How to Fix "Malware Blocked" com.docker.socket on macOS
macOS XProtect sometimes flags com.docker.socket as malware after a Docker Desktop update. This is a false positive caused by a code-signing mismatch — the helper binaries in /Library/PrivilegedHelperTools/ have stale or revoked signatures. No actual malware is involved.