Skrog

Skrog

Upstream Docker Engine on Windows via WSL2. No licence fees, no Electron.

Skrog runs the upstream open source Docker Engine on Windows, inside WSL2. No licence fees, no Electron, no Kubernetes: install once and docker ps works forever, on laptops and CI runners alike.

skrog install     # engine, docker context, autostart at logon
skrog start       # the always-on bridge, now (later logons start it for you)
docker run --rm hello-world

New here? The README has the install steps and the current status. These pages are the detail behind them — each one is a markdown file in docs/, so anything wrong on this site is a pull request away from being right.

Binaries are not Authenticode-signed yet, so SmartScreen warns on first run. Code signing is applied for through the SignPath Foundation, with signing by SignPath.io; the code signing policy says who can produce a signed binary and how. Every release does carry SLSA build provenance and a cosign-signed SHA256SUMS today — see verifying a download.

Start

  • Bundled docker CLISkrog runs the engine; you still need a docker command to talk to it.
  • Dev Containers & VS CodeThe Dev Containers CLI and the VS Code Dev Containers extension work against the Skrog engine with no shim — Skrog serves the standard Docker API, and its Windows-path rewriting handles the bind mounts these...

Keep it healthy

  • Housekeeping: diskRunners die of full disks. Two levers, and a warning that fires before docker starts erroring on its own.
  • Engine snapshotsSave and restore the whole engine state — every image, container and volume — as a named, checksummed archive.
  • Staying currentThree things have to stay current, and they are not independent:
  • Engine upgrades and rollbackAn engine security patch should not have to wait for a Skrog release, and taking one should not cost you your images. skrog engine does both:
  • Right-sizing the engine’s VMA runner with 8 GB should not let the engine take four of them.

At work

  • Corporate networksThe most common "works at home, breaks at work" failure: behind a TLS-inspecting proxy, docker pull fails with an x509 / certificate error because the engine does not trust the corporate root CA.
  • VPNsA corporate VPN is the second "works at home, breaks at work" failure after a TLS-inspecting proxy.
  • Air-gapped installIsolated-network machines cannot use Docker Desktop at all — it phones home to log in and check for updates.
  • Skrog security model & trust boundariesSkrog runs the real Docker Engine as root inside a WSL2 distro and bridges it to docker.exe.
  • Code signing policyThis page exists because the SignPath Foundation requires projects it sponsors to publish one, and because anyone installing a binary that claims to be Skrog deserves to know who can make one.
  • Audit logBecause Skrog proxies the docker API at the pipe, it can record the container-affecting calls that actually crossed it — image pulls, container create / start / stop / remove, exec, and builds — something Do...
  • Admission controlA local, scriptable guardrail on the docker API.

Fleet and CI

  • CI runnersSkrog turns a Windows machine into a Linux-container CI runner: the engine is upstream dockerd in WSL2, so a job that runs on docker on a Linux runner runs here too, with no per-runner Docker Desktop license...
  • Running Skrog unattended (CI runners, build agents)Skrog's supervisor keeps the engine alive across crashes, wsl --shutdown, and sleep/resume — but it needs a logged-on interactive session to do it.
  • Declarative install (skrog.yaml)Describe a whole install in one YAML file, check it into your provisioning repo, and install a fleet of runners from it instead of a pile of flags:
  • Network profilesThe same laptop needs different engine config on the corporate VPN than at home — registry mirrors, DNS, logging, the idle timeout, lifecycle hooks.
  • Remote engine over mutual TLSBy default Skrog's engine is reachable only from the host it runs on, through a Windows named pipe — nothing listens on the network. skrog serve opens a second door: a TCP listener protected by mutual TLS, s...
  • Running CI pipelines locallyThe push-and-wait loop is the worst part of CI work: edit YAML, push, wait five minutes, read a log, repeat.

Advanced

  • GPU accessNVIDIA is supported and validated. AMD is experimental and untested on hardware — see AMD (experimental) at the end.
  • Kubernetes on SkrogSkrog will never ship a Kubernetes.
  • Lifecycle hooksRun your own script when the engine's state changes.
  • The --json contractEvery Skrog command that reports state can emit machine-readable JSON with --json.
  • Command referenceEvery command, its flags and its exit codes — generated from the binary's own --help output by scripts/build-reference.ps1, so it cannot drift from what the CLI actually does.

Contributing