# 04 — Control the Docker containers/builds Target

**What to build:** A Docker client Target that applies the Active Profile as defaults for new containers and builds while preserving unrelated client configuration and clearly distinguishing this behavior from Docker daemon proxying.

**Blocked by:** 02 — Safely control the Shell Target.

**Status:** done

- [ ] The Target is Available when the standard Docker client configuration model can be used for the owning user.
- [ ] Its explanation states that it affects new containers and builds, not Docker daemon registry access or existing containers.
- [ ] Enabling safely merges managed proxy defaults without removing unrelated Docker client settings.
- [ ] Disabling restores recognized prior proxy defaults and retains all unrelated configuration.
- [ ] Inspection distinguishes Enabled, Disabled, External, and Drifted, including externally edited managed values.
- [ ] HTTP, HTTPS, ALL/SOCKS, and Bypass values are applied only where Docker's documented model can represent them.
- [ ] Unsupported Profile data prevents mutation and is reported rather than silently discarded.
- [ ] Secret-bearing configuration is owner-restricted and credentials are redacted from UI errors and logs.
- [ ] Writes are atomic and repeated operations are idempotent.
- [ ] Adapter contract and Target-specific tests use isolated Docker client configuration and never contact or modify a real Docker daemon.