Problem
In corporate Windows 11 environments where Microsoft Defender for Endpoint (MDE) / Attack Surface Reduction (ASR) rules are enforced by IT policy, Docker Desktop's WSL2 integration triggers repeated Defender alerts that are hard to correlate back to Docker.
Specific pain points we're hitting on Windows 11 Enterprise + corp Defender policy:
- ASR rule "Block credential stealing from lsass.exe" occasionally flags
com.docker.backend.exe and wslhost.exe during container start. No clear Docker Desktop-side guidance on which ASR rules are known-safe to exclude for Docker.
- Controlled Folder Access blocks Docker Desktop from writing to
%USERPROFILE%\.docker\ on some corp policies. The failure mode is a silent "Docker Desktop is starting..." that never completes — no dialog pointing at Defender.
- Defender real-time scanning of the WSL2 vhdx (
ext4.vhdx) causes 5-15 minute Docker Desktop startup on first launch of the day. Get-MpPreference | Select ExclusionPath shows the vhdx is not excluded by default, and there's no Docker Desktop UI hint suggesting the exclusion.
Ask
- A "Windows corp environment" section in the Docker Desktop for Windows troubleshooting docs listing:
- Recommended Defender exclusions (paths + processes) for Docker Desktop + WSL2 backend
- Known-benign ASR rule interactions with
com.docker.backend.exe and wslhost.exe
- How to detect when Controlled Folder Access is blocking
%USERPROFILE%\.docker\
- Ideally, a first-run diagnostic in Docker Desktop itself: if startup takes >60s and Defender real-time scanning is enabled without vhdx exclusion, surface a one-time toast "Defender is scanning WSL disks on every read — consider excluding
<path>."
Currently, the only working workaround is finding third-party blog posts. Corp IT departments block adding exclusions unless the software vendor (Docker) documents them officially, so this is a real onboarding blocker for enterprise users.
Environment
- Docker Desktop 4.x on Windows 11 Enterprise
- WSL2 backend
- MDE + corp ASR policy active
- Cannot disable Defender (IT-locked)
Happy to test a doc PR or diagnostic prototype.
Problem
In corporate Windows 11 environments where Microsoft Defender for Endpoint (MDE) / Attack Surface Reduction (ASR) rules are enforced by IT policy, Docker Desktop's WSL2 integration triggers repeated Defender alerts that are hard to correlate back to Docker.
Specific pain points we're hitting on Windows 11 Enterprise + corp Defender policy:
com.docker.backend.exeandwslhost.exeduring container start. No clear Docker Desktop-side guidance on which ASR rules are known-safe to exclude for Docker.%USERPROFILE%\.docker\on some corp policies. The failure mode is a silent "Docker Desktop is starting..." that never completes — no dialog pointing at Defender.ext4.vhdx) causes 5-15 minute Docker Desktop startup on first launch of the day.Get-MpPreference | Select ExclusionPathshows the vhdx is not excluded by default, and there's no Docker Desktop UI hint suggesting the exclusion.Ask
com.docker.backend.exeandwslhost.exe%USERPROFILE%\.docker\<path>."Currently, the only working workaround is finding third-party blog posts. Corp IT departments block adding exclusions unless the software vendor (Docker) documents them officially, so this is a real onboarding blocker for enterprise users.
Environment
Happy to test a doc PR or diagnostic prototype.