How to launch docker container from CLI in MacOS (eg `docker run ...`)?

Question

How can I launch a docker container from the command-line in MacOS?

In Debian Linux, I can execute the following commands to install docker, launch a new docker container based on the latest version of Debian, and get a shell inside that container

# securely install docker and let our user interact with it
sudo apt-get install docker.io
sudo bash -c 'gpasswd -a "${SUDO_USER}" docker'
su - `whoami`

# "securely" download and run latest Debian container
# * https://security.stackexchange.com/q/238529/213165
export DOCKER_CONTENT_TRUST=1
docker run --rm -it --entrypoint /bin/bash debian:stable-slim

In MacOS, I can (insecurely) install docker as follows

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
brew install --cask docker

But then I get command not found errors when attempting to run a new container (in both zsh and bash)

user@host ~ % export DOCKER_CONTENT_TRUST=1
user@host ~ % docker run --rm -it --entrypoint /bin/bash debian:stable-slim 
zsh: command not found: docker
user@host ~ % bash

The default interactive shell is now zsh.
To update your account to use zsh, please run `chsh -s /bin/zsh`.
For more details, please visit https://support.apple.com/kb/HT208050.
bash-3.2$ export DOCKER_CONTENT_TRUST=1
bash-3.2$ docker run --rm -it --entrypoint /bin/bash debian:stable-slim 
bash: docker: command not found
bash-3.2$ 

Note that this is a headless machine with no access to the GUI. The only access provided is via ssh (with sudo for root permission).

How can I launch and enter a new docker container from the command-line in MacOS?

Answer 1

As far as I know, Docker cannot be installed on a headless machine running MacOS.

I finally gave-up and had someone plug a damn monitor into the Mac Mini in the datacenter. When they did, they saw a window that said

"Docker" is an app downloaded from the internet. Are you sure you want to open it?

Homebrew Cask downloaded this file on 3 May 2022 from www.docker.com. Aplle checked it for malicious software and none was detected.

It's super annoying that no output was given by Apple on the CLI to indicate this, but whatever.

I figured, for future reference, I'd bypass this using the CLI. You can do so as follows:

xattr -r -d com.apple.quarantine /Applications/Docker.app

I ran sudo open /Applications/Docker.app again. This time it exited 1 with an error message

LSOpenURLsWithRole() failed with error -600 for the file /Applications/Docker.app.

This is where I gave-up on the CLI. In the GUI was a window that said:

Docker desktop needs privileged access.

Docker Desktop needs privileged access to install its networking components and links to the Docker apps.

You will be asked for your password.

I just clicked "OK" and typed my password into the GUI.

After I did that, the docker binary was available

user@host ~ % ls /usr/local/bin/docker
/usr/local/bin/docker
user@host ~ %

user@host ~ % export DOCKER_CONTENT_TRUST=1

user@host ~ % docker run --rm -it --entrypoint /bin/bash debian:stable-slim 
docker: Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?.
See 'docker run --help'.
user@host ~ % 

The above error was resolved by ticking "I accept the terms" and clicking Accept in a silly ToS that also appears to be only available to the GUI :facepalm:

After that, I re-opened Docker again

open -a Docker

Again, it exited immediately and no bloody output was printed on the terminal. But in the GUI a window opened that said Docker was starting. After half a minute or so, I could finally start a damn container

user@host ~ % docker run --rm -it --entrypoint /bin/bash debian:stable-slim
Unable to find image 'debian:stable-slim' locally
docker.io/library/debian@sha256:3d412a8a2e0f087738e6185c5cddab08827880a23e5bd9dc8b2494d89e4b33fd: Pulling from library/debian
2bc8f4ca4fd1: Pull complete 
Digest: sha256:3d412a8a2e0f087738e6185c5cddab08827880a23e5bd9dc8b2494d89e4b33fd
Status: Downloaded newer image for debian@sha256:3d412a8a2e0f087738e6185c5cddab08827880a23e5bd9dc8b2494d89e4b33fd
Tagging debian@sha256:3d412a8a2e0f087738e6185c5cddab08827880a23e5bd9dc8b2494d89e4b33fd as debian:stable-slim
root@4d255f94ce06:/# 

Update

I discovered that there's a documentation page with the commands to install docker from the CLI

xattr -r -d com.apple.quarantine /Applications/Docker.app
/Applications/Docker.app/Contents/MacOS/install --accept-license --user=`whoami`
sudo /Applications/Docker.app/Contents/MacOS/Docker --unattended --install-privileged-components
open -a /Applications/Docker.app

But I haven't tested this.

Answer 2

While I haven't used this as extensively as I have Docker Desktop, you can install Colima along with Docker community tools.

Both are available in Homebrew and—once that is installed—can be simply run like so:

brew install colima docker
colima start

Once the Colima VM has started, regular Docker CLI commands will just work. For example, to start an Alpine container and get a shell:

docker run -it alpine

Colima also supports the (currently) experimental Rosetta on Linux support that makes it possible to use Rosetta technology to run Intel Docker images on Apple Silicon.

colima start --vz-rosetta

The default QEMU is also available, if you have difficulty with Rosetta.