docker mac malware | “com.docker.vmnetd” was not opened because it contains malware

Has our beloved Docker app been trojaned?

docker mac malware | “com.docker.vmnetd” was not opened because it contains malware
Photo by Rubaitul Azad / Unsplash

Just like every person on this planet I start my day by opening Docker. Today however I was met with shock, horror and disgust (I'll get to a fix later).

To my absolute surprise my beloved Mac device fell to its knees and told me com.docker.vmnted wouldn't be opened as it contained malware.

Have I been compromised? Have we all been compromised? What does this mean for my hello-world Docker image?

What happened?

In simple terms, in the beginning of January users on the Docker forums started to complain that they could not open Docker anymore.
Most people are reporting that this is happening on M1, M2 and M3 macbooks.

Is it a malicious hack operated by the secret agents that infiltrate our every server, client and cloud apps? Will a sternly worded letter to the embassy of North Korea in London warn them of the fury that is brewing inside me? No. It's just a certificate signing issue with Apple as confirmed by Jean-Philippe Briend (Staff Software Engineer at Docker and JBP for short).

Docker staff's reply to the issue

The solution

Well now that I don't need my pen and paper any longer let's start looking for solutions.

As noted by JPB a possible solution could be running the following command and restarting Docker Desktop:

sudo cp /Applications/Docker.app//Contents/Library/LaunchServices/com.docker.vmnetd /Library/PrivilegedHelperTools/

However some users have reported this solution does not work and are recommending to downgrade.

Another user by the name of yakoveka suggested on GitHub to use brew to uninstall and reinstall Docker:

brew uninstall --cask docker --force
brew uninstall --formula docker --force
brew install --cask docker

More solutions have been listed on the forum post and on the GitHub issue.

All in all, it's not North Korea or the CIA (as far as we know, keep your tin foil hats on just to be sure), but rather an issue on Apple and Docker's part.