Docker Desktop

03Resource Saver mode in Docker Desktop

Resource Saver stops the Docker Desktop Linux VM once no containers have run for a set time, 5 minutes by default. Docker says that cuts host CPU and memory use by 2 GB or more. It is on by default.

1. Change the idle timer, or turn the mode off, on the Resources tab in Settings.
2. For a timer the menu doesn't offer, set autoPauseTimeoutSeconds to any value above 30 in settings-store.json. Docker Desktop picks it up without a restart:

   Mac:     ~/Library/Group Containers/group.com.docker/settings-store.json
   Windows: C:\Users\[USERNAME]\AppData\Roaming\Docker\settings-store.json
   Linux:   ~/.docker/desktop/settings-store.json

A moon icon in the status bar and on the tray icon shows the mode. Commands that need the VM wake it and take about 3 to 10 seconds longer; listing images or volumes doesn't necessarily wake it.

On Windows with WSL, Resource Saver only pauses the Docker Engine inside the docker-desktop distribution, so CPU use drops but memory use doesn't. Any enabled WSL integration counts as activity and keeps the mode from starting.

20 release notes since 2024 mention Resource Saver, the latest 4.94.0 on 5 October 2026.

Resource Saver docs

04MSI install and sign-in enforcement

The MSI package is the Windows installer for MDM tools and bulk rollouts. It only does all-users installs; a per-user install needs the EXE. Sign-in enforcement then makes users sign in as members of your organization before Docker Desktop works.

1. Install silently with a log, no reboot, and your organization required at sign-in. Admin rights are needed:

   msiexec /i "DockerDesktop.msi" /L*V ".\msi.log" /quiet /norestart ALLOWEDORG="your-organization"

2. ALLOWEDORG writes the allowedOrgs registry key under HKLM\Software\Policies\Docker\Docker Desktop. ADMINSETTINGS writes an admin-settings.json, but only together with ALLOWEDORG: on its own the install succeeds, writes no file and reports no error.
3. Check your scripts and CI before rollout. While the sign-in prompt shows, docker run, pull, build and ps fail; docker version, info and login still work.

MSI installs turn in-app updates off by default. Set disableUpdate to false through Settings Management to turn them back on. Without /norestart the installer reboots the machine after a successful install, and a silent install doesn't ask first.

A new registry key, profile or registry.json takes effect at the next Docker Desktop restart. Sign-in enforcement is separate from SSO enforcement, which decides how users authenticate, not whether they must.

23 release notes since 2024 mention the MSI or sign-in enforcement, the latest 4.96.0 on 19 October 2026.

MSI installer docs / Enforce sign-in docs

05Dockerfile build checks

Build checks lint your Dockerfile and build options before any build step runs. They came with Dockerfile 1.8 and need Buildx 0.15.0 or later. A normal docker build runs them and prints the violations as warnings.

1. Run only the checks, without building. Unlike a normal build, this exits non-zero when it finds a violation:

   docker build --check .

2. Make violations fail the build, or skip rules you don't want, with a directive at the top of the Dockerfile:

   # syntax=docker/dockerfile:1
   # check=skip=JSONArgsRecommended;error=true

3. Add --debug (docker --debug build .) to get each rule's docs link and the offending Dockerfile lines.

Experimental checks are off by default. Turn them on with --build-arg "BUILDKIT_DOCKERFILE_CHECK=experimental=all". In GitHub Actions, docker/build-push-action 6.6.0 and later show violations in the pull request diff.

2 release notes since 2024 mention Dockerfile rules or build checks, the latest 4.35.0 on 24 October 2024.

Build checks docs