Docker daemon configuration file

The --config-file option allows you to set any configuration option for the daemon in a JSON format. This file uses the same flag names as keys, except for flags that allow several entries, where it uses the plural of the flag name, e.g., labelsfor the label flag.

The options set in the configuration file must not conflict with options set via flags. The docker daemon fails to start if an option is duplicated between the file and the flags, regardless their value. This is done to silently ignore changes introduced in configuration reloads. For example, the daemon fails to start if you set daemon labels in the configuration file and also set daemon labels via the --label flag. Options that are not present in the file are ignored when the daemon starts.

Linux configuration file

The default location of the configuration file on Linux is /etc/docker/daemon.json. The --config-file flag can be used to specify a non-default location.

Allowed configuration options on Linux:

{
 "authorization-plugins": [],
 "dns": [],
 "dns-opts": [],
 "dns-search": [],
 "exec-opts": [],
 "exec-root": "",
 "experimental": false,
 "storage-driver": "",
 "storage-opts": [],
 "labels": [],
 "live-restore": true,
 "log-driver": "",
 "log-opts": {},
 "mtu": 0,
 "pidfile": "",
 "graph": "",
 "cluster-store": "",
 "cluster-store-opts": {},
 "cluster-advertise": "",
 "max-concurrent-downloads": 3,
 "max-concurrent-uploads": 5,
 "shutdown-timeout": 15,
 "debug": true,
 "hosts": [],
 "log-level": "",
 "tls": true,
 "tlsverify": true,
 "tlscacert": "",
 "tlscert": "",
 "tlskey": "",
 "swarm-default-advertise-addr": "",
 "api-cors-header": "",
 "selinux-enabled": false,
 "userns-remap": "",
 "group": "",
 "cgroup-parent": "",
 "default-ulimits": {},
 "init": false,
 "init-path": "/usr/libexec/docker-init",
 "ipv6": false,
 "iptables": false,
 "ip-forward": false,
 "ip-masq": false,
 "userland-proxy": false,
 "userland-proxy-path": "/usr/libexec/docker-proxy",
 "ip": "0.0.0.0",
 "bridge": "",
 "bip": "",
 "fixed-cidr": "",
 "fixed-cidr-v6": "",
 "default-gateway": "",
 "default-gateway-v6": "",
 "icc": false,
 "raw-logs": false,
 "registry-mirrors": [],
 "seccomp-profile": "",
 "insecure-registries": [],
 "disable-legacy-registry": false,
 "default-runtime": "runc",
 "oom-score-adjust": -500,
 "runtimes": {
  "runc": {
   "path": "runc"
  },
  "custom": {
   "path": "/usr/local/bin/my-runc-replacement",
   "runtimeArgs": [
    "--debug"
   ]
  }
 }
}

Windows configuration file

The default location of the configuration file on Windows is %programdata%\docker\config\daemon.json. The --config-file flag can be used to specify a non-default location.

Allowed configuration options on Windows:

{
    "authorization-plugins": [],
    "dns": [],
    "dns-opts": [],
    "dns-search": [],
    "exec-opts": [],
    "experimental": false,
    "storage-driver": "",
    "storage-opts": [],
    "labels": [],
    "log-driver": "",
    "mtu": 0,
    "pidfile": "",
    "graph": "",
    "cluster-store": "",
    "cluster-advertise": "",
    "max-concurrent-downloads": 3,
    "max-concurrent-uploads": 5,
    "shutdown-timeout": 15,
    "debug": true,
    "hosts": [],
    "log-level": "",
    "tlsverify": true,
    "tlscacert": "",
    "tlscert": "",
    "tlskey": "",
    "swarm-default-advertise-addr": "",
    "group": "",
    "default-ulimits": {},
    "bridge": "",
    "fixed-cidr": "",
    "raw-logs": false,
    "registry-mirrors": [],
    "insecure-registries": [],
    "disable-legacy-registry": false
}

Configuration reloading

Some options can be reconfigured when the daemon is running without requiring to restart the process. We use the SIGHUP signal in Linux to reload, and a global event in Windows with the key Global\docker-daemon-config-$PID. The options can be modified in the configuration file but still will check for conflicts with the provided flags. The daemon fails to reconfigure itself if there are conflicts, but it won't stop execution.

The list of currently supported options that can be reconfigured is:

• debug: it changes the daemon to debug mode when set to true.
• cluster-store: it reloads the discovery store with the new address.
• cluster-store-opts: it uses the new options to reload the discovery store.
• cluster-advertise: it modifies the address advertised after reloading.
• labels: it replaces the daemon labels with a new set of labels.
• live-restore: Enables keeping containers alive during daemon downtime.
• max-concurrent-downloads: it updates the max concurrent downloads for each pull.
• max-concurrent-uploads: it updates the max concurrent uploads for each push.
• default-runtime: it updates the runtime to be used if not is specified at container creation. It defaults to "default" which is the runtime shipped with the official docker packages.
• runtimes: it updates the list of available OCI runtimes that can be used to run containers
• authorization-plugin: specifies the authorization plugins to use.
• insecure-registries: it replaces the daemon insecure registries with a new set of insecure registries. If some existing insecure registries in daemon's configuration are not in newly reloaded insecure resgitries, these existing ones will be removed from daemon's config.

Updating and reloading the cluster configurations such as --cluster-store, --cluster-advertise and --cluster-store-opts will take effect only if these configurations were not previously configured. If --cluster-store has been provided in flags and cluster-advertise not, cluster-advertise can be added in the configuration file without accompanied by --cluster-store. Configuration reload will log a warning message if it detects a change in previously configured cluster configurations.