github.com/docker/for-mac/issues/7527#issuecomment-2582955343 https://github.com/docker/for-mac/issues/7527#issuecomment-2...
  - heelix 2y ago
    Installing 4.37.2 does sort the malware warning, for those who install with the binary. Was a fun post holiday treat for those who have lots of developers.
    - JohnMakin 2y ago
      yes. it’s been a stupid amount of work for something I could not possibly care less about, but the issues for me are not the fresh installs of the patched version, but uninstalling corrupted versions.
joshdavham 2y ago
Yeah I was having some trouble with it a little less than a week ago. I downloaded the new update and then my app was corrupt and couldn't open so I just re-downloaded and installed and it was fine.
jonathanlydall 2y ago
I had a bizarre issue with Docker Desktop on Windows this week where it had somehow been uninstalled. I only occasionally use Docker, probably used it about a month ago (with summer Christmas break here), but when I tried on Monday it just wasn’t on my computer any more. My PC isn’t managed at all by any other system or person.
- theshrike79 2y ago
  These are usually caused by failed autoupdates. It uninstalls the old one, fails at installing new version -> whoops, gone.
sshine 2y ago
OrbStack is the best alternative to Docker Desktop on Mac.
- theshrike79 2y ago
  When Enterprise pricing is "contact sales", I usually just close the tab.
  - sshine 2y ago
    I never needed Enterprise Docker Desktop. I hardly even need Docker Desktop. It just proves useful to start and stop Docker this way, since it uses fewer resources.
angoragoats 2y ago
Heads up to anyone at a company using Docker Desktop: If your company has over 250 employees or more than $10 million in annual revenue, it's against their license terms for anyone at the company to use Docker Desktop without paying for a subscription [0]. Docker can and will go after companies who are out of compliance with this (ask me how I know). If paying a subscription fee for a sub-par product doesn't sound great to you, I encourage you to check out one of the many alternatives available. I've used Colima (MIT licensed) [1] for a few years now and it works great. [0] https://www.docker.com/pricing/faq/ https://www.docker.com/pricing/faq/, see the section "Who’s required to pay for Docker subscription plans?" [1] https://github.com/abiosoft/colima https://github.com/abiosoft/colima
1x00 2y ago
https://orbstack.dev/ https://orbstack.dev/
CafeRacer 2y ago
We're relying on buildx bake. And few days ago Docker just stopped working. I tried the steps that they outlined with no success. I know I can still run it from CD/CI, but I don't want to jump around like a crazy monkey trying to debug my builds locally. I had issues with docker desktop just hanging on my mac. I've been using podman for over a year with docker context pointing to podman so I can still use bake. I've moved some of our workloads to s2i and bash scripts and could not be happier. Old good sysadminy stuff just works.

66 points by JohnMakin 2y ago

I wanted to leave the original post unsullied by my ragy commentary: They are listing this as "operational" but the steps they are outlining here are not a proper solution for this problem! I cannot sudo on my work macs. How can a severe problem like this go on for more than a week? This has completely shut down my local development. I'm mad at the situation more than anything, but also a big middle finger to mac OS for not allowing me, a somewhat mature professional adult with expertise in stuff like this, what I want on my machine. My new workstation orders are not going to be macs. Good job! The worst part is, even if you go with the extremely user-hostile un-minimizable prompt wants you to do, which is delete a bunch of files, the popup will still spam you until you are able to follow the instructions on the remediation that docker provided! Completely FUBAR

nikau 2y ago
Turn off updates, test things first
JojoFatsani 2y ago
John, it's really pretty easy to fix: Take a deep breath. Uninstall docker, including from homebrew if you've ever used that to install it. Reboot Download newest ARM version from Docker. Install it. Reboot again. You should be good.
- JohnMakin 2y ago
  If it wasn’t clear in my original post, I have to solve this for a fleet of machines. I’ve taken many breaths today, but thanks for your condescending concern. And as I said, for people with typical machine access in an org, this is a completely unacceptable solution. Anything that requires sudo access and a pasted bash script in a doc is a completely unacceptable solution. You cannot turn around and call this solved.
  - honestSysAdmin 2y ago
    What you can do is have a cron job that continuously polls one or more URLs looking for tarballs with Git repos accompanied by GnuPG or Signify signatures. The primary idea is that the tarballs are only unpacked and executed if the signatures are valid and anything received by the machines is only executed after the hashes and signatures are successfully logged, this prevents (or at least documents) any abuse on the part of the IT team. Inside the tarballs are Salt, Ansible, and/or shell commands. In addition to a cron job, we had an active pubsub listener on each machine to poke this process. You can do this on macOS too, or at least, modern macOS "should" be able to do this. We did this on a large fleet of user machines (laptops) running Windows 10/11, macOS, and Linux.
  - zdragnar 2y ago
    On an entirely separate tangent... Why are you remotely managing macs? That seems like a cluster of nightmarish proportions without even getting to this issue. If you don't trust people, give them Windows and use the tools that have been around for decades for this.
    - smithcoin 2y ago
      Remote management is a requirement for SOC other compliance frameworks.
      - hedora 2y ago
        That doesn’t sound right. Most of SOC compliance boils down to having a plan to check enterprisey checkboxes. So, you pay someone that can write a report explaining how the boxes will be checked in a way that minimizes the blast radius of security theater stuff like broken approaches to remote management. Consider fixing your soc compliance plan. Anyway, assuming the remote management tool has root, you can use brew to install docker desktop from the cli.
      - ghxst 2y ago
        In principle yes. The implementation however is rarely defined (if you have examples, feel free to share). In my experience it's by choice that companies use compliance to turn their dev environments into a micromanaged hell that engineers hate working in (our company went through multiple compliance certifications including SOC1 and SOC2).
soraminazuki 2y ago
Judging from the fact that all the workaround does is reinstall a privileged daemon, you needed root to install Docker in the first place. Why are you outraged that you need root again to reinstall? Moreover, how is that even a macOS problem? Being outraged that you need to invoke administrative privileges on a development machine seems unreasonable to me. You can't get far with that kind of restriction.
- JohnMakin 2y ago
  because modern macOs does not gracefully allow true root, without hacking, in a way that doesnt solve compliance requirements?
  - soraminazuki 2y ago
    macOS obviously has the capability to reinstall Docker. If your company is preventing you from upgrading to the fixed version in timely manner, that's your company's responsibility.
    - JohnMakin 2y ago
      Perhaps you should inform yourself about the actual problem/proposed solution here - the issue isnt installing a fresh new version, it’s the uninstallation steps required to even get there in the first place. and no, mac os will not let me do this, even when I follow the prompts. docker’s elevated permission scripted solution is the only thing that has worked yet.
      - soraminazuki 2y ago
        Looking at the incident page, the bash solution was superseded by a proper release the next day. And the linked document specifically instructs to "update directly through the app" if possible [1]. So uninstall not working is completely news for most people reading this thread. Even the title of this thread, "Docker Desktop Broken on Mac OS Update for over a Week," isn't substantiated anywhere else. But even if it is required to manually stop and remove the two daemons, shouldn't that be doable using any device management solution? Perhaps using something like Jamf Self Service? Because it otherwise wouldn't be possible to deploy any changes without that kind of capability. [1]: https://docs.docker.com/desktop/cert-revoke-solution/ https://docs.docker.com/desktop/cert-revoke-solution/
gunian 2y ago
used to have a gig where local dev worked on all machines except mine lol if it is only broken when Docker messes up horrible but not the worst it could be if perspective helps in this situation :)
JohnMakin 2y ago
Not having sudo on a work managed mac is so completely common that I struggle to take anyone seriously that argues otherwise and I'll just leave that comment here
- theamk 2y ago
  My sample of 3 shows the Macs in big corp has some way to temporary get sudo. Some sort of proprietary app you run that grants you permissions for a period of time. Sometimes there is a text field for "reason", but no one ever reads it.
- dacryn 2y ago
  A work managed mac without a sort of helpdesk that can help you fix an update issue of approved software is equally unserious. I have never had sudo on a work managed device, but always had a phone number to call for exactly these types of issues. Explain the problem, point them to the fix. They look it up internally, call me back half an hour later, take over the machine and perform the procedure. Is it frictionless? No. Is it impossible? No, just part of dealing with corporate IT.
  - JohnMakin 2y ago
    Imagine I am the corporate IT here. I don’t even need docker desktop! I’m switching to something else. This is now a huge unnecessary pain that still has yet to be explained.

rvz 2y ago

How can a broken update like this even happen? Surely Docker goes under rigorous testing before actions like this? I'm still waiting for a detailed post mortem, [0] but quite frankly this is a very basic intern mistake, but done by "senior" engineers. In the mean time, I'm using Orbstack. [1] Much faster, lightweight and a native alternative. [0] https://news.ycombinator.com/item?id=42695066 https://news.ycombinator.com/item?id=42695066 [1] https://orbstack.dev https://orbstack.dev

satoru42 2y ago
I really like Orbstack, switched to it and never looked back.
- meagher 2y ago
  +1 OrbStack is incredible
nomilk 2y ago
Also odd that it's taking so long to patch. A week is a long time to be without a key part of developer tooling.
adastra22 2y ago
Their signing key was revoked by apple. Unclear if this is by accident or in response for something. But the downstream effect is that it breaks updates.

xyst 2y ago

I experienced this earlier in the week. Didn’t realize it was an upstream issue. I ended up re-installing docker which somehow fixed the issue. Work machine is managed by orgs fleet management software (jamf?) and thought it was an issue on their end (bad conf push).

segfaltnh 2y ago

Docker has jumped the shark as a company, good thing the alternatives are maturing quickly. We've had pretty good (not perfect) success with the Colima project.

tonymet 2y ago
What did I miss?
- dev_daftly 2y ago
  They decided they want to actually get paid for their work and changed their pricing structure so large companies need to pay for their software and apparently that's terrible and everybody started being very vocal about alternatives despite still being able to use it for free.
  - tonymet 2y ago
    sounds reasonable

frogperson 2y ago

Colima on MacOS is so much easier and better than Docker Desktoo

cabronerp 2y ago

Thanks for posting this!

gunian 2y ago

is there anything like firecracker that works on macOS/Linux/Windows? or does anyone know if someone is working on one

jbverschoor 2y ago

Orbstack

jamifsud 2y ago

I'm hearing about lots of alternatives lately: Comila, Rancher Desktop, Podman Desktop, OrbStack, etc. Which one do folks like best?

foobarchu 2y ago
I'm partial to Rancher Desktop, in my experience it's the most drop in replacement.
jchw 2y ago
If you find yourself bottlenecked on IO performance, OrbStack is the best. Also a fan of the fact that it has a very similar VM function to WSL2. Also supports using either Rosetta or Qemu for emulation of Intel architecture, and has some kind of Kubernetes integration that I didn't try. Last I tried Podman Desktop, it was OK, but had worse performance than Docker and was a little rougher around the edges. Still, not bad. Colima is probably fine, but I had issues that were showstoppers for me. Trying to get it to consistently start up correctly in a CI environment seemed oddly challenging, and it doesn't seem to support IPv6 at all. YMMV. Have not tried Rancher Desktop.
- campbel 2y ago
  I did evals of most of the popular ones for my company and my opinion is OrbStack is best performance and most reliable. The Kubernetes integration is also very nice and resetting it takes about ~10s in case you get in a pickle.
aaomidi 2y ago
OrbStack has been great. I'm not affiliated with them but a happy customer. They've had issues where an update broke them in very _weird_ ways, but I've been very impressed with their support engineers on this. I've even had a situation where the support engineer jumped on a call with me to see the repro as it was a very specific/hard to share a simple repro situation.
commandersaki 2y ago
Big fan of colima. It's pretty fast (in some cases not on parity with Orbstack), but it's free and doesn't have annoying Electron GUI or any crap like that. Orbstack would be my next choice, but costs money for comercial user and my employer is a tight arse.

iameli 2y ago

Been using and happy with Podman Desktop for a while now on Mac

betaby 2y ago
Podman Desktop on Mac uses weird user-pace IP stack which does direct socket allocations on the MAcOS host itself. Additionally, Podman Desktop on Mac always return on ICMP echo, try running `ping 5.5.5.5` or any other non-ping-able IP and see it yourself.
- rgovostes 2y ago
  Can you elaborate on the direct socket allocations?
  - betaby 2y ago
    You can see `tcp` sessions of the container using `netstat` on the host MacOS if you use Podman Desktop. That's not the case if podman runs on a Linux VM on UTM for example. Additionally, ICMP behaves correctly in the later case.

mrpippy 2y ago

Judging from the script linked here (https://github.com/docker/for-mac/issues/7527 https://github.com/docker/for-mac/issues/7527), Docker’s Developer ID cert was revoked by Apple. Are…they going to explain why/how that happened?

js2 2y ago
It's also possible someone with access to the Docker team account on the Apple developer portal revoked it by accident. The access controls on the Apple developer portal are not particularly fine grained, there is no audit trail, and many actions cannot be undone.
- agsnu 2y ago
  That’s what I thought at first, but actually this seems to be not the case for Developer ID certificates? https://developer.apple.com/help/account/reference/revoking-privileges/ https://developer.apple.com/help/account/reference/revoking-...
  - mrpippy 2y ago
    Correct. Developer ID certs cannot be revoked self-service, you have to email Apple.
- joshstrange 2y ago
  Gets out soapbox App Store Developer portal is a mess. I manage 10+ accounts and I hate using it so much (Google Play isn’t better, just sucks in different ways). I also have access to an enterprise account and “nerve racking” does not even begin to describe what interacting with the portal is like. A single click with a badly worded confirmation step is the ONLY thing keeping your released app in the field from shutting down until you get a new version out. Let me say that again: if you delete your signing cert then your app will not open on devices anymore. No way to communicate to users to update or let them know anything at all. Just dead. Even if you avoid making that mistake, the cert rotation dance is horrible and terrifying, it doesn’t help that Apple’s docs and help text are completely useless. It doesn’t help that most info you find online is for AppStore certs/signing and not Enterprise certs/signing (the _massive_ difference being you can revoke a cert for an App Store app and it keeps working). There is no wording about max certs on their webpage so in most cases you just have to try something in the portal and see if it fails. It’s even more fun because every click in the cert rotation process is a gamble and so after you’ve worked yourself up to finally clicking the button you then run right into an error and you have to rethink your strategy. Again, your entire business potentially hangs in the balance if you pick wrong, have fun! I understand what Apple is trying to accomplish and that’s fine but they need better messaging. They need to make it clear what the effects of revoking/deleting certs/profiles is. They need to make the connections between certs and profiles more obvious. The whole UI is horrible and flakey on top of that.

jjayj 2y ago

We ran into this, informed our users to reinstall Docker (we use Homebrew), and seemingly have had no further issues. I guess we're the minority? I would be more inclined to blame this on Apple than Docker, but I haven't looked too deeply since things are working for us. Curious about you folks' opinions.

localghost3000 2y ago

Ran into this today. Took me about an hour to figure out. You have to run the script they provide (can’t find the link right now but it’s in the GH issue). But if you are like me and installed it via homebrew, you also you have to uninstall docker fully and you have to do it via homebrew. So instead of upgrading you have to `brew uninstall docker` and THEN brew update & `brew install —cask docker`. Bit of a pain but it does eventually sort itself out.

jey 2y ago
looks to be this: https://github.com/docker/for-mac/issues/7527#issuecomment-2582955343 https://github.com/docker/for-mac/issues/7527#issuecomment-2...
- heelix 2y ago
  Installing 4.37.2 does sort the malware warning, for those who install with the binary. Was a fun post holiday treat for those who have lots of developers.
  - JohnMakin 2y ago
    yes. it’s been a stupid amount of work for something I could not possibly care less about, but the issues for me are not the fresh installs of the patched version, but uninstalling corrupted versions.

joshdavham 2y ago

Yeah I was having some trouble with it a little less than a week ago. I downloaded the new update and then my app was corrupt and couldn't open so I just re-downloaded and installed and it was fine.

jonathanlydall 2y ago

I had a bizarre issue with Docker Desktop on Windows this week where it had somehow been uninstalled. I only occasionally use Docker, probably used it about a month ago (with summer Christmas break here), but when I tried on Monday it just wasn’t on my computer any more. My PC isn’t managed at all by any other system or person.

theshrike79 2y ago
These are usually caused by failed autoupdates. It uninstalls the old one, fails at installing new version -> whoops, gone.

sshine 2y ago

OrbStack is the best alternative to Docker Desktop on Mac.

theshrike79 2y ago
When Enterprise pricing is "contact sales", I usually just close the tab.
- sshine 2y ago
  I never needed Enterprise Docker Desktop. I hardly even need Docker Desktop. It just proves useful to start and stop Docker this way, since it uses fewer resources.

angoragoats 2y ago

Heads up to anyone at a company using Docker Desktop: If your company has over 250 employees or more than $10 million in annual revenue, it's against their license terms for anyone at the company to use Docker Desktop without paying for a subscription [0]. Docker can and will go after companies who are out of compliance with this (ask me how I know). If paying a subscription fee for a sub-par product doesn't sound great to you, I encourage you to check out one of the many alternatives available. I've used Colima (MIT licensed) [1] for a few years now and it works great. [0] https://www.docker.com/pricing/faq/ https://www.docker.com/pricing/faq/, see the section "Who’s required to pay for Docker subscription plans?" [1] https://github.com/abiosoft/colima https://github.com/abiosoft/colima

1x00 2y ago

https://orbstack.dev/ https://orbstack.dev/

CafeRacer 2y ago

We're relying on buildx bake. And few days ago Docker just stopped working. I tried the steps that they outlined with no success. I know I can still run it from CD/CI, but I don't want to jump around like a crazy monkey trying to debug my builds locally. I had issues with docker desktop just hanging on my mac. I've been using podman for over a year with docker context pointing to podman so I can still use bake. I've moved some of our workloads to s2i and bash scripts and could not be happier. Old good sysadminy stuff just works.