# Account for manual Docker stops when reviewing restart policy

> A configured restart policy can intentionally stand aside after an operator stops the container.

- Canonical URL: https://update.dsesecurity.com/updates/account-for-manual-docker-stops-when-reviewing-restart-policy/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:15:13+00:00
- Modified: 2026-10-20T18:34:32+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

A configured restart policy can intentionally stand aside after an operator stops the container.

## Potentially affected

Review Docker container restart policy after application exit, operator stop and daemon restart.

## DSE recommendation

DSE recommends recording deliberate stops in maintenance activity and checking the effective policy before assuming failed automatic recovery.

## Article

A configured restart policy can intentionally stand aside after an operator stops the container.

## Source facts

Docker ignores a container’s restart policy after a manual stop until the daemon or container is restarted. The always and unless-stopped policies differ across daemon restart: unless-stopped preserves the stopped state. Docker also applies restart policy only after the container has started successfully under its documented monitoring threshold, avoiding an immediate launch-failure loop.

Source: [Docker documentation — Start containers automatically](https://docs.docker.com/engine/containers/start-containers-automatically/).

## Applicability

Review Docker container restart policy after application exit, operator stop and daemon restart.

## DSE recommendation

DSE recommends recording deliberate stops in maintenance activity and checking the effective policy before assuming failed automatic recovery. Choose whether a stopped workload should return after host maintenance and document that decision with its owner. Avoid combining competing host supervisors and container restart mechanisms without a clear authority. Keep application health checks separate from process-exit handling; a running but unhealthy process may require another response. Review start failures as deployment defects rather than attempting to conceal them with increasingly aggressive restarts.

## Verification

In a test workload, compare an application exit with a manual stop, then inspect the result of a controlled daemon restart under the chosen policy. Confirm monitoring recognizes an intentionally stopped service and alerts appropriately when it remains unavailable beyond the approved window. Preserve the operator stop event and the selected policy with the observed lifecycle. Have the service owner identify the permitted maintenance-stop duration and the exact action expected to return the workload to service.

## Official reference

[Docker documentation — Start containers automatically](https://docs.docker.com/engine/containers/start-containers-automatically/). Reviewed October 20, 2026.

## Primary reference

- Name: Docker documentation — Start containers automatically
- Authority: docs.docker.com
- URL: https://docs.docker.com/engine/containers/start-containers-automatically/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Account for manual Docker stops when reviewing restart policy,” DSE Security, https://update.dsesecurity.com/updates/account-for-manual-docker-stops-when-reviewing-restart-policy/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.