Skrog

Skrog

Upstream Docker Engine on Windows via WSL2. No licence fees, no Electron.

Skrog runs the upstream open source Docker Engine on Windows, inside WSL2. No licence fees, no Electron, no Kubernetes: install once and docker ps works forever, on laptops and CI runners alike.

skrog install     # engine, docker context, autostart at logon
skrog start       # the always-on bridge, now (later logons start it for you)
docker run --rm hello-world

Images built for the other architecture run too — the common case on Windows on ARM, where much of Docker Hub is still amd64-only. One opt-in key, and no emulator to download:

skrog config set emulation.platforms linux/amd64   # or linux/arm64
skrog restart
docker run --rm --platform linux/amd64 alpine uname -m   # x86_64

It is opt-in because binfmt_misc is kernel state shared by every WSL2 distro on the machine — the detail is in the docker CLI page.

New here? The README has the install steps and the current status, and how it compares says where Docker Desktop, Rancher Desktop, Podman Desktop and Microsoft’s own WSL container tooling each win — including when to use one of them instead. These pages are the detail behind them — each one is a markdown file in docs/, so anything wrong on this site is a pull request away from being right.

Binaries are not Authenticode-signed yet, so SmartScreen warns on first run. The SignPath Foundation’s free programme declined for now — it is for projects with an established user base — and invited a reapplication as visibility grows; paying for a certificate is the other route and needs nobody’s approval. Which one, and when, is #358. The code signing policy says who could produce a signed binary and how. Every release does carry SLSA build provenance and a cosign-signed SHA256SUMS today — see verifying a download.

Start

  • Installing SkrogInstalling Skrog is three separate steps, and knowing they are separate saves the most common confusion — "I installed it and docker says command not found":
  • Bundled docker CLISkrog runs the engine; you still need a docker command to talk to it.
  • Published portsdocker run -p 8080:80 works. Then you try it from your phone, and it does not.
  • Dev Containers & VS CodeThe Dev Containers CLI and the VS Code Dev Containers extension work against the Skrog engine with no shim — Skrog serves the standard Docker API, and its Windows-path rewriting handles the bind mounts these...
  • Per-workspace engines (targets)By default every project on the machine shares one engine: one pool of images, containers and volumes.

Keep it healthy

At work

  • Corporate networksThe most common "works at home, breaks at work" failure: behind a TLS-inspecting proxy, docker pull fails with an x509 / certificate error because the engine does not trust the corporate root CA.
  • VPNsA corporate VPN is the second "works at home, breaks at work" failure after a TLS-inspecting proxy.
  • Air-gapped installIsolated-network machines cannot use Docker Desktop at all — it phones home to log in and check for updates.
  • Pull-through registry cacheA layer you have pulled before comes off your own disk instead of the internet.
  • Skrog security model & trust boundariesSkrog runs the real Docker Engine as root inside a WSL2 distro and bridges it to docker.exe.
  • Code signing policyAnyone installing a binary that claims to be Skrog deserves to know who can make one.
  • Audit logBecause Skrog proxies the docker API at the pipe, it can record the container-affecting calls that actually crossed it — image pulls, container create / start / stop / remove, exec, and builds — something Do...
  • Admission controlA local, scriptable guardrail on the docker API.

Fleet and CI

  • CI runnersSkrog turns a Windows machine into a Linux-container CI runner: the engine is upstream dockerd in WSL2, so a job that runs on docker on a Linux runner runs here too, with no per-runner Docker Desktop license...
  • Running Skrog unattended (CI runners, build agents)Skrog's supervisor keeps the engine alive across crashes, and wakes it on the next docker command after a wsl --shutdown — but it needs a logged-on interactive session to do it.
  • Declarative install (skrog.yaml)Describe a whole install in one YAML file, check it into your provisioning repo, and install a fleet of runners from it instead of a pile of flags:
  • Network profilesThe same laptop needs different engine config on the corporate VPN than at home — registry mirrors, DNS, logging, the idle timeout, lifecycle hooks.
  • Remote engine over mutual TLSBy default Skrog's engine is reachable only from the host it runs on, through a Windows named pipe — nothing listens on the network. skrog serve opens a second door: a TCP listener protected by mutual TLS, s...
  • Running CI pipelines locallyThe push-and-wait loop is the worst part of CI work: edit YAML, push, wait five minutes, read a log, repeat.
  • Monitoring a fleetskrog status --prometheus prints the numbers --stats collects as Prometheus text, so a machine's health lands in the dashboard you already run.

Advanced

  • GPU accessNVIDIA is supported and validated. AMD is experimental and untested on hardware — see AMD (experimental) at the end.
  • Kubernetes on SkrogSkrog will never ship a Kubernetes.
  • Lifecycle hooksRun your own script when the engine's state changes.
  • The --json contractEvery Skrog command that reports state can emit machine-readable JSON with --json.
  • Command referenceEvery command, its flags and its exit codes — generated from the binary's own --help output by scripts/build-reference.ps1, so it cannot drift from what the CLI actually does.

Contributing