Docker Desktop update got flagged as ransomware. What should I do?

A security alert after an update doesn’t prove either that Docker is malicious or that the detection is a false alarm. Don’t restore or delete the listed files yet. Keep the alert open, note the exact file paths and detection details, and check that the installer came from Docker’s official source and has a valid publisher signature. Then ask Acronis support to review the detection, and check Docker’s official release or security notices for version 4.79.

For now, stop Docker if Acronis is actively blocking it, but don’t uninstall your security software just to make the warning disappear. Avoid choosing recovery until you know what it would change. If you need the local app urgently, use a known clean backup or another device rather than making a broad antivirus exception. Once the alert is verified as a false positive, use the security vendor’s recommended process for allowing that specific signed file.

Docker Desktop can touch a lot of files and run background components, so behavior-based protection may flag an update. That makes a false positive plausible, not certain. The affected-file list may include ordinary configuration or metadata files, but don’t assume that from filenames alone. If you’re unsure how to inspect them, save the alert details and ask Acronis or Docker support to interpret them before restoring, deleting, or allowing anything.