**Related issue:** Customer reports of failed Docker Desktop updates
from self-service on macOS.
## Details
The reported error is Docker Desktop's own updater speaking, not
Fleet's:
```
failed to back up /Applications/Docker.app before update: renaming (moving) file from /Applications/Docker.app to /Applications/Docker.app.back: rename /Applications/Docker.app /Applications/Docker.app.back: file exists
```
Hosts showing "update available" in self-service are exactly the hosts
where Docker Desktop has already downloaded and staged its **own**
self-update at `~/Library/Application
Support/com.docker.install/in_progress/Docker.app`. When the FMA install
script gracefully quits Docker Desktop, that quit triggers Docker's
install-on-quit updater, which renames `Docker.app` → `Docker.app.back`
and moves the staged copy into place — racing the script's own
`mv`/`rm`/`cp` of `/Applications/Docker.app`. The script previously
cleaned up after this race (leftover `.back` bundle and staged copy);
this PR prevents it instead:
- Remove the entire `com.docker.install` staging directory (staged
bundle + updater state) **before** quitting the app, so the quit can't
trigger Docker's updater. Same whole-directory removal the uninstall's
`post_uninstall_scripts` already does.
- Wait out (bounded, 30s) any updater already in flight before touching
`/Applications/Docker.app`.
- Output regenerated via `go run ./cmd/maintained-apps -slug
docker-desktop/darwin`; version pinned at 4.85.0, installer URL/sha
unchanged, only the install script ref changed.
Hosts already wedged with a stale `Docker.app.back` self-heal: the
script still removes `.back` before copying the new bundle.
## Local validation (macOS arm64, Docker Desktop 4.84.0 running)
- shellcheck and `bash -n` clean; embedded output script matches input
byte-for-byte with correct sha256[:8] ref
- Downloaded the pinned 4.85.0 DMG; sha256 matches the manifest
- Seeded affected-host state (non-empty `/Applications/Docker.app.back`,
staged `com.docker.install/in_progress/Docker.app`) and ran the shipped
script: staging dir removed before quit, running Docker Desktop (VM +
active build) quit gracefully, wait loop did not hang
- Wait loop unit-tested against a live process matching
`com\.docker\.install`: waits until it exits, 30s cap
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] QA'd all new/changed functionality manually
Allen Houchins
183aa052d2