WebStorm 2023.3 Docker integration: handling expired registry credentials without storing passwords

Goal

I want to run and build containers from WebStorm 2023.3's Docker integration while keeping authentication least-privilege: short-lived registry tokens rather than long-lived logins, and no credentials persisted inside the IDE.

Constraints and uncertainty

My understanding from the documentation is that WebStorm delegates authentication to Docker Desktop's credential socket and does not store passwords internally. That raises a practical gap: when a token issued to the Docker daemon expires mid-session, it is unclear whether WebStorm surfaces a re-authentication prompt, silently retries, or fails the run configuration with a generic pull error. The release notes also mention that TLS client-certificate setups can trigger extra credential prompts, which may interact with token refresh.

Assume WebStorm 2023.3 with a current Docker Desktop and Docker Engine pairing, since integration behavior differs across major versions.

Questions

• When registry credentials expire, does WebStorm 2023.3 re-trigger the Docker Desktop authentication flow, or must the user re-login from the Docker CLI outside the IDE?
• Is there a supported way to scope the Docker connection in WebStorm to a least-privilege token (e.g., a read-only registry identity) without affecting other run configurations?
• With TLS client certificates configured, which component owns renewal or re-prompting when the certificate or token lapses?