Docker hardener
Run av harden docker to apply this hardener and
av doctor docker to verify it.
av harden docker keeps Docker Desktop's vendor-signed,
Hardened Runtime CLI and replaces its ambient credential helper with
Automic Vault's Secret Gate. It migrates credentials without printing
them, installs a root-owned helper at
/usr/local/bin/docker-credential-av only when every
containing directory is root-owned and protected from group/world
writes, and updates Docker's credsStore.
The Docker helper protocol necessarily returns a usable registry token to an authorized Docker process. Automic Vault verifies the live Docker Desktop code signature, Hardened Runtime, process ancestry, arguments, and registry before release. Non-Automic per-registry helpers and inline credentials fail closed.