setup-docker-engine-for-windows-containers.ps1

# Enable operating system container-related features (requires restart)
Enable-WindowsOptionalFeature -Online -FeatureName containers -All
Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All

# Download and extract Docker binaries
$dockerBinariesIndex = (Invoke-WebRequest "https://download.docker.com/win/static/stable/x86_64")
$dockerLatestVersion = ($dockerBinariesIndex.Links[$dockerBinariesIndex.Links.Count - 1]).innerText
Invoke-WebRequest "https://download.docker.com/win/static/stable/x86_64/$dockerLatestVersion" -OutFile "$Env:TEMP\$dockerLatestVersion"
Expand-Archive "$Env:TEMP\$dockerLatestVersion" -DestinationPath $Env:ProgramFiles -Force
Remove-Item "$Env:TEMP\$dockerLatestVersion"

# Add installed binaries to PATH
[System.Environment]::SetEnvironmentVariable("PATH", "$Env:PATH;$Env:ProgramFiles\docker", [System.EnvironmentVariableTarget]::User)
$Env:PATH = [System.Environment]::GetEnvironmentVariable("PATH", [System.EnvironmentVariableTarget]::User)

# Register and start Docker service
dockerd --register-service
Start-Service docker

# Grant access control to non-elevated user to the Docker engine pipe
$directoryInfo = New-Object "System.IO.DirectoryInfo" -ArgumentList "\\.\pipe\docker_engine"
$directorySecurity = $directoryInfo.GetAccessControl()
$accessRule = New-Object "System.Security.AccessControl.FileSystemAccessRule" -ArgumentList ([System.Security.Principal.WindowsIdentity]::GetCurrent().Name),FullControl,Allow
$directorySecurity.AddAccessRule($accessRule)
$directoryInfo.SetAccessControl($directorySecurity)

# Test the following in a non-elevated shell session
docker run --rm hello-world:nanoserver

I should have seen this before: https://learn.microsoft.com/en-us/virtualization/windowscontainers/quick-start/set-up-environment?tabs=dockerce#windows-server-2