feat(installer): install Docker Desktop unattended with the WSL2 backend (#419)

[shujaatTracebloc]

What & why

On the winget path the installer couldn't pass Docker Desktop's own installer arguments — winget's manifest defaults decided — leaving first-launch license/onboarding prompts possible and the backend choice implicit. The direct-download path already passed install --quiet --accept-license but not --backend=wsl-2.

Changes (scripts/install-k8s.ps1)

• winget path: add --override "install --quiet --accept-license --backend=wsl-2 --always-run-service" so Docker Desktop's own installer flags apply through winget (--override replaces winget's manifest defaults).
• direct path: add --backend=wsl-2 --always-run-service to match.
• --always-run-service (Docker's documented unattended flag) runs the engine service without a GUI first-run — so a fresh machine reaches a running engine with zero Docker Desktop interaction. Both paths now produce the identical unattended result.

Acceptance (from #419)

• winget path passes the installer flags (--override) / direct path adds --backend=wsl-2
• Fresh machine reaches a running engine with zero Docker Desktop GUI interaction
• Evaluated org-install extras — included --always-run-service (the documented unattended flag that starts the service so any user can use Docker without launching the GUI). Left --admin-settings JSON out of scope (needs a policy file; belongs with the docker-users/feat(installer): provision Docker for the daily user during the admin window (docker-users + autostart + sized .wslconfig) #418 provisioning work).

Tests

Source guards: both install paths select the WSL2 backend explicitly + run the service unattended; winget uses --override. (Widened the #422 killable-process regex for the longer args string.)

Local verification

Pester 275/0/9 · check-style pass · drift clean · manifest regenerated · PS parse OK. (No bash changes — bats unaffected.)

Closes#419

---

Note

Low Risk
Installer-only change on Windows Docker install flags and tests; no auth, data, or cluster logic touched.

Overview
Windows Docker Desktop install now targets a fully unattended first run: WSL2 backend, license acceptance, and engine service without GUI onboarding.

On the winget path, the script passes Docker’s own installer args via --override "install --quiet --accept-license --backend=wsl-2 --always-run-service" (replacing winget manifest defaults). Arguments are built as a single command-line string for Start-Process so PowerShell 5.1 does not split the quoted --override value.

The direct-download installer path uses the same flags (--backend=wsl-2 --always-run-service) so both routes behave the same.

Tests add a #419 describe block that guards those flags in source, and tweak existing #422 regex windows for the longer installer argument strings. manifest.sha256 is updated for install-k8s.ps1.

^{Reviewed by Cursor Bugbot for commit 71e69ed. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 778fdd5. Configure here.}