diff --git a/content/manuals/docker-hub/release-notes.md b/content/manuals/docker-hub/release-notes.md index d93b4ad0e06..1e2f34f2456 100644 --- a/content/manuals/docker-hub/release-notes.md +++ b/content/manuals/docker-hub/release-notes.md @@ -47,13 +47,13 @@ known issues for each Docker Hub release. ## 2023-08-28 -- Organizations with SSO enabled can assign members to roles, organizations, and teams with [SCIM role mapping](scim.md#set-up-role-mapping). +- Organizations with SSO enabled can assign members to roles, organizations, and teams with [SCIM role mapping](scim.md#set-up-role-mapping). ## 2023-07-26 ### New -- Organizations can assign the [editor role](roles-and-permissions.md) to members to grant additional permissions without full administrative access. +- Organizations can assign the [editor role](/manuals/enterprise/security/roles-and-permissions/_index.md) to members to grant additional permissions without full administrative access. ## 2023-05-09 diff --git a/content/manuals/enterprise/security/roles-and-permissions/_index.md b/content/manuals/enterprise/security/roles-and-permissions/_index.md new file mode 100644 index 00000000000..9549ad764eb --- /dev/null +++ b/content/manuals/enterprise/security/roles-and-permissions/_index.md @@ -0,0 +1,74 @@ +--- +title: Roles and permissions +linkTitle: Roles and permissions +description: Control access to content, registry, and organization management with Docker's role system +keywords: roles, permissions, custom roles, core roles, access control, organization management, docker hub, admin console, security +tags: [admin] +aliases: + - /admin/organization/roles/ + - /security/for-admins/roles-and-permissions/ +grid: + - title: "Core roles" + description: Learn about Docker's built-in Member, Editor, and Owner roles with predefined permissions. + icon: "admin_panel_settings" + link: /enterprise/security/roles-and-permissions/core-roles/ + - title: "Custom roles" + description: Create tailored permission sets that match your organization's specific needs. + icon: "tune" + link: /enterprise/security/roles-and-permissions/custom-roles/ +weight: 40 +--- + +{{< summary-bar feature_name="General admin" >}} + +Roles control what users can do in your Docker organization. When you invite users or create teams, you assign them roles that determine their permissions for repositories, teams, and organization settings. + +Docker provides two types of roles to meet different organizational needs: + +- [Core roles](/manuals/enterprise/security/roles-and-permissions/core-roles.md) with predefined permissions +- [Custom roles](/manuals/enterprise/security/roles-and-permissions/custom-roles.md) that you can tailor to your specific requirements + +## Docker roles + +### Core roles + +Core roles are Docker's built-in roles with predefined permission sets: + +- **Member**: Non-administrative role with basic access. Members can view other organization members and pull images from repositories they have access to. +- **Editor**: Partial administrative access. Editors can create, edit, and delete repositories, and manage team permissions for repositories. +- **Owner**: Full administrative access. Owners can manage all organization settings, including repositories, teams, members, billing, and security features. + +### Custom roles + +Custom roles allow you to create tailored permission sets by selecting specific permissions from categories like user management, team management, billing, and Hub permissions. Use custom roles when Docker's core roles don't fit your needs. + +## When to use each role + +Use core roles when: + +- Docker's predefined permission sets match your organizational structure +- You want simple, straightforward role assignments +- You're getting started with Docker organization management +- Your access control needs are standard and don't require fine-grained permissions + +Use custom roles when: + +- You need specific permission combinations not available in core roles +- You want to create specialized roles like billing administrators, security auditors, or repository managers +- You need department-specific access control +- You want to implement the principle of least privilege with precise permission grants + +## How roles work together + +Users and teams can be assigned either a core role or a custom role, but not both. However, roles work in combination with team permissions: + +1. **Role permissions**: Applied organization-wide (core or custom role). Custom roles can grant permissions to both organization-wide settings and repository access. +2. **Team permissions**: Additional repository-specific permissions when users are added to teams. This is a separate permission system from role-based permissions. + +This layered approach gives you flexibility to provide broad organizational access through roles and specific repository access through team memberships. + +## Next steps + +Choose the role type that best fits your organization's needs: + +{{< grid >}} diff --git a/content/manuals/enterprise/security/roles-and-permissions.md b/content/manuals/enterprise/security/roles-and-permissions/core-roles.md similarity index 52% rename from content/manuals/enterprise/security/roles-and-permissions.md rename to content/manuals/enterprise/security/roles-and-permissions/core-roles.md index 82227b4550a..a426a90c7ca 100644 --- a/content/manuals/enterprise/security/roles-and-permissions.md +++ b/content/manuals/enterprise/security/roles-and-permissions/core-roles.md @@ -1,54 +1,51 @@ --- -title: Roles and permissions +title: Core roles description: Control access to content, registry, and organization management with roles in your organization. keywords: members, teams, organization, company, roles, access, docker hub, admin console, security, permissions aliases: -- /docker-hub/roles-and-permissions/ -- /security/for-admins/roles-and-permissions/ -weight: 40 + - /docker-hub/roles-and-permissions/ + - /security/for-admins/roles-and-permissions/ + - /enterprise/security/roles-and-permissions/ --- {{< summary-bar feature_name="General admin" >}} -Roles control what users can do in your organization. When you invite users, you assign them a role that determines their permissions for repositories, teams, and organization settings. +Core roles are Docker's built-in roles with predefined permission sets. +This page provides an overview of Docker's core roles and permissions for each role. -This page provides an overview of Docker roles and permissions for each role. +## What are core roles? -## Organization roles +Docker organizations have three core roles: -Docker organizations have three main roles: - -- Member: Non-administrative role with basic access. Members can view other organization members and pull images from repositories they have access to. -- Editor: Partial administrative access. Editors can create, edit, and delete repositories. They can also manage team permissions for repositories. -- Owner: Full administrative access. Owners can manage all organization settings, including repositories, teams, members, billing, and security features. - -## Permissions by role +- **Member**: Non-administrative role with basic access. Members can view other organization members and pull images from repositories they have access to. +- **Editor**: Partial administrative access. Editors can create, edit, and delete repositories. They can also manage team permissions for repositories. +- **Owner**: Full administrative access. Owners can manage all organization settings, including repositories, teams, members, billing, and security features. > [!NOTE] > -> An owner role assigned at the company level has the same access as an owner role assigned at the organization level. For more information, see [Company overview](/admin/company/). +> A company owner has the same organization management permissions as an organization owner, but there are some content and registry permissions that company owners don't have (for example, repository pull/push). For more information, see [Company overview](/admin/company/). ### Content and registry permissions These permissions apply organization-wide, including all repositories in your organization's namespace. | Permission | Member | Editor | Owner | -| :---------------------------------------------------- | :----- | :----- | :----------------- | -| Explore images and extensions | ✅ | ✅ | ✅ | -| Star, favorite, vote, and comment on content | ✅ | ✅ | ✅ | -| Pull images | ✅ | ✅ | ✅ | -| Create and publish an extension | ✅ | ✅ | ✅ | -| Become a Verified, Official, or Open Source publisher | ❌ | ❌ | ✅ | -| Edit and delete publisher repository logos | ❌ | ✅ | ✅ | -| Observe content engagement as a publisher | ❌ | ❌ | ✅ | -| Create public and private repositories | ❌ | ✅ | ✅ | -| Edit and delete repositories | ❌ | ✅ | ✅ | -| Manage tags | ❌ | ✅ | ✅ | -| View repository activity | ❌ | ❌ | ✅ | -| Set up Automated builds | ❌ | ❌ | ✅ | -| Edit build settings | ❌ | ❌ | ✅ | -| View teams | ✅ | ✅ | ✅ | -| Assign team permissions to repositories | ❌ | ✅ | ✅ | +| :---------------------------------------------------- | :----- | :----- | :---- | +| Explore images and extensions | ✅ | ✅ | ✅ | +| Star, favorite, vote, and comment on content | ✅ | ✅ | ✅ | +| Pull images | ✅ | ✅ | ✅ | +| Create and publish an extension | ✅ | ✅ | ✅ | +| Become a Verified, Official, or Open Source publisher | ❌ | ❌ | ✅ | +| Edit and delete publisher repository logos | ❌ | ✅ | ✅ | +| Observe content engagement as a publisher | ❌ | ❌ | ✅ | +| Create public and private repositories | ❌ | ✅ | ✅ | +| Edit and delete repositories | ❌ | ✅ | ✅ | +| Manage tags | ❌ | ✅ | ✅ | +| View repository activity | ❌ | ❌ | ✅ | +| Set up Automated builds | ❌ | ❌ | ✅ | +| Edit build settings | ❌ | ❌ | ✅ | +| View teams | ✅ | ✅ | ✅ | +| Assign team permissions to repositories | ❌ | ✅ | ✅ | When you add members to teams, you can grant additional repository permissions beyond their organization role: @@ -59,45 +56,45 @@ beyond their organization role: ### Organization management permissions | Permission | Member | Editor | Owner | -| :---------------------------------------------------------------- | :----- | :----- | :----------------- | -| Create teams | ❌ | ❌ | ✅ | -| Manage teams (including delete) | ❌ | ❌ | ✅ | -| Configure the organization's settings (including linked services) | ❌ | ❌ | ✅ | -| Add organizations to a company | ❌ | ❌ | ✅ | -| Invite members | ❌ | ❌ | ✅ | -| Manage members | ❌ | ❌ | ✅ | -| Manage member roles and permissions | ❌ | ❌ | ✅ | -| View member activity | ❌ | ❌ | ✅ | -| Export and reporting | ❌ | ❌ | ✅ | -| Image Access Management | ❌ | ❌ | ✅ | -| Registry Access Management | ❌ | ❌ | ✅ | -| Set up Single Sign-On (SSO) and SCIM | ❌ | ❌ | ✅ \* | -| Require Docker Desktop sign-in | ❌ | ❌ | ✅ \* | -| Manage billing information (for example, billing address) | ❌ | ❌ | ✅ | -| Manage payment methods (for example, credit card or invoice) | ❌ | ❌ | ✅ | -| View billing history | ❌ | ❌ | ✅ | -| Manage subscriptions | ❌ | ❌ | ✅ | -| Manage seats | ❌ | ❌ | ✅ | -| Upgrade and downgrade plans | ❌ | ❌ | ✅ | +| :---------------------------------------------------------------- | :----- | :----- | :---- | +| Create teams | ❌ | ❌ | ✅ | +| Manage teams (including delete) | ❌ | ❌ | ✅ | +| Configure the organization's settings (including linked services) | ❌ | ❌ | ✅ | +| Add organizations to a company | ❌ | ❌ | ✅ | +| Invite members | ❌ | ❌ | ✅ | +| Manage members | ❌ | ❌ | ✅ | +| Manage member roles and permissions | ❌ | ❌ | ✅ | +| View member activity | ❌ | ❌ | ✅ | +| Export and reporting | ❌ | ❌ | ✅ | +| Image Access Management | ❌ | ❌ | ✅ | +| Registry Access Management | ❌ | ❌ | ✅ | +| Set up Single Sign-On (SSO) and SCIM | ❌ | ❌ | ✅ \* | +| Require Docker Desktop sign-in | ❌ | ❌ | ✅ \* | +| Manage billing information (for example, billing address) | ❌ | ❌ | ✅ | +| Manage payment methods (for example, credit card or invoice) | ❌ | ❌ | ✅ | +| View billing history | ❌ | ❌ | ✅ | +| Manage subscriptions | ❌ | ❌ | ✅ | +| Manage seats | ❌ | ❌ | ✅ | +| Upgrade and downgrade plans | ❌ | ❌ | ✅ | _\* If not part of a company_ ### Docker Scout permissions | Permission | Member | Editor | Owner | -| :---------------------------------------------------- | :----- | :----- | :----------------- | -| View and compare analysis results | ✅ | ✅ | ✅ | -| Upload analysis records | ✅ | ✅ | ✅ | -| Activate and deactivate Docker Scout for a repository | ❌ | ✅ | ✅ | -| Create environments | ❌ | ❌ | ✅ | -| Manage registry integrations | ❌ | ❌ | ✅ | +| :---------------------------------------------------- | :----- | :----- | :---- | +| View and compare analysis results | ✅ | ✅ | ✅ | +| Upload analysis records | ✅ | ✅ | ✅ | +| Activate and deactivate Docker Scout for a repository | ❌ | ✅ | ✅ | +| Create environments | ❌ | ❌ | ✅ | +| Manage registry integrations | ❌ | ❌ | ✅ | ### Docker Build Cloud permissions -| Permission | Member | Editor | Owner | -| ---------------------------- | :----- | :----- | :----------------- | -| Use a cloud builder | ✅ | ✅ | ✅ | -| Create and remove builders | ✅ | ✅ | ✅ | -| Configure builder settings | ✅ | ✅ | ✅ | -| Buy minutes | ❌ | ❌ | ✅ | -| Manage subscription | ❌ | ❌ | ✅ | +| Permission | Member | Editor | Owner | +| -------------------------- | :----- | :----- | :---- | +| Use a cloud builder | ✅ | ✅ | ✅ | +| Create and remove builders | ✅ | ✅ | ✅ | +| Configure builder settings | ✅ | ✅ | ✅ | +| Buy minutes | ❌ | ❌ | ✅ | +| Manage subscription | ❌ | ❌ | ✅ | diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles.md b/content/manuals/enterprise/security/roles-and-permissions/custom-roles.md new file mode 100644 index 00000000000..7d7f66dd392 --- /dev/null +++ b/content/manuals/enterprise/security/roles-and-permissions/custom-roles.md @@ -0,0 +1,198 @@ +--- +title: Custom roles +description: Create tailored permission sets for your organization with custom roles +keywords: custom roles, permissions, access control, organization management, docker hub, admin console, security +--- + +{{< summary-bar feature_name="General admin" >}} + +Custom roles allow you to create tailored permission sets that match your +organization's specific needs. This page covers custom roles and steps +to create and manage them. + +## What are custom roles? + +Custom roles let you create tailored permission sets for your organization. You +can assign custom roles to individual users or teams. +Users and teams get either a core role or custom role, but not both. + +Use custom roles when Docker's core roles don't fit your needs. + +## Prerequisites + +To configure custom roles, you need owner permissions in your Docker +organization. + +## Create a custom role + +Before you can assign a custom role to users, you must create one in the +Admin Console: + +1. Sign in to [Docker Home](https://app.docker.com). +2. Select **Admin Console**, then **User management**. +3. Select **Roles**, then **Create role**. +4. Create a name and describe what the role is for: + - Provide a **Label** + - Enter a unique **Name** identifier (can't be changed later) + - Add an optional **Description** +5. Set permissions for the role by expanding permission categories and selecting + the checkboxes for permissions. For a full list of available permissions, see + the [custom roles permissions reference](#custom-roles-permissions-reference). +6. Select **Review** to review your custom roles configuration and see a summary + of selected permissions. +7. Select **Create**. + +With a custom role created, you can now [assign custom roles to users](#assign-custom-roles). + +## Edit a custom role + +1. Sign in to [Docker Home](https://app.docker.com). +2. Select **Admin Console**, then **User management**. +3. Select **Roles**. +4. Find your custom role from the list, and select the **Actions menu**. +5. Select **Edit**. +6. You can edit the following custom role settings: + - Label + - Description + - Permissions +7. After you have finished editing, select **Save**. + +## Assign custom roles + +{{< tabs >}} +{{< tab name="Individual users" >}} + +1. Sign in to [Docker Home](https://app.docker.com). +2. Select **Members**. +3. Locate the member you want to assign a custom role to, then select the + **Actions menu**. +4. In the drop-down, select **Change role**. +5. In the **Select a role** drop-down, select your custom role. +6. Select **Save**. + +{{< /tab >}} +{{< tab name="Bulk users" >}} + +1. Sign in to [Docker Home](https://app.docker.com). +2. Select **Members**. +3. Use the checkboxes in the username column to select all users you want + to assign a custom role to. +4. Select **Change role**. +5. In the **Select a role** drop-down, select your custom role or a core role. +6. Select **Save**. + +{{< /tab >}} +{{< tab name="Teams" >}} + +1. Sign in to [Docker Home](https://app.docker.com). +2. Select **Teams**. +3. Locate the team you want to assign a custom role to, then select + the **Actions menu**. +4. Select **Assign role**. +5. Select your custom role, then select **Assign**. + +The role column will update to the newly assigned role. + +{{< /tab >}} +{{< /tabs >}} + +## View role assignments + +To see which users and teams are assigned to roles: + +1. Sign in to [Docker Home](https://app.docker.com). +2. Select **Admin Console**, then **User management**. +3. Select **Roles**. +4. In the roles list, view the **Users** and **Teams** columns to see + assignment counts. +5. Select a specific role to view its permissions and assignments in detail. + +## Reassign custom roles + +{{< tabs >}} +{{< tab name="Individual users" >}} + +1. Sign in to [Docker Home](https://app.docker.com). +2. Select **Members**. +3. Locate the member you want to reassign, then select the **Actions menu**. +4. Select **Change role**. +5. In the **Select a role** drop-down, select the new role. +6. Select **Save**. + +{{< /tab >}} +{{< tab name="Bulk users" >}} + +1. Sign in to [Docker Home](https://app.docker.com). +2. Select **Members**. +3. Use the checkboxes in the username column to select all users you want + to reassign. +4. Select **Change role**. +5. In the **Select a role** drop-down, select the new role. +6. Select **Save**. + +{{< /tab >}} +{{< tab name="Teams" >}} + +1. Sign in to [Docker Home](https://app.docker.com). +2. Select **Teams**. +3. Locate the team, then select the **Actions menu**. +4. Select **Change role**. +5. In the pop-up window, select a role from the drop-down menu, then + select **Save**. + +{{< /tab >}} +{{< /tabs >}} + +## Delete a custom role + +Before deleting a custom role, you must reassign all users and teams to different roles. + +1. Sign in to [Docker Home](https://app.docker.com). +2. Select **Admin Console**, then **User management**. +3. Select **Roles**. +4. Find your custom role from the list, and select the **Actions menu**. +5. If the role has assigned users or teams: + - Navigate to the **Members** page and change the role for all users assigned to this custom role + - Navigate to the **Teams** page and reassign all teams that have this custom role +6. Once no users or teams are assigned, return to **Roles**. +7. Find your custom role and select the **Actions menu**. +8. Select **Delete**. +9. In the confirmation window, select **Delete** to confirm. + +## Custom roles permissions reference + +Custom roles are built by selecting specific permissions across different categories. The following tables list all available permissions you can assign to a custom role. + +### Organization management + +| Permission | Description | +| :-------------------------------- | :---------------------------------------------------------------------------------------------- | +| View teams | View teams and team members | +| Manage teams | Create, update, and delete teams and team members | +| Manage registry access | Control which registries members can access | +| Manage image access | Set policies for which images members can pull and use | +| Update organization information | Update organization information such as name and location | +| Member management | Manage organization members, invites, and roles | +| View custom roles | View existing custom roles and their permissions | +| Manage custom roles | Full access to custom role management and assignment | +| Manage organization access tokens | Create, update, and delete repositories in this org. Push/pull or registry actions not included | +| View activity logs | Access organization audit logs and activity history | +| View domains | View domains and domain audit settings | +| Manage domains | Manage verified domains and domain audit settings | +| View SSO and SCIM | View single sign-on and user provisioning configurations | +| Manage SSO and SCIM | Full access to SSO and SCIM management | +| Manage Desktop settings | Configure Docker Desktop settings policies and view usage reports | + +### Docker Hub + +| Permission | Description | +| :------------------ | :--------------------------------------------------------- | +| View repositories | View repository details and contents | +| Manage repositories | Create, update, and delete repositories and their contents | + +### Billing + +| Permission | Description | +| :------------- | :----------------------------------------------- | +| View billing | View organization billing information | +| Manage billing | Complete access to managing organization billing | diff --git a/hugo_stats.json b/hugo_stats.json index e0b7375b82e..23fc99e1a49 100644 --- a/hugo_stats.json +++ b/hugo_stats.json @@ -26,6 +26,7 @@ "Bake", "Bash", "Before", + "Bulk-users", "CLI", "CentOS-RHEL-and-Fedora", "Circle-CI", @@ -75,6 +76,7 @@ "HTTP", "Heredocs", "Hyper-V-backend-x86_64", + "Individual-users", "Inline", "Installation-time-setup", "Instant-verification", @@ -129,6 +131,7 @@ "Shell-script-deployment", "Specific-version", "Svelte", + "Teams", "Testcontainers-Cloud", "TypeScript", "Ubuntu",