What Watch checks
Container images
New in 1.2.0 Requires Cloak Watch 1.2.0 or later.
How Cloak Watch lists container images from Docker Desktop, OrbStack, Colima, Rancher Desktop and Podman, what it keeps, and how it matches them against incidents.
Container images live inside your container runtime’s virtual machine, out of reach of a file scan. Cloak Watch asks each running container engine for its list of images, over the engine’s local socket, and matches them against incident packs that name an image. Nothing is pulled, run or changed.
Which engines
Section titled “Which engines”Watch tries these sockets in order and reads each engine that answers, once:
| Runtime | Socket |
|---|---|
Whatever DOCKER_HOST or your current Docker context points at |
A local unix:// socket only |
| Docker Desktop | ~/.docker/run/docker.sock |
| OrbStack | ~/.orbstack/run/docker.sock |
| Rancher Desktop | ~/.rd/docker.sock |
| Other Docker installs | /var/run/docker.sock |
| Colima | ~/.colima/<profile>/docker.sock |
| Podman | Podman machine sockets in ~/.local/share/containers/podman/machine/ |
Watch makes two kinds of read-only request: the image list, and each image’s settings (for at most 150 images; at most 2,000 images are listed).
What Watch keeps
Section titled “What Watch keeps”For each image: its ID, tags, digests and creation date, any *_VERSION setting such as PHP_VERSION (short version strings only), and the org.opencontainers.image.version and org.opencontainers.image.source labels. No other environment values are kept.
Images show in Inventory › Packages with the ecosystem Docker.
What Watch checks
Section titled “What Watch checks”- Incident packs. A pack that names an image by tag, digest or image ID raises PKG-10 when that image is on the Mac.
- Headlines. Check my Mac answers headlines that list images, from the same list.
When a runtime isn’t running
Section titled “When a runtime isn’t running”Images are read only while their engine runs. When a runtime is installed but no engine answered, Settings › Permissions › Not checked on this Mac names it: “… isn’t running, so its images can’t be listed (they live inside its VM). Start it and Watch lists them on the next scan.” A headline about container images then says it couldn’t look.
If the engine’s socket refuses Watch, the gap says so (“… engine socket refused Watch (permission denied)”).
Images are read again on full scans (the daily scan, the scan shortly after launch, and Scan Now), not when files change.