You should only get that prompt when you run

docker login

or

nerdctl login

. The latter uses the credential forwarder to still store credentials on the host and not unencrypted inside the VM.