# Homebrew and Docker

> What Cloak Watch checks in Homebrew and Docker: redirected downloads, taps from elsewhere, unsigned casks, unknown CLI plugins, saved registry passwords and plain-TCP hosts.

Source: https://docs.subcloak.com/cloak-watch/homebrew-and-docker/

Added in Cloak Watch 1.2.0.

Homebrew and Docker both download and run code with your access, and both can be pointed somewhere else by a line in a config file. Cloak Watch reads their settings, taps, casks and plugins as files and flags what attackers change. It never runs `brew` or `docker`: each fix is a command for you to run, or a move to Quarantine you confirm.

## Homebrew

| Card | Tier | What Watch flags | What to do |
|---|---|---|---|
| [BREW-1](https://docs.subcloak.com/cloak-watch/detections/#brew-1) "Homebrew settings redirect downloads or turn off its checks" | Review | In a `brew.env` file or a shell profile: `HOMEBREW_*_DOMAIN` or `*_GIT_REMOTE` overrides, `HOMEBREW_NO_VERIFY_ATTESTATIONS`, `HOMEBREW_NO_REQUIRE_TAP_TRUST`, `HOMEBREW_CURLRC`, `HOMEBREW_INSTALL_FROM_API_URL` and similar | If your company runs a Homebrew mirror, this is expected: mark it as not a problem. Otherwise remove the line. |
| [BREW-2](https://docs.subcloak.com/cloak-watch/detections/#brew-2) "Homebrew tap … comes from somewhere else" | Review | A third-party tap whose Git remote isn't the repository its name says (`github.com/<owner>/homebrew-<name>`), or whose remote changed since Watch first saw it ("… changed where it comes from") | If you didn't add it with that URL, run `brew untap …`, then `brew tap …` to get the real one. |
| [BREW-3](https://docs.subcloak.com/cloak-watch/detections/#brew-3) | From the pack | A tap or formula an incident pack names | Follow the card's steps. |
| [BREW-4](https://docs.subcloak.com/cloak-watch/detections/#brew-4) "… skipped Gatekeeper and isn't signed" | Review | A cask app with no quarantine flag, so Gatekeeper never checked it, that is unsigned or ad-hoc signed | `brew reinstall --cask …`, without `--no-quarantine`. If macOS then refuses to open it, `brew uninstall --cask …`. |

Watch reads `/etc/homebrew/brew.env`, Homebrew's own `etc/homebrew/brew.env`, `~/.homebrew/brew.env` and `~/.config/homebrew/brew.env`, your shell profiles, each tap's Git remote and Homebrew's tap trust list.

## Docker

| Card | Tier | What Watch flags | What to do |
|---|---|---|---|
| [DOCK-1](https://docs.subcloak.com/cloak-watch/detections/#dock-1) "Docker CLI plugin from an unknown source" | Review | A file named `docker-*` in `~/.docker/cli-plugins` (or another Docker plugin folder) that isn't a link into Docker Desktop, OrbStack, Rancher Desktop, Podman or Homebrew, and isn't signed by an identified developer | See below. |
| [DOCK-2](https://docs.subcloak.com/cloak-watch/detections/#dock-2) "Docker registry passwords are saved in plain text" | Review | A password or token for a registry saved in `~/.docker/config.json` | Add `"credsStore": "osxkeychain"` (or `"desktop"` with Docker Desktop) to the file, run `docker logout` and `docker login` so the login moves into the Keychain, then rotate the password. Watch records which registries, never the password. |
| [DOCK-3](https://docs.subcloak.com/cloak-watch/detections/#dock-3) "Docker pulls from … without TLS" or "Docker talks to … without TLS" | Review | A remote registry in `insecure-registries`, or a Docker context, daemon host or `DOCKER_HOST` that uses plain `tcp://` to another machine | Remove the registry from `insecure-registries` (Docker Desktop › Settings › Docker Engine) and give it a certificate; for a host, use an `ssh://` Docker context or a TLS endpoint instead. |

### Docker's own plugins

Docker's docs have you install some plugins, such as `docker-compose` and `docker-buildx`, by hand from their GitHub releases, and those files aren't Developer ID signed. Watch never offers to quarantine a plugin with one of Docker's own names. Instead the card asks you to check where it came from:

- For buildx, compose, scout, sbom and scan, compare the file's SHA-256 (`shasum -a 256 …`) with the checksums on the plugin's GitHub releases page for that version.
- For Docker's other plugin names, check it links into Docker Desktop, and reinstall Docker Desktop if you didn't put it there yourself.
- If it doesn't match, delete it and reinstall the plugin from Docker Desktop, Homebrew or Docker's release page.

A plugin with a name Docker doesn't use can be moved to [Quarantine](https://docs.subcloak.com/cloak-watch/quarantine/) with **Fix it**.

## Container images

Watch also lists the images in each running container engine and matches them against incident packs. See [Container images](https://docs.subcloak.com/cloak-watch/container-images/).

## Related

  - [Container images](https://docs.subcloak.com/cloak-watch/container-images/): How Watch reads images from Docker, OrbStack, Colima and Podman.
  - [Detection catalogue](https://docs.subcloak.com/cloak-watch/detections/#homebrew-brew): BREW and DOCK checks.
  - [Footprint](https://docs.subcloak.com/cloak-watch/footprint/): Docker registries and remote engines this Mac knows.