Legacy vmnetd cleanup (remove-vmnetd) fails when helper is already absent, prompting for admin password on every start

Bug report

Settings: osIntegration.privilegedPorts.enabled: false, RequireVmnetd: false, default socket enabled, CLI install location System.

Actual behavior: Every Docker Desktop start shows “Docker Desktop requires privileged access to apply configuration” via osascript. Backend log:

should enable privileged port mapping:  false
remove process used for privileged port binding
configuring  remove-vmnetd
executing: /Applications/Docker.app/Contents/MacOS/install --errfile ... config --user <USER> remove-vmnetd
running applescript through osascript ... with administrator privileges

vmnetd is not installed. There is no /Library/LaunchDaemons/com.docker.vmnetd.plist and no helper binary in /Library/PrivilegedHelperTools/, and launchctl print system/com.docker.vmnetd reports the service is not found. Running the step manually fails:

$ sudo /Applications/Docker.app/Contents/MacOS/install config --user <USER> remove-vmnetd
Error: removing vmnetd: removing vmnetd: exit status 3
(exit 44)

$ sudo launchctl bootout system/com.docker.vmnetd
Boot-out failed: 3: No such process

The installer’s exit status 3 is consistent with launchctl bootout failing on a service that isn’t loaded. The failed step appears not to be recorded as complete, so the next start retries it. Cancelling the prompt is harmless and Docker runs normally.

Likely cause: vmnetd and the privileged-port setting were removed in 4.89, so this looks like the upgrade path that cleans up a legacy helper. That path doesn’t handle the helper already being absent.

Expected: remove-vmnetd should treat “not loaded / not installed” as success, or the backend should check for vmnetd before escalating.

Related: #651 (same prompt, different privileged step: set-docker-socket).

Platform

macOS

Version information

Client:
 Version:           29.9.2
 API version:       1.56
 Go version:        go1.26.10
 Git commit:        a82e528
 Built:             Tue Oct 20 18:43:59 2026
 OS/Arch:           darwin/amd64
 Context:           desktop-linux

Server: Docker Desktop 4.96.1 (244132)
 Engine:
  Version:          29.9.2
  API version:      1.56 (minimum version 1.40)
  Go version:       go1.26.10
  Git commit:       0367cbe
  Built:            Tue Oct 20 18:45:02 2026
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          v2.4.2
  GitCommit:        b7a25261e029d68978bbf290df0a62fc819b3c51
 runc:
  Version:          1.5.2
  GitCommit:        v1.5.2-0-g29dd3dc2
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0
Client:
 Version:    29.9.2
 Context:    desktop-linux
 Debug Mode: false
 Plugins:
  agent: Docker AI Agent Runner (Docker Inc.)
    Version:  v1.149.0
    Path:     /Users/shiley/.docker/cli-plugins/docker-agent
  ai: Docker AI Agent - Ask Gordon (Docker Inc.)
    Version:  v1.31.0
    Path:     /Users/shiley/.docker/cli-plugins/docker-ai
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.38.1
    Path:     /Users/shiley/.docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v5.6.0
    Path:     /Users/shiley/.docker/cli-plugins/docker-compose
  debug: Get a shell into any image or container (Docker Inc.)
    Version:  0.0.47
    Path:     /Users/shiley/.docker/cli-plugins/docker-debug
  desktop: Docker Desktop commands (Docker Inc.)
    Version:  4.96.1
    Path:     /Users/shiley/.docker/cli-plugins/docker-desktop
  dhi: CLI for managing Docker Hardened Images (Docker Inc.)
    Version:  v0.0.7
    Path:     /Users/shiley/.docker/cli-plugins/docker-dhi
  extension: Manages Docker extensions (Docker Inc.)
    Version:  v0.2.31
    Path:     /Users/shiley/.docker/cli-plugins/docker-extension
  init: Creates Docker-related starter files for your project (Docker Inc.)
    Version:  v1.4.0
    Path:     /Users/shiley/.docker/cli-plugins/docker-init
  mcp: Docker MCP Plugin (Docker Inc.)
    Version:  v0.44.1
    Path:     /Users/shiley/.docker/cli-plugins/docker-mcp
  offload: Docker Offload (Docker Inc.)
    Version:  v0.7.16
    Path:     /Users/shiley/.docker/cli-plugins/docker-offload
  pass: Docker Pass Secrets Manager Plugin (beta) (Docker Inc.)
    Version:  v0.3.0
    Path:     /Users/shiley/.docker/cli-plugins/docker-pass
  sandbox: "docker sandbox" is deprecated, use Docker Sandboxes instead (Docker Inc.)
    Version:  v0.13.0
    Path:     /Users/shiley/.docker/cli-plugins/docker-sandbox
  scout: Docker Scout (Docker Inc.)
    Version:  v1.26.0
    Path:     /Users/shiley/.docker/cli-plugins/docker-scout

Server:
 Containers: 1
  Running: 0
  Paused: 0
  Stopped: 1
 Images: 10
 Server Version: 29.9.2
 Storage Driver: overlayfs
  driver-type: io.containerd.snapshotter.v1
 Logging Driver: local
 Cgroup Driver: cgroupfs
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Discovered Devices:
  cdi: docker.com/gpu=webgpu
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: b7a25261e029d68978bbf290df0a62fc819b3c51
 runc version: v1.5.2-0-g29dd3dc2
 init version: de40ad0
 Security Options:
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 7.0.14-linuxkit
 Operating System: Docker Desktop
 OSType: linux
 Architecture: x86_64
 CPUs: 4
 Total Memory: 11.68GiB
 Name: docker-desktop
 ID: 81d7d9b9-f675-4019-a408-d4cb3db7ffa2
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 HTTP Proxy: http.docker.internal:3128
 HTTPS Proxy: http.docker.internal:3128
 No Proxy: hubproxy.docker.internal
 Labels:
  com.docker.desktop.address=unix:///Users/shiley/Library/Containers/com.docker.docker/Data/docker-cli.sock
 Experimental: false
 Insecure Registries:
  hubproxy.docker.internal:5555
  127.0.0.0/8
  ::1/128
 Live Restore Enabled: false
 Firewall Backend: iptables

Diagnostics ID

No response

@mv-shiley

@mv-shiley please share a diagnostics id

Navigation Menu

Repository navigation

Legacy vmnetd cleanup (remove-vmnetd) fails when helper is already absent, prompting for admin password on every start #771

Bug report

Platform

Version information

Diagnostics ID

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Legacy vmnetd cleanup (remove-vmnetd) fails when helper is already absent, prompting for admin password on every start #771

Description

Bug report

Platform

Version information

Diagnostics ID

Activity

bsousaa commented on Oct 23, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions