# Container images

> How Cloak Watch lists container images from Docker Desktop, OrbStack, Colima, Rancher Desktop and Podman, what it keeps, and how it matches them against incidents.

Source: https://docs.subcloak.com/cloak-watch/container-images/

Added in Cloak Watch 1.2.0.

Container images live inside your container runtime's virtual machine, out of reach of a file scan. Cloak Watch asks each running container engine for its list of images, over the engine's local socket, and matches them against incident packs that name an image. Nothing is pulled, run or changed.

## Which engines

Watch tries these sockets in order and reads each engine that answers, once:

| Runtime | Socket |
|---|---|
| Whatever `DOCKER_HOST` or your current Docker context points at | A local `unix://` socket only |
| Docker Desktop | `~/.docker/run/docker.sock` |
| OrbStack | `~/.orbstack/run/docker.sock` |
| Rancher Desktop | `~/.rd/docker.sock` |
| Other Docker installs | `/var/run/docker.sock` |
| Colima | `~/.colima/<profile>/docker.sock` |
| Podman | Podman machine sockets in `~/.local/share/containers/podman/machine/` |

Watch makes two kinds of read-only request: the image list, and each image's settings (for at most 150 images; at most 2,000 images are listed).

## What Watch keeps

For each image: its ID, tags, digests and creation date, any `*_VERSION` setting such as `PHP_VERSION` (short version strings only), and the `org.opencontainers.image.version` and `org.opencontainers.image.source` labels. No other environment values are kept.

Images show in [Inventory › Packages](https://docs.subcloak.com/cloak-watch/inventory/#packages) with the ecosystem **Docker**.

## What Watch checks

- **Incident packs.** A pack that names an image by tag, digest or image ID raises [PKG-10](https://docs.subcloak.com/cloak-watch/detections/#pkg-10) when that image is on the Mac.
- **Headlines.** [Check my Mac](https://docs.subcloak.com/cloak-watch/check-my-mac/) answers headlines that list images, from the same list.

## When a runtime isn't running

Images are read only while their engine runs. When a runtime is installed but no engine answered, **Settings › Permissions › Not checked on this Mac** names it: "… isn't running, so its images can't be listed (they live inside its VM). Start it and Watch lists them on the next scan." A headline about container images then says it couldn't look.

If the engine's socket refuses Watch, the gap says so ("… engine socket refused Watch (permission denied)").

Images are read again on full scans (the daily scan, the scan shortly after launch, and **Scan Now**), not when files change.

> **Note:**
> Watch reads the images in your engines, not what's inside them: it doesn't look at the packages or trust stores in an image's file system.

## Related

  - [Homebrew and Docker](https://docs.subcloak.com/cloak-watch/homebrew-and-docker/): Docker plugins, saved registry passwords and plain-TCP hosts.
  - [Check my Mac](https://docs.subcloak.com/cloak-watch/check-my-mac/): How headlines about images are answered.
  - [Inventory](https://docs.subcloak.com/cloak-watch/inventory/#packages): Where images are listed.