Configuration

The daemon reads its configuration from two places, merged in this order:

1. The config file at /etc/docker/daemon.json (Linux) or %programdata%\docker\config\daemon.json (Windows). Path overridable with --config-file.
2. Command-line flags to dockerd.

The config schema lives in daemon/config/config.go and its OS-specific siblings (config_linux.go, config_windows.go). That file is the source of truth — every documented key here corresponds to a struct field there.

Selected keys

Key	Meaning
data-root	Where the daemon stores state. Default /var/lib/docker.
exec-root	Where the daemon stores per-process state. Default /var/run/docker.
hosts	Listening addresses (unix:///..., tcp://..., npipe://...).
tls, tlsverify, tlscacert, tlscert, tlskey	TLS for the TCP listener.
log-level	debug, info, warn, error. Reloadable.
log-driver, log-opts	Default container log driver. See Logging.
storage-driver, storage-opts	Graphdriver / snapshotter selection. See Graphdrivers.
iptables, ip6tables	Whether the daemon manages the firewall. Disable to manage rules yourself.
userland-proxy	Whether to spawn docker-proxy for published ports.
bridge, bip, fixed-cidr, default-gateway	Bridge network defaults.
default-address-pools	Subnets libnetwork allocates from for new bridge networks.
default-runtime, runtimes	OCI runtimes. The default is runc; map other names to OCI binaries.
containerd, containerd-namespace	Address and namespace for the upstream containerd.
experimental	Gate experimental endpoints.
insecure-registries, registry-mirrors	Pull config.
seccomp-profile	Path to a custom seccomp profile.
userns-remap	UID/GID remapping (e.g. default).
live-restore	Keep containers running across daemon restarts.
default-shm-size, shutdown-timeout, max-concurrent-downloads, max-concurrent-uploads	Self-explanatory tuning knobs.
metrics-addr	Bind address for the Prometheus metrics endpoint.
features	Feature flags map (e.g. containerd-snapshotter).
authorization-plugins	List of authz plugin names. See Plugins.
cri-containerd	Hint that this daemon shares a containerd instance with CRI.

Flags vs config file

Most of the above can be set on the command line as --<key> instead. dockerd --help enumerates them all (generated from the same struct via Cobra). When both are set, the flag wins.

Reload

SIGHUP reloads a curated subset of the config: debug, log-level, labels, cluster-store, insecure-registries, registry-mirrors, runtimes, default-runtime, default-address-pools, live-restore, max-concurrent-downloads, max-concurrent-uploads, shutdown-timeout, and a handful of others. The full list is in daemon/reload.go.

Anything else requires a daemon restart.

Validation

config.Validate (and OS-specific variants in config_linux.go / config_windows.go) runs a set of cross-field checks at startup. Tests live in config_test.go next to the implementation.