[Workaround in description] Mac is detecting Docker as a malware and keeping it from starting #7520
Comments
|
If it helps, I have the same issue and am running this version of MacOS M3: |
|
can you tell us how old is the |
|
Running |
|
Hi, Which version(s) of Docker Desktop have you tried? Which one is the highest one? Did you download it fresh? then start Docker Desktop again? (Docker Desktop should re-install it on-demand when it needs it) Thanks, and sorry this happened to you! |
|
I deleted the com.docker.vmnetd but now I get this opening docker again |
|
I uninstalled after the issue happened and re-installed the latest version available on the website - since deleting |
|
Ah maybe you need to (sudo) kill -9 the show it running? |
|
Or any other docker process running? |
|
$ps aux | grep vmnetd
user 25212 0.0 0.0 410733072 1664 s000 S+ 1:16pm 0:00.01 grep vmnetd
$ps aux | grep "[dD]ocker"
user 24255 0.0 0.2 412151024 73200 ?? S 1:05pm 0:00.15 /Applications/Docker.app/Contents/MacOS/com.docker.backend run |
|
It'd be helpful to get some system logs to see why macOS is rejecting
|
|
I see this at the end of the log output that looks suspicious: |
Ah right, so Docker Desktop does not re-install then restart Docker Desktop. edit: this probably needs you to update to at least Docker Desktop 4.35 before cp’ing |
|
This worked for me ^ |
|
That also worked for me! |
|
I uninstalled, and then reinstalled using the command line, and things seem to be working properly |
|
If someone is facing this issue, before removing the broken vmnetd or socket binary, could you please try to run these two commands and paste the output here: |
|
This wasn't working for me
but reinstalling from command line worked. |
|
I have the same problem but with a small different detail. In the screenshot the file mentioned is
@acassioaraujo your screenshot shows |
|
@zioproto I think both are affected since they were signed with the same certificate. If you have a chance, could you try to run the commands I posted in this comment please? This would help us a lot. #7520 (comment) |
|
@akerouanton It seems the signature cannot be verified: |
This worked for me on version 4.32 |
|
@zioproto I just added two other commands to my comment, ie. EDIT: Let me re-add them here for clarity. |
|
@akerouanton the certificate has been revoked: Question: I am not familiar with this, is it normal that the verification url is plaintext http and not https ? and here is the full certificate in text form: |
|
@zioproto Thanks a lot! Last batch of questions:
|
It also worked for Docker 4.32.0, which we are stuck on due to the issue outlined here. |
difficult to say for sure because I am not able to start docker anymore.
Can you give me the full path to those files ? Do you need the full file ? this is my hash: |
|
It should be:
But if one is missing on your system, don't worry and just upload what you have 🙂 |
|
Seeing similar issues. Downloaded the specific MacOS version (4.29.0) from https://desktop.docker.com/mac/main/arm64/145265/Docker.dmg and Apple wouldn't even let me install the dmg, with message 
When I use |
Thank you!! This has fixed the issue I had where For everyone's benefit or if the link goes down: this says to add the following line to your I did try updating the attributes as per this post but it hasn't removed them - don't know if this is why this workaround above for the socket is still required: view comment e.g. |
|
Tip works for Macbook Air M2, MacOs Sequoia 15.0.1. |
|
I am getting the below error, how can I come past this? |
Got to a new error now:
|
|
Im getting the below error and I have uninstalled and installed Docker from the official website/self service? |
Have you tried workaround from the issue description? |
|
Thanks so much for the script! When will this nonsense be fixed, though? |
|
I'm on Sequoia as well and this worked for me, thank you! Before trying this, the error message kept popping up for me even after dismissing it. |
|
I'm been trying and failing to fix this all day. Just constantly come back to this error I have tried everything and that service just never seems to work EDIT: I'll leave this comment here to maybe prevent someone else going round in circles all day |
|
This didn't work for me...using the latest Mac OS Sequoia 15.3.1. The malware popup just continuously shows up every few seconds until I restart my Mac, even after doing the fix above. |
|
Fixing Persistent "Docker will damage your computer" Pop-up – A Special Case First off, a huge thanks to everyone contributing to this thread! The suggested fix helped a lot of people, and it’s great to see the community troubleshooting together. That said, I ran into a slightly different issue that required a few extra steps to fully resolve. I wanted to document it here in case anyone else finds themselves in the same situation. After uninstalling Docker, and trying the fix above (and even reinstalling the properly signed release), I kept getting the "Docker will damage your computer" pop-up, even after running the recommended fix in this thread. The pop-up persisted despite: After digging deeper, I found that macOS security services (syspolicyd and XProtect) were still referencing a quarantined Docker file in my Trash. 🕵️♂️ How to Check If You Have the Same Issue 
If you've uninstalled Docker and still get the "Docker will damage your computer" pop-up, macOS may still be referencing a quarantined file. This isn't covered in the usual uninstall scripts, so here’s how to check and fix it. Disclaimer: I worked with ChatGPT 4o on this (since I'm still new to MacOS) and had it help me generate this report. I edited it after the fact and it's a good summary, but please know that it generated a lot of these diagnosis steps. With that: 1️⃣ Check If macOS Is Still Tracking Docker Files
If you see output showing syspolicyd, xprotectservice, or other system processes accessing a Docker-related file, macOS is still tracking it. Example: 2️⃣ Check for Quarantined Docker Files macOS uses a quarantine flag (com.apple.quarantine) to block suspicious files. We need to check if Docker files are still being marked. 🔍 A. Scan Common Locations for Quarantined Files Run: If any files show com.apple.quarantine, they are still flagged as potential threats, causing the persistent pop-up. Example output: This confirms macOS is still treating a Docker file as untrusted. Since some users (including me) found that the issue came from a Docker file stuck in Trash, manually check: If you see 3️⃣ Attempt to Remove the Quarantine Flag & Delete the File If a quarantined Docker file exists, first remove its quarantine flag: For example, if it’s in Trash: Then, delete it: 🚀 If this works, you may NOT need to disable SIP! 4️⃣ If You Still Can’t Delete It, Check System Integrity Protection (SIP) If the file still won’t delete, SIP is blocking its removal, even with sudo. If you see "enabled", SIP is likely preventing removal. 5️⃣ (Last Resort) Temporarily Disable SIP to Delete the File If none of the above worked, SIP is likely preventing deletion. Follow these steps: 🛑 Disable SIP (Temporarily):
Note: This disables security on you MacOS. 🗑️ Delete the Problematic Docker File
Once the pop-up is gone, go back to macOS Recovery Mode and turn SIP back on:
🎯 Key Takeaways 💡 Hope this helps others who hit this more stubborn version of the issue! Shoutout to ChatGPT 4o for helping me document this troubleshooting process—make sure to verify any steps before running commands from the internet. Hope this helps! Good luck! 🚀 |
|
Thank you ! |
|
Thanks it did work for me. |
|
If you're using a Mac with an M3 chip and macOS Sonoma, you need to make sure you're using the Docker version that's compatible with Apple Silicon. Here's how to resolve this Docker installation issue on your M3 (Last is best):
The M3 chip should provide excellent performance for Docker once you get it installed properly. The initial warning is just macOS's security system being cautious about applications that modify system settings. |
|
I got this working with the bash script, thank you for sharing the workaround. |
This worked for me. |
|
Thank you so much. This worked for me. Not being able to run services locally was killing me. |
|
What helped me was disabling docker in "Open at Login" part of settings |
|
I've uninstalled Docker before. Last time I fixed it with some codes online which I forgot). The pop-up showed again after I restarted my Laptop. I followed the steps in jebeals post Try "1️⃣ Check If macOS Is Still Tracking Docker Files sudo lsof | grep -i docker. " ____------my terminal output : syspolicy 462 root 18r REG 1,13 80527424 16169400 /Users/yuf***/.Trash/Docker.app/Contents/MacOS/com.docker.backend 2️⃣ Check for Quarantined Docker Files macOS uses a quarantine flag (com.apple.quarantine) to block suspicious files. We need to check if Docker files are still being marked. 🔍 A. Scan Common Locations for Quarantined Files Run: ____------my terminal output : 🗑️ B. Check If the Quarantined File Is Stuck in Trash sudo ls -lah ~/.Trash ____------my terminal output: total 0 What do you think I should do next? March 26 ,2025, updated: I found the code worked for me last time ."brew uninstall --cask docker --force brew uninstall --formula docker --force " . But it will pop up when I restart the laptop. I noticed it showed "verifying docker...." when restarted, and then the warning showed up!!! |
|
The solution that worked for me, was to ensure that:
Secondly: Restart System. |
|
Thanks a lot @acassioaraujo it helped me ! |
|
This workaround resolved the issue for me. Thank you! @acassioaraujo |
|
Have been pulling my hair out - thank you for the workaround |
|
Thanks a lot @acassioaraujo 🍻 |
|
none of the methods above worked. Installing docker shouldnt be this hard. |
absolute G in a Gi |
and others
Description
Whenever Docker is started, this error is shown:
Reproduce
Workaround
Tip
If you face this issue, try the following procedure:
If that still doesn't work, download one of the currently supported release from the Release notes and re-apply step 2.
As suggested running this command is working for most of people that had this problem.
Original issue details
### docker versiondocker info
Diagnostics ID
Can't get a Diagnostics ID because I'm not able to open docker, the error is from MacOS
Additional Info
I tried installing older versions of Docker but the error is the same to all of them.
The text was updated successfully, but these errors were encountered: