From 0d14e0877d126d81f54ce3d40c18a2a346149082 Mon Sep 17 00:00:00 2001 From: Alexa Date: Thu, 27 Aug 2026 11:34:47 -0500 Subject: [PATCH 1/4] Restructure Security IA under Platform and top-level FAQs. Consolidate access tokens, authentication, provisioning, and roles under platform/security, move FAQs to a top-level Platform section, and preserve old URLs with aliases. Co-authored-by: Cursor --- content/guides/admin-set-up.md | 16 +- content/guides/admin-user-management.md | 10 +- content/guides/genai-claude-code-mcp.md | 2 +- content/guides/gha.md | 2 +- content/manuals/_index.md | 2 +- content/manuals/accounts/_index.md | 6 +- content/manuals/accounts/create-account.md | 2 +- content/manuals/accounts/manage-account.md | 6 +- content/manuals/admin/company/_index.md | 4 +- content/manuals/admin/company/company-faqs.md | 2 +- content/manuals/admin/insights.md | 8 +- content/manuals/admin/organization/_index.md | 2 +- .../admin/organization/deactivate-account.md | 2 +- .../admin/organization/manage/_index.md | 2 +- .../organization/manage/manage-a-team.md | 4 +- .../organization/manage/manage-licenses.md | 6 +- .../organization/manage/manage-products.md | 4 +- .../admin/organization/manage/members.md | 8 +- .../admin/organization/organization-faqs.md | 2 +- .../admin/organization/setup/_index.md | 2 +- .../organization/setup/convert-account.md | 2 +- .../organization/setup/general-settings.md | 6 +- .../admin/organization/setup/onboard.md | 20 +-- .../access-controls/organization.md | 6 +- .../ai/sandboxes/governance/audit/_index.md | 4 +- .../sandboxes/governance/audit/configure.md | 4 +- .../sign-in-enforcement.md | 2 +- content/manuals/build-cloud/_index.md | 2 +- content/manuals/build-cloud/ci.md | 8 +- content/manuals/desktop/release-notes.md | 16 +- .../desktop/setup/install/mac-install.md | 2 +- .../desktop/setup/install/windows-install.md | 2 +- content/manuals/desktop/setup/sign-in.md | 2 +- content/manuals/dhi/how-to/customize.md | 4 +- content/manuals/dhi/how-to/helm.md | 4 +- content/manuals/dhi/how-to/mirror.md | 16 +- content/manuals/dhi/how-to/policies.md | 2 +- content/manuals/dhi/how-to/use.md | 12 +- content/manuals/dhi/how-to/verify.md | 4 +- content/manuals/dhi/tools/api.md | 2 +- content/manuals/dhi/tools/mcp.md | 2 +- content/manuals/docker-hub/release-notes.md | 6 +- content/manuals/docker-hub/repos/create.md | 2 +- .../manuals/docker-hub/repos/manage/access.md | 6 +- .../docker-hub/repos/manage/builds/migrate.md | 4 +- .../manuals/docker-hub/repos/manage/export.md | 2 +- content/manuals/docker-hub/usage/pulls.md | 2 +- .../pkg-install-and-configure.md | 2 +- .../enterprise-deployment/use-intune.md | 2 +- .../enterprise-deployment/use-jamf-pro.md | 2 +- content/manuals/enterprise/security/_index.md | 38 +---- .../hardened-desktop/air-gapped-containers.md | 2 +- .../enable-eci.md | 2 +- .../image-access-management.md | 4 +- .../registry-access-management.md | 6 +- .../settings-management/_index.md | 6 +- .../compliance-reporting.md | 4 +- .../configure-admin-console.md | 4 +- .../configure-json-file.md | 2 +- .../security/single-sign-on/FAQs/_index.md | 6 - .../security/single-sign-on/FAQs/general.md | 35 ----- .../security/single-sign-on/FAQs/idp-faqs.md | 53 ------- .../single-sign-on/FAQs/users-faqs.md | 62 -------- .../manuals/extensions/private-marketplace.md | 2 +- content/manuals/faqs/_index.md | 15 ++ .../manuals/{security => }/faqs/containers.md | 3 + .../FAQs => faqs}/domain-faqs.md | 5 +- .../FAQs => faqs}/enforcement-faqs.md | 11 +- .../manuals/{security => }/faqs/general.md | 7 +- .../{security => }/faqs/networking-and-vms.md | 3 + content/manuals/faqs/sso-faqs.md | 140 ++++++++++++++++++ content/manuals/platform-release-notes.md | 6 +- .../manuals/{ => platform}/security/_index.md | 11 +- .../platform/security/access-tokens/_index.md | 9 ++ .../organization-access-tokens.md} | 3 +- .../access-tokens/personal-access-tokens.md} | 6 +- .../security/authentication}/2fa/_index.md | 1 + .../2fa/recover-hub-account.md | 0 .../security/authentication/_index.md | 9 ++ .../authentication}/enforce-sign-in/_index.md | 7 +- .../enforce-sign-in/methods.md | 1 + .../oidc-connections/_index.md | 8 +- .../oidc-connections/create-manage.md | 4 +- .../oidc-connections/rulesets-claims.md | 4 +- .../authentication}/single-sign-on/_index.md | 7 +- .../authentication}/single-sign-on/connect.md | 18 +-- .../single-sign-on/images/SSO.png | Bin .../authentication}/single-sign-on/manage.md | 3 +- .../single-sign-on/troubleshoot-sso.md | 4 +- .../security/provisioning/_index.md | 7 +- .../provisioning/auto-provisioning.md | 4 +- .../provisioning}/domain-management.md | 12 +- .../security/provisioning/just-in-time.md | 6 +- .../security/provisioning/scim/_index.md | 6 +- .../provisioning/scim/group-mapping.md | 6 +- .../provisioning/scim/migrate-scim.md | 8 +- .../provisioning/scim/provision-scim.md | 18 +-- .../provisioning/troubleshoot-provisioning.md | 0 .../security/roles-and-permissions/_index.md | 9 +- .../roles-and-permissions/core-roles.md | 6 +- .../custom-roles/_index.md | 6 +- .../custom-roles/manage.md | 2 +- .../custom-roles/permissions-reference.md | 2 +- .../security/security-announcements.md | 24 +-- content/manuals/retired.md | 2 +- .../manuals/scout/explore/metrics-exporter.md | 8 +- .../scout/integrations/registry/acr.md | 2 +- .../integrations/registry/artifactory.md | 2 +- .../scout/integrations/registry/ecr.md | 2 +- content/manuals/security/faqs/_index.md | 6 - .../manuals/unassociated-machines/_index.md | 8 +- content/reference/api/hub/latest.yaml | 2 +- data/redirects.yml | 2 +- 113 files changed, 459 insertions(+), 444 deletions(-) delete mode 100644 content/manuals/enterprise/security/single-sign-on/FAQs/_index.md delete mode 100644 content/manuals/enterprise/security/single-sign-on/FAQs/general.md delete mode 100644 content/manuals/enterprise/security/single-sign-on/FAQs/idp-faqs.md delete mode 100644 content/manuals/enterprise/security/single-sign-on/FAQs/users-faqs.md create mode 100644 content/manuals/faqs/_index.md rename content/manuals/{security => }/faqs/containers.md (94%) rename content/manuals/{enterprise/security/single-sign-on/FAQs => faqs}/domain-faqs.md (89%) rename content/manuals/{enterprise/security/single-sign-on/FAQs => faqs}/enforcement-faqs.md (70%) rename content/manuals/{security => }/faqs/general.md (90%) rename content/manuals/{security => }/faqs/networking-and-vms.md (93%) create mode 100644 content/manuals/faqs/sso-faqs.md rename content/manuals/{ => platform}/security/_index.md (92%) create mode 100644 content/manuals/platform/security/access-tokens/_index.md rename content/manuals/{enterprise/security/access-tokens.md => platform/security/access-tokens/organization-access-tokens.md} (97%) rename content/manuals/{security/access-tokens.md => platform/security/access-tokens/personal-access-tokens.md} (93%) rename content/manuals/{security => platform/security/authentication}/2fa/_index.md (99%) rename content/manuals/{security => platform/security/authentication}/2fa/recover-hub-account.md (100%) create mode 100644 content/manuals/platform/security/authentication/_index.md rename content/manuals/{enterprise/security => platform/security/authentication}/enforce-sign-in/_index.md (91%) rename content/manuals/{enterprise/security => platform/security/authentication}/enforce-sign-in/methods.md (99%) rename content/manuals/{enterprise/security => platform/security/authentication}/oidc-connections/_index.md (83%) rename content/manuals/{enterprise/security => platform/security/authentication}/oidc-connections/create-manage.md (92%) rename content/manuals/{enterprise/security => platform/security/authentication}/oidc-connections/rulesets-claims.md (94%) rename content/manuals/{enterprise/security => platform/security/authentication}/single-sign-on/_index.md (86%) rename content/manuals/{enterprise/security => platform/security/authentication}/single-sign-on/connect.md (92%) rename content/manuals/{enterprise/security => platform/security/authentication}/single-sign-on/images/SSO.png (100%) rename content/manuals/{enterprise/security => platform/security/authentication}/single-sign-on/manage.md (98%) rename content/manuals/{enterprise/security => platform/security/authentication}/single-sign-on/troubleshoot-sso.md (97%) rename content/manuals/{enterprise => platform}/security/provisioning/_index.md (95%) rename content/manuals/{enterprise => platform}/security/provisioning/auto-provisioning.md (91%) rename content/manuals/{enterprise/security => platform/security/provisioning}/domain-management.md (90%) rename content/manuals/{enterprise => platform}/security/provisioning/just-in-time.md (93%) rename content/manuals/{enterprise => platform}/security/provisioning/scim/_index.md (82%) rename content/manuals/{enterprise => platform}/security/provisioning/scim/group-mapping.md (97%) rename content/manuals/{enterprise => platform}/security/provisioning/scim/migrate-scim.md (94%) rename content/manuals/{enterprise => platform}/security/provisioning/scim/provision-scim.md (94%) rename content/manuals/{enterprise => platform}/security/provisioning/troubleshoot-provisioning.md (100%) rename content/manuals/{enterprise => platform}/security/roles-and-permissions/_index.md (89%) rename content/manuals/{enterprise => platform}/security/roles-and-permissions/core-roles.md (96%) rename content/manuals/{enterprise => platform}/security/roles-and-permissions/custom-roles/_index.md (87%) rename content/manuals/{enterprise => platform}/security/roles-and-permissions/custom-roles/manage.md (98%) rename content/manuals/{enterprise => platform}/security/roles-and-permissions/custom-roles/permissions-reference.md (98%) rename content/manuals/{ => platform}/security/security-announcements.md (93%) delete mode 100644 content/manuals/security/faqs/_index.md diff --git a/content/guides/admin-set-up.md b/content/guides/admin-set-up.md index 4978217bb01c..5298ab58f388 100644 --- a/content/guides/admin-set-up.md +++ b/content/guides/admin-set-up.md @@ -56,11 +56,11 @@ This guide covers the following Docker features: repositories. Your organization was created with your subscription and is managed by one or more owners. Users signed into the organization are assigned seats based on the purchased subscription. -- [Enforce sign-in](/manuals/enterprise/security/enforce-sign-in/_index.md): +- [Enforce sign-in](/manuals/platform/security/authentication/enforce-sign-in/_index.md): By default, Docker Desktop doesn't require sign-in. You can configure settings to enforce this and ensure your developers sign in to your Docker organization. -- [SSO](/manuals/enterprise/security/single-sign-on/_index.md): Without SSO, +- [SSO](/manuals/platform/security/authentication/single-sign-on/_index.md): Without SSO, user management in a Docker organization is manual. Setting up an SSO connection between your identity provider and Docker ensures compliance with your security policy and automates user provisioning. Adding @@ -154,7 +154,7 @@ configuration: Review these areas together: - Security features and - [enforcing sign-in](/manuals/enterprise/security/enforce-sign-in/_index.md) + [enforcing sign-in](/manuals/platform/security/authentication/enforce-sign-in/_index.md) for Docker Desktop users - Additional Docker products included in your subscriptions @@ -176,7 +176,7 @@ security configurations as outlined in the previous section, configure Settings [`admin-settings.json` file](/manuals/enterprise/security/hardened-desktop/settings-management/configure-json-file.md). Once the file is ready, collaborate with your MDM team to deploy your chosen -settings, along with your chosen method for [enforcing sign-in](/manuals/enterprise/security/enforce-sign-in/_index.md). +settings, along with your chosen method for [enforcing sign-in](/manuals/platform/security/authentication/enforce-sign-in/_index.md). > [!IMPORTANT] > @@ -196,9 +196,9 @@ organizations. Single sign-on (SSO) lets developers authenticate using their identity providers (IdPs) to access Docker. SSO is available for a whole company and all associated organizations, or an individual organization that has a Docker Business subscription. For more information, see the -[documentation](/manuals/enterprise/security/single-sign-on/_index.md). +[documentation](/manuals/platform/security/authentication/single-sign-on/_index.md). -You can also enable [SCIM](/manuals/enterprise/security/provisioning/scim/_index.md) +You can also enable [SCIM](/manuals/platform/security/provisioning/scim/_index.md) for further automation of provisioning and deprovisioning of users. #### Set up Docker product entitlements included in the subscription @@ -252,7 +252,7 @@ SSO and SCIM setup. > [!IMPORTANT] > > Some users may need CLI based logins to Docker Hub, and for this they will -> need a [personal access token (PAT)](/manuals/security/access-tokens.md). +> need a [personal access token (PAT)](/manuals/platform/security/access-tokens/personal-access-tokens.md). ### Test Registry Access Management and Image Access Management @@ -312,7 +312,7 @@ that matches your verified domain must sign in using your SSO connection. Make sure the Identity provider groups associated with your SSO connection cover all the developer groups that you want to have access to the Docker subscription. -For instructions on how to enforce SSO, see [Enforce SSO](/manuals/enterprise/security/single-sign-on/connect.md). +For instructions on how to enforce SSO, see [Enforce SSO](/manuals/platform/security/authentication/single-sign-on/connect.md). ### Deploy configuration settings and enforce sign-in to users diff --git a/content/guides/admin-user-management.md b/content/guides/admin-user-management.md index 84ff0adb7545..413aa13d192c 100644 --- a/content/guides/admin-user-management.md +++ b/content/guides/admin-user-management.md @@ -58,7 +58,7 @@ Docker's predefined roles offer flexibility for various organizational needs. As - Editor: Partial administrative access to the organization. Editors can create, edit, and delete repositories. They can also edit an existing team's access permissions. - Owner: Full organization administrative access. Owners can manage organization repositories, teams, members, settings, and billing. -For more information, see [Roles and permissions](/manuals/enterprise/security/roles-and-permissions.md). +For more information, see [Roles and permissions](/manuals/platform/security/roles-and-permissions.md). #### Enhance with teams @@ -89,7 +89,7 @@ This page guides you through onboarding owners and members, and using tools like When you create a Docker organization, you automatically become its sole owner. While optional, adding additional owners can significantly ease the process of onboarding and managing your organization by distributing administrative responsibilities. It also ensures continuity and prevents blockers if the primary owner is unavailable. -For detailed information on owners, see [Roles and permissions](/manuals/enterprise/security/roles-and-permissions.md). +For detailed information on owners, see [Roles and permissions](/manuals/platform/security/roles-and-permissions.md). ### Invite members and assign roles @@ -119,11 +119,11 @@ SSO: - Reduces password-related vulnerabilities. - Simplifies onboarding as it works seamlessly with SCIM and group mapping for automated provisioning. -For more information, see the [SSO documentation](/manuals/enterprise/security/single-sign-on/_index.md). +For more information, see the [SSO documentation](/manuals/platform/security/authentication/single-sign-on/_index.md). #### Automate onboarding with SCIM and JIT provisioning -Streamline user provisioning and role management with [SCIM](/manuals/enterprise/security/provisioning/scim/_index.md) and [Just-in-Time (JIT) provisioning](/manuals/enterprise/security/provisioning/just-in-time.md). +Streamline user provisioning and role management with [SCIM](/manuals/platform/security/provisioning/scim/_index.md) and [Just-in-Time (JIT) provisioning](/manuals/platform/security/provisioning/just-in-time.md). With SCIM you can: @@ -145,7 +145,7 @@ It also: - Ensures consistent access control policies. - Help you scale permissions as teams grow or change. -For more information on how it works, see [Group mapping](/manuals/enterprise/security/provisioning/scim/group-mapping.md). +For more information on how it works, see [Group mapping](/manuals/platform/security/provisioning/scim/group-mapping.md). ## Monitoring and insights diff --git a/content/guides/genai-claude-code-mcp.md b/content/guides/genai-claude-code-mcp.md index c71ee9f89203..7eecad93e79f 100644 --- a/content/guides/genai-claude-code-mcp.md +++ b/content/guides/genai-claude-code-mcp.md @@ -71,7 +71,7 @@ Make sure you have: 1. Select the **Docker Hub**MCP server 1. Add the MCP server, then open the **Configuration** tab 1. Enter your Docker Hub username -1. [Create a read-only personal access token](/security/access-tokens/#create-a-personal-access-token) and enter your access token under **Secrets** +1. [Create a read-only personal access token](/platform/security/access-tokens/personal-access-tokens/#create-a-personal-access-token) and enter your access token under **Secrets** 1. Save the configuration ![Docker Hub](images/genai-claude-code-mcp-catalog-docker-hub.avif "Docker Hub") diff --git a/content/guides/gha.md b/content/guides/gha.md index 4da6330e797f..197730cbe556 100644 --- a/content/guides/gha.md +++ b/content/guides/gha.md @@ -52,7 +52,7 @@ that, you must authenticate with your Docker credentials (username and access token) as part of the GitHub Actions workflow. For instructions on how to create a Docker access token, see -[Create and manage access tokens](/manuals/security/access-tokens.md). +[Create and manage access tokens](/manuals/platform/security/access-tokens/personal-access-tokens.md). Once you have your Docker credentials ready, add the credentials to your GitHub repository so you can use them in GitHub Actions: diff --git a/content/manuals/_index.md b/content/manuals/_index.md index 20c7a49c57b4..2d9623682077 100644 --- a/content/manuals/_index.md +++ b/content/manuals/_index.md @@ -94,7 +94,7 @@ params: - title: Security description: Security guardrails for both administrators and developers. icon: lock-closed - link: /security/ + link: /platform/security/ - title: Subscription description: Commercial use licenses for Docker products. icon: credit-card diff --git a/content/manuals/accounts/_index.md b/content/manuals/accounts/_index.md index 67ffb1841983..0cb3765e2f38 100644 --- a/content/manuals/accounts/_index.md +++ b/content/manuals/accounts/_index.md @@ -22,10 +22,10 @@ grid: - title: Personal access tokens description: Learn how to create and manage access tokens for your account. icon: lock-closed - link: /security/access-tokens/ + link: /platform/security/access-tokens/personal-access-tokens/ - title: Set up two-factor authentication description: Add an extra layer of authentication to your Docker account. - link: /security/2fa/ + link: /platform/security/authentication/2fa/ icon: device-phone-mobile - title: Organization overview description: Learn how to create and manage Docker organizations. @@ -56,7 +56,7 @@ Docker also ties a verified email to the account. - Email: How Docker contacts you for notifications and security-related communications. - Sign-in method: Email and password, - [single sign-on (SSO)](/manuals/enterprise/security/single-sign-on/_index.md), + [single sign-on (SSO)](/manuals/platform/security/authentication/single-sign-on/_index.md), Google, or GitHub. ## Next steps diff --git a/content/manuals/accounts/create-account.md b/content/manuals/accounts/create-account.md index 5bdff24960c3..c4986499e0cc 100644 --- a/content/manuals/accounts/create-account.md +++ b/content/manuals/accounts/create-account.md @@ -86,4 +86,4 @@ basis: ## Next steps - [Manage a Docker account](/manuals/accounts/manage-account.md) -- [Enable two-factor authentication](/manuals/security/2fa/_index.md) +- [Enable two-factor authentication](/manuals/platform/security/authentication/2fa/_index.md) diff --git a/content/manuals/accounts/manage-account.md b/content/manuals/accounts/manage-account.md index d75ab1ab4f35..856cfae99c20 100644 --- a/content/manuals/accounts/manage-account.md +++ b/content/manuals/accounts/manage-account.md @@ -77,7 +77,7 @@ To update your two-factor authentication (2FA) settings: 1. Select **2FA**. For more information, see -[Enable two-factor authentication](/manuals/security/2fa/_index.md). +[Enable two-factor authentication](/manuals/platform/security/authentication/2fa/_index.md). ## Manage personal access tokens @@ -88,7 +88,7 @@ To manage personal access tokens: 1. Select **Personal access tokens**. For more information, see -[Create and manage access tokens](/manuals/security/access-tokens.md). +[Create and manage access tokens](/manuals/platform/security/access-tokens/personal-access-tokens.md). ## Manage connected accounts @@ -127,4 +127,4 @@ For information on deactivating your account, see - [Docker accounts overview](/manuals/accounts/_index.md) - [Create a Docker account](/manuals/accounts/create-account.md) -- [Enable two-factor authentication](/manuals/security/2fa/_index.md) +- [Enable two-factor authentication](/manuals/platform/security/authentication/2fa/_index.md) diff --git a/content/manuals/admin/company/_index.md b/content/manuals/admin/company/_index.md index 55398a5b3474..5697d54e8be7 100644 --- a/content/manuals/admin/company/_index.md +++ b/content/manuals/admin/company/_index.md @@ -16,11 +16,11 @@ grid: - title: Configure SSO and SCIM description: Set up single sign-on and SCIM provisioning for your company. icon: key - link: /enterprise/security/single-sign-on/ + link: /platform/security/authentication/single-sign-on/ - title: Domain management description: Add and verify your company's domains. icon: check-badge - link: /enterprise/security/domain-management/ + link: /platform/security/provisioning/domain-management/ - title: FAQs description: Explore frequently asked questions about companies. link: /faq/admin/company-faqs/ diff --git a/content/manuals/admin/company/company-faqs.md b/content/manuals/admin/company/company-faqs.md index 8ab054c97ce7..c6f4f78d1652 100644 --- a/content/manuals/admin/company/company-faqs.md +++ b/content/manuals/admin/company/company-faqs.md @@ -46,4 +46,4 @@ organization members and change single sign-on (SSO) and System for Cross-domain Identity Management (SCIM) settings. Changes to company settings impact all users in each organization under the company. -For more information, see [Roles and permissions](/manuals/enterprise/security/roles-and-permissions.md). +For more information, see [Roles and permissions](/manuals/platform/security/roles-and-permissions.md). diff --git a/content/manuals/admin/insights.md b/content/manuals/admin/insights.md index 1b498cc8bbbc..b48507ad37ca 100644 --- a/content/manuals/admin/insights.md +++ b/content/manuals/admin/insights.md @@ -28,7 +28,7 @@ Key benefits include: To use Insights, you must meet the following requirements: - [Docker Business subscription](https://www.docker.com/pricing?ref=Docs&refAction=DocsAdminInsights) -- Administrators must [enforce sign-in](/manuals/enterprise/security/enforce-sign-in/_index.md) +- Administrators must [enforce sign-in](/manuals/platform/security/authentication/enforce-sign-in/_index.md) for users - Your Account Executive must turn on Insights for your organization @@ -59,7 +59,7 @@ The chart contains the following data: | Data | Description | | :--------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Active user | The number of users who have actively used Docker Desktop and either signed in with a Docker account that has a license in your organization or signed in to a Docker account with an email address from a domain associated with your organization.

Users who don’t sign in to an account associated with your organization are not represented in the data. To ensure users sign in with an account associated with your organization, you can [enforce sign-in](/manuals/enterprise/security/enforce-sign-in/_index.md). | +| Active user | The number of users who have actively used Docker Desktop and either signed in with a Docker account that has a license in your organization or signed in to a Docker account with an email address from a domain associated with your organization.

Users who don’t sign in to an account associated with your organization are not represented in the data. To ensure users sign in with an account associated with your organization, you can [enforce sign-in](/manuals/platform/security/authentication/enforce-sign-in/_index.md). | | Total organization members | The number of users who have used Docker Desktop, regardless of their Insights activity. | | Users opted out of analytics | The number of users who are members of your organization that have opted out of sending analytics.

When users opt out of sending analytics, you won't see any of their data in Insights. To ensure that the data includes all users, you can use [Settings Management](/manuals/enterprise/security/hardened-desktop/settings-management/_index.md) to set `analyticsEnabled` for all your users. | | Active users (graph) | The view over time for total active users. | @@ -163,7 +163,7 @@ A Docker Desktop user export file contains the following data points: - Username: User's Docker ID - Email: User's email address associated with their Docker ID - Type: User type -- Role: User [role](/manuals/enterprise/security/roles-and-permissions.md) +- Role: User [role](/manuals/platform/security/roles-and-permissions.md) - Teams: Team(s) within your organization the user is a member of - Date Joined: The date the user joined your organization @@ -207,4 +207,4 @@ solutions to resolve common problems: Users who don’t sign in to an account associated with your organization are not represented in the data. To ensure users sign in with an account associated with your organization, you can [enforce - sign-in](/manuals/enterprise/security/enforce-sign-in/_index.md). + sign-in](/manuals/platform/security/authentication/enforce-sign-in/_index.md). diff --git a/content/manuals/admin/organization/_index.md b/content/manuals/admin/organization/_index.md index 438bf56e5a69..91084750c4dd 100644 --- a/content/manuals/admin/organization/_index.md +++ b/content/manuals/admin/organization/_index.md @@ -67,7 +67,7 @@ permissions. For details about each role and its permissions, see [Roles and -permissions](/manuals/enterprise/security/roles-and-permissions/_index.md). +permissions](/manuals/platform/security/roles-and-permissions/_index.md). ## Next steps diff --git a/content/manuals/admin/organization/deactivate-account.md b/content/manuals/admin/organization/deactivate-account.md index cd4b8cfaa8f5..a1bd7972d207 100644 --- a/content/manuals/admin/organization/deactivate-account.md +++ b/content/manuals/admin/organization/deactivate-account.md @@ -37,7 +37,7 @@ organization: - Unlink your [GitHub and Bitbucket accounts](/manuals/docker-hub/repos/manage/builds/link-source.md#unlink-a-github-user-account). - For Business organizations, [remove your SSO - connection](/manuals/enterprise/security/single-sign-on/manage.md#delete-a-connection). + connection](/manuals/platform/security/authentication/single-sign-on/manage.md#delete-a-connection). ## Deactivate diff --git a/content/manuals/admin/organization/manage/_index.md b/content/manuals/admin/organization/manage/_index.md index 5ccfc50fa17c..531bc47d0250 100644 --- a/content/manuals/admin/organization/manage/_index.md +++ b/content/manuals/admin/organization/manage/_index.md @@ -31,7 +31,7 @@ revoke licenses and seats, and change access to Docker products. You manage your organization from [Docker Home](https://app.docker.com) and must be assigned the -[organization owner role](/manuals/enterprise/security/roles-and-permissions/_index.md). +[organization owner role](/manuals/platform/security/roles-and-permissions/_index.md). ## Seats and licenses diff --git a/content/manuals/admin/organization/manage/manage-a-team.md b/content/manuals/admin/organization/manage/manage-a-team.md index 31fd9b53bfc7..58b7acf48b20 100644 --- a/content/manuals/admin/organization/manage/manage-a-team.md +++ b/content/manuals/admin/organization/manage/manage-a-team.md @@ -34,7 +34,7 @@ An organization owner is an administrator who has the following permissions: organization settings - Specify [permissions](#permissions-reference) for each team in the organization -- Enable [SSO](/manuals/enterprise/security/single-sign-on/_index.md) for the +- Enable [SSO](/manuals/platform/security/authentication/single-sign-on/_index.md) for the organization When SSO is enabled for your organization, the organization owner can @@ -46,7 +46,7 @@ Organization owners can add others with the owner role to help them manage users, teams, and repositories in the organization. For more information on roles, see -[Roles and permissions](/manuals/enterprise/security/roles-and-permissions.md). +[Roles and permissions](/manuals/platform/security/roles-and-permissions.md). ## Create a team diff --git a/content/manuals/admin/organization/manage/manage-licenses.md b/content/manuals/admin/organization/manage/manage-licenses.md index 4a1d142dc728..56ccc7bd0638 100644 --- a/content/manuals/admin/organization/manage/manage-licenses.md +++ b/content/manuals/admin/organization/manage/manage-licenses.md @@ -50,7 +50,7 @@ a member: 1. Select **Emails or usernames**. 1. Enter the email addresses or Docker IDs of the people you want to invite, then assign their - [role](/manuals/enterprise/security/roles-and-permissions/_index.md). + [role](/manuals/platform/security/roles-and-permissions/_index.md). 1. Under **Licenses (optional)**, select one or more licenses that are available to your organization. 1. Select **Invite** to send the invite. @@ -88,8 +88,8 @@ set up auto-assignment for Docker Core as well. AI Governance licenses include single sign-on (SSO) and provisioning features regardless of your Docker Core subscription. Automatic license assignment requires -[setting up SSO](/manuals/enterprise/security/single-sign-on/connect.md), then -[provisioning](/manuals/enterprise/security/provisioning/_index.md) with System +[setting up SSO](/manuals/platform/security/authentication/single-sign-on/connect.md), then +[provisioning](/manuals/platform/security/provisioning/_index.md) with System for Cross-domain Identity Management (SCIM) or Just-in-Time (JIT). ## Manage licenses diff --git a/content/manuals/admin/organization/manage/manage-products.md b/content/manuals/admin/organization/manage/manage-products.md index dd6afd68cb5f..e9530e50c14b 100644 --- a/content/manuals/admin/organization/manage/manage-products.md +++ b/content/manuals/admin/organization/manage/manage-products.md @@ -25,9 +25,9 @@ use the following procedures to control access for all members. To manage Docker Desktop access: -1. [Enforce sign-in](../../../enterprise/security/enforce-sign-in/_index.md). +1. [Enforce sign-in](../../../platform/security/authentication/enforce-sign-in/_index.md). 1. Manage members [manually](./members.md) or use - [provisioning](../../../enterprise/security/provisioning/_index.md). + [provisioning](../../../platform/security/provisioning/_index.md). With sign-in enforced, only users who are a member of your organization can use Docker Desktop after signing in. diff --git a/content/manuals/admin/organization/manage/members.md b/content/manuals/admin/organization/manage/members.md index f8fe6cf014e2..75656ddc5913 100644 --- a/content/manuals/admin/organization/manage/members.md +++ b/content/manuals/admin/organization/manage/members.md @@ -40,7 +40,7 @@ or email address. 1000 members and separate multiple entries by comma, semicolon, or space. When you invite members, you assign them a role. See -[Roles and permissions](/manuals/enterprise/security/roles-and-permissions/_index.md) +[Roles and permissions](/manuals/platform/security/roles-and-permissions/_index.md) for details about the access permissions for each role. Pending invitations appear in the table. Invitees can accept or decline the @@ -196,7 +196,7 @@ being added to the team. ### Remove members from teams If your organization uses single sign-on (SSO) with -[SCIM](/manuals/enterprise/security/provisioning/scim/_index.md) enabled, you +[SCIM](/manuals/platform/security/provisioning/scim/_index.md) enabled, you should remove members from your identity provider (IdP). This automatically removes members from Docker. If SCIM is disabled, follow procedures in this doc to remove members manually in Docker. @@ -215,10 +215,10 @@ from a specific team: ### Update a member role Organization owners can manage -[roles](/manuals/enterprise/security/roles-and-permissions/_index.md) within +[roles](/manuals/platform/security/roles-and-permissions/_index.md) within an organization. If an organization is part of a company, the company owner can also manage that organization's roles. If you have SSO enabled, you can -use [SCIM for role mapping](/manuals/enterprise/security/provisioning/scim/_index.md). +use [SCIM for role mapping](/manuals/platform/security/provisioning/scim/_index.md). To update a member role: diff --git a/content/manuals/admin/organization/organization-faqs.md b/content/manuals/admin/organization/organization-faqs.md index e013e5539d7e..a76fc447ca89 100644 --- a/content/manuals/admin/organization/organization-faqs.md +++ b/content/manuals/admin/organization/organization-faqs.md @@ -28,7 +28,7 @@ assign them to a team during the invite process. ### Can I force my organization's members to authenticate before using Docker Desktop and are there any benefits? Yes. You can -[enforce sign-in](/manuals/enterprise/security/enforce-sign-in/_index.md). +[enforce sign-in](/manuals/platform/security/authentication/enforce-sign-in/_index.md). Some benefits of enforcing sign-in are: diff --git a/content/manuals/admin/organization/setup/_index.md b/content/manuals/admin/organization/setup/_index.md index eb36ef60da67..94d2d27f327c 100644 --- a/content/manuals/admin/organization/setup/_index.md +++ b/content/manuals/admin/organization/setup/_index.md @@ -39,7 +39,7 @@ an existing user account into an organization. You set up your organization from [Docker Home](https://app.docker.com) and must be assigned the -[organization owner role](/manuals/enterprise/security/roles-and-permissions/_index.md). +[organization owner role](/manuals/platform/security/roles-and-permissions/_index.md). Setting up an organization happens in broad phases: 1. You can create a new organization, or convert an existing user account diff --git a/content/manuals/admin/organization/setup/convert-account.md b/content/manuals/admin/organization/setup/convert-account.md index 7c5b856d5bfc..db3ebf6765e7 100644 --- a/content/manuals/admin/organization/setup/convert-account.md +++ b/content/manuals/admin/organization/setup/convert-account.md @@ -16,7 +16,7 @@ useful if you need multiple users to access your account and the repositories it’s connected to. Converting it to an organization gives you better control over permissions for these users through [teams](/manuals/admin/organization/manage/manage-a-team.md) and -[roles](/manuals/enterprise/security/roles-and-permissions.md). +[roles](/manuals/platform/security/roles-and-permissions.md). When you convert a user account to an organization, the account is migrated to a Docker Team subscription by default. diff --git a/content/manuals/admin/organization/setup/general-settings.md b/content/manuals/admin/organization/setup/general-settings.md index 3c7d4c9b2e04..95b95b139e72 100644 --- a/content/manuals/admin/organization/setup/general-settings.md +++ b/content/manuals/admin/organization/setup/general-settings.md @@ -33,7 +33,7 @@ To edit this information: After configuring your organization information, you can: -- [Configure single sign-on (SSO)](/manuals/enterprise/security/single-sign-on/connect.md) -- [Set up SCIM provisioning](/manuals/enterprise/security/provisioning/scim/_index.md) -- [Manage domains](/manuals/enterprise/security/domain-management.md) +- [Configure single sign-on (SSO)](/manuals/platform/security/authentication/single-sign-on/connect.md) +- [Set up SCIM provisioning](/manuals/platform/security/provisioning/scim/_index.md) +- [Manage domains](/manuals/platform/security/provisioning/domain-management.md) - [Create a company](/manuals/admin/company/new-company.md) diff --git a/content/manuals/admin/organization/setup/onboard.md b/content/manuals/admin/organization/setup/onboard.md index e71216f1bff7..88b609b77bff 100644 --- a/content/manuals/admin/organization/setup/onboard.md +++ b/content/manuals/admin/organization/setup/onboard.md @@ -105,7 +105,7 @@ add additional owners. To add an owner, invite a user and assign them the owner role. For more details, see [Invite members](/manuals/admin/organization/manage/members.md) and -[Roles and permissions](/manuals/enterprise/security/roles-and-permissions.md). +[Roles and permissions](/manuals/platform/security/roles-and-permissions.md). ### Step three: Invite members @@ -116,7 +116,7 @@ they are signed in. To add a member, invite a user and assign them the member role. For more details, see [Invite members](/manuals/admin/organization/manage/members.md) and -[Roles and permissions](/manuals/enterprise/security/roles-and-permissions.md). +[Roles and permissions](/manuals/platform/security/roles-and-permissions.md). ### Step four: Manage user access with SSO and SCIM @@ -127,20 +127,20 @@ subscription, see [Upgrade a plan](/manuals/subscription/manage.md#upgrade-plans Use your identity provider (IdP) to manage members and provision them to Docker automatically via SSO and SCIM. See the following for more details: -- [Configure SSO](/manuals/enterprise/security/single-sign-on/connect.md) +- [Configure SSO](/manuals/platform/security/authentication/single-sign-on/connect.md) to authenticate and add members when they sign in to Docker through your identity provider. - Optional. - [Enforce SSO](/manuals/enterprise/security/single-sign-on/connect.md) to + [Enforce SSO](/manuals/platform/security/authentication/single-sign-on/connect.md) to ensure that when users sign in to Docker, they must use SSO. > [!NOTE] > > Enforcing single sign-on (SSO) and enforcing Docker Desktop sign in > are different features. For more details, see - > [Enforcing sign-in versus enforcing single sign-on (SSO)](/manuals/enterprise/security/enforce-sign-in/_index.md#enforcing-sign-in-versus-enforcing-single-sign-on-sso). + > [Enforcing sign-in versus enforcing single sign-on (SSO)](/manuals/platform/security/authentication/enforce-sign-in/_index.md#enforcing-sign-in-versus-enforcing-single-sign-on-sso). -- [Configure SCIM](/manuals/enterprise/security/provisioning/scim/_index.md) to +- [Configure SCIM](/manuals/platform/security/provisioning/scim/_index.md) to automatically provision, add, and de-provision members to Docker through your identity provider. @@ -155,9 +155,9 @@ and they can circumvent [Docker’s security features](/manuals/enterprise/secur There are multiple ways you can enforce sign-in, depending on your organization's Docker configuration: -- [Registry key method (Windows only)](/manuals/enterprise/security/enforce-sign-in/methods.md#registry-key-method-windows-only) -- [`.plist` method (Mac only)](/manuals/enterprise/security/enforce-sign-in/methods.md#plist-method-mac-only) -- [`registry.json` method (All)](/manuals/enterprise/security/enforce-sign-in/methods.md#registryjson-method-all) +- [Registry key method (Windows only)](/manuals/platform/security/authentication/enforce-sign-in/methods.md#registry-key-method-windows-only) +- [`.plist` method (Mac only)](/manuals/platform/security/authentication/enforce-sign-in/methods.md#plist-method-mac-only) +- [`registry.json` method (All)](/manuals/platform/security/authentication/enforce-sign-in/methods.md#registryjson-method-all) ### Step six: Manage Docker Desktop security @@ -172,7 +172,7 @@ security posture: - [Manage Docker products](../manage/manage-products.md) to configure access and view usage. - Configure [Hardened Docker Desktop](/manuals/enterprise/security/hardened-desktop/_index.md) to improve your organization’s security posture for containerized development. -- [Manage your domains](/manuals/enterprise/security/domain-management.md) to ensure that all Docker users in your domain are part of your organization. +- [Manage your domains](/manuals/platform/security/provisioning/domain-management.md) to ensure that all Docker users in your domain are part of your organization. Your Docker subscription provides many more additional features. To learn more, see [Docker subscriptions and features](https://www.docker.com/pricing?ref=Docs&refAction=DocsAdminOnboard). diff --git a/content/manuals/ai/sandboxes/governance/access-controls/organization.md b/content/manuals/ai/sandboxes/governance/access-controls/organization.md index 18d8eeb14cef..1b439823a29e 100644 --- a/content/manuals/ai/sandboxes/governance/access-controls/organization.md +++ b/content/manuals/ai/sandboxes/governance/access-controls/organization.md @@ -23,10 +23,10 @@ programmatic management of network and filesystem policies, use the [Governance API](/reference/api/ai-governance/). By default, only organization -[owners](/manuals/enterprise/security/roles-and-permissions/core-roles.md) can +[owners](/manuals/platform/security/roles-and-permissions/core-roles.md) can view and manage AI Governance policies. To let someone other than an owner manage policies, create a -[custom role](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md) +[custom role](/manuals/platform/security/roles-and-permissions/custom-roles/_index.md) with the **Governance** permissions and assign it to a user or team. > [!NOTE] @@ -114,7 +114,7 @@ in one of two ways: - Manually, in Docker Home. - Automatically, by using - [group mapping](/manuals/enterprise/security/provisioning/scim/group-mapping.md) + [group mapping](/manuals/platform/security/provisioning/scim/group-mapping.md) to synchronize your identity provider's groups with the teams in your organization. Group mapping creates teams that don't already exist and keeps their membership in step with your IdP groups. diff --git a/content/manuals/ai/sandboxes/governance/audit/_index.md b/content/manuals/ai/sandboxes/governance/audit/_index.md index 35ac8c59b7da..3dfca85862c2 100644 --- a/content/manuals/ai/sandboxes/governance/audit/_index.md +++ b/content/manuals/ai/sandboxes/governance/audit/_index.md @@ -32,7 +32,7 @@ To use AI Governance Audit Logs, your organization needs: - A Docker [AI Governance plan](/manuals/subscription/plans/ai-governance.md) - An enforced organization governance policy - A Docker organization account -- An organization owner, or a user with a [custom role](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md) that includes AI Governance audit permissions, to configure delivery and view hosted events +- An organization owner, or a user with a [custom role](/manuals/platform/security/roles-and-permissions/custom-roles/_index.md) that includes AI Governance audit permissions, to configure delivery and view hosted events > [!NOTE] > Other Docker subscriptions are not sufficient on their own to use AI Governance @@ -58,7 +58,7 @@ Docker supports two delivery modes for audit records: app.docker.com. Cloud delivery is on by default when AI Governance is enabled. Organization owners can disable it in [audit delivery settings](configure.md). -Organization owners and users with a [custom role](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md) that includes AI Governance audit permissions can configure local disk, Docker Cloud, or both. +Organization owners and users with a [custom role](/manuals/platform/security/roles-and-permissions/custom-roles/_index.md) that includes AI Governance audit permissions can configure local disk, Docker Cloud, or both. The hosted audit log view, CSV export, and SIEM forwarding all require Docker Cloud delivery to be enabled. Local delivery alone does not power these features. diff --git a/content/manuals/ai/sandboxes/governance/audit/configure.md b/content/manuals/ai/sandboxes/governance/audit/configure.md index 38342b898f44..314c449479f0 100644 --- a/content/manuals/ai/sandboxes/governance/audit/configure.md +++ b/content/manuals/ai/sandboxes/governance/audit/configure.md @@ -6,7 +6,7 @@ description: Configure local and cloud delivery, retention, and history for Dock keywords: docker sandboxes, audit delivery, AI Governance, audit logs, retention, cloud delivery, AI Platform --- -Organization owners and users with a [custom role](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md) that includes AI Governance audit permissions can configure where Docker writes audit events. +Organization owners and users with a [custom role](/manuals/platform/security/roles-and-permissions/custom-roles/_index.md) that includes AI Governance audit permissions can configure where Docker writes audit events. Two delivery destinations are available and can be used independently or together: @@ -21,7 +21,7 @@ Your organization needs: - A Docker [AI Governance plan](/manuals/subscription/plans/ai-governance.md) - An enforced organization governance policy -- Organization owner access, or a [custom role](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md) with AI Governance audit permissions +- Organization owner access, or a [custom role](/manuals/platform/security/roles-and-permissions/custom-roles/_index.md) with AI Governance audit permissions Only users who have an AI Governance license and are governed by the enforced organization policy send Docker Sandboxes audit data. diff --git a/content/manuals/ai/sandboxes/governance/monitor-and-enforce/sign-in-enforcement.md b/content/manuals/ai/sandboxes/governance/monitor-and-enforce/sign-in-enforcement.md index ba30413d3453..6794c045a14f 100644 --- a/content/manuals/ai/sandboxes/governance/monitor-and-enforce/sign-in-enforcement.md +++ b/content/manuals/ai/sandboxes/governance/monitor-and-enforce/sign-in-enforcement.md @@ -269,5 +269,5 @@ For access, contact ACME IT Security: Console - [Governance overview](../_index.md): how local and organization governance fit together -- [Enforce sign-in for Docker Desktop](/manuals/enterprise/security/enforce-sign-in/_index.md): +- [Enforce sign-in for Docker Desktop](/manuals/platform/security/authentication/enforce-sign-in/_index.md): the equivalent control for Docker Desktop diff --git a/content/manuals/build-cloud/_index.md b/content/manuals/build-cloud/_index.md index 80458665e99d..4b04be3a920e 100644 --- a/content/manuals/build-cloud/_index.md +++ b/content/manuals/build-cloud/_index.md @@ -64,4 +64,4 @@ Once you've signed up and created a builder, continue by [setting up the builder in your local environment](./setup.md). For information about roles and permissions related to Docker Build Cloud, see -[Roles and Permissions](/manuals/enterprise/security/roles-and-permissions/core-roles.md#docker-build-cloud). +[Roles and Permissions](/manuals/platform/security/roles-and-permissions/core-roles.md#docker-build-cloud). diff --git a/content/manuals/build-cloud/ci.md b/content/manuals/build-cloud/ci.md index 110853ecd513..d01d115d6af9 100644 --- a/content/manuals/build-cloud/ci.md +++ b/content/manuals/build-cloud/ci.md @@ -37,8 +37,8 @@ See [Loading build results](./usage/#loading-build-results) for details. To enable your CI/CD system to build and push images using Docker Build Cloud, provide both an access token and a username. The type of token and the username you use depend on your account type and permissions. -- If you are an organization administrator or have permission to create [organization access tokens (OAT)](/manuals/enterprise/security/access-tokens.md), use an OAT and set `DOCKER_ACCOUNT` to your Docker Hub organization name. -- If you do not have permission to create OATs or are using a personal account, use a [personal access token (PAT)](/security/access-tokens/) and set `DOCKER_ACCOUNT` to your Docker Hub username. +- If you are an organization administrator or have permission to create [organization access tokens (OAT)](/manuals/platform/security/access-tokens/organization-access-tokens.md), use an OAT and set `DOCKER_ACCOUNT` to your Docker Hub organization name. +- If you do not have permission to create OATs or are using a personal account, use a [personal access token (PAT)](/platform/security/access-tokens/personal-access-tokens/) and set `DOCKER_ACCOUNT` to your Docker Hub username. ### Creating access tokens @@ -46,7 +46,7 @@ To enable your CI/CD system to build and push images using Docker Build Cloud, p If you are an organization administrator: -- Create an [organization access token (OAT)](/manuals/enterprise/security/access-tokens.md). The token must have these permissions: +- Create an [organization access token (OAT)](/manuals/platform/security/access-tokens/organization-access-tokens.md). The token must have these permissions: 1. **cloud-connect** scope 2. **Read public repositories** permission 3. **Repository access** with **Image push** permission for the target repository: @@ -60,7 +60,7 @@ If you are not an organization administrator: #### For personal accounts -- Create a [personal access token (PAT)](/security/access-tokens/) with the following permissions: +- Create a [personal access token (PAT)](/platform/security/access-tokens/personal-access-tokens/) with the following permissions: 1. **Read & write** access. - Note: Building with Docker Build Cloud only requires read access, but you need write access to push images to a Docker Hub repository. diff --git a/content/manuals/desktop/release-notes.md b/content/manuals/desktop/release-notes.md index 7260ad82eb1b..f6ed578bfe3a 100644 --- a/content/manuals/desktop/release-notes.md +++ b/content/manuals/desktop/release-notes.md @@ -1572,7 +1572,7 @@ For more frequently asked questions, see the [FAQs](/manuals/desktop/troubleshoo ### New - You can now specify PAC files and Embedded PAC scripts with installer flags for [macOS](/manuals/desktop/setup/install/mac-install.md#proxy-configuration) and [Windows](/manuals/desktop/setup/install/windows-install.md#proxy-configuration). -- Administrators can set proxy settings via [macOS configuration profiles](/manuals/enterprise/security/enforce-sign-in/methods.md#macos-configuration-profiles-method-recommended). +- Administrators can set proxy settings via [macOS configuration profiles](/manuals/platform/security/authentication/enforce-sign-in/methods.md#macos-configuration-profiles-method-recommended). ### Upgrades @@ -1951,7 +1951,7 @@ We are aware of [CVE-2025-23266](https://nvd.nist.gov/vuln/detail/CVE-2025-23266 - Improved the sign-in enforcement message when more than 10 organizations are enforced. - Changed the way ports are mapped by Docker Desktop to fully support IPv6 ports. - Fixed a bug in the Dashboard container logs screen causing the scrollbar to disappear as the mouse approaches. -- [Enforced sign-in](/manuals/enterprise/security/enforce-sign-in/_index.md) fixed for Teams subscription users. +- [Enforced sign-in](/manuals/platform/security/authentication/enforce-sign-in/_index.md) fixed for Teams subscription users. - `llama.cpp` server now supports streaming and tool calling in Model Runner. - Sign-in Enforcement capability is now available to all subscriptions. @@ -2352,7 +2352,7 @@ We are aware of [CVE-2025-23266](https://nvd.nist.gov/vuln/detail/CVE-2025-23266 - Existing Docker Desktop installations using the WSL2 engine on Windows are now automatically migrated to a unified single-distribution architecture for enhanced consistency and performance. - Administrators can now: - - Enforce sign-in with macOS [configuration profiles](/manuals/enterprise/security/enforce-sign-in/methods.md#configuration-profiles-method-mac-only) (Early Access). + - Enforce sign-in with macOS [configuration profiles](/manuals/platform/security/authentication/enforce-sign-in/methods.md#configuration-profiles-method-mac-only) (Early Access). - Enforce sign-in for more than one organization at a time (Early Access). - Deploy Docker Desktop for Mac in bulk with the [PKG installer](/manuals/enterprise/enterprise-deployment/pkg-install-and-configure.md) (Early Access). - Use Desktop Settings Management to manage and enforce defaults via admin.docker.com (Early Access). @@ -2470,7 +2470,7 @@ We are aware of [CVE-2025-23266](https://nvd.nist.gov/vuln/detail/CVE-2025-23266 - Image tags added to **Build results** section under the **Info** tab. - Improved efficiency of host-side disk utilization for fresh installations on Mac and Linux. - Fixed a bug that prevented the Sign in enforcement popup to be triggered when token expires. -- Fixed a bug where containers would not be displayed in the GUI immediately after signing in when using [enforced sign-in](/manuals/enterprise/security/enforce-sign-in/_index.md). +- Fixed a bug where containers would not be displayed in the GUI immediately after signing in when using [enforced sign-in](/manuals/platform/security/authentication/enforce-sign-in/_index.md). - `settings.json` has been renamed to `settings-store.json` - The host networking feature no longer requires users to be signed-in in order to use it. @@ -2572,7 +2572,7 @@ We are aware of [CVE-2025-23266](https://nvd.nist.gov/vuln/detail/CVE-2025-23266 - If you authenticate via the CLI, you can now authenticate through a browser-based flow, removing the need for manual PAT generation. - Windows now supports automatic reclamation of disk space in Docker Desktop for WSL2 installations [using a managed virtual hard disk](/manuals/desktop/features/wsl/best-practices.md). - Deploying Docker Desktop via the [MSI installer](/manuals/enterprise/enterprise-deployment/msi-install-and-configure.md) is now generally available. -- Two new methods to [enforce sign-in](/manuals/enterprise/security/enforce-sign-in/_index.md) (windows registry key and `.plist` file) are now generally available. +- Two new methods to [enforce sign-in](/manuals/platform/security/authentication/enforce-sign-in/_index.md) (windows registry key and `.plist` file) are now generally available. - Fresh installations of Docker Desktop now use the containerd image store by default. - [Compose Bridge](/manuals/compose/bridge/_index.md) (Experimental) is now available from the Compose file viewer. Easily convert and deploy your Compose project to a Kubernetes cluster. @@ -4983,7 +4983,7 @@ Installing Docker Desktop 4.5.0 from scratch has a bug which defaults Docker Des ### New - Easy, Secure sign in with Auth0 and Single Sign-on - - Single Sign-on: Users with a Docker Business subscription can now configure SSO to authenticate using their identity providers (IdPs) to access Docker. For more information, see [Single Sign-on](/manuals/enterprise/security/single-sign-on/_index.md). + - Single Sign-on: Users with a Docker Business subscription can now configure SSO to authenticate using their identity providers (IdPs) to access Docker. For more information, see [Single Sign-on](/manuals/platform/security/authentication/single-sign-on/_index.md). - Signing in to Docker Desktop now takes you through the browser so that you get all the benefits of auto-filling from password managers. ### Upgrades @@ -4995,7 +4995,7 @@ Installing Docker Desktop 4.5.0 from scratch has a bug which defaults Docker Des ### Security -- Fixed [CVE-2021-45449](../security/_index.md#cve-2021-45449) that affects users currently on Docker Desktop version 4.3.0 or 4.3.1. +- Fixed [CVE-2021-45449](../platform/security/security-announcements.md#cve-2021-45449) that affects users currently on Docker Desktop version 4.3.0 or 4.3.1. Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information (access token or password) on the user's machine during login. This only affects users if they are on Docker Desktop 4.3.0, 4.3.1 and the user has logged in while on 4.3.0, 4.3.1. Gaining access to this data would require having access to the user’s local files. @@ -5035,7 +5035,7 @@ This only affects users if they are on Docker Desktop 4.3.0, 4.3.1 and the user ### Security -- Fixed [CVE-2021-45449](../security/_index.md#cve-2021-45449) that affects users currently on Docker Desktop version 4.3.0 or 4.3.1. +- Fixed [CVE-2021-45449](../platform/security/security-announcements.md#cve-2021-45449) that affects users currently on Docker Desktop version 4.3.0 or 4.3.1. Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information (access token or password) on the user's machine during login. This only affects users if they are on Docker Desktop 4.3.0, 4.3.1 and the user has logged in while on 4.3.0, 4.3.1. Gaining access to this data would require having access to the user’s local files. diff --git a/content/manuals/desktop/setup/install/mac-install.md b/content/manuals/desktop/setup/install/mac-install.md index 3c065841aa15..9d0485847979 100644 --- a/content/manuals/desktop/setup/install/mac-install.md +++ b/content/manuals/desktop/setup/install/mac-install.md @@ -154,7 +154,7 @@ $ sudo /Applications/Docker.app/Contents/MacOS/install --user testuser --proxy-h > [!TIP] > -> As an IT administrator, you can use endpoint management (MDM) software to identify the number of Docker Desktop instances and their versions within your environment. This can provide accurate license reporting, help ensure your machines use the latest version of Docker Desktop, and enable you to [enforce sign-in](/manuals/enterprise/security/enforce-sign-in/_index.md). +> As an IT administrator, you can use endpoint management (MDM) software to identify the number of Docker Desktop instances and their versions within your environment. This can provide accurate license reporting, help ensure your machines use the latest version of Docker Desktop, and enable you to [enforce sign-in](/manuals/platform/security/authentication/enforce-sign-in/_index.md). > - [Intune](https://learn.microsoft.com/en-us/mem/intune/apps/app-discovered-apps) > - [Jamf](https://docs.jamf.com/10.25.0/jamf-pro/administrator-guide/Application_Usage.html) > - [Kandji](https://support.kandji.io/support/solutions/articles/72000559793-view-a-device-application-list) diff --git a/content/manuals/desktop/setup/install/windows-install.md b/content/manuals/desktop/setup/install/windows-install.md index af06573c64ba..8a86c24c5160 100644 --- a/content/manuals/desktop/setup/install/windows-install.md +++ b/content/manuals/desktop/setup/install/windows-install.md @@ -232,7 +232,7 @@ Docker Desktop does not start automatically after installation. To start Docker > [!TIP] > -> As an IT administrator, you can use endpoint management (MDM) software to identify the number of Docker Desktop instances and their versions within your environment. This can provide accurate license reporting, help ensure your machines use the latest version of Docker Desktop, and enable you to [enforce sign-in](/manuals/enterprise/security/enforce-sign-in/_index.md). +> As an IT administrator, you can use endpoint management (MDM) software to identify the number of Docker Desktop instances and their versions within your environment. This can provide accurate license reporting, help ensure your machines use the latest version of Docker Desktop, and enable you to [enforce sign-in](/manuals/platform/security/authentication/enforce-sign-in/_index.md). > - [Intune](https://learn.microsoft.com/en-us/mem/intune/apps/app-discovered-apps) > - [Jamf](https://docs.jamf.com/10.25.0/jamf-pro/administrator-guide/Application_Usage.html) > - [Kandji](https://support.kandji.io/support/solutions/articles/72000559793-view-a-device-application-list) diff --git a/content/manuals/desktop/setup/sign-in.md b/content/manuals/desktop/setup/sign-in.md index 01b04cab60d5..d09e6346b64d 100644 --- a/content/manuals/desktop/setup/sign-in.md +++ b/content/manuals/desktop/setup/sign-in.md @@ -17,7 +17,7 @@ aliases: Docker recommends signing in with the **Sign in** option in the top-right corner of the Docker Dashboard. -In large enterprises where admin access is restricted, administrators can [enforce sign-in](/manuals/enterprise/security/enforce-sign-in/_index.md). +In large enterprises where admin access is restricted, administrators can [enforce sign-in](/manuals/platform/security/authentication/enforce-sign-in/_index.md). > [!TIP] > diff --git a/content/manuals/dhi/how-to/customize.md b/content/manuals/dhi/how-to/customize.md index fbb17a2d4f89..e4129e9cac29 100644 --- a/content/manuals/dhi/how-to/customize.md +++ b/content/manuals/dhi/how-to/customize.md @@ -161,9 +161,9 @@ You can create customizations using either the DHI CLI or the Docker Hub web int {{< tab name="CLI" >}} Authenticate with `docker login` using your Docker credentials or a [personal -access token (PAT)](../../security/access-tokens.md) with **Read & Write** +access token (PAT)](../../platform/security/access-tokens/personal-access-tokens.md) with **Read & Write** permissions, or an [organization access token -(OAT)](../../enterprise/security/access-tokens.md). When using an OAT, the +(OAT)](../../platform/security/access-tokens/organization-access-tokens.md). When using an OAT, the available operations depend on the token's permission scope: - To list or get customizations, or to view build logs, the OAT must have read diff --git a/content/manuals/dhi/how-to/helm.md b/content/manuals/dhi/how-to/helm.md index 0afdf0d80249..4f73db28ca86 100644 --- a/content/manuals/dhi/how-to/helm.md +++ b/content/manuals/dhi/how-to/helm.md @@ -53,8 +53,8 @@ registry, you still need to create this secret if the registry requires authentication. 1. For `dhi.io` or Docker Hub, create a [personal access token - (PAT)](/security/access-tokens/) using your Docker account or an - [organization access token (OAT)](/enterprise/security/access-tokens/). + (PAT)](/platform/security/access-tokens/personal-access-tokens/) using your Docker account or an + [organization access token (OAT)](/enterprise/platform/security/access-tokens/personal-access-tokens/). Ensure the token has at least read-only access to the Docker Hardened Image repositories. 2. Create a secret in Kubernetes using the following command. Replace ``, ``, diff --git a/content/manuals/dhi/how-to/mirror.md b/content/manuals/dhi/how-to/mirror.md index b942a01862a5..3c89c3b7e375 100644 --- a/content/manuals/dhi/how-to/mirror.md +++ b/content/manuals/dhi/how-to/mirror.md @@ -34,10 +34,10 @@ repositories: ## Mirror a DHI repository to your organization -Organization owners, editors, and members with a [custom role](../../enterprise/security/roles-and-permissions/custom-roles/_index.md) +Organization owners, editors, and members with a [custom role](../../platform/security/roles-and-permissions/custom-roles/_index.md) that includes the DHI mirroring permission can create, view, and manage mirrors. When using the CLI or Terraform, you can also mirror using an [organization -access token (OAT)](../../enterprise/security/access-tokens.md) with the +access token (OAT)](../../platform/security/access-tokens/organization-access-tokens.md) with the appropriate permission scopes, without requiring role-based access. When a member with a custom role that includes the DHI mirroring permission @@ -83,9 +83,9 @@ It may take a few minutes for all the tags to finish mirroring. {{< tab name="CLI" >}} Authenticate with `docker login` using your Docker credentials, a [personal -access token (PAT)](../../security/access-tokens.md) with **Read & Write** +access token (PAT)](../../platform/security/access-tokens/personal-access-tokens.md) with **Read & Write** permissions, or an [organization access token -(OAT)](../../enterprise/security/access-tokens.md). When using an OAT, the +(OAT)](../../platform/security/access-tokens/organization-access-tokens.md). When using an OAT, the available operations depend on the token's permission scope: - To list mirrored repositories, the OAT must have read (pull) access to the @@ -200,9 +200,9 @@ updates. You can still use the last images or charts that were mirrored. {{< tab name="CLI" >}} Authenticate with `docker login` using your Docker credentials, a [personal -access token (PAT)](../../security/access-tokens.md) with **Read & Write** +access token (PAT)](../../platform/security/access-tokens/personal-access-tokens.md) with **Read & Write** permissions, or an [organization access token -(OAT)](../../enterprise/security/access-tokens.md) with push access to the +(OAT)](../../platform/security/access-tokens/organization-access-tokens.md) with push access to the relevant repository. Use the [`docker dhi mirror`](/reference/cli/docker/dhi/mirror/) command: @@ -303,11 +303,11 @@ same steps to a non-mirrored image by updating the `SRC_ATT_REPO` and In this example, you authenticate as your Docker organization using an [organization access token - (OAT)](../../enterprise/security/access-tokens.md). The OAT must have at + (OAT)](../../platform/security/access-tokens/organization-access-tokens.md). The OAT must have at least pull access to every DHI repository you want to mirror. Only repositories in the token's scope are accessible. Alternatively, you can authenticate as a Docker Hub user with a [personal access token - (PAT)](../../security/access-tokens.md) that has `read only` access. + (PAT)](../../platform/security/access-tokens/personal-access-tokens.md) that has `read only` access. > [!WARNING] > diff --git a/content/manuals/dhi/how-to/policies.md b/content/manuals/dhi/how-to/policies.md index e909dfdfadc7..bbf0caff7059 100644 --- a/content/manuals/dhi/how-to/policies.md +++ b/content/manuals/dhi/how-to/policies.md @@ -215,7 +215,7 @@ jobs: The `docker/login-action` step authenticates with Docker Hub so the runner can pull the DHI base image and the `dhi/policies` bundle. Store your Docker Hub -username and a [personal access token](/manuals/security/access-tokens.md) as the +username and a [personal access token](/manuals/platform/security/access-tokens/personal-access-tokens.md) as the `DOCKER_USER` and `DOCKER_PAT` repository secrets. Set `exit-code: true` to fail the step when any policy isn't met. The diff --git a/content/manuals/dhi/how-to/use.md b/content/manuals/dhi/how-to/use.md index 73bf38594ea0..5df029daa0d6 100644 --- a/content/manuals/dhi/how-to/use.md +++ b/content/manuals/dhi/how-to/use.md @@ -26,9 +26,9 @@ package manager, and may run as a non-root user by default. > you don't have a Docker account, [create one](../../accounts/create-account.md) > for free. > - **Access token:** Use a [personal access token -> (PAT)](../../security/access-tokens.md) for personal accounts, or an +> (PAT)](../../platform/security/access-tokens/personal-access-tokens.md) for personal accounts, or an > [organization access token -> (OAT)](../../enterprise/security/access-tokens.md) with your organization +> (OAT)](../../platform/security/access-tokens/organization-access-tokens.md) with your organization > name as the username. > > Run `docker login dhi.io` to authenticate. @@ -109,14 +109,14 @@ attached to Docker Hardened Images. This is particularly useful in CI/CD pipelines for supply chain security validation and compliance checks. For automated workflows, authenticate using an [organization access token -(OAT)](../../enterprise/security/access-tokens.md). OATs are owned by the +(OAT)](../../platform/security/access-tokens/organization-access-tokens.md). OATs are owned by the organization rather than an individual user, making them better suited for CI/CD pipelines. To discover attestations with ORAS: 1. [Generate an organization access - token](../../enterprise/security/access-tokens.md) with **Read public + token](../../platform/security/access-tokens/organization-access-tokens.md) with **Read public repositories** scope. The following example shows how to discover attestations on DHI community @@ -268,8 +268,8 @@ For the `--docker-server` value: #### Using an access token Create a secret using a [Personal Access Token -(PAT)](../../security/access-tokens.md) or [Organization Access Token -(OAT)](../../enterprise/security/access-tokens.md). Ensure the token has at +(PAT)](../../platform/security/access-tokens/personal-access-tokens.md) or [Organization Access Token +(OAT)](../../platform/security/access-tokens/organization-access-tokens.md). Ensure the token has at least read-only access to the repositories. ```console diff --git a/content/manuals/dhi/how-to/verify.md b/content/manuals/dhi/how-to/verify.md index ab4602e0deb7..9021b47bc940 100644 --- a/content/manuals/dhi/how-to/verify.md +++ b/content/manuals/dhi/how-to/verify.md @@ -62,11 +62,11 @@ This command shows all available attestations, including SBOMs, provenance, vuln First, authenticate to both registries. This example authenticates as your Docker organization using an [organization access token -(OAT)](../../enterprise/security/access-tokens.md). The OAT must have at least +(OAT)](../../platform/security/access-tokens/organization-access-tokens.md). The OAT must have at least pull access to the DHI repositories you want to verify. Only repositories in the token's scope are accessible. Alternatively, you can authenticate as a Docker Hub user with a [personal access token -(PAT)](../../security/access-tokens.md) that has `read only` access. +(PAT)](../../platform/security/access-tokens/personal-access-tokens.md) that has `read only` access. > [!WARNING] > diff --git a/content/manuals/dhi/tools/api.md b/content/manuals/dhi/tools/api.md index be29c3ce9d6b..7062770f541f 100644 --- a/content/manuals/dhi/tools/api.md +++ b/content/manuals/dhi/tools/api.md @@ -40,7 +40,7 @@ Every query takes a `Context` argument (conventionally named `ctx` in the ## Authentication -An [organization access token](/manuals/enterprise/security/access-tokens.md) +An [organization access token](/manuals/platform/security/access-tokens/organization-access-tokens.md) (OAT) or personal access token (PAT) isn't used directly as the bearer token. Exchange it first for an access token: diff --git a/content/manuals/dhi/tools/mcp.md b/content/manuals/dhi/tools/mcp.md index bc71dae76de6..ebf014575c99 100644 --- a/content/manuals/dhi/tools/mcp.md +++ b/content/manuals/dhi/tools/mcp.md @@ -148,7 +148,7 @@ based on what you ask: ## Authenticate for mirror tools The mirror tools require a Docker Hub username and [personal access token -(PAT)](/security/access-tokens/) with owner access to the target organization, +(PAT)](/platform/security/access-tokens/personal-access-tokens/) with owner access to the target organization, passed as an HTTP Basic auth header. Generate the value with: ```console diff --git a/content/manuals/docker-hub/release-notes.md b/content/manuals/docker-hub/release-notes.md index 4b45b5eb3b74..700576df266f 100644 --- a/content/manuals/docker-hub/release-notes.md +++ b/content/manuals/docker-hub/release-notes.md @@ -110,7 +110,7 @@ known issues for each Docker Hub release. ### New -- Organizations can assign the [editor role](/manuals/enterprise/security/roles-and-permissions/_index.md) to members to grant additional permissions without full administrative access. +- Organizations can assign the [editor role](/manuals/platform/security/roles-and-permissions/_index.md) to members to grant additional permissions without full administrative access. ## 2023-05-09 @@ -140,7 +140,7 @@ known issues for each Docker Hub release. ### Bug fixes and enhancements -- In Docker Hub, you can now download a [registry.json](/manuals/enterprise/security/enforce-sign-in/_index.md) file or copy the commands to create a registry.json file to enforce sign-in for your organization. +- In Docker Hub, you can now download a [registry.json](/manuals/platform/security/authentication/enforce-sign-in/_index.md) file or copy the commands to create a registry.json file to enforce sign-in for your organization. ## 2022-09-19 @@ -318,7 +318,7 @@ Docker introduces Hub Vulnerability Scanning which enables you to automatically ### New features -- You can now [create personal access tokens](/security/access-tokens/) in Docker Hub and use them to authenticate from the Docker CLI. Find them in your account settings, under the new **[Security](https://hub.docker.com/settings/security)** section. +- You can now [create personal access tokens](/platform/security/access-tokens/personal-access-tokens/) in Docker Hub and use them to authenticate from the Docker CLI. Find them in your account settings, under the new **[Security](https://hub.docker.com/settings/security)** section. ### Known Issues diff --git a/content/manuals/docker-hub/repos/create.md b/content/manuals/docker-hub/repos/create.md index 9e20df6710c0..d21171cd5bf6 100644 --- a/content/manuals/docker-hub/repos/create.md +++ b/content/manuals/docker-hub/repos/create.md @@ -39,7 +39,7 @@ weight: 20 is only accessible to you and collaborators. In addition, if you selected an organization's namespace, then the repository is accessible to those with applicable roles or permissions. For more details, see [Roles and - permissions](/manuals/enterprise/security/roles-and-permissions.md). + permissions](/manuals/platform/security/roles-and-permissions.md). > [!NOTE] > diff --git a/content/manuals/docker-hub/repos/manage/access.md b/content/manuals/docker-hub/repos/manage/access.md index c88d3492cfb3..0124d2bc28fc 100644 --- a/content/manuals/docker-hub/repos/manage/access.md +++ b/content/manuals/docker-hub/repos/manage/access.md @@ -94,7 +94,7 @@ repository from that repository's **Settings** page. Organizations can use roles for individuals, giving them different permissions in the organization. For more details, see [Roles and -permissions](/manuals/enterprise/security/roles-and-permissions.md). +permissions](/manuals/platform/security/roles-and-permissions.md). ## Organization teams @@ -131,7 +131,7 @@ To configure team repository permissions: Organizations can use OATs. OATs let you assign fine-grained repository access permissions to tokens. For more details, see [Organization access -tokens](/manuals/enterprise/security/access-tokens.md). +tokens](/manuals/platform/security/access-tokens/organization-access-tokens.md). ## Gated distribution @@ -156,7 +156,7 @@ If you are interested in Gated Distribution contact the }} @@ -13,7 +14,7 @@ Organization access tokens (OATs) provide secure, programmatic access to Docker > [!WARNING] > -> Organization access tokens are incompatible with Docker Desktop and Image Access Management. If you use these features, use [personal access tokens](/manuals/security/access-tokens.md) instead. +> Organization access tokens are incompatible with Docker Desktop and Image Access Management. If you use these features, use [personal access tokens](/manuals/platform/security/access-tokens/personal-access-tokens.md) instead. ## Who should use organization access tokens? diff --git a/content/manuals/security/access-tokens.md b/content/manuals/platform/security/access-tokens/personal-access-tokens.md similarity index 93% rename from content/manuals/security/access-tokens.md rename to content/manuals/platform/security/access-tokens/personal-access-tokens.md index 380b93383dd6..e3d35140095d 100644 --- a/content/manuals/security/access-tokens.md +++ b/content/manuals/platform/security/access-tokens/personal-access-tokens.md @@ -6,6 +6,8 @@ keywords: personal access tokens, PAT, docker cli authentication, docker hub sec weight: 10 aliases: - /docker-hub/access-tokens/ + - /security/access-tokens/ + - /security/personal-access-tokens/ - /security/for-developers/access-tokens/ --- @@ -32,7 +34,7 @@ Use PATs for these common scenarios: > [!NOTE] > -> For organization-wide automation, consider [organization access tokens](/manuals/enterprise/security/access-tokens.md) which aren't tied to individual user accounts. +> For organization-wide automation, consider [organization access tokens](/manuals/platform/security/access-tokens/organization-access-tokens.md) which aren't tied to individual user accounts. ## Create a personal access token @@ -101,5 +103,5 @@ Best practices for fair use include: - Reuse tokens across similar use cases instead of creating many single-purpose tokens - Delete unused tokens regularly -- Use [organization access tokens](/manuals/enterprise/security/access-tokens.md) for organization-wide automation +- Use [organization access tokens](/manuals/platform/security/access-tokens/organization-access-tokens.md) for organization-wide automation - Monitor token usage to identify optimization opportunities diff --git a/content/manuals/security/2fa/_index.md b/content/manuals/platform/security/authentication/2fa/_index.md similarity index 99% rename from content/manuals/security/2fa/_index.md rename to content/manuals/platform/security/authentication/2fa/_index.md index 688c3449d800..1cb2332cc7c1 100644 --- a/content/manuals/security/2fa/_index.md +++ b/content/manuals/platform/security/authentication/2fa/_index.md @@ -9,6 +9,7 @@ aliases: - /security/2fa/disable-2fa/ - /security/for-developers/2fa/ - /security/for-developers/2fa/disable-2fa/ + - /security/2fa/ --- Two-factor authentication (2FA) adds an essential security layer to your Docker account by requiring a unique security code in addition to your password when signing in. This prevents unauthorized access even if your password is compromised. diff --git a/content/manuals/security/2fa/recover-hub-account.md b/content/manuals/platform/security/authentication/2fa/recover-hub-account.md similarity index 100% rename from content/manuals/security/2fa/recover-hub-account.md rename to content/manuals/platform/security/authentication/2fa/recover-hub-account.md diff --git a/content/manuals/platform/security/authentication/_index.md b/content/manuals/platform/security/authentication/_index.md new file mode 100644 index 000000000000..fd683d953cd5 --- /dev/null +++ b/content/manuals/platform/security/authentication/_index.md @@ -0,0 +1,9 @@ +--- +build: + render: never +title: Authentication +linkTitle: Authentication +description: Configure single sign-on, OIDC connections, two-factor authentication, and sign-in enforcement. +keywords: authentication, SSO, OIDC, two-factor authentication, 2FA, enforce sign-in, Docker security +weight: 20 +--- diff --git a/content/manuals/enterprise/security/enforce-sign-in/_index.md b/content/manuals/platform/security/authentication/enforce-sign-in/_index.md similarity index 91% rename from content/manuals/enterprise/security/enforce-sign-in/_index.md rename to content/manuals/platform/security/authentication/enforce-sign-in/_index.md index 82497c724f6f..87121af63822 100644 --- a/content/manuals/enterprise/security/enforce-sign-in/_index.md +++ b/content/manuals/platform/security/authentication/enforce-sign-in/_index.md @@ -8,6 +8,7 @@ tags: [admin] aliases: - /security/for-admins/configure-sign-in/ - /security/for-admins/enforce-sign-in/ + - /enterprise/security/enforce-sign-in/ weight: 30 --- @@ -55,7 +56,7 @@ On the next Docker Desktop restart: ## Enforcing sign-in versus enforcing single sign-on (SSO) -Enforcing Docker Desktop sign-in and [enforcing SSO](/manuals/enterprise/security/single-sign-on/connect.md#optional-enforce-sso) are different features that serve different purposes: +Enforcing Docker Desktop sign-in and [enforcing SSO](/manuals/platform/security/authentication/single-sign-on/connect.md#optional-enforce-sso) are different features that serve different purposes: | Enforcement | Description | Benefits | @@ -67,5 +68,5 @@ Enforcing Docker Desktop sign-in and [enforcing SSO](/manuals/enterprise/securit ## Next steps -- To set up sign-in enforcement, see [Configure sign-in enforcement](/manuals/enterprise/security/enforce-sign-in/methods.md). -- To configure SSO enforcement, see [Enforce SSO](/manuals/enterprise/security/single-sign-on/connect.md). +- To set up sign-in enforcement, see [Configure sign-in enforcement](/manuals/platform/security/authentication/enforce-sign-in/methods.md). +- To configure SSO enforcement, see [Enforce SSO](/manuals/platform/security/authentication/single-sign-on/connect.md). diff --git a/content/manuals/enterprise/security/enforce-sign-in/methods.md b/content/manuals/platform/security/authentication/enforce-sign-in/methods.md similarity index 99% rename from content/manuals/enterprise/security/enforce-sign-in/methods.md rename to content/manuals/platform/security/authentication/enforce-sign-in/methods.md index 09648085c141..6c97f2bac7d9 100644 --- a/content/manuals/enterprise/security/enforce-sign-in/methods.md +++ b/content/manuals/platform/security/authentication/enforce-sign-in/methods.md @@ -6,6 +6,7 @@ keywords: authentication, registry.json, configure, enforce sign-in, docker desk tags: [admin] aliases: - /security/for-admins/enforce-sign-in/methods/ + - /enterprise/security/enforce-sign-in/methods/ --- {{< summary-bar feature_name="Enforce sign-in" >}} diff --git a/content/manuals/enterprise/security/oidc-connections/_index.md b/content/manuals/platform/security/authentication/oidc-connections/_index.md similarity index 83% rename from content/manuals/enterprise/security/oidc-connections/_index.md rename to content/manuals/platform/security/authentication/oidc-connections/_index.md index 72d19efd3019..9d349e929b3d 100644 --- a/content/manuals/enterprise/security/oidc-connections/_index.md +++ b/content/manuals/platform/security/authentication/oidc-connections/_index.md @@ -5,6 +5,8 @@ description: Authenticate GitHub Actions to Docker with short-lived OpenID Conne keywords: oidc connections, openid connect, github actions, jwt, subject claims, rulesets, enterprise security, workload authentication tags: [admin] weight: 35 +aliases: + - /enterprise/security/oidc-connections/ --- {{< summary-bar feature_name="OIDC connections" >}} @@ -34,7 +36,7 @@ and issued on a per-workflow basis. ## OIDC connections and OATs -[Organization access tokens (OATs)](/manuals/enterprise/security/access-tokens.md) +[Organization access tokens (OATs)](/manuals/platform/security/access-tokens/organization-access-tokens.md) provide programmatic access to your Docker resources at the organization level. Unlike personal access tokens, OATs aren't tied to individual members, so access continues when membership changes. @@ -48,5 +50,5 @@ they request a change to your Docker resources. ## Next steps -- [Create an OIDC connection](/manuals/enterprise/security/oidc-connections/create-manage.md) -- [OIDC rulesets and subject claims](/manuals/enterprise/security/oidc-connections/rulesets-claims.md) +- [Create an OIDC connection](/manuals/platform/security/authentication/oidc-connections/create-manage.md) +- [OIDC rulesets and subject claims](/manuals/platform/security/authentication/oidc-connections/rulesets-claims.md) diff --git a/content/manuals/enterprise/security/oidc-connections/create-manage.md b/content/manuals/platform/security/authentication/oidc-connections/create-manage.md similarity index 92% rename from content/manuals/enterprise/security/oidc-connections/create-manage.md rename to content/manuals/platform/security/authentication/oidc-connections/create-manage.md index f87c9823e604..581fa014ae39 100644 --- a/content/manuals/enterprise/security/oidc-connections/create-manage.md +++ b/content/manuals/platform/security/authentication/oidc-connections/create-manage.md @@ -25,7 +25,7 @@ with a short-lived token. 1. Select **Create OIDC connection** and fill in the OIDC connection form. - Provide rulesets and subject claims. Other values are optional. - For rulesets, subject claims, and resources, see - [OIDC connections rulesets and subject claims](/manuals/enterprise/security/oidc-connections/rulesets-claims.md). + [OIDC connections rulesets and subject claims](/manuals/platform/security/authentication/oidc-connections/rulesets-claims.md). 1. Select **Create connection**. 1. Copy your OIDC connection ID. @@ -90,4 +90,4 @@ fails at the token-exchange step until you activate the connection. ## Next steps -- [OIDC connections rulesets and subject claims](/manuals/enterprise/security/oidc-connections/rulesets-claims.md) +- [OIDC connections rulesets and subject claims](/manuals/platform/security/authentication/oidc-connections/rulesets-claims.md) diff --git a/content/manuals/enterprise/security/oidc-connections/rulesets-claims.md b/content/manuals/platform/security/authentication/oidc-connections/rulesets-claims.md similarity index 94% rename from content/manuals/enterprise/security/oidc-connections/rulesets-claims.md rename to content/manuals/platform/security/authentication/oidc-connections/rulesets-claims.md index 6e14e038bc48..104d06667da4 100644 --- a/content/manuals/enterprise/security/oidc-connections/rulesets-claims.md +++ b/content/manuals/platform/security/authentication/oidc-connections/rulesets-claims.md @@ -91,5 +91,5 @@ Docker Hub repositories and Docker Build Cloud are supported resources. ## Next steps -- [OIDC connections overview](/manuals/enterprise/security/oidc-connections/_index.md) -- [Create or manage OIDC connections](/manuals/enterprise/security/oidc-connections/create-manage.md) +- [OIDC connections overview](/manuals/platform/security/authentication/oidc-connections/_index.md) +- [Create or manage OIDC connections](/manuals/platform/security/authentication/oidc-connections/create-manage.md) diff --git a/content/manuals/enterprise/security/single-sign-on/_index.md b/content/manuals/platform/security/authentication/single-sign-on/_index.md similarity index 86% rename from content/manuals/enterprise/security/single-sign-on/_index.md rename to content/manuals/platform/security/authentication/single-sign-on/_index.md index c7cfa70db0b7..8abb723f1ef6 100644 --- a/content/manuals/enterprise/security/single-sign-on/_index.md +++ b/content/manuals/platform/security/authentication/single-sign-on/_index.md @@ -8,6 +8,7 @@ aliases: - /admin/company/settings/sso/ - /admin/organization/security-settings/sso-management/ - /security/for-admins/single-sign-on/ + - /enterprise/security/single-sign-on/ weight: 10 --- @@ -50,10 +51,10 @@ assigned to an organization, and added to a team. > > When SSO is enforced, CLI password-based sign-in is no longer supported. > Use a personal access token (PAT) for CLI access. For more information, see the -> [security announcement](/manuals/security/security-announcements.md#deprecation-of-password-logins-on-cli-when-sso-enforced). +> [security announcement](/manuals/platform/security/security-announcements.md#deprecation-of-password-logins-on-cli-when-sso-enforced). ## Next steps - Start [configuring SSO](connect.md). -- Read the [FAQs](/manuals/enterprise/security/single-sign-on/FAQs/general.md). -- [Troubleshoot](/manuals/enterprise/security/single-sign-on/troubleshoot-sso.md) SSO issues. +- Read the [FAQs](/manuals/faqs/sso-faqs.md). +- [Troubleshoot](/manuals/platform/security/authentication/single-sign-on/troubleshoot-sso.md) SSO issues. diff --git a/content/manuals/enterprise/security/single-sign-on/connect.md b/content/manuals/platform/security/authentication/single-sign-on/connect.md similarity index 92% rename from content/manuals/enterprise/security/single-sign-on/connect.md rename to content/manuals/platform/security/authentication/single-sign-on/connect.md index 52630a29786f..85eb77d6cc3b 100644 --- a/content/manuals/enterprise/security/single-sign-on/connect.md +++ b/content/manuals/platform/security/authentication/single-sign-on/connect.md @@ -13,7 +13,7 @@ aliases: - /admin/company/settings/sso-configuration/ - /admin/organization/security-settings/sso-configuration/ - /security/for-admins/single-sign-on/configure/ - - /enterprise/security/single-sign-on/configure + - /enterprise/security/single-sign-on/connect/ --- {{< summary-bar feature_name="SSO" >}} @@ -22,7 +22,7 @@ To set up a single sign-on (SSO), you need to establish a connection between Doc and your identity provider (IdP). While this guide uses Okta and Microsoft Entra ID as a working example, the general process remains the same for other IdPs. -If you're unfamiliar with the SSO process, first review [SSO overview](/manuals/enterprise/security/single-sign-on/_index.md) to learn about how SSO works. +If you're unfamiliar with the SSO process, first review [SSO overview](/manuals/platform/security/authentication/single-sign-on/_index.md) to learn about how SSO works. ## Prerequisites @@ -124,7 +124,7 @@ You need [super admin permissions](https://help.okta.com/en-us/content/topics/se - For **Name ID format**, choose `EmailAddress` - For **Application username**, choose `Email` - For **Update application username on**, choose `Create and update` - - Optional. Add [SAML attributes](/manuals/enterprise/security/provisioning/_index.md#sso-attributes), if required by your org. + - Optional. Add [SAML attributes](/manuals/platform/security/provisioning/_index.md#sso-attributes), if required by your org. 1. For **Feedback**, choose **This is an internal app that we have created** checkbox before finishing. Keep your Okta window open for the next step. @@ -140,7 +140,7 @@ To enable SSO with Microsoft Entra, you need [Cloud Application Administrator](h 1. Select **Edit** on the **Basic SAML configuration** section. From **Basic SAML configuration**, choose **Edit** and paste the values you copied from creating an SSO connection in Docker: - For the **Identifier** value, paste the Docker Entity ID. - For the **Reply URL** value, paste Docker ACS URL. -1. Optional. Add [SAML attributes](/manuals/enterprise/security/provisioning/_index.md#sso-attributes), if required by your org. +1. Optional. Add [SAML attributes](/manuals/platform/security/provisioning/_index.md#sso-attributes), if required by your org. 1. From the **SAML Signing Certificate** section, download your **Certificate (Base64)**. {{< /tab >}} @@ -233,7 +233,7 @@ Docker supports multiple identity provider (IdP) configurations by letting you a To add multiple IdPs: 1. Use the same domain for each connection. -1. Repeat steps 3-6 from the [Set up an SSO connection](/manuals/enterprise/security/single-sign-on/connect.md#set-up-an-sso-connection) procedures on this page. Repeat these steps for each IdP your organization intends to use. +1. Repeat steps 3-6 from the [Set up an SSO connection](/manuals/platform/security/authentication/single-sign-on/connect.md#set-up-an-sso-connection) procedures on this page. Repeat these steps for each IdP your organization intends to use. Because you must use the same domain for each IdP, you won't need to repeat steps to add and verify your domains. @@ -241,7 +241,7 @@ Because you must use the same domain for each IdP, you won't need to repeat step If SSO is not enforced, users can still sign in using Docker usernames and passwords. Enforcing SSO requires users to use SSO when signing into Docker, which centralizes authentication and enforces policies set by the IdP. -Before enforcing SSO, users accessing Docker through the CLI must [create a personal access token (PAT)](/manuals/security/access-tokens.md). The PAT replaces their username and password for authentication. +Before enforcing SSO, users accessing Docker through the CLI must [create a personal access token (PAT)](/manuals/platform/security/access-tokens/personal-access-tokens.md). The PAT replaces their username and password for authentication. 1. Sign in to [Docker Home](https://app.docker.com/) and select your organization or company. @@ -256,7 +256,7 @@ Docker Hub. If you want to use 2FA, you must enable 2FA through your IdP. ## Next steps -- [Provision users](/manuals/enterprise/security/provisioning/_index.md). +- [Provision users](/manuals/platform/security/provisioning/_index.md). - [Enforce sign-in](../enforce-sign-in/_index.md). -- [Create personal access tokens](/manuals/security/access-tokens.md). -- [Troubleshoot SSO](/manuals/enterprise/security/single-sign-on/troubleshoot-sso.md) issues. +- [Create personal access tokens](/manuals/platform/security/access-tokens/personal-access-tokens.md). +- [Troubleshoot SSO](/manuals/platform/security/authentication/single-sign-on/troubleshoot-sso.md) issues. diff --git a/content/manuals/enterprise/security/single-sign-on/images/SSO.png b/content/manuals/platform/security/authentication/single-sign-on/images/SSO.png similarity index 100% rename from content/manuals/enterprise/security/single-sign-on/images/SSO.png rename to content/manuals/platform/security/authentication/single-sign-on/images/SSO.png diff --git a/content/manuals/enterprise/security/single-sign-on/manage.md b/content/manuals/platform/security/authentication/single-sign-on/manage.md similarity index 98% rename from content/manuals/enterprise/security/single-sign-on/manage.md rename to content/manuals/platform/security/authentication/single-sign-on/manage.md index c5f71844e459..71d34c1c63a9 100644 --- a/content/manuals/enterprise/security/single-sign-on/manage.md +++ b/content/manuals/platform/security/authentication/single-sign-on/manage.md @@ -8,6 +8,7 @@ aliases: - /admin/company/settings/sso-management/ - /single-sign-on/manage/ - /security/for-admins/single-sign-on/manage/ +- /enterprise/security/single-sign-on/manage/ --- {{< summary-bar feature_name="SSO" >}} @@ -106,7 +107,7 @@ when they sign in via SSO - Group mapping: Sync user groups from your identity provider with teams in your Docker organization - Manual provisioning: Turn off automatic provisioning and manually invite users -For more information on provisioning methods, see [Provision users](/manuals/enterprise/security/provisioning/_index.md). +For more information on provisioning methods, see [Provision users](/manuals/platform/security/provisioning/_index.md). ### Add guest users diff --git a/content/manuals/enterprise/security/single-sign-on/troubleshoot-sso.md b/content/manuals/platform/security/authentication/single-sign-on/troubleshoot-sso.md similarity index 97% rename from content/manuals/enterprise/security/single-sign-on/troubleshoot-sso.md rename to content/manuals/platform/security/authentication/single-sign-on/troubleshoot-sso.md index ebd616e7f6c4..22e091433e09 100644 --- a/content/manuals/enterprise/security/single-sign-on/troubleshoot-sso.md +++ b/content/manuals/platform/security/authentication/single-sign-on/troubleshoot-sso.md @@ -117,7 +117,7 @@ If you have SCIM enabled, troubleshoot your SCIM connection using the following 1. Navigate back to **Identity & auth**, then **SSO and SCIM**, and verify your SCIM configuration: - Ensure that the SCIM Base URL and API Token in your IdP match those provided in Docker. - Verify that SCIM is enabled in both Docker and your IdP. -1. Ensure that the attributes being synced from your IdP match Docker's [supported attributes](/manuals/enterprise/security/provisioning/scim/provision-scim.md#supported-attributes) for SCIM. +1. Ensure that the attributes being synced from your IdP match Docker's [supported attributes](/manuals/platform/security/provisioning/scim/provision-scim.md#supported-attributes) for SCIM. 1. Test user provisioning by trying to provision a test user through your IdP and verify if they appear in Docker. ## IdP-initiated sign in is not enabled for connection @@ -192,7 +192,7 @@ Ensure that the IdP SSO connection is returning the correct UPN value in the ass **Add and verify all domains** -Add and verify all domains and subdomains used as UPN by your IdP and associate them with your Docker SSO connection. For details, see [Configure single sign-on](/manuals/enterprise/security/single-sign-on/connect.md). +Add and verify all domains and subdomains used as UPN by your IdP and associate them with your Docker SSO connection. For details, see [Configure single sign-on](/manuals/platform/security/authentication/single-sign-on/connect.md). ## Unable to find session diff --git a/content/manuals/enterprise/security/provisioning/_index.md b/content/manuals/platform/security/provisioning/_index.md similarity index 95% rename from content/manuals/enterprise/security/provisioning/_index.md rename to content/manuals/platform/security/provisioning/_index.md index 923731988856..62c0fdfbdd28 100644 --- a/content/manuals/enterprise/security/provisioning/_index.md +++ b/content/manuals/platform/security/provisioning/_index.md @@ -3,10 +3,15 @@ description: Learn about provisioning users for your SSO configuration. keywords: provision users, provisioning, JIT, SCIM, group mapping, sso, docker admin, admin, security title: Provision users linkTitle: Provision -weight: 20 +weight: 30 aliases: - /security/for-admins/provisioning/ + - /enterprise/security/provisioning/ grid: + - title: "Add and manage domains" + description: "Add, verify, and manage domains to control user access and enable auto-provisioning." + icon: globe-alt + link: "domain-management/" - title: "SCIM provisioning" description: "Enable continuous user data synchronization between your IdP and Docker. Best for larger organizations." icon: arrow-path diff --git a/content/manuals/enterprise/security/provisioning/auto-provisioning.md b/content/manuals/platform/security/provisioning/auto-provisioning.md similarity index 91% rename from content/manuals/enterprise/security/provisioning/auto-provisioning.md rename to content/manuals/platform/security/provisioning/auto-provisioning.md index a0ab4c209362..f0de99448de3 100644 --- a/content/manuals/enterprise/security/provisioning/auto-provisioning.md +++ b/content/manuals/platform/security/provisioning/auto-provisioning.md @@ -54,5 +54,5 @@ To disable auto-provisioning for a user: To choose a different method to provision users, you can set up: -- [SCIM provisioning](/manuals/enterprise/security/provisioning/scim/_index.md) for advanced user management. -- [Group mapping](/manuals/enterprise/security/provisioning/scim/group-mapping.md) to assign users to teams automatically. +- [SCIM provisioning](/manuals/platform/security/provisioning/scim/_index.md) for advanced user management. +- [Group mapping](/manuals/platform/security/provisioning/scim/group-mapping.md) to assign users to teams automatically. diff --git a/content/manuals/enterprise/security/domain-management.md b/content/manuals/platform/security/provisioning/domain-management.md similarity index 90% rename from content/manuals/enterprise/security/domain-management.md rename to content/manuals/platform/security/provisioning/domain-management.md index 767f58deaa27..55679bea5ffd 100644 --- a/content/manuals/enterprise/security/domain-management.md +++ b/content/manuals/platform/security/provisioning/domain-management.md @@ -2,9 +2,11 @@ title: Add and manage domains description: Add, verify, and manage domains to control user access and enable auto-provisioning in Docker organizations keywords: domain management, domain verification, auto-provisioning, user management, DNS, TXT record, Docker Home -weight: 10 +weight: 5 aliases: - /security/for-admins/domain-management/ + - /enterprise/security/domain-management/ + - /platform/security/domains/domain-management/ --- {{< summary-bar feature_name="Domain management" >}} @@ -90,7 +92,7 @@ Domain audit can't identify: - Users who authenticate using an account that doesn't have an email address associated with one of your verified domains -To prevent unidentifiable users from accessing Docker Desktop, [enforce sign-in](/manuals/enterprise/security/enforce-sign-in/_index.md). +To prevent unidentifiable users from accessing Docker Desktop, [enforce sign-in](/manuals/platform/security/authentication/enforce-sign-in/_index.md). ### Run a domain audit @@ -114,10 +116,10 @@ CSV file. For more information on bulk inviting users, see ## Auto-provisioning -[Auto-provisioning](/manuals/enterprise/security/provisioning/auto-provisioning.md) uses verified domains to associate organization members with email address that match the verified domains. To override auto-provisioning, you can configure one of the two alternative methods: +[Auto-provisioning](/manuals/platform/security/provisioning/auto-provisioning.md) uses verified domains to associate organization members with email address that match the verified domains. To override auto-provisioning, you can configure one of the two alternative methods: -- [Just-in-Time (JIT)](/manuals/enterprise/security/provisioning/just-in-time.md) provisioning -- [System for Cross-domain Identity Management (SCIM)](/manuals/enterprise/security/provisioning/scim/_index.md) +- [Just-in-Time (JIT)](/manuals/platform/security/provisioning/just-in-time.md) provisioning +- [System for Cross-domain Identity Management (SCIM)](/manuals/platform/security/provisioning/scim/_index.md) ## Delete a domain diff --git a/content/manuals/enterprise/security/provisioning/just-in-time.md b/content/manuals/platform/security/provisioning/just-in-time.md similarity index 93% rename from content/manuals/enterprise/security/provisioning/just-in-time.md rename to content/manuals/platform/security/provisioning/just-in-time.md index e2ed13bf3f8e..9faf96896460 100644 --- a/content/manuals/enterprise/security/provisioning/just-in-time.md +++ b/content/manuals/platform/security/provisioning/just-in-time.md @@ -79,6 +79,6 @@ Users are provisioned with JIT by default. If you enable SCIM, you can disable J ## Next steps -- Configure [SCIM provisioning](/manuals/enterprise/security/provisioning/scim/_index.md) for advanced user management. -- Set up [group mapping](/manuals/enterprise/security/provisioning/scim/group-mapping.md) to automatically assign users to teams. -- Review [Troubleshoot provisioning](/manuals/enterprise/security/provisioning/troubleshoot-provisioning.md). +- Configure [SCIM provisioning](/manuals/platform/security/provisioning/scim/_index.md) for advanced user management. +- Set up [group mapping](/manuals/platform/security/provisioning/scim/group-mapping.md) to automatically assign users to teams. +- Review [Troubleshoot provisioning](/manuals/platform/security/provisioning/troubleshoot-provisioning.md). diff --git a/content/manuals/enterprise/security/provisioning/scim/_index.md b/content/manuals/platform/security/provisioning/scim/_index.md similarity index 82% rename from content/manuals/enterprise/security/provisioning/scim/_index.md rename to content/manuals/platform/security/provisioning/scim/_index.md index ace0770e759d..38841d4f8f8f 100644 --- a/content/manuals/enterprise/security/provisioning/scim/_index.md +++ b/content/manuals/platform/security/provisioning/scim/_index.md @@ -59,6 +59,6 @@ SCIM automates: ## Next steps -- [Migrate JIT to SCIM](/manuals/enterprise/security/provisioning/scim/migrate-scim.md) if users were provisioned with Just-in-Time (JIT) before you enabled SCIM. -- [Group mapping](/manuals/enterprise/security/provisioning/scim/group-mapping.md) to sync identity provider groups with members. -- [Troubleshoot provisioning](/manuals/enterprise/security/provisioning/troubleshoot-provisioning.md) for SCIM, JIT, and attribute issues. +- [Migrate JIT to SCIM](/manuals/platform/security/provisioning/scim/migrate-scim.md) if users were provisioned with Just-in-Time (JIT) before you enabled SCIM. +- [Group mapping](/manuals/platform/security/provisioning/scim/group-mapping.md) to sync identity provider groups with members. +- [Troubleshoot provisioning](/manuals/platform/security/provisioning/troubleshoot-provisioning.md) for SCIM, JIT, and attribute issues. diff --git a/content/manuals/enterprise/security/provisioning/scim/group-mapping.md b/content/manuals/platform/security/provisioning/scim/group-mapping.md similarity index 97% rename from content/manuals/enterprise/security/provisioning/scim/group-mapping.md rename to content/manuals/platform/security/provisioning/scim/group-mapping.md index 308cad4a8e7e..00cce8cbcee7 100644 --- a/content/manuals/enterprise/security/provisioning/scim/group-mapping.md +++ b/content/manuals/platform/security/provisioning/scim/group-mapping.md @@ -7,7 +7,7 @@ aliases: - /admin/organization/security-settings/group-mapping/ - /security/for-admins/group-mapping/ - /security/for-admins/provisioning/scim/group-mapping/ -- /enterprise/security/provisioning/group-mapping/ +- /platform/security/provisioning/group-mapping/ weight: 20 --- @@ -194,5 +194,5 @@ Once complete, a user who signs in to Docker through SSO is automatically added ## Next steps -- [Assign roles](/manuals/enterprise/security/roles-and-permissions/core-roles.md) to members of your org. -- [Enforce sign in](/manuals/enterprise/security/enforce-sign-in.md), if needed. +- [Assign roles](/manuals/platform/security/roles-and-permissions/core-roles.md) to members of your org. +- [Enforce sign in](/manuals/platform/security/authentication/enforce-sign-in.md), if needed. diff --git a/content/manuals/enterprise/security/provisioning/scim/migrate-scim.md b/content/manuals/platform/security/provisioning/scim/migrate-scim.md similarity index 94% rename from content/manuals/enterprise/security/provisioning/scim/migrate-scim.md rename to content/manuals/platform/security/provisioning/scim/migrate-scim.md index 00b62c4f3bbf..fa31fa18a97b 100644 --- a/content/manuals/enterprise/security/provisioning/scim/migrate-scim.md +++ b/content/manuals/platform/security/provisioning/scim/migrate-scim.md @@ -171,10 +171,10 @@ If a user fails to reappear after removal: 4. Check provisioning logs in your identity provider for errors. For more troubleshooting guidance, see -[Troubleshoot provisioning](/manuals/enterprise/security/provisioning/troubleshoot-provisioning.md). +[Troubleshoot provisioning](/manuals/platform/security/provisioning/troubleshoot-provisioning.md). ## Next steps -- Set up [Group mapping](/manuals/enterprise/security/provisioning/scim/group-mapping.md). -- [Assign roles](/manuals/enterprise/security/roles-and-permissions/core-roles.md) to members of your org. -- [Enforce sign in](/manuals/enterprise/security/enforce-sign-in.md), if needed. +- Set up [Group mapping](/manuals/platform/security/provisioning/scim/group-mapping.md). +- [Assign roles](/manuals/platform/security/roles-and-permissions/core-roles.md) to members of your org. +- [Enforce sign in](/manuals/platform/security/authentication/enforce-sign-in.md), if needed. diff --git a/content/manuals/enterprise/security/provisioning/scim/provision-scim.md b/content/manuals/platform/security/provisioning/scim/provision-scim.md similarity index 94% rename from content/manuals/enterprise/security/provisioning/scim/provision-scim.md rename to content/manuals/platform/security/provisioning/scim/provision-scim.md index 5f7a24703547..069bf870c131 100644 --- a/content/manuals/enterprise/security/provisioning/scim/provision-scim.md +++ b/content/manuals/platform/security/provisioning/scim/provision-scim.md @@ -4,7 +4,7 @@ linkTitle: Setup description: Learn how System for Cross-domain Identity Management works and how to set it up. weight: 10 aliases: - - /enterprise/security/provisioning/scim/ + - /platform/security/provisioning/scim/ --- {{< summary-bar feature_name="SSO" >}} @@ -37,7 +37,7 @@ For additional details about supported attributes and SCIM, see > your SCIM values. > > Alternatively, you can disable JIT provisioning to rely solely on SCIM. -> For details, see [Just-in-Time](/manuals/enterprise/security/provisioning/just-in-time.md). +> For details, see [Just-in-Time](/manuals/platform/security/provisioning/just-in-time.md). ## Enable SCIM in Docker @@ -152,7 +152,7 @@ Next, [set up role mapping](#set-up-role-mapping). ## Set up role mapping -You can assign [Docker roles](/manuals/enterprise/security/roles-and-permissions/_index.md) to +You can assign [Docker roles](/manuals/platform/security/roles-and-permissions/_index.md) to users by adding optional SCIM attributes in your IdP. These attributes override default role and team values set in your SSO configuration. @@ -166,7 +166,7 @@ The following table lists the supported optional user-level attributes: | Attribute | Possible values | Notes | | ------------ | ---------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| `dockerRole` | `member`, `editor`, or `owner` | If not set, the user defaults to the `member` role. Setting this attribute overrides the default.

For role definitions, see [Roles and permissions](/manuals/enterprise/security/roles-and-permissions/_index.md). | +| `dockerRole` | `member`, `editor`, or `owner` | If not set, the user defaults to the `member` role. Setting this attribute overrides the default.

For role definitions, see [Roles and permissions](/manuals/platform/security/roles-and-permissions/_index.md). | | `dockerOrg` | Docker `organizationName` (e.g., `moby`) | Overrides the default organization configured in your SSO connection.

If unset, the user is provisioned to the default organization. If `dockerOrg` and `dockerTeam` are both set, the user is provisioned to the team within the specified organization. | | `dockerTeam` | Docker `teamName` (e.g., `developers`) | Provisions the user to the specified team in the default or specified organization. If the team doesn't exist, it is automatically created.

You can still use [group mapping](group-mapping.md) to assign users to multiple teams across organizations. | @@ -178,7 +178,7 @@ This value is required in your identity provider when creating custom SCIM attri ### Step one: Set up role mapping in Okta -1. Setup [SSO](/manuals/enterprise/security/single-sign-on/connect.md) and SCIM first. +1. Setup [SSO](/manuals/platform/security/authentication/single-sign-on/connect.md) and SCIM first. 1. In the Okta admin portal, go to **Directory**, select **Profile Editor**, and then **User (Default)**. 1. Select **Add Attribute** and configure the values for the role, organization, @@ -221,7 +221,7 @@ group will inherit these attributes upon provisioning. ### Step one: Configure attribute mappings -1. Complete the [SCIM provisioning setup](/manuals/enterprise/security/provisioning/scim/provision-scim.md#enable-scim-in-docker). +1. Complete the [SCIM provisioning setup](/manuals/platform/security/provisioning/scim/provision-scim.md#enable-scim-in-docker). 1. In the Azure Portal, open **Microsoft Entra ID** > **Enterprise Applications**, and select your SCIM application. 1. Go to **Provisioning** > **Mappings** > @@ -230,7 +230,7 @@ group will inherit these attributes upon provisioning. - `userPrincipalName` -> `userName` - `mail` -> `emails.value` - Optional. Map `dockerRole`, `dockerOrg`, or `dockerTeam` using one of the - [mapping methods](/manuals/enterprise/security/provisioning/scim/provision-scim.md#set-up-role-mapping). + [mapping methods](/manuals/platform/security/provisioning/scim/provision-scim.md#set-up-role-mapping). 1. Remove any unsupported attributes to prevent sync errors. 1. Optional. Go to **Mappings** > **Provision Azure Active Directory Groups**: - If group provisioning causes errors, set **Enabled** to **No**. @@ -370,5 +370,5 @@ To disable SCIM: ## Next steps -- Set up [Group mapping](/manuals/enterprise/security/provisioning/scim/group-mapping.md). -- [Troubleshoot provisioning](/manuals/enterprise/security/provisioning/troubleshoot-provisioning.md). +- Set up [Group mapping](/manuals/platform/security/provisioning/scim/group-mapping.md). +- [Troubleshoot provisioning](/manuals/platform/security/provisioning/troubleshoot-provisioning.md). diff --git a/content/manuals/enterprise/security/provisioning/troubleshoot-provisioning.md b/content/manuals/platform/security/provisioning/troubleshoot-provisioning.md similarity index 100% rename from content/manuals/enterprise/security/provisioning/troubleshoot-provisioning.md rename to content/manuals/platform/security/provisioning/troubleshoot-provisioning.md diff --git a/content/manuals/enterprise/security/roles-and-permissions/_index.md b/content/manuals/platform/security/roles-and-permissions/_index.md similarity index 89% rename from content/manuals/enterprise/security/roles-and-permissions/_index.md rename to content/manuals/platform/security/roles-and-permissions/_index.md index 54d7e0239879..abd3689982ab 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/_index.md +++ b/content/manuals/platform/security/roles-and-permissions/_index.md @@ -8,27 +8,28 @@ keywords: >- Docker organization roles, permissions, core roles, custom roles, Member, Editor, Owner, access control, least privilege, Docker Business, security tags: [admin] +weight: 40 aliases: - /admin/organization/roles/ - /security/for-admins/roles-and-permissions/ - /docker-hub/roles-and-permissions/ + - /enterprise/security/roles-and-permissions/ grid: - title: Core roles description: >- Compare permissions for the built-in Member, Editor, and Owner roles. icon: shield-check - link: /enterprise/security/roles-and-permissions/core-roles/ + link: /platform/security/roles-and-permissions/core-roles/ - title: Custom roles description: >- Build permission sets that match your organization's access control needs. icon: adjustments-horizontal - link: /enterprise/security/roles-and-permissions/custom-roles/ + link: /platform/security/roles-and-permissions/custom-roles/ - title: Custom roles permissions description: >- Review every permission you can assign to a custom role. icon: list-bullet - link: /enterprise/security/roles-and-permissions/custom-roles/permissions-reference/ -weight: 40 + link: /platform/security/roles-and-permissions/custom-roles/permissions-reference/ --- {{< summary-bar feature_name="General admin" >}} diff --git a/content/manuals/enterprise/security/roles-and-permissions/core-roles.md b/content/manuals/platform/security/roles-and-permissions/core-roles.md similarity index 96% rename from content/manuals/enterprise/security/roles-and-permissions/core-roles.md rename to content/manuals/platform/security/roles-and-permissions/core-roles.md index fe2036836c77..a6dabb8ceda9 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/core-roles.md +++ b/content/manuals/platform/security/roles-and-permissions/core-roles.md @@ -15,7 +15,7 @@ weight: 10 Docker organizations use built-in Member, Editor, and Owner roles with predefined permissions. This reference compares their permissions across Docker products. To assign a different combination of permissions, use -[custom roles](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md) +[custom roles](/manuals/platform/security/roles-and-permissions/custom-roles/_index.md) instead. ## Core roles @@ -103,7 +103,7 @@ Use team permissions for that. > > For more granular access control, > [upgrade to a Docker Business plan](https://www.docker.com/pricing?ref=Docs&refAction=DocsEnterpriseCoreRoles) -> to use [custom roles](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md). +> to use [custom roles](/manuals/platform/security/roles-and-permissions/custom-roles/_index.md). _\* If not part of a company_ @@ -129,7 +129,7 @@ _\* If not part of a company_ ## Next steps -- [Custom roles](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md): +- [Custom roles](/manuals/platform/security/roles-and-permissions/custom-roles/_index.md): Create tailored permission sets on a Docker Business plan - [Manage organization members](/manuals/admin/organization/manage/members.md): Invite users and assign roles diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md b/content/manuals/platform/security/roles-and-permissions/custom-roles/_index.md similarity index 87% rename from content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md rename to content/manuals/platform/security/roles-and-permissions/custom-roles/_index.md index 5df1b9ac6ef5..fd5fa2c469ca 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md +++ b/content/manuals/platform/security/roles-and-permissions/custom-roles/_index.md @@ -14,11 +14,11 @@ grid: - title: Manage custom roles description: Create, edit, assign, and delete custom roles for users and teams. icon: adjustments-horizontal - link: /enterprise/security/roles-and-permissions/custom-roles/manage/ + link: /platform/security/roles-and-permissions/custom-roles/manage/ - title: Permissions reference description: Review every permission you can assign when building a custom role. icon: list-bullet - link: /enterprise/security/roles-and-permissions/custom-roles/permissions-reference/ + link: /platform/security/roles-and-permissions/custom-roles/permissions-reference/ --- {{< summary-bar feature_name="Custom roles" >}} @@ -32,7 +32,7 @@ Custom roles are permission sets that you choose to grant access to users or tea If Docker's predefined permission sets meet your needs, use -[core roles](/manuals/enterprise/security/roles-and-permissions/core-roles.md) +[core roles](/manuals/platform/security/roles-and-permissions/core-roles.md) instead. ## Prerequisites diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/manage.md b/content/manuals/platform/security/roles-and-permissions/custom-roles/manage.md similarity index 98% rename from content/manuals/enterprise/security/roles-and-permissions/custom-roles/manage.md rename to content/manuals/platform/security/roles-and-permissions/custom-roles/manage.md index 3dbf85e77731..1f1844c259d2 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/manage.md +++ b/content/manuals/platform/security/roles-and-permissions/custom-roles/manage.md @@ -158,7 +158,7 @@ To see which users and teams are assigned to roles: - [Custom roles permissions reference](permissions-reference.md): Review permissions you can grant to a custom role -- [Core roles and permissions](/manuals/enterprise/security/roles-and-permissions/core-roles.md): +- [Core roles and permissions](/manuals/platform/security/roles-and-permissions/core-roles.md): Compare built-in Member, Editor, and Owner permissions - [Manage organization members](/manuals/admin/organization/manage/members.md): Invite and manage users in your organization diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md b/content/manuals/platform/security/roles-and-permissions/custom-roles/permissions-reference.md similarity index 98% rename from content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md rename to content/manuals/platform/security/roles-and-permissions/custom-roles/permissions-reference.md index fe210416c740..0871da550e96 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md +++ b/content/manuals/platform/security/roles-and-permissions/custom-roles/permissions-reference.md @@ -81,5 +81,5 @@ the following tables to [create or edit a custom role](manage.md). - [Manage custom roles](manage.md): Create, assign, and delete custom roles -- [Core roles and permissions](/manuals/enterprise/security/roles-and-permissions/core-roles.md): +- [Core roles and permissions](/manuals/platform/security/roles-and-permissions/core-roles.md): Compare built-in Member, Editor, and Owner permissions diff --git a/content/manuals/security/security-announcements.md b/content/manuals/platform/security/security-announcements.md similarity index 93% rename from content/manuals/security/security-announcements.md rename to content/manuals/platform/security/security-announcements.md index ec3536d9945b..aba5f04dcacc 100644 --- a/content/manuals/security/security-announcements.md +++ b/content/manuals/platform/security/security-announcements.md @@ -2,15 +2,19 @@ description: Docker security announcements keywords: Docker, CVEs, security, notice, Log4J 2, Log4Shell, Text4Shell, announcements title: Docker security announcements -linkTitle: Security announcements +linkTitle: Announcements outputs: ["HTML", "markdown", "RSS"] layout: security-announcements -weight: 80 +weight: 1 toc_min: 1 toc_max: 2 +aliases: + - /security/security-announcements/ + - /platform/security/resources/security-announcements/ + - /security-announcements/ --- -[Subscribe to security RSS feed](/security/security-announcements/index.xml) +[Subscribe to security RSS feed](/platform/security/security-announcements/index.xml) ## Docker Desktop 4.86.0 security update: CVE-2026-17106 @@ -64,7 +68,7 @@ A vulnerability in Docker Desktop for Windows was fixed on October 23 in the [4. A vulnerability in Docker Desktop was fixed on September 25 in the [4.47.0](/manuals/desktop/release-notes.md#4470) release: -- Fixed [CVE-2025-10657](https://www.cve.org/CVERecord?id=CVE-2025-10657) where the Enhanced Container Isolation [Docker Socket command restrictions](../enterprise/security/hardened-desktop/enhanced-container-isolation/config.md#command-restrictions) feature was not working properly in Docker Desktop 4.46.0 only (the configuration for it was being ignored). +- Fixed [CVE-2025-10657](https://www.cve.org/CVERecord?id=CVE-2025-10657) where the Enhanced Container Isolation [Docker Socket command restrictions](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/config.md#command-restrictions) feature was not working properly in Docker Desktop 4.46.0 only (the configuration for it was being ignored). ## Docker Desktop 4.44.3 security update: CVE-2025-9074 @@ -117,7 +121,7 @@ We strongly encourage you to update to Docker Desktop [4.34.2](/manuals/desktop/ _Last updated July, 2024_ -When [SSO enforcement](/manuals/enterprise/security/single-sign-on/connect.md) was first introduced, Docker provided a grace period to continue to let passwords be used on the Docker CLI when authenticating to Docker Hub. This was allowed so organizations could more easily use SSO enforcement. It is recommended that administrators configuring SSO encourage users using the CLI [to switch over to Personal Access Tokens](/manuals/enterprise/security/single-sign-on/_index.md#prerequisites) in anticipation of this grace period ending. +When [SSO enforcement](/manuals/platform/security/authentication/single-sign-on/connect.md) was first introduced, Docker provided a grace period to continue to let passwords be used on the Docker CLI when authenticating to Docker Hub. This was allowed so organizations could more easily use SSO enforcement. It is recommended that administrators configuring SSO encourage users using the CLI [to switch over to Personal Access Tokens](/manuals/platform/security/authentication/single-sign-on/_index.md#prerequisites) in anticipation of this grace period ending. On September 16, 2024, the grace period ended and passwords can no longer authenticate to Docker Hub via the Docker CLI when SSO is enforced. Affected users are required to switch over to using PATs to continue signing in. @@ -161,7 +165,7 @@ If you are using affected versions of runc, BuildKit, Moby, or Docker Desktop, m If you are unable to update to an unaffected version promptly, follow these best practices to mitigate risk: -- Only use trusted Docker images (such as [Docker Official Images](../docker-hub/image-library/trusted-content.md#docker-official-images)). +- Only use trusted Docker images (such as [Docker Official Images](/manuals/docker-hub/image-library/trusted-content.md#docker-official-images)). - Don't build Docker images from untrusted sources or untrusted Dockerfiles. - If you are a Docker Business customer using Docker Desktop and unable to update to v4.27.1, make sure to enable [Hardened Docker Desktop](/manuals/enterprise/security/hardened-desktop/_index.md) features such as: - [Enhanced Container Isolation](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/_index.md), which mitigates the impact of CVE-2024-21626 in the case of running containers from malicious images. @@ -247,11 +251,11 @@ Docker Hub security scans triggered after 1200 UTC 21 October 2021 are now correctly identifying the Text4Shell CVE. Scans before this date do not currently reflect the status of this vulnerability. Therefore, we recommend that you trigger scans by pushing new images to Docker Hub to view the status of -the Text4Shell CVE in the vulnerability report. For detailed instructions, see [Scan images on Docker Hub](../docker-hub/repos/manage/vulnerability-scanning.md). +the Text4Shell CVE in the vulnerability report. For detailed instructions, see [Scan images on Docker Hub](/manuals/docker-hub/repos/manage/vulnerability-scanning.md). ### Docker Official Images impacted by CVE-2022-42889 -A number of [Docker Official Images](../docker-hub/image-library/trusted-content.md#docker-official-images) contain the vulnerable versions of +A number of [Docker Official Images](/manuals/docker-hub/image-library/trusted-content.md#docker-official-images) contain the vulnerable versions of Apache Commons Text. The following lists Docker Official Images that may contain the vulnerable versions of Apache Commons Text: @@ -297,13 +301,13 @@ Docker Hub security scans triggered after 1700 UTC 13 December 2021 are now correctly identifying the Log4j 2 CVEs. Scans before this date do not currently reflect the status of this vulnerability. Therefore, we recommend that you trigger scans by pushing new images to Docker Hub to view the status of -Log4j 2 CVE in the vulnerability report. For detailed instructions, see [Scan images on Docker Hub](../docker-hub/repos/manage/vulnerability-scanning.md). +Log4j 2 CVE in the vulnerability report. For detailed instructions, see [Scan images on Docker Hub](/manuals/docker-hub/repos/manage/vulnerability-scanning.md). ## Docker Official Images impacted by Log4j 2 CVE _Last updated December 2021_ -A number of [Docker Official Images](../docker-hub/image-library/trusted-content.md#docker-official-images) contain the vulnerable versions of +A number of [Docker Official Images](/manuals/docker-hub/image-library/trusted-content.md#docker-official-images) contain the vulnerable versions of Log4j 2 CVE-2021-44228. The following table lists Docker Official Images that may contained the vulnerable versions of Log4j 2. We updated Log4j 2 in these images to the latest version. Some of these images may not be vulnerable for other reasons. We recommend that you also review the guidelines published on the upstream websites. diff --git a/content/manuals/retired.md b/content/manuals/retired.md index 2b5401bfd6b7..5196d0873fcb 100644 --- a/content/manuals/retired.md +++ b/content/manuals/retired.md @@ -195,7 +195,7 @@ Enhanced Service Account add-ons provided tiered pull rate limits for automated workflows and service accounts accessing Docker Hub. Docker recommends transitioning to [Organization Access Tokens -(OATs)](/manuals/enterprise/security/access-tokens.md), which provide secure, +(OATs)](/manuals/platform/security/access-tokens/organization-access-tokens.md), which provide secure, programmatic access to Docker Hub with granular repository permissions, token expiration, and better security auditing. OATs are included with Docker Team and Business subscriptions and offer similar functionality without requiring diff --git a/content/manuals/scout/explore/metrics-exporter.md b/content/manuals/scout/explore/metrics-exporter.md index 8141eef331a4..664edfab8e72 100644 --- a/content/manuals/scout/explore/metrics-exporter.md +++ b/content/manuals/scout/explore/metrics-exporter.md @@ -40,7 +40,7 @@ To export metrics from your organization, first make sure your organization is e Then, create a Personal Access Token (PAT) - a secret token that allows the exporter to authenticate with the Docker Scout API. The PAT does not require any specific permissions, but it must be created by a user who is an owner of the Docker organization. -To create a PAT, follow the steps in [Create an access token](/manuals/security/access-tokens.md). +To create a PAT, follow the steps in [Create an access token](/manuals/platform/security/access-tokens/personal-access-tokens.md). Once you have created the PAT, store it in a secure location. You will need to provide this token to the exporter when scraping metrics. @@ -108,7 +108,7 @@ alongside Grafana with a pre-configured dashboard to visualize the vulnerability $ cd scout-metrics-exporter/prometheus ``` -2. [Create a Docker access token](/manuals/security/access-tokens.md) +2. [Create a Docker access token](/manuals/platform/security/access-tokens/personal-access-tokens.md) and store it in a plain text file at `/prometheus/prometheus/token` under the template directory. ```plaintext {title=token} @@ -241,7 +241,7 @@ and a Datadog site. $ cd scout-metrics-exporter/datadog ``` -2. [Create a Docker access token](/manuals/security/access-tokens.md) +2. [Create a Docker access token](/manuals/platform/security/access-tokens/personal-access-tokens.md) and store it in a plain text file at `/datadog/token` under the template directory. ```plaintext {title=token} @@ -347,7 +347,7 @@ To change the scrape interval: ## Revoke an access token If you suspect that your PAT has been compromised or is no longer needed, you can revoke it at any time. -To revoke a PAT, follow the steps in the [Create and manage access tokens](/manuals/security/access-tokens.md). +To revoke a PAT, follow the steps in the [Create and manage access tokens](/manuals/platform/security/access-tokens/personal-access-tokens.md). Revoking a PAT immediately invalidates the token, and prevents Prometheus from scraping metrics using that token. You will need to create a new PAT and update the Prometheus configuration to use the new token. diff --git a/content/manuals/scout/integrations/registry/acr.md b/content/manuals/scout/integrations/registry/acr.md index c0dc9b4d813c..9e1b500c410a 100644 --- a/content/manuals/scout/integrations/registry/acr.md +++ b/content/manuals/scout/integrations/registry/acr.md @@ -189,7 +189,7 @@ what the integration provided. 4. Set up your Scout credentials. 1. Generate an organization access token. For more details, see - [Create an organization access token](/enterprise/security/access-tokens/#create-an-organization-access-token). + [Create an organization access token](/enterprise/platform/security/access-tokens/personal-access-tokens/#create-an-organization-access-token). 2. Sign in to Docker using the organization access token. ```console diff --git a/content/manuals/scout/integrations/registry/artifactory.md b/content/manuals/scout/integrations/registry/artifactory.md index 36cb7f2ffcb1..73c975aa9f2e 100644 --- a/content/manuals/scout/integrations/registry/artifactory.md +++ b/content/manuals/scout/integrations/registry/artifactory.md @@ -102,7 +102,7 @@ Scout. 1. Generate an organization access token for accessing Scout. For more details, see [Create an organization access - token](/enterprise/security/access-tokens/#create-an-organization-access-token). + token](/enterprise/platform/security/access-tokens/personal-access-tokens/#create-an-organization-access-token). 2. Sign in to Docker using the organization access token. ```console diff --git a/content/manuals/scout/integrations/registry/ecr.md b/content/manuals/scout/integrations/registry/ecr.md index a326e485434e..268667f01565 100644 --- a/content/manuals/scout/integrations/registry/ecr.md +++ b/content/manuals/scout/integrations/registry/ecr.md @@ -228,7 +228,7 @@ what the integration provided. 4. Set up your Scout credentials. 1. Generate an organization access token. For more details, see - [Create an organization access token](/enterprise/security/access-tokens/#create-an-organization-access-token). + [Create an organization access token](/enterprise/platform/security/access-tokens/personal-access-tokens/#create-an-organization-access-token). 2. Sign in to Docker using the organization access token. ```console diff --git a/content/manuals/security/faqs/_index.md b/content/manuals/security/faqs/_index.md deleted file mode 100644 index 4aebbca68bbb..000000000000 --- a/content/manuals/security/faqs/_index.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -build: - render: never -title: FAQs -weight: 70 ---- diff --git a/content/manuals/unassociated-machines/_index.md b/content/manuals/unassociated-machines/_index.md index 48e7e9986adb..cc8a9e0ea8fa 100644 --- a/content/manuals/unassociated-machines/_index.md +++ b/content/manuals/unassociated-machines/_index.md @@ -72,12 +72,12 @@ You can: > [!NOTE] > > Sign-in enforcement for unassociated machines is different from -> the [organization-level sign-in enforcement](/enterprise/security/enforce-sign-in/) +> the [organization-level sign-in enforcement](/platform/security/authentication/enforce-sign-in/) > available through `registry.json` and configuration profiles. This sign-in > enforcement only requires users to sign in so admins can identify who is > using the machine, meaning users can sign in with any email address. For more > stringent security controls that limit sign-ins to users who are already part -> of your organization, see [Enforce sign-in](/enterprise/security/enforce-sign-in/). +> of your organization, see [Enforce sign-in](/platform/security/authentication/enforce-sign-in/). Sign-in enforcement helps you identify who is using unassociated machines in your organization. When you enable enforcement, users on these machines will @@ -160,9 +160,9 @@ organization in two ways: - Auto-provisioning: If you have verified domains with auto-provisioning enabled, users who sign in with a matching email domain will automatically be added to your organization. For more information on verifying domains and - auto-provisioning, see [Domain management](/enterprise/security/domain-management). + auto-provisioning, see [Domain management](/platform/security/provisioning/domain-management). - SSO user provisioning: If you have SSO configured with - [Just-in-Time provisioning](/manuals/enterprise/security/provisioning/just-in-time.md), + [Just-in-Time provisioning](/manuals/platform/security/provisioning/just-in-time.md), users who sign in through your SSO connection will automatically be added to your organization. - Manual addition: If you don't have auto-provisioning or SSO set up, or if a diff --git a/content/reference/api/hub/latest.yaml b/content/reference/api/hub/latest.yaml index 38034331654a..9902731c1cc6 100644 --- a/content/reference/api/hub/latest.yaml +++ b/content/reference/api/hub/latest.yaml @@ -101,7 +101,7 @@ tags: - name: access-tokens x-displayName: Personal Access Tokens description: | - The Personal Access Token endpoints lets you manage personal access tokens. For more information, see [Access Tokens](https://docs.docker.com/security/access-tokens/). + The Personal Access Token endpoints lets you manage personal access tokens. For more information, see [Access Tokens](https://docs.docker.com/platform/security/access-tokens/personal-access-tokens/). You can use a personal access token instead of a password in the [Docker CLI](https://docs.docker.com/engine/reference/commandline/cli/) or in the [Create an authentication token](#operation/PostUsersLogin) route to obtain a bearer token. diff --git a/data/redirects.yml b/data/redirects.yml index 456923e33322..7a8ce4002db2 100644 --- a/data/redirects.yml +++ b/data/redirects.yml @@ -10,7 +10,7 @@ # in its help output, which can be redirected to elsewhere in the documentation. "/learn/": - /learn -"/security/access-tokens/": +"/platform/security/access-tokens/personal-access-tokens/": - /go/access-tokens/ "/agentic-platform/": - /go/dap/ From 4a678d9f458cf3464a89f5c271d9e89c49edeebd Mon Sep 17 00:00:00 2001 From: Alexa Date: Thu, 27 Aug 2026 11:41:48 -0500 Subject: [PATCH 2/4] Move Hardened Docker Desktop out of enterprise/security. Promote Hardened Docker Desktop to a top-level Enterprise section so the sidebar reads Admin, Deploy Docker Desktop, then Hardened Docker Desktop, and preserve old URLs with aliases. Co-authored-by: Cursor --- content/guides/admin-set-up.md | 12 ++--- content/guides/admin-user-management.md | 2 +- content/guides/zscaler.md | 2 +- content/manuals/_index.md | 4 ++ content/manuals/admin/_index.md | 2 +- content/manuals/admin/insights.md | 6 +-- content/manuals/admin/organization/_index.md | 2 +- .../admin/organization/manage/_index.md | 2 +- .../organization/manage/manage-products.md | 10 ++-- .../admin/organization/organization-faqs.md | 2 +- .../admin/organization/setup/_index.md | 2 +- .../admin/organization/setup/onboard.md | 10 ++-- content/manuals/ai/gordon/_index.md | 2 +- .../ai/gordon/concepts/data-privacy.md | 4 +- .../ai/gordon/how-to/configure-tools.md | 2 +- .../manuals/ai/gordon/how-to/permissions.md | 2 +- .../features/networking/networking-how-tos.md | 2 +- .../manuals/desktop/features/wsl/_index.md | 2 +- content/manuals/desktop/release-notes.md | 52 +++++++++---------- .../settings-and-maintenance/settings.md | 12 ++--- .../desktop/setup/install/mac-install.md | 2 +- .../install/mac-permission-requirements.md | 2 +- .../desktop/setup/install/windows-install.md | 2 +- .../windows-permission-requirements.md | 2 +- content/manuals/desktop/setup/sign-in.md | 2 +- .../manuals/desktop/use-desktop/kubernetes.md | 8 +-- content/manuals/docker-hub/release-notes.md | 2 +- .../enterprise-deployment/_index.md | 2 +- .../msi-install-and-configure.md | 2 +- .../{security => }/hardened-desktop/_index.md | 21 +++++--- .../hardened-desktop/air-gapped-containers.md | 11 ++-- .../enhanced-container-isolation/_index.md | 5 +- .../enhanced-container-isolation/config.md | 9 ++-- .../enable-eci.md | 12 +++-- .../enhanced-container-isolation/faq.md | 9 ++-- .../limitations.md | 1 + .../image-access-management.md | 3 +- .../hardened-desktop/namespace-access.md | 2 + .../registry-access-management.md | 3 +- .../settings-management/_index.md | 9 ++-- .../compliance-reporting.md | 1 + .../configure-admin-console.md | 1 + .../configure-json-file.md | 1 + .../settings-management/settings-reference.md | 5 +- content/manuals/enterprise/security/_index.md | 46 ---------------- .../manuals/extensions/private-marketplace.md | 12 ++--- .../manuals/extensions/settings-feedback.md | 2 +- content/manuals/faqs/general.md | 2 +- content/manuals/faqs/networking-and-vms.md | 2 +- content/manuals/platform-release-notes.md | 10 ++-- .../security/images/jit-disabled-flow.svg | 0 .../security/images/jit-enabled-flow.svg | 0 .../security/security-announcements.md | 8 +-- data/redirects.yml | 2 +- 54 files changed, 157 insertions(+), 178 deletions(-) rename content/manuals/enterprise/{security => }/hardened-desktop/_index.md (86%) rename content/manuals/enterprise/{security => }/hardened-desktop/air-gapped-containers.md (90%) rename content/manuals/enterprise/{security => }/hardened-desktop/enhanced-container-isolation/_index.md (97%) rename content/manuals/enterprise/{security => }/hardened-desktop/enhanced-container-isolation/config.md (94%) rename content/manuals/enterprise/{security => }/hardened-desktop/enhanced-container-isolation/enable-eci.md (88%) rename content/manuals/enterprise/{security => }/hardened-desktop/enhanced-container-isolation/faq.md (89%) rename content/manuals/enterprise/{security => }/hardened-desktop/enhanced-container-isolation/limitations.md (98%) rename content/manuals/enterprise/{security => }/hardened-desktop/image-access-management.md (97%) rename content/manuals/enterprise/{security => }/hardened-desktop/namespace-access.md (97%) rename content/manuals/enterprise/{security => }/hardened-desktop/registry-access-management.md (97%) rename content/manuals/enterprise/{security => }/hardened-desktop/settings-management/_index.md (89%) rename content/manuals/enterprise/{security => }/hardened-desktop/settings-management/compliance-reporting.md (98%) rename content/manuals/enterprise/{security => }/hardened-desktop/settings-management/configure-admin-console.md (98%) rename content/manuals/enterprise/{security => }/hardened-desktop/settings-management/configure-json-file.md (99%) rename content/manuals/enterprise/{security => }/hardened-desktop/settings-management/settings-reference.md (98%) delete mode 100644 content/manuals/enterprise/security/_index.md rename content/manuals/{enterprise => platform}/security/images/jit-disabled-flow.svg (100%) rename content/manuals/{enterprise => platform}/security/images/jit-enabled-flow.svg (100%) diff --git a/content/guides/admin-set-up.md b/content/guides/admin-set-up.md index 5298ab58f388..8947dec46184 100644 --- a/content/guides/admin-set-up.md +++ b/content/guides/admin-set-up.md @@ -142,7 +142,7 @@ If you suspect your company has multiple Docker organizations: ### Gather requirements -[Settings Management](/manuals/enterprise/security/hardened-desktop/settings-management/_index.md) lets you preset numerous configuration parameters for Docker Desktop. +[Settings Management](/manuals/enterprise/hardened-desktop/settings-management/_index.md) lets you preset numerous configuration parameters for Docker Desktop. Work with the following stakeholders to establish your company's baseline configuration: @@ -158,7 +158,7 @@ Review these areas together: for Docker Desktop users - Additional Docker products included in your subscriptions -To view the parameters that can be preset, see [Configure Settings Management](/manuals/enterprise/security/hardened-desktop/settings-management/configure-json-file.md#step-two-configure-the-settings-you-want-to-lock-in). +To view the parameters that can be preset, see [Configure Settings Management](/manuals/enterprise/hardened-desktop/settings-management/configure-json-file.md#step-two-configure-the-settings-you-want-to-lock-in). ### Optional: Meet with the Docker Implementation team @@ -172,8 +172,8 @@ To schedule a meeting, email successteam@docker.com. ### Send finalized settings files to the MDM team After reaching an agreement with the relevant teams about your baseline and -security configurations as outlined in the previous section, configure Settings Management either via [Docker Home](/manuals/enterprise/security/hardened-desktop/settings-management/configure-admin-console.md) or with an -[`admin-settings.json` file](/manuals/enterprise/security/hardened-desktop/settings-management/configure-json-file.md). +security configurations as outlined in the previous section, configure Settings Management either via [Docker Home](/manuals/enterprise/hardened-desktop/settings-management/configure-admin-console.md) or with an +[`admin-settings.json` file](/manuals/enterprise/hardened-desktop/settings-management/configure-json-file.md). Once the file is ready, collaborate with your MDM team to deploy your chosen settings, along with your chosen method for [enforcing sign-in](/manuals/platform/security/authentication/enforce-sign-in/_index.md). @@ -261,7 +261,7 @@ SSO and SCIM setup. > Communicate with your users before proceeding, as this step will impact all > existing users signing into your Docker organization. -If you plan to use [Registry Access Management (RAM)](/manuals/enterprise/security/hardened-desktop/registry-access-management.md) and/or [Image Access Management (IAM)](/manuals/enterprise/security/hardened-desktop/image-access-management.md): +If you plan to use [Registry Access Management (RAM)](/manuals/enterprise/hardened-desktop/registry-access-management.md) and/or [Image Access Management (IAM)](/manuals/enterprise/hardened-desktop/image-access-management.md): 1. Ensure your test developer signs in to Docker Desktop using their organization credentials @@ -327,4 +327,4 @@ To continue optimizing your Docker environment: - Review your [organization's usage data](/manuals/admin/insights.md) to track adoption - Monitor [Docker Scout findings](/manuals/scout/explore/analysis.md) for security insights -- Explore [additional security features](/manuals/enterprise/security/_index.md) to enhance your configuration +- Explore [additional security features](/manuals/enterprise/hardened-desktop/_index.md) to enhance your configuration diff --git a/content/guides/admin-user-management.md b/content/guides/admin-user-management.md index 413aa13d192c..f054ad47717c 100644 --- a/content/guides/admin-user-management.md +++ b/content/guides/admin-user-management.md @@ -194,5 +194,5 @@ Now that you've mastered user and access management in Docker, you can: - Review your [activity logs](/manuals/admin/activity-logs.md) regularly to maintain security awareness - Check your [Insights dashboard](/manuals/admin/insights.md) to identify opportunities for optimization -- Explore [advanced security features](/manuals/enterprise/security/_index.md) to further enhance your Docker environment +- Explore [advanced security features](/manuals/enterprise/hardened-desktop/_index.md) to further enhance your Docker environment - Share best practices with your team to ensure consistent adoption of security policies diff --git a/content/guides/zscaler.md b/content/guides/zscaler.md index c705e34e526a..80a8a0640b4a 100644 --- a/content/guides/zscaler.md +++ b/content/guides/zscaler.md @@ -47,7 +47,7 @@ necessary. If you are not using Zscaler as a system-level proxy, manually configure proxy settings in Docker Desktop. Set up proxy settings for all clients in the -organization using [Settings Management](/manuals/enterprise/security/hardened-desktop/settings-management/_index.md), +organization using [Settings Management](/manuals/enterprise/hardened-desktop/settings-management/_index.md), or edit proxy configuration in the Docker Desktop GUI under [**Settings > Resources > Proxies**](/manuals/desktop/settings-and-maintenance/settings.md#proxies). ## Install root certificates in Docker images diff --git a/content/manuals/_index.md b/content/manuals/_index.md index 2d9623682077..befcaf0dd5f2 100644 --- a/content/manuals/_index.md +++ b/content/manuals/_index.md @@ -104,6 +104,10 @@ params: description: Deploy Docker Desktop at scale within your company icon: arrow-down-tray link: /enterprise/enterprise-deployment/ + - title: Hardened Docker Desktop + description: Security features that strengthen developer environments. + icon: shield-check + link: /enterprise/hardened-desktop/ --- This section contains user guides on how to install, set up, configure, and use diff --git a/content/manuals/admin/_index.md b/content/manuals/admin/_index.md index 780462e3d624..224820580228 100644 --- a/content/manuals/admin/_index.md +++ b/content/manuals/admin/_index.md @@ -22,7 +22,7 @@ grid: - title: Security description: Explore security features for administrators. icon: shield-check - link: /enterprise/security/ + link: /platform/security/ aliases: - /docker-hub/admin-overview --- diff --git a/content/manuals/admin/insights.md b/content/manuals/admin/insights.md index b48507ad37ca..8a6ff5d6567a 100644 --- a/content/manuals/admin/insights.md +++ b/content/manuals/admin/insights.md @@ -61,7 +61,7 @@ The chart contains the following data: | :--------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Active user | The number of users who have actively used Docker Desktop and either signed in with a Docker account that has a license in your organization or signed in to a Docker account with an email address from a domain associated with your organization.

Users who don’t sign in to an account associated with your organization are not represented in the data. To ensure users sign in with an account associated with your organization, you can [enforce sign-in](/manuals/platform/security/authentication/enforce-sign-in/_index.md). | | Total organization members | The number of users who have used Docker Desktop, regardless of their Insights activity. | -| Users opted out of analytics | The number of users who are members of your organization that have opted out of sending analytics.

When users opt out of sending analytics, you won't see any of their data in Insights. To ensure that the data includes all users, you can use [Settings Management](/manuals/enterprise/security/hardened-desktop/settings-management/_index.md) to set `analyticsEnabled` for all your users. | +| Users opted out of analytics | The number of users who are members of your organization that have opted out of sending analytics.

When users opt out of sending analytics, you won't see any of their data in Insights. To ensure that the data includes all users, you can use [Settings Management](/manuals/enterprise/hardened-desktop/settings-management/_index.md) to set `analyticsEnabled` for all your users. | | Active users (graph) | The view over time for total active users. | ### Builds @@ -173,7 +173,7 @@ A Docker Desktop user export file contains the following data points: installed - Last Seen Date: The last date the user used the Docker Desktop application - Opted Out Analytics: Whether the user has opted out of the - [Send usage statistics](/manuals/enterprise/security/hardened-desktop/settings-management/settings-reference.md#send-usage-statistics) setting in Docker Desktop + [Send usage statistics](/manuals/enterprise/hardened-desktop/settings-management/settings-reference.md#send-usage-statistics) setting in Docker Desktop ## Troubleshoot Insights @@ -191,7 +191,7 @@ solutions to resolve common problems: If users have opted out of sending usage statistics for Docker Desktop, then their usage data will not be a part of Insights. To manage the setting at scale for all your users, you can use [Settings - Management](/manuals/enterprise/security/hardened-desktop/settings-management/_index.md) and turn on the + Management](/manuals/enterprise/hardened-desktop/settings-management/_index.md) and turn on the `analyticsEnabled` setting. - Ensure users use Docker Desktop and aren't using the standalone diff --git a/content/manuals/admin/organization/_index.md b/content/manuals/admin/organization/_index.md index 91084750c4dd..aec33fa838bc 100644 --- a/content/manuals/admin/organization/_index.md +++ b/content/manuals/admin/organization/_index.md @@ -26,7 +26,7 @@ grid: Start here to manage security and access for your organization, including single sign-on, provisioning, and image and registry access management. icon: shield-check - link: /enterprise/security/ + link: /platform/security/ --- A Docker organization is a collection of teams and repositories under diff --git a/content/manuals/admin/organization/manage/_index.md b/content/manuals/admin/organization/manage/_index.md index 531bc47d0250..f6854f955395 100644 --- a/content/manuals/admin/organization/manage/_index.md +++ b/content/manuals/admin/organization/manage/_index.md @@ -16,7 +16,7 @@ grid: - title: Security description: Configure single sign-on, provisioning, and access management. icon: shield-check - link: /enterprise/security/ + link: /platform/security/ - title: Billing description: Manage payment methods and view billing history. icon: credit-card diff --git a/content/manuals/admin/organization/manage/manage-products.md b/content/manuals/admin/organization/manage/manage-products.md index e9530e50c14b..4ed394b5a99e 100644 --- a/content/manuals/admin/organization/manage/manage-products.md +++ b/content/manuals/admin/organization/manage/manage-products.md @@ -39,9 +39,9 @@ To manage Docker Hub access: 1. Sign in to [Docker Home](https://app.docker.com/) and select your organization, then select **Docker Desktop**. 1. Select **Registry Access** to configure - [Registry Access Management](../../../enterprise/security/hardened-desktop/registry-access-management.md). + [Registry Access Management](../../../enterprise/hardened-desktop/registry-access-management.md). 1. Select **Image Access** to control - [Image Access Management](../../../enterprise/security/hardened-desktop/image-access-management.md). + [Image Access Management](../../../enterprise/hardened-desktop/image-access-management.md). ### Docker Build Cloud access @@ -72,7 +72,7 @@ To manage Docker Scout access: [repository settings](../../../scout/explore/dashboard.md#repository-settings). 1. To manage access to Docker Scout for use on local images with Docker Desktop, use - [Settings Management](../../../enterprise/security/hardened-desktop/settings-management/_index.md) + [Settings Management](../../../enterprise/hardened-desktop/settings-management/_index.md) and set `sbomIndexing` to `false` to disable, or to `true` to enable. ### Testcontainers Cloud access @@ -98,7 +98,7 @@ To manage access to Testcontainers Cloud: > subscribe. To manage Docker Offload access for your organization, use [Settings -Management](../../../enterprise/security/hardened-desktop/settings-management/_index.md): +Management](../../../enterprise/hardened-desktop/settings-management/_index.md): 1. Sign in to [Docker Home](https://app.docker.com/), then select **Docker Desktop**. @@ -123,7 +123,7 @@ Management](../../../enterprise/security/hardened-desktop/settings-management/_i 1. Select **Save**. For more details on Settings Management, see the [Settings -reference](../../../enterprise/security/hardened-desktop/settings-management/settings-reference.md#enable-docker-offload). +reference](../../../enterprise/hardened-desktop/settings-management/settings-reference.md#enable-docker-offload). ## Monitor product usage for your organization diff --git a/content/manuals/admin/organization/organization-faqs.md b/content/manuals/admin/organization/organization-faqs.md index a76fc447ca89..7ea67a06184f 100644 --- a/content/manuals/admin/organization/organization-faqs.md +++ b/content/manuals/admin/organization/organization-faqs.md @@ -33,7 +33,7 @@ Yes. You can Some benefits of enforcing sign-in are: - Ensures users receive the benefits of your subscription. -- Ensures security features like [Image Access Management](/manuals/enterprise/security/hardened-desktop/image-access-management.md) and [Registry Access Management](/manuals/enterprise/security/hardened-desktop/registry-access-management.md) are applied. +- Ensures security features like [Image Access Management](/manuals/enterprise/hardened-desktop/image-access-management.md) and [Registry Access Management](/manuals/enterprise/hardened-desktop/registry-access-management.md) are applied. - Ensures you gain insights into users' activity. ### Can I convert my personal Docker ID to an organization account? diff --git a/content/manuals/admin/organization/setup/_index.md b/content/manuals/admin/organization/setup/_index.md index 94d2d27f327c..1a30cc663c26 100644 --- a/content/manuals/admin/organization/setup/_index.md +++ b/content/manuals/admin/organization/setup/_index.md @@ -28,7 +28,7 @@ grid: - title: Security description: Configure single sign-on, provisioning, and access management. icon: shield-check - link: /enterprise/security/ + link: /platform/security/ --- Before you manage members and access, set up your Docker organization. You can diff --git a/content/manuals/admin/organization/setup/onboard.md b/content/manuals/admin/organization/setup/onboard.md index 88b609b77bff..e77ed85ef52f 100644 --- a/content/manuals/admin/organization/setup/onboard.md +++ b/content/manuals/admin/organization/setup/onboard.md @@ -150,7 +150,7 @@ By default, members of your organization can use Docker Desktop without signing in. When users don’t sign in as a member of your organization, they don’t receive the [benefits of your organization’s subscription](https://www.docker.com/pricing?ref=Docs&refAction=DocsAdminOnboard) -and they can circumvent [Docker’s security features](/manuals/enterprise/security/hardened-desktop/_index.md). +and they can circumvent [Docker’s security features](/manuals/enterprise/hardened-desktop/_index.md). There are multiple ways you can enforce sign-in, depending on your organization's Docker configuration: @@ -164,14 +164,14 @@ Docker configuration: Docker offers the following security features to manage your organization's security posture: -- [Image Access Management](/manuals/enterprise/security/hardened-desktop/image-access-management.md): Control which types of images your developers can pull from Docker Hub. -- [Registry Access Management](/manuals/enterprise/security/hardened-desktop/registry-access-management.md): Define which registries your developers can access. -- [Settings management](/manuals/enterprise/security/hardened-desktop/settings-management.md): Set and control Docker Desktop settings for your users. +- [Image Access Management](/manuals/enterprise/hardened-desktop/image-access-management.md): Control which types of images your developers can pull from Docker Hub. +- [Registry Access Management](/manuals/enterprise/hardened-desktop/registry-access-management.md): Define which registries your developers can access. +- [Settings management](/manuals/enterprise/hardened-desktop/settings-management.md): Set and control Docker Desktop settings for your users. ## Next steps - [Manage Docker products](../manage/manage-products.md) to configure access and view usage. -- Configure [Hardened Docker Desktop](/manuals/enterprise/security/hardened-desktop/_index.md) to improve your organization’s security posture for containerized development. +- Configure [Hardened Docker Desktop](/manuals/enterprise/hardened-desktop/_index.md) to improve your organization’s security posture for containerized development. - [Manage your domains](/manuals/platform/security/provisioning/domain-management.md) to ensure that all Docker users in your domain are part of your organization. Your Docker subscription provides many more additional features. To learn more, diff --git a/content/manuals/ai/gordon/_index.md b/content/manuals/ai/gordon/_index.md index 6b586e91c999..c4809547468a 100644 --- a/content/manuals/ai/gordon/_index.md +++ b/content/manuals/ai/gordon/_index.md @@ -67,7 +67,7 @@ Before you begin: > 1. Contact Docker Support to activate Gordon for your organization. Docker > will confirm when activation is complete. > 2. Once confirmed, an organization administrator must turn on Gordon via -> [Settings Management](/manuals/enterprise/security/hardened-desktop/settings-management/_index.md). +> [Settings Management](/manuals/enterprise/hardened-desktop/settings-management/_index.md). > Set **Enable Gordon** to **Enabled** or **Always enabled**. Ensure all > Settings Management prerequisites are met for the setting to take effect > on Docker Desktop clients. diff --git a/content/manuals/ai/gordon/concepts/data-privacy.md b/content/manuals/ai/gordon/concepts/data-privacy.md index 38f5a5b49acb..c85dbcffc827 100644 --- a/content/manuals/ai/gordon/concepts/data-privacy.md +++ b/content/manuals/ai/gordon/concepts/data-privacy.md @@ -95,7 +95,7 @@ For Business subscriptions, administrators can enable or disable Gordon for their organization using Settings Management. Review your organization's data handling requirements before enabling Gordon. -See [Settings Management](/enterprise/security/hardened-desktop/settings-management/) +See [Settings Management](/enterprise/hardened-desktop/settings-management/) for configuration details. ## Disabling Gordon @@ -112,7 +112,7 @@ Individual users: Business organizations: Administrators can disable Gordon for the entire organization using Settings -Management. See [Settings Management](/enterprise/security/hardened-desktop/settings-management/) +Management. See [Settings Management](/enterprise/hardened-desktop/settings-management/) for details. ## Questions about privacy diff --git a/content/manuals/ai/gordon/how-to/configure-tools.md b/content/manuals/ai/gordon/how-to/configure-tools.md index 90c3b6ae11f7..e016b41e6538 100644 --- a/content/manuals/ai/gordon/how-to/configure-tools.md +++ b/content/manuals/ai/gordon/how-to/configure-tools.md @@ -77,5 +77,5 @@ Administrators can: - Lock tool configuration to prevent users from changing it - Set organization-wide tool policies -See [Settings Management](/enterprise/security/hardened-desktop/settings-management/) +See [Settings Management](/enterprise/hardened-desktop/settings-management/) for details. diff --git a/content/manuals/ai/gordon/how-to/permissions.md b/content/manuals/ai/gordon/how-to/permissions.md index 3e08cfb3c58a..0fda05508464 100644 --- a/content/manuals/ai/gordon/how-to/permissions.md +++ b/content/manuals/ai/gordon/how-to/permissions.md @@ -121,5 +121,5 @@ Available controls: For Business subscriptions, Gordon must be enabled by an administrator before users can access it. -See [Settings Management](/enterprise/security/hardened-desktop/settings-management/) +See [Settings Management](/enterprise/hardened-desktop/settings-management/) for details. diff --git a/content/manuals/desktop/features/networking/networking-how-tos.md b/content/manuals/desktop/features/networking/networking-how-tos.md index 6591a3abb671..cc8db7d6b76a 100644 --- a/content/manuals/desktop/features/networking/networking-how-tos.md +++ b/content/manuals/desktop/features/networking/networking-how-tos.md @@ -97,7 +97,7 @@ For more details on proxies and proxy configurations, see the [Proxy settings do You can control how Docker handles container networking and DNS resolution to better support a range of environments — from IPv4-only to dual-stack and IPv6-only systems. These settings help prevent timeouts and connectivity issues caused by incompatible or misconfigured host networks. -You can set the following settings on the **Network** tab in the Docker Desktop Dashboard settings, or if you're an admin, with Settings Management via the [`admin-settings.json` file](/manuals/enterprise/security/hardened-desktop/settings-management/configure-json-file.md#networking), or [Docker Home](/manuals/enterprise/security/hardened-desktop/settings-management/configure-admin-console.md) +You can set the following settings on the **Network** tab in the Docker Desktop Dashboard settings, or if you're an admin, with Settings Management via the [`admin-settings.json` file](/manuals/enterprise/hardened-desktop/settings-management/configure-json-file.md#networking), or [Docker Home](/manuals/enterprise/hardened-desktop/settings-management/configure-admin-console.md) > [!NOTE] > diff --git a/content/manuals/desktop/features/wsl/_index.md b/content/manuals/desktop/features/wsl/_index.md index 080e9d1bac09..2d6692fc6cd1 100644 --- a/content/manuals/desktop/features/wsl/_index.md +++ b/content/manuals/desktop/features/wsl/_index.md @@ -97,7 +97,7 @@ WSL is designed to aid interoperability between Windows and Linux environments. For environments that require stricter isolation: - Run Docker Desktop in Hyper-V mode instead of WSL 2 to avoid the shared-kernel model entirely. -- Enable [Enhanced Container Isolation](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/_index.md) to add an additional layer of protection around container workloads regardless of backend. +- Enable [Enhanced Container Isolation](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/_index.md) to add an additional layer of protection around container workloads regardless of backend. ## Additional resources diff --git a/content/manuals/desktop/release-notes.md b/content/manuals/desktop/release-notes.md index f6ed578bfe3a..c6b7954e1292 100644 --- a/content/manuals/desktop/release-notes.md +++ b/content/manuals/desktop/release-notes.md @@ -1446,7 +1446,7 @@ For more frequently asked questions, see the [FAQs](/manuals/desktop/troubleshoo ### Security -- Added security patches to address CVEs [2025-52565](https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2), [2025-52881](https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm), and [2025-31133](https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r) when using [Enhanced Container Isolation](https://docs.docker.com/enterprise/security/hardened-desktop/enhanced-container-isolation). +- Added security patches to address CVEs [2025-52565](https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2), [2025-52881](https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm), and [2025-31133](https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r) when using [Enhanced Container Isolation](https://docs.docker.com/enterprise/hardened-desktop/enhanced-container-isolation). ## 4.52.0 @@ -1604,7 +1604,7 @@ For more frequently asked questions, see the [FAQs](/manuals/desktop/troubleshoo ### Security -- Fixed [CVE-2025-10657](https://www.cve.org/CVERecord?id=CVE-2025-10657) where the Enhanced Container Isolation [Docker Socket command restrictions](../enterprise/security/hardened-desktop/enhanced-container-isolation/config.md#command-restrictions) feature was not working properly in Docker Desktop 4.46.0 only (the configuration for it was being ignored). +- Fixed [CVE-2025-10657](https://www.cve.org/CVERecord?id=CVE-2025-10657) where the Enhanced Container Isolation [Docker Socket command restrictions](../enterprise/hardened-desktop/enhanced-container-isolation/config.md#command-restrictions) feature was not working properly in Docker Desktop 4.46.0 only (the configuration for it was being ignored). ### New @@ -1649,7 +1649,7 @@ For more frequently asked questions, see the [FAQs](/manuals/desktop/troubleshoo ### New - Added a new Learning center walkthrough for Docker MCP Toolkit and other onboarding improvements. -- Administrators can now control [PAC configurations with Settings Management](/manuals/enterprise/security/hardened-desktop/settings-management/configure-json-file.md#proxy-settings). +- Administrators can now control [PAC configurations with Settings Management](/manuals/enterprise/hardened-desktop/settings-management/configure-json-file.md#proxy-settings). - The update experience has been redesigned to make it easier to understand and manage updates for Docker Desktop and its components. ### Upgrades @@ -1785,9 +1785,9 @@ We are aware of [CVE-2025-23266](https://nvd.nist.gov/vuln/detail/CVE-2025-23266 - Fixed an issue pulling images with zstd differential layers when the containerd image store is enabled. - Fixed a bug causing containers launching with the `--restart` flag to not restart properly when using Enhanced Container Isolation. -- Improved interaction between [Kubernetes custom registry images](/manuals/desktop/use-desktop/kubernetes.md#configuring-a-custom-image-registry-for-kubernetes-control-plane-images) and Enhanced Container Isolation (ECI), so the [ECI Docker Socket image list](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/config.md) no longer needs to be manually updated when using a custom registry for Kubernetes control plane images. +- Improved interaction between [Kubernetes custom registry images](/manuals/desktop/use-desktop/kubernetes.md#configuring-a-custom-image-registry-for-kubernetes-control-plane-images) and Enhanced Container Isolation (ECI), so the [ECI Docker Socket image list](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/config.md) no longer needs to be manually updated when using a custom registry for Kubernetes control plane images. - Fixed a bug where a Docker Desktop Kubernetes cluster in kind mode fails to start after restarting Docker Desktop if the user is required to be signed in but is currently signed out. -- Fixed a bug that prevented the mounting of MCP secrets into containers when [Enhanced Container Isolation](/enterprise/security/hardened-desktop/enhanced-container-isolation/) is enabled. +- Fixed a bug that prevented the mounting of MCP secrets into containers when [Enhanced Container Isolation](/enterprise/hardened-desktop/enhanced-container-isolation/) is enabled. - Fixed a bug preventing the use of `--publish-all` when `--publish` was already specified. - Fixed a bug causing the **Images** view to scroll infinitely. Fixes [docker/for-mac#7725](https://github.com/docker/for-mac/issues/7725). - Fixed a bug which caused the **Volumes** tab to be blank while in Resource Saver mode. @@ -2046,7 +2046,7 @@ We are aware of [CVE-2025-23266](https://nvd.nist.gov/vuln/detail/CVE-2025-23266 - Improved error messages when downloading Registry Access Management configuration. - If Docker can't bind an ICMPv4 socket, it now logs an error and continues rather than quits. - Enabled the memory protection keys mechanism in the Docker Desktop Linux VM, allowing containers like Oracle database images to run correctly. -- Fixed a problem with containers accessing `/proc/sys/kernel/shm*` sysctls when [Enhanced Container Isolation](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/_index.md) is enabled on Mac, Windows Hyper-V, or Linux. +- Fixed a problem with containers accessing `/proc/sys/kernel/shm*` sysctls when [Enhanced Container Isolation](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/_index.md) is enabled on Mac, Windows Hyper-V, or Linux. - Added kernel module `nft_fib_inet`, required for running firewalld in a Linux container. - MacOS QEMU Virtualization option is being deprecated on July 14, 2025. @@ -2203,7 +2203,7 @@ We are aware of [CVE-2025-23266](https://nvd.nist.gov/vuln/detail/CVE-2025-23266 #### For all platforms - Fixed a bug where access tokens generated by the `docker login` web flow could not be refreshed by Docker Desktop. -- Fixed a bug where container creation via the Docker API using `curl` failed when [Enhanced Container Isolation](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/_index.md) was enabled. +- Fixed a bug where container creation via the Docker API using `curl` failed when [Enhanced Container Isolation](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/_index.md) was enabled. - Fixed a bug where the RAM policy was not refreshed after the refresh period had elapsed. - Fixed a bug in Enhanced Container Isolation when mounting the Docker socket into a container, and then creating Docker containers with bind-mounts from within that container. - Fixed an issue that caused a discrepancy between the GUI and the CLI, the former forcing the `0.0.0.0` HostIP in port-mappings. This caused default binding IPs configured through Engine's `ip` flag, or through the bridge option `com.docker.network.bridge.host_binding_ipv4`, to not be used. @@ -2262,7 +2262,7 @@ We are aware of [CVE-2025-23266](https://nvd.nist.gov/vuln/detail/CVE-2025-23266 #### For all platforms - Fixed an issue that caused the AI Catalog in Docker Hub to be unavailable in Docker Desktop. -- Fixed an issue that caused Docker Desktop to panic with `index out of range [0] with length 0` when using [Enhanced Container Isolation](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/_index.md). +- Fixed an issue that caused Docker Desktop to panic with `index out of range [0] with length 0` when using [Enhanced Container Isolation](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/_index.md). ### Known issues @@ -2357,8 +2357,8 @@ We are aware of [CVE-2025-23266](https://nvd.nist.gov/vuln/detail/CVE-2025-23266 - Deploy Docker Desktop for Mac in bulk with the [PKG installer](/manuals/enterprise/enterprise-deployment/pkg-install-and-configure.md) (Early Access). - Use Desktop Settings Management to manage and enforce defaults via admin.docker.com (Early Access). - Enhance Container Isolation (ECI) has been improved to: - - Allow admins to [turn off Docker socket mount restrictions](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/config.md#allowing-all-containers-to-mount-the-docker-socket). - - Support wildcard tags when using the [`allowedDerivedImages` setting](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/config.md#docker-socket-mount-permissions-for-derived-images). + - Allow admins to [turn off Docker socket mount restrictions](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/config.md#allowing-all-containers-to-mount-the-docker-socket). + - Support wildcard tags when using the [`allowedDerivedImages` setting](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/config.md#docker-socket-mount-permissions-for-derived-images). ### Upgrades @@ -2462,7 +2462,7 @@ We are aware of [CVE-2025-23266](https://nvd.nist.gov/vuln/detail/CVE-2025-23266 - Fixed a bug where the **Push to Docker Hub** action in the **Images** view would result in an `invalid tag format` error. Fixes [docker/for-win#14258](https://github.com/docker/for-win/issues/14258). - Fixed an issue where Docker Desktop startup failed when ICMPv6 setup was not successful. - Added drivers that allow USB/IP to work. -- Fixed a bug in Enhanced Container Isolation (ECI) [Docker socket mount permissions for derived images](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/config.md) where it was incorrectly denying Docker socket mounts for some images when Docker Desktop uses the containerd image store. +- Fixed a bug in Enhanced Container Isolation (ECI) [Docker socket mount permissions for derived images](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/config.md) where it was incorrectly denying Docker socket mounts for some images when Docker Desktop uses the containerd image store. - Enable `NFT_NUMGEN`, `NFT_FIB_IPV4` and `NFT_FIB_IPV6` kernel modules. - Build UI: - Highlight build check warnings in the **Completed builds** list. @@ -2619,8 +2619,8 @@ We are aware of [CVE-2025-23266](https://nvd.nist.gov/vuln/detail/CVE-2025-23266 > [!NOTE] > Using `docker login` with an address that includes URL path segments is not a documented use case and is considered unsupported. The recommended usage is to specify only a registry hostname, and optionally a port, as the address for `docker login`. - When running `docker compose up` and Docker Desktop is in the Resource Saver mode, the command is unresponsive. As a workaround, manually exit the Resource Saving mode and Docker Compose becomes responsive again. -- When [Enhanced Container Isolation (ECI)](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/_index.md) is enabled, Docker Desktop may not enter Resource Saver mode. This will be fixed in a future Docker Desktop release. -- The new [ECI Docker socket mount permissions for derived images](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/config.md#docker-socket-mount-permissions-for-derived-images) feature does not yet work when Docker Desktop is configured with the **Use containerd for pulling and storing images**. This will be fixed in the next Docker Desktop release. +- When [Enhanced Container Isolation (ECI)](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/_index.md) is enabled, Docker Desktop may not enter Resource Saver mode. This will be fixed in a future Docker Desktop release. +- The new [ECI Docker socket mount permissions for derived images](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/config.md#docker-socket-mount-permissions-for-derived-images) feature does not yet work when Docker Desktop is configured with the **Use containerd for pulling and storing images**. This will be fixed in the next Docker Desktop release. ## 4.33.2 @@ -2766,7 +2766,7 @@ For more information, see [microsoft/WSL#11794](https://github.com/microsoft/WSL - Improved instructions for `watch` in the Compose File Viewer - Added support for Golang projects that don't have dependencies in Docker Init. Addresses [docker/roadmap#611](https://github.com/docker/roadmap/issues/611) -- [Settings Management](/manuals/enterprise/security/hardened-desktop/settings-management/_index.md) now lets admins set the default value to `ProxyEnableKerberosNTLM`. +- [Settings Management](/manuals/enterprise/hardened-desktop/settings-management/_index.md) now lets admins set the default value to `ProxyEnableKerberosNTLM`. - Removed a temporary compatibility fix for older versions of Visual Studio Code. - Builds view: - Changed icon for imported build record to a "files" icon. @@ -2821,7 +2821,7 @@ For more information, see [microsoft/WSL#11794](https://github.com/microsoft/WSL ### New -- [Air-Gapped Containers](/manuals/enterprise/security/hardened-desktop/air-gapped-containers.md) is now generally available. +- [Air-Gapped Containers](/manuals/enterprise/hardened-desktop/air-gapped-containers.md) is now generally available. - Docker Compose File Viewer shows your Compose YAML with syntax highlighting and contextual links to relevant docs (Beta, progressive rollout). - New Sidebar user experience. @@ -2845,7 +2845,7 @@ For more information, see [microsoft/WSL#11794](https://github.com/microsoft/WSL - Added `proxyEnableKerberosNTLM` config to `settings.json` to enable fallback to basic proxy authentication if Kerberos/NTLM environment is not properly set up. - Fixed a bug where Docker Debug was not working properly with Enhanced Container Isolation enabled. - Fixed a bug where UDP responses were not truncated properly. -- Fixed a bug where the **Update** screen was hidden when using [Settings Management](/manuals/enterprise/security/hardened-desktop/settings-management/_index.md). +- Fixed a bug where the **Update** screen was hidden when using [Settings Management](/manuals/enterprise/hardened-desktop/settings-management/_index.md). - Fixed a bug where proxy settings defined in `admin-settings.json` were not applied correctly on startup. - Fixed a bug where the **Manage Synchronized file shares with Compose** toggle did not correctly reflect the value with the feature. - Fixed a bug where a bind mounted file modified on host is not updated after the container restarts, when gRPC FUSE file sharing is used on macOS and on Windows with Hyper-V. Fixes [docker/for-mac#7274](https://github.com/docker/for-mac/issues/7274), [docker/for-win#14060](https://github.com/docker/for-win/issues/14060). @@ -2908,7 +2908,7 @@ For more information, see [microsoft/WSL#11794](https://github.com/microsoft/WSL #### For all platforms - Docker Desktop now supports [SOCKS5 proxies](/manuals/desktop/features/networking.md#socks5-proxy-support). Requires a Business subscription. -- Added a new setting to manage the onboarding survey in [Settings Management](/manuals/enterprise/security/hardened-desktop/settings-management/_index.md). +- Added a new setting to manage the onboarding survey in [Settings Management](/manuals/enterprise/hardened-desktop/settings-management/_index.md). #### For Windows @@ -2985,14 +2985,14 @@ This can be resolved by adding the user to the **docker-users** group. Before st ### New -- You can now enforce Rosetta usage via [Settings Management](/manuals/enterprise/security/hardened-desktop/settings-management/_index.md). -- [Docker socket mount restrictions](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/config.md) with ECI is now generally available. +- You can now enforce Rosetta usage via [Settings Management](/manuals/enterprise/hardened-desktop/settings-management/_index.md). +- [Docker socket mount restrictions](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/config.md) with ECI is now generally available. - Docker Engine and CLI updated to [Moby 26.0](https://github.com/moby/moby/releases/tag/v26.0.0). This includes Buildkit 0.13, sub volumes mounts, networking updates, and improvements to the containerd multi-platform image store UX. - New and improved Docker Desktop error screens: swift troubleshooting, easy diagnostics uploads, and actionable remediation. - Compose supports [Synchronized file shares (experimental)](/manuals/desktop/features/synchronized-file-sharing.md). - New [interactive Compose CLI (experimental)](/manuals/compose/how-tos/environment-variables/envvars.md#compose_menu). - Beta release of: - - Air-Gapped Containers with [Settings Management](/manuals/enterprise/security/hardened-desktop/air-gapped-containers.md). + - Air-Gapped Containers with [Settings Management](/manuals/enterprise/hardened-desktop/air-gapped-containers.md). - [Host networking](/manuals/engine/network/drivers/host.md#docker-desktop) in Docker Desktop. - [Docker Debug](use-desktop/container.md#integrated-terminal) for running containers. - [Volumes Backup & Share extension](use-desktop/volumes.md) functionality available in the **Volumes** tab. @@ -3063,7 +3063,7 @@ This can be resolved by adding the user to the **docker-users** group. Before st ### New -- [Settings Management](/manuals/enterprise/security/hardened-desktop/settings-management/_index.md) now allows admins to set the default file-sharing implementation and specify which paths developer can add file shares to. +- [Settings Management](/manuals/enterprise/hardened-desktop/settings-management/_index.md) now allows admins to set the default file-sharing implementation and specify which paths developer can add file shares to. - Added support for `socks5://` HTTP and HTTPS proxy URLs when the [`SOCKS` proxy support beta feature](/manuals/desktop/features/networking.md) is enabled. - Users can now filter volumes to see which ones are in use in the **Volumes** tab. @@ -3182,7 +3182,7 @@ This can be resolved by adding the user to the **docker-users** group. Before st - Docker init now supports Java and is generally available to all users. - [Synchronized File Shares](/manuals/desktop/features/synchronized-file-sharing.md) provides fast and flexible host-to-VM file sharing within Docker Desktop. Utilizing the technology behind [Docker’s acquisition of Mutagen](https://www.docker.com/blog/mutagen-acquisition/), this feature provides an alternative to virtual bind mounts that uses synchronized filesystem caches, improving performance for developers working with large codebases. -- Organization admins can now [configure Docker socket mount permissions](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/config.md) when ECI is enabled. +- Organization admins can now [configure Docker socket mount permissions](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/config.md) when ECI is enabled. - [Containerd Image Store](/manuals/desktop/features/containerd.md) support is now generally available to all users. - Get a debug shell into any container or image with the new [`docker debug` command](/reference/cli/docker/debug/) (Beta). - Organization admins, with a Docker Business subscription, can now configure a custom list of extensions with [Private Extensions Marketplace](/manuals/extensions/private-marketplace.md) enabled (Beta) @@ -3283,7 +3283,7 @@ This can be resolved by adding the user to the **docker-users** group. Before st ### New -- Administrators can now control access to beta and experimental features in the **Features in development** tab with [Settings Management](/manuals/enterprise/security/hardened-desktop/settings-management/_index.md). +- Administrators can now control access to beta and experimental features in the **Features in development** tab with [Settings Management](/manuals/enterprise/hardened-desktop/settings-management/_index.md). - Introduced four new version update states in the footer. - `docker init` (Beta) now supports PHP with Apache + Composer. - The [**Builds** view](use-desktop/builds.md) is now GA. You can now inspect builds, troubleshoot errors, and optimize build speed. @@ -3393,7 +3393,7 @@ This can be resolved by adding the user to the **docker-users** group. Before st - Rosetta is now Generally Available for all users on macOS 13 or later. It provides faster emulation of Intel-based images on Apple Silicon. To use Rosetta, see [Settings](/manuals/desktop/settings-and-maintenance/settings.md). Rosetta is enabled by default on macOS 14.1 and later. - Docker Desktop now detects if a WSL version is out of date. If an out dated version of WSL is detected, you can allow Docker Desktop to automatically update the installation or you can manually update WSL outside of Docker Desktop. - New installations of Docker Desktop for Windows now require a Windows version of 19044 or later. -- Administrators now have the ability to control Docker Scout image analysis in [Settings Management](/manuals/enterprise/security/hardened-desktop/settings-management/_index.md). +- Administrators now have the ability to control Docker Scout image analysis in [Settings Management](/manuals/enterprise/hardened-desktop/settings-management/_index.md). ### Upgrades @@ -3654,7 +3654,7 @@ This can be resolved by adding the user to the **docker-users** group. Before st #### For all platforms -- [Settings Management](/manuals/enterprise/security/hardened-desktop/settings-management/_index.md) now lets you turn off Docker Extensions for your organisation. +- [Settings Management](/manuals/enterprise/hardened-desktop/settings-management/_index.md) now lets you turn off Docker Extensions for your organisation. - Fixed a bug where turning on Kubernetes from the UI failed when the system was paused. - Fixed a bug where turning on Wasm from the UI failed when the system was paused. - Bind mounts are now shown when you [inspect a container](use-desktop/container.md). @@ -4286,7 +4286,7 @@ This can be resolved by adding the user to the **docker-users** group. Before st ### New -- Two new security features have been introduced for Docker Business users, Settings Management and Enhanced Container Isolation. Read more about Docker Desktop’s new [Hardened Docker Desktop security model](/manuals/enterprise/security/hardened-desktop/_index.md). +- Two new security features have been introduced for Docker Business users, Settings Management and Enhanced Container Isolation. Read more about Docker Desktop’s new [Hardened Docker Desktop security model](/manuals/enterprise/hardened-desktop/_index.md). - Added the new Dev Environments CLI `docker dev`, so you can create, list, and run Dev Envs via command line. Now it's easier to integrate Dev Envs into custom scripts. - Docker Desktop can now be installed to any drive and folder using the `--installation-dir`. Partially addresses [docker/roadmap#94](https://github.com/docker/roadmap/issues/94). diff --git a/content/manuals/desktop/settings-and-maintenance/settings.md b/content/manuals/desktop/settings-and-maintenance/settings.md index 32f91f922ed2..8882f02dff7b 100644 --- a/content/manuals/desktop/settings-and-maintenance/settings.md +++ b/content/manuals/desktop/settings-and-maintenance/settings.md @@ -24,7 +24,7 @@ You can also locate the `settings-store.json` file at: - Windows: `C:\Users\[USERNAME]\AppData\Roaming\Docker\settings-store.json` - Linux: `~/.docker/desktop/settings-store.json` -For information on enforcing settings at an organization level, see [Settings Management](/manuals/enterprise/security/hardened-desktop/settings-management/settings-reference.md). +For information on enforcing settings at an organization level, see [Settings Management](/manuals/enterprise/hardened-desktop/settings-management/settings-reference.md). ## General @@ -48,7 +48,7 @@ Configure startup behavior, UI appearance, terminal preferences, and feature def | **Choose file sharing implementation for your containers** | Choose whether you want to share files using **VirtioFS**, or **gRPC FUSE** | **VirtioFS** | Mac | Use VirtioFS for speedy file sharing. VirtioFS has reduced the time taken to complete filesystem operations by [up to 98%](https://github.com/docker/roadmap/issues/7#issuecomment-1044452206). It is the only file sharing implementation supported by Docker VMM. | |**Use Rosetta for x86_64/amd64 emulation on Apple Silicon** | Accelerate x86/AMD64 binary emulation on Apple Silicon. This option is only available if you have selected **Apple Virtualization framework** as the Virtual Machine Manager. | Disabled | Mac | | | **Send usage statistics** | Send diagnostics, crash reports, and usage data to Docker to improve and troubleshoot the application. Docker may periodically prompt you for more information. | Enabled | All | | -| **Use Enhanced Container Isolation** | Prevent containers from breaching the Linux VM. For more information, see [Enhanced Container Isolation](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/_index.md). | Disabled | All | Must be signed in and have a Docker Business subscription. | +| **Use Enhanced Container Isolation** | Prevent containers from breaching the Linux VM. For more information, see [Enhanced Container Isolation](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/_index.md). | Disabled | All | Must be signed in and have a Docker Business subscription. | | **Show CLI hints** | Display helpful CLI suggestions in terminal. | Enabled | All | Improves discoverability | | **Enable Docker Scout image analysis** | Show a **Start analysis** button when inspecting an image, which analyzes the image with Docker Scout. | Enabled | All | | | **Enable background SBOM indexing** | Automatically analyze images that you build or pull. | Disabled | All | | @@ -119,7 +119,7 @@ For more information, see [Volume mounting requires file sharing for any project Docker Desktop supports HTTP/HTTPS and SOCKS5 proxies. SOCKS5 requires a Business subscription. To prevent developers from accidentally changing the proxy settings, see -[Settings Management](/manuals/enterprise/security/hardened-desktop/settings-management/_index.md#what-features-can-i-configure-with-settings-management). +[Settings Management](/manuals/enterprise/hardened-desktop/settings-management/_index.md#what-features-can-i-configure-with-settings-management). #### Docker Desktop proxy @@ -133,7 +133,7 @@ Used for Docker Desktop host-level traffic: signing in to Docker, the Desktop ap > [!NOTE] > -> If you use a PAC file hosted on a web server, add the MIME type `application/x-ns-proxy-autoconfig` for the `.pac` extension. Without this, the PAC file may not parse correctly. See [Hardened Docker Desktop](/manuals/enterprise/security/hardened-desktop/air-gapped-containers.md#proxy-auto-configuration-files). +> If you use a PAC file hosted on a web server, add the MIME type `application/x-ns-proxy-autoconfig` for the `.pac` extension. Without this, the PAC file may not parse correctly. See [Hardened Docker Desktop](/manuals/enterprise/hardened-desktop/air-gapped-containers.md#proxy-auto-configuration-files). #### Containers proxy @@ -155,10 +155,10 @@ Used for `docker image pull` (always enforced - all `docker pull` and Compose pu When you run Windows containers, enable **Use proxy for Windows Docker daemon** to let the Windows Docker daemon connect to Docker Desktop's internal proxy. This allows Windows containers to use the configured Docker Desktop proxy, and -it is required if you want [Registry Access Management](/manuals/enterprise/security/hardened-desktop/registry-access-management.md) +it is required if you want [Registry Access Management](/manuals/enterprise/hardened-desktop/registry-access-management.md) restrictions to apply to Windows image operations. Administrators can manage the same behavior with -[**Override Windows "dockerd" port**](/manuals/enterprise/security/hardened-desktop/settings-management/settings-reference.md#override-windows-dockerd-port). +[**Override Windows "dockerd" port**](/manuals/enterprise/hardened-desktop/settings-management/settings-reference.md#override-windows-dockerd-port). #### Proxy authentication diff --git a/content/manuals/desktop/setup/install/mac-install.md b/content/manuals/desktop/setup/install/mac-install.md index 9d0485847979..848ab969da20 100644 --- a/content/manuals/desktop/setup/install/mac-install.md +++ b/content/manuals/desktop/setup/install/mac-install.md @@ -127,7 +127,7 @@ The `install` command accepts the following flags: - `--allowed-org=`: Requires the user to sign in and be part of the specified Docker Hub organization when running the application - `--user=`: Performs the privileged configurations once during installation. This removes the need for the user to grant root privileges on first run. For more information, see [Privileged helper permission requirements](/manuals/desktop/setup/install/mac-permission-requirements.md#permission-requirements). To find the username, enter `ls /Users` in the CLI. -- `--admin-settings`: Automatically creates an `admin-settings.json` file which is used by administrators to control certain Docker Desktop settings on client machines within their organization. For more information, see [Settings Management](/manuals/enterprise/security/hardened-desktop/settings-management/_index.md). +- `--admin-settings`: Automatically creates an `admin-settings.json` file which is used by administrators to control certain Docker Desktop settings on client machines within their organization. For more information, see [Settings Management](/manuals/enterprise/hardened-desktop/settings-management/_index.md). - It must be used together with the `--allowed-org=` flag. - For example: `--allowed-org= --admin-settings="{'configurationFileVersion': 2, 'enhancedContainerIsolation': {'value': true, 'locked': false}}"` diff --git a/content/manuals/desktop/setup/install/mac-permission-requirements.md b/content/manuals/desktop/setup/install/mac-permission-requirements.md index 34bc7d7e2ff8..a8fff2bc84b3 100644 --- a/content/manuals/desktop/setup/install/mac-permission-requirements.md +++ b/content/manuals/desktop/setup/install/mac-permission-requirements.md @@ -113,7 +113,7 @@ retain their original permissions. ## Enhanced Container Isolation In addition, Docker Desktop supports [Enhanced Container Isolation -mode](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/_index.md) (ECI), +mode](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/_index.md) (ECI), available to Business customers only, which further secures containers without impacting developer workflows. diff --git a/content/manuals/desktop/setup/install/windows-install.md b/content/manuals/desktop/setup/install/windows-install.md index 8a86c24c5160..f237bdb87fc7 100644 --- a/content/manuals/desktop/setup/install/windows-install.md +++ b/content/manuals/desktop/setup/install/windows-install.md @@ -294,7 +294,7 @@ If Microsoft Store access is blocked due to security policies: #### Security and access control - `--allowed-org=`: Requires the user to sign in and be part of the specified Docker Hub organization when running the application -- `--admin-settings`: Automatically creates an `admin-settings.json` file which is used by admins to control certain Docker Desktop settings on client machines within their organization. For more information, see [Settings Management](/manuals/enterprise/security/hardened-desktop/settings-management/_index.md). +- `--admin-settings`: Automatically creates an `admin-settings.json` file which is used by admins to control certain Docker Desktop settings on client machines within their organization. For more information, see [Settings Management](/manuals/enterprise/hardened-desktop/settings-management/_index.md). - It must be used together with the `--allowed-org=` flag. - For example:`--allowed-org= --admin-settings="{'configurationFileVersion': 2, 'enhancedContainerIsolation': {'value': true, 'locked': false}}"` - `--no-windows-containers`: Disables the Windows containers integration. This can improve security. For more information, see [Windows containers](/manuals/desktop/setup/install/windows-permission-requirements.md#windows-containers). diff --git a/content/manuals/desktop/setup/install/windows-permission-requirements.md b/content/manuals/desktop/setup/install/windows-permission-requirements.md index c4b06f1be930..e0b0c05aff20 100644 --- a/content/manuals/desktop/setup/install/windows-permission-requirements.md +++ b/content/manuals/desktop/setup/install/windows-permission-requirements.md @@ -93,7 +93,7 @@ into Docker containers still retain their original permissions. Containers don' ## Enhanced Container Isolation In addition, Docker Desktop supports [Enhanced Container Isolation -mode](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/_index.md) (ECI), +mode](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/_index.md) (ECI), available to Business customers only, which further secures containers without impacting developer workflows. diff --git a/content/manuals/desktop/setup/sign-in.md b/content/manuals/desktop/setup/sign-in.md index d09e6346b64d..9d7c6282483f 100644 --- a/content/manuals/desktop/setup/sign-in.md +++ b/content/manuals/desktop/setup/sign-in.md @@ -29,7 +29,7 @@ In large enterprises where admin access is restricted, administrators can [enfor - Increase your pull rate limit compared to anonymous users. See [Usage and limits](/manuals/docker-hub/usage/_index.md). -- Enhance your organization’s security posture for containerized development with [Hardened Desktop](/manuals/enterprise/security/hardened-desktop/_index.md). +- Enhance your organization’s security posture for containerized development with [Hardened Desktop](/manuals/enterprise/hardened-desktop/_index.md). > [!NOTE] > diff --git a/content/manuals/desktop/use-desktop/kubernetes.md b/content/manuals/desktop/use-desktop/kubernetes.md index c5429aebc88d..38e74e8f23a7 100644 --- a/content/manuals/desktop/use-desktop/kubernetes.md +++ b/content/manuals/desktop/use-desktop/kubernetes.md @@ -53,7 +53,7 @@ Docker Desktop Kubernetes can be provisioned with either the `kubeadm` or `kind` provisioners. `kubeadm` is the older provisioner. It supports a single-node cluster, you can't select the kubernetes -version, it's slower to provision than `kind`, and it's not supported by [Enhanced Container Isolation](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/index.md) (ECI), +version, it's slower to provision than `kind`, and it's not supported by [Enhanced Container Isolation](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/index.md) (ECI), meaning that if ECI is enabled the cluster works but it's not protected by ECI. `kind` is the newer provisioner. It supports multi-node clusters (for @@ -156,7 +156,7 @@ factors, including the version of Kubernetes being used. The tags vary for each To accommodate scenarios where access to Docker Hub is not allowed, admins can configure Docker Desktop to pull the above listed images from a different registry (e.g., a mirror) -using the [KubernetesImagesRepository](/manuals/enterprise/security/hardened-desktop/settings-management/configure-json-file.md#kubernetes) setting as follows. +using the [KubernetesImagesRepository](/manuals/enterprise/hardened-desktop/settings-management/configure-json-file.md#kubernetes) setting as follows. An image name can be broken into `[registry[:port]/][namespace/]repository[:tag]` components. The `KubernetesImagesRepository` setting allows users to override the `[registry[:port]/][namespace]` @@ -195,8 +195,8 @@ The recommended approach to set this up is the following: > [!NOTE] > -> In Docker Desktop versions 4.43 or earlier, when using `KubernetesImagesRepository` and [Enhanced Container Isolation (ECI)](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/_index.md) -> is enabled, add the following images to the [ECI Docker socket mount image list](/manuals/enterprise/security/hardened-desktop/settings-management/configure-json-file.md#enhanced-container-isolation): +> In Docker Desktop versions 4.43 or earlier, when using `KubernetesImagesRepository` and [Enhanced Container Isolation (ECI)](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/_index.md) +> is enabled, add the following images to the [ECI Docker socket mount image list](/manuals/enterprise/hardened-desktop/settings-management/configure-json-file.md#enhanced-container-isolation): > > `[imagesRepository]/desktop-cloud-provider-kind:` > `[imagesRepository]/desktop-containerd-registry-mirror:` diff --git a/content/manuals/docker-hub/release-notes.md b/content/manuals/docker-hub/release-notes.md index 700576df266f..da93573e506f 100644 --- a/content/manuals/docker-hub/release-notes.md +++ b/content/manuals/docker-hub/release-notes.md @@ -170,7 +170,7 @@ known issues for each Docker Hub release. ### New -- [Registry Access Management](/manuals/enterprise/security/hardened-desktop/registry-access-management.md) is now available for all Docker Business subscriptions. When enabled, your users can access specific registries in Docker Hub. +- [Registry Access Management](/manuals/enterprise/hardened-desktop/registry-access-management.md) is now available for all Docker Business subscriptions. When enabled, your users can access specific registries in Docker Hub. ## 2022-05-03 diff --git a/content/manuals/enterprise/enterprise-deployment/_index.md b/content/manuals/enterprise/enterprise-deployment/_index.md index 8324d70ef201..093845281cc1 100644 --- a/content/manuals/enterprise/enterprise-deployment/_index.md +++ b/content/manuals/enterprise/enterprise-deployment/_index.md @@ -1,6 +1,6 @@ --- title: Deploy Docker Desktop -weight: 10 +weight: 20 description: If you're an IT admin, learn how to deploy Docker Desktop at scale keywords: msi, docker desktop, windows, installation, mac, pkg, enterprise params: diff --git a/content/manuals/enterprise/enterprise-deployment/msi-install-and-configure.md b/content/manuals/enterprise/enterprise-deployment/msi-install-and-configure.md index 68fe0a96f0c6..28af5ffd7def 100644 --- a/content/manuals/enterprise/enterprise-deployment/msi-install-and-configure.md +++ b/content/manuals/enterprise/enterprise-deployment/msi-install-and-configure.md @@ -200,7 +200,7 @@ In addition to the following custom properties, the Docker Desktop MSI installer | :--------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :---------------------- | | `ENABLEDESKTOPSHORTCUT` | Creates a desktop shortcut. | 1 | | `INSTALLFOLDER` | Specifies a custom location where Docker Desktop will be installed. | C:\Program Files\Docker | -| `ADMINSETTINGS` | Automatically creates an `admin-settings.json` file which is used to [control certain Docker Desktop settings](/manuals/enterprise/security/hardened-desktop/settings-management/_index.md) on client machines within organizations. It must be used together with the `ALLOWEDORG` property. | None | +| `ADMINSETTINGS` | Automatically creates an `admin-settings.json` file which is used to [control certain Docker Desktop settings](/manuals/enterprise/hardened-desktop/settings-management/_index.md) on client machines within organizations. It must be used together with the `ALLOWEDORG` property. | None | | `ALLOWEDORG` | Requires the user to sign in and be part of the specified Docker Hub organization when running the application. This creates a registry key called `allowedOrgs` in `HKLM\Software\Policies\Docker\Docker Desktop`. | None | | `ALWAYSRUNSERVICE` | Lets users switch to Windows containers without needing admin rights | 0 | | `DISABLEWINDOWSCONTAINERS` | Disables the Windows containers integration | 0 | diff --git a/content/manuals/enterprise/security/hardened-desktop/_index.md b/content/manuals/enterprise/hardened-desktop/_index.md similarity index 86% rename from content/manuals/enterprise/security/hardened-desktop/_index.md rename to content/manuals/enterprise/hardened-desktop/_index.md index 6fb7a7ae9749..c583ee442710 100644 --- a/content/manuals/enterprise/security/hardened-desktop/_index.md +++ b/content/manuals/enterprise/hardened-desktop/_index.md @@ -4,34 +4,39 @@ linkTitle: Hardened Docker Desktop description: Security features that help organizations secure developer environments without impacting productivity keywords: security, hardened desktop, enhanced container isolation, registry access management, settings management, admins, docker desktop, image access management, air-gapped containers tags: [admin] +weight: 30 +params: + sidebar: + group: Enterprise aliases: - - /security/for-admins/hardened-desktop/ + - /security/for-admins/hardened-desktop/ + - /enterprise/hardened-desktop/ + - /enterprise/security/ grid: - title: "Settings Management" description: Learn how Settings Management can secure your developers' workflows. icon: shield-check - link: /enterprise/security/hardened-desktop/settings-management/ + link: /enterprise/hardened-desktop/settings-management/ - title: "Enhanced Container Isolation" description: Understand how Enhanced Container Isolation can prevent container attacks. icon: shield-check - link: /enterprise/security/hardened-desktop/enhanced-container-isolation/ + link: /enterprise/hardened-desktop/enhanced-container-isolation/ - title: "Registry Access Management" description: Control the registries developers can access while using Docker Desktop. icon: server - link: /enterprise/security/hardened-desktop/registry-access-management/ + link: /enterprise/hardened-desktop/registry-access-management/ - title: "Image Access Management" description: Control the images developers can pull from Docker Hub. icon: photo - link: /enterprise/security/hardened-desktop/image-access-management/ + link: /enterprise/hardened-desktop/image-access-management/ - title: "Air-Gapped Containers" description: Restrict containers from accessing unwanted network resources. icon: lock-closed - link: /enterprise/security/hardened-desktop/air-gapped-containers/ + link: /enterprise/hardened-desktop/air-gapped-containers/ - title: "Namespace access" description: Control whether organization members can push content to their personal namespaces. icon: folder-open - link: /enterprise/security/hardened-desktop/namespace-access/ -weight: 60 + link: /enterprise/hardened-desktop/namespace-access/ --- {{< summary-bar feature_name="Hardened Docker Desktop" >}} diff --git a/content/manuals/enterprise/security/hardened-desktop/air-gapped-containers.md b/content/manuals/enterprise/hardened-desktop/air-gapped-containers.md similarity index 90% rename from content/manuals/enterprise/security/hardened-desktop/air-gapped-containers.md rename to content/manuals/enterprise/hardened-desktop/air-gapped-containers.md index 086a431a71de..d564dd074b93 100644 --- a/content/manuals/enterprise/security/hardened-desktop/air-gapped-containers.md +++ b/content/manuals/enterprise/hardened-desktop/air-gapped-containers.md @@ -4,6 +4,7 @@ description: Restrict outbound container traffic using proxy rules, PAC files, a keywords: air gapped containers, network security, proxy configuration, container isolation, docker desktop, PAC file, network isolation aliases: - /security/for-admins/hardened-desktop/air-gapped-containers/ + - /enterprise/security/hardened-desktop/air-gapped-containers/ weight: 30 --- @@ -43,11 +44,11 @@ Before configuring air-gapped containers, you must have: - [Enforce sign-in](/manuals/platform/security/authentication/enforce-sign-in/_index.md) enabled to ensure users authenticate with your organization - A Docker Business subscription -- Configured [Settings Management](/manuals/enterprise/security/hardened-desktop/settings-management/_index.md) with the `admin-settings.json` file to manage organization policies +- Configured [Settings Management](/manuals/enterprise/hardened-desktop/settings-management/_index.md) with the `admin-settings.json` file to manage organization policies ## Configure air-gapped containers -Add the container proxy to your [`admin-settings.json` file](/manuals/enterprise/security/hardened-desktop/settings-management/configure-json-file.md). For example: +Add the container proxy to your [`admin-settings.json` file](/manuals/enterprise/hardened-desktop/settings-management/configure-json-file.md). For example: ```json { @@ -140,10 +141,10 @@ function FindProxyForURL(url, host) { ### General considerations - `FindProxyForURL` function URL parameter format is `http://host_or_ip:port` or `https://host_or_ip:port` - - If you have an internal container trying to access `https://docs.docker.com/enterprise/security/hardened-desktop/air-gapped-containers` the Docker proxy service will submit docs.docker.com for the host value and https://docs.docker.com:443 for the url value to `FindProxyForURL`, if you are using `shExpMatch` function in your PAC file as follows: + - If you have an internal container trying to access `https://docs.docker.com/enterprise/hardened-desktop/air-gapped-containers` the Docker proxy service will submit docs.docker.com for the host value and https://docs.docker.com:443 for the url value to `FindProxyForURL`, if you are using `shExpMatch` function in your PAC file as follows: ```console - if(shExpMatch(url, "https://docs.docker.com:443/enterprise/security/*")) return "DIRECT"; + if(shExpMatch(url, "https://docs.docker.com:443/enterprise/hardened-desktop/*")) return "DIRECT"; ``` `shExpMatch` function will fail, instead use: @@ -227,5 +228,5 @@ $ docker run --rm alpine wget -O- https://docker.io ## Next steps -- [Explore Enhanced Container Isolation](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/_index.md) to further restrict what containers can do at runtime +- [Explore Enhanced Container Isolation](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/_index.md) to further restrict what containers can do at runtime - [Understand how Docker Desktop handles host and container networking](/manuals/desktop/features/networking/_index.md) \ No newline at end of file diff --git a/content/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/_index.md b/content/manuals/enterprise/hardened-desktop/enhanced-container-isolation/_index.md similarity index 97% rename from content/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/_index.md rename to content/manuals/enterprise/hardened-desktop/enhanced-container-isolation/_index.md index 6651dcd4f208..d2b4487fb835 100644 --- a/content/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/_index.md +++ b/content/manuals/enterprise/hardened-desktop/enhanced-container-isolation/_index.md @@ -6,6 +6,7 @@ keywords: enhanced container isolation, container security, sysbox runtime, linu aliases: - /desktop/hardened-desktop/enhanced-container-isolation/ - /security/for-admins/hardened-desktop/enhanced-container-isolation/ + - /enterprise/security/hardened-desktop/enhanced-container-isolation/ weight: 10 --- @@ -13,7 +14,7 @@ weight: 10 Enhanced Container Isolation (ECI) prevents malicious containers from compromising Docker Desktop or the host system. It applies advanced security techniques automatically while maintaining full developer productivity and workflow compatibility. -- ECI strengthens container isolation and locks in security configurations created by administrators, such as [Registry Access Management policies](/manuals/enterprise/security/hardened-desktop/registry-access-management.md) and [Settings Management](../settings-management/_index.md) controls. +- ECI strengthens container isolation and locks in security configurations created by administrators, such as [Registry Access Management policies](/manuals/enterprise/hardened-desktop/registry-access-management.md) and [Settings Management](../settings-management/_index.md) controls. - ECI works alongside other Docker security features like reduced Linux capabilities, seccomp, and AppArmor. If you are using WSL2 backend, ensure you’re running WSL version 2.6 or later. This is required because ECI depends on a Linux kernel version of at least 6.3.0, and WSL 2.6+ includes kernel version 6.6. @@ -212,4 +213,4 @@ Enhanced Container Isolation maintains optimized performance and full compatibil > [!IMPORTANT] > -> ECI protection varies by Docker Desktop version and doesn't yet protect extension containers. Docker builds and Kubernetes in Docker Desktop have varying protection levels depending on the version. For details, see [Enhanced Container Isolation limitations](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/limitations.md). +> ECI protection varies by Docker Desktop version and doesn't yet protect extension containers. Docker builds and Kubernetes in Docker Desktop have varying protection levels depending on the version. For details, see [Enhanced Container Isolation limitations](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/limitations.md). diff --git a/content/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/config.md b/content/manuals/enterprise/hardened-desktop/enhanced-container-isolation/config.md similarity index 94% rename from content/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/config.md rename to content/manuals/enterprise/hardened-desktop/enhanced-container-isolation/config.md index 2ce32c791dd2..3b21936bf31d 100644 --- a/content/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/config.md +++ b/content/manuals/enterprise/hardened-desktop/enhanced-container-isolation/config.md @@ -5,6 +5,7 @@ description: Configure Docker socket exceptions and advanced settings for Enhanc keywords: enhanced container isolation, docker socket, configuration, testcontainers, admin settings aliases: - /security/for-admins/hardened-desktop/enhanced-container-isolation/config/ + - /enterprise/security/hardened-desktop/enhanced-container-isolation/config/ weight: 20 --- @@ -32,7 +33,7 @@ Configure Docker socket exceptions using Settings Management: 1. Sign in to [Docker Home](https://app.docker.com) and select your organization from the top-left account drop-down. 1. Select **Docker Desktop**, then **Settings Management**. -1. [Create or edit a setting policy](/manuals/enterprise/security/hardened-desktop/settings-management/configure-admin-console.md). +1. [Create or edit a setting policy](/manuals/enterprise/hardened-desktop/settings-management/configure-admin-console.md). 1. Find **Enhanced Container Isolation** settings. 1. Configure **Docker socket access control** with your trusted images and command restrictions. @@ -40,7 +41,7 @@ command restrictions. {{< /tab >}} {{< tab name="JSON file" >}} -Create an [`admin-settings.json` file](/manuals/enterprise/security/hardened-desktop/settings-management/configure-json-file.md) and add: +Create an [`admin-settings.json` file](/manuals/enterprise/hardened-desktop/settings-management/configure-json-file.md) and add: ```json { @@ -278,5 +279,5 @@ This resolves digest mismatches when upstream images are updated. ## Next steps -- Review [Enhanced Container Isolation limitations](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/limitations.md). -- Review [Enhanced Container Isolation FAQs](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/faq.md). +- Review [Enhanced Container Isolation limitations](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/limitations.md). +- Review [Enhanced Container Isolation FAQs](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/faq.md). diff --git a/content/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/enable-eci.md b/content/manuals/enterprise/hardened-desktop/enhanced-container-isolation/enable-eci.md similarity index 88% rename from content/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/enable-eci.md rename to content/manuals/enterprise/hardened-desktop/enhanced-container-isolation/enable-eci.md index b282d0c90363..0d1700b41438 100644 --- a/content/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/enable-eci.md +++ b/content/manuals/enterprise/hardened-desktop/enhanced-container-isolation/enable-eci.md @@ -4,6 +4,8 @@ linkTitle: Enable ECI description: Enable Enhanced Container Isolation to secure containers in Docker Desktop keywords: enhanced container isolation, enable eci, container security, docker desktop setup weight: 15 +aliases: + - /enterprise/security/hardened-desktop/enhanced-container-isolation/enable-eci/ --- {{< summary-bar feature_name="Hardened Docker Desktop" >}} @@ -51,13 +53,13 @@ Configure Enhanced Container Isolation organization-wide using Settings Manageme 1. Sign in to [Docker Home](https://app.docker.com) and select your organization from the top-left account drop-down. 1. Select **Docker Desktop**, then **Settings Management**. -1. [Create or edit a setting policy](/manuals/enterprise/security/hardened-desktop/settings-management/configure-admin-console.md). +1. [Create or edit a setting policy](/manuals/enterprise/hardened-desktop/settings-management/configure-admin-console.md). 1. Set **Enhanced Container Isolation** to **Always enabled**. {{< /tab >}} {{< tab name="JSON file" >}} -1. Create an [`admin-settings.json` file](/manuals/enterprise/security/hardened-desktop/settings-management/configure-json-file.md) and add: +1. Create an [`admin-settings.json` file](/manuals/enterprise/hardened-desktop/settings-management/configure-json-file.md) and add: ```json { @@ -88,7 +90,7 @@ For ECI settings to take effect: > > Restarting from the Docker Desktop menu isn't sufficient. Users must completely quit and reopen Docker Desktop. -You can also configure [Docker socket mount permissions](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/config.md) for trusted images that need Docker API access. +You can also configure [Docker socket mount permissions](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/config.md) for trusted images that need Docker API access. ## Verify Enhanced Container Isolation is active @@ -164,5 +166,5 @@ Docker Desktop settings. ## Next steps -- Review [Configure Docker socket exceptions and advanced settings](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/config.md). -- Review [Enhanced Container Isolation limitations](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/limitations.md). +- Review [Configure Docker socket exceptions and advanced settings](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/config.md). +- Review [Enhanced Container Isolation limitations](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/limitations.md). diff --git a/content/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/faq.md b/content/manuals/enterprise/hardened-desktop/enhanced-container-isolation/faq.md similarity index 89% rename from content/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/faq.md rename to content/manuals/enterprise/hardened-desktop/enhanced-container-isolation/faq.md index 3dee031d634c..d1af00951bea 100644 --- a/content/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/faq.md +++ b/content/manuals/enterprise/hardened-desktop/enhanced-container-isolation/faq.md @@ -6,6 +6,7 @@ keywords: enhanced container isolation, faq, troubleshooting, docker desktop toc_max: 2 aliases: - /security/for-admins/hardened-desktop/enhanced-container-isolation/faq/ + - /enterprise/security/hardened-desktop/enhanced-container-isolation/faq/ weight: 40 --- @@ -19,7 +20,7 @@ No. ECI works automatically in the background by creating more secure containers ## Do all container workloads work well with ECI? -Most container workloads run without issues when ECI is turned on. However, some advanced workloads that require specific kernel-level access may not work. For details about which workloads are affected, see [ECI limitations](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/limitations.md). +Most container workloads run without issues when ECI is turned on. However, some advanced workloads that require specific kernel-level access may not work. For details about which workloads are affected, see [ECI limitations](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/limitations.md). ## Why not just restrict usage of the `--privileged` flag? @@ -50,7 +51,7 @@ $ docker stop $(docker ps -q) $ docker rm $(docker ps -aq) ``` -For more details, see [Enable Enhanced Container Isolation](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/enable-eci.md). +For more details, see [Enable Enhanced Container Isolation](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/enable-eci.md). ## Which containers does ECI protect? @@ -72,13 +73,13 @@ ECI protection varies by container type and Docker Desktop version: - Docker Debug containers - Kubernetes with Kubeadm provisioner -For complete details, see [ECI limitations](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/limitations.md). +For complete details, see [ECI limitations](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/limitations.md). ## Can I mount the Docker socket with ECI turned on? By default, no. ECI blocks Docker socket bind mounts for security. However, you can configure exceptions for trusted images like Testcontainers. -For configuration details, see [Configure Docker socket exceptions](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/config.md). +For configuration details, see [Configure Docker socket exceptions](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/config.md). ## What bind mounts does ECI restrict? diff --git a/content/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/limitations.md b/content/manuals/enterprise/hardened-desktop/enhanced-container-isolation/limitations.md similarity index 98% rename from content/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/limitations.md rename to content/manuals/enterprise/hardened-desktop/enhanced-container-isolation/limitations.md index e7a2f63736b4..ff1acc985d3b 100644 --- a/content/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/limitations.md +++ b/content/manuals/enterprise/hardened-desktop/enhanced-container-isolation/limitations.md @@ -8,6 +8,7 @@ weight: 30 aliases: - /security/for-admins/hardened-desktop/enhanced-container-isolation/limitations/ --- + - /enterprise/security/hardened-desktop/enhanced-container-isolation/limitations/ {{< summary-bar feature_name="Hardened Docker Desktop" >}} diff --git a/content/manuals/enterprise/security/hardened-desktop/image-access-management.md b/content/manuals/enterprise/hardened-desktop/image-access-management.md similarity index 97% rename from content/manuals/enterprise/security/hardened-desktop/image-access-management.md rename to content/manuals/enterprise/hardened-desktop/image-access-management.md index 73414ad7ffac..9b725127d8a1 100644 --- a/content/manuals/enterprise/security/hardened-desktop/image-access-management.md +++ b/content/manuals/enterprise/hardened-desktop/image-access-management.md @@ -7,6 +7,7 @@ aliases: - /admin/organization/image-access/ - /security/for-admins/image-access-management/ - /security/for-admins/hardened-desktop/image-access-management/ + - /enterprise/security/hardened-desktop/image-access-management/ weight: 50 --- @@ -109,7 +110,7 @@ Image access restrictions apply to all Docker Hub operations including pulls, bu ## Scope and bypass considerations -- Image Access Management only controls access to Docker Hub images. Images from other registries aren't affected by these policies. Use [Registry Access Management](/manuals/enterprise/security/hardened-desktop/registry-access-management.md) to control access to other registries. +- Image Access Management only controls access to Docker Hub images. Images from other registries aren't affected by these policies. Use [Registry Access Management](/manuals/enterprise/hardened-desktop/registry-access-management.md) to control access to other registries. - Users can potentially bypass Image Access Management by signing out of Docker Desktop (unless sign-in is enforced), using images from other registries that aren't restricted, or using registry mirrors or proxies. Enforce sign-in and combine with Registry Access Management for comprehensive control. - Image restrictions apply to Dockerfile `FROM` instructions, Docker Compose services using restricted images will fail, multi-stage builds may be affected if intermediate images are restricted, and CI/CD pipelines using diverse image types may be impacted. diff --git a/content/manuals/enterprise/security/hardened-desktop/namespace-access.md b/content/manuals/enterprise/hardened-desktop/namespace-access.md similarity index 97% rename from content/manuals/enterprise/security/hardened-desktop/namespace-access.md rename to content/manuals/enterprise/hardened-desktop/namespace-access.md index 14c81e03fe51..9d502100fda8 100644 --- a/content/manuals/enterprise/security/hardened-desktop/namespace-access.md +++ b/content/manuals/enterprise/hardened-desktop/namespace-access.md @@ -5,6 +5,8 @@ description: Control whether organization members can push content to their pers keywords: namespace access, docker hub, personal namespace, organization security, docker business tags: [admin] weight: 60 +aliases: + - /enterprise/security/hardened-desktop/namespace-access/ --- {{< summary-bar feature_name="Namespace access" >}} diff --git a/content/manuals/enterprise/security/hardened-desktop/registry-access-management.md b/content/manuals/enterprise/hardened-desktop/registry-access-management.md similarity index 97% rename from content/manuals/enterprise/security/hardened-desktop/registry-access-management.md rename to content/manuals/enterprise/hardened-desktop/registry-access-management.md index 70630ffa5779..f9f4714e42bf 100644 --- a/content/manuals/enterprise/security/hardened-desktop/registry-access-management.md +++ b/content/manuals/enterprise/hardened-desktop/registry-access-management.md @@ -12,6 +12,7 @@ aliases: - /security/for-admins/registry-access-management/ - /security/for-admins/hardened-desktop/registry-access-management/ - /docker-hub/registry-access-management/ + - /enterprise/security/hardened-desktop/registry-access-management/ weight: 40 --- @@ -164,5 +165,5 @@ To maximize security effectiveness: - Confirm all necessary redirect domains are included - Ensure development workflows aren't disrupted - Combine with - [Enhanced Container Isolation](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/_index.md) + [Enhanced Container Isolation](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/_index.md) for broader Desktop security \ No newline at end of file diff --git a/content/manuals/enterprise/security/hardened-desktop/settings-management/_index.md b/content/manuals/enterprise/hardened-desktop/settings-management/_index.md similarity index 89% rename from content/manuals/enterprise/security/hardened-desktop/settings-management/_index.md rename to content/manuals/enterprise/hardened-desktop/settings-management/_index.md index 98775f7695e1..ffa01f671e6f 100644 --- a/content/manuals/enterprise/security/hardened-desktop/settings-management/_index.md +++ b/content/manuals/enterprise/hardened-desktop/settings-management/_index.md @@ -6,6 +6,7 @@ title: Settings Management linkTitle: Settings Management aliases: - /security/for-admins/hardened-desktop/settings-management/ + - /enterprise/security/hardened-desktop/settings-management/ weight: 10 --- @@ -25,9 +26,9 @@ Settings Management is designed for organizations that: Administrators can define settings using one of these methods: -- [Docker Home](/manuals/enterprise/security/hardened-desktop/settings-management/configure-admin-console.md): Create and assign settings policies via Docker Home. This provides a web-based interface for managing settings +- [Docker Home](/manuals/enterprise/hardened-desktop/settings-management/configure-admin-console.md): Create and assign settings policies via Docker Home. This provides a web-based interface for managing settings across your organization. -- [`admin-settings.json` file](/manuals/enterprise/security/hardened-desktop/settings-management/configure-json-file.md): Place a configuration file on the +- [`admin-settings.json` file](/manuals/enterprise/hardened-desktop/settings-management/configure-json-file.md): Place a configuration file on the user's machine to enforce settings. This method works well for automated deployments and scripted installations. @@ -45,7 +46,7 @@ Settings Management supports a wide range of Docker Desktop features, including: - Security policies - Cloud policies -For a complete list of settings you can enforce, see the [Settings reference](/manuals/enterprise/security/hardened-desktop/settings-management/settings-reference.md). +For a complete list of settings you can enforce, see the [Settings reference](/manuals/enterprise/hardened-desktop/settings-management/settings-reference.md). ## Policy precedence @@ -65,7 +66,7 @@ You can create settings management policies at any time, but your organization n ensure all developers authenticate with your organization. 3. Choose a configuration method: - Use the `--admin-settings` installer flag on [macOS](/manuals/desktop/setup/install/mac-install.md#install-from-the-command-line) or [Windows](/manuals/desktop/setup/install/windows-install.md#install-from-the-command-line) to automatically create the `admin-settings.json`. - - Manually create and configure the [`admin-settings.json` file](/manuals/enterprise/security/hardened-desktop/settings-management/configure-json-file.md). + - Manually create and configure the [`admin-settings.json` file](/manuals/enterprise/hardened-desktop/settings-management/configure-json-file.md). - Create a settings policy in the [Docker Home](configure-admin-console.md). After configuration, developers receive the enforced settings when they: diff --git a/content/manuals/enterprise/security/hardened-desktop/settings-management/compliance-reporting.md b/content/manuals/enterprise/hardened-desktop/settings-management/compliance-reporting.md similarity index 98% rename from content/manuals/enterprise/security/hardened-desktop/settings-management/compliance-reporting.md rename to content/manuals/enterprise/hardened-desktop/settings-management/compliance-reporting.md index ed8b52f99fd6..52ba7c6c12cc 100644 --- a/content/manuals/enterprise/security/hardened-desktop/settings-management/compliance-reporting.md +++ b/content/manuals/enterprise/hardened-desktop/settings-management/compliance-reporting.md @@ -7,6 +7,7 @@ weight: 30 aliases: - /security/for-admins/hardened-desktop/settings-management/compliance-reporting/ --- + - /enterprise/security/hardened-desktop/settings-management/compliance-reporting/ {{< summary-bar feature_name="Compliance reporting" >}} diff --git a/content/manuals/enterprise/security/hardened-desktop/settings-management/configure-admin-console.md b/content/manuals/enterprise/hardened-desktop/settings-management/configure-admin-console.md similarity index 98% rename from content/manuals/enterprise/security/hardened-desktop/settings-management/configure-admin-console.md rename to content/manuals/enterprise/hardened-desktop/settings-management/configure-admin-console.md index 26bf2c802f5a..ba2a742b9dfb 100644 --- a/content/manuals/enterprise/security/hardened-desktop/settings-management/configure-admin-console.md +++ b/content/manuals/enterprise/hardened-desktop/settings-management/configure-admin-console.md @@ -7,6 +7,7 @@ weight: 20 aliases: - /security/for-admins/hardened-desktop/settings-management/configure-admin-console/ --- + - /enterprise/security/hardened-desktop/settings-management/configure-admin-console/ {{< summary-bar feature_name="Admin Console" >}} diff --git a/content/manuals/enterprise/security/hardened-desktop/settings-management/configure-json-file.md b/content/manuals/enterprise/hardened-desktop/settings-management/configure-json-file.md similarity index 99% rename from content/manuals/enterprise/security/hardened-desktop/settings-management/configure-json-file.md rename to content/manuals/enterprise/hardened-desktop/settings-management/configure-json-file.md index 4b6784ff80be..819d3e40cbc4 100644 --- a/content/manuals/enterprise/security/hardened-desktop/settings-management/configure-json-file.md +++ b/content/manuals/enterprise/hardened-desktop/settings-management/configure-json-file.md @@ -8,6 +8,7 @@ aliases: - /security/for-admins/hardened-desktop/settings-management/configure/ - /security/for-admins/hardened-desktop/settings-management/configure-json-file/ --- + - /enterprise/security/hardened-desktop/settings-management/configure-json-file/ {{< summary-bar feature_name="Hardened Docker Desktop" >}} diff --git a/content/manuals/enterprise/security/hardened-desktop/settings-management/settings-reference.md b/content/manuals/enterprise/hardened-desktop/settings-management/settings-reference.md similarity index 98% rename from content/manuals/enterprise/security/hardened-desktop/settings-management/settings-reference.md rename to content/manuals/enterprise/hardened-desktop/settings-management/settings-reference.md index 80b254341fcc..8599ded1fcb7 100644 --- a/content/manuals/enterprise/security/hardened-desktop/settings-management/settings-reference.md +++ b/content/manuals/enterprise/hardened-desktop/settings-management/settings-reference.md @@ -7,8 +7,9 @@ toc_max: 2 aliases: - /security/for-admins/hardened-desktop/settings-management/settings-reference/ --- + - /enterprise/security/hardened-desktop/settings-management/settings-reference/ -This reference documents Docker Desktop settings that administrators can configure using [Settings Management](/manuals/enterprise/security/hardened-desktop/settings-management/_index.md). Use this page to understand which settings are available, their accepted values, platform compatibility, and which configuration methods apply. +This reference documents Docker Desktop settings that administrators can configure using [Settings Management](/manuals/enterprise/hardened-desktop/settings-management/_index.md). Use this page to understand which settings are available, their accepted values, platform compatibility, and which configuration methods apply. > [!NOTE] > @@ -431,7 +432,7 @@ The [`proxy`](#proxy) setting governs Docker Desktop host-level traffic: the Des } ``` -For more information, see [Air-gapped containers](/manuals/enterprise/security/hardened-desktop/air-gapped-containers.md). +For more information, see [Air-gapped containers](/manuals/enterprise/hardened-desktop/air-gapped-containers.md). ## LinuxVM diff --git a/content/manuals/enterprise/security/_index.md b/content/manuals/enterprise/security/_index.md deleted file mode 100644 index 4bad1ece1274..000000000000 --- a/content/manuals/enterprise/security/_index.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -linkTitle: Security -title: Security for enterprises -description: Learn about enterprise level security features Docker has to offer and explore best practices -keywords: docker, docker hub, docker desktop, security, enterprises, scale -weight: 10 -params: - sidebar: - group: Enterprise -grid_admins: - - title: Settings Management - description: Learn how Settings Management can secure your developers' workflows. - icon: shield-check - link: /enterprise/security/hardened-desktop/settings-management/ - - title: Enhanced Container Isolation - description: Understand how Enhanced Container Isolation can prevent container attacks. - icon: shield-check - link: /enterprise/security/hardened-desktop/enhanced-container-isolation/ - - title: Registry Access Management - description: Control the registries developers can access while using Docker Desktop. - icon: server - link: /enterprise/security/hardened-desktop/registry-access-management/ - - title: Image Access Management - description: Control the images developers can pull from Docker Hub. - icon: photo - link: /enterprise/security/hardened-desktop/image-access-management/ - - title: "Air-Gapped Containers" - description: Restrict containers from accessing unwanted network resources. - icon: lock-closed - link: /enterprise/security/hardened-desktop/air-gapped-containers/ - - title: Namespace access - description: Control which Kubernetes namespaces developers can access in Docker Desktop. - icon: lock-closed - link: /enterprise/security/hardened-desktop/namespace-access/ ---- - -Docker provides security guardrails for both administrators and developers. - -If you're an administrator, you can enforce sign-in across Docker products for your developers, and -scale, manage, and secure your instances of Docker Desktop with DevOps security controls like Enhanced Container Isolation and Registry Access Management. - -## For administrators - -Explore the security features Docker offers to satisfy your company's security policies. - -{{< grid items="grid_admins" >}} diff --git a/content/manuals/extensions/private-marketplace.md b/content/manuals/extensions/private-marketplace.md index a72bfd9f6afa..9cd28a1783b9 100644 --- a/content/manuals/extensions/private-marketplace.md +++ b/content/manuals/extensions/private-marketplace.md @@ -11,7 +11,7 @@ weight: 30 Learn how to configure and set up a private marketplace with a curated list of extensions for your Docker Desktop users. -Docker Extensions' private marketplace is designed specifically for organizations who don’t give developers root access to their machines. It makes use of [Settings Management](/manuals/enterprise/security/hardened-desktop/settings-management/_index.md) so administrators have complete control over the private marketplace. +Docker Extensions' private marketplace is designed specifically for organizations who don’t give developers root access to their machines. It makes use of [Settings Management](/manuals/enterprise/hardened-desktop/settings-management/_index.md) so administrators have complete control over the private marketplace. ## Prerequisites @@ -65,7 +65,7 @@ This creates 2 files: > [!IMPORTANT] > -> If your org is using [Settings Management](/manuals/enterprise/security/hardened-desktop/settings-management/_index.md) via [Docker Home](manuals/enterprise/security/hardened-desktop/settings-management/configure-admin-console/_index.md), you will not need the `admin-settings.json` file. Delete the generated file and keep only the `extensions.txt` file. +> If your org is using [Settings Management](/manuals/enterprise/hardened-desktop/settings-management/_index.md) via [Docker Home](manuals/enterprise/hardened-desktop/settings-management/configure-admin-console/_index.md), you will not need the `admin-settings.json` file. Delete the generated file and keep only the `extensions.txt` file. ## Step two: Set the behaviour @@ -73,7 +73,7 @@ The generated `admin-settings.json` file includes various settings you can modif > [!IMPORTANT] > -> If your org is managing settings via [Docker Home](manuals/enterprise/security/hardened-desktop/settings-management/configure-admin-console/_index.md), you will define the same settings in Docker Home instead of the `admin-settings.json` file. +> If your org is managing settings via [Docker Home](manuals/enterprise/hardened-desktop/settings-management/configure-admin-console/_index.md), you will define the same settings in Docker Home instead of the `admin-settings.json` file. Each setting has a `value` that you can set, including a `locked` field that lets you lock the setting and make it unchangeable by your developers. @@ -89,7 +89,7 @@ Each setting has a `value` that you can set, including a `locked` field that let } ``` -To find out more information about the `admin-settings.json` file, see [Settings Management](/manuals/enterprise/security/hardened-desktop/settings-management/_index.md). +To find out more information about the `admin-settings.json` file, see [Settings Management](/manuals/enterprise/hardened-desktop/settings-management/_index.md). ## Step three: List allowed extensions @@ -194,7 +194,7 @@ It's recommended that you try the private marketplace on your Docker Desktop ins > [!IMPORTANT] > -> > If your org is managing settings via [Docker Home](manuals/enterprise/security/hardened-desktop/settings-management/configure-admin-console/_index.md), in Docker Desktop 4.59 and earlier, you must manually delete the `admin-settings.json` file created in the target folder by the `apply` command before step 2. In Docker Desktop 4.60 and later, this step is no longer necessary. +> > If your org is managing settings via [Docker Home](manuals/enterprise/hardened-desktop/settings-management/configure-admin-console/_index.md), in Docker Desktop 4.59 and earlier, you must manually delete the `admin-settings.json` file created in the target folder by the `apply` command before step 2. In Docker Desktop 4.60 and later, this step is no longer necessary. When you select the **Extensions** tab, you should see the private marketplace listing only the extensions you have allowed in `extensions.txt`. @@ -205,7 +205,7 @@ When you select the **Extensions** tab, you should see the private marketplace l Once you’ve confirmed that the private marketplace configuration works, the final step is to distribute the files to the developers’ machines with the MDM software your organization uses. For example, [Jamf](https://www.jamf.com/). The files to distribute are: -* `admin-settings.json` (except if your org is managing settings via [Docker Home](manuals/enterprise/security/hardened-desktop/settings-management/configure-admin-console/_index.md)) +* `admin-settings.json` (except if your org is managing settings via [Docker Home](manuals/enterprise/hardened-desktop/settings-management/configure-admin-console/_index.md)) * the entire `extension-marketplace` folder and its subfolders These files must be placed on developer's machines. Depending on your operating system, the target location is (as mentioned above): diff --git a/content/manuals/extensions/settings-feedback.md b/content/manuals/extensions/settings-feedback.md index c585fd009eaf..fcc00f304ba1 100644 --- a/content/manuals/extensions/settings-feedback.md +++ b/content/manuals/extensions/settings-feedback.md @@ -24,7 +24,7 @@ Docker Extensions is switched off by default. To change your settings: > - `~/Library/Group Containers/group.com.docker/settings-store.json` on Mac > - `C:\Users\[USERNAME]\AppData\Roaming\Docker\settings-store.json` on Windows > -> This can also be done with [Hardened Docker Desktop](/manuals/enterprise/security/hardened-desktop/_index.md) +> This can also be done with [Hardened Docker Desktop](/manuals/enterprise/hardened-desktop/_index.md) ### Turn on or turn off extensions not available in the Marketplace diff --git a/content/manuals/faqs/general.md b/content/manuals/faqs/general.md index 15116119616c..bc4b024f72db 100644 --- a/content/manuals/faqs/general.md +++ b/content/manuals/faqs/general.md @@ -69,4 +69,4 @@ Security vetting for extensions isn't implemented. Extensions aren't covered as ## Can I prevent users from pushing images to Docker Hub private repositories? -No direct setting exists to disable private repositories. However, [Registry Access Management](/manuals/enterprise/security/hardened-desktop/registry-access-management.md) lets administrators control which registries developers can access through Docker Desktop via Docker Home. +No direct setting exists to disable private repositories. However, [Registry Access Management](/manuals/enterprise/hardened-desktop/registry-access-management.md) lets administrators control which registries developers can access through Docker Desktop via Docker Home. diff --git a/content/manuals/faqs/networking-and-vms.md b/content/manuals/faqs/networking-and-vms.md index bdd570f4bd4f..dd2e912451b3 100644 --- a/content/manuals/faqs/networking-and-vms.md +++ b/content/manuals/faqs/networking-and-vms.md @@ -16,7 +16,7 @@ aliases: Docker Desktop doesn't have a built-in mechanism for this, but you can use process-level firewalls on the host. Apply rules to the `com.docker.vpnkit` user-space process to control where it can connect (DNS allowlists, packet filters) and which ports/protocols it can use. -For enterprise environments, consider [Air-gapped containers](/manuals/enterprise/security/hardened-desktop/air-gapped-containers.md) which provide network access controls for containers. +For enterprise environments, consider [Air-gapped containers](/manuals/enterprise/hardened-desktop/air-gapped-containers.md) which provide network access controls for containers. ## Can I apply firewall rules to container network traffic? diff --git a/content/manuals/platform-release-notes.md b/content/manuals/platform-release-notes.md index 204798fa0d89..68f2eb70c799 100644 --- a/content/manuals/platform-release-notes.md +++ b/content/manuals/platform-release-notes.md @@ -18,7 +18,7 @@ This page provides details on new features, enhancements, known issues, and bug - Administrators can now control whether organization members can push content to their personal namespaces on Docker Hub with [namespace access - control](/manuals/enterprise/security/hardened-desktop/namespace-access.md). + control](/manuals/enterprise/hardened-desktop/namespace-access.md). - Administrators can now prevent creating public repositories within organization namespaces using the [Disable public repositories](/manuals/docker-hub/settings.md#disable-creation-of-public-repos) setting. @@ -28,7 +28,7 @@ This page provides details on new features, enhancements, known issues, and bug ### New - Administrators can now use an allow list with [Image Access - Management](/manuals/enterprise/security/hardened-desktop/image-access-management.md) + Management](/manuals/enterprise/hardened-desktop/image-access-management.md) to approve specific repositories that bypass image access controls. ## 2025-01-30 @@ -55,13 +55,13 @@ This page provides details on new features, enhancements, known issues, and bug - Enforce sign-in with [configuration profiles](/manuals/platform/security/authentication/enforce-sign-in/methods.md#configuration-profiles-method-mac-only) (Early Access). - Enforce sign-in for more than one organization at a time (Early Access). - Deploy Docker Desktop for Mac in bulk with the [PKG installer](/manuals/enterprise/enterprise-deployment/pkg-install-and-configure.md) (Early Access). - - [Use Desktop Settings Management via the Docker Admin Console](/manuals/enterprise/security/hardened-desktop/settings-management/configure-admin-console.md) (Early Access). + - [Use Desktop Settings Management via the Docker Admin Console](/manuals/enterprise/hardened-desktop/settings-management/configure-admin-console.md) (Early Access). ### Bug fixes and enhancements - Enhance Container Isolation (ECI) has been improved to: - - Permit admins to [turn off Docker socket mount restrictions](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/config.md#allowing-all-containers-to-mount-the-docker-socket). - - Support wildcard tags when using the [`allowedDerivedImages` setting](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/config.md#docker-socket-mount-permissions-for-derived-images). + - Permit admins to [turn off Docker socket mount restrictions](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/config.md#allowing-all-containers-to-mount-the-docker-socket). + - Support wildcard tags when using the [`allowedDerivedImages` setting](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/config.md#docker-socket-mount-permissions-for-derived-images). ## 2024-11-11 diff --git a/content/manuals/enterprise/security/images/jit-disabled-flow.svg b/content/manuals/platform/security/images/jit-disabled-flow.svg similarity index 100% rename from content/manuals/enterprise/security/images/jit-disabled-flow.svg rename to content/manuals/platform/security/images/jit-disabled-flow.svg diff --git a/content/manuals/enterprise/security/images/jit-enabled-flow.svg b/content/manuals/platform/security/images/jit-enabled-flow.svg similarity index 100% rename from content/manuals/enterprise/security/images/jit-enabled-flow.svg rename to content/manuals/platform/security/images/jit-enabled-flow.svg diff --git a/content/manuals/platform/security/security-announcements.md b/content/manuals/platform/security/security-announcements.md index aba5f04dcacc..58ba226274c1 100644 --- a/content/manuals/platform/security/security-announcements.md +++ b/content/manuals/platform/security/security-announcements.md @@ -68,7 +68,7 @@ A vulnerability in Docker Desktop for Windows was fixed on October 23 in the [4. A vulnerability in Docker Desktop was fixed on September 25 in the [4.47.0](/manuals/desktop/release-notes.md#4470) release: -- Fixed [CVE-2025-10657](https://www.cve.org/CVERecord?id=CVE-2025-10657) where the Enhanced Container Isolation [Docker Socket command restrictions](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/config.md#command-restrictions) feature was not working properly in Docker Desktop 4.46.0 only (the configuration for it was being ignored). +- Fixed [CVE-2025-10657](https://www.cve.org/CVERecord?id=CVE-2025-10657) where the Enhanced Container Isolation [Docker Socket command restrictions](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/config.md#command-restrictions) feature was not working properly in Docker Desktop 4.46.0 only (the configuration for it was being ignored). ## Docker Desktop 4.44.3 security update: CVE-2025-9074 @@ -167,9 +167,9 @@ If you are unable to update to an unaffected version promptly, follow these best - Only use trusted Docker images (such as [Docker Official Images](/manuals/docker-hub/image-library/trusted-content.md#docker-official-images)). - Don't build Docker images from untrusted sources or untrusted Dockerfiles. -- If you are a Docker Business customer using Docker Desktop and unable to update to v4.27.1, make sure to enable [Hardened Docker Desktop](/manuals/enterprise/security/hardened-desktop/_index.md) features such as: - - [Enhanced Container Isolation](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/_index.md), which mitigates the impact of CVE-2024-21626 in the case of running containers from malicious images. - - [Image Access Management](/manuals/enterprise/security/hardened-desktop/image-access-management.md), and [Registry Access Management](/manuals/enterprise/security/hardened-desktop/registry-access-management.md), which give organizations control over which images and repositories their users can access. +- If you are a Docker Business customer using Docker Desktop and unable to update to v4.27.1, make sure to enable [Hardened Docker Desktop](/manuals/enterprise/hardened-desktop/_index.md) features such as: + - [Enhanced Container Isolation](/manuals/enterprise/hardened-desktop/enhanced-container-isolation/_index.md), which mitigates the impact of CVE-2024-21626 in the case of running containers from malicious images. + - [Image Access Management](/manuals/enterprise/hardened-desktop/image-access-management.md), and [Registry Access Management](/manuals/enterprise/hardened-desktop/registry-access-management.md), which give organizations control over which images and repositories their users can access. - For CVE-2024-23650, CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653, avoid using BuildKit frontend from an untrusted source. A frontend image is usually specified as the #syntax line on your Dockerfile, or with `--frontend` flag when using the `buildctl build` command. - To mitigate CVE-2024-24557, make sure to either use BuildKit or disable caching when building images. From the CLI this can be done via the `DOCKER_BUILDKIT=1` environment variable (default for Moby >= v23.0 if the buildx plugin is installed) or the `--no-cache flag`. If you are using the HTTP API directly or through a client, the same can be done by setting `nocache` to `true` or `version` to `2` for the [/build API endpoint](https://docs.docker.com/reference/api/engine/version/v1.44/#tag/Image/operation/ImageBuild). diff --git a/data/redirects.yml b/data/redirects.yml index 7a8ce4002db2..5612772e4af0 100644 --- a/data/redirects.yml +++ b/data/redirects.yml @@ -317,7 +317,7 @@ "/admin/organization/insights/#extensions": - /go/insights-extensions/ -"/enterprise/security/hardened-desktop/settings-management/": +"/enterprise/hardened-desktop/settings-management/": - /go/settings-management/ # Billing - cancellation From 22ec9e224e534b147cae6e90e742e49d7d8795db Mon Sep 17 00:00:00 2001 From: Alexa Date: Thu, 27 Aug 2026 11:53:39 -0500 Subject: [PATCH 3/4] Fix CI failures from Hardened Desktop path move. Co-authored-by: Cursor --- .../enterprise-deployment/msi-install-and-configure.md | 2 +- content/manuals/enterprise/hardened-desktop/_index.md | 2 +- .../enterprise/hardened-desktop/air-gapped-containers.md | 4 +++- .../enhanced-container-isolation/limitations.md | 2 +- .../settings-management/compliance-reporting.md | 2 +- .../settings-management/configure-admin-console.md | 2 +- .../settings-management/configure-json-file.md | 2 +- .../settings-management/settings-reference.md | 2 +- content/manuals/faqs/sso-faqs.md | 2 +- 9 files changed, 11 insertions(+), 9 deletions(-) diff --git a/content/manuals/enterprise/enterprise-deployment/msi-install-and-configure.md b/content/manuals/enterprise/enterprise-deployment/msi-install-and-configure.md index 28af5ffd7def..d9084ec238c2 100644 --- a/content/manuals/enterprise/enterprise-deployment/msi-install-and-configure.md +++ b/content/manuals/enterprise/enterprise-deployment/msi-install-and-configure.md @@ -41,7 +41,7 @@ If your administrator account is different from your user account, you must add > [!NOTE] > > When installing Docker Desktop with the MSI, in-app updates are automatically disabled by default. This ensures organizations can maintain version consistency and prevent unapproved updates. -> Starting with Docker Desktop version 4.60 and later, in-app updates from an MSI installation can be enabled by changing the `disableUpdate` setting to `false` through [Settings Management](../security/hardened-desktop/settings-management/). +> Starting with Docker Desktop version 4.60 and later, in-app updates from an MSI installation can be enabled by changing the `disableUpdate` setting to `false` through [Settings Management](../hardened-desktop/settings-management/). > > Docker Desktop notifies you when an update is available. To update Docker Desktop, download the latest installer from Docker Home. Navigate to the **Deploy** page. > diff --git a/content/manuals/enterprise/hardened-desktop/_index.md b/content/manuals/enterprise/hardened-desktop/_index.md index c583ee442710..38e76abc9783 100644 --- a/content/manuals/enterprise/hardened-desktop/_index.md +++ b/content/manuals/enterprise/hardened-desktop/_index.md @@ -10,7 +10,7 @@ params: group: Enterprise aliases: - /security/for-admins/hardened-desktop/ - - /enterprise/hardened-desktop/ + - /enterprise/security/hardened-desktop/ - /enterprise/security/ grid: - title: "Settings Management" diff --git a/content/manuals/enterprise/hardened-desktop/air-gapped-containers.md b/content/manuals/enterprise/hardened-desktop/air-gapped-containers.md index d564dd074b93..54758d90a0c9 100644 --- a/content/manuals/enterprise/hardened-desktop/air-gapped-containers.md +++ b/content/manuals/enterprise/hardened-desktop/air-gapped-containers.md @@ -141,8 +141,9 @@ function FindProxyForURL(url, host) { ### General considerations - `FindProxyForURL` function URL parameter format is `http://host_or_ip:port` or `https://host_or_ip:port` - - If you have an internal container trying to access `https://docs.docker.com/enterprise/hardened-desktop/air-gapped-containers` the Docker proxy service will submit docs.docker.com for the host value and https://docs.docker.com:443 for the url value to `FindProxyForURL`, if you are using `shExpMatch` function in your PAC file as follows: + - If you have an internal container trying to access `https://docs.docker.com/enterprise/hardened-desktop/air-gapped-containers` the Docker proxy service will submit docs.docker.com for the host value and https://docs.docker.com:443 for the URL value to `FindProxyForURL`, if you are using `shExpMatch` function in your PAC file as follows: + ```console if(shExpMatch(url, "https://docs.docker.com:443/enterprise/hardened-desktop/*")) return "DIRECT"; ``` @@ -152,6 +153,7 @@ function FindProxyForURL(url, host) { ```console if (host == docs.docker.com && url.indexOf(":443") > 0) return "DIRECT"; ``` + ### PAC file return values diff --git a/content/manuals/enterprise/hardened-desktop/enhanced-container-isolation/limitations.md b/content/manuals/enterprise/hardened-desktop/enhanced-container-isolation/limitations.md index ff1acc985d3b..119c7ce3b403 100644 --- a/content/manuals/enterprise/hardened-desktop/enhanced-container-isolation/limitations.md +++ b/content/manuals/enterprise/hardened-desktop/enhanced-container-isolation/limitations.md @@ -7,8 +7,8 @@ toc_max: 3 weight: 30 aliases: - /security/for-admins/hardened-desktop/enhanced-container-isolation/limitations/ + - /enterprise/security/hardened-desktop/enhanced-container-isolation/limitations/ --- - - /enterprise/security/hardened-desktop/enhanced-container-isolation/limitations/ {{< summary-bar feature_name="Hardened Docker Desktop" >}} diff --git a/content/manuals/enterprise/hardened-desktop/settings-management/compliance-reporting.md b/content/manuals/enterprise/hardened-desktop/settings-management/compliance-reporting.md index 52ba7c6c12cc..82e455832d94 100644 --- a/content/manuals/enterprise/hardened-desktop/settings-management/compliance-reporting.md +++ b/content/manuals/enterprise/hardened-desktop/settings-management/compliance-reporting.md @@ -6,8 +6,8 @@ keywords: settings management, compliance reporting, docker home, policy enforce weight: 30 aliases: - /security/for-admins/hardened-desktop/settings-management/compliance-reporting/ + - /enterprise/security/hardened-desktop/settings-management/compliance-reporting/ --- - - /enterprise/security/hardened-desktop/settings-management/compliance-reporting/ {{< summary-bar feature_name="Compliance reporting" >}} diff --git a/content/manuals/enterprise/hardened-desktop/settings-management/configure-admin-console.md b/content/manuals/enterprise/hardened-desktop/settings-management/configure-admin-console.md index ba2a742b9dfb..5a3e267b7b70 100644 --- a/content/manuals/enterprise/hardened-desktop/settings-management/configure-admin-console.md +++ b/content/manuals/enterprise/hardened-desktop/settings-management/configure-admin-console.md @@ -6,8 +6,8 @@ keywords: docker home, settings management, policy configuration, enterprise con weight: 20 aliases: - /security/for-admins/hardened-desktop/settings-management/configure-admin-console/ ---- - /enterprise/security/hardened-desktop/settings-management/configure-admin-console/ +--- {{< summary-bar feature_name="Admin Console" >}} diff --git a/content/manuals/enterprise/hardened-desktop/settings-management/configure-json-file.md b/content/manuals/enterprise/hardened-desktop/settings-management/configure-json-file.md index 819d3e40cbc4..8438fe0cd492 100644 --- a/content/manuals/enterprise/hardened-desktop/settings-management/configure-json-file.md +++ b/content/manuals/enterprise/hardened-desktop/settings-management/configure-json-file.md @@ -7,8 +7,8 @@ weight: 10 aliases: - /security/for-admins/hardened-desktop/settings-management/configure/ - /security/for-admins/hardened-desktop/settings-management/configure-json-file/ ---- - /enterprise/security/hardened-desktop/settings-management/configure-json-file/ +--- {{< summary-bar feature_name="Hardened Docker Desktop" >}} diff --git a/content/manuals/enterprise/hardened-desktop/settings-management/settings-reference.md b/content/manuals/enterprise/hardened-desktop/settings-management/settings-reference.md index 8599ded1fcb7..1462378fdad6 100644 --- a/content/manuals/enterprise/hardened-desktop/settings-management/settings-reference.md +++ b/content/manuals/enterprise/hardened-desktop/settings-management/settings-reference.md @@ -6,8 +6,8 @@ keywords: docker desktop settings, configuration reference, admin controls, sett toc_max: 2 aliases: - /security/for-admins/hardened-desktop/settings-management/settings-reference/ + - /enterprise/security/hardened-desktop/settings-management/settings-reference/ --- - - /enterprise/security/hardened-desktop/settings-management/settings-reference/ This reference documents Docker Desktop settings that administrators can configure using [Settings Management](/manuals/enterprise/hardened-desktop/settings-management/_index.md). Use this page to understand which settings are available, their accepted values, platform compatibility, and which configuration methods apply. diff --git a/content/manuals/faqs/sso-faqs.md b/content/manuals/faqs/sso-faqs.md index f240536a609d..030a535d7c69 100644 --- a/content/manuals/faqs/sso-faqs.md +++ b/content/manuals/faqs/sso-faqs.md @@ -84,7 +84,7 @@ Yes, bot accounts need seats like regular users, requiring a non-aliased domain The SSO implementation uses Just-in-Time (JIT) provisioning by default. You can optionally turn off JIT in Docker Home if you turn on auto-provisioning using SCIM. See [Just-in-Time provisioning](/manuals/platform/security/provisioning/just-in-time.md). -## My Entra ID SSO connection isn't working and shows an error. How can I troubleshoot this? +## How can I troubleshoot an Entra ID SSO connection error? Confirm that you've configured the necessary API permissions in Entra ID for your SSO connection. You need to grant administrator consent within your Entra ID tenant. See [Entra ID (formerly Azure AD) documentation](https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/grant-admin-consent?pivots=portal#grant-admin-consent-in-app-registrations). From 5d54f62a0a6008fff8529cd73e71603bddd3c854 Mon Sep 17 00:00:00 2001 From: Alexa Date: Thu, 27 Aug 2026 12:00:46 -0500 Subject: [PATCH 4/4] Fix broken access token links for htmltest. Co-authored-by: Cursor --- content/manuals/dhi/how-to/helm.md | 2 +- content/manuals/scout/integrations/registry/acr.md | 2 +- content/manuals/scout/integrations/registry/artifactory.md | 2 +- content/manuals/scout/integrations/registry/ecr.md | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/content/manuals/dhi/how-to/helm.md b/content/manuals/dhi/how-to/helm.md index 4f73db28ca86..cfc3ba372162 100644 --- a/content/manuals/dhi/how-to/helm.md +++ b/content/manuals/dhi/how-to/helm.md @@ -54,7 +54,7 @@ authentication. 1. For `dhi.io` or Docker Hub, create a [personal access token (PAT)](/platform/security/access-tokens/personal-access-tokens/) using your Docker account or an - [organization access token (OAT)](/enterprise/platform/security/access-tokens/personal-access-tokens/). + [organization access token (OAT)](/platform/security/access-tokens/organization-access-tokens/). Ensure the token has at least read-only access to the Docker Hardened Image repositories. 2. Create a secret in Kubernetes using the following command. Replace ``, ``, diff --git a/content/manuals/scout/integrations/registry/acr.md b/content/manuals/scout/integrations/registry/acr.md index 9e1b500c410a..8c4871ce0ce4 100644 --- a/content/manuals/scout/integrations/registry/acr.md +++ b/content/manuals/scout/integrations/registry/acr.md @@ -189,7 +189,7 @@ what the integration provided. 4. Set up your Scout credentials. 1. Generate an organization access token. For more details, see - [Create an organization access token](/enterprise/platform/security/access-tokens/personal-access-tokens/#create-an-organization-access-token). + [Create an organization access token](/platform/security/access-tokens/organization-access-tokens/#create-an-organization-access-token). 2. Sign in to Docker using the organization access token. ```console diff --git a/content/manuals/scout/integrations/registry/artifactory.md b/content/manuals/scout/integrations/registry/artifactory.md index 73c975aa9f2e..002e4daec75a 100644 --- a/content/manuals/scout/integrations/registry/artifactory.md +++ b/content/manuals/scout/integrations/registry/artifactory.md @@ -102,7 +102,7 @@ Scout. 1. Generate an organization access token for accessing Scout. For more details, see [Create an organization access - token](/enterprise/platform/security/access-tokens/personal-access-tokens/#create-an-organization-access-token). + token](/platform/security/access-tokens/organization-access-tokens/#create-an-organization-access-token). 2. Sign in to Docker using the organization access token. ```console diff --git a/content/manuals/scout/integrations/registry/ecr.md b/content/manuals/scout/integrations/registry/ecr.md index 268667f01565..cb02b03cd6e7 100644 --- a/content/manuals/scout/integrations/registry/ecr.md +++ b/content/manuals/scout/integrations/registry/ecr.md @@ -228,7 +228,7 @@ what the integration provided. 4. Set up your Scout credentials. 1. Generate an organization access token. For more details, see - [Create an organization access token](/enterprise/platform/security/access-tokens/personal-access-tokens/#create-an-organization-access-token). + [Create an organization access token](/platform/security/access-tokens/organization-access-tokens/#create-an-organization-access-token). 2. Sign in to Docker using the organization access token. ```console