diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 8c66352f48d8..32035af6ed63 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -25,14 +25,12 @@ /content/reference/cli/ @dvdksn -/content/manuals/subscription/ @akristen +/content/manuals/subscription-billing/ @akristen /content/manuals/security/ @aevesdocker @akristen /content/manuals/admin/ @akristen -/content/manuals/billing/ @akristen - /content/manuals/accounts/ @akristen /content/manuals/support/ @akristen diff --git a/.github/labeler.yml b/.github/labeler.yml index d7a4a910758e..fbb9eeffe71c 100644 --- a/.github/labeler.yml +++ b/.github/labeler.yml @@ -143,17 +143,17 @@ area/scout: area/billing: - changed-files: - any-glob-to-any-file: - - content/manuals/billing/** + - content/manuals/subscription-billing/** area/subscription: - changed-files: - any-glob-to-any-file: - - content/manuals/subscription/** + - content/manuals/subscription-billing/** area/admin: - changed-files: - any-glob-to-any-file: - - content/manuals/admin/** + - content/manuals/accounts/organization/** area/extensions: - changed-files: @@ -175,6 +175,7 @@ area/accounts: - changed-files: - any-glob-to-any-file: - content/manuals/accounts/** + - content/manuals/faqs/** area/copilot: - changed-files: diff --git a/COMPONENTS.md b/COMPONENTS.md index 69eeef375181..8a35a66a5918 100644 --- a/COMPONENTS.md +++ b/COMPONENTS.md @@ -296,7 +296,7 @@ features: | subscription | Subscription tier required | All, Personal, Pro, Team, Business | | availability | Product development stage | Experimental, Beta, Early Access, GA, Retired | | requires | Minimum version requirement | String describing version (link to release notes) | -| for | Indicates administrator-only features | Administrators | +| for | Audience for the feature | Administrators, Individuals | ### Buttons diff --git a/content/guides/admin-set-up.md b/content/guides/admin-set-up.md index 4978217bb01c..99f7e6db7b0a 100644 --- a/content/guides/admin-set-up.md +++ b/content/guides/admin-set-up.md @@ -51,7 +51,7 @@ policies. This guide covers the following Docker features: -- [Organizations](/manuals/admin/organization/_index.md): The core structure +- [Organizations](/manuals/accounts/organization/_index.md): The core structure for managing your Docker environment, grouping users, teams, and image repositories. Your organization was created with your subscription and is managed by one or more owners. Users signed into the organization are @@ -60,7 +60,7 @@ This guide covers the following Docker features: By default, Docker Desktop doesn't require sign-in. You can configure settings to enforce this and ensure your developers sign in to your Docker organization. -- [SSO](/manuals/enterprise/security/single-sign-on/_index.md): Without SSO, +- [SSO](/manuals/security/authentication/single-sign-on/_index.md): Without SSO, user management in a Docker organization is manual. Setting up an SSO connection between your identity provider and Docker ensures compliance with your security policy and automates user provisioning. Adding @@ -130,7 +130,7 @@ files to be distributed to developer machines. Use MDM tools to deploy these con ### Identify Docker organizations Some companies may have more than one -[Docker organization](/manuals/admin/organization/_index.md) created. These +[Docker organization](/manuals/accounts/organization/_index.md) created. These organizations may have been created for specific purposes, or may not be needed anymore. @@ -185,8 +185,8 @@ settings, along with your chosen method for [enforcing sign-in](/manuals/enterpr ### Manage your organizations If you have more than one organization, consider either [consolidating them -into one organization](/manuals/admin/organization/setup/orgs.md) or creating a -[Docker company](/manuals/admin/company/_index.md) to manage multiple +into one organization](/manuals/accounts/organization/setup/orgs.md) or creating a +[Docker company](/manuals/accounts/company/_index.md) to manage multiple organizations. ### Begin setup @@ -196,9 +196,9 @@ organizations. Single sign-on (SSO) lets developers authenticate using their identity providers (IdPs) to access Docker. SSO is available for a whole company and all associated organizations, or an individual organization that has a Docker Business subscription. For more information, see the -[documentation](/manuals/enterprise/security/single-sign-on/_index.md). +[documentation](/manuals/security/authentication/single-sign-on/_index.md). -You can also enable [SCIM](/manuals/enterprise/security/provisioning/scim/_index.md) +You can also enable [SCIM](/manuals/security/provisioning/scim/_index.md) for further automation of provisioning and deprovisioning of users. #### Set up Docker product entitlements included in the subscription @@ -252,7 +252,7 @@ SSO and SCIM setup. > [!IMPORTANT] > > Some users may need CLI based logins to Docker Hub, and for this they will -> need a [personal access token (PAT)](/manuals/security/access-tokens.md). +> need a [personal access token (PAT)](/manuals/security/access-tokens/personal-access-tokens.md). ### Test Registry Access Management and Image Access Management @@ -312,7 +312,7 @@ that matches your verified domain must sign in using your SSO connection. Make sure the Identity provider groups associated with your SSO connection cover all the developer groups that you want to have access to the Docker subscription. -For instructions on how to enforce SSO, see [Enforce SSO](/manuals/enterprise/security/single-sign-on/connect.md). +For instructions on how to enforce SSO, see [Enforce SSO](/manuals/security/authentication/single-sign-on/connect.md). ### Deploy configuration settings and enforce sign-in to users @@ -325,6 +325,6 @@ for Docker. To continue optimizing your Docker environment: -- Review your [organization's usage data](/manuals/admin/insights.md) to track adoption +- Review your [organization's usage data](/manuals/accounts/organization/insights.md) to track adoption - Monitor [Docker Scout findings](/manuals/scout/explore/analysis.md) for security insights -- Explore [additional security features](/manuals/enterprise/security/_index.md) to enhance your configuration +- Explore [additional security features](/manuals/enterprise/security/hardened-desktop/_index.md) to enhance your configuration diff --git a/content/guides/admin-user-management.md b/content/guides/admin-user-management.md index 84ff0adb7545..0ec2938bde7c 100644 --- a/content/guides/admin-user-management.md +++ b/content/guides/admin-user-management.md @@ -46,7 +46,7 @@ With the right configurations, you can ensure your developers have easy access t Before setting up roles and permissions, it's important to have a clear understanding of who in your organization requires Docker access. Focus on gathering a comprehensive view of active users, their roles within projects, and how they interact with Docker resources. This process can be supported by tools like device management software or manual assessments. Encourage all users to update their Docker accounts to use organizational email addresses, ensuring seamless integration with your subscription. -For steps on how you can do this, see [step 1 of onboarding your organization](/manuals/admin/organization/setup/onboard.md). +For steps on how you can do this, see [step 1 of onboarding your organization](/manuals/accounts/organization/setup/onboard.md). ### Assign roles strategically @@ -58,7 +58,7 @@ Docker's predefined roles offer flexibility for various organizational needs. As - Editor: Partial administrative access to the organization. Editors can create, edit, and delete repositories. They can also edit an existing team's access permissions. - Owner: Full organization administrative access. Owners can manage organization repositories, teams, members, settings, and billing. -For more information, see [Roles and permissions](/manuals/enterprise/security/roles-and-permissions.md). +For more information, see [Roles and permissions](/manuals/security/roles-and-permissions.md). #### Enhance with teams @@ -68,7 +68,7 @@ Teams in Docker provide a structured way to manage member access and they provid - Assign permissions at the team level rather than individually. For instance, a development team might have "Read & Write" access to certain repositories, while a QA team has "Read-only" access. - As teams grow or responsibilities shift, you can easily update permissions or add new members, maintaining consistency without reconfiguring individual settings. -For more information, see [Create and manage a team](/manuals/admin/organization/manage/manage-a-team.md). +For more information, see [Create and manage a team](/manuals/accounts/organization/manage/manage-a-team.md). #### Example scenarios @@ -89,7 +89,7 @@ This page guides you through onboarding owners and members, and using tools like When you create a Docker organization, you automatically become its sole owner. While optional, adding additional owners can significantly ease the process of onboarding and managing your organization by distributing administrative responsibilities. It also ensures continuity and prevents blockers if the primary owner is unavailable. -For detailed information on owners, see [Roles and permissions](/manuals/enterprise/security/roles-and-permissions.md). +For detailed information on owners, see [Roles and permissions](/manuals/security/roles-and-permissions.md). ### Invite members and assign roles @@ -103,7 +103,7 @@ Members are granted controlled access to resources and enjoy enhanced organizati - Access to enhanced features: Members benefit from organization-wide perks, such as increased pull limits and access to premium Docker features. - Security control: Apply and enforce security settings at an organizational level, reducing risks associated with unmanaged accounts. -For detailed information, see [Manage organization members](/manuals/admin/organization/manage/members.md). +For detailed information, see [Manage organization members](/manuals/accounts/organization/manage/members.md). ### Future-proof user management @@ -119,11 +119,11 @@ SSO: - Reduces password-related vulnerabilities. - Simplifies onboarding as it works seamlessly with SCIM and group mapping for automated provisioning. -For more information, see the [SSO documentation](/manuals/enterprise/security/single-sign-on/_index.md). +For more information, see the [SSO documentation](/manuals/security/authentication/single-sign-on/_index.md). #### Automate onboarding with SCIM and JIT provisioning -Streamline user provisioning and role management with [SCIM](/manuals/enterprise/security/provisioning/scim/_index.md) and [Just-in-Time (JIT) provisioning](/manuals/enterprise/security/provisioning/just-in-time.md). +Streamline user provisioning and role management with [SCIM](/manuals/security/provisioning/scim/_index.md) and [Just-in-Time (JIT) provisioning](/manuals/security/provisioning/just-in-time.md). With SCIM you can: @@ -145,7 +145,7 @@ It also: - Ensures consistent access control policies. - Help you scale permissions as teams grow or change. -For more information on how it works, see [Group mapping](/manuals/enterprise/security/provisioning/scim/group-mapping.md). +For more information on how it works, see [Group mapping](/manuals/security/provisioning/scim/group-mapping.md). ## Monitoring and insights @@ -168,7 +168,7 @@ Activity logs are available for Docker Team or Docker Business plans, with data - Team collaboration review: Logs show which team members pushed updates to a critical repository, ensuring accountability during a development sprint. - Billing adjustments: Track who added or removed subscription seats to maintain budgetary control and compliance. -For more information, see [Activity logs](/manuals/admin/activity-logs.md). +For more information, see [Activity logs](/manuals/accounts/organization/activity-logs.md). ### Insights @@ -186,13 +186,13 @@ Insights provide data-driven views of Docker usage to improve team productivity - Build efficiency: Track average build times and success rates to pinpoint bottlenecks in development processes. - Container utilization: Analyze container activity across departments to ensure proper resource distribution and cost efficiency. -For more information, see [Insights](/manuals/admin/insights.md). +For more information, see [Insights](/manuals/accounts/organization/insights.md). ### Next steps Now that you've mastered user and access management in Docker, you can: -- Review your [activity logs](/manuals/admin/activity-logs.md) regularly to maintain security awareness -- Check your [Insights dashboard](/manuals/admin/insights.md) to identify opportunities for optimization -- Explore [advanced security features](/manuals/enterprise/security/_index.md) to further enhance your Docker environment +- Review your [activity logs](/manuals/accounts/organization/activity-logs.md) regularly to maintain security awareness +- Check your [Insights dashboard](/manuals/accounts/organization/insights.md) to identify opportunities for optimization +- Explore [advanced security features](/manuals/enterprise/security/hardened-desktop/_index.md) to further enhance your Docker environment - Share best practices with your team to ensure consistent adoption of security policies diff --git a/content/guides/genai-claude-code-mcp.md b/content/guides/genai-claude-code-mcp.md index c71ee9f89203..9e4fcb449737 100644 --- a/content/guides/genai-claude-code-mcp.md +++ b/content/guides/genai-claude-code-mcp.md @@ -71,7 +71,7 @@ Make sure you have: 1. Select the **Docker Hub**MCP server 1. Add the MCP server, then open the **Configuration** tab 1. Enter your Docker Hub username -1. [Create a read-only personal access token](/security/access-tokens/#create-a-personal-access-token) and enter your access token under **Secrets** +1. [Create a read-only personal access token](/security/access-tokens/personal-access-tokens/#create-a-personal-access-token) and enter your access token under **Secrets** 1. Save the configuration ![Docker Hub](images/genai-claude-code-mcp-catalog-docker-hub.avif "Docker Hub") diff --git a/content/guides/gha.md b/content/guides/gha.md index 4da6330e797f..085cbf0565bf 100644 --- a/content/guides/gha.md +++ b/content/guides/gha.md @@ -52,7 +52,7 @@ that, you must authenticate with your Docker credentials (username and access token) as part of the GitHub Actions workflow. For instructions on how to create a Docker access token, see -[Create and manage access tokens](/manuals/security/access-tokens.md). +[Create and manage access tokens](/manuals/security/access-tokens/personal-access-tokens.md). Once you have your Docker credentials ready, add the credentials to your GitHub repository so you can use them in GitHub Actions: diff --git a/content/manuals/_index.md b/content/manuals/_index.md index 20c7a49c57b4..51b69b2d9239 100644 --- a/content/manuals/_index.md +++ b/content/manuals/_index.md @@ -12,7 +12,7 @@ params: - AI and agents - Application development - Supply chain security - - Platform + - Accounts and admin - Enterprise notoc: true ai-and-agents: @@ -79,31 +79,39 @@ params: icon: /icons/Scout.svg link: /scout/ platform: - - title: Administration - description: Centralized observability for companies and organizations. - icon: shield-check - link: /admin/ - - title: Billing - description: Manage billing and payment methods. - icon: credit-card - link: /billing/ - title: Accounts - description: Manage your Docker account. + description: Manage Docker individual and organization accounts. icon: user-circle link: /accounts/ + - title: Subscription and billing + description: Manage Docker subscriptions, plans, billing, and payments. + icon: credit-card + link: /subscription-billing/ - title: Security description: Security guardrails for both administrators and developers. icon: lock-closed link: /security/ - - title: Subscription - description: Commercial use licenses for Docker products. - icon: credit-card - link: /subscription/ + - title: FAQs + description: Frequently asked questions about Docker accounts, organizations, companies, subscriptions, billing, and security. + icon: question-mark-circle + link: /faqs/ + - title: Support + description: Support options for paid subscriptions and community resources. + icon: chat-bubble-left + link: /support/ + - title: Release notes + description: Features, bug fixes, and breaking changes for Docker Home, billing, security, and subscriptions. + icon: document-plus + link: /platform-release-notes/ enterprise: - title: Deploy Docker Desktop description: Deploy Docker Desktop at scale within your company icon: arrow-down-tray link: /enterprise/enterprise-deployment/ + - title: Hardened Docker Desktop + description: Security features that strengthen developer environments. + icon: shield-check + link: /enterprise/security/hardened-desktop/ --- This section contains user guides on how to install, set up, configure, and use @@ -127,10 +135,9 @@ Security guardrails and image analysis for your software supply chain. {{< grid items=supply-chain-security >}} -## Platform +## Accounts and admin -Documentation related to the Docker platform, such as administration and -subscription management. +Manage Docker accounts, administration, subscriptions, billing, and security. {{< grid items=platform >}} diff --git a/content/manuals/accounts/_index.md b/content/manuals/accounts/_index.md index 67ffb1841983..0c8bebc8369b 100644 --- a/content/manuals/accounts/_index.md +++ b/content/manuals/accounts/_index.md @@ -1,63 +1,55 @@ --- -title: Docker accounts +title: Accounts description: > - Learn what a Docker account is, how Docker IDs, emails, and sign-in methods - relate, and how individual accounts connect to organizations -keywords: accounts, docker ID, username, email, Google, GitHub, sign-in, - authentication, account management, docker account, individual account, - organization account, account types, Docker Hub, SSO, deactivate account + Manage Docker individual accounts and organization administration, including + members, teams, and companies. +keywords: accounts, admin, Docker ID, organization, company, Docker Home, + account management weight: 10 params: sidebar: - group: Platform + group: Accounts and admin grid: - - title: Create an account - description: Get started with Docker and create an account. - icon: finger-print - link: /accounts/create-account/ - - title: Manage account - description: Learn how to manage the settings for your account. - icon: cog - link: /accounts/manage-account/ - - title: Personal access tokens - description: Learn how to create and manage access tokens for your account. - icon: lock-closed - link: /security/access-tokens/ - - title: Set up two-factor authentication - description: Add an extra layer of authentication to your Docker account. - link: /security/2fa/ - icon: device-phone-mobile - - title: Organization overview - description: Learn how to create and manage Docker organizations. + - title: Docker individual accounts + description: Create and manage your Docker ID, email, and sign-in methods. + icon: user-circle + link: /accounts/individual/ + - title: Organization accounts + description: Manage members, teams, and organization settings. icon: building-storefront - link: /admin/organization/ - - title: Account FAQs - description: Explore frequently asked questions about Docker accounts. + link: /accounts/organization/ + - title: Company accounts + description: Group multiple organizations for centralized administration. + icon: building-office-2 + link: /accounts/company/ + - title: Security + description: Authentication, tokens, and roles for accounts and organizations. + icon: lock-closed + link: /security/ + - title: Subscription and billing + description: Plans, payments, and invoices for your account or organization. + icon: credit-card + link: /subscription-billing/ + - title: FAQs + description: Common questions about accounts, billing, and security. icon: question-mark-circle - link: /accounts/general-faqs/ + link: /faqs/ --- -A Docker account is how Docker identifies you. Use it to access products like -Docker Hub and Docker Desktop, manage settings, and join organizations. - -Docker has two primary account types: individual and organization. You create -and administer organizations with your individual account. For organization -accounts, see [Organizations](/manuals/admin/organization/_index.md). For -organizations and companies, see [Administration](/manuals/admin/_index.md). - -## Docker ID, email, and sign-in +A Docker account identifies you and lets you access Docker products. You +manage it in [Docker Home](https://app.docker.com/). Docker has two +primary account types: individual and organization. A company groups +multiple organizations. -When you create an account, you choose a Docker ID and a sign-in method. -Docker also ties a verified email to the account. +| Account type | What it is | Who it's for | +| --- | --- | --- | +| Individual | A Docker ID with personal settings, Hub repositories, and sign-in methods | A person | +| Organization | A shared workspace for members, teams, and repositories | Teams on Docker Team or Business | +| Company | Multiple organizations under centralized administration | Docker Business subscribers | -- Docker account: Associates your plans, Hub repositories, and account - settings. -- Docker ID: A unique username that identifies you. -- Email: How Docker contacts you for notifications and security-related - communications. -- Sign-in method: Email and password, - [single sign-on (SSO)](/manuals/enterprise/security/single-sign-on/_index.md), - Google, or GitHub. +You always sign in with your individual account, then work in the +organizations you own or belong to. Those organizations sit under a +company when you administer more than one. ## Next steps diff --git a/content/manuals/admin/company/_index.md b/content/manuals/accounts/company/_index.md similarity index 60% rename from content/manuals/admin/company/_index.md rename to content/manuals/accounts/company/_index.md index 55398a5b3474..e55aaf076e05 100644 --- a/content/manuals/admin/company/_index.md +++ b/content/manuals/accounts/company/_index.md @@ -8,43 +8,52 @@ grid: - title: Create a company description: Get started by learning how to create a company. icon: building-office-2 - link: /admin/company/new-company/ + link: /accounts/company/new-company/ - title: Manage your company description: Add organizations, manage company owners, and invite members. icon: building-storefront - link: /admin/company/manage/ + link: /accounts/company/manage/ - title: Configure SSO and SCIM description: Set up single sign-on and SCIM provisioning for your company. icon: key - link: /enterprise/security/single-sign-on/ + link: /security/authentication/single-sign-on/ - title: Domain management description: Add and verify your company's domains. icon: check-badge - link: /enterprise/security/domain-management/ + link: /security/provisioning/domain-management/ - title: FAQs description: Explore frequently asked questions about companies. - link: /faq/admin/company-faqs/ + link: /faqs/accounts/ icon: question-mark-circle aliases: + - /admin/company/ - /docker-hub/creating-companies/ --- {{< summary-bar feature_name="Company" >}} -A company provides a single point of visibility across multiple -organizations, for centralized organization and settings management. +A company groups multiple Docker organizations for centralized configuration +and provides a single point of visibility across those organizations. Organization owners with a Docker Business subscription can create a company and manage it through Docker Home. ## Company structure -The following diagram shows how a company relates to its associated -organizations. +A company sits at the top of the hierarchy and groups multiple Docker +organizations for centralized configuration. Companies are only available +for Docker Business subscribers. -![Diagram showing how companies relate to Docker organizations](/admin/images/docker-admin-structure.webp) +![Diagram showing Docker’s administration hierarchy with Company at the top, followed by Organizations, Teams, and Members](../organization/images/docker-admin-structure.webp) -For the full administration hierarchy, see the -[administration overview](/manuals/admin/_index.md#company-and-organization-hierarchy). +An organization sits below the company. You group teams and members there +and assign access to repositories. Every Docker Team and Business +subscriber has at least one organization. + +For organization structure, including teams and members, see +[Organization accounts](/manuals/accounts/organization/_index.md). + +[Upgrading to a Docker Business plan](https://www.docker.com/pricing?ref=Docs&refAction=DocsAdmin) +grants you the company owner role so you can manage multiple organizations. ## Company roles @@ -62,7 +71,7 @@ organization owners. automatically adds them as an organization member. To add or remove company owners, see -[Manage your company](/manuals/admin/company/manage.md#company-owners). +[Manage your company](/manuals/accounts/company/manage.md#company-owners). ## Next steps diff --git a/content/manuals/admin/company/manage.md b/content/manuals/accounts/company/manage.md similarity index 93% rename from content/manuals/admin/company/manage.md rename to content/manuals/accounts/company/manage.md index 4b91db7a0e2b..a7b466825003 100644 --- a/content/manuals/admin/company/manage.md +++ b/content/manuals/accounts/company/manage.md @@ -5,6 +5,7 @@ weight: 20 description: Learn how to manage your company, including its organizations, owners, and members, using Docker Home. keywords: company, manage company, multiple organizations, company owners, company members, Docker Home, add organization, resend invites aliases: + - /admin/company/manage/ - /admin/company/manage/organizations/ - /admin/company/manage/owners/ - /admin/company/manage/users/ @@ -46,7 +47,7 @@ longer manage it through the company, and its owner must manage it separately. A company can have multiple owners who manage the company and all of its organizations. For details about the company owner role and how it affects -seats, see [Company roles](/manuals/admin/company/_index.md#company-roles). +seats, see [Company roles](/manuals/accounts/company/_index.md#company-roles). ### Add a company owner @@ -108,7 +109,7 @@ To bulk resend invitations: If you have a self-serve subscription that has no pending subscription changes, you can add seats using Docker Home. For more information about adding seats, -see [Manage seats](/manuals/admin/organization/manage/manage-seats.md#add-seats-to-your-subscription). +see [Manage seats](/manuals/accounts/organization/manage/manage-seats.md#add-seats-to-your-subscription). If you have a sales-assisted subscription, you must contact Docker support or sales to add seats. @@ -118,4 +119,4 @@ sales to add seats. Teams exist at the organization level, not the company level. After inviting members to an organization, you can add them to teams within that organization. For more details, see -[Manage members on a team](/manuals/admin/organization/manage/members.md#manage-members-on-a-team). +[Manage members on a team](/manuals/accounts/organization/manage/members.md#manage-members-on-a-team). diff --git a/content/manuals/admin/company/new-company.md b/content/manuals/accounts/company/new-company.md similarity index 98% rename from content/manuals/admin/company/new-company.md rename to content/manuals/accounts/company/new-company.md index 38cd05e04842..0d28f76e3ef6 100644 --- a/content/manuals/admin/company/new-company.md +++ b/content/manuals/accounts/company/new-company.md @@ -5,6 +5,7 @@ weight: 10 description: Learn how to create a company to centrally manage multiple organizations. keywords: company, hub, organization, company owner, Docker Home, company management, Docker Business, create company aliases: + - /admin/company/new-company/ - /docker-hub/new-company/ --- diff --git a/content/manuals/accounts/general-faqs.md b/content/manuals/accounts/general-faqs.md deleted file mode 100644 index 8e00863d7881..000000000000 --- a/content/manuals/accounts/general-faqs.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Docker account FAQs -linkTitle: FAQs -weight: 40 -description: FAQs about Docker IDs, account creation, and organization names -keywords: - docker ID, docker account FAQ, change docker ID, username taken, trademark, - organization name, organization namespace, create account, Google, GitHub, - deactivate docker ID -tags: [FAQ] -aliases: - - /docker-hub/general-faqs/ - - /docker-hub/onboarding-faqs/ - - /faq/admin/general-faqs/ - - /admin/faqs/general-faqs/ ---- - -## What is a Docker ID? - -A Docker ID is a username for your Docker account that lets you access Docker -products. To create a Docker ID you need one of the following: - -- An email address -- A Google account -- A GitHub account - -Your Docker ID must be between 4 and 30 characters long, and can only contain -numbers and lowercase letters. You can't use any special characters or spaces. - -For more information, see -[Create a Docker account](/manuals/accounts/create-account.md). - -## Can I change my Docker ID? - -No. You can't change your Docker ID once it's created. If you need a different -Docker ID, you must create a new Docker account with a new Docker ID. - -Docker IDs can't be reused after deactivation. - -## What if my Docker ID is taken? - -All Docker IDs are first-come, first-served except for companies that have a -U.S. Trademark on a username. - -If you have a trademark for your Docker ID, -[Docker Support](https://hub.docker.com/support/contact/) can retrieve the -Docker ID for you. - -## What's an organization name or namespace? - -The organization name, sometimes referred to as the organization namespace or -the organization ID, is the unique identifier of a Docker organization. The -organization name can't be the same as an existing Docker ID. - -For more information, see -[Docker organization overview](/manuals/admin/organization/_index.md). - -## Next steps - -- [Create a Docker account](/manuals/accounts/create-account.md) -- [Manage a Docker account](/manuals/accounts/manage-account.md) -- [Docker organization overview](/manuals/admin/organization/_index.md) diff --git a/content/manuals/accounts/individual/_index.md b/content/manuals/accounts/individual/_index.md new file mode 100644 index 000000000000..ad0cf10392c1 --- /dev/null +++ b/content/manuals/accounts/individual/_index.md @@ -0,0 +1,62 @@ +--- +title: Docker individual accounts +linkTitle: Individual +description: > + Learn what a Docker account is, how Docker IDs, emails, and sign-in methods + relate, and how individual accounts connect to organizations +keywords: accounts, docker ID, username, email, Google, GitHub, sign-in, + authentication, account management, docker account, individual account, + organization account, account types, Docker Hub, SSO, deactivate account +weight: 10 +grid: + - title: Set up your account + description: Get started with Docker and create an account. + icon: finger-print + link: /accounts/individual/create-account/ + - title: Manage account + description: Learn how to manage the settings for your account. + icon: cog + link: /accounts/individual/manage-account/ + - title: Personal access tokens + description: Learn how to create and manage access tokens for your account. + icon: lock-closed + link: /security/access-tokens/ + - title: Set up two-factor authentication + description: Add an extra layer of authentication to your Docker account. + link: /security/2fa/ + icon: device-phone-mobile + - title: Organization accounts + description: Learn how to create and manage Docker organizations. + icon: building-storefront + link: /accounts/organization/ + - title: Account FAQs + description: Explore frequently asked questions about Docker accounts. + icon: question-mark-circle + link: /faqs/accounts/ +--- + +A Docker account is how Docker identifies you. Use it to access products like +Docker Hub and Docker Desktop, manage settings, and join organizations. + +For how individual, organization, and company accounts compare, see +[Accounts](/manuals/accounts/_index.md). For organization accounts, including +companies, see +[Organization accounts](/manuals/accounts/organization/_index.md). + +## Docker ID, email, and sign-in + +When you create an account, you choose a Docker ID and a sign-in method. +Docker also ties a verified email to the account. + +- Docker account: Associates your plans, Hub repositories, and account + settings. +- Docker ID: A unique username that identifies you. +- Email: How Docker contacts you for notifications and security-related + communications. +- Sign-in method: Email and password, + [single sign-on (SSO)](/manuals/security/authentication/single-sign-on/_index.md), + Google, or GitHub. + +## Next steps + +{{< grid >}} diff --git a/content/manuals/accounts/create-account.md b/content/manuals/accounts/individual/create-account.md similarity index 93% rename from content/manuals/accounts/create-account.md rename to content/manuals/accounts/individual/create-account.md index 5bdff24960c3..3db92002274e 100644 --- a/content/manuals/accounts/create-account.md +++ b/content/manuals/accounts/individual/create-account.md @@ -1,6 +1,6 @@ --- title: Create a Docker account -linkTitle: Create +linkTitle: Setup weight: 10 description: Create a Docker ID with email, Google, or GitHub, then verify your account @@ -8,6 +8,7 @@ keywords: create docker account, docker ID, sign up, sign in, email, Google, GitHub, verification, OTP, password, docker login, username requirements aliases: + - /accounts/create-account/ - /docker-hub/accounts/ - /docker-id/ --- @@ -85,5 +86,5 @@ basis: ## Next steps -- [Manage a Docker account](/manuals/accounts/manage-account.md) -- [Enable two-factor authentication](/manuals/security/2fa/_index.md) +- [Manage a Docker account](/manuals/accounts/individual/manage-account.md) +- [Enable two-factor authentication](/manuals/security/authentication/2fa/_index.md) diff --git a/content/manuals/accounts/deactivate-user-account.md b/content/manuals/accounts/individual/deactivate-user-account.md similarity index 92% rename from content/manuals/accounts/deactivate-user-account.md rename to content/manuals/accounts/individual/deactivate-user-account.md index e7203eb6b47c..273ba89a0955 100644 --- a/content/manuals/accounts/deactivate-user-account.md +++ b/content/manuals/accounts/individual/deactivate-user-account.md @@ -7,13 +7,15 @@ keywords: deactivate docker account, delete docker account, close docker account, disable docker account, account management, leave organization, privacy request, personal data +aliases: + - /accounts/deactivate-user-account/ --- Learn how to deactivate an individual Docker account, including the prerequisites required for deactivation. For information on deactivating an organization, see -[Deactivate an organization](/manuals/admin/organization/deactivate-account.md). +[Deactivate an organization](/manuals/accounts/organization/manage/deactivate-account.md). > [!WARNING] > @@ -38,7 +40,7 @@ requirements: and then remove yourself, or deactivate the company. - If you have an active Docker subscription, [downgrade it to a Docker Personal - subscription](/manuals/subscription/plans/docker.md#cancel-a-docker-plan). + subscription](/manuals/subscription-billing/plans/docker.md#cancel-a-docker-plan). - Download any images and tags you want to keep. Use `docker pull -a ` to pull all tags, or `docker pull :` to pull a specific tag. diff --git a/content/manuals/accounts/manage-account.md b/content/manuals/accounts/individual/manage-account.md similarity index 88% rename from content/manuals/accounts/manage-account.md rename to content/manuals/accounts/individual/manage-account.md index d75ab1ab4f35..616abe7bfac1 100644 --- a/content/manuals/accounts/manage-account.md +++ b/content/manuals/accounts/individual/manage-account.md @@ -8,6 +8,8 @@ keywords: manage docker account, account settings, update email, change password, Gravatar, two-factor authentication, personal access tokens, Google, GitHub, connected accounts, convert account, deactivate account, Docker Home +aliases: + - /accounts/manage-account/ --- You can manage your Docker account in Docker Home, including administrative @@ -77,7 +79,7 @@ To update your two-factor authentication (2FA) settings: 1. Select **2FA**. For more information, see -[Enable two-factor authentication](/manuals/security/2fa/_index.md). +[Enable two-factor authentication](/manuals/security/authentication/2fa/_index.md). ## Manage personal access tokens @@ -88,7 +90,7 @@ To manage personal access tokens: 1. Select **Personal access tokens**. For more information, see -[Create and manage access tokens](/manuals/security/access-tokens.md). +[Create and manage access tokens](/manuals/security/access-tokens/personal-access-tokens.md). ## Manage connected accounts @@ -116,15 +118,15 @@ or GitHub. See Google or GitHub's documentation for more information: For information on converting your account into an organization, see [Convert an account into an -organization](/manuals/admin/organization/setup/convert-account.md). +organization](/manuals/accounts/organization/setup/convert-account.md). ## Deactivate your account For information on deactivating your account, see -[Deactivate a Docker account](/manuals/accounts/deactivate-user-account.md). +[Deactivate a Docker account](/manuals/accounts/individual/deactivate-user-account.md). ## Next steps -- [Docker accounts overview](/manuals/accounts/_index.md) -- [Create a Docker account](/manuals/accounts/create-account.md) -- [Enable two-factor authentication](/manuals/security/2fa/_index.md) +- [Docker individual accounts overview](/manuals/accounts/individual/_index.md) +- [Create a Docker account](/manuals/accounts/individual/create-account.md) +- [Enable two-factor authentication](/manuals/security/authentication/2fa/_index.md) diff --git a/content/manuals/accounts/organization/_index.md b/content/manuals/accounts/organization/_index.md new file mode 100644 index 000000000000..f270382e28ab --- /dev/null +++ b/content/manuals/accounts/organization/_index.md @@ -0,0 +1,91 @@ +--- +title: Organization accounts +linkTitle: Organization +description: Overview of administration features and roles in Docker Home +keywords: admin, administration, company, organization, Docker Home, user + accounts, account management, organizations, manage teams, roles, members, + permissions, organization settings, organization account, individual account, + Docker ID, account types, owners, teams +weight: 15 +grid: + - title: Set up your organization + description: Create, onboard, and configure your organization. + icon: magnifying-glass-plus + link: /accounts/organization/setup/ + - title: Manage your organization + description: Manage members, teams, seats, and product access. + icon: user-plus + link: /accounts/organization/manage/ + - title: Activity logs + description: Review member activity across your organization and repositories. + icon: clipboard-document-list + link: /accounts/organization/activity-logs/ + - title: Insights + description: See how people in your organization use Docker. + icon: chart-bar + link: /accounts/organization/insights/ + - title: Security + description: Explore security features for administrators. + icon: shield-check + link: /security/ +aliases: + - /admin/ + - /docker-hub/admin-overview + - /admin/organization/ + - /accounts/organization/overview/ +--- + +Organization and company owners can manage members, control access, and enforce +security across their Docker environments. You perform these tasks in Docker +Home, which provides centralized observability, access management, and security +controls. + +A Docker organization is a collection of teams and repositories under +centralized management. Organization administrators group members and +assign repository access at scale. + +As an organization or company owner, you can: + +- Create and manage companies and organizations +- Assign roles and permissions to members +- Group members into teams to manage access by project or role +- Set company-wide policies, including SCIM provisioning and security + enforcement + +For how individual, organization, and company accounts compare, see +[Accounts](/manuals/accounts/_index.md). For individual accounts, see +[Docker individual accounts](/manuals/accounts/individual/_index.md). + +## Organization structure + +The following diagram shows how organizations relate to teams and members. + +![Diagram showing how teams and members relate within a Docker +organization](./images/org-structure.webp) + +An organization includes owners, members, and optional teams. Organization +owners have full administrator access to manage members, roles, and teams. + +### Team + +Teams are optional and let you group members to assign repository permissions +collectively. Teams simplify permission management across projects +or functions. + +### Member + +A member is any Docker user added to an organization. Organization and company +owners can assign roles to members to define their level of access. + +For details about each role and its permissions, see +[Roles and +permissions](/manuals/security/roles-and-permissions/_index.md). + +For how companies relate to organizations, see +[Company structure](/manuals/accounts/company/_index.md#company-structure). + +## Next steps + +Learn how to manage organizations in the following sections. + +{{< grid >}} diff --git a/content/manuals/admin/activity-logs.md b/content/manuals/accounts/organization/activity-logs.md similarity index 99% rename from content/manuals/admin/activity-logs.md rename to content/manuals/accounts/organization/activity-logs.md index d4d97991d524..d4575f09d5d5 100644 --- a/content/manuals/admin/activity-logs.md +++ b/content/manuals/accounts/organization/activity-logs.md @@ -1,9 +1,10 @@ --- title: Activity logs -weight: 30 +weight: 40 description: Learn how to access and interpret Docker activity logs for organizations and repositories. keywords: audit log, organization activity, Docker business logs, repository activity, track changes Docker, security logs Docker, filter logs, log Docker events aliases: +- /admin/activity-logs/ - /docker-hub/audit-log/ - /admin/organization/activity-logs/ --- diff --git a/content/manuals/admin/images/docker-admin-structure.webp b/content/manuals/accounts/organization/images/docker-admin-structure.webp similarity index 100% rename from content/manuals/admin/images/docker-admin-structure.webp rename to content/manuals/accounts/organization/images/docker-admin-structure.webp diff --git a/content/manuals/admin/images/org-structure.webp b/content/manuals/accounts/organization/images/org-structure.webp similarity index 100% rename from content/manuals/admin/images/org-structure.webp rename to content/manuals/accounts/organization/images/org-structure.webp diff --git a/content/manuals/admin/insights.md b/content/manuals/accounts/organization/insights.md similarity index 99% rename from content/manuals/admin/insights.md rename to content/manuals/accounts/organization/insights.md index 1b498cc8bbbc..ffb05dbbc858 100644 --- a/content/manuals/admin/insights.md +++ b/content/manuals/accounts/organization/insights.md @@ -1,8 +1,10 @@ --- title: Insights -weight: 40 +weight: 50 description: Gain insights about your organization's users and their Docker usage. keywords: organization, insights, Docker Desktop analytics, user usage statistics, Docker Business, track Docker activity +aliases: + - /admin/insights/ --- {{< summary-bar feature_name="Insights" >}} @@ -163,7 +165,7 @@ A Docker Desktop user export file contains the following data points: - Username: User's Docker ID - Email: User's email address associated with their Docker ID - Type: User type -- Role: User [role](/manuals/enterprise/security/roles-and-permissions.md) +- Role: User [role](/manuals/security/roles-and-permissions.md) - Teams: Team(s) within your organization the user is a member of - Date Joined: The date the user joined your organization diff --git a/content/manuals/accounts/organization/manage/_index.md b/content/manuals/accounts/organization/manage/_index.md new file mode 100644 index 000000000000..8d4089572255 --- /dev/null +++ b/content/manuals/accounts/organization/manage/_index.md @@ -0,0 +1,76 @@ +--- +title: Manage your organization +linkTitle: Manage +weight: 20 +description: Learn how to manage your Docker organization, including members, teams, licenses, seats, product access, and settings. +keywords: manage organization, members, teams, licenses, seats, product access, organization management, docker home, organization settings, deactivate organization +grid: + - title: Members + description: Invite, manage, and assign roles to your organization members. + icon: user-plus + link: /accounts/organization/manage/members/ + - title: Teams + description: Create teams and manage repository access for groups of members. + icon: user-group + link: /accounts/organization/manage/manage-a-team/ + - title: Seats + description: Add or remove seats for Docker Team and Business subscriptions. + icon: user-circle + link: /accounts/organization/manage/manage-seats/ + - title: Licenses + description: Assign and revoke product licenses for organization members. + icon: key + link: /accounts/organization/manage/manage-licenses/ + - title: Product access and usage + description: Manage access and view usage for Docker products across your organization. + icon: squares-2x2 + link: /accounts/organization/manage/manage-products/ + - title: Change information + description: Update your organization's general information and settings. + icon: pencil-square + link: /accounts/organization/manage/general-settings/ + - title: Deactivate + description: Deactivate an organization after completing the required steps. + icon: minus-circle + link: /accounts/organization/manage/deactivate-account/ + - title: Security + description: Configure single sign-on, provisioning, and access management. + icon: shield-check + link: /security/ + - title: Billing + description: Manage payment methods and view billing history. + icon: credit-card + link: /subscription-billing/ +aliases: + - /admin/organization/manage/ +--- + +As an organization owner, you manage your organization's membership, access, +product usage, and settings. You can invite members, group them into teams, +assign or revoke licenses and seats, change access to Docker products, update +organization information, and deactivate the organization. + +## Managing your organization + +You manage your organization from [Docker Home](https://app.docker.com) and +must be assigned the +[organization owner role](/manuals/security/roles-and-permissions/_index.md). + +## Seats and licenses + +Seats and licenses both control access, but they apply to different kinds of +plans. The following table summarizes the difference. + +| Entitlement | What it grants | Applies to | Managed from | +| ----------- | ------------------------------------------------------- | ------------------------------------------------ | ------------ | +| Seat | Membership in your Docker Team or Business subscription | Docker Core subscription | Billing | +| License | Access to a specific product or add-on | AI Governance, Docker Offload, and other add-ons | Members | + +For details, see [Seats](/manuals/accounts/organization/manage/manage-seats.md) +and [License assignment](/manuals/accounts/organization/manage/manage-licenses.md). + +## Next steps + +Explore the following sections to manage your organization. + +{{< grid >}} diff --git a/content/manuals/admin/organization/deactivate-account.md b/content/manuals/accounts/organization/manage/deactivate-account.md similarity index 84% rename from content/manuals/admin/organization/deactivate-account.md rename to content/manuals/accounts/organization/manage/deactivate-account.md index cd4b8cfaa8f5..13b9374e88d3 100644 --- a/content/manuals/admin/organization/deactivate-account.md +++ b/content/manuals/accounts/organization/manage/deactivate-account.md @@ -5,9 +5,11 @@ description: Learn how to deactivate a Docker organization and required prerequisite steps. keywords: deactivate organization, delete organization, organization management, Docker Home, cancel subscription, unlink GitHub, remove SSO -weight: 50 +weight: 70 aliases: + - /admin/organization/deactivate-account/ - /docker-hub/deactivate-account/ + - /accounts/organization/deactivate-account/ --- {{< summary-bar feature_name="General admin" >}} @@ -15,7 +17,7 @@ aliases: Learn how to deactivate a Docker organization, including required prerequisite steps. For information about deactivating user accounts, see [Deactivate a Docker -account](/manuals/accounts/deactivate-user-account.md). +account](/manuals/accounts/individual/deactivate-user-account.md). > [!WARNING] > @@ -32,12 +34,12 @@ organization: to pull all tags, or `docker pull :` to pull a specific tag. - If you have an active Docker subscription, [downgrade it to a basic organization - account](/manuals/subscription/plans/docker.md#cancel-a-docker-plan). + account](/manuals/subscription-billing/plans/docker.md#cancel-a-docker-plan). - Remove all other members within the organization. - Unlink your [GitHub and Bitbucket accounts](/manuals/docker-hub/repos/manage/builds/link-source.md#unlink-a-github-user-account). - For Business organizations, [remove your SSO - connection](/manuals/enterprise/security/single-sign-on/manage.md#delete-a-connection). + connection](/manuals/security/authentication/single-sign-on/manage.md#delete-a-connection). ## Deactivate diff --git a/content/manuals/admin/organization/setup/general-settings.md b/content/manuals/accounts/organization/manage/general-settings.md similarity index 73% rename from content/manuals/admin/organization/setup/general-settings.md rename to content/manuals/accounts/organization/manage/general-settings.md index 3c7d4c9b2e04..f3560c801512 100644 --- a/content/manuals/admin/organization/setup/general-settings.md +++ b/content/manuals/accounts/organization/manage/general-settings.md @@ -1,11 +1,13 @@ --- title: Change general organization information linkTitle: Change information -weight: 30 +weight: 60 description: Learn how to manage settings for organizations. keywords: organization, settings, Docker Home, manage, Docker organization, Gravatar, SCIM, SSO setup, domain management, organization settings aliases: + - /admin/organization/setup/general-settings/ - /admin/organization/general-settings/ + - /accounts/organization/setup/general-settings/ --- Learn how to update your organization information. @@ -33,7 +35,7 @@ To edit this information: After configuring your organization information, you can: -- [Configure single sign-on (SSO)](/manuals/enterprise/security/single-sign-on/connect.md) -- [Set up SCIM provisioning](/manuals/enterprise/security/provisioning/scim/_index.md) -- [Manage domains](/manuals/enterprise/security/domain-management.md) -- [Create a company](/manuals/admin/company/new-company.md) +- [Configure single sign-on (SSO)](/manuals/security/authentication/single-sign-on/connect.md) +- [Set up SCIM provisioning](/manuals/security/provisioning/scim/_index.md) +- [Manage domains](/manuals/security/provisioning/domain-management.md) +- [Create a company](/manuals/accounts/company/new-company.md) diff --git a/content/manuals/admin/organization/manage/manage-a-team.md b/content/manuals/accounts/organization/manage/manage-a-team.md similarity index 95% rename from content/manuals/admin/organization/manage/manage-a-team.md rename to content/manuals/accounts/organization/manage/manage-a-team.md index 31fd9b53bfc7..b2ee5b57327d 100644 --- a/content/manuals/admin/organization/manage/manage-a-team.md +++ b/content/manuals/accounts/organization/manage/manage-a-team.md @@ -6,6 +6,7 @@ description: Learn how to create and manage teams for your organization keywords: docker, registry, teams, organizations, plans, Dockerfile, Docker Hub, docs, documentation, repository permissions, configure repository access, team management aliases: + - /admin/organization/manage/manage-a-team/ - /docker-hub/manage-a-team/ - /admin/organization/manage-a-team/ --- @@ -34,7 +35,7 @@ An organization owner is an administrator who has the following permissions: organization settings - Specify [permissions](#permissions-reference) for each team in the organization -- Enable [SSO](/manuals/enterprise/security/single-sign-on/_index.md) for the +- Enable [SSO](/manuals/security/authentication/single-sign-on/_index.md) for the organization When SSO is enabled for your organization, the organization owner can @@ -46,7 +47,7 @@ Organization owners can add others with the owner role to help them manage users, teams, and repositories in the organization. For more information on roles, see -[Roles and permissions](/manuals/enterprise/security/roles-and-permissions.md). +[Roles and permissions](/manuals/security/roles-and-permissions.md). ## Create a team @@ -60,7 +61,7 @@ For more information on roles, see You must create a team before you are able to configure repository permissions. For more details, see [Create and manage a -team](/manuals/admin/organization/manage/manage-a-team.md). +team](/manuals/accounts/organization/manage/manage-a-team.md). To set team repository permissions: diff --git a/content/manuals/admin/organization/manage/manage-licenses.md b/content/manuals/accounts/organization/manage/manage-licenses.md similarity index 87% rename from content/manuals/admin/organization/manage/manage-licenses.md rename to content/manuals/accounts/organization/manage/manage-licenses.md index 4a1d142dc728..dae594e409f3 100644 --- a/content/manuals/admin/organization/manage/manage-licenses.md +++ b/content/manuals/accounts/organization/manage/manage-licenses.md @@ -4,6 +4,8 @@ linkTitle: License assignment description: Manage product licenses for your organization, including invite-time assignment, revocation, and automatic assignment. keywords: licenses, organization, members, invite, invitation, Docker Core, Docker Offload, AI Governance, license assignment, docker home weight: 30 +aliases: + - /admin/organization/manage/manage-licenses/ --- Licenses let you choose which organization members can access supported Docker @@ -13,7 +15,7 @@ products. > [!TIP] > To learn more about product licenses, Docker Core seats, and other Docker -> add-ons, see [Docker plans](/manuals/subscription/plans/_index.md), +> add-ons, see [Docker plans](/manuals/subscription-billing/plans/_index.md), > or > contact sales > to purchase licenses. @@ -50,14 +52,14 @@ a member: 1. Select **Emails or usernames**. 1. Enter the email addresses or Docker IDs of the people you want to invite, then assign their - [role](/manuals/enterprise/security/roles-and-permissions/_index.md). + [role](/manuals/security/roles-and-permissions/_index.md). 1. Under **Licenses (optional)**, select one or more licenses that are available to your organization. 1. Select **Invite** to send the invite. For more about sending, resending, and removing invitations, including CSV file limits, see -[Manage organization members](/manuals/admin/organization/manage/members.md). +[Manage organization members](/manuals/accounts/organization/manage/members.md). ### Accept invites @@ -88,8 +90,8 @@ set up auto-assignment for Docker Core as well. AI Governance licenses include single sign-on (SSO) and provisioning features regardless of your Docker Core subscription. Automatic license assignment requires -[setting up SSO](/manuals/enterprise/security/single-sign-on/connect.md), then -[provisioning](/manuals/enterprise/security/provisioning/_index.md) with System +[setting up SSO](/manuals/security/authentication/single-sign-on/connect.md), then +[provisioning](/manuals/security/provisioning/_index.md) with System for Cross-domain Identity Management (SCIM) or Just-in-Time (JIT). ## Manage licenses @@ -114,11 +116,11 @@ To manage licenses for your organization: Explore Docker Core add-ons and products that need licenses: -- [Docker plans](/manuals/subscription/plans/_index.md) to learn about different +- [Docker plans](/manuals/subscription-billing/plans/_index.md) to learn about different add-ons -- [Manage seats](/manuals/admin/organization/manage/manage-seats.md) to add more +- [Manage seats](/manuals/accounts/organization/manage/manage-seats.md) to add more seats to your Docker Core subscription -- [AI Governance plan](/manuals/subscription/plans/ai-governance.md) to learn +- [AI Governance plan](/manuals/subscription-billing/plans/ai-governance.md) to learn about AI Governance license usage and billing - [Docker Offload](/manuals/offload/about.md) to let your developers offload building and running containers to the cloud diff --git a/content/manuals/admin/organization/manage/manage-products.md b/content/manuals/accounts/organization/manage/manage-products.md similarity index 95% rename from content/manuals/admin/organization/manage/manage-products.md rename to content/manuals/accounts/organization/manage/manage-products.md index dd6afd68cb5f..cce9d67281b2 100644 --- a/content/manuals/admin/organization/manage/manage-products.md +++ b/content/manuals/accounts/organization/manage/manage-products.md @@ -5,6 +5,7 @@ weight: 50 description: Learn how to manage access and usage for Docker products for your organization keywords: organization, product access, product usage, access control, docker desktop, docker hub, docker scout, docker build cloud, docker offload, testcontainers cloud aliases: + - /admin/organization/manage/manage-products/ - /admin/organization/manage-products/ --- @@ -27,7 +28,7 @@ To manage Docker Desktop access: 1. [Enforce sign-in](../../../enterprise/security/enforce-sign-in/_index.md). 1. Manage members [manually](./members.md) or use - [provisioning](../../../enterprise/security/provisioning/_index.md). + [provisioning](../../../security/provisioning/_index.md). With sign-in enforced, only users who are a member of your organization can use Docker Desktop after signing in. @@ -132,7 +133,7 @@ following table to learn where you can monitor organization usage: | Product | Monitor usage | | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| Docker Desktop | From [Docker Home](https://app.docker.com/), view the [**Insights**](../../insights.md) page. | +| Docker Desktop | From [Docker Home](https://app.docker.com/), view the [**Insights**](/manuals/accounts/organization/insights.md) page. | | Docker Hub | From Docker Hub, view the [**Usage** page](https://hub.docker.com/usage). | | Docker Build Cloud | From [Docker Build Cloud](http://app.docker.com/build), view the **Build minutes** page. | | Docker Scout | From [Docker Home](https://app.docker.com/), select **Go to Scout** to view the [**Repository settings** page](https://scout.docker.com/settings/repos). | @@ -140,7 +141,7 @@ following table to learn where you can monitor organization usage: | Docker Offload | From [Docker Home](https://app.docker.com/), select **Offload**, then **Offload activity**. See [Docker Offload usage and billing](../../../offload/usage.md) for more details. | If your usage or seat count exceeds your subscription amount, you can -[add seats](./manage-seats.md) or [view available Docker plans](../../../subscription/plans/_index.md) to meet your needs. +[add seats](./manage-seats.md) or [view available Docker plans](../../../subscription-billing/plans/_index.md) to meet your needs. ## Next steps diff --git a/content/manuals/admin/organization/manage/manage-seats.md b/content/manuals/accounts/organization/manage/manage-seats.md similarity index 98% rename from content/manuals/admin/organization/manage/manage-seats.md rename to content/manuals/accounts/organization/manage/manage-seats.md index c67156f5224a..15747bf01854 100644 --- a/content/manuals/admin/organization/manage/manage-seats.md +++ b/content/manuals/accounts/organization/manage/manage-seats.md @@ -4,6 +4,7 @@ linkTitle: Seats description: Add or remove seats for Docker Team and Business subscriptions keywords: manage seats, add seats, remove seats, subscription billing, team members aliases: + - /admin/organization/manage/manage-seats/ - /docker-hub/billing/add-seats/ - /subscription/add-seats/ - /docker-hub/billing/remove-seats/ diff --git a/content/manuals/admin/organization/manage/members.md b/content/manuals/accounts/organization/manage/members.md similarity index 94% rename from content/manuals/admin/organization/manage/members.md rename to content/manuals/accounts/organization/manage/members.md index f8fe6cf014e2..116865de6764 100644 --- a/content/manuals/admin/organization/manage/members.md +++ b/content/manuals/accounts/organization/manage/members.md @@ -7,6 +7,7 @@ description: Manage organization members, including invitations, roles, teams, keywords: members, organization members, invitations, teams, manage team members, export member list, edit roles, user management aliases: + - /admin/organization/manage/members/ - /docker-hub/members/ - /admin/organization/members/ --- @@ -25,7 +26,7 @@ You can also select one or more product licenses for an invitee; Docker assigns available licenses when they accept. Unlike a seat, licenses aren't deducted from your organization's available licenses until the invitee accepts. See -[Licenses and invites](/manuals/admin/organization/manage/manage-licenses.md#licenses-and-invites). +[Licenses and invites](/manuals/accounts/organization/manage/manage-licenses.md#licenses-and-invites). ### Invite members via Docker ID or email address @@ -40,7 +41,7 @@ or email address. 1000 members and separate multiple entries by comma, semicolon, or space. When you invite members, you assign them a role. See -[Roles and permissions](/manuals/enterprise/security/roles-and-permissions/_index.md) +[Roles and permissions](/manuals/security/roles-and-permissions/_index.md) for details about the access permissions for each role. Pending invitations appear in the table. Invitees can accept or decline the @@ -137,7 +138,7 @@ able to invite more members. > Need to manage more than 1,000 team members? > [Upgrade to Docker Business for unlimited user invites](https://www.docker.com/pricing?ref=Docs&refAction=DocsAdminMembers) > and advanced role management. You can also -> [add seats](/manuals/admin/organization/manage/manage-seats.md) to your +> [add seats](/manuals/accounts/organization/manage/manage-seats.md) to your > subscription. ### Resend an invitation @@ -196,7 +197,7 @@ being added to the team. ### Remove members from teams If your organization uses single sign-on (SSO) with -[SCIM](/manuals/enterprise/security/provisioning/scim/_index.md) enabled, you +[SCIM](/manuals/security/provisioning/scim/_index.md) enabled, you should remove members from your identity provider (IdP). This automatically removes members from Docker. If SCIM is disabled, follow procedures in this doc to remove members manually in Docker. @@ -215,10 +216,10 @@ from a specific team: ### Update a member role Organization owners can manage -[roles](/manuals/enterprise/security/roles-and-permissions/_index.md) within +[roles](/manuals/security/roles-and-permissions/_index.md) within an organization. If an organization is part of a company, the company owner can also manage that organization's roles. If you have SSO enabled, you can -use [SCIM for role mapping](/manuals/enterprise/security/provisioning/scim/_index.md). +use [SCIM for role mapping](/manuals/security/provisioning/scim/_index.md). To update a member role: diff --git a/content/manuals/admin/organization/setup/_index.md b/content/manuals/accounts/organization/setup/_index.md similarity index 66% rename from content/manuals/admin/organization/setup/_index.md rename to content/manuals/accounts/organization/setup/_index.md index eb36ef60da67..87c233886ddc 100644 --- a/content/manuals/admin/organization/setup/_index.md +++ b/content/manuals/accounts/organization/setup/_index.md @@ -2,44 +2,42 @@ title: Set up your organization linkTitle: Setup weight: 10 -description: Learn how to set up your Docker organization, including creating an organization, onboarding, and configuring settings. -keywords: set up organization, create organization, onboard, convert account, organization settings, docker home +description: Learn how to set up your Docker organization, including creating an organization, onboarding, and converting an account. +keywords: set up organization, create organization, onboard, convert account, docker home grid: - title: Create your organization description: Create an organization to group teams and members and assign access. icon: building-storefront - link: /admin/organization/setup/orgs/ + link: /accounts/organization/setup/orgs/ - title: Onboard your organization description: Onboard and secure your Docker Team or Business organization. icon: magnifying-glass-plus - link: /admin/organization/setup/onboard/ - - title: Change information - description: Update your organization's general information and settings. - icon: pencil-square - link: /admin/organization/setup/general-settings/ + link: /accounts/organization/setup/onboard/ - title: Convert account description: Convert an existing Docker user account into an organization. icon: arrows-right-left - link: /admin/organization/setup/convert-account/ + link: /accounts/organization/setup/convert-account/ - title: Manage your organization description: Add members, teams, licenses, and seats after setup. icon: user-group - link: /admin/organization/manage/ + link: /accounts/organization/manage/ - title: Security description: Configure single sign-on, provisioning, and access management. icon: shield-check - link: /enterprise/security/ + link: /security/ +aliases: + - /admin/organization/setup/ --- Before you manage members and access, set up your Docker organization. You can -create an organization, onboard and secure it, update its information, or convert -an existing user account into an organization. +create an organization, onboard and secure it, or convert an existing user +account into an organization. ## Setting up your organization You set up your organization from [Docker Home](https://app.docker.com) and must be assigned the -[organization owner role](/manuals/enterprise/security/roles-and-permissions/_index.md). +[organization owner role](/manuals/security/roles-and-permissions/_index.md). Setting up an organization happens in broad phases: 1. You can create a new organization, or convert an existing user account @@ -48,7 +46,6 @@ Setting up an organization happens in broad phases: 1. After creating your organization, you must onboard it by inviting members, securing authentication, and enforcing sign-in. These steps build on each other, so follow them in order. -1. You can update your organization's general information whenever it changes. ## Next steps diff --git a/content/manuals/admin/organization/setup/convert-account.md b/content/manuals/accounts/organization/setup/convert-account.md similarity index 95% rename from content/manuals/admin/organization/setup/convert-account.md rename to content/manuals/accounts/organization/setup/convert-account.md index 7c5b856d5bfc..a17ba032cdcd 100644 --- a/content/manuals/admin/organization/setup/convert-account.md +++ b/content/manuals/accounts/organization/setup/convert-account.md @@ -5,6 +5,7 @@ title: Convert an account into an organization keywords: docker hub, hub, organization, convert account, migrate account weight: 40 aliases: + - /admin/organization/setup/convert-account/ - /docker-hub/convert-account/ - /admin/organization/convert-account/ --- @@ -15,8 +16,8 @@ Learn how to convert an existing user account into an organization. This is useful if you need multiple users to access your account and the repositories it’s connected to. Converting it to an organization gives you better control over permissions for these users through -[teams](/manuals/admin/organization/manage/manage-a-team.md) and -[roles](/manuals/enterprise/security/roles-and-permissions.md). +[teams](/manuals/accounts/organization/manage/manage-a-team.md) and +[roles](/manuals/security/roles-and-permissions/_index.md). When you convert a user account to an organization, the account is migrated to a Docker Team subscription by default. diff --git a/content/manuals/admin/organization/setup/onboard.md b/content/manuals/accounts/organization/setup/onboard.md similarity index 88% rename from content/manuals/admin/organization/setup/onboard.md rename to content/manuals/accounts/organization/setup/onboard.md index e71216f1bff7..d652041b9c18 100644 --- a/content/manuals/admin/organization/setup/onboard.md +++ b/content/manuals/accounts/organization/setup/onboard.md @@ -7,6 +7,7 @@ keywords: business, team, organizations, get started, onboarding, Docker Home, o toc_min: 1 toc_max: 3 aliases: + - /admin/organization/setup/onboard/ - /docker-hub/onboard/ - /docker-hub/onboard-team/ - /docker-hub/onboard-business/ @@ -40,7 +41,7 @@ Before you start onboarding your organization, ensure you: > When purchasing a self-serve subscription, the on-screen instructions > guide you through creating an organization. If you have purchased a > subscription through Docker Sales and you have not yet created an - > organization, see [Create an organization](/manuals/admin/organization/setup/orgs.md). + > organization, see [Create an organization](/manuals/accounts/organization/setup/orgs.md). - Familiarize yourself with Docker concepts and terminology in the [administration overview](../../_index.md). @@ -50,7 +51,7 @@ Before you start onboarding your organization, ensure you: Docker Home has a guided setup to help you onboard your organization. The guided setup's steps consist of basic onboarding tasks. If you want to onboard outside of the guided setup, -see [Recommended onboarding steps](/manuals/admin/organization/setup/onboard.md#recommended-onboarding-steps). +see [Recommended onboarding steps](/manuals/accounts/organization/setup/onboard.md#recommended-onboarding-steps). To onboard using the guided setup, navigate to [Docker Home](https://app.docker.com) and @@ -104,8 +105,8 @@ When you create an organization, you are the only owner. It is optional to add additional owners. To add an owner, invite a user and assign them the owner role. For more -details, see [Invite members](/manuals/admin/organization/manage/members.md) and -[Roles and permissions](/manuals/enterprise/security/roles-and-permissions.md). +details, see [Invite members](/manuals/accounts/organization/manage/members.md) and +[Roles and permissions](/manuals/security/roles-and-permissions/_index.md). ### Step three: Invite members @@ -115,23 +116,23 @@ receive increased pull limits and other organization wide benefits when they are signed in. To add a member, invite a user and assign them the member role. -For more details, see [Invite members](/manuals/admin/organization/manage/members.md) and -[Roles and permissions](/manuals/enterprise/security/roles-and-permissions.md). +For more details, see [Invite members](/manuals/accounts/organization/manage/members.md) and +[Roles and permissions](/manuals/security/roles-and-permissions/_index.md). ### Step four: Manage user access with SSO and SCIM Configuring SSO and SCIM is optional and only available to Docker Business subscribers. To upgrade a Docker Team subscription to a Docker Business -subscription, see [Upgrade a plan](/manuals/subscription/manage.md#upgrade-plans). +subscription, see [Upgrade a plan](/manuals/subscription-billing/manage/plans.md#upgrade-plans). Use your identity provider (IdP) to manage members and provision them to Docker automatically via SSO and SCIM. See the following for more details: -- [Configure SSO](/manuals/enterprise/security/single-sign-on/connect.md) +- [Configure SSO](/manuals/security/authentication/single-sign-on/connect.md) to authenticate and add members when they sign in to Docker through your identity provider. - Optional. - [Enforce SSO](/manuals/enterprise/security/single-sign-on/connect.md) to + [Enforce SSO](/manuals/security/authentication/single-sign-on/connect.md) to ensure that when users sign in to Docker, they must use SSO. > [!NOTE] @@ -140,7 +141,7 @@ automatically via SSO and SCIM. See the following for more details: > are different features. For more details, see > [Enforcing sign-in versus enforcing single sign-on (SSO)](/manuals/enterprise/security/enforce-sign-in/_index.md#enforcing-sign-in-versus-enforcing-single-sign-on-sso). -- [Configure SCIM](/manuals/enterprise/security/provisioning/scim/_index.md) to +- [Configure SCIM](/manuals/security/provisioning/scim/_index.md) to automatically provision, add, and de-provision members to Docker through your identity provider. @@ -172,7 +173,7 @@ security posture: - [Manage Docker products](../manage/manage-products.md) to configure access and view usage. - Configure [Hardened Docker Desktop](/manuals/enterprise/security/hardened-desktop/_index.md) to improve your organization’s security posture for containerized development. -- [Manage your domains](/manuals/enterprise/security/domain-management.md) to ensure that all Docker users in your domain are part of your organization. +- [Manage your domains](/manuals/security/provisioning/domain-management.md) to ensure that all Docker users in your domain are part of your organization. Your Docker subscription provides many more additional features. To learn more, see [Docker subscriptions and features](https://www.docker.com/pricing?ref=Docs&refAction=DocsAdminOnboard). diff --git a/content/manuals/admin/organization/setup/orgs.md b/content/manuals/accounts/organization/setup/orgs.md similarity index 89% rename from content/manuals/admin/organization/setup/orgs.md rename to content/manuals/accounts/organization/setup/orgs.md index 5cb67788393d..fb30f23cf465 100644 --- a/content/manuals/admin/organization/setup/orgs.md +++ b/content/manuals/accounts/organization/setup/orgs.md @@ -5,6 +5,7 @@ weight: 10 description: Learn how to create an organization. keywords: docker organizations, organization, create organization, docker teams, organization management aliases: + - /admin/organization/setup/orgs/ - /docker-hub/orgs/ - /admin/organization/orgs/ --- @@ -19,9 +20,9 @@ There are multiple ways to create an organization. You can either: ## Prerequisites -- Before you create an organization, you need a [Docker ID](/manuals/accounts/create-account.md). +- Before you create an organization, you need a [Docker ID](/manuals/accounts/individual/create-account.md). - For prerequisites and detailed instructions on converting an existing user account to an organization, see - [Convert an account into an organization](/manuals/admin/organization/setup/convert-account.md). + [Convert an account into an organization](/manuals/accounts/organization/setup/convert-account.md). > [!TIP] > Need a different plan for your team's needs? Review different [Docker subscriptions and features](https://www.docker.com/pricing?ref=Docs&refAction=DocsAdminOrgs) to choose a subscription for your organization. @@ -36,7 +37,7 @@ There are multiple ways to create an organization. You can either: your organization in Docker Hub. - It's not possible to change the name of the organization after you've created it. - Your Docker ID and organization can't share the same name. - - If you want to use your Docker ID as the organization name, then you must first [convert your account into an organization](/manuals/admin/organization/setup/convert-account.md). + - If you want to use your Docker ID as the organization name, then you must first [convert your account into an organization](/manuals/accounts/organization/setup/convert-account.md). 1. Enter your **Company name**. This is the full name of your company. - Docker displays the company name on your organization page and in the details of any public images you publish. @@ -71,7 +72,7 @@ the following steps: 1. Based on the number of seats from the secondary organization, [purchase additional seats](../manage/manage-seats.md) for the primary organization account that you want to keep. 1. Manually add users to the primary organization and remove existing users from the secondary organization. 1. Manually move over your data, including all repositories. -1. Once you're done moving all of your users and data, [downgrade](../../../subscription/plans/docker.md#cancel-a-docker-plan) the secondary account to a free subscription. Note that Docker does not offer refunds for downgrading organizations mid-billing cycle. +1. Once you're done moving all of your users and data, [downgrade](../../../subscription-billing/plans/docker.md#cancel-a-docker-plan) the secondary account to a free subscription. Note that Docker does not offer refunds for downgrading organizations mid-billing cycle. If your organization has a Docker Business subscription with a purchase order, contact Support or your Account Manager at Docker. diff --git a/content/manuals/admin/_index.md b/content/manuals/admin/_index.md deleted file mode 100644 index 780462e3d624..000000000000 --- a/content/manuals/admin/_index.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: Administration -description: Overview of administration features and roles in Docker Home -keywords: admin, administration, company, organization, Docker Home, user accounts, account management -weight: 10 -params: - sidebar: - group: Enterprise -grid: - - title: Company administration - description: Explore how to manage a company. - icon: building-office-2 - link: /admin/company/ - - title: Organization administration - description: Learn about organization administration. - icon: building-storefront - link: /admin/organization/ - - title: Onboard your organization - description: Learn how to onboard and secure your organization. - icon: magnifying-glass-plus - link: /admin/organization/setup/onboard - - title: Security - description: Explore security features for administrators. - icon: shield-check - link: /enterprise/security/ -aliases: - - /docker-hub/admin-overview ---- - -Organization and company owners can manage members, control access, and enforce -security across their Docker environments. You perform these tasks in Docker -Home, which provides centralized observability, access management, and security -controls. - -As an organization or company owner, you can: - -- Create and manage companies and organizations -- Assign roles and permissions to members -- Group members into teams to manage access by project or role -- Set company-wide policies, including SCIM provisioning and security - enforcement - -## Company and organization hierarchy - -To provide centralized administration, Docker organizes companies and -organizations into the following hierarchy and roles. - -![Diagram showing Docker’s administration hierarchy with Company at the top, followed by Organizations, Teams, and Members](./images/docker-admin-structure.webp) - -### Company - -A company groups multiple Docker organizations for centralized configuration. A -company owner can view and manage every organization in the company and its -company-wide settings, with the same access rights as an organization owner. For -the company owner role and how it affects seats, see -[Company roles](/manuals/admin/company/_index.md#company-roles). - -Companies are only available for Docker Business subscribers. - -### Organization - -An organization sits below the company and is where you group teams and -members and assign access to repositories. Every Docker Team and Business -subscriber has at least one organization. - -Organization owners hold the organization owner administrator role and manage -organization settings, users, and access controls. Each owner occupies a -[seat](/manuals/admin/organization/organization-faqs.md#what-is-the-difference-between-user-invitee-seat-and-member). - -[Upgrading to a Docker Business plan](https://www.docker.com/pricing?ref=Docs&refAction=DocsAdmin) -grants you the company owner role so you can manage multiple organizations. - -### Team - -Teams are optional and let you group members to assign repository permissions -collectively. Teams simplify permission management across projects -or functions. - -### Member - -A member is any Docker user added to an organization. Organization and company -owners can assign roles to members to define their level of access. - -## Next steps - -Learn how to manage companies and organizations in the following sections. - -{{< grid >}} diff --git a/content/manuals/admin/company/company-faqs.md b/content/manuals/admin/company/company-faqs.md deleted file mode 100644 index 8ab054c97ce7..000000000000 --- a/content/manuals/admin/company/company-faqs.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Company FAQs -linkTitle: FAQs -weight: 30 -description: Frequently asked questions about Docker companies, including subscriptions, seats, company owners, and permissions. -keywords: Docker, Docker Hub, SSO FAQs, single sign-on, company, administration, company management -tags: [FAQ] -aliases: - - /docker-hub/company-faqs/ - - /faq/admin/company-faqs/ - - /admin/faqs/company-faqs/ ---- - -### Some of my organizations don’t have a Docker Business subscription. Can I still use a parent company? - -Yes, but you can only add organizations with a Docker Business subscription -to a company. For more details, see [Add more organizations](/manuals/admin/company/manage.md#add-more-organizations). - -### What happens if one of my organizations downgrades from Docker Business, but I still need access as a company owner? - -To access and manage a nested organization, it must have a Docker Business -subscription. If an organization downgrades from Docker Business, its owner must -manage it outside of the company. For more details, see -[Add more organizations](/manuals/admin/company/manage.md#add-more-organizations). - -### Do company owners occupy a subscription seat? - -Company owners don't occupy a seat unless one of the following is true: - -- They are added as a member of an organization under your company -- SSO is enabled and the company owner signs in through SSO, which - automatically adds them as an organization member - -When you first create a company, your account is both a company owner and an -organization owner, so it occupies a seat as long as you remain an organization -owner. To free up that seat, -[assign another user as the organization owner](/manuals/admin/organization/manage/members.md#update-a-member-role) -and remove yourself from the organization. You keep full administrative access -as a company owner without using a subscription seat. - -### What permissions does the company owner have in the associated/nested organizations? - -Company owners can navigate to the **Organizations** page to view all their -nested organizations in a single location. They can also view or edit -organization members and change single sign-on (SSO) and System for -Cross-domain Identity Management (SCIM) settings. Changes to company settings -impact all users in each organization under the company. - -For more information, see [Roles and permissions](/manuals/enterprise/security/roles-and-permissions.md). diff --git a/content/manuals/admin/organization/_index.md b/content/manuals/admin/organization/_index.md deleted file mode 100644 index 438bf56e5a69..000000000000 --- a/content/manuals/admin/organization/_index.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: Docker organization overview -linkTitle: Organization -weight: 10 -description: > - Learn how Docker organization accounts relate to individual accounts, and how - to manage teams, members, permissions, and settings. -keywords: organizations, admin, overview, manage teams, roles, members, - permissions, organization settings, organization account, individual account, - Docker ID, account types, owners, teams -grid: - - title: Onboard your organization - description: Learn how to onboard and secure your organization. - icon: magnifying-glass-plus - link: /admin/organization/setup/onboard - - title: Manage members - description: Learn how to manage members. - icon: user-plus - link: /admin/organization/manage/members/ - - title: Activity logs - description: Learn how to audit the activities of your members. - icon: document-text - link: /admin/activity-logs/ - - title: Security - description: - Start here to manage security and access for your organization, including - single sign-on, provisioning, and image and registry access management. - icon: shield-check - link: /enterprise/security/ ---- - -A Docker organization is a collection of teams and repositories under -centralized management. Organization administrators group members and -assign repository access at scale. - -## Organization structure - -The following diagram shows how organizations relate to teams and members. - -![Diagram showing how teams and members relate within a Docker -organization](/admin/images/org-structure.webp) - -For how organizations fit into the broader company hierarchy, see -[Administration -overview](/manuals/admin/_index.md#company-and-organization-hierarchy). - -## Individual and organization accounts - -Docker has two primary account types: - -- Individual accounts that are identified by a Docker ID. -- Organization accounts that are shared workspaces for teams and - repositories. - -Every organization is created and administered by one or more individual -accounts. You always sign in with your individual account, then work in the -organizations you own or belong to. Organization owners and members are -individual accounts that hold a role in that organization. For individual -accounts, see [Accounts](/manuals/accounts/_index.md). - -## Organization roles - -An organization includes owners, members, and optional teams. Organization -owners have full administrator access to manage members, roles, and teams. A -team is an optional grouping of members that share the same repository -permissions. - -For details about each role and its permissions, see -[Roles and -permissions](/manuals/enterprise/security/roles-and-permissions/_index.md). - -## Next steps - -Learn how to create and manage your organization in the following sections. - -{{< grid >}} diff --git a/content/manuals/admin/organization/manage/_index.md b/content/manuals/admin/organization/manage/_index.md deleted file mode 100644 index 5ccfc50fa17c..000000000000 --- a/content/manuals/admin/organization/manage/_index.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Manage your organization -linkTitle: Manage -weight: 20 -description: Learn how to manage your Docker organization, including members, teams, licenses, seats, and product access. -keywords: manage organization, members, teams, licenses, seats, product access, organization management, docker home -grid: - - title: Members - description: Invite, manage, and assign roles to your organization members. - icon: user-plus - link: /admin/organization/manage/members/ - - title: Product access and usage - description: Manage access and view usage for Docker products across your organization. - icon: squares-2x2 - link: /admin/organization/manage/manage-products/ - - title: Security - description: Configure single sign-on, provisioning, and access management. - icon: shield-check - link: /enterprise/security/ - - title: Billing - description: Manage payment methods and view billing history. - icon: credit-card - link: /billing/ ---- - -As an organization owner, you manage your organization's membership, access, -and product usage. You can invite members, group them into teams, assign or -revoke licenses and seats, and change access to Docker products. - -## Managing your organization - -You manage your organization from [Docker Home](https://app.docker.com) and -must be assigned the -[organization owner role](/manuals/enterprise/security/roles-and-permissions/_index.md). - -## Seats and licenses - -Seats and licenses both control access, but they apply to different kinds of -plans. The following table summarizes the difference. - -| Entitlement | What it grants | Applies to | Managed from | -| ----------- | ------------------------------------------------------- | ------------------------------------------------ | ------------ | -| Seat | Membership in your Docker Team or Business subscription | Docker Core subscription | Billing | -| License | Access to a specific product or add-on | AI Governance, Docker Offload, and other add-ons | Members | - -For details, see [Seats](/manuals/admin/organization/manage/manage-seats.md) -and [License assignment](/manuals/admin/organization/manage/manage-licenses.md). - -## Next steps - -Explore the following sections to manage your organization. - -{{< grid >}} diff --git a/content/manuals/admin/organization/organization-faqs.md b/content/manuals/admin/organization/organization-faqs.md deleted file mode 100644 index e013e5539d7e..000000000000 --- a/content/manuals/admin/organization/organization-faqs.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Organization FAQs -linkTitle: FAQs -weight: 60 -description: Organization FAQs -keywords: Docker, Docker Hub, SSO FAQs, single sign-on, organizations, administration, Docker Home, members, organization management, manage orgs -tags: [FAQ] -aliases: - - /docker-hub/organization-faqs/ - - /faq/admin/organization-faqs/ - - /admin/faqs/organization-faqs/ ---- - -### How can I see how many active users are in my organization? - -If your organization uses a Software Asset Management tool, you can use it to -find out how many users have Docker Desktop installed. If your organization -doesn't use this software, you can run an internal survey -to find out who is using Docker Desktop. - -For more information, see [Identify your Docker users and their Docker accounts](../../admin/organization/setup/onboard.md#step-one-identify-your-docker-users). - -### Do users need to authenticate with Docker before an owner can add them to an organization? - -No. Organization owners can invite users with their email addresses, and also -assign them to a team during the invite process. - -### Can I force my organization's members to authenticate before using Docker Desktop and are there any benefits? - -Yes. You can -[enforce sign-in](/manuals/enterprise/security/enforce-sign-in/_index.md). - -Some benefits of enforcing sign-in are: - -- Ensures users receive the benefits of your subscription. -- Ensures security features like [Image Access Management](/manuals/enterprise/security/hardened-desktop/image-access-management.md) and [Registry Access Management](/manuals/enterprise/security/hardened-desktop/registry-access-management.md) are applied. -- Ensures you gain insights into users' activity. - -### Can I convert my personal Docker ID to an organization account? - -Yes. You can convert your user account to an organization account. Once you -convert a user account into an organization, it's not possible to -revert it to a personal user account. - -For prerequisites and instructions, see -[Convert an account into an organization](setup/convert-account.md). - -### Do organization invitees take up seats? - -Yes. A user invited to an organization will take up one of the provisioned -seats, even if that user hasn’t accepted their invitation yet. - -To manage invites, see [Manage organization members](/manuals/admin/organization/manage/members.md). - -### Do organization owners take a seat? - -Yes. Organization owners occupy a seat. - -### What is the difference between user, invitee, seat, and member? - -- User: Docker user with a Docker ID. -- Invitee: A user that an administrator has invited to join an organization but - has not yet accepted their invitation. -- Seats: The number of purchased seats in an organization. -- Member: A user who has received and accepted an invitation to join an - organization. Member can also refer to a member of a team within an - organization. - -### If I have two organizations and a user belongs to both organizations, do they take up two seats? - -Yes. In a scenario where a user belongs to two organizations, they take up one -seat in each organization. diff --git a/content/manuals/agentic-platform/_index.md b/content/manuals/agentic-platform/_index.md index 179c8e790c77..38baaac6ca35 100644 --- a/content/manuals/agentic-platform/_index.md +++ b/content/manuals/agentic-platform/_index.md @@ -65,6 +65,6 @@ Account-level configuration can be reused across sandboxes: To begin, open [Docker Agentic Platform](https://agentic-platform.docker.com/) and sign in with your Docker account. Docker meters sandbox compute per second. -For account and payment information, see [Docker Billing](/billing/). +For account and payment information, see [Docker Billing](/subscription-billing/). {{< grid >}} diff --git a/content/manuals/agentic-platform/faq.md b/content/manuals/agentic-platform/faq.md index 6f32f40bd194..41677bb5e558 100644 --- a/content/manuals/agentic-platform/faq.md +++ b/content/manuals/agentic-platform/faq.md @@ -53,7 +53,7 @@ also shows the equivalent hourly rate. Model inference is billed separately. The sandbox uses your credential for an external model provider, which meters and bills inference under that provider -account. See [Docker Billing](/billing/) for account, usage, and payment +account. See [Docker Billing](/subscription-billing/) for account, usage, and payment information. ## How long are logs, telemetry, and snapshots retained? diff --git a/content/manuals/agentic-platform/sandboxes.md b/content/manuals/agentic-platform/sandboxes.md index b9ecf3b49035..607b3219a6b0 100644 --- a/content/manuals/agentic-platform/sandboxes.md +++ b/content/manuals/agentic-platform/sandboxes.md @@ -62,7 +62,7 @@ when the sandbox is created and cannot be changed while it runs. Docker bills sandbox compute per second while the sandbox runs. Model inference uses your external provider credential and is metered by that provider. For -account, usage, and payment information, see [Docker Billing](/billing/). +account, usage, and payment information, see [Docker Billing](/subscription-billing/). ## Check sandbox configuration diff --git a/content/manuals/ai/sandboxes/governance/access-controls/organization.md b/content/manuals/ai/sandboxes/governance/access-controls/organization.md index 18d8eeb14cef..1b65fad4edb1 100644 --- a/content/manuals/ai/sandboxes/governance/access-controls/organization.md +++ b/content/manuals/ai/sandboxes/governance/access-controls/organization.md @@ -23,10 +23,10 @@ programmatic management of network and filesystem policies, use the [Governance API](/reference/api/ai-governance/). By default, only organization -[owners](/manuals/enterprise/security/roles-and-permissions/core-roles.md) can +[owners](/manuals/security/roles-and-permissions/core-roles.md) can view and manage AI Governance policies. To let someone other than an owner manage policies, create a -[custom role](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md) +[custom role](/manuals/security/roles-and-permissions/custom-roles/_index.md) with the **Governance** permissions and assign it to a user or team. > [!NOTE] @@ -108,13 +108,13 @@ it only to members of the teams you select. ### Before you start Team scoping targets your organization's existing -[teams](/manuals/admin/organization/manage/manage-a-team.md), so a team must +[teams](/manuals/accounts/organization/manage/manage-a-team.md), so a team must exist before you can scope a policy to it. Create teams and manage their members in one of two ways: - Manually, in Docker Home. - Automatically, by using - [group mapping](/manuals/enterprise/security/provisioning/scim/group-mapping.md) + [group mapping](/manuals/security/provisioning/scim/group-mapping.md) to synchronize your identity provider's groups with the teams in your organization. Group mapping creates teams that don't already exist and keeps their membership in step with your IdP groups. diff --git a/content/manuals/ai/sandboxes/governance/audit/_index.md b/content/manuals/ai/sandboxes/governance/audit/_index.md index 35ac8c59b7da..844758e94453 100644 --- a/content/manuals/ai/sandboxes/governance/audit/_index.md +++ b/content/manuals/ai/sandboxes/governance/audit/_index.md @@ -29,10 +29,10 @@ don't send audit data to audit logs. To use AI Governance Audit Logs, your organization needs: -- A Docker [AI Governance plan](/manuals/subscription/plans/ai-governance.md) +- A Docker [AI Governance plan](/manuals/subscription-billing/plans/ai-governance.md) - An enforced organization governance policy - A Docker organization account -- An organization owner, or a user with a [custom role](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md) that includes AI Governance audit permissions, to configure delivery and view hosted events +- An organization owner, or a user with a [custom role](/manuals/security/roles-and-permissions/custom-roles/_index.md) that includes AI Governance audit permissions, to configure delivery and view hosted events > [!NOTE] > Other Docker subscriptions are not sufficient on their own to use AI Governance @@ -58,7 +58,7 @@ Docker supports two delivery modes for audit records: app.docker.com. Cloud delivery is on by default when AI Governance is enabled. Organization owners can disable it in [audit delivery settings](configure.md). -Organization owners and users with a [custom role](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md) that includes AI Governance audit permissions can configure local disk, Docker Cloud, or both. +Organization owners and users with a [custom role](/manuals/security/roles-and-permissions/custom-roles/_index.md) that includes AI Governance audit permissions can configure local disk, Docker Cloud, or both. The hosted audit log view, CSV export, and SIEM forwarding all require Docker Cloud delivery to be enabled. Local delivery alone does not power these features. diff --git a/content/manuals/ai/sandboxes/governance/audit/configure.md b/content/manuals/ai/sandboxes/governance/audit/configure.md index 38342b898f44..5afa22949ab6 100644 --- a/content/manuals/ai/sandboxes/governance/audit/configure.md +++ b/content/manuals/ai/sandboxes/governance/audit/configure.md @@ -6,7 +6,7 @@ description: Configure local and cloud delivery, retention, and history for Dock keywords: docker sandboxes, audit delivery, AI Governance, audit logs, retention, cloud delivery, AI Platform --- -Organization owners and users with a [custom role](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md) that includes AI Governance audit permissions can configure where Docker writes audit events. +Organization owners and users with a [custom role](/manuals/security/roles-and-permissions/custom-roles/_index.md) that includes AI Governance audit permissions can configure where Docker writes audit events. Two delivery destinations are available and can be used independently or together: @@ -19,9 +19,9 @@ together: Your organization needs: -- A Docker [AI Governance plan](/manuals/subscription/plans/ai-governance.md) +- A Docker [AI Governance plan](/manuals/subscription-billing/plans/ai-governance.md) - An enforced organization governance policy -- Organization owner access, or a [custom role](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md) with AI Governance audit permissions +- Organization owner access, or a [custom role](/manuals/security/roles-and-permissions/custom-roles/_index.md) with AI Governance audit permissions Only users who have an AI Governance license and are governed by the enforced organization policy send Docker Sandboxes audit data. diff --git a/content/manuals/ai/sandboxes/governance/concepts.md b/content/manuals/ai/sandboxes/governance/concepts.md index d39cd47f128c..ed96c722a219 100644 --- a/content/manuals/ai/sandboxes/governance/concepts.md +++ b/content/manuals/ai/sandboxes/governance/concepts.md @@ -47,7 +47,7 @@ to specific teams: - Team-scoped: with one or more teams assigned, the policy applies only to members of those teams. -Teams are the same [teams](/manuals/admin/organization/manage/manage-a-team.md) +Teams are the same [teams](/manuals/accounts/organization/manage/manage-a-team.md) you manage for your organization; Docker matches a policy's teams against each user's team membership. Because an organization can mix org-wide and team-scoped policies, a single user is often subject to several at once. The policies that diff --git a/content/manuals/billing/_index.md b/content/manuals/billing/_index.md deleted file mode 100644 index 4f94c88bdec0..000000000000 --- a/content/manuals/billing/_index.md +++ /dev/null @@ -1,80 +0,0 @@ ---- -title: Manage billing and payments -linkTitle: Billing -description: > - Manage Docker billing and payments, including usage, costs, credits, - invoices, payment methods, and tax details. -keywords: - billing, invoice, payment, subscription, Docker billing, update payment - method, billing history, invoices, payment verification, tax exemption, - usage, costs, credits, metered billing -weight: 30 -params: - sidebar: - group: Platform -grid_core: - - title: Add or update a payment method - description: Learn how to add or update a payment method for your personal account or organization. - link: /billing/payment-method/ - icon: credit-card - - title: Update billing information - description: Learn how to update billing information for your personal account or organization. - link: /billing/details/ - icon: pencil-square - - title: View billing history - description: Learn how to view billing history and download past invoices. - link: /billing/history/ - icon: credit-card - - title: 3D Secure authentication - description: Learn how 3DS works and how to troubleshoot verification issues. - link: /billing/3d-secure/ - icon: wallet - - title: Taxes - description: Learn how to submit a US tax exemption certificate or add a VAT number. - link: /billing/tax-certificate/ - icon: document-text -aliases: - - /billing/docker-hub-pricing/ ---- - -You can use the billing portal to manage your Docker subscriptions, such -as updating payment methods, reviewing billing details, and tracking -invoice history. - -## Billing - -You can manage your Docker plans from the billing portal: - -1. Sign in to [Docker Home](https://app.docker.com/), then choose your - account. -1. Go to **Billing** to view the **Overview** page. -1. Select the page you want to explore. - -### Usage - -The billing **Usage** page helps you compare usage-based charges across -billing periods. You can track usage by changing the period, product, -and how the product is metered. - -### Costs - -The billing **Costs** page aggregates all costs by billing period. It -breaks down charges by resource (the product accruing a charge), the -status of your billing period, and costs to date. - -### Credits - -The billing **Credits** page shows credits applied to your costs. If you -received a promotional credit, you can see how it applies to your bill -from this page. - -## Docker plans and billing cycle - -Your invoice history is a reference to the Docker plans you subscribe -to. For information about your billing cycle and renewal dates, see -[Billing cycle](/manuals/billing/details.md#billing-cycle). To upgrade or add -a new plan, see [Subscription](/manuals/subscription/_index.md). - -## Next steps - -{{< grid items="grid_core" >}} diff --git a/content/manuals/billing/faqs.md b/content/manuals/billing/faqs.md deleted file mode 100644 index 2f7a9a838b9f..000000000000 --- a/content/manuals/billing/faqs.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Billing FAQs -linkTitle: FAQs -description: Find answers to common questions about Docker billing, failed payments, taxes, and pay by invoice. -keywords: billing, renewal, failed payments, sales tax, VAT, academic pricing, pay by invoice -tags: [FAQ] -weight: 80 ---- - -## What happens if my subscription payment fails? - -If your subscription payment fails, there is a grace period of 15 days, -including the due date. Docker attempts to collect the payment three times using -the following schedule: - -- 3 days after the due date -- 5 days after the previous attempt -- 7 days after the previous attempt - -Docker also sends an email notification -`Action Required - Credit Card Payment Failed` with an attached unpaid invoice -after each failed payment attempt. - -If the invoice remains unpaid after the grace period, the -subscription downgrades to a free subscription and all paid features are -disabled. - -## Can I manually retry a failed payment? - -Yes. If your payment fails, select **Pay now** to retry the payment through -Stripe. - -Before retrying, verify that your default payment method is up to date. For -instructions, see -[Manage a payment method](/manuals/billing/payment-method.md#manage-payment-method). - -## Does Docker collect sales tax and VAT? - -Docker collects sales tax or VAT from the following customers: - -- For United States customers, Docker began collecting sales tax on - July 1, 2024. -- For European customers, Docker began collecting VAT on March 1, 2025. -- For United Kingdom customers, Docker began collecting VAT on May 1, 2025. - -To help ensure correct tax assessments, keep your -[billing information](/manuals/billing/details.md) up to date. For details on -adding a VAT number or submitting a US tax exemption certificate, see -[Taxes](/manuals/billing/tax-certificate.md). - -## Does Docker offer academic pricing? - -For academic pricing, contact the -[Docker Sales Team](https://www.docker.com/company/contact). - -## Can I use pay by invoice for upgrades or additional seats? - -No. Pay by invoice is only available for renewing annual subscriptions, not for -purchasing upgrades or additional seats. You must use card payment or US bank -accounts for these changes. - -For a list of supported payment methods, see -[Add or update a payment method](/manuals/billing/payment-method.md). diff --git a/content/manuals/build-cloud/_index.md b/content/manuals/build-cloud/_index.md index 80458665e99d..54af535bd8d5 100644 --- a/content/manuals/build-cloud/_index.md +++ b/content/manuals/build-cloud/_index.md @@ -52,7 +52,7 @@ data between cloud builders. ## Get Docker Build Cloud To get started with Docker Build Cloud, -[create a Docker account](/accounts/create-account/). There are two options +[create a Docker account](/accounts/individual/create-account/). There are two options to get access to Docker Build Cloud: - Users with a free Personal account can opt-in to a 7-day free trial, with the option @@ -64,4 +64,4 @@ Once you've signed up and created a builder, continue by [setting up the builder in your local environment](./setup.md). For information about roles and permissions related to Docker Build Cloud, see -[Roles and Permissions](/manuals/enterprise/security/roles-and-permissions/core-roles.md#docker-build-cloud). +[Roles and Permissions](/manuals/security/roles-and-permissions/core-roles.md#docker-build-cloud). diff --git a/content/manuals/build-cloud/builder-settings.md b/content/manuals/build-cloud/builder-settings.md index a117595f2a8d..2b6f41a59aa3 100644 --- a/content/manuals/build-cloud/builder-settings.md +++ b/content/manuals/build-cloud/builder-settings.md @@ -47,7 +47,7 @@ two builders: ### Get more build cache space -To get more Build cache space, [upgrade your subscription](/manuals/subscription/plans/docker.md). +To get more Build cache space, [upgrade your subscription](/manuals/subscription-billing/manage/plans.md#upgrade-plans). > [!TIP] > diff --git a/content/manuals/build-cloud/ci.md b/content/manuals/build-cloud/ci.md index 110853ecd513..7aa9f176d154 100644 --- a/content/manuals/build-cloud/ci.md +++ b/content/manuals/build-cloud/ci.md @@ -37,8 +37,8 @@ See [Loading build results](./usage/#loading-build-results) for details. To enable your CI/CD system to build and push images using Docker Build Cloud, provide both an access token and a username. The type of token and the username you use depend on your account type and permissions. -- If you are an organization administrator or have permission to create [organization access tokens (OAT)](/manuals/enterprise/security/access-tokens.md), use an OAT and set `DOCKER_ACCOUNT` to your Docker Hub organization name. -- If you do not have permission to create OATs or are using a personal account, use a [personal access token (PAT)](/security/access-tokens/) and set `DOCKER_ACCOUNT` to your Docker Hub username. +- If you are an organization administrator or have permission to create [organization access tokens (OAT)](/manuals/security/access-tokens/organization-access-tokens.md), use an OAT and set `DOCKER_ACCOUNT` to your Docker Hub organization name. +- If you do not have permission to create OATs or are using a personal account, use a [personal access token (PAT)](/security/access-tokens/personal-access-tokens/) and set `DOCKER_ACCOUNT` to your Docker Hub username. ### Creating access tokens @@ -46,7 +46,7 @@ To enable your CI/CD system to build and push images using Docker Build Cloud, p If you are an organization administrator: -- Create an [organization access token (OAT)](/manuals/enterprise/security/access-tokens.md). The token must have these permissions: +- Create an [organization access token (OAT)](/manuals/security/access-tokens/organization-access-tokens.md). The token must have these permissions: 1. **cloud-connect** scope 2. **Read public repositories** permission 3. **Repository access** with **Image push** permission for the target repository: @@ -60,7 +60,7 @@ If you are not an organization administrator: #### For personal accounts -- Create a [personal access token (PAT)](/security/access-tokens/) with the following permissions: +- Create a [personal access token (PAT)](/security/access-tokens/personal-access-tokens/) with the following permissions: 1. **Read & write** access. - Note: Building with Docker Build Cloud only requires read access, but you need write access to push images to a Docker Hub repository. diff --git a/content/manuals/desktop/previous-versions/edge-releases-mac.md b/content/manuals/desktop/previous-versions/edge-releases-mac.md index 6ab358c1dcc6..a42c984f0f43 100644 --- a/content/manuals/desktop/previous-versions/edge-releases-mac.md +++ b/content/manuals/desktop/previous-versions/edge-releases-mac.md @@ -1104,7 +1104,7 @@ This release contains a Kubernetes upgrade. Note that your local Kubernetes clus - Add daemon options validation - Diagnose can be cancelled & Improved help information. Fixes [docker/for-mac#1134](https://github.com/docker/for-mac/issues/1134), [docker/for-mac#1474](https://github.com/docker/for-mac/issues/1474) -- Support paging of Docker Cloud [repositories](../../docker-hub/repos/_index.md) and [organizations](../../admin/organization/setup/orgs.md). Fixes [docker/for-mac#1538](https://github.com/docker/for-mac/issues/1538) +- Support paging of Docker Cloud [repositories](../../docker-hub/repos/_index.md) and [organizations](../../accounts/organization/setup/orgs.md). Fixes [docker/for-mac#1538](https://github.com/docker/for-mac/issues/1538) ### Docker Community Edition 17.06.1-ce-mac20, 2017-07-18 diff --git a/content/manuals/desktop/release-notes.md b/content/manuals/desktop/release-notes.md index 85980e5deea6..c89d6b302955 100644 --- a/content/manuals/desktop/release-notes.md +++ b/content/manuals/desktop/release-notes.md @@ -4982,7 +4982,7 @@ Installing Docker Desktop 4.5.0 from scratch has a bug which defaults Docker Des ### New - Easy, Secure sign in with Auth0 and Single Sign-on - - Single Sign-on: Users with a Docker Business subscription can now configure SSO to authenticate using their identity providers (IdPs) to access Docker. For more information, see [Single Sign-on](/manuals/enterprise/security/single-sign-on/_index.md). + - Single Sign-on: Users with a Docker Business subscription can now configure SSO to authenticate using their identity providers (IdPs) to access Docker. For more information, see [Single Sign-on](/manuals/security/authentication/single-sign-on/_index.md). - Signing in to Docker Desktop now takes you through the browser so that you get all the benefits of auto-filling from password managers. ### Upgrades @@ -4994,7 +4994,7 @@ Installing Docker Desktop 4.5.0 from scratch has a bug which defaults Docker Des ### Security -- Fixed [CVE-2021-45449](../security/_index.md#cve-2021-45449) that affects users currently on Docker Desktop version 4.3.0 or 4.3.1. +- Fixed [CVE-2021-45449](../security/security-announcements.md#cve-2021-45449) that affects users currently on Docker Desktop version 4.3.0 or 4.3.1. Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information (access token or password) on the user's machine during login. This only affects users if they are on Docker Desktop 4.3.0, 4.3.1 and the user has logged in while on 4.3.0, 4.3.1. Gaining access to this data would require having access to the user’s local files. @@ -5034,7 +5034,7 @@ This only affects users if they are on Docker Desktop 4.3.0, 4.3.1 and the user ### Security -- Fixed [CVE-2021-45449](../security/_index.md#cve-2021-45449) that affects users currently on Docker Desktop version 4.3.0 or 4.3.1. +- Fixed [CVE-2021-45449](../security/security-announcements.md#cve-2021-45449) that affects users currently on Docker Desktop version 4.3.0 or 4.3.1. Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information (access token or password) on the user's machine during login. This only affects users if they are on Docker Desktop 4.3.0, 4.3.1 and the user has logged in while on 4.3.0, 4.3.1. Gaining access to this data would require having access to the user’s local files. @@ -5261,7 +5261,7 @@ The updated [Docker Subscription Service Agreement](https://www.docker.com/legal - **No changes** to Docker Engine or any other upstream **open source** Docker or Moby project. To understand how these changes affect you, read the [FAQs](https://www.docker.com/pricing/faq). -For more information, see [Docker subscription overview](../subscription/_index.md). +For more information, see [Docker subscription overview](../subscription-billing/_index.md). ### Upgrades diff --git a/content/manuals/desktop/setup/sign-in.md b/content/manuals/desktop/setup/sign-in.md index 01b04cab60d5..d8dd1ea49d59 100644 --- a/content/manuals/desktop/setup/sign-in.md +++ b/content/manuals/desktop/setup/sign-in.md @@ -38,7 +38,7 @@ In large enterprises where admin access is restricted, administrators can [enfor ## Signing in with Docker Desktop for Linux Docker Desktop for Linux relies on [`pass`](https://www.passwordstore.org/) to store credentials in GPG-encrypted files. -Before signing in to Docker Desktop with your [Docker ID](/accounts/create-account/), you must initialize `pass`. +Before signing in to Docker Desktop with your [Docker ID](/accounts/individual/create-account/), you must initialize `pass`. Docker Desktop displays a warning if `pass` is not configured. 1. Generate a GPG key. You can initialize pass by using a gpg key. To generate a gpg key, run: diff --git a/content/manuals/dhi/how-to/customize.md b/content/manuals/dhi/how-to/customize.md index fbb17a2d4f89..559bc482c9d3 100644 --- a/content/manuals/dhi/how-to/customize.md +++ b/content/manuals/dhi/how-to/customize.md @@ -161,9 +161,9 @@ You can create customizations using either the DHI CLI or the Docker Hub web int {{< tab name="CLI" >}} Authenticate with `docker login` using your Docker credentials or a [personal -access token (PAT)](../../security/access-tokens.md) with **Read & Write** +access token (PAT)](../../security/access-tokens/personal-access-tokens.md) with **Read & Write** permissions, or an [organization access token -(OAT)](../../enterprise/security/access-tokens.md). When using an OAT, the +(OAT)](../../security/access-tokens/organization-access-tokens.md). When using an OAT, the available operations depend on the token's permission scope: - To list or get customizations, or to view build logs, the OAT must have read diff --git a/content/manuals/dhi/how-to/helm.md b/content/manuals/dhi/how-to/helm.md index 0afdf0d80249..ee65e52d596b 100644 --- a/content/manuals/dhi/how-to/helm.md +++ b/content/manuals/dhi/how-to/helm.md @@ -53,8 +53,8 @@ registry, you still need to create this secret if the registry requires authentication. 1. For `dhi.io` or Docker Hub, create a [personal access token - (PAT)](/security/access-tokens/) using your Docker account or an - [organization access token (OAT)](/enterprise/security/access-tokens/). + (PAT)](/security/access-tokens/personal-access-tokens/) using your Docker account or an + [organization access token (OAT)](/security/access-tokens/organization-access-tokens/). Ensure the token has at least read-only access to the Docker Hardened Image repositories. 2. Create a secret in Kubernetes using the following command. Replace ``, ``, diff --git a/content/manuals/dhi/how-to/mirror.md b/content/manuals/dhi/how-to/mirror.md index b942a01862a5..56b3c4a1bd5e 100644 --- a/content/manuals/dhi/how-to/mirror.md +++ b/content/manuals/dhi/how-to/mirror.md @@ -34,10 +34,10 @@ repositories: ## Mirror a DHI repository to your organization -Organization owners, editors, and members with a [custom role](../../enterprise/security/roles-and-permissions/custom-roles/_index.md) +Organization owners, editors, and members with a [custom role](../../security/roles-and-permissions/custom-roles/_index.md) that includes the DHI mirroring permission can create, view, and manage mirrors. When using the CLI or Terraform, you can also mirror using an [organization -access token (OAT)](../../enterprise/security/access-tokens.md) with the +access token (OAT)](../../security/access-tokens/organization-access-tokens.md) with the appropriate permission scopes, without requiring role-based access. When a member with a custom role that includes the DHI mirroring permission @@ -83,9 +83,9 @@ It may take a few minutes for all the tags to finish mirroring. {{< tab name="CLI" >}} Authenticate with `docker login` using your Docker credentials, a [personal -access token (PAT)](../../security/access-tokens.md) with **Read & Write** +access token (PAT)](../../security/access-tokens/personal-access-tokens.md) with **Read & Write** permissions, or an [organization access token -(OAT)](../../enterprise/security/access-tokens.md). When using an OAT, the +(OAT)](../../security/access-tokens/organization-access-tokens.md). When using an OAT, the available operations depend on the token's permission scope: - To list mirrored repositories, the OAT must have read (pull) access to the @@ -200,9 +200,9 @@ updates. You can still use the last images or charts that were mirrored. {{< tab name="CLI" >}} Authenticate with `docker login` using your Docker credentials, a [personal -access token (PAT)](../../security/access-tokens.md) with **Read & Write** +access token (PAT)](../../security/access-tokens/personal-access-tokens.md) with **Read & Write** permissions, or an [organization access token -(OAT)](../../enterprise/security/access-tokens.md) with push access to the +(OAT)](../../security/access-tokens/organization-access-tokens.md) with push access to the relevant repository. Use the [`docker dhi mirror`](/reference/cli/docker/dhi/mirror/) command: @@ -303,11 +303,11 @@ same steps to a non-mirrored image by updating the `SRC_ATT_REPO` and In this example, you authenticate as your Docker organization using an [organization access token - (OAT)](../../enterprise/security/access-tokens.md). The OAT must have at + (OAT)](../../security/access-tokens/organization-access-tokens.md). The OAT must have at least pull access to every DHI repository you want to mirror. Only repositories in the token's scope are accessible. Alternatively, you can authenticate as a Docker Hub user with a [personal access token - (PAT)](../../security/access-tokens.md) that has `read only` access. + (PAT)](../../security/access-tokens/personal-access-tokens.md) that has `read only` access. > [!WARNING] > diff --git a/content/manuals/dhi/how-to/policies.md b/content/manuals/dhi/how-to/policies.md index e909dfdfadc7..152aa454dc1b 100644 --- a/content/manuals/dhi/how-to/policies.md +++ b/content/manuals/dhi/how-to/policies.md @@ -215,7 +215,7 @@ jobs: The `docker/login-action` step authenticates with Docker Hub so the runner can pull the DHI base image and the `dhi/policies` bundle. Store your Docker Hub -username and a [personal access token](/manuals/security/access-tokens.md) as the +username and a [personal access token](/manuals/security/access-tokens/personal-access-tokens.md) as the `DOCKER_USER` and `DOCKER_PAT` repository secrets. Set `exit-code: true` to fail the step when any policy isn't met. The diff --git a/content/manuals/dhi/how-to/select-enterprise.md b/content/manuals/dhi/how-to/select-enterprise.md index e108079f0254..2e9c6bda3877 100644 --- a/content/manuals/dhi/how-to/select-enterprise.md +++ b/content/manuals/dhi/how-to/select-enterprise.md @@ -20,7 +20,7 @@ To use this workflow, you need: - One of the following: - A DHI Select or Enterprise subscription. [Contact Docker sales](https://www.docker.com/products/hardened-images/#compare) to purchase DHI Enterprise - or [learn more about DHI plans](../../subscription/plans/dhi.md). + or [learn more about DHI plans](../../subscription-billing/plans/dhi.md). - An active DHI trial. [Start a free DHI trial](https://hub.docker.com/hardened-images/start-free-trial). - [Docker Desktop](../../desktop/release-notes.md) 4.65 or later to use the diff --git a/content/manuals/dhi/how-to/use.md b/content/manuals/dhi/how-to/use.md index 73bf38594ea0..2725d4f07050 100644 --- a/content/manuals/dhi/how-to/use.md +++ b/content/manuals/dhi/how-to/use.md @@ -23,12 +23,12 @@ package manager, and may run as a non-root user by default. > pull DHI Community images. You can authenticate using either of the following: > > - **Docker ID and password:** Use your Docker Hub username and password. If -> you don't have a Docker account, [create one](../../accounts/create-account.md) +> you don't have a Docker account, [create one](../../accounts/individual/create-account.md > for free. > - **Access token:** Use a [personal access token -> (PAT)](../../security/access-tokens.md) for personal accounts, or an +> (PAT)](../../security/access-tokens/personal-access-tokens.md) for personal accounts, or an > [organization access token -> (OAT)](../../enterprise/security/access-tokens.md) with your organization +> (OAT)](../../security/access-tokens/organization-access-tokens.md) with your organization > name as the username. > > Run `docker login dhi.io` to authenticate. @@ -109,14 +109,14 @@ attached to Docker Hardened Images. This is particularly useful in CI/CD pipelines for supply chain security validation and compliance checks. For automated workflows, authenticate using an [organization access token -(OAT)](../../enterprise/security/access-tokens.md). OATs are owned by the +(OAT)](../../security/access-tokens/organization-access-tokens.md). OATs are owned by the organization rather than an individual user, making them better suited for CI/CD pipelines. To discover attestations with ORAS: 1. [Generate an organization access - token](../../enterprise/security/access-tokens.md) with **Read public + token](../../security/access-tokens/organization-access-tokens.md) with **Read public repositories** scope. The following example shows how to discover attestations on DHI community @@ -268,8 +268,8 @@ For the `--docker-server` value: #### Using an access token Create a secret using a [Personal Access Token -(PAT)](../../security/access-tokens.md) or [Organization Access Token -(OAT)](../../enterprise/security/access-tokens.md). Ensure the token has at +(PAT)](../../security/access-tokens/personal-access-tokens.md) or [Organization Access Token +(OAT)](../../security/access-tokens/organization-access-tokens.md). Ensure the token has at least read-only access to the repositories. ```console diff --git a/content/manuals/dhi/how-to/verify.md b/content/manuals/dhi/how-to/verify.md index ab4602e0deb7..1095c40176b8 100644 --- a/content/manuals/dhi/how-to/verify.md +++ b/content/manuals/dhi/how-to/verify.md @@ -27,7 +27,7 @@ attestation infrastructure. > You must authenticate to the Docker Hardened Images registry (`dhi.io`) to > pull images. Use your Docker ID credentials (the same username and password > you use for Docker Hub) when signing in. If you don't have a Docker account, -> [create one](../../accounts/create-account.md) for free. +> [create one](../../accounts/individual/create-account.md) for free. > > Run `docker login dhi.io` to authenticate. @@ -62,11 +62,11 @@ This command shows all available attestations, including SBOMs, provenance, vuln First, authenticate to both registries. This example authenticates as your Docker organization using an [organization access token -(OAT)](../../enterprise/security/access-tokens.md). The OAT must have at least +(OAT)](../../security/access-tokens/organization-access-tokens.md). The OAT must have at least pull access to the DHI repositories you want to verify. Only repositories in the token's scope are accessible. Alternatively, you can authenticate as a Docker Hub user with a [personal access token -(PAT)](../../security/access-tokens.md) that has `read only` access. +(PAT)](../../security/access-tokens/personal-access-tokens.md) that has `read only` access. > [!WARNING] > diff --git a/content/manuals/dhi/migration/examples/dotnet.md b/content/manuals/dhi/migration/examples/dotnet.md index 79cdee998e1a..129d2f937788 100644 --- a/content/manuals/dhi/migration/examples/dotnet.md +++ b/content/manuals/dhi/migration/examples/dotnet.md @@ -23,7 +23,7 @@ Hardened Images. Each example includes four variations: > You must authenticate to `dhi.io` before you can pull Docker Hardened Images. > Use your Docker ID credentials (the same username and password you use for > Docker Hub). If you don't have a Docker account, [create -> one](../../../accounts/create-account.md) for free. +> one](../../../accounts/individual/create-account.md) for free. > > Run `docker login dhi.io` to authenticate. diff --git a/content/manuals/dhi/migration/examples/go.md b/content/manuals/dhi/migration/examples/go.md index 3a42bdc50a9d..b79ba0d407a6 100644 --- a/content/manuals/dhi/migration/examples/go.md +++ b/content/manuals/dhi/migration/examples/go.md @@ -24,7 +24,7 @@ Hardened Images. Each example includes five variations: > You must authenticate to `dhi.io` before you can pull Docker Hardened Images. > Use your Docker ID credentials (the same username and password you use for > Docker Hub). If you don't have a Docker account, [create -> one](../../../accounts/create-account.md) for free. +> one](../../../accounts/individual/create-account.md) for free. > > Run `docker login dhi.io` to authenticate. diff --git a/content/manuals/dhi/migration/examples/java.md b/content/manuals/dhi/migration/examples/java.md index bfae595dc48a..2b26fbeb1d74 100644 --- a/content/manuals/dhi/migration/examples/java.md +++ b/content/manuals/dhi/migration/examples/java.md @@ -24,7 +24,7 @@ Hardened Images. Each example includes five variations: > You must authenticate to `dhi.io` before you can pull Docker Hardened Images. > Use your Docker ID credentials (the same username and password you use for > Docker Hub). If you don't have a Docker account, [create -> one](../../../accounts/create-account.md) for free. +> one](../../../accounts/individual/create-account.md) for free. > > Run `docker login dhi.io` to authenticate. diff --git a/content/manuals/dhi/migration/examples/node.md b/content/manuals/dhi/migration/examples/node.md index 3019df3f8d16..23425e726437 100644 --- a/content/manuals/dhi/migration/examples/node.md +++ b/content/manuals/dhi/migration/examples/node.md @@ -24,7 +24,7 @@ Hardened Images. Each example includes five variations: > You must authenticate to `dhi.io` before you can pull Docker Hardened Images. > Use your Docker ID credentials (the same username and password you use for > Docker Hub). If you don't have a Docker account, [create -> one](../../../accounts/create-account.md) for free. +> one](../../../accounts/individual/create-account.md) for free. > > Run `docker login dhi.io` to authenticate. diff --git a/content/manuals/dhi/migration/examples/python.md b/content/manuals/dhi/migration/examples/python.md index 4ee4d327551c..bf11e9bc4bfd 100644 --- a/content/manuals/dhi/migration/examples/python.md +++ b/content/manuals/dhi/migration/examples/python.md @@ -24,7 +24,7 @@ Hardened Images. Each example includes five variations: > You must authenticate to `dhi.io` before you can pull Docker Hardened Images. > Use your Docker ID credentials (the same username and password you use for > Docker Hub). If you don't have a Docker account, [create -> one](../../../accounts/create-account.md) for free. +> one](../../../accounts/individual/create-account.md) for free. > > Run `docker login dhi.io` to authenticate. diff --git a/content/manuals/dhi/migration/migrate-from-doi.md b/content/manuals/dhi/migration/migrate-from-doi.md index 559967e003e2..5908e3a4c2c9 100644 --- a/content/manuals/dhi/migration/migrate-from-doi.md +++ b/content/manuals/dhi/migration/migrate-from-doi.md @@ -48,7 +48,7 @@ replaced by the new hardened image. > You must authenticate to `dhi.io` before you can pull Docker Hardened Images. > Use your Docker ID credentials (the same username and password you use for > Docker Hub). If you don't have a Docker account, [create -> one](../../accounts/create-account.md) for free. +> one](../../accounts/individual/create-account.md) for free. > > Run `docker login dhi.io` to authenticate. diff --git a/content/manuals/dhi/migration/migrate-from-ubuntu.md b/content/manuals/dhi/migration/migrate-from-ubuntu.md index b061e791df46..b28d8cecdc18 100644 --- a/content/manuals/dhi/migration/migrate-from-ubuntu.md +++ b/content/manuals/dhi/migration/migrate-from-ubuntu.md @@ -43,7 +43,7 @@ replaced by the new DHI Debian image. > You must authenticate to `dhi.io` before you can pull Docker Hardened Images. > Use your Docker ID credentials (the same username and password you use for > Docker Hub). If you don't have a Docker account, [create -> one](../../accounts/create-account.md) for free. +> one](../../accounts/individual/create-account.md) for free. > > Run `docker login dhi.io` to authenticate. diff --git a/content/manuals/dhi/migration/migrate-from-wolfi.md b/content/manuals/dhi/migration/migrate-from-wolfi.md index d291653e2b40..59de5e0e3f1f 100644 --- a/content/manuals/dhi/migration/migrate-from-wolfi.md +++ b/content/manuals/dhi/migration/migrate-from-wolfi.md @@ -34,7 +34,7 @@ replaced by the new hardened image. > You must authenticate to `dhi.io` before you can pull Docker Hardened Images. > Use your Docker ID credentials (the same username and password you use for > Docker Hub). If you don't have a Docker account, [create -> one](../../accounts/create-account.md) for free. +> one](../../accounts/individual/create-account.md) for free. > > Run `docker login dhi.io` to authenticate. diff --git a/content/manuals/dhi/tools/api.md b/content/manuals/dhi/tools/api.md index be29c3ce9d6b..e52f50e5b5cc 100644 --- a/content/manuals/dhi/tools/api.md +++ b/content/manuals/dhi/tools/api.md @@ -40,7 +40,7 @@ Every query takes a `Context` argument (conventionally named `ctx` in the ## Authentication -An [organization access token](/manuals/enterprise/security/access-tokens.md) +An [organization access token](/manuals/security/access-tokens/organization-access-tokens.md) (OAT) or personal access token (PAT) isn't used directly as the bearer token. Exchange it first for an access token: diff --git a/content/manuals/dhi/tools/mcp.md b/content/manuals/dhi/tools/mcp.md index bc71dae76de6..d894d26e0efd 100644 --- a/content/manuals/dhi/tools/mcp.md +++ b/content/manuals/dhi/tools/mcp.md @@ -148,7 +148,7 @@ based on what you ask: ## Authenticate for mirror tools The mirror tools require a Docker Hub username and [personal access token -(PAT)](/security/access-tokens/) with owner access to the target organization, +(PAT)](/security/access-tokens/personal-access-tokens/) with owner access to the target organization, passed as an HTTP Basic auth header. Generate the value with: ```console diff --git a/content/manuals/docker-hub/_index.md b/content/manuals/docker-hub/_index.md index da692cc9dc8d..59b549bbae3b 100644 --- a/content/manuals/docker-hub/_index.md +++ b/content/manuals/docker-hub/_index.md @@ -27,7 +27,7 @@ grid: - title: Organizations description: Learn about organization administration. icon: building-storefront - link: /admin/ + link: /accounts/organization/ - title: Usage and limits description: Explore usage limits and how to better utilize Docker Hub. icon: chart-bar diff --git a/content/manuals/docker-hub/release-notes.md b/content/manuals/docker-hub/release-notes.md index 4b45b5eb3b74..35f79f9b92cd 100644 --- a/content/manuals/docker-hub/release-notes.md +++ b/content/manuals/docker-hub/release-notes.md @@ -110,7 +110,7 @@ known issues for each Docker Hub release. ### New -- Organizations can assign the [editor role](/manuals/enterprise/security/roles-and-permissions/_index.md) to members to grant additional permissions without full administrative access. +- Organizations can assign the [editor role](/manuals/security/roles-and-permissions/_index.md) to members to grant additional permissions without full administrative access. ## 2023-05-09 @@ -146,7 +146,7 @@ known issues for each Docker Hub release. ### Bug fixes and enhancements -- You can now [export a CSV file of members](../admin/organization/manage/members.md#export-members-csv-file) from organizations that you own. +- You can now [export a CSV file of members](../accounts/organization/manage/members.md#export-members-csv-file) from organizations that you own. ## 2022-07-22 @@ -182,7 +182,7 @@ known issues for each Docker Hub release. ### New -- You can now purchase or upgrade to a Docker Business subscription using a credit card. To learn more, see [Upgrade your subscription](../subscription/plans/docker.md). +- You can now purchase or upgrade to a Docker Business subscription using a credit card. To learn more, see [Upgrade your subscription](../subscription-billing/plans/docker.md). ## 2021-08-31 @@ -199,7 +199,7 @@ The updated [Docker Subscription Service Agreement](https://www.docker.com/legal - The existing Docker Free subscription has been renamed **Docker Personal**. - **No changes** to Docker Engine or any other upstream **open source** Docker or Moby project. - To understand how these changes affect you, read the [FAQs](https://www.docker.com/pricing/faq). For more information, see [Docker subscription overview](../subscription/_index.md). + To understand how these changes affect you, read the [FAQs](https://www.docker.com/pricing/faq). For more information, see [Docker subscription overview](../subscription-billing/_index.md). ## 2021-05-05 @@ -223,7 +223,7 @@ You can now specify any email address to receive billing-related emails for your To change the email address receiving billing-related emails, log into Docker Hub and navigate to the **Billing** tab of your organization. Select **Payment Methods** > **Billing Information**. Enter the new email address that you'd like to use in the **Email** field. Click **Update** for the changes to take effect. -For details on how to update your billing information, see [Update billing information](../billing/_index.md). +For details on how to update your billing information, see [Update billing information](../subscription-billing/_index.md). ## 2021-03-22 @@ -239,7 +239,7 @@ Docker introduces the Advanced Image Management dashboard that enables you to vi Docker introduces Audit logs, a new feature that allows team owners to view a list of activities that occur at organization and repository levels. This feature begins tracking the activities from the release date, that is, **from 25 January 2021**. -For more information about this feature and for instructions on how to use it, see [Activity logs](../admin/activity-logs.md). +For more information about this feature and for instructions on how to use it, see [Activity logs](../accounts/organization/activity-logs.md). ## 2020-11-10 @@ -257,7 +257,7 @@ Docker introduces Hub Vulnerability Scanning which enables you to automatically ### New features -- Docker has announced a new, per-seat pricing model to accelerate developer workflows for cloud-native development. The previous private repository/concurrent autobuild-based plans have been replaced with new **Pro** and **Team** plans that include unlimited private repositories. For more information, see [Docker subscription](../subscription/_index.md). +- Docker has announced a new, per-seat pricing model to accelerate developer workflows for cloud-native development. The previous private repository/concurrent autobuild-based plans have been replaced with new **Pro** and **Team** plans that include unlimited private repositories. For more information, see [Docker subscription](../subscription-billing/_index.md). - Docker has enabled download rate limits for downloads and pull requests on Docker Hub. This caps the number of objects that users can download within a specified timeframe. For more information, see [Usage and limits](/manuals/docker-hub/usage/_index.md). @@ -318,7 +318,7 @@ Docker introduces Hub Vulnerability Scanning which enables you to automatically ### New features -- You can now [create personal access tokens](/security/access-tokens/) in Docker Hub and use them to authenticate from the Docker CLI. Find them in your account settings, under the new **[Security](https://hub.docker.com/settings/security)** section. +- You can now [create personal access tokens](/security/access-tokens/personal-access-tokens/) in Docker Hub and use them to authenticate from the Docker CLI. Find them in your account settings, under the new **[Security](https://hub.docker.com/settings/security)** section. ### Known Issues @@ -328,7 +328,7 @@ Docker introduces Hub Vulnerability Scanning which enables you to automatically ### Enhancements -- The [billing page](../subscription/plans/docker.md) for personal accounts has been updated. You can access the page at its new URL: [https://hub.docker.com/billing/plan](https://hub.docker.com/billing/plan). +- The [billing page](../subscription-billing/plans/docker.md) for personal accounts has been updated. You can access the page at its new URL: [https://hub.docker.com/billing/plan](https://hub.docker.com/billing/plan). ### Known Issues diff --git a/content/manuals/docker-hub/repos/create.md b/content/manuals/docker-hub/repos/create.md index 9e20df6710c0..b2674644b9fc 100644 --- a/content/manuals/docker-hub/repos/create.md +++ b/content/manuals/docker-hub/repos/create.md @@ -39,7 +39,7 @@ weight: 20 is only accessible to you and collaborators. In addition, if you selected an organization's namespace, then the repository is accessible to those with applicable roles or permissions. For more details, see [Roles and - permissions](/manuals/enterprise/security/roles-and-permissions.md). + permissions](/manuals/security/roles-and-permissions.md). > [!NOTE] > diff --git a/content/manuals/docker-hub/repos/manage/access.md b/content/manuals/docker-hub/repos/manage/access.md index c88d3492cfb3..aa9732a65e20 100644 --- a/content/manuals/docker-hub/repos/manage/access.md +++ b/content/manuals/docker-hub/repos/manage/access.md @@ -94,7 +94,7 @@ repository from that repository's **Settings** page. Organizations can use roles for individuals, giving them different permissions in the organization. For more details, see [Roles and -permissions](/manuals/enterprise/security/roles-and-permissions.md). +permissions](/manuals/security/roles-and-permissions.md). ## Organization teams @@ -105,7 +105,7 @@ access. You must create a team before you are able to configure repository permissions. For more details, see [Create and manage a -team](/manuals/admin/organization/manage/manage-a-team.md). +team](/manuals/accounts/organization/manage/manage-a-team.md). To configure team repository permissions: @@ -131,7 +131,7 @@ To configure team repository permissions: Organizations can use OATs. OATs let you assign fine-grained repository access permissions to tokens. For more details, see [Organization access -tokens](/manuals/enterprise/security/access-tokens.md). +tokens](/manuals/security/access-tokens/organization-access-tokens.md). ## Gated distribution @@ -156,7 +156,7 @@ If you are interested in Gated Distribution contact the }} +{{< grid >}} diff --git a/content/manuals/enterprise/security/enforce-sign-in/_index.md b/content/manuals/enterprise/security/enforce-sign-in/_index.md index f33359f3c732..2e7f373d9739 100644 --- a/content/manuals/enterprise/security/enforce-sign-in/_index.md +++ b/content/manuals/enterprise/security/enforce-sign-in/_index.md @@ -55,8 +55,7 @@ On the next Docker Desktop restart: ## Enforcing sign-in versus enforcing single sign-on (SSO) -Enforcing Docker Desktop sign-in and [enforcing SSO](/manuals/enterprise/security/single-sign-on/connect.md#enforce-sso) are different features that serve different purposes: - +Enforcing Docker Desktop sign-in and [enforcing SSO](/manuals/security/authentication/single-sign-on/connect.md#enforce-sso) are different features that serve different purposes: | Enforcement | Description | Benefits | |:----------------------------------|:----------------------------------------------------------------|:-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| @@ -68,4 +67,4 @@ Enforcing Docker Desktop sign-in and [enforcing SSO](/manuals/enterprise/securit ## Next steps - To set up sign-in enforcement, see [Configure sign-in enforcement](/manuals/enterprise/security/enforce-sign-in/methods.md). -- To configure SSO enforcement, see [Enforce SSO](/manuals/enterprise/security/single-sign-on/connect.md). +- To configure SSO enforcement, see [Enforce SSO](/manuals/security/authentication/single-sign-on/connect.md). diff --git a/content/manuals/enterprise/security/hardened-desktop/_index.md b/content/manuals/enterprise/security/hardened-desktop/_index.md index 6fb7a7ae9749..972660a77fdf 100644 --- a/content/manuals/enterprise/security/hardened-desktop/_index.md +++ b/content/manuals/enterprise/security/hardened-desktop/_index.md @@ -5,7 +5,7 @@ description: Security features that help organizations secure developer environm keywords: security, hardened desktop, enhanced container isolation, registry access management, settings management, admins, docker desktop, image access management, air-gapped containers tags: [admin] aliases: - - /security/for-admins/hardened-desktop/ + - /security/for-admins/hardened-desktop/ grid: - title: "Settings Management" description: Learn how Settings Management can secure your developers' workflows. @@ -31,7 +31,6 @@ grid: description: Control whether organization members can push content to their personal namespaces. icon: folder-open link: /enterprise/security/hardened-desktop/namespace-access/ -weight: 60 --- {{< summary-bar feature_name="Hardened Docker Desktop" >}} diff --git a/content/manuals/enterprise/security/hardened-desktop/air-gapped-containers.md b/content/manuals/enterprise/security/hardened-desktop/air-gapped-containers.md index 36eb900d1e10..4170bf8bbcf5 100644 --- a/content/manuals/enterprise/security/hardened-desktop/air-gapped-containers.md +++ b/content/manuals/enterprise/security/hardened-desktop/air-gapped-containers.md @@ -140,10 +140,11 @@ function FindProxyForURL(url, host) { ### General considerations - `FindProxyForURL` function URL parameter format is `http://host_or_ip:port` or `https://host_or_ip:port` - - If you have an internal container trying to access `https://docs.docker.com/enterprise/security/hardened-desktop/air-gapped-containers` the Docker proxy service will submit docs.docker.com for the host value and https://docs.docker.com:443 for the url value to `FindProxyForURL`, if you are using `shExpMatch` function in your PAC file as follows: + - If you have an internal container trying to access `https://docs.docker.com/enterprise/security/hardened-desktop/air-gapped-containers` the Docker proxy service will submit docs.docker.com for the host value and https://docs.docker.com:443 for the URL value to `FindProxyForURL`, if you are using `shExpMatch` function in your PAC file as follows: + ```console - if(shExpMatch(url, "https://docs.docker.com:443/enterprise/security/*")) return "DIRECT"; + if(shExpMatch(url, "https://docs.docker.com:443/enterprise/security/hardened-desktop/*")) return "DIRECT"; ``` `shExpMatch` function will fail, instead use: @@ -151,6 +152,7 @@ function FindProxyForURL(url, host) { ```console if (host == docs.docker.com && url.indexOf(":443") > 0) return "DIRECT"; ``` + ### PAC file return values diff --git a/content/manuals/enterprise/security/hardened-desktop/image-access-management.md b/content/manuals/enterprise/security/hardened-desktop/image-access-management.md index e77af278b2a3..fa532cb335e4 100644 --- a/content/manuals/enterprise/security/hardened-desktop/image-access-management.md +++ b/content/manuals/enterprise/security/hardened-desktop/image-access-management.md @@ -45,7 +45,7 @@ Use the repository allowlist when you need to: Before configuring Image Access Management, you must: - [Enforce sign-in](/manuals/enterprise/security/enforce-sign-in/_index.md). Image Access Management only takes effect when users are signed in to Docker Desktop with organization credentials. -- Use [personal access tokens (PATs)](/manuals/security/access-tokens.md) for authentication (Organization access tokens aren't supported) +- Use [personal access tokens (PATs)](/manuals/security/access-tokens/personal-access-tokens.md) for authentication (Organization access tokens aren't supported) - Have a Docker Business subscription ## Configure image access diff --git a/content/manuals/enterprise/security/hardened-desktop/registry-access-management.md b/content/manuals/enterprise/security/hardened-desktop/registry-access-management.md index c4bd8e2dd60e..34be43580036 100644 --- a/content/manuals/enterprise/security/hardened-desktop/registry-access-management.md +++ b/content/manuals/enterprise/security/hardened-desktop/registry-access-management.md @@ -45,7 +45,7 @@ Before configuring Registry Access Management, you must: Registry Access Management only takes effect when users are signed in to Docker Desktop with organization credentials. - Use - [Organization access tokens (OATs)](/manuals/enterprise/security/access-tokens.md) + [Organization access tokens (OATs)](/manuals/security/access-tokens/organization-access-tokens.md) for authentication - Have a Docker Business subscription diff --git a/content/manuals/enterprise/security/hardened-desktop/settings-management/_index.md b/content/manuals/enterprise/security/hardened-desktop/settings-management/_index.md index 86915d861306..63b09e8615ea 100644 --- a/content/manuals/enterprise/security/hardened-desktop/settings-management/_index.md +++ b/content/manuals/enterprise/security/hardened-desktop/settings-management/_index.md @@ -60,7 +60,7 @@ When multiple policies exist, Docker Desktop applies them in this order: You can create settings management policies at any time, but your organization needs to verify a domain before the policies take effect. -1. Check that you have [added and verified](/manuals/enterprise/security/domain-management.md#add-and-verify-a-domain) your organization's domain. +1. Check that you have [added and verified](/manuals/security/provisioning/domain-management.md#add-and-verify-a-domain) your organization's domain. 2. [Enforce sign-in](/manuals/enterprise/security/enforce-sign-in/_index.md) to ensure all developers authenticate with your organization. 3. Choose a configuration method: diff --git a/content/manuals/enterprise/security/hardened-desktop/settings-management/compliance-reporting.md b/content/manuals/enterprise/security/hardened-desktop/settings-management/compliance-reporting.md index 95bba780115c..742bc0e17c3d 100644 --- a/content/manuals/enterprise/security/hardened-desktop/settings-management/compliance-reporting.md +++ b/content/manuals/enterprise/security/hardened-desktop/settings-management/compliance-reporting.md @@ -17,7 +17,7 @@ Desktop settings reporting tracks user compliance with Docker Desktop settings p Before you can use Docker Desktop settings reporting, make sure you have: - [Docker Desktop](/manuals/desktop/release-notes.md) installed across your organization -- [A verified domain](/manuals/enterprise/security/single-sign-on/connect.md) +- [A verified domain](/manuals/security/authentication/single-sign-on/connect.md) - [Enforced sign-in](/manuals/enterprise/security/enforce-sign-in/_index.md) for your organization - A Docker Business subscription - At least one settings policy configured diff --git a/content/manuals/enterprise/security/hardened-desktop/settings-management/configure-admin-console.md b/content/manuals/enterprise/security/hardened-desktop/settings-management/configure-admin-console.md index e787818cd0ab..2406727df7bc 100644 --- a/content/manuals/enterprise/security/hardened-desktop/settings-management/configure-admin-console.md +++ b/content/manuals/enterprise/security/hardened-desktop/settings-management/configure-admin-console.md @@ -17,7 +17,7 @@ Use Docker Home to create and manage settings policies for Docker Desktop across Before you begin, make sure you have: - [Docker Desktop](/manuals/desktop/release-notes.md) installed -- [A verified domain](/enterprise/security/single-sign-on/connect/#step-1-add-a-domain) +- [A verified domain](/security/authentication/single-sign-on/connect/#step-1-add-a-domain) - [Enforced sign-in](/manuals/enterprise/security/enforce-sign-in/_index.md) for your organization - A Docker Business subscription diff --git a/content/manuals/enterprise/security/single-sign-on/FAQs/_index.md b/content/manuals/enterprise/security/single-sign-on/FAQs/_index.md deleted file mode 100644 index 224304008d4e..000000000000 --- a/content/manuals/enterprise/security/single-sign-on/FAQs/_index.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -build: - render: never -title: FAQs -weight: 50 ---- \ No newline at end of file diff --git a/content/manuals/enterprise/security/single-sign-on/FAQs/domain-faqs.md b/content/manuals/enterprise/security/single-sign-on/FAQs/domain-faqs.md deleted file mode 100644 index ace6b06cad66..000000000000 --- a/content/manuals/enterprise/security/single-sign-on/FAQs/domain-faqs.md +++ /dev/null @@ -1,23 +0,0 @@ ---- -title: SSO domain FAQs -linkTitle: Domains -description: Frequently asked questions about domain verification and management for Docker single sign-on -keywords: SSO domains, domain verification, DNS, TXT records, single sign-on -tags: [FAQ] -aliases: -- /single-sign-on/domain-faqs/ -- /faq/security/single-sign-on/domain-faqs/ -- /security/faqs/single-sign-on/domain-faqs/ ---- - -## Can I add sub-domains? - -Yes, you can add sub-domains to your SSO connection. All email addresses must use domains you've added to the connection. Verify that your DNS provider supports multiple TXT records for the same domain. - -## Do I need to keep the DNS TXT record permanently? - -You can remove the TXT record after one-time verification to add the domain. However, if your organization changes identity providers and needs to set up SSO again, you'll need to verify the domain again. - -## Can I verify the same domain for multiple organizations? - -You can't verify the same domain for multiple organizations at the organization level. To verify one domain for multiple organizations, you must have a Docker Business subscription and create a company. Companies allow centralized management of organizations and domain verification at the company level. diff --git a/content/manuals/enterprise/security/single-sign-on/FAQs/enforcement-faqs.md b/content/manuals/enterprise/security/single-sign-on/FAQs/enforcement-faqs.md deleted file mode 100644 index 39e87fbb471c..000000000000 --- a/content/manuals/enterprise/security/single-sign-on/FAQs/enforcement-faqs.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: SSO enforcement FAQs -linkTitle: Enforcement -description: Frequently asked questions about Docker single sign-on enforcement and its effects on users -keywords: SSO enforcement, single sign-on, personal access tokens, CLI authentication, guest users -tags: [FAQ] -aliases: - - /single-sign-on/enforcement-faqs/ - - /faq/security/single-sign-on/enforcement-faqs/ - - /security/faqs/single-sign-on/enforcement-faqs/ ---- - -## Does Docker SSO support authenticating through the command line? - -When SSO is enforced, [passwords are prevented from accessing the Docker CLI](/manuals/security/security-announcements.md#deprecation-of-password-logins-on-cli-when-sso-enforced). You must use a personal access token (PAT) for CLI authentication instead. - -Each user must create a PAT to access the CLI. To learn how to create a PAT, see [Manage personal access tokens](/manuals/security/access-tokens.md). Users who already used a PAT before SSO enforcement can continue using that PAT. - -## How does SSO affect automation systems and CI/CD pipelines? - -Before enforcing SSO, you must [create personal access tokens](/manuals/security/access-tokens.md) to replace passwords in automation systems and CI/CD pipelines. - -## Can I turn on SSO without enforcing it immediately? - -Yes, you can turn on SSO without enforcement. Users can choose between Docker ID (standard email and password) or domain-verified email address (SSO) at the sign-in screen. - -## SSO is enforced, but a user can sign in using a username and password. Why is this happening? - -Guest users who aren't part of your registered domain but have been invited to your organization don't sign in through your SSO identity provider. SSO enforcement only applies to users who belong to your verified domain. - -## Can I test SSO functionality before going to production? - -Yes, you can create a test organization with a 5-seat Business subscription. When testing, turn on SSO but don't enforce it, or all domain email users will be forced to sign in to the test environment. - -## What is enforcing SSO versus enforcing sign-in? - -These are separate features you can use independently or together: - -- Enforcing SSO ensures users sign in using SSO credentials instead of their Docker ID, enabling better credential management. -- Enforcing sign-in to Docker Desktop ensures users always sign in to accounts that are members of your organization, so security settings and subscription benefits are always applied. - -For more details, see [Enforce sign-in for Desktop](/manuals/enterprise/security/enforce-sign-in/_index.md#enforcing-sign-in-versus-enforcing-single-sign-on-sso). diff --git a/content/manuals/enterprise/security/single-sign-on/FAQs/general.md b/content/manuals/enterprise/security/single-sign-on/FAQs/general.md deleted file mode 100644 index ce25481d4df8..000000000000 --- a/content/manuals/enterprise/security/single-sign-on/FAQs/general.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -description: Frequently asked questions about Docker single sign-on -keywords: Docker, Docker Hub, SSO FAQs, single sign-on, administration, security -title: General SSO FAQs -linkTitle: General -weight: 20 -tags: [FAQ] -aliases: -- /single-sign-on/faqs/ -- /faq/security/single-sign-on/faqs/ -- /single-sign-on/saml-faqs/ -- /faq/security/single-sign-on/saml-faqs/ -- /security/faqs/single-sign-on/saml-faqs/ -- /security/faqs/single-sign-on/faqs/ ---- - -## What SSO flows does Docker support? - -Docker supports Service Provider Initiated (SP-initiated) SSO flow. Users must sign in to Docker Hub or Docker Desktop to initiate the SSO authentication process. - -## Does Docker SSO support multi-factor authentication? - -When an organization uses SSO, multi-factor authentication is controlled at the identity provider level, not on the Docker platform. - -## Can I retain my Docker ID when using SSO? - -Users with personal Docker IDs retain ownership of their repositories, images, and assets. When SSO is enforced, existing accounts with company domain emails are connected to the organization. Users signing in without existing accounts automatically have new accounts and Docker IDs created. - -## Are there any firewall rules required for SSO configuration? - -No specific firewall rules are required as long as `login.docker.com` is accessible. This domain is commonly accessible by default, but some organizations may need to allow it in their firewall settings if SSO setup encounters issues. - -## Does Docker use my IdP's default session timeout? - -Yes, Docker supports your IdP's session timeout using a custom `dockerSessionMinutes` SAML attribute instead of the standard `SessionNotOnOrAfter` element. See [SSO attributes](/manuals/enterprise/security/provisioning/_index.md#sso-attributes) for more information. diff --git a/content/manuals/enterprise/security/single-sign-on/FAQs/idp-faqs.md b/content/manuals/enterprise/security/single-sign-on/FAQs/idp-faqs.md deleted file mode 100644 index 9559a972da18..000000000000 --- a/content/manuals/enterprise/security/single-sign-on/FAQs/idp-faqs.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: SSO identity provider FAQs -linkTitle: Identity providers -description: Frequently asked questions about Docker SSO and identity provider configuration -keywords: identity providers, SSO IdP, SAML, Azure AD, Entra ID, certificate management -tags: [FAQ] -aliases: - - /single-sign-on/idp-faqs/ - - /faq/security/single-sign-on/idp-faqs/ - - /security/faqs/single-sign-on/idp-faqs/ ---- - -## Can I use multiple identity providers with Docker SSO? - -Yes, Docker supports multiple IdP configurations. A domain can be associated with multiple IdPs. Docker supports Entra ID (formerly Azure AD) and identity providers that support SAML 2.0. - -## Can I change my identity provider after configuring SSO? - -Yes. Delete your existing IdP configuration in your Docker SSO connection, then [configure SSO using your new IdP](/manuals/enterprise/security/single-sign-on/connect.md). If you had already turned on enforcement, turn off enforcement before updating the provider connection. - -## What information do I need from my identity provider to configure SSO? - -To turn on SSO in Docker, you need the following from your IdP: - -- SAML: Entity ID, ACS URL, Single Logout URL, and the public X.509 certificate -- Entra ID (formerly Azure AD): Client ID, Client Secret, AD Domain - -## What happens if my existing certificate expires? - -Contact your identity provider to retrieve a new X.509 certificate. Update with the new certificate in [SSO configuration settings](/manuals/enterprise/security/single-sign-on/manage.md#manage-sso-connections) from Docker Home. - -- If your organization enforces SSO, username and password credentials won't work. -- If your organization doesn't enforce SSO, users can sign in with their username and password credentials. - -If you need additional help, contact [Docker support](https://app.docker.com/support/contact). - -## What happens if my IdP goes down when SSO is turned on? - -If SSO is enforced, users can't access Docker Hub when your IdP is down. Users can still access Docker Hub images from the CLI using personal access tokens. - -If SSO is turned on but not enforced, users can fall back to username/password authentication. - -## Do bot accounts need seats to access organizations using SSO? - -Yes, bot accounts need seats like regular users, requiring a non-aliased domain email in the IdP and using a seat in Docker Hub. You can add bot accounts to your IdP and create access tokens to replace other credentials. - -## Does SAML SSO use Just-in-Time provisioning? - -The SSO implementation uses Just-in-Time (JIT) provisioning by default. You can optionally turn off JIT in Docker Home if you turn on auto-provisioning using SCIM. See [Just-in-Time provisioning](/manuals/enterprise/security/provisioning/just-in-time.md). - -## My Entra ID SSO connection isn't working and shows an error. How can I troubleshoot this? - -Confirm that you've configured the necessary API permissions in Entra ID for your SSO connection. You need to grant administrator consent within your Entra ID tenant. See [Entra ID (formerly Azure AD) documentation](https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/grant-admin-consent?pivots=portal#grant-admin-consent-in-app-registrations). diff --git a/content/manuals/enterprise/security/single-sign-on/FAQs/users-faqs.md b/content/manuals/enterprise/security/single-sign-on/FAQs/users-faqs.md deleted file mode 100644 index a89bbe4ca5f8..000000000000 --- a/content/manuals/enterprise/security/single-sign-on/FAQs/users-faqs.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: SSO user management FAQs -linkTitle: User management -description: Frequently asked questions about managing users with Docker single sign-ons -keywords: SSO user management, user provisioning, SCIM, just-in-time provisioning, organization members -tags: [FAQ] -aliases: - - /single-sign-on/users-faqs/ - - /faq/security/single-sign-on/users-faqs/ - - /security/faqs/single-sign-on/users-faqs/ ---- - -## Do I need to manually add users to my organization? - -No, you don't need to manually add users to your organization. Just ensure user accounts exist in your IdP. When users sign in to Docker with their domain email address, they're automatically added to the organization after successful authentication. - -## Can users use different email addresses to authenticate through SSO? - -All users must authenticate using the email domain specified during SSO setup. Users with email addresses that don't match the verified domain can sign in as guests with username and password if SSO isn't enforced, but only if they've been invited. - -## How will users know they're being added to a Docker organization? - -When SSO is turned on, users are prompted to authenticate through SSO the next time they sign in to Docker Hub or Docker Desktop. The system detects their domain email and prompts them to sign in with SSO credentials instead. - -For CLI access, users must authenticate using personal access tokens. - -## Can I convert existing users from non-SSO to SSO accounts? - -Yes, you can convert existing users to SSO accounts. Ensure users have: - -- Company domain email addresses and accounts in your IdP -- Docker Desktop version 4.4.2 or later -- Personal access tokens created to replace passwords for CLI access -- CI/CD pipelines updated to use PATs instead of passwords - -For detailed instructions, see [Configure single sign-on](/manuals/enterprise/security/single-sign-on/connect.md). - -## Is Docker SSO fully synced with the IdP? - -Docker SSO provides Just-in-Time (JIT) provisioning by default. Users are provisioned when they authenticate with SSO. If users leave the organization, administrators must manually [remove the user](/manuals/admin/organization/manage/members.md#remove-members-from-teams) from the organization. - -[SCIM](/manuals/enterprise/security/provisioning/scim/_index.md) provides full synchronization with users and groups. When using SCIM, the recommended configuration is to turn off JIT so all auto-provisioning is handled by SCIM. - -Additionally, you can use the [Docker Hub API](/reference/api/hub/latest.md) to complete this process. - -## How does turning off Just-in-Time provisioning affect user sign-in? - -When JIT is turned off (available with SCIM in Docker Home), users must be organization members or have pending invitations to access Docker. Users who don't meet these criteria get an "Access denied" error and need administrator invitations. - -See [SSO authentication with JIT provisioning disabled](/manuals/enterprise/security/provisioning/just-in-time.md#sso-authentication-with-jit-provisioning-disabled). - -## Can someone join an organization without an invitation? - -Not without SSO. Joining requires an invite from an organization owner. When SSO is enforced, users with verified domain emails can automatically join the organization when they sign in. - -## What happens to existing licensed users when SCIM is turned on? - -Turning on SCIM doesn't immediately remove or modify existing licensed users. They retain current access and roles, but you'll manage them through your IdP after SCIM is active. If SCIM is later turned off, previously SCIM-managed users remain in Docker but are no longer automatically updated based on your IdP. - -## Is user information visible in Docker Hub? - -All Docker accounts have public profiles associated with their namespace. If you don't want user information (like full names) to be visible, remove those attributes from your SSO and SCIM mappings, or use different identifiers to replace users' full names. diff --git a/content/manuals/extensions/settings-feedback.md b/content/manuals/extensions/settings-feedback.md index c585fd009eaf..0b6e5e3ceb96 100644 --- a/content/manuals/extensions/settings-feedback.md +++ b/content/manuals/extensions/settings-feedback.md @@ -19,7 +19,7 @@ Docker Extensions is switched off by default. To change your settings: > [!NOTE] > -> If you are an [organization owner](/manuals/admin/organization/manage/manage-a-team.md#what-is-an-organization-owner), you can turn off extensions for your users. Open the `settings-store.json` file, and set `"extensionsEnabled"` to `false`. +> If you are an [organization owner](/manuals/accounts/organization/manage/manage-a-team.md#what-is-an-organization-owner), you can turn off extensions for your users. Open the `settings-store.json` file, and set `"extensionsEnabled"` to `false`. > The `settings-store.json` file is located at: > - `~/Library/Group Containers/group.com.docker/settings-store.json` on Mac > - `C:\Users\[USERNAME]\AppData\Roaming\Docker\settings-store.json` on Windows diff --git a/content/manuals/faqs/_index.md b/content/manuals/faqs/_index.md new file mode 100644 index 000000000000..79617019d3a5 --- /dev/null +++ b/content/manuals/faqs/_index.md @@ -0,0 +1,37 @@ +--- +title: FAQs +linkTitle: FAQs +description: Frequently asked questions about Docker accounts, subscriptions, billing, and security. +keywords: FAQ, FAQs, accounts, Docker ID, Docker Home, subscription FAQs, billing FAQs, security FAQs, SSO FAQs +weight: 45 +params: + sidebar: + group: Accounts and admin +aliases: + - /platform/security/faqs/ + - /faq/security/ +grid: + - title: Account FAQs + description: FAQs about Docker IDs, account creation, organizations, and companies. + icon: question-mark-circle + link: /faqs/accounts/ + - title: Security FAQs + description: FAQs about single sign-on, identity providers, enforcement, and domains. + icon: lock-closed + link: /faqs/security/ + - title: Subscription and billing FAQs + description: FAQs about Docker plans, payments, taxes, and invoices. + icon: credit-card + link: /faqs/subscription-billing/ + - title: Platform FAQs + description: FAQs about Docker Desktop containers, networking, VMs, and general platform security. + icon: cpu-chip + link: /faqs/platform/ +--- + +Answers to common questions about Docker accounts, organizations, companies, +subscriptions, billing, and security. + +## Next steps + +{{< grid >}} diff --git a/content/manuals/faqs/accounts.md b/content/manuals/faqs/accounts.md new file mode 100644 index 000000000000..c6147b53b617 --- /dev/null +++ b/content/manuals/faqs/accounts.md @@ -0,0 +1,175 @@ +--- +title: Account FAQs +linkTitle: Accounts +weight: 10 +description: FAQs about Docker IDs, account creation, organizations, companies, seats, and members +keywords: + docker ID, docker account FAQ, change docker ID, username taken, trademark, + organization name, organization namespace, create account, Google, GitHub, + deactivate docker ID, organizations, members, seats, company, company owners +tags: [FAQ] +toc_max: 2 +aliases: + - /accounts/general-faqs/ + - /accounts/individual/general-faqs/ + - /docker-hub/general-faqs/ + - /docker-hub/onboarding-faqs/ + - /faq/admin/general-faqs/ + - /admin/faqs/general-faqs/ + - /admin/organization/organization-faqs/ + - /docker-hub/organization-faqs/ + - /faq/admin/organization-faqs/ + - /admin/faqs/organization-faqs/ + - /accounts/organization/organization-faqs/ + - /admin/company/company-faqs/ + - /docker-hub/company-faqs/ + - /faq/admin/company-faqs/ + - /admin/faqs/company-faqs/ + - /accounts/organization/company/company-faqs/ + - /faqs/general-faqs/ + - /faqs/organization-faqs/ + - /faqs/company-faqs/ +--- + +## Individual accounts + +### What is a Docker ID? + +A Docker ID is a username for your Docker account that lets you access Docker +products. To create a Docker ID you need one of the following: + +- An email address +- A Google account +- A GitHub account + +Your Docker ID must be between 4 and 30 characters long, and can only contain +numbers and lowercase letters. You can't use any special characters or spaces. + +For more information, see +[Create a Docker account](/manuals/accounts/individual/create-account.md). + +### Can I change my Docker ID? + +No. You can't change your Docker ID once it's created. If you need a different +Docker ID, you must create a new Docker account with a new Docker ID. + +Docker IDs can't be reused after deactivation. + +### What if my Docker ID is taken? + +All Docker IDs are first-come, first-served except for companies that have a +U.S. Trademark on a username. + +If you have a trademark for your Docker ID, +[Docker Support](https://hub.docker.com/support/contact/) can retrieve the +Docker ID for you. + +## Organizations + +### What's an organization name or namespace? + +The organization name, sometimes referred to as the organization namespace or +the organization ID, is the unique identifier of a Docker organization. The +organization name can't be the same as an existing Docker ID. + +For more information, see +[Organization accounts](/manuals/accounts/organization/_index.md). + +### How can I see how many active users are in my organization? + +If your organization uses a Software Asset Management tool, you can use it to +find out how many users have Docker Desktop installed. If your organization +doesn't use this software, you can run an internal survey +to find out who is using Docker Desktop. + +For more information, see [Identify your Docker users and their Docker accounts](/manuals/accounts/organization/setup/onboard.md#step-one-identify-your-docker-users). + +### Do users need to authenticate with Docker before an owner can add them to an organization? + +No. Organization owners can invite users with their email addresses, and also +assign them to a team during the invite process. + +### Can I force my organization's members to authenticate before using Docker Desktop and are there any benefits? + +Yes. You can +[enforce sign-in](/manuals/enterprise/security/enforce-sign-in/_index.md). + +Some benefits of enforcing sign-in are: + +- Ensures users receive the benefits of your subscription. +- Ensures security features like [Image Access Management](/manuals/enterprise/security/hardened-desktop/image-access-management.md) and [Registry Access Management](/manuals/enterprise/security/hardened-desktop/registry-access-management.md) are applied. +- Ensures you gain insights into users' activity. + +### Can I convert my personal Docker ID to an organization account? + +Yes. You can convert your user account to an organization account. Once you +convert a user account into an organization, it's not possible to +revert it to a personal user account. + +For prerequisites and instructions, see +[Convert an account into an organization](/manuals/accounts/organization/setup/convert-account.md). + +### Do organization invitees take up seats? + +Yes. A user invited to an organization will take up one of the provisioned +seats, even if that user hasn’t accepted their invitation yet. + +To manage invites, see [Manage organization members](/manuals/accounts/organization/manage/members.md). + +### Do organization owners take a seat? + +Yes. Organization owners occupy a seat. + +### What is the difference between user, invitee, seat, and member? + +- User: Docker user with a Docker ID. +- Invitee: A user that an administrator has invited to join an organization but + has not yet accepted their invitation. +- Seats: The number of purchased seats in an organization. +- Member: A user who has received and accepted an invitation to join an + organization. Member can also refer to a member of a team within an + organization. + +### If I have two organizations and a user belongs to both organizations, do they take up two seats? + +Yes. In a scenario where a user belongs to two organizations, they take up one +seat in each organization. + +### Companies + +#### Can I use a parent company if some of my organizations don’t have a Docker Business subscription? + +Yes, but you can only add organizations with a Docker Business subscription +to a company. For more details, see [Add more organizations](/manuals/accounts/company/manage.md#add-more-organizations). + +#### What happens if one of my organizations downgrades from Docker Business, but I still need access as a company owner? + +To access and manage a nested organization, it must have a Docker Business +subscription. If an organization downgrades from Docker Business, its owner must +manage it outside of the company. For more details, see +[Add more organizations](/manuals/accounts/company/manage.md#add-more-organizations). + +#### Do company owners occupy a subscription seat? + +Company owners don't occupy a seat unless one of the following is true: + +- They are added as a member of an organization under your company +- SSO is enabled and the company owner signs in through SSO, which + automatically adds them as an organization member + +When you first create a company, your account is both a company owner and an +organization owner, so it occupies a seat as long as you remain an organization +owner. To free up that seat, +[assign another user as the organization owner](/manuals/accounts/organization/manage/members.md#update-a-member-role) +and remove yourself from the organization. You keep full administrative access +as a company owner without using a subscription seat. + +#### What permissions does the company owner have in the associated/nested organizations? + +Company owners can navigate to the **Organizations** page to view all their +nested organizations in a single location. They can also view or edit +organization members and change single sign-on (SSO) and System for +Cross-domain Identity Management (SCIM) settings. Changes to company settings +impact all users in each organization under the company. + +For more information, see [Roles and permissions](/manuals/security/roles-and-permissions.md). diff --git a/content/manuals/faqs/platform.md b/content/manuals/faqs/platform.md new file mode 100644 index 000000000000..cd4e6383099d --- /dev/null +++ b/content/manuals/faqs/platform.md @@ -0,0 +1,126 @@ +--- +title: Platform FAQs +linkTitle: Platform +description: Frequently asked questions about Docker platform security, containers, networking, and VMs. +keywords: Docker security, FAQs, authentication, vulnerability reporting, session management, container security, docker desktop isolation, enhanced container isolation, file sharing, docker desktop networking, virtualization, hyper-v, wsl2, network security, firewall +weight: 40 +tags: [FAQ] +toc_max: 2 +aliases: + - /faq/security/general/ + - /security/faqs/general/ + - /faq/security/containers/ + - /security/faqs/containers/ + - /faq/security/networking-and-vms/ + - /security/faqs/networking-and-vms/ +--- + +## General + +### How do I report a vulnerability? + +If you've discovered a security vulnerability in Docker, report it responsibly to security@docker.com so Docker can quickly address it. + +### Does Docker lockout users after failed sign-ins? + +Docker Hub locks out users after 10 failed sign-in attempts within 5 minutes. The lockout duration is 5 minutes. This policy applies to Docker Hub, Docker Desktop, and Docker Scout authentication. + +### Do you support physical multi-factor authentication (MFA) with YubiKeys? + +You can configure physical multi-factor authentication (MFA) through SSO using your identity provider (IdP). Check with your IdP if they support physical MFA devices like YubiKeys. + +### How are sessions managed and do they expire? + +Docker uses tokens to manage user sessions with different expiration periods: + +- Docker Desktop: Signs you out after 90 days, or 30 days of inactivity +- Docker Hub and Docker Home: Sign you out after 24 hours + +Docker also supports your IdP's default session timeout through SAML attributes. For more information, see [SSO attributes](/manuals/security/provisioning/_index.md#sso-attributes). + +### How does Docker distinguish between employee users and contractor users? + +Organizations use verified domains to distinguish user types. Team members with email domains other than verified domains appear as "Guest" users in the organization. + +### How long are activity logs available? + +Docker activity logs are available for 90 days. You're responsible for exporting logs or setting up drivers to send logs to your internal systems for longer retention. + +### Can I export a list of users with their roles and privileges? + +Yes, use the [Export Members](/manuals/accounts/organization/manage/members.md#export-members-csv-file) feature to export a CSV file containing your organization's users with role and team information. + +### How do I remove users who aren't part of my IdP when using SSO without SCIM? + +If SCIM isn't turned on, you must manually remove users from the organization. SCIM can automate user removal, but only for users added after SCIM is turned on. Users added before SCIM was turned on must be removed manually. + +For more information, see [Manage organization members](/manuals/accounts/organization/manage/members.md). + +### What metadata does Scout collect from container images? + +For information about metadata stored by Docker Scout, see [Data handling](/manuals/scout/deep-dive/data-handling.md). + +### How are Marketplace extensions vetted for security? + +Security vetting for extensions isn't implemented. Extensions aren't covered as part of Docker's Third-Party Risk Management Program. + +### Can I prevent users from pushing images to Docker Hub private repositories? + +No direct setting exists to disable private repositories. However, [Registry Access Management](/manuals/enterprise/security/hardened-desktop/registry-access-management.md) lets administrators control which registries developers can access through Docker Desktop via Docker Home. + +## Docker Desktop + +### How does Docker Desktop handle authentication information? + +Docker Desktop uses the host operating system's secure key management to store authentication tokens: + +- macOS: [Keychain](https://support.apple.com/guide/security/keychain-data-protection-secb0694df1a/web) +- Windows: [Security and Identity API via Wincred](https://learn.microsoft.com/en-us/windows/win32/api/wincred/) +- Linux: [Pass](https://www.passwordstore.org/). + +### Containers + +#### How are containers isolated from the host in Docker Desktop? + +Docker Desktop runs all containers inside a customized Linux virtual machine (except for native Windows containers). This adds strong isolation between containers and the host machine, even when containers run as root. + +Important considerations include: + +- Containers have access to host files configured for file sharing via Docker Desktop settings +- Containers run as root with limited capabilities inside the Docker Desktop VM by default +- Privileged containers (`--privileged`, `--pid=host`, `--cap-add`) run with elevated privileges inside the VM, giving them access to VM internals and Docker Engine + +With Enhanced Container Isolation turned on, each container runs in a dedicated Linux user namespace inside the Docker Desktop VM. Even privileged containers only have privileges within their container boundary, not the VM. ECI uses advanced techniques to prevent containers from breaching the Docker Desktop VM and Docker Engine. + +#### Which portions of the host filesystem can containers access? + +Containers can only access host files that are: + +1. Shared using Docker Desktop settings +1. Explicitly bind-mounted into the container (e.g., `docker run -v /path/to/host/file:/mnt`) + +#### Can containers running as root access admin-owned files on the host? + +No. Host file sharing uses a user-space file server (running in `com.docker.backend` as the Docker Desktop user), so containers can only access files that the Docker Desktop user already has permission to access. + +### Networking and VMs + +#### How can I limit container internet access? + +Docker Desktop doesn't have a built-in mechanism for this, but you can use process-level firewalls on the host. Apply rules to the `com.docker.vpnkit` user-space process to control where it can connect (DNS allowlists, packet filters) and which ports/protocols it can use. + +For enterprise environments, consider [Air-gapped containers](/manuals/enterprise/security/hardened-desktop/air-gapped-containers.md) which provide network access controls for containers. + +#### Can I apply firewall rules to container network traffic? + +Yes. Docker Desktop uses a user-space process (`com.docker.vpnkit`) for network connectivity, which inherits constraints like firewall rules, VPN settings, and HTTP proxy properties from the user that launched it. + +#### Does Docker Desktop for Windows with Hyper-V allow users to create other VMs? + +No. The `DockerDesktopVM` name is hard-coded in the service, so you cannot use Docker Desktop to create or manipulate other virtual machines. + +#### How does Docker Desktop achieve network isolation with Hyper-V and WSL 2? + +Docker Desktop uses the same VM processes for both WSL 2 (in the `docker-desktop` distribution) and Hyper-V (in `DockerDesktopVM`). Host/VM communication uses `AF_VSOCK` hypervisor sockets (shared memory) rather than network switches or interfaces. All host networking is performed using standard TCP/IP sockets from the `com.docker.vpnkit.exe` and `com.docker.backend.exe` processes. + +For more information, see [How Docker Desktop networking works under the hood](https://www.docker.com/blog/how-docker-desktop-networking-works-under-the-hood/). diff --git a/content/manuals/faqs/security.md b/content/manuals/faqs/security.md new file mode 100644 index 000000000000..d4a079dba41c --- /dev/null +++ b/content/manuals/faqs/security.md @@ -0,0 +1,201 @@ +--- +description: Frequently asked questions about Docker single sign-on, identity providers, user management, SSO enforcement, and domain verification +keywords: Docker, Docker Hub, SSO FAQs, single sign-on, identity providers, IdP, SAML, Entra ID, user management, SCIM, JIT, administration, security, SSO enforcement, SSO domains, domain verification, DNS, TXT records +title: Security FAQs +linkTitle: Security +weight: 20 +tags: [FAQ] +toc_max: 2 +aliases: + - /single-sign-on/faqs/ + - /faq/security/single-sign-on/faqs/ + - /single-sign-on/saml-faqs/ + - /faq/security/single-sign-on/saml-faqs/ + - /security/faqs/single-sign-on/saml-faqs/ + - /security/faqs/single-sign-on/faqs/ + - /platform/security/authentication/single-sign-on/FAQs/general/ + - /single-sign-on/idp-faqs/ + - /faq/security/single-sign-on/idp-faqs/ + - /security/faqs/single-sign-on/idp-faqs/ + - /platform/security/authentication/single-sign-on/FAQs/idp-faqs/ + - /platform/security/faqs/idp-faqs/ + - /single-sign-on/users-faqs/ + - /faq/security/single-sign-on/users-faqs/ + - /security/faqs/single-sign-on/users-faqs/ + - /platform/security/authentication/single-sign-on/FAQs/users-faqs/ + - /platform/security/faqs/users-faqs/ + - /platform/security/faqs/sso-faqs/ + - /single-sign-on/enforcement-faqs/ + - /faq/security/single-sign-on/enforcement-faqs/ + - /security/faqs/single-sign-on/enforcement-faqs/ + - /enterprise/security/single-sign-on/FAQs/enforcement-faqs/ + - /single-sign-on/domain-faqs/ + - /faq/security/single-sign-on/domain-faqs/ + - /security/faqs/single-sign-on/domain-faqs/ + - /platform/security/authentication/single-sign-on/FAQs/domain-faqs/ + - /platform/security/faqs/domain-faqs/ + - /faqs/sso-faqs/ + - /faqs/domain-faqs/ +--- + +## SSO + +### What SSO flows does Docker support? + +Docker supports Service Provider Initiated (SP-initiated) SSO flow. Users must sign in to Docker Hub or Docker Desktop to initiate the SSO authentication process. + +### Does Docker SSO support multi-factor authentication? + +When an organization uses SSO, multi-factor authentication is controlled at the identity provider level, not on the Docker platform. + +### Can I retain my Docker ID when using SSO? + +Users with personal Docker IDs retain ownership of their repositories, images, and assets. When SSO is enforced, existing accounts with company domain emails are connected to the organization. Users signing in without existing accounts automatically have new accounts and Docker IDs created. + +### Are there any firewall rules required for SSO configuration? + +No specific firewall rules are required as long as `login.docker.com` is accessible. This domain is commonly accessible by default, but some organizations may need to allow it in their firewall settings if SSO setup encounters issues. + +### Does Docker use my IdP's default session timeout? + +Yes, Docker supports your IdP's session timeout using a custom `dockerSessionMinutes` SAML attribute instead of the standard `SessionNotOnOrAfter` element. See [SSO attributes](/manuals/security/provisioning/_index.md#sso-attributes) for more information. + +### Can I use multiple identity providers with Docker SSO? + +Yes, Docker supports multiple IdP configurations. A domain can be associated with multiple IdPs. Docker supports Entra ID (formerly Azure AD) and identity providers that support SAML 2.0. + +### Can I change my identity provider after configuring SSO? + +Yes. Delete your existing IdP configuration in your Docker SSO connection, then [configure SSO using your new IdP](/manuals/security/authentication/single-sign-on/connect.md). If you had already turned on enforcement, turn off enforcement before updating the provider connection. + +### What information do I need from my identity provider to configure SSO? + +To turn on SSO in Docker, you need the following from your IdP: + +- SAML: Entity ID, ACS URL, Single Logout URL, and the public X.509 certificate +- Entra ID (formerly Azure AD): Client ID, Client Secret, AD Domain + +### What happens if my existing certificate expires? + +Contact your identity provider to retrieve a new X.509 certificate. Update with the new certificate in [SSO configuration settings](/manuals/security/authentication/single-sign-on/manage.md#manage-sso-connections) from Docker Home. + +- If your organization enforces SSO, username and password credentials won't work. +- If your organization doesn't enforce SSO, users can sign in with their username and password credentials. + +If you need additional help, contact [Docker support](https://app.docker.com/support/contact). + +### What happens if my IdP goes down when SSO is turned on? + +If SSO is enforced, users can't access Docker Hub when your IdP is down. Users can still access Docker Hub images from the CLI using personal access tokens. + +If SSO is turned on but not enforced, users can fall back to username/password authentication. + +### Do bot accounts need seats to access organizations using SSO? + +Yes, bot accounts need seats like regular users, requiring a non-aliased domain email in the IdP and using a seat in Docker Hub. You can add bot accounts to your IdP and create access tokens to replace other credentials. + +### Does SAML SSO use Just-in-Time provisioning? + +The SSO implementation uses Just-in-Time (JIT) provisioning by default. You can optionally turn off JIT in Docker Home if you turn on auto-provisioning using SCIM. See [Just-in-Time provisioning](/manuals/security/provisioning/just-in-time.md). + +### How can I troubleshoot an Entra ID SSO connection error? + +Confirm that you've configured the necessary API permissions in Entra ID for your SSO connection. You need to grant administrator consent within your Entra ID tenant. See [Entra ID (formerly Azure AD) documentation](https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/grant-admin-consent?pivots=portal#grant-admin-consent-in-app-registrations). + +### Do I need to manually add users to my organization? + +No, you don't need to manually add users to your organization. Just ensure user accounts exist in your IdP. When users sign in to Docker with their domain email address, they're automatically added to the organization after successful authentication. + +### Can users use different email addresses to authenticate through SSO? + +All users must authenticate using the email domain specified during SSO setup. Users with email addresses that don't match the verified domain can sign in as guests with username and password if SSO isn't enforced, but only if they've been invited. + +### How will users know they're being added to a Docker organization? + +When SSO is turned on, users are prompted to authenticate through SSO the next time they sign in to Docker Hub or Docker Desktop. The system detects their domain email and prompts them to sign in with SSO credentials instead. + +For CLI access, users must authenticate using personal access tokens. + +### Can I convert existing users from non-SSO to SSO accounts? + +Yes, you can convert existing users to SSO accounts. Ensure users have: + +- Company domain email addresses and accounts in your IdP +- Docker Desktop version 4.4.2 or later +- Personal access tokens created to replace passwords for CLI access +- CI/CD pipelines updated to use PATs instead of passwords + +For detailed instructions, see [Configure single sign-on](/manuals/security/authentication/single-sign-on/connect.md). + +### Is Docker SSO fully synced with the IdP? + +Docker SSO provides Just-in-Time (JIT) provisioning by default. Users are provisioned when they authenticate with SSO. If users leave the organization, administrators must manually [remove the user](/manuals/accounts/organization/manage/members.md#remove-members-from-teams) from the organization. + +[SCIM](/manuals/security/provisioning/scim/_index.md) provides full synchronization with users and groups. When using SCIM, the recommended configuration is to turn off JIT so all auto-provisioning is handled by SCIM. + +Additionally, you can use the [Docker Hub API](/reference/api/hub/latest.md) to complete this process. + +### How does turning off Just-in-Time provisioning affect user sign-in? + +When JIT is turned off (available with SCIM in Docker Home), users must be organization members or have pending invitations to access Docker. Users who don't meet these criteria get an "Access denied" error and need administrator invitations. + +See [SSO authentication with JIT provisioning disabled](/manuals/security/provisioning/just-in-time.md#sso-authentication-with-jit-provisioning-disabled). + +### Can someone join an organization without an invitation? + +Not without SSO. Joining requires an invite from an organization owner. When SSO is enforced, users with verified domain emails can automatically join the organization when they sign in. + +### What happens to existing licensed users when SCIM is turned on? + +Turning on SCIM doesn't immediately remove or modify existing licensed users. They retain current access and roles, but you'll manage them through your IdP after SCIM is active. If SCIM is later turned off, previously SCIM-managed users remain in Docker but are no longer automatically updated based on your IdP. + +### Is user information visible in Docker Hub? + +All Docker accounts have public profiles associated with their namespace. If you don't want user information (like full names) to be visible, remove those attributes from your SSO and SCIM mappings, or use different identifiers to replace users' full names. + +## Enforcement + +### Does Docker SSO support authenticating through the command line? + +When SSO is enforced, [passwords are prevented from accessing the Docker CLI](/manuals/security/security-announcements.md#deprecation-of-password-logins-on-cli-when-sso-enforced). You must use a personal access token (PAT) for CLI authentication instead. + +Each user must create a PAT to access the CLI. To learn how to create a PAT, see [Manage personal access tokens](/manuals/security/access-tokens/personal-access-tokens.md). Users who already used a PAT before SSO enforcement can continue using that PAT. + +### How does SSO affect automation systems and CI/CD pipelines? + +Before enforcing SSO, you must [create personal access tokens](/manuals/security/access-tokens/personal-access-tokens.md) to replace passwords in automation systems and CI/CD pipelines. + +### Can I turn on SSO without enforcing it immediately? + +Yes, you can turn on SSO without enforcement. Users can choose between Docker ID (standard email and password) or domain-verified email address (SSO) at the sign-in screen. + +### Why can a user sign in with a username and password when SSO is enforced? + +Guest users who aren't part of your registered domain but have been invited to your organization don't sign in through your SSO identity provider. SSO enforcement only applies to users who belong to your verified domain. + +### Can I test SSO functionality before going to production? + +Yes, you can create a test organization with a 5-seat Business subscription. When testing, turn on SSO but don't enforce it, or all domain email users will be forced to sign in to the test environment. + +### What is enforcing SSO versus enforcing sign-in? + +These are separate features you can use independently or together: + +- Enforcing SSO ensures users sign in using SSO credentials instead of their Docker ID, enabling better credential management. +- Enforcing sign-in to Docker Desktop ensures users always sign in to accounts that are members of your organization, so security settings and subscription benefits are always applied. + +For more details, see [Enforce sign-in for Desktop](/manuals/enterprise/security/enforce-sign-in/_index.md#enforcing-sign-in-versus-enforcing-single-sign-on-sso). + +## Domain + +### Can I add sub-domains? + +Yes, you can add sub-domains to your SSO connection. All email addresses must use domains you've added to the connection. Verify that your DNS provider supports multiple TXT records for the same domain. + +### Do I need to keep the DNS TXT record permanently? + +You can remove the TXT record after one-time verification to add the domain. However, if your organization changes identity providers and needs to set up SSO again, you'll need to verify the domain again. + +### Can I verify the same domain for multiple organizations? + +You can't verify the same domain for multiple organizations at the organization level. To verify one domain for multiple organizations, you must have a Docker Business subscription and create a company. Companies allow centralized management of organizations and domain verification at the company level. diff --git a/content/manuals/faqs/subscription-billing.md b/content/manuals/faqs/subscription-billing.md new file mode 100644 index 000000000000..0271fc39756e --- /dev/null +++ b/content/manuals/faqs/subscription-billing.md @@ -0,0 +1,112 @@ +--- +title: Subscription and billing FAQs +linkTitle: Subscription and billing +description: Frequently asked questions about Docker subscriptions, billing, failed payments, taxes, and plans. +keywords: subscription faqs, billing, docker plans, renewal, failed payments, sales tax, VAT, academic pricing, pay by invoice, subscription transfer +tags: [FAQ] +toc_max: 2 +weight: 35 +aliases: + - /subscription/faq/ + - /billing/faqs/ + - /subscription-billing/faqs/subscription/ + - /subscription-billing/faqs/billing/ +--- + +For more information on Docker subscriptions, see +[Subscription and billing](/manuals/subscription-billing/_index.md). + +## Subscriptions + +### Can I transfer my subscription from one user or organization account to another? + +Subscriptions are non-transferable between accounts or organizations. + +### Can I pause or delay my Docker subscription? + +You can't pause or delay a subscription, but you can downgrade your +subscription. If a subscription invoice isn't paid by the due date, there's a +15-day grace period starting from the due date. + +### Does Docker offer academic pricing? + +For academic pricing, contact the +[Docker Sales Team](https://www.docker.com/company/contact). + +### How can I contribute to Docker content? + +Docker offers two content contribution programs: + +- [Docker-Sponsored Open Source Program (DSOS)](/manuals/docker-hub/repos/manage/trusted-content/dsos-program.md) + for open source projects +- [Docker Verified Publisher (DVP)](/manuals/docker-hub/repos/manage/trusted-content/dvp-program.md) + for commercial publishers + +You can also join the +[Developer Preview Program](https://www.docker.com/community/get-involved/developer-preview/) +or sign up for early access programs to participate in research and try new +features. + +### How do I upgrade to Docker Pro? + +To upgrade to Docker Pro, go to the +Docker pricing page +and select **Buy now**. + +## Payments + +### What happens if my subscription payment fails? + +If your subscription payment fails, there is a grace period of 15 days, +including the due date. Docker attempts to collect the payment three times using +the following schedule: + +- 3 days after the due date +- 5 days after the previous attempt +- 7 days after the previous attempt + +Docker also sends an email notification +`Action Required - Credit Card Payment Failed` with an attached unpaid invoice +after each failed payment attempt. + +If the invoice remains unpaid after the grace period, the +subscription downgrades to a free subscription and all paid features are +disabled. + +### Can I manually retry a failed payment? + +Yes. If your payment fails, select **Pay now** to retry the payment through +Stripe. + +Before retrying, verify that your default payment method is up to date. For +instructions, see +[Manage a payment method](/manuals/subscription-billing/manage/payment-method.md#manage-payment-method). + +### Can I use pay by invoice for upgrades or additional seats? + +No. Pay by invoice is only available for renewing annual subscriptions, not for +purchasing upgrades or additional seats. You must use card payment or US bank +accounts for these changes. + +For a list of supported payment methods, see +[Add or update a payment method](/manuals/subscription-billing/manage/payment-method.md). + +> [!TIP] +> +> Need to upgrade? Compare Docker Team and Docker Business to choose the plan that best fits your team's needs. + +## Taxes + +### Does Docker collect sales tax and VAT? + +Docker collects sales tax or VAT from the following customers: + +- For United States customers, Docker began collecting sales tax on + July 1, 2024. +- For European customers, Docker began collecting VAT on March 1, 2025. +- For United Kingdom customers, Docker began collecting VAT on May 1, 2025. + +To help ensure correct tax assessments, keep your +[billing information](/manuals/subscription-billing/manage/details.md) up to date. For details on +adding a VAT number or submitting a US tax exemption certificate, see +[Taxes](/manuals/subscription-billing/manage/tax-certificate.md). diff --git a/content/manuals/offload/configuration.md b/content/manuals/offload/configuration.md index f0275bebbde5..83bf541a121c 100644 --- a/content/manuals/offload/configuration.md +++ b/content/manuals/offload/configuration.md @@ -17,7 +17,7 @@ settings when allowed by their organization. For organization owners, you can manage Docker Offload settings for all users in your organization. For more details, see [Manage Docker -products](../admin/organization/manage/manage-products.md). To view usage for Docker +products](../accounts/organization/manage/manage-products.md). To view usage for Docker Offload, see [Docker Offload usage](/offload/usage/). ## Configure settings in Docker Desktop diff --git a/content/manuals/offload/quickstart.md b/content/manuals/offload/quickstart.md index 27b864a2e132..a35e8b30b2ca 100644 --- a/content/manuals/offload/quickstart.md +++ b/content/manuals/offload/quickstart.md @@ -19,7 +19,7 @@ This quickstart covers the steps developers need to get started with Docker Offl > > If you're an organization owner, to get started you must contact sales and subscribe your > organization to use Docker Offload. After subscribing, see [Manage Docker -> products](../admin/organization/manage/manage-products.md) to learn how to manage +> products](../accounts/organization/manage/manage-products.md) to learn how to manage > access for the developers in your organization. diff --git a/content/manuals/platform-release-notes.md b/content/manuals/platform-release-notes.md index dc7026bcf64d..4ba130ee1e50 100644 --- a/content/manuals/platform-release-notes.md +++ b/content/manuals/platform-release-notes.md @@ -6,7 +6,7 @@ keywords: Docker Home, billing, subscription, security, admin, releases, what's weight: 60 params: sidebar: - group: Platform + group: Accounts and admin tags: [Release notes, admin] --- @@ -67,7 +67,7 @@ This page provides details on new features, enhancements, known issues, and bug ### New -- [Personal access tokens](/security/access-tokens/) (PATs) now support expiration dates. +- [Personal access tokens](/security/access-tokens/personal-access-tokens/) (PATs) now support expiration dates. ## 2024-10-15 @@ -86,7 +86,7 @@ This page provides details on new features, enhancements, known issues, and bug ### New -- Administrators can now view [organization Insights](/manuals/admin/insights.md). +- Administrators can now view [organization Insights](/manuals/accounts/organization/insights.md). ## 2024-07-17 diff --git a/content/manuals/retired.md b/content/manuals/retired.md index 58694a8d35b9..71994d3ab6ab 100644 --- a/content/manuals/retired.md +++ b/content/manuals/retired.md @@ -206,7 +206,7 @@ Enhanced Service Account add-ons provided tiered pull rate limits for automated workflows and service accounts accessing Docker Hub. Docker recommends transitioning to [Organization Access Tokens -(OATs)](/manuals/enterprise/security/access-tokens.md), which provide secure, +(OATs)](/manuals/security/access-tokens/organization-access-tokens.md), which provide secure, programmatic access to Docker Hub with granular repository permissions, token expiration, and better security auditing. OATs are included with Docker Team and Business subscriptions and offer similar functionality without requiring diff --git a/content/manuals/scout/_index.md b/content/manuals/scout/_index.md index 2de739f7f90a..7f5046903622 100644 --- a/content/manuals/scout/_index.md +++ b/content/manuals/scout/_index.md @@ -38,7 +38,7 @@ grid: Ensure that your artifacts align with supply chain best practices. icon: shield-check - title: Upgrade - link: /subscription/change/ + link: /subscription-billing/manage/plans/ description: | A Personal subscription includes up to 1 repository. Upgrade for more. icon: arrow-up-circle diff --git a/content/manuals/scout/explore/metrics-exporter.md b/content/manuals/scout/explore/metrics-exporter.md index 8141eef331a4..69c5a179e43b 100644 --- a/content/manuals/scout/explore/metrics-exporter.md +++ b/content/manuals/scout/explore/metrics-exporter.md @@ -40,7 +40,7 @@ To export metrics from your organization, first make sure your organization is e Then, create a Personal Access Token (PAT) - a secret token that allows the exporter to authenticate with the Docker Scout API. The PAT does not require any specific permissions, but it must be created by a user who is an owner of the Docker organization. -To create a PAT, follow the steps in [Create an access token](/manuals/security/access-tokens.md). +To create a PAT, follow the steps in [Create an access token](/manuals/security/access-tokens/personal-access-tokens.md). Once you have created the PAT, store it in a secure location. You will need to provide this token to the exporter when scraping metrics. @@ -108,7 +108,7 @@ alongside Grafana with a pre-configured dashboard to visualize the vulnerability $ cd scout-metrics-exporter/prometheus ``` -2. [Create a Docker access token](/manuals/security/access-tokens.md) +2. [Create a Docker access token](/manuals/security/access-tokens/personal-access-tokens.md) and store it in a plain text file at `/prometheus/prometheus/token` under the template directory. ```plaintext {title=token} @@ -241,7 +241,7 @@ and a Datadog site. $ cd scout-metrics-exporter/datadog ``` -2. [Create a Docker access token](/manuals/security/access-tokens.md) +2. [Create a Docker access token](/manuals/security/access-tokens/personal-access-tokens.md) and store it in a plain text file at `/datadog/token` under the template directory. ```plaintext {title=token} @@ -347,7 +347,7 @@ To change the scrape interval: ## Revoke an access token If you suspect that your PAT has been compromised or is no longer needed, you can revoke it at any time. -To revoke a PAT, follow the steps in the [Create and manage access tokens](/manuals/security/access-tokens.md). +To revoke a PAT, follow the steps in the [Create and manage access tokens](/manuals/security/access-tokens/personal-access-tokens.md). Revoking a PAT immediately invalidates the token, and prevents Prometheus from scraping metrics using that token. You will need to create a new PAT and update the Prometheus configuration to use the new token. diff --git a/content/manuals/scout/integrations/registry.md b/content/manuals/scout/integrations/registry.md index 7c09f767e9cd..372ef3cad1e7 100644 --- a/content/manuals/scout/integrations/registry.md +++ b/content/manuals/scout/integrations/registry.md @@ -82,7 +82,7 @@ see [Data handling](/manuals/scout/deep-dive/data-handling.md). 4. Set up your Scout credentials. 1. Generate an organization access token. For more details, see - [Create an organization access token](/enterprise/security/access-tokens/#create-an-organization-access-token). + [Create an organization access token](/manuals/security/access-tokens/organization-access-tokens.md#create-an-organization-access-token). 2. Sign in to Docker using the organization access token. ```console diff --git a/content/manuals/security/_index.md b/content/manuals/security/_index.md index e8a3f9e8ad9c..1723f70a97f5 100644 --- a/content/manuals/security/_index.md +++ b/content/manuals/security/_index.md @@ -1,66 +1,72 @@ --- -title: Security for developers +title: Security linkTitle: Security -description: Learn about developer-level security features like 2FA and access tokens -keywords: docker, docker hub, docker desktop, security, developer security, 2FA, access tokens +description: > + Secure Docker accounts, manage access, and control membership for + individuals and organizations in Docker Home. +keywords: docker, docker hub, security, 2FA, access tokens, SSO, OIDC, + provisioning, roles, Docker Home weight: 40 +aliases: + - /security/for-developers/ + - /platform/security/ params: sidebar: - group: Platform -grid_developers: -- title: Set up two-factor authentication - description: Add an extra layer of authentication to your Docker account. - link: /security/2fa/ - icon: device-phone-mobile -- title: Manage access tokens - description: Create personal access tokens as an alternative to your password. - icon: lock-closed - link: /security/access-tokens/ -- title: Static vulnerability scanning - description: Automatically run a point-in-time scan on your Docker images for vulnerabilities. - icon: magnifying-glass - link: /docker-hub/repos/manage/vulnerability-scanning/ -- title: Docker Engine security - description: Understand how to keep Docker Engine secure. - icon: shield-check - link: /engine/security/ -- title: Secrets in Docker Compose - description: Learn how to use secrets in Docker Compose. - icon: shield-exclamation - link: /compose/how-tos/use-secrets/ -grid_resources: -- title: Security FAQs - description: Explore common security FAQs. - icon: question-mark-circle - link: /faq/security/general/ -- title: Security best practices - description: Understand the steps you can take to improve the security of your container. - icon: squares-2x2 - link: /develop/security-best-practices/ -- title: Suppress CVEs with VEX - description: Learn how to suppress non-applicable or fixed vulnerabilities found in your images. - icon: chart-bar - link: /scout/guides/vex/ -- title: Docker Hardened Images - description: Learn how to use Docker Hardened Images to enhance your software supply security. - icon: lock-closed - link: /dhi/ + group: Accounts and admin +grid: + - title: Authentication + description: Two-factor authentication, single sign-on, and OIDC connections. + icon: key + link: /security/authentication/ + - title: Access tokens + description: Personal and organization access tokens for the Docker CLI and automation. + icon: lock-closed + link: /security/access-tokens/ + - title: Provisioning + description: Add users with SCIM, JIT, auto-provisioning, and domain management. + icon: arrow-path + link: /security/provisioning/ + - title: Roles and permissions + description: Assign core or custom roles to control access in your organization. + icon: shield-check + link: /security/roles-and-permissions/ --- -Docker helps you protect your local environments, infrastructure, and networks -with its developer-level security features. +Security helps individual users and organization owners secure their +accounts, manage access, and control membership. You configure these +settings in [Docker Home](https://app.docker.com/). -Use tools like two-factor authentication (2FA), personal access tokens, and -Docker Scout to manage access and detect vulnerabilities early in your workflow. -You can also integrate secrets securely into your development stack using Docker Compose, -or enhance your software supply security with Docker Hardened Images. +## Individual accounts -Explore the following sections to learn more. +You sign in with your individual account. -## For developers +- [Two-factor authentication](/manuals/security/authentication/2fa/_index.md) +(2FA) adds a time-based one-time password (TOTP) from an authenticator +app to your password. +- A [personal access token](/manuals/security/access-tokens/personal-access-tokens.md) +(PAT) authenticates the Docker CLI and tools without your password, and +is required for CLI sign-in when 2FA is on or single sign-on (SSO) is +enforced. -{{< grid items="grid_developers" >}} +## Organization accounts -## More resources +Organization and company owners set up how members sign in, add them to +the organization, configure automation, and control what members can do. -{{< grid items="grid_resources" >}} +- [Single sign-on](/manuals/security/authentication/single-sign-on/_index.md) +(SSO) federates sign-in through your identity provider, which can cover +one organization or every organization in a company. +- [Provisioning](/manuals/security/provisioning/_index.md) adds users with +System for Cross-domain Identity Management (SCIM), Just-in-Time (JIT) +provisioning, auto-provisioning, or domain matching. +- An [organization access token](/manuals/security/access-tokens/organization-access-tokens.md) +(OAT) stays with the organization when membership changes. +- [OIDC connections](/manuals/security/authentication/oidc-connections/_index.md) +use OpenID Connect to authenticate GitHub Actions with short-lived +tokens, as an alternative to a long-lived OAT. +- [Roles and permissions](/manuals/security/roles-and-permissions/_index.md) +control what members can do after they join. + +## Next steps + +{{< grid >}} diff --git a/content/manuals/security/access-tokens/_index.md b/content/manuals/security/access-tokens/_index.md new file mode 100644 index 000000000000..eb933ede9584 --- /dev/null +++ b/content/manuals/security/access-tokens/_index.md @@ -0,0 +1,37 @@ +--- +title: Access tokens +linkTitle: Access tokens +description: Create and manage personal and organization access tokens for Docker Hub authentication. +keywords: access tokens, personal access tokens, organization access tokens, PAT, OAT, Docker security +weight: 10 +aliases: + - /platform/security/access-tokens/ +grid: + - title: Personal access tokens + description: Authenticate the Docker CLI and tools with a token tied to your account. + icon: lock-closed + link: /security/access-tokens/personal-access-tokens/ + - title: Organization access tokens + description: Grant org-owned Hub access to CI/CD and other automation. + icon: building-office-2 + link: /security/access-tokens/organization-access-tokens/ +--- + +Access tokens let you authenticate to Docker Hub without using your password. +Use a token for the Docker CLI, automation, and any account that has +two-factor authentication (2FA) or enforced single sign-on (SSO), because +password sign-in to the CLI is not supported in those cases. + +## Choose a token type + +| Token | Ownership | Use when | Limitations | +| --- | --- | --- | --- | +| Personal access token (PAT) | Tied to an individual Docker account | CLI access, local tools, and automation that should run as you. Required for CLI sign-in when 2FA is on or SSO is enforced | Access ends if the account leaves the organization or the token is revoked | +| Organization access token (OAT) | Owned by the organization. Any organization owner can manage it | CI/CD and other automation that must keep working when membership changes | Incompatible with Docker Desktop and Image Access Management | + +For GitHub Actions, [OIDC connections](/manuals/security/authentication/oidc-connections/_index.md) +are an alternative to storing a long-lived organization access token. + +## Next steps + +{{< grid >}} diff --git a/content/manuals/enterprise/security/access-tokens.md b/content/manuals/security/access-tokens/organization-access-tokens.md similarity index 98% rename from content/manuals/enterprise/security/access-tokens.md rename to content/manuals/security/access-tokens/organization-access-tokens.md index a65b78499397..e1258dd92179 100644 --- a/content/manuals/enterprise/security/access-tokens.md +++ b/content/manuals/security/access-tokens/organization-access-tokens.md @@ -5,6 +5,8 @@ description: Create and manage organization access tokens to securely authentica keywords: organization access tokens, OAT, docker hub security, programmatic access, automation aliases: - /security/for-admins/access-tokens/ + - /enterprise/security/access-tokens/ + - /platform/security/access-tokens/organization-access-tokens/ --- {{< summary-bar feature_name="OATs" >}} @@ -13,7 +15,7 @@ Organization access tokens (OATs) provide secure, programmatic access to Docker > [!WARNING] > -> Organization access tokens are incompatible with Docker Desktop and Image Access Management. If you use these features, use [personal access tokens](/manuals/security/access-tokens.md) instead. +> Organization access tokens are incompatible with Docker Desktop and Image Access Management. If you use these features, use [personal access tokens](/manuals/security/access-tokens/personal-access-tokens.md) instead. ## Who should use organization access tokens? diff --git a/content/manuals/security/access-tokens.md b/content/manuals/security/access-tokens/personal-access-tokens.md similarity index 92% rename from content/manuals/security/access-tokens.md rename to content/manuals/security/access-tokens/personal-access-tokens.md index 380b93383dd6..76b8a5d7d7aa 100644 --- a/content/manuals/security/access-tokens.md +++ b/content/manuals/security/access-tokens/personal-access-tokens.md @@ -6,9 +6,14 @@ keywords: personal access tokens, PAT, docker cli authentication, docker hub sec weight: 10 aliases: - /docker-hub/access-tokens/ + - /security/access-tokens/ + - /security/personal-access-tokens/ - /security/for-developers/access-tokens/ + - /platform/security/access-tokens/personal-access-tokens/ --- +{{< summary-bar feature_name="PATs" >}} + Personal access tokens (PATs) provide a secure alternative to passwords for Docker CLI authentication. Use PATs to authenticate automated systems, CI/CD pipelines, and development tools without exposing your Docker Hub password. ## Key benefits @@ -32,7 +37,7 @@ Use PATs for these common scenarios: > [!NOTE] > -> For organization-wide automation, consider [organization access tokens](/manuals/enterprise/security/access-tokens.md) which aren't tied to individual user accounts. +> For organization-wide automation, consider [organization access tokens](/manuals/security/access-tokens/organization-access-tokens.md) which aren't tied to individual user accounts. ## Create a personal access token @@ -101,5 +106,5 @@ Best practices for fair use include: - Reuse tokens across similar use cases instead of creating many single-purpose tokens - Delete unused tokens regularly -- Use [organization access tokens](/manuals/enterprise/security/access-tokens.md) for organization-wide automation +- Use [organization access tokens](/manuals/security/access-tokens/organization-access-tokens.md) for organization-wide automation - Monitor token usage to identify optimization opportunities diff --git a/content/manuals/security/2fa/_index.md b/content/manuals/security/authentication/2fa/_index.md similarity index 96% rename from content/manuals/security/2fa/_index.md rename to content/manuals/security/authentication/2fa/_index.md index 688c3449d800..842e9dd8290a 100644 --- a/content/manuals/security/2fa/_index.md +++ b/content/manuals/security/authentication/2fa/_index.md @@ -9,8 +9,12 @@ aliases: - /security/2fa/disable-2fa/ - /security/for-developers/2fa/ - /security/for-developers/2fa/disable-2fa/ + - /security/2fa/ + - /platform/security/authentication/2fa/ --- +{{< summary-bar feature_name="2FA" >}} + Two-factor authentication (2FA) adds an essential security layer to your Docker account by requiring a unique security code in addition to your password when signing in. This prevents unauthorized access even if your password is compromised. When you turn on two-factor authentication, Docker provides a unique recovery code specific to your account. Store this code securely as it lets you recover your account if you lose access to your authenticator app. diff --git a/content/manuals/security/2fa/recover-hub-account.md b/content/manuals/security/authentication/2fa/recover-hub-account.md similarity index 94% rename from content/manuals/security/2fa/recover-hub-account.md rename to content/manuals/security/authentication/2fa/recover-hub-account.md index 4535b6b77741..9bcc06f9cfd9 100644 --- a/content/manuals/security/2fa/recover-hub-account.md +++ b/content/manuals/security/authentication/2fa/recover-hub-account.md @@ -6,9 +6,12 @@ aliases: - /docker-hub/2fa/recover-hub-account/ - /security/for-developers/2fa/recover-hub-account/ - /security/2fa/new-recovery-code/ + - /platform/security/authentication/2fa/recover-hub-account/ weight: 20 --- +{{< summary-bar feature_name="2FA" >}} + This page explains how to recover your Docker account and manage recovery codes for two-factor authentication. ## Generate a new recovery code diff --git a/content/manuals/security/authentication/_index.md b/content/manuals/security/authentication/_index.md new file mode 100644 index 000000000000..8e8332286152 --- /dev/null +++ b/content/manuals/security/authentication/_index.md @@ -0,0 +1,48 @@ +--- +title: Authentication +linkTitle: Authentication +description: Configure single sign-on, OIDC connections, and two-factor authentication. +keywords: authentication, SSO, OIDC, two-factor authentication, 2FA, Docker security +weight: 20 +aliases: + - /platform/security/authentication/ +grid: + - title: Single sign-on + description: Authenticate users through your identity provider. + icon: key + link: /security/authentication/single-sign-on/ + - title: Two-factor authentication + description: Add a TOTP security code to an individual Docker account. + icon: device-phone-mobile + link: /security/authentication/2fa/ + - title: OIDC connections + description: Authenticate GitHub Actions with short-lived tokens. + icon: lock-closed + link: /security/authentication/oidc-connections/ +--- + +Authentication in Docker Home is how users and workloads prove who they are +before they access Docker products. + +Two-factor authentication (2FA) protects an individual account. Single +sign-on (SSO) federates sign-in for an organization or company. OpenID +Connect (OIDC) connections authenticate CI workloads such as GitHub Actions. + +## Choose an authentication method + +| Method | Who it covers | Who configures it | How authentication works | +| --- | --- | --- | --- | +| Two-factor authentication (2FA) | An individual Docker account | The account holder | Password plus a time-based one-time password (TOTP) from an authenticator app | +| Single sign-on (SSO) | An organization or company | An organization or company owner | Users sign in through the organization's identity provider (IdP) | +| OIDC connections | GitHub Actions and similar workloads | An organization owner or editor | Docker exchanges short-lived tokens issued per workflow run | + +SSO requires a Docker Business subscription. OIDC connections require a +Docker Team or Business subscription. + +To require Docker Desktop users to sign in as organization members, see +[Enforce sign-in](/manuals/enterprise/security/enforce-sign-in/_index.md). +Enforce sign-in is configured in Enterprise, not in this section. + +## Next steps + +{{< grid >}} diff --git a/content/manuals/enterprise/security/oidc-connections/_index.md b/content/manuals/security/authentication/oidc-connections/_index.md similarity index 62% rename from content/manuals/enterprise/security/oidc-connections/_index.md rename to content/manuals/security/authentication/oidc-connections/_index.md index 72d19efd3019..43b78274f313 100644 --- a/content/manuals/enterprise/security/oidc-connections/_index.md +++ b/content/manuals/security/authentication/oidc-connections/_index.md @@ -5,6 +5,9 @@ description: Authenticate GitHub Actions to Docker with short-lived OpenID Conne keywords: oidc connections, openid connect, github actions, jwt, subject claims, rulesets, enterprise security, workload authentication tags: [admin] weight: 35 +aliases: + - /enterprise/security/oidc-connections/ + - /platform/security/authentication/oidc-connections/ --- {{< summary-bar feature_name="OIDC connections" >}} @@ -32,21 +35,10 @@ GitHub follows these steps: All tokens created and exchanged during an OIDC workflow are short-lived and issued on a per-workflow basis. -## OIDC connections and OATs - -[Organization access tokens (OATs)](/manuals/enterprise/security/access-tokens.md) -provide programmatic access to your Docker resources at the organization -level. Unlike personal access tokens, OATs aren't tied to individual -members, so access continues when membership changes. - -OIDC connections don't replace OATs. OIDC connections authenticate a -workflow as if it were a user, then authorize access after authentication. - -While OATs govern access to your Docker resources through organization -membership, OIDC connections authenticate GitHub Actions workflows when -they request a change to your Docker resources. +For how OIDC connections compare to organization access tokens, see +[Access tokens](/manuals/security/access-tokens/_index.md). ## Next steps -- [Create an OIDC connection](/manuals/enterprise/security/oidc-connections/create-manage.md) -- [OIDC rulesets and subject claims](/manuals/enterprise/security/oidc-connections/rulesets-claims.md) +- [Create an OIDC connection](/manuals/security/authentication/oidc-connections/create-manage.md) +- [OIDC rulesets and subject claims](/manuals/security/authentication/oidc-connections/rulesets-claims.md) diff --git a/content/manuals/enterprise/security/oidc-connections/create-manage.md b/content/manuals/security/authentication/oidc-connections/create-manage.md similarity index 91% rename from content/manuals/enterprise/security/oidc-connections/create-manage.md rename to content/manuals/security/authentication/oidc-connections/create-manage.md index f87c9823e604..6961ce607115 100644 --- a/content/manuals/enterprise/security/oidc-connections/create-manage.md +++ b/content/manuals/security/authentication/oidc-connections/create-manage.md @@ -5,6 +5,8 @@ description: Create and manage OIDC connections in Docker Home, then authenticat keywords: oidc connections, create oidc connection, github actions, docker/login-action, DOCKERHUB_OIDC_CONNECTIONID, openid connect, docker hub, enterprise security, admin tags: [admin] weight: 10 +aliases: + - /platform/security/authentication/oidc-connections/create-manage/ --- {{< summary-bar feature_name="OIDC connections" >}} @@ -25,7 +27,7 @@ with a short-lived token. 1. Select **Create OIDC connection** and fill in the OIDC connection form. - Provide rulesets and subject claims. Other values are optional. - For rulesets, subject claims, and resources, see - [OIDC connections rulesets and subject claims](/manuals/enterprise/security/oidc-connections/rulesets-claims.md). + [OIDC connections rulesets and subject claims](/manuals/security/authentication/oidc-connections/rulesets-claims.md). 1. Select **Create connection**. 1. Copy your OIDC connection ID. @@ -90,4 +92,4 @@ fails at the token-exchange step until you activate the connection. ## Next steps -- [OIDC connections rulesets and subject claims](/manuals/enterprise/security/oidc-connections/rulesets-claims.md) +- [OIDC connections rulesets and subject claims](/manuals/security/authentication/oidc-connections/rulesets-claims.md) diff --git a/content/manuals/enterprise/security/oidc-connections/rulesets-claims.md b/content/manuals/security/authentication/oidc-connections/rulesets-claims.md similarity index 92% rename from content/manuals/enterprise/security/oidc-connections/rulesets-claims.md rename to content/manuals/security/authentication/oidc-connections/rulesets-claims.md index 6e14e038bc48..a1632d8f9c1d 100644 --- a/content/manuals/enterprise/security/oidc-connections/rulesets-claims.md +++ b/content/manuals/security/authentication/oidc-connections/rulesets-claims.md @@ -5,6 +5,8 @@ description: Configure rulesets and subject claims to control OIDC workflow acce keywords: oidc connections, rulesets, subject claims, github actions, jwt claims, access control, wildcards, enterprise security tags: [admin] weight: 20 +aliases: + - /platform/security/authentication/oidc-connections/rulesets-claims/ --- {{< summary-bar feature_name="OIDC connections" >}} @@ -91,5 +93,5 @@ Docker Hub repositories and Docker Build Cloud are supported resources. ## Next steps -- [OIDC connections overview](/manuals/enterprise/security/oidc-connections/_index.md) -- [Create or manage OIDC connections](/manuals/enterprise/security/oidc-connections/create-manage.md) +- [OIDC connections overview](/manuals/security/authentication/oidc-connections/_index.md) +- [Create or manage OIDC connections](/manuals/security/authentication/oidc-connections/create-manage.md) diff --git a/content/manuals/enterprise/security/single-sign-on/_index.md b/content/manuals/security/authentication/single-sign-on/_index.md similarity index 86% rename from content/manuals/enterprise/security/single-sign-on/_index.md rename to content/manuals/security/authentication/single-sign-on/_index.md index c7cfa70db0b7..7927a24e3f85 100644 --- a/content/manuals/enterprise/security/single-sign-on/_index.md +++ b/content/manuals/security/authentication/single-sign-on/_index.md @@ -8,6 +8,8 @@ aliases: - /admin/company/settings/sso/ - /admin/organization/security-settings/sso-management/ - /security/for-admins/single-sign-on/ + - /enterprise/security/single-sign-on/ + - /platform/security/authentication/single-sign-on/ weight: 10 --- @@ -39,7 +41,7 @@ To configure SSO in Docker, follow these steps: 1. Link Docker to your identity provider. 1. Test your SSO connection. 1. Provision users in Docker. -1. Optional. [Enforce sign-in](../enforce-sign-in/_index.md). +1. Optional. [Enforce sign-in](/manuals/enterprise/security/enforce-sign-in/_index.md). 1. [Manage your SSO configuration](manage.md). Once configuration is complete, users can sign in to Docker services using @@ -55,5 +57,5 @@ assigned to an organization, and added to a team. ## Next steps - Start [configuring SSO](connect.md). -- Read the [FAQs](/manuals/enterprise/security/single-sign-on/FAQs/general.md). -- [Troubleshoot](/manuals/enterprise/security/single-sign-on/troubleshoot-sso.md) SSO issues. +- Read the [FAQs](/manuals/faqs/security.md). +- [Troubleshoot](/manuals/security/authentication/single-sign-on/troubleshoot-sso.md) SSO issues. diff --git a/content/manuals/enterprise/security/single-sign-on/connect.md b/content/manuals/security/authentication/single-sign-on/connect.md similarity index 92% rename from content/manuals/enterprise/security/single-sign-on/connect.md rename to content/manuals/security/authentication/single-sign-on/connect.md index 52630a29786f..2817d48695d2 100644 --- a/content/manuals/enterprise/security/single-sign-on/connect.md +++ b/content/manuals/security/authentication/single-sign-on/connect.md @@ -13,7 +13,8 @@ aliases: - /admin/company/settings/sso-configuration/ - /admin/organization/security-settings/sso-configuration/ - /security/for-admins/single-sign-on/configure/ - - /enterprise/security/single-sign-on/configure + - /enterprise/security/single-sign-on/connect/ + - /platform/security/authentication/single-sign-on/connect/ --- {{< summary-bar feature_name="SSO" >}} @@ -22,7 +23,7 @@ To set up a single sign-on (SSO), you need to establish a connection between Doc and your identity provider (IdP). While this guide uses Okta and Microsoft Entra ID as a working example, the general process remains the same for other IdPs. -If you're unfamiliar with the SSO process, first review [SSO overview](/manuals/enterprise/security/single-sign-on/_index.md) to learn about how SSO works. +If you're unfamiliar with the SSO process, first review [SSO overview](/manuals/security/authentication/single-sign-on/_index.md) to learn about how SSO works. ## Prerequisites @@ -124,7 +125,7 @@ You need [super admin permissions](https://help.okta.com/en-us/content/topics/se - For **Name ID format**, choose `EmailAddress` - For **Application username**, choose `Email` - For **Update application username on**, choose `Create and update` - - Optional. Add [SAML attributes](/manuals/enterprise/security/provisioning/_index.md#sso-attributes), if required by your org. + - Optional. Add [SAML attributes](/manuals/security/provisioning/_index.md#sso-attributes), if required by your org. 1. For **Feedback**, choose **This is an internal app that we have created** checkbox before finishing. Keep your Okta window open for the next step. @@ -140,7 +141,7 @@ To enable SSO with Microsoft Entra, you need [Cloud Application Administrator](h 1. Select **Edit** on the **Basic SAML configuration** section. From **Basic SAML configuration**, choose **Edit** and paste the values you copied from creating an SSO connection in Docker: - For the **Identifier** value, paste the Docker Entity ID. - For the **Reply URL** value, paste Docker ACS URL. -1. Optional. Add [SAML attributes](/manuals/enterprise/security/provisioning/_index.md#sso-attributes), if required by your org. +1. Optional. Add [SAML attributes](/manuals/security/provisioning/_index.md#sso-attributes), if required by your org. 1. From the **SAML Signing Certificate** section, download your **Certificate (Base64)**. {{< /tab >}} @@ -233,7 +234,7 @@ Docker supports multiple identity provider (IdP) configurations by letting you a To add multiple IdPs: 1. Use the same domain for each connection. -1. Repeat steps 3-6 from the [Set up an SSO connection](/manuals/enterprise/security/single-sign-on/connect.md#set-up-an-sso-connection) procedures on this page. Repeat these steps for each IdP your organization intends to use. +1. Repeat steps 3-6 from the [Set up an SSO connection](/manuals/security/authentication/single-sign-on/connect.md#set-up-an-sso-connection) procedures on this page. Repeat these steps for each IdP your organization intends to use. Because you must use the same domain for each IdP, you won't need to repeat steps to add and verify your domains. @@ -241,7 +242,7 @@ Because you must use the same domain for each IdP, you won't need to repeat step If SSO is not enforced, users can still sign in using Docker usernames and passwords. Enforcing SSO requires users to use SSO when signing into Docker, which centralizes authentication and enforces policies set by the IdP. -Before enforcing SSO, users accessing Docker through the CLI must [create a personal access token (PAT)](/manuals/security/access-tokens.md). The PAT replaces their username and password for authentication. +Before enforcing SSO, users accessing Docker through the CLI must [create a personal access token (PAT)](/manuals/security/access-tokens/personal-access-tokens.md). The PAT replaces their username and password for authentication. 1. Sign in to [Docker Home](https://app.docker.com/) and select your organization or company. @@ -256,7 +257,7 @@ Docker Hub. If you want to use 2FA, you must enable 2FA through your IdP. ## Next steps -- [Provision users](/manuals/enterprise/security/provisioning/_index.md). -- [Enforce sign-in](../enforce-sign-in/_index.md). -- [Create personal access tokens](/manuals/security/access-tokens.md). -- [Troubleshoot SSO](/manuals/enterprise/security/single-sign-on/troubleshoot-sso.md) issues. +- [Provision users](/manuals/security/provisioning/_index.md). +- [Enforce sign-in](/manuals/enterprise/security/enforce-sign-in/_index.md). +- [Create personal access tokens](/manuals/security/access-tokens/personal-access-tokens.md). +- [Troubleshoot SSO](/manuals/security/authentication/single-sign-on/troubleshoot-sso.md) issues. diff --git a/content/manuals/enterprise/security/single-sign-on/images/SSO.png b/content/manuals/security/authentication/single-sign-on/images/SSO.png similarity index 100% rename from content/manuals/enterprise/security/single-sign-on/images/SSO.png rename to content/manuals/security/authentication/single-sign-on/images/SSO.png diff --git a/content/manuals/enterprise/security/single-sign-on/manage.md b/content/manuals/security/authentication/single-sign-on/manage.md similarity index 97% rename from content/manuals/enterprise/security/single-sign-on/manage.md rename to content/manuals/security/authentication/single-sign-on/manage.md index c5f71844e459..c931de7b1030 100644 --- a/content/manuals/enterprise/security/single-sign-on/manage.md +++ b/content/manuals/security/authentication/single-sign-on/manage.md @@ -8,6 +8,8 @@ aliases: - /admin/company/settings/sso-management/ - /single-sign-on/manage/ - /security/for-admins/single-sign-on/manage/ +- /enterprise/security/single-sign-on/manage/ +- /platform/security/authentication/single-sign-on/manage/ --- {{< summary-bar feature_name="SSO" >}} @@ -106,7 +108,7 @@ when they sign in via SSO - Group mapping: Sync user groups from your identity provider with teams in your Docker organization - Manual provisioning: Turn off automatic provisioning and manually invite users -For more information on provisioning methods, see [Provision users](/manuals/enterprise/security/provisioning/_index.md). +For more information on provisioning methods, see [Provision users](/manuals/security/provisioning/_index.md). ### Add guest users diff --git a/content/manuals/enterprise/security/single-sign-on/troubleshoot-sso.md b/content/manuals/security/authentication/single-sign-on/troubleshoot-sso.md similarity index 94% rename from content/manuals/enterprise/security/single-sign-on/troubleshoot-sso.md rename to content/manuals/security/authentication/single-sign-on/troubleshoot-sso.md index ebd616e7f6c4..8bbb0d4a3e14 100644 --- a/content/manuals/enterprise/security/single-sign-on/troubleshoot-sso.md +++ b/content/manuals/security/authentication/single-sign-on/troubleshoot-sso.md @@ -10,6 +10,7 @@ aliases: - /security/for-admins/single-sign-on/troubleshoot/ - /security/troubleshoot/troubleshoot-sso/ - /enterprise/troubleshoot/troubleshoot-sso/ + - /platform/security/authentication/single-sign-on/troubleshoot-sso/ --- This page describes common single sign-on (SSO) errors and their solutions. Issues can stem from your identity provider (IdP) configuration or Docker settings. @@ -105,7 +106,7 @@ to re-enable it: **Manually invite users** When JIT is disabled, users are not automatically added to your organization when they authenticate through SSO. -To manually invite users, see [Invite members](/manuals/admin/organization/manage/members.md#invite-members). +To manually invite users, see [Invite members](/manuals/accounts/organization/manage/members.md#invite-members). **Configure SCIM provisioning** @@ -117,7 +118,7 @@ If you have SCIM enabled, troubleshoot your SCIM connection using the following 1. Navigate back to **Identity & auth**, then **SSO and SCIM**, and verify your SCIM configuration: - Ensure that the SCIM Base URL and API Token in your IdP match those provided in Docker. - Verify that SCIM is enabled in both Docker and your IdP. -1. Ensure that the attributes being synced from your IdP match Docker's [supported attributes](/manuals/enterprise/security/provisioning/scim/provision-scim.md#supported-attributes) for SCIM. +1. Ensure that the attributes being synced from your IdP match Docker's [supported attributes](/manuals/security/provisioning/scim/provision-scim.md#supported-attributes) for SCIM. 1. Test user provisioning by trying to provision a test user through your IdP and verify if they appear in Docker. ## IdP-initiated sign in is not enabled for connection @@ -162,11 +163,11 @@ This error occurs when the organization has no available seats for the user when **Add more seats to the organization** -Purchase additional Docker Business subscription seats. For details, see [Manage subscription seats](/manuals/admin/organization/manage/manage-seats.md). +Purchase additional Docker Business subscription seats. For details, see [Manage subscription seats](/manuals/accounts/organization/manage/manage-seats.md). **Remove users or pending invitations** -Review your organization members and pending invitations. Remove inactive users or pending invitations to free up seats. For more details, see [Manage organization members](/manuals/admin/organization/manage/members.md). +Review your organization members and pending invitations. Remove inactive users or pending invitations to free up seats. For more details, see [Manage organization members](/manuals/accounts/organization/manage/members.md). ## Domain is not verified for SSO connection @@ -192,7 +193,7 @@ Ensure that the IdP SSO connection is returning the correct UPN value in the ass **Add and verify all domains** -Add and verify all domains and subdomains used as UPN by your IdP and associate them with your Docker SSO connection. For details, see [Configure single sign-on](/manuals/enterprise/security/single-sign-on/connect.md). +Add and verify all domains and subdomains used as UPN by your IdP and associate them with your Docker SSO connection. For details, see [Configure single sign-on](/manuals/security/authentication/single-sign-on/connect.md). ## Unable to find session diff --git a/content/manuals/security/faqs/_index.md b/content/manuals/security/faqs/_index.md deleted file mode 100644 index 4aebbca68bbb..000000000000 --- a/content/manuals/security/faqs/_index.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -build: - render: never -title: FAQs -weight: 70 ---- diff --git a/content/manuals/security/faqs/containers.md b/content/manuals/security/faqs/containers.md deleted file mode 100644 index 5c3496f338eb..000000000000 --- a/content/manuals/security/faqs/containers.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: Container security FAQs -linkTitle: Container -description: Frequently asked questions about Docker container security and isolation -keywords: container security, docker desktop isolation, enhanced container isolation, file sharing -weight: 20 -tags: [FAQ] -aliases: -- /faq/security/containers/ ---- - -## How are containers isolated from the host in Docker Desktop? - -Docker Desktop runs all containers inside a customized Linux virtual machine (except for native Windows containers). This adds strong isolation between containers and the host machine, even when containers run as root. - -Important considerations include: - -- Containers have access to host files configured for file sharing via Docker Desktop settings -- Containers run as root with limited capabilities inside the Docker Desktop VM by default -- Privileged containers (`--privileged`, `--pid=host`, `--cap-add`) run with elevated privileges inside the VM, giving them access to VM internals and Docker Engine - -With Enhanced Container Isolation turned on, each container runs in a dedicated Linux user namespace inside the Docker Desktop VM. Even privileged containers only have privileges within their container boundary, not the VM. ECI uses advanced techniques to prevent containers from breaching the Docker Desktop VM and Docker Engine. - -## Which portions of the host filesystem can containers access? - -Containers can only access host files that are: - -1. Shared using Docker Desktop settings -1. Explicitly bind-mounted into the container (e.g., `docker run -v /path/to/host/file:/mnt`) - -## Can containers running as root access admin-owned files on the host? - -No. Host file sharing uses a user-space file server (running in `com.docker.backend` as the Docker Desktop user), so containers can only access files that the Docker Desktop user already has permission to access. diff --git a/content/manuals/security/faqs/general.md b/content/manuals/security/faqs/general.md deleted file mode 100644 index 89ed07dfabde..000000000000 --- a/content/manuals/security/faqs/general.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -description: Frequently asked questions about Docker security, authentication, and organization management -keywords: Docker security, FAQs, authentication, SSO, vulnerability reporting, session management -title: General security FAQs -linkTitle: General -weight: 10 -tags: [FAQ] -aliases: -- /faq/security/general/ ---- - -## How do I report a vulnerability? - -If you've discovered a security vulnerability in Docker, report it responsibly to security@docker.com so Docker can quickly address it. - -## Does Docker lockout users after failed sign-ins? - -Docker Hub locks out users after 10 failed sign-in attempts within 5 minutes. The lockout duration is 5 minutes. This policy applies to Docker Hub, Docker Desktop, and Docker Scout authentication. - -## Do you support physical multi-factor authentication (MFA) with YubiKeys? - -You can configure physical multi-factor authentication (MFA) through SSO using your identity provider (IdP). Check with your IdP if they support physical MFA devices like YubiKeys. - -## How are sessions managed and do they expire? - -Docker uses tokens to manage user sessions with different expiration periods: - -- Docker Desktop: Signs you out after 90 days, or 30 days of inactivity -- Docker Hub and Docker Home: Sign you out after 24 hours - -Docker also supports your IdP's default session timeout through SAML attributes. For more information, see [SSO attributes](/manuals/enterprise/security/provisioning/_index.md#sso-attributes). - -## How does Docker distinguish between employee users and contractor users? - -Organizations use verified domains to distinguish user types. Team members with email domains other than verified domains appear as "Guest" users in the organization. - -## How long are activity logs available? - -Docker activity logs are available for 90 days. You're responsible for exporting logs or setting up drivers to send logs to your internal systems for longer retention. - -## Can I export a list of users with their roles and privileges? - -Yes, use the [Export Members](../../admin/organization/manage/members.md#export-members-csv-file) feature to export a CSV file containing your organization's users with role and team information. - -## How does Docker Desktop handle authentication information? - -Docker Desktop uses the host operating system's secure key management to store authentication tokens: - -- macOS: [Keychain](https://support.apple.com/guide/security/keychain-data-protection-secb0694df1a/web) -- Windows: [Security and Identity API via Wincred](https://learn.microsoft.com/en-us/windows/win32/api/wincred/) -- Linux: [Pass](https://www.passwordstore.org/). - -## How do I remove users who aren't part of my IdP when using SSO without SCIM? - -If SCIM isn't turned on, you must manually remove users from the organization. SCIM can automate user removal, but only for users added after SCIM is turned on. Users added before SCIM was turned on must be removed manually. - -For more information, see [Manage organization members](/manuals/admin/organization/manage/members.md). - -## What metadata does Scout collect from container images? - -For information about metadata stored by Docker Scout, see [Data handling](/manuals/scout/deep-dive/data-handling.md). - -## How are Marketplace extensions vetted for security? - -Security vetting for extensions isn't implemented. Extensions aren't covered as part of Docker's Third-Party Risk Management Program. - -## Can I prevent users from pushing images to Docker Hub private repositories? - -No direct setting exists to disable private repositories. However, [Registry Access Management](/manuals/enterprise/security/hardened-desktop/registry-access-management.md) lets administrators control which registries developers can access through Docker Desktop via Docker Home. diff --git a/content/manuals/security/faqs/networking-and-vms.md b/content/manuals/security/faqs/networking-and-vms.md deleted file mode 100644 index 668697d482a5..000000000000 --- a/content/manuals/security/faqs/networking-and-vms.md +++ /dev/null @@ -1,30 +0,0 @@ ---- -title: Network and VM FAQs -linkTitle: Network and VM -description: Frequently asked questions about Docker Desktop networking and virtualization security -keywords: docker desktop networking, virtualization, hyper-v, wsl2, network security, firewall -weight: 30 -tags: [FAQ] -aliases: -- /faq/security/networking-and-vms/ ---- - -## How can I limit container internet access? - -Docker Desktop doesn't have a built-in mechanism for this, but you can use process-level firewalls on the host. Apply rules to the `com.docker.vpnkit` user-space process to control where it can connect (DNS allowlists, packet filters) and which ports/protocols it can use. - -For enterprise environments, consider [Air-gapped containers](/manuals/enterprise/security/hardened-desktop/air-gapped-containers.md) which provide network access controls for containers. - -## Can I apply firewall rules to container network traffic? - -Yes. Docker Desktop uses a user-space process (`com.docker.vpnkit`) for network connectivity, which inherits constraints like firewall rules, VPN settings, and HTTP proxy properties from the user that launched it. - -## Does Docker Desktop for Windows with Hyper-V allow users to create other VMs? - -No. The `DockerDesktopVM` name is hard-coded in the service, so you cannot use Docker Desktop to create or manipulate other virtual machines. - -## How does Docker Desktop achieve network isolation with Hyper-V and WSL 2? - -Docker Desktop uses the same VM processes for both WSL 2 (in the `docker-desktop` distribution) and Hyper-V (in `DockerDesktopVM`). Host/VM communication uses `AF_VSOCK` hypervisor sockets (shared memory) rather than network switches or interfaces. All host networking is performed using standard TCP/IP sockets from the `com.docker.vpnkit.exe` and `com.docker.backend.exe` processes. - -For more information, see [How Docker Desktop networking works under the hood](https://www.docker.com/blog/how-docker-desktop-networking-works-under-the-hood/). diff --git a/content/manuals/enterprise/security/images/jit-disabled-flow.svg b/content/manuals/security/images/jit-disabled-flow.svg similarity index 100% rename from content/manuals/enterprise/security/images/jit-disabled-flow.svg rename to content/manuals/security/images/jit-disabled-flow.svg diff --git a/content/manuals/enterprise/security/images/jit-enabled-flow.svg b/content/manuals/security/images/jit-enabled-flow.svg similarity index 100% rename from content/manuals/enterprise/security/images/jit-enabled-flow.svg rename to content/manuals/security/images/jit-enabled-flow.svg diff --git a/content/manuals/enterprise/security/provisioning/_index.md b/content/manuals/security/provisioning/_index.md similarity index 94% rename from content/manuals/enterprise/security/provisioning/_index.md rename to content/manuals/security/provisioning/_index.md index 923731988856..3604309d8237 100644 --- a/content/manuals/enterprise/security/provisioning/_index.md +++ b/content/manuals/security/provisioning/_index.md @@ -3,10 +3,16 @@ description: Learn about provisioning users for your SSO configuration. keywords: provision users, provisioning, JIT, SCIM, group mapping, sso, docker admin, admin, security title: Provision users linkTitle: Provision -weight: 20 +weight: 30 aliases: - /security/for-admins/provisioning/ + - /enterprise/security/provisioning/ + - /platform/security/provisioning/ grid: + - title: "Add and manage domains" + description: "Add, verify, and manage domains to control user access and enable auto-provisioning." + icon: globe-alt + link: "domain-management/" - title: "SCIM provisioning" description: "Enable continuous user data synchronization between your IdP and Docker. Best for larger organizations." icon: arrow-path diff --git a/content/manuals/enterprise/security/provisioning/auto-provisioning.md b/content/manuals/security/provisioning/auto-provisioning.md similarity index 85% rename from content/manuals/enterprise/security/provisioning/auto-provisioning.md rename to content/manuals/security/provisioning/auto-provisioning.md index a0ab4c209362..5775aba77022 100644 --- a/content/manuals/enterprise/security/provisioning/auto-provisioning.md +++ b/content/manuals/security/provisioning/auto-provisioning.md @@ -4,6 +4,8 @@ linkTitle: Auto-provision description: Auto-provision users by associating members to your organization when email addresses match a verified domain. keywords: user provisioning, just-in-time provisioning, JIT, autoprovision, Docker Admin, admin, security weight: 30 +aliases: + - /platform/security/provisioning/auto-provisioning/ --- Auto-provisioning automatically adds users to your organization when they sign in with email addresses that match your verified domains. You must verify a domain before enabling auto-provisioning. @@ -20,7 +22,7 @@ When auto-provisioning is enabled for a verified domain: - Auto-provisioning only adds existing Docker users to your organization, it doesn't create new accounts. - Users experience no changes to their sign-in process. - Company and organization owners receive email notifications when new users are added. -- You may need to [manage seats](/manuals/admin/organization/manage/manage-seats.md) to accommodate new users. +- You may need to [manage seats](/manuals/accounts/organization/manage/manage-seats.md) to accommodate new users. ### Enable auto-provisioning @@ -54,5 +56,5 @@ To disable auto-provisioning for a user: To choose a different method to provision users, you can set up: -- [SCIM provisioning](/manuals/enterprise/security/provisioning/scim/_index.md) for advanced user management. -- [Group mapping](/manuals/enterprise/security/provisioning/scim/group-mapping.md) to assign users to teams automatically. +- [SCIM provisioning](/manuals/security/provisioning/scim/_index.md) for advanced user management. +- [Group mapping](/manuals/security/provisioning/scim/group-mapping.md) to assign users to teams automatically. diff --git a/content/manuals/enterprise/security/domain-management.md b/content/manuals/security/provisioning/domain-management.md similarity index 90% rename from content/manuals/enterprise/security/domain-management.md rename to content/manuals/security/provisioning/domain-management.md index 767f58deaa27..f21a26a218cd 100644 --- a/content/manuals/enterprise/security/domain-management.md +++ b/content/manuals/security/provisioning/domain-management.md @@ -2,9 +2,12 @@ title: Add and manage domains description: Add, verify, and manage domains to control user access and enable auto-provisioning in Docker organizations keywords: domain management, domain verification, auto-provisioning, user management, DNS, TXT record, Docker Home -weight: 10 +weight: 5 aliases: - /security/for-admins/domain-management/ + - /enterprise/security/domain-management/ + - /platform/security/domains/domain-management/ + - /platform/security/provisioning/domain-management/ --- {{< summary-bar feature_name="Domain management" >}} @@ -110,14 +113,14 @@ The CSV file contains the following columns: You can bulk invite uncaptured users to your organization using the exported CSV file. For more information on bulk inviting users, see -[Manage organization members](/manuals/admin/organization/manage/members.md). +[Manage organization members](/manuals/accounts/organization/manage/members.md). ## Auto-provisioning -[Auto-provisioning](/manuals/enterprise/security/provisioning/auto-provisioning.md) uses verified domains to associate organization members with email address that match the verified domains. To override auto-provisioning, you can configure one of the two alternative methods: +[Auto-provisioning](/manuals/security/provisioning/auto-provisioning.md) uses verified domains to associate organization members with email address that match the verified domains. To override auto-provisioning, you can configure one of the two alternative methods: -- [Just-in-Time (JIT)](/manuals/enterprise/security/provisioning/just-in-time.md) provisioning -- [System for Cross-domain Identity Management (SCIM)](/manuals/enterprise/security/provisioning/scim/_index.md) +- [Just-in-Time (JIT)](/manuals/security/provisioning/just-in-time.md) provisioning +- [System for Cross-domain Identity Management (SCIM)](/manuals/security/provisioning/scim/_index.md) ## Delete a domain diff --git a/content/manuals/enterprise/security/provisioning/just-in-time.md b/content/manuals/security/provisioning/just-in-time.md similarity index 92% rename from content/manuals/enterprise/security/provisioning/just-in-time.md rename to content/manuals/security/provisioning/just-in-time.md index e2ed13bf3f8e..c6b3af2d9ae2 100644 --- a/content/manuals/enterprise/security/provisioning/just-in-time.md +++ b/content/manuals/security/provisioning/just-in-time.md @@ -6,6 +6,7 @@ linkTitle: Just-in-Time weight: 20 aliases: - /security/for-admins/provisioning/just-in-time/ + - /platform/security/provisioning/just-in-time/ --- {{< summary-bar feature_name="SSO" >}} @@ -79,6 +80,6 @@ Users are provisioned with JIT by default. If you enable SCIM, you can disable J ## Next steps -- Configure [SCIM provisioning](/manuals/enterprise/security/provisioning/scim/_index.md) for advanced user management. -- Set up [group mapping](/manuals/enterprise/security/provisioning/scim/group-mapping.md) to automatically assign users to teams. -- Review [Troubleshoot provisioning](/manuals/enterprise/security/provisioning/troubleshoot-provisioning.md). +- Configure [SCIM provisioning](/manuals/security/provisioning/scim/_index.md) for advanced user management. +- Set up [group mapping](/manuals/security/provisioning/scim/group-mapping.md) to automatically assign users to teams. +- Review [Troubleshoot provisioning](/manuals/security/provisioning/troubleshoot-provisioning.md). diff --git a/content/manuals/enterprise/security/provisioning/scim/_index.md b/content/manuals/security/provisioning/scim/_index.md similarity index 79% rename from content/manuals/enterprise/security/provisioning/scim/_index.md rename to content/manuals/security/provisioning/scim/_index.md index ace0770e759d..68cc5743cd27 100644 --- a/content/manuals/enterprise/security/provisioning/scim/_index.md +++ b/content/manuals/security/provisioning/scim/_index.md @@ -7,6 +7,7 @@ keywords: SCIM, SSO, user provisioning, de-provisioning, role mapping, assign us aliases: - /security/for-admins/scim/ - /security/for-admins/provisioning/scim/ + - /platform/security/provisioning/scim/ --- {{< summary-bar feature_name="SSO" >}} @@ -55,10 +56,10 @@ SCIM automates: > > To remove those users, delete them manually from your Docker organization. > For more information, see -> [Manage organization members](/manuals/admin/organization/manage/members.md). +> [Manage organization members](/manuals/accounts/organization/manage/members.md). ## Next steps -- [Migrate JIT to SCIM](/manuals/enterprise/security/provisioning/scim/migrate-scim.md) if users were provisioned with Just-in-Time (JIT) before you enabled SCIM. -- [Group mapping](/manuals/enterprise/security/provisioning/scim/group-mapping.md) to sync identity provider groups with members. -- [Troubleshoot provisioning](/manuals/enterprise/security/provisioning/troubleshoot-provisioning.md) for SCIM, JIT, and attribute issues. +- [Migrate JIT to SCIM](/manuals/security/provisioning/scim/migrate-scim.md) if users were provisioned with Just-in-Time (JIT) before you enabled SCIM. +- [Group mapping](/manuals/security/provisioning/scim/group-mapping.md) to sync identity provider groups with members. +- [Troubleshoot provisioning](/manuals/security/provisioning/troubleshoot-provisioning.md) for SCIM, JIT, and attribute issues. diff --git a/content/manuals/enterprise/security/provisioning/scim/group-mapping.md b/content/manuals/security/provisioning/scim/group-mapping.md similarity index 97% rename from content/manuals/enterprise/security/provisioning/scim/group-mapping.md rename to content/manuals/security/provisioning/scim/group-mapping.md index 308cad4a8e7e..9813891d9ab6 100644 --- a/content/manuals/enterprise/security/provisioning/scim/group-mapping.md +++ b/content/manuals/security/provisioning/scim/group-mapping.md @@ -7,7 +7,8 @@ aliases: - /admin/organization/security-settings/group-mapping/ - /security/for-admins/group-mapping/ - /security/for-admins/provisioning/scim/group-mapping/ -- /enterprise/security/provisioning/group-mapping/ +- /platform/security/provisioning/group-mapping/ +- /platform/security/provisioning/scim/group-mapping/ weight: 20 --- @@ -194,5 +195,5 @@ Once complete, a user who signs in to Docker through SSO is automatically added ## Next steps -- [Assign roles](/manuals/enterprise/security/roles-and-permissions/core-roles.md) to members of your org. +- [Assign roles](/manuals/security/roles-and-permissions/core-roles.md) to members of your org. - [Enforce sign in](/manuals/enterprise/security/enforce-sign-in.md), if needed. diff --git a/content/manuals/enterprise/security/provisioning/scim/migrate-scim.md b/content/manuals/security/provisioning/scim/migrate-scim.md similarity index 94% rename from content/manuals/enterprise/security/provisioning/scim/migrate-scim.md rename to content/manuals/security/provisioning/scim/migrate-scim.md index 00b62c4f3bbf..9a6a52f6337e 100644 --- a/content/manuals/enterprise/security/provisioning/scim/migrate-scim.md +++ b/content/manuals/security/provisioning/scim/migrate-scim.md @@ -3,6 +3,8 @@ title: Migrate JIT to SCIM linkTitle: Migrate description: Learn how to migrate from just-in-time (JIT) to SCIM. weight: 30 +aliases: + - /platform/security/provisioning/scim/migrate-scim/ --- If you already have users provisioned through Just-in-Time (JIT) and want to @@ -171,10 +173,10 @@ If a user fails to reappear after removal: 4. Check provisioning logs in your identity provider for errors. For more troubleshooting guidance, see -[Troubleshoot provisioning](/manuals/enterprise/security/provisioning/troubleshoot-provisioning.md). +[Troubleshoot provisioning](/manuals/security/provisioning/troubleshoot-provisioning.md). ## Next steps -- Set up [Group mapping](/manuals/enterprise/security/provisioning/scim/group-mapping.md). -- [Assign roles](/manuals/enterprise/security/roles-and-permissions/core-roles.md) to members of your org. +- Set up [Group mapping](/manuals/security/provisioning/scim/group-mapping.md). +- [Assign roles](/manuals/security/roles-and-permissions/core-roles.md) to members of your org. - [Enforce sign in](/manuals/enterprise/security/enforce-sign-in.md), if needed. diff --git a/content/manuals/enterprise/security/provisioning/scim/provision-scim.md b/content/manuals/security/provisioning/scim/provision-scim.md similarity index 94% rename from content/manuals/enterprise/security/provisioning/scim/provision-scim.md rename to content/manuals/security/provisioning/scim/provision-scim.md index 5f7a24703547..e45fbdff0d35 100644 --- a/content/manuals/enterprise/security/provisioning/scim/provision-scim.md +++ b/content/manuals/security/provisioning/scim/provision-scim.md @@ -4,7 +4,7 @@ linkTitle: Setup description: Learn how System for Cross-domain Identity Management works and how to set it up. weight: 10 aliases: - - /enterprise/security/provisioning/scim/ + - /platform/security/provisioning/scim/provision-scim/ --- {{< summary-bar feature_name="SSO" >}} @@ -37,7 +37,7 @@ For additional details about supported attributes and SCIM, see > your SCIM values. > > Alternatively, you can disable JIT provisioning to rely solely on SCIM. -> For details, see [Just-in-Time](/manuals/enterprise/security/provisioning/just-in-time.md). +> For details, see [Just-in-Time](/manuals/security/provisioning/just-in-time.md). ## Enable SCIM in Docker @@ -152,7 +152,7 @@ Next, [set up role mapping](#set-up-role-mapping). ## Set up role mapping -You can assign [Docker roles](/manuals/enterprise/security/roles-and-permissions/_index.md) to +You can assign [Docker roles](/manuals/security/roles-and-permissions/_index.md) to users by adding optional SCIM attributes in your IdP. These attributes override default role and team values set in your SSO configuration. @@ -166,7 +166,7 @@ The following table lists the supported optional user-level attributes: | Attribute | Possible values | Notes | | ------------ | ---------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| `dockerRole` | `member`, `editor`, or `owner` | If not set, the user defaults to the `member` role. Setting this attribute overrides the default.

For role definitions, see [Roles and permissions](/manuals/enterprise/security/roles-and-permissions/_index.md). | +| `dockerRole` | `member`, `editor`, or `owner` | If not set, the user defaults to the `member` role. Setting this attribute overrides the default.

For role definitions, see [Roles and permissions](/manuals/security/roles-and-permissions/_index.md). | | `dockerOrg` | Docker `organizationName` (e.g., `moby`) | Overrides the default organization configured in your SSO connection.

If unset, the user is provisioned to the default organization. If `dockerOrg` and `dockerTeam` are both set, the user is provisioned to the team within the specified organization. | | `dockerTeam` | Docker `teamName` (e.g., `developers`) | Provisions the user to the specified team in the default or specified organization. If the team doesn't exist, it is automatically created.

You can still use [group mapping](group-mapping.md) to assign users to multiple teams across organizations. | @@ -178,7 +178,7 @@ This value is required in your identity provider when creating custom SCIM attri ### Step one: Set up role mapping in Okta -1. Setup [SSO](/manuals/enterprise/security/single-sign-on/connect.md) and SCIM first. +1. Setup [SSO](/manuals/security/authentication/single-sign-on/connect.md) and SCIM first. 1. In the Okta admin portal, go to **Directory**, select **Profile Editor**, and then **User (Default)**. 1. Select **Add Attribute** and configure the values for the role, organization, @@ -221,7 +221,7 @@ group will inherit these attributes upon provisioning. ### Step one: Configure attribute mappings -1. Complete the [SCIM provisioning setup](/manuals/enterprise/security/provisioning/scim/provision-scim.md#enable-scim-in-docker). +1. Complete the [SCIM provisioning setup](/manuals/security/provisioning/scim/provision-scim.md#enable-scim-in-docker). 1. In the Azure Portal, open **Microsoft Entra ID** > **Enterprise Applications**, and select your SCIM application. 1. Go to **Provisioning** > **Mappings** > @@ -230,7 +230,7 @@ group will inherit these attributes upon provisioning. - `userPrincipalName` -> `userName` - `mail` -> `emails.value` - Optional. Map `dockerRole`, `dockerOrg`, or `dockerTeam` using one of the - [mapping methods](/manuals/enterprise/security/provisioning/scim/provision-scim.md#set-up-role-mapping). + [mapping methods](/manuals/security/provisioning/scim/provision-scim.md#set-up-role-mapping). 1. Remove any unsupported attributes to prevent sync errors. 1. Optional. Go to **Mappings** > **Provision Azure Active Directory Groups**: - If group provisioning causes errors, set **Enabled** to **No**. @@ -370,5 +370,5 @@ To disable SCIM: ## Next steps -- Set up [Group mapping](/manuals/enterprise/security/provisioning/scim/group-mapping.md). -- [Troubleshoot provisioning](/manuals/enterprise/security/provisioning/troubleshoot-provisioning.md). +- Set up [Group mapping](/manuals/security/provisioning/scim/group-mapping.md). +- [Troubleshoot provisioning](/manuals/security/provisioning/troubleshoot-provisioning.md). diff --git a/content/manuals/enterprise/security/provisioning/troubleshoot-provisioning.md b/content/manuals/security/provisioning/troubleshoot-provisioning.md similarity index 97% rename from content/manuals/enterprise/security/provisioning/troubleshoot-provisioning.md rename to content/manuals/security/provisioning/troubleshoot-provisioning.md index d682ac63cecf..b61089a19d7b 100644 --- a/content/manuals/enterprise/security/provisioning/troubleshoot-provisioning.md +++ b/content/manuals/security/provisioning/troubleshoot-provisioning.md @@ -7,6 +7,7 @@ tags: [Troubleshooting] toc_max: 2 aliases: - /enterprise/troubleshoot/troubleshoot-provisioning/ + - /platform/security/provisioning/troubleshoot-provisioning/ --- This page helps troubleshoot common user provisioning issues including user roles, attributes, and unexpected account behavior with SCIM and Just-in-Time (JIT) provisioning. diff --git a/content/manuals/enterprise/security/roles-and-permissions/_index.md b/content/manuals/security/roles-and-permissions/_index.md similarity index 88% rename from content/manuals/enterprise/security/roles-and-permissions/_index.md rename to content/manuals/security/roles-and-permissions/_index.md index 54d7e0239879..170e91789d06 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/_index.md +++ b/content/manuals/security/roles-and-permissions/_index.md @@ -8,27 +8,29 @@ keywords: >- Docker organization roles, permissions, core roles, custom roles, Member, Editor, Owner, access control, least privilege, Docker Business, security tags: [admin] +weight: 40 aliases: - /admin/organization/roles/ - /security/for-admins/roles-and-permissions/ - /docker-hub/roles-and-permissions/ + - /enterprise/security/roles-and-permissions/ + - /platform/security/roles-and-permissions/ grid: - title: Core roles description: >- Compare permissions for the built-in Member, Editor, and Owner roles. icon: shield-check - link: /enterprise/security/roles-and-permissions/core-roles/ + link: /security/roles-and-permissions/core-roles/ - title: Custom roles description: >- Build permission sets that match your organization's access control needs. icon: adjustments-horizontal - link: /enterprise/security/roles-and-permissions/custom-roles/ + link: /security/roles-and-permissions/custom-roles/ - title: Custom roles permissions description: >- Review every permission you can assign to a custom role. icon: list-bullet - link: /enterprise/security/roles-and-permissions/custom-roles/permissions-reference/ -weight: 40 + link: /security/roles-and-permissions/custom-roles/permissions-reference/ --- {{< summary-bar feature_name="General admin" >}} diff --git a/content/manuals/enterprise/security/roles-and-permissions/core-roles.md b/content/manuals/security/roles-and-permissions/core-roles.md similarity index 93% rename from content/manuals/enterprise/security/roles-and-permissions/core-roles.md rename to content/manuals/security/roles-and-permissions/core-roles.md index fe2036836c77..9cce5c460480 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/core-roles.md +++ b/content/manuals/security/roles-and-permissions/core-roles.md @@ -8,6 +8,8 @@ keywords: >- permissions, company owner, Docker Hub, Docker Scout, Docker Build Cloud, OIDC, teams, access control, Docker Business, custom roles weight: 10 +aliases: + - /platform/security/roles-and-permissions/core-roles/ --- {{< summary-bar feature_name="General admin" >}} @@ -15,7 +17,7 @@ weight: 10 Docker organizations use built-in Member, Editor, and Owner roles with predefined permissions. This reference compares their permissions across Docker products. To assign a different combination of permissions, use -[custom roles](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md) +[custom roles](/manuals/security/roles-and-permissions/custom-roles/_index.md) instead. ## Core roles @@ -35,7 +37,7 @@ Docker organizations have three core roles: A company owner has the same organization-management permissions as an organization owner. Content and registry permissions, such as repository pull and push, don't apply to company owners. For more information, see -[Company overview](/manuals/admin/company/_index.md). +[Company overview](/manuals/accounts/company/_index.md). ## Permissions reference @@ -103,7 +105,7 @@ Use team permissions for that. > > For more granular access control, > [upgrade to a Docker Business plan](https://www.docker.com/pricing?ref=Docs&refAction=DocsEnterpriseCoreRoles) -> to use [custom roles](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md). +> to use [custom roles](/manuals/security/roles-and-permissions/custom-roles/_index.md). _\* If not part of a company_ @@ -129,9 +131,9 @@ _\* If not part of a company_ ## Next steps -- [Custom roles](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md): +- [Custom roles](/manuals/security/roles-and-permissions/custom-roles/_index.md): Create tailored permission sets on a Docker Business plan -- [Manage organization members](/manuals/admin/organization/manage/members.md): +- [Manage organization members](/manuals/accounts/organization/manage/members.md): Invite users and assign roles -- [Company overview](/manuals/admin/company/_index.md): Understand company +- [Company overview](/manuals/accounts/company/_index.md): Understand company owner permissions versus organization owner permissions diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md b/content/manuals/security/roles-and-permissions/custom-roles/_index.md similarity index 65% rename from content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md rename to content/manuals/security/roles-and-permissions/custom-roles/_index.md index 5df1b9ac6ef5..85e10d2b614a 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md +++ b/content/manuals/security/roles-and-permissions/custom-roles/_index.md @@ -14,25 +14,23 @@ grid: - title: Manage custom roles description: Create, edit, assign, and delete custom roles for users and teams. icon: adjustments-horizontal - link: /enterprise/security/roles-and-permissions/custom-roles/manage/ + link: /security/roles-and-permissions/custom-roles/manage/ - title: Permissions reference description: Review every permission you can assign when building a custom role. icon: list-bullet - link: /enterprise/security/roles-and-permissions/custom-roles/permissions-reference/ + link: /security/roles-and-permissions/custom-roles/permissions-reference/ +aliases: + - /platform/security/roles-and-permissions/custom-roles/ --- {{< summary-bar feature_name="Custom roles" >}} -Custom roles are permission sets that you choose to grant access to users or teams based on specific use cases. Use custom roles when you need: +Custom roles are permission sets that you choose to grant access to users +or teams based on specific use cases. Use custom roles when you need +specialized roles, department-specific access, or least-privilege grants. -- Specialized roles such as billing administrators, security auditors, or - repository managers -- Department-specific access control -- Least-privilege access with precise permission grants - -If Docker's predefined -permission sets meet your needs, use -[core roles](/manuals/enterprise/security/roles-and-permissions/core-roles.md) +If Docker's predefined permission sets meet your needs, use +[core roles](/manuals/security/roles-and-permissions/_index.md) instead. ## Prerequisites @@ -46,8 +44,6 @@ To create a custom role, you select permissions from organization management, Docker Hub, billing, AI Governance, Docker Hardened Images, and Docker Offload. You then assign custom roles you created to individual users or to teams. -Users and teams get either a core role or a custom role, but not both. - ## Next steps {{< grid >}} diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/manage.md b/content/manuals/security/roles-and-permissions/custom-roles/manage.md similarity index 95% rename from content/manuals/enterprise/security/roles-and-permissions/custom-roles/manage.md rename to content/manuals/security/roles-and-permissions/custom-roles/manage.md index 3dbf85e77731..97a57a024831 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/manage.md +++ b/content/manuals/security/roles-and-permissions/custom-roles/manage.md @@ -8,6 +8,8 @@ keywords: >- custom roles, manage custom roles, role assignments, access control, Docker Home, Docker Business, organization roles, permissions, teams weight: 10 +aliases: + - /platform/security/roles-and-permissions/custom-roles/manage/ --- {{< summary-bar feature_name="Custom roles" >}} @@ -158,7 +160,7 @@ To see which users and teams are assigned to roles: - [Custom roles permissions reference](permissions-reference.md): Review permissions you can grant to a custom role -- [Core roles and permissions](/manuals/enterprise/security/roles-and-permissions/core-roles.md): +- [Core roles and permissions](/manuals/security/roles-and-permissions/core-roles.md): Compare built-in Member, Editor, and Owner permissions -- [Manage organization members](/manuals/admin/organization/manage/members.md): +- [Manage organization members](/manuals/accounts/organization/manage/members.md): Invite and manage users in your organization diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md b/content/manuals/security/roles-and-permissions/custom-roles/permissions-reference.md similarity index 96% rename from content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md rename to content/manuals/security/roles-and-permissions/custom-roles/permissions-reference.md index fe210416c740..a697ecdb0b7f 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md +++ b/content/manuals/security/roles-and-permissions/custom-roles/permissions-reference.md @@ -10,6 +10,8 @@ keywords: >- management, billing, AI Governance, access tokens, SSO, SCIM, OIDC, DHI, Docker Offload, security weight: 20 +aliases: + - /platform/security/roles-and-permissions/custom-roles/permissions-reference/ --- {{< summary-bar feature_name="Custom roles" >}} @@ -81,5 +83,5 @@ the following tables to [create or edit a custom role](manage.md). - [Manage custom roles](manage.md): Create, assign, and delete custom roles -- [Core roles and permissions](/manuals/enterprise/security/roles-and-permissions/core-roles.md): +- [Core roles and permissions](/manuals/security/roles-and-permissions/core-roles.md): Compare built-in Member, Editor, and Owner permissions diff --git a/content/manuals/security/security-announcements.md b/content/manuals/security/security-announcements.md index ec3536d9945b..6b30907277a8 100644 --- a/content/manuals/security/security-announcements.md +++ b/content/manuals/security/security-announcements.md @@ -2,12 +2,16 @@ description: Docker security announcements keywords: Docker, CVEs, security, notice, Log4J 2, Log4Shell, Text4Shell, announcements title: Docker security announcements -linkTitle: Security announcements +linkTitle: Announcements outputs: ["HTML", "markdown", "RSS"] layout: security-announcements -weight: 80 +weight: 1 toc_min: 1 toc_max: 2 +aliases: + - /platform/security/resources/security-announcements/ + - /security-announcements/ + - /platform/security/security-announcements/ --- [Subscribe to security RSS feed](/security/security-announcements/index.xml) @@ -64,7 +68,7 @@ A vulnerability in Docker Desktop for Windows was fixed on October 23 in the [4. A vulnerability in Docker Desktop was fixed on September 25 in the [4.47.0](/manuals/desktop/release-notes.md#4470) release: -- Fixed [CVE-2025-10657](https://www.cve.org/CVERecord?id=CVE-2025-10657) where the Enhanced Container Isolation [Docker Socket command restrictions](../enterprise/security/hardened-desktop/enhanced-container-isolation/config.md#command-restrictions) feature was not working properly in Docker Desktop 4.46.0 only (the configuration for it was being ignored). +- Fixed [CVE-2025-10657](https://www.cve.org/CVERecord?id=CVE-2025-10657) where the Enhanced Container Isolation [Docker Socket command restrictions](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/config.md#command-restrictions) feature was not working properly in Docker Desktop 4.46.0 only (the configuration for it was being ignored). ## Docker Desktop 4.44.3 security update: CVE-2025-9074 @@ -117,7 +121,7 @@ We strongly encourage you to update to Docker Desktop [4.34.2](/manuals/desktop/ _Last updated July, 2024_ -When [SSO enforcement](/manuals/enterprise/security/single-sign-on/connect.md) was first introduced, Docker provided a grace period to continue to let passwords be used on the Docker CLI when authenticating to Docker Hub. This was allowed so organizations could more easily use SSO enforcement. It is recommended that administrators configuring SSO encourage users using the CLI [to switch over to Personal Access Tokens](/manuals/enterprise/security/single-sign-on/_index.md#prerequisites) in anticipation of this grace period ending. +When [SSO enforcement](/manuals/security/authentication/single-sign-on/connect.md) was first introduced, Docker provided a grace period to continue to let passwords be used on the Docker CLI when authenticating to Docker Hub. This was allowed so organizations could more easily use SSO enforcement. It is recommended that administrators configuring SSO encourage users using the CLI [to switch over to Personal Access Tokens](/manuals/security/authentication/single-sign-on/_index.md#prerequisites) in anticipation of this grace period ending. On September 16, 2024, the grace period ended and passwords can no longer authenticate to Docker Hub via the Docker CLI when SSO is enforced. Affected users are required to switch over to using PATs to continue signing in. @@ -161,7 +165,7 @@ If you are using affected versions of runc, BuildKit, Moby, or Docker Desktop, m If you are unable to update to an unaffected version promptly, follow these best practices to mitigate risk: -- Only use trusted Docker images (such as [Docker Official Images](../docker-hub/image-library/trusted-content.md#docker-official-images)). +- Only use trusted Docker images (such as [Docker Official Images](/manuals/docker-hub/image-library/trusted-content.md#docker-official-images)). - Don't build Docker images from untrusted sources or untrusted Dockerfiles. - If you are a Docker Business customer using Docker Desktop and unable to update to v4.27.1, make sure to enable [Hardened Docker Desktop](/manuals/enterprise/security/hardened-desktop/_index.md) features such as: - [Enhanced Container Isolation](/manuals/enterprise/security/hardened-desktop/enhanced-container-isolation/_index.md), which mitigates the impact of CVE-2024-21626 in the case of running containers from malicious images. @@ -247,11 +251,11 @@ Docker Hub security scans triggered after 1200 UTC 21 October 2021 are now correctly identifying the Text4Shell CVE. Scans before this date do not currently reflect the status of this vulnerability. Therefore, we recommend that you trigger scans by pushing new images to Docker Hub to view the status of -the Text4Shell CVE in the vulnerability report. For detailed instructions, see [Scan images on Docker Hub](../docker-hub/repos/manage/vulnerability-scanning.md). +the Text4Shell CVE in the vulnerability report. For detailed instructions, see [Scan images on Docker Hub](/manuals/docker-hub/repos/manage/vulnerability-scanning.md). ### Docker Official Images impacted by CVE-2022-42889 -A number of [Docker Official Images](../docker-hub/image-library/trusted-content.md#docker-official-images) contain the vulnerable versions of +A number of [Docker Official Images](/manuals/docker-hub/image-library/trusted-content.md#docker-official-images) contain the vulnerable versions of Apache Commons Text. The following lists Docker Official Images that may contain the vulnerable versions of Apache Commons Text: @@ -297,13 +301,13 @@ Docker Hub security scans triggered after 1700 UTC 13 December 2021 are now correctly identifying the Log4j 2 CVEs. Scans before this date do not currently reflect the status of this vulnerability. Therefore, we recommend that you trigger scans by pushing new images to Docker Hub to view the status of -Log4j 2 CVE in the vulnerability report. For detailed instructions, see [Scan images on Docker Hub](../docker-hub/repos/manage/vulnerability-scanning.md). +Log4j 2 CVE in the vulnerability report. For detailed instructions, see [Scan images on Docker Hub](/manuals/docker-hub/repos/manage/vulnerability-scanning.md). ## Docker Official Images impacted by Log4j 2 CVE _Last updated December 2021_ -A number of [Docker Official Images](../docker-hub/image-library/trusted-content.md#docker-official-images) contain the vulnerable versions of +A number of [Docker Official Images](/manuals/docker-hub/image-library/trusted-content.md#docker-official-images) contain the vulnerable versions of Log4j 2 CVE-2021-44228. The following table lists Docker Official Images that may contained the vulnerable versions of Log4j 2. We updated Log4j 2 in these images to the latest version. Some of these images may not be vulnerable for other reasons. We recommend that you also review the guidelines published on the upstream websites. diff --git a/content/manuals/subscription-billing/_index.md b/content/manuals/subscription-billing/_index.md new file mode 100644 index 000000000000..f098754e56c6 --- /dev/null +++ b/content/manuals/subscription-billing/_index.md @@ -0,0 +1,75 @@ +--- +title: Subscription and billing +linkTitle: Subscription and billing +description: Manage Docker subscriptions, plans, billing, and payments. +keywords: subscription, billing, docker plans, payments, invoices, pricing +weight: 20 +params: + sidebar: + group: Accounts and admin +aliases: + - /subscription/ + - /billing/ + - /docker-hub/billing/ + - /docker-hub/billing/faq/ + - /billing/docker-hub-pricing/ +grid: + - title: Explore plans + description: Browse available Docker plans and add-ons for individuals, teams, and organizations. + link: /subscription-billing/plans/ + icon: chart-bar + - title: Manage billing + description: Manage payment methods, invoices, credits, and billing details in the billing portal. + link: /subscription-billing/manage/ + icon: credit-card +--- + +A Docker plan is a subscription tied to a personal account, an organization +account, or a specific product. When you upgrade a plan, you expand your +usage entitlements and feature sets. You can also top up some plans, +extending usage without changing your plan type. + +## Docker plans + +The following table summarizes the available plans. + +| Plans | Billing model | Types | +| --- | --- | --- | +| [Docker](/manuals/subscription-billing/plans/docker.md) | Flat-rate plans for personal and organization accounts | Docker Personal, Docker Pro, Docker Team, Docker Business | +| [Docker Hardened Images (DHI)](/manuals/subscription-billing/plans/dhi.md) | Graduated security features for hardened container images | DHI Community, DHI Select, DHI Enterprise | +| [Gordon](/manuals/subscription-billing/plans/gordon.md) | Prepaid usage for the Gordon AI agent | Gordon Plus, Gordon Max, Gordon Ultra | +| [AI Governance](/manuals/subscription-billing/plans/ai-governance.md) | Purchase set amount of licenses | AI Governance | +| [Docker Verified Publisher (DVP)](/manuals/subscription-billing/plans/docker-verified-publisher.md) | Annual plans based on consuming domains | DVP Starter, DVP Growth | + +Docker plans that upgrade your account (Docker Pro, Team, and Business) cover +most use cases. Some product plans require an upgraded Docker account. Others +let you subscribe without one. For details, see +[Plans](/manuals/subscription-billing/plans/_index.md). + +## Top up your plan + +Plans come with usage entitlements that can be extended without upgrading to +a different plan. + +| Unit | Description | Examples | +| --- | --- | --- | +| Seats | Each seat extends entitlements to one more member. | Docker Team, Docker Business | +| Licenses | Access to specific products or features. | AI Governance, Docker Offload | +| Minutes | Cloud build capacity, sold in blocks and consumed within the billing period. | Docker Build Cloud | +| Repositories | Additional container repositories covered by security scanning and analysis features. | DHI | +| Consuming domains | Additional consuming domains tracked in publisher analytics, sold in blocks of 25. | DVP Starter, DVP Growth | + +## Manage your plans + +To subscribe to a new plan or upgrade an active plan, see +[Manage plans](/manuals/subscription-billing/manage/plans.md). See +[Docker plans](/manuals/subscription-billing/plans/docker.md) to learn about +Docker Team, Business, and Pro. You can also +contact sales. + +To update payment methods, review usage and credits, or download invoices, see +[Manage billing](/manuals/subscription-billing/manage/_index.md). + +## Next steps + +{{< grid >}} diff --git a/content/manuals/subscription/desktop-license.md b/content/manuals/subscription-billing/desktop-license.md similarity index 97% rename from content/manuals/subscription/desktop-license.md rename to content/manuals/subscription-billing/desktop-license.md index 4b23bbf19ed2..6b83533c8e01 100644 --- a/content/manuals/subscription/desktop-license.md +++ b/content/manuals/subscription-billing/desktop-license.md @@ -2,8 +2,9 @@ title: Docker Desktop license agreement description: Information about Docker Desktop's license agreement and commercial use requirements keywords: docker desktop license, subscription service agreement, commercial use, licensing terms -weight: 40 +weight: 30 aliases: + - /subscription/desktop-license/ - /subscription/products/desktop-license/ - /subscription/plans/desktop-license/ --- diff --git a/content/manuals/billing/3d-secure.md b/content/manuals/subscription-billing/manage/3d-secure.md similarity index 80% rename from content/manuals/billing/3d-secure.md rename to content/manuals/subscription-billing/manage/3d-secure.md index eca8852ca43c..7b17cacc7373 100644 --- a/content/manuals/billing/3d-secure.md +++ b/content/manuals/subscription-billing/manage/3d-secure.md @@ -4,6 +4,8 @@ linkTitle: 3D Secure description: Learn how 3D Secure authentication works for Docker subscription payments and how to troubleshoot verification issues. keywords: billing, payments, subscriptions, 3D Secure, 3DS, credit card verification, payment authentication weight: 30 +aliases: + - /billing/3d-secure/ --- Docker supports 3D Secure (3DS), an extra layer of authentication required @@ -27,10 +29,10 @@ requirements. You may be asked to verify your identity when performing any of the following actions: -- Starting a [paid subscription](../subscription/manage.md) -- Changing your [billing cycle](/manuals/billing/details.md#billing-cycle) from monthly to annual -- [Upgrading your subscription](../subscription/manage.md#upgrade-plans) -- [Adding seats](../admin/organization/manage/manage-seats.md) to an existing +- Starting a [paid subscription](/manuals/subscription-billing/manage/plans.md) +- Changing your [billing cycle](/manuals/subscription-billing/manage/details.md#billing-cycle) from monthly to annual +- [Upgrading your subscription](/manuals/subscription-billing/manage/plans.md#upgrade-plans) +- [Adding seats](/manuals/accounts/organization/manage/manage-seats.md) to an existing subscription If 3DS is required and your payment method supports it, the verification prompt diff --git a/content/manuals/subscription-billing/manage/_index.md b/content/manuals/subscription-billing/manage/_index.md new file mode 100644 index 000000000000..da9471e652de --- /dev/null +++ b/content/manuals/subscription-billing/manage/_index.md @@ -0,0 +1,80 @@ +--- +title: Manage billing +linkTitle: Manage +description: Manage Docker plans, payment methods, billing details, invoices, and taxes. +keywords: manage plans, billing, payment methods, invoices, taxes, docker subscription +weight: 20 +grid: + - title: Manage plans + description: Add a new plan, upgrade an active plan, or cancel auto-renewal. + icon: shopping-cart + link: /subscription-billing/manage/plans/ + - title: Add or update a payment method + description: Add or update a payment method for your personal account or organization. + icon: credit-card + link: /subscription-billing/manage/payment-method/ + - title: Update billing information + description: Update billing information for your personal account or organization. + icon: pencil-square + link: /subscription-billing/manage/details/ + - title: View billing history + description: View billing history and download past invoices. + icon: credit-card + link: /subscription-billing/manage/history/ + - title: 3D Secure authentication + description: Learn how 3DS works and how to troubleshoot verification issues. + icon: wallet + link: /subscription-billing/manage/3d-secure/ + - title: Taxes + description: Submit a US tax exemption certificate or add a VAT number. + icon: document-text + link: /subscription-billing/manage/tax-certificate/ +--- + +You manage Docker plans, payment methods, invoices, credits, and taxes from +Docker Home. Billing is scoped to the account you +select. To manage billing: + +1. Sign in to [Docker Home](https://app.docker.com/), then choose your + personal account or organization. +1. Select **Billing**. +1. Select the page you want in the sidebar, or stay on **Overview**. + +To add or upgrade a plan, see +[Manage plans](/manuals/subscription-billing/manage/plans.md). To compare +plan types, see [Plans](/manuals/subscription-billing/plans/_index.md). + +## Overview + +When you select **Billing**, you are taken to the **Overview** page, where you review active plans, payment +method, and subscription totals for that account. From there you add +self-serve products, manage a plan you already have, or open another +billing page in the sidebar. + +## Invoices + +The billing **Invoices** page lists invoices issued when a plan renews or +changes. You can open an invoice, check payment status, and download a +copy. + +## Usage + +The billing **Usage** page helps you compare usage-based charges across +billing periods. You can track usage by changing the period, product, +and how the product is metered. + +## Costs + +The billing **Costs** page aggregates all costs by billing period. It +breaks down charges by resource (the product accruing a charge), the +status of your billing period, and costs to date. + +## Credits + +The billing **Credits** page shows credits applied to your costs. If you +received a promotional credit, you can see how it applies to your bill +from this page. + +## Next steps + +{{< grid >}} diff --git a/content/manuals/billing/details.md b/content/manuals/subscription-billing/manage/details.md similarity index 88% rename from content/manuals/billing/details.md rename to content/manuals/subscription-billing/manage/details.md index 817272f845df..63bfbaf5b832 100644 --- a/content/manuals/billing/details.md +++ b/content/manuals/subscription-billing/manage/details.md @@ -1,10 +1,11 @@ --- title: Update your billing details -linkTitle: Update details +linkTitle: Billing details weight: 40 description: Learn how to update billing details, like contact information, addresses, and notification email for Docker subscriptions. keywords: payments, billing, subscription, invoices, update billing email, change billing address, Docker billing account aliases: + - /billing/details/ - /billing/cycle/ --- @@ -22,7 +23,7 @@ To update your billing information from **Settings** in Docker Home: 1. Select **Edit** to make your changes. 1. Verify your information, then select **Save as default**. -For more information on changing your default payment method, see [Change default payment method](/manuals/billing/payment-method.md#change-default-payment-method). +For more information on changing your default payment method, see [Change default payment method](/manuals/subscription-billing/manage/payment-method.md#change-default-payment-method). ## Billing notifications @@ -37,4 +38,4 @@ to the billing account's email address. These communications include: Billing cycles are defined on a per-plan basis. Depending on the product you subscribe to, your cycle can be monthly, annual, or another cadence. For -plan-specific billing cycle details, see [Plans](/manuals/subscription/plans/_index.md). +plan-specific billing cycle details, see [Plans](/manuals/subscription-billing/plans/_index.md). diff --git a/content/manuals/billing/history.md b/content/manuals/subscription-billing/manage/history.md similarity index 98% rename from content/manuals/billing/history.md rename to content/manuals/subscription-billing/manage/history.md index c56089369f3b..36f3afbf3708 100644 --- a/content/manuals/billing/history.md +++ b/content/manuals/subscription-billing/manage/history.md @@ -5,6 +5,7 @@ weight: 60 description: Learn how to view your Docker billing history, understand what's on an invoice, and pay by invoice. keywords: payments, billing, subscription, invoices, renewals, billing history, pay by invoice aliases: + - /billing/history/ - /billing/core-billing/history/ --- @@ -58,7 +59,7 @@ Docker finalizes your invoice. For more information, see [Update billing informa ## View renewal date -Renewal dates are set on a per-plan basis, so check each plan individually if you subscribe to more than one. Depending on the product, your billing cycle can be monthly, annual, or another cadence. For plan-specific renewal and billing cycle details, see [Plans](/manuals/subscription/plans/_index.md). +Renewal dates are set on a per-plan basis, so check each plan individually if you subscribe to more than one. Depending on the product, your billing cycle can be monthly, annual, or another cadence. For plan-specific renewal and billing cycle details, see [Plans](/manuals/subscription-billing/plans/_index.md). ## Pay by invoice diff --git a/content/manuals/billing/payment-method.md b/content/manuals/subscription-billing/manage/payment-method.md similarity index 98% rename from content/manuals/billing/payment-method.md rename to content/manuals/subscription-billing/manage/payment-method.md index 6c6a64e274d7..3797c7d269f6 100644 --- a/content/manuals/billing/payment-method.md +++ b/content/manuals/subscription-billing/manage/payment-method.md @@ -5,6 +5,7 @@ weight: 20 description: Learn how to manage cards, US bank accounts, Stripe Link, and pay by invoice for Docker subscriptions. keywords: payments, billing, subscription, payment methods, credit card, ACH, US bank account, Stripe Link, pay by invoice, failed payments aliases: + - /billing/payment-method/ - /billing/core-billing/payment-method/ --- @@ -72,7 +73,7 @@ You can only remove secondary payment methods. To remove a secondary payment met 1. Select the **Actions** menu next to the payment method you want to remove, then select **Remove**. 1. Verify your billing details, then select **Save as default**. -To remove your default payment method, first set a different payment method as default, or [downgrade to a free subscription](/manuals/subscription/plans/docker.md#cancel-a-docker-plan). +To remove your default payment method, first set a different payment method as default, or [downgrade to a free subscription](/manuals/subscription-billing/plans/docker.md#cancel-a-docker-plan). ## Enable and disable pay by invoice diff --git a/content/manuals/subscription/manage.md b/content/manuals/subscription-billing/manage/plans.md similarity index 85% rename from content/manuals/subscription/manage.md rename to content/manuals/subscription-billing/manage/plans.md index 4fcf96dd68a0..1e0d2b021f7a 100644 --- a/content/manuals/subscription/manage.md +++ b/content/manuals/subscription-billing/manage/plans.md @@ -1,14 +1,15 @@ --- title: Manage plans -linkTitle: Manage +linkTitle: Plans description: > Learn how to set up, upgrade, downgrade, or cancel plans, and how to manage auto-renewal and credits. keywords: purchase subscription, buy docker subscription, product catalog, browse products, upgrade subscription, downgrade subscription, docker billing, cancel auto-renewal, cancel, top up, manage -weight: 20 +weight: 10 aliases: + - /subscription/manage/ - /subscription/change/ - /subscription/setup/ - /docker-hub/upgrade/ @@ -61,17 +62,17 @@ You can upgrade active plans from the billing Overview page. > [!TIP] > Billing cycle details vary from plan to plan. Learn more about usage, downgrading, or canceling plans > from the relevant -> [product page](/manuals/subscription/plans/_index.md). +> [product page](/manuals/subscription-billing/plans/_index.md). ## View your credits Docker displays available account credits in the billing portal. Credits offset eligible usage automatically before Docker charges your payment method. To review credit balance and applied credits, see -[Credits](/manuals/billing/_index.md#credits). +[Credits](/manuals/subscription-billing/manage/_index.md#credits). Credits apply to -[Docker Agentic Platform](/manuals/subscription/plans/docker-agentic-platform.md). +[Docker Agentic Platform](/manuals/subscription-billing/plans/docker-agentic-platform.md). When you sign up for Docker Agentic Platform, Docker adds a one-time promotional credit to your account. This credit is non-recurring, doesn't expire, and applies to cloud compute usage only. It doesn't @@ -84,9 +85,9 @@ Some products are sales-led. You must ## Next steps -- [Learn about available plans](/manuals/subscription/plans/_index.md) -- [Set up payment information](/manuals/billing/payment-method.md) -- [View invoices](/manuals/billing/history.md) -- To learn more about managing your billing details, see [Billing](/manuals/billing/_index.md). +- [Learn about available plans](/manuals/subscription-billing/plans/_index.md) +- [Set up payment information](/manuals/subscription-billing/manage/payment-method.md) +- [View invoices](/manuals/subscription-billing/manage/history.md) +- To learn more about managing your billing details, see [Billing](/manuals/subscription-billing/_index.md). - To learn about sales tax and VAT, see - [Taxes](/manuals/billing/tax-certificate.md). + [Taxes](/manuals/subscription-billing/manage/tax-certificate.md). diff --git a/content/manuals/billing/tax-certificate.md b/content/manuals/subscription-billing/manage/tax-certificate.md similarity index 96% rename from content/manuals/billing/tax-certificate.md rename to content/manuals/subscription-billing/manage/tax-certificate.md index 6b6a83b58ab1..4261c1af901d 100644 --- a/content/manuals/billing/tax-certificate.md +++ b/content/manuals/subscription-billing/manage/tax-certificate.md @@ -8,6 +8,8 @@ keywords: billing, sales tax, VAT, tax exemption certificate, tax ID, VAT number, United States tax exemption, Docker Support, billing portal weight: 70 +aliases: + - /billing/tax-certificate/ --- Depending on your location, Docker may collect sales tax or VAT on your @@ -88,4 +90,4 @@ Your VAT number must include your country prefix. For example, enter > existing payment method or billing details in billing settings. Add a VAT number or tax ID when you -[set up a new plan](/manuals/subscription/manage.md#set-up-a-new-plan). \ No newline at end of file +[set up a new plan](/manuals/subscription-billing/manage/plans.md#set-up-a-new-plan). \ No newline at end of file diff --git a/content/manuals/subscription/plans/_index.md b/content/manuals/subscription-billing/plans/_index.md similarity index 52% rename from content/manuals/subscription/plans/_index.md rename to content/manuals/subscription-billing/plans/_index.md index fc7210a22de6..e2999cf023f7 100644 --- a/content/manuals/subscription/plans/_index.md +++ b/content/manuals/subscription-billing/plans/_index.md @@ -6,9 +6,10 @@ description: organizations. keywords: docker products, docker subscriptions, docker core, ai governance, dhi select, - docker build cloud, gordon plans, docker agentic platform, product catalog + docker build cloud, gordon plans, product catalog weight: 10 aliases: + - /subscription/plans/ - /subscription/products/ - /subscription/scale/ - /subscription/details/ @@ -18,23 +19,23 @@ aliases: grid: - title: Docker description: Personal and organization plans, including build and runtime minutes. - link: /subscription/plans/docker/ + link: /subscription-billing/plans/docker/ icon: credit-card - title: Gordon plans description: Usage plans that increase your Gordon allowance. - link: /subscription/plans/gordon/ + link: /subscription-billing/plans/gordon/ icon: /icons/gordon.svg - title: Docker Hardened Images (DHI) description: Hardened image repositories for organization accounts. - link: /subscription/plans/dhi/ + link: /subscription-billing/plans/dhi/ icon: /icons/dhi.svg - title: AI Governance description: Licenses for organization-wide AI policy enforcement. - link: /subscription/plans/ai-governance/ + link: /subscription-billing/plans/ai-governance/ icon: shield-check - title: Docker Verified Publisher (DVP) description: Publisher analytics and reporting plans for organization accounts. - link: /subscription/plans/docker-verified-publisher/ + link: /subscription-billing/plans/docker-verified-publisher/ icon: check-badge --- @@ -42,11 +43,20 @@ grid: > Interested in pricing details? Check out the > pricing page to compare plans. -To subscribe to a plan, see [Manage plans](../manage.md) or [Docker plans](docker.md). Plans can be tied to personal or organization account types, and include options to extend usage limits. +Docker plans attach to a personal account, an organization, or a specific +product. Personal plans (Docker Personal and Docker Pro) upgrade an individual +account. Organization plans (Docker Team and Docker Business) upgrade an +organization. Product add-ons add usage or features without changing that +account's Docker plan type: Gordon increases usage on a personal account, and +DHI, AI Governance, and DVP add product features on an organization. -This section covers usage entitlements, billing cycle, and plan management options for each available plan. +Topping up extends a plan's entitlements, such as seats, licenses, or +minutes, without changing the plan type. For the units you can top up, see +[Top up your plan](/manuals/subscription-billing/_index.md#top-up-your-plan). -To manage your plans by adding a new plan or upgrading an active plan, see [Manage plans](/manuals/subscription/manage.md). +Each plan page covers usage entitlements, billing cycle, and management +options. To add or upgrade a plan, see +[Manage plans](/manuals/subscription-billing/manage/plans.md). ## Product catalog diff --git a/content/manuals/subscription/plans/ai-governance.md b/content/manuals/subscription-billing/plans/ai-governance.md similarity index 78% rename from content/manuals/subscription/plans/ai-governance.md rename to content/manuals/subscription-billing/plans/ai-governance.md index 486e9f12a1be..1f483ef27034 100644 --- a/content/manuals/subscription/plans/ai-governance.md +++ b/content/manuals/subscription-billing/plans/ai-governance.md @@ -9,6 +9,7 @@ keywords: subscription management weight: 50 aliases: + - /subscription/plans/ai-governance/ - /subscription/products/ai-governance/ - /subscription/ai-governance/ --- @@ -22,7 +23,7 @@ aliases: AI Governance lets organization owners enforce [organization policies](/manuals/ai/sandboxes/governance/access-controls/organization.md) for license-holding members. Organization policies override a license-holding member's local policies. -You can [assign AI Governance licenses](/manuals/admin/organization/manage/manage-licenses.md) to any organization member, even if they don't occupy a Docker Team or Docker Business seat. For best practice, review available licenses as you add new members since members without an AI Governance license can still use Docker AI products. +You can [assign AI Governance licenses](/manuals/accounts/organization/manage/manage-licenses.md) to any organization member, even if they don't occupy a Docker Team or Docker Business seat. For best practice, review available licenses as you add new members since members without an AI Governance license can still use Docker AI products. ## Billing cycle diff --git a/content/manuals/subscription/plans/dhi.md b/content/manuals/subscription-billing/plans/dhi.md similarity index 96% rename from content/manuals/subscription/plans/dhi.md rename to content/manuals/subscription-billing/plans/dhi.md index 443ea3ea023d..26c2bbf4d8a9 100644 --- a/content/manuals/subscription/plans/dhi.md +++ b/content/manuals/subscription-billing/plans/dhi.md @@ -9,6 +9,7 @@ keywords: dhi select, dhi enterprise, docker hardened images, hardened images, repositories, organization subscription, secure images weight: 40 aliases: + - /subscription/plans/dhi/ - /subscription/products/dhi-select/ - /subscription/dhi-select/ - /subscription/plans/dhi-select/ @@ -34,7 +35,7 @@ For details on setting up and managing repositories, see [Get started with DHI S ## Billing cycle -DHI Select is an annual plan billed per repository from the date your plan starts. Repositories added mid-cycle are prorated for the remainder of the billing period. You can add more repositories to your DHI Select plan by going to **Active plans** in the billing portal. For steps, see [Manage plans](../manage.md#upgrade-plans). +DHI Select is an annual plan billed per repository from the date your plan starts. Repositories added mid-cycle are prorated for the remainder of the billing period. You can add more repositories to your DHI Select plan by going to **Active plans** in the billing portal. For steps, see [Manage plans](/manuals/subscription-billing/manage/plans.md#upgrade-plans). ## Disable auto-renewal diff --git a/content/manuals/subscription/plans/docker-agentic-platform.md b/content/manuals/subscription-billing/plans/docker-agentic-platform.md similarity index 91% rename from content/manuals/subscription/plans/docker-agentic-platform.md rename to content/manuals/subscription-billing/plans/docker-agentic-platform.md index e0ad92e9a802..fef6a45d5d23 100644 --- a/content/manuals/subscription/plans/docker-agentic-platform.md +++ b/content/manuals/subscription-billing/plans/docker-agentic-platform.md @@ -11,12 +11,14 @@ keywords: compute, usage and billing weight: 20 sitemap: false +aliases: + - /subscription/plans/docker-agentic-platform/ --- > [!TIP] > Docker Agentic Platform signups receive a one-time promotional > credit toward cloud compute usage. To review your balance, see -> [Credits](/manuals/billing/_index.md#credits). +> [Credits](/manuals/subscription-billing/manage/_index.md#credits). [Docker Agentic Platform](https://agentic-platform.docker.com/) is a pay-as-you-go plan for running agent and tool workloads in isolated @@ -77,6 +79,6 @@ the plan period. ## Next steps - To add or cancel a plan, see - [Manage plans](/manuals/subscription/manage.md) + [Manage plans](/manuals/subscription-billing/manage/plans.md) - To track usage across plans, see - [Usage](/manuals/billing/_index.md#usage) + [Usage](/manuals/subscription-billing/manage/_index.md#usage) diff --git a/content/manuals/subscription/plans/docker-verified-publisher.md b/content/manuals/subscription-billing/plans/docker-verified-publisher.md similarity index 98% rename from content/manuals/subscription/plans/docker-verified-publisher.md rename to content/manuals/subscription-billing/plans/docker-verified-publisher.md index f72ce0140475..f71b5aa76b94 100644 --- a/content/manuals/subscription/plans/docker-verified-publisher.md +++ b/content/manuals/subscription-billing/plans/docker-verified-publisher.md @@ -9,6 +9,8 @@ keywords: domains, publisher analytics, organization subscription, apply for dvp, auto-renewal, billing portal, docker hub weight: 60 +aliases: + - /subscription/plans/docker-verified-publisher/ --- [Docker Verified Publisher (DVP)](/manuals/docker-hub/repos/manage/trusted-content/dvp-program.md) diff --git a/content/manuals/subscription/plans/docker.md b/content/manuals/subscription-billing/plans/docker.md similarity index 95% rename from content/manuals/subscription/plans/docker.md rename to content/manuals/subscription-billing/plans/docker.md index 3cb15ca76063..58e19b0c15de 100644 --- a/content/manuals/subscription/plans/docker.md +++ b/content/manuals/subscription-billing/plans/docker.md @@ -10,6 +10,7 @@ keywords: pricing, subscription changes, build cloud minutes, testcontainers minutes weight: 10 aliases: + - /subscription/plans/docker/ - /subscription/plans/core/ - /subscription/products/core/ - /subscription/core/ @@ -39,7 +40,7 @@ Docker Personal and Docker Pro are Docker plans for individual account types whi > [!TIP] > If you're upgrading from a Personal plan to a Team plan > and want to keep your username, -> [convert your user account into an organization](/manuals/admin/organization/setup/convert-account.md). +> [convert your user account into an organization](/manuals/accounts/organization/setup/convert-account.md). ## Billing cycle @@ -61,11 +62,11 @@ For Docker Team and Docker Business, you can purchase more seats for new members 1. Verify your billing details, continue to payment, and complete checkout. To learn how to manage seats from Docker Home, see -[Manage seats](/manuals/admin/organization/manage/manage-seats.md). +[Manage seats](/manuals/accounts/organization/manage/manage-seats.md). ### Docker Offload licenses -[Docker Offload](/manuals/offload/_index.md) licenses are available for Docker Team and Docker Business plans. Once assigned to your account, organization owners can [manage license assignments](/manuals/admin/organization/manage/manage-licenses.md) in Docker Home. +[Docker Offload](/manuals/offload/_index.md) licenses are available for Docker Team and Docker Business plans. Once assigned to your account, organization owners can [manage license assignments](/manuals/accounts/organization/manage/manage-licenses.md) in Docker Home. To add Docker Offload licenses, you must contact sales. diff --git a/content/manuals/subscription/plans/gordon.md b/content/manuals/subscription-billing/plans/gordon.md similarity index 97% rename from content/manuals/subscription/plans/gordon.md rename to content/manuals/subscription-billing/plans/gordon.md index 321ae886bf34..b8dabd5f7d34 100644 --- a/content/manuals/subscription/plans/gordon.md +++ b/content/manuals/subscription-billing/plans/gordon.md @@ -9,6 +9,7 @@ keywords: personal subscription, ai assistant, usage allowance weight: 30 aliases: + - /subscription/plans/gordon/ - /subscription/products/gordon/ - /subscription/gordon/ --- @@ -20,7 +21,7 @@ aliases: - Gordon Max is for power users who rely on Gordon throughout their workflow. It offers a significantly higher usage allowance than Plus. - Gordon Ultra is for developers with the highest usage needs. It provides the maximum monthly allowance available on a self-serve plan. -To upgrade to a Gordon paid plan, see [Manage plans](/manuals/subscription/manage.md). +To upgrade to a Gordon paid plan, see [Manage plans](/manuals/subscription-billing/manage/plans.md). ## Usage diff --git a/content/manuals/subscription/_index.md b/content/manuals/subscription/_index.md deleted file mode 100644 index 029d54cc2aa5..000000000000 --- a/content/manuals/subscription/_index.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: Overview -linkTitle: Subscription -description: Learn about Docker plans, like how to subscribe to product-based plans and how they apply to personal and organization accounts. -keywords: - docker subscription, pricing, billing, subscription types, subscription - plans, docker hardened images, gordon, cloud sandboxes, subscription - management -weight: 20 -params: - sidebar: - group: Platform -grid_subscriptions: - - title: Compare Docker plans - description: Visit the pricing page to see what's included in different Docker plans. - link: "https://www.docker.com/pricing?ref=Docs&refAction=DocsSubscription" - icon: magnifying-glass - - title: Manage plans - description: Add a new plan, upgrade an active plan, or cancel auto-renewal. - link: /subscription/manage/ - icon: shopping-cart - - title: Explore plans - description: Browse available Docker plans and add-ons for individuals, teams, and organizations. - link: /subscription/plans/ - icon: chart-bar - - title: Docker Desktop license agreement - description: Review the terms of the Docker Subscription Service Agreement. - link: /subscription/desktop-license/ - icon: document-text - - title: Plan FAQs - description: Find the answers you need and explore common questions. - link: /subscription/faq/ - icon: question-mark-circle -aliases: - - /docker-hub/billing/ - - /docker-hub/billing/faq/ ---- - -You can subscribe to several Docker plans that range from free to paid plans. When you upgrade a plan, you expand your usage entitlements and feature sets for Docker products. You can also top up some plans, extending usage to more users without changing your plan type. - -## Docker plans - -You can subscribe to plans for individual or organization accounts, or plans for specific products. The following table summarizes the available plans. - -| Plans | Billing model | Types | -| ---------------------------------------------------------------------- | --------------------------------------------------------- | --------------------------------------------------------- | -| [Docker](/manuals/subscription/plans/docker.md) | Flat-rate plans for personal and organization accounts | Docker Personal, Docker Pro, Docker Team, Docker Business | -| [Docker Agentic Platform](/manuals/subscription/plans/docker-agentic-platform.md) | Pay-as-you-go (PayGo) for cloud sandbox usage | Docker Agentic Platform | -| [Docker Hardened Images (DHI)](/manuals/subscription/plans/dhi.md) | Graduated security features for hardened container images | DHI Community, DHI Select, DHI Enterprise | -| [Gordon](/manuals/subscription/plans/gordon.md) | Prepaid usage for the Gordon AI agent | Gordon Plus, Gordon Max, Gordon Ultra | -| [AI Governance](/manuals/subscription/plans/ai-governance.md) | Purchase set amount of licenses | AI Governance | -| [Docker Verified Publisher (DVP)](/manuals/subscription/plans/docker-verified-publisher.md) | Annual plans based on consuming domains | DVP Starter, DVP Growth | - -Docker plans that upgrade your account (Docker Pro or Docker Team and Business) can provide a foundation for most use cases. Some product plans may require an upgraded Docker account while other product plans let you subscribe without an upgraded account. To learn more, see [Docker plans](/manuals/subscription/plans/_index.md). - -## Top up your plan - -Plans come with usage entitlements that can be extended without upgrading to a different plan. - -| Unit | Description | Examples | -| ----------------- | ------------------------------------------------------------------------------------- | ----------------------------- | -| Seats | Each seat extends entitlements to one more member. | Docker Team, Docker Business | -| Licenses | Access to specific products or features. | AI Governance, Docker Offload | -| Minutes | Cloud build capacity, sold in blocks and consumed within the billing period. | Docker Build Cloud | -| Repositories | Additional container repositories covered by security scanning and analysis features. | DHI | -| Consuming domains | Additional consuming domains tracked in publisher analytics, sold in blocks of 25. | DVP Starter, DVP Growth | - -## Manage your plans - -To subscribe to a new plan or upgrade an active plan, see [Manage plans](/manuals/subscription/manage.md). See [Docker plans](/manuals/subscription/plans/docker.md) to learn about Docker Team, Business, and Pro. You can also contact sales. - -## Next steps - -{{< grid items="grid_subscriptions" >}} diff --git a/content/manuals/subscription/faq.md b/content/manuals/subscription/faq.md deleted file mode 100644 index 3c93ac073845..000000000000 --- a/content/manuals/subscription/faq.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Plan FAQs -linkTitle: FAQs -description: Frequently asked questions about Docker subscriptions and billing -keywords: subscription faqs, docker billing, subscription transfer, academic pricing, docker programs -tags: [FAQ] -weight: 30 ---- - -For more information on Docker subscriptions, see [Docker subscription overview](_index.md). - -## Can I transfer my subscription from one user or organization account to another? - -Subscriptions are non-transferable between accounts or organizations. - -## Can I pause or delay my Docker subscription? - -You can't pause or delay a subscription, but you can downgrade your subscription. If a subscription invoice isn't paid by the due date, there's a 15-day grace period starting from the due date. - -## Does Docker offer academic pricing? - -Contact the [Docker Sales Team](https://www.docker.com/company/contact) for information about academic pricing options. - -## How can I contribute to Docker content? - -Docker offers two content contribution programs: - -- [Docker-Sponsored Open Source Program (DSOS)](../docker-hub/repos/manage/trusted-content/dsos-program.md) for open source projects -- [Docker Verified Publisher (DVP)](../docker-hub/repos/manage/trusted-content/dvp-program.md) for commercial publishers - -You can also join the [Developer Preview Program](https://www.docker.com/community/get-involved/developer-preview/) or sign up for early access programs to participate in research and try new features. - -## How do I upgrade to Docker Pro? - -To upgrade to Docker Pro, go to the -Docker pricing page -and select **Buy now**. - -> [!TIP] -> -> Need to upgrade? Compare Docker Team and Docker Business to choose the plan that best fits your team's needs. diff --git a/content/manuals/support/_index.md b/content/manuals/support/_index.md index 6364b9ba9eb2..61e362454496 100644 --- a/content/manuals/support/_index.md +++ b/content/manuals/support/_index.md @@ -6,7 +6,7 @@ keywords: support, help, docker desktop, subscriptions, community, troubleshooti weight: 50 params: sidebar: - group: Platform + group: Accounts and admin --- Docker offers multiple support channels depending on your subscription level and needs. diff --git a/content/manuals/unassociated-machines/_index.md b/content/manuals/unassociated-machines/_index.md index 48e7e9986adb..d99aa6fb601c 100644 --- a/content/manuals/unassociated-machines/_index.md +++ b/content/manuals/unassociated-machines/_index.md @@ -160,9 +160,9 @@ organization in two ways: - Auto-provisioning: If you have verified domains with auto-provisioning enabled, users who sign in with a matching email domain will automatically be added to your organization. For more information on verifying domains and - auto-provisioning, see [Domain management](/enterprise/security/domain-management). + auto-provisioning, see [Domain management](/security/provisioning/domain-management). - SSO user provisioning: If you have SSO configured with - [Just-in-Time provisioning](/manuals/enterprise/security/provisioning/just-in-time.md), + [Just-in-Time provisioning](/manuals/security/provisioning/just-in-time.md), users who sign in through your SSO connection will automatically be added to your organization. - Manual addition: If you don't have auto-provisioning or SSO set up, or if a diff --git a/content/reference/api/hub/latest.yaml b/content/reference/api/hub/latest.yaml index 23a3a63defeb..e1df4223f091 100644 --- a/content/reference/api/hub/latest.yaml +++ b/content/reference/api/hub/latest.yaml @@ -101,7 +101,7 @@ tags: - name: access-tokens x-displayName: Personal Access Tokens description: | - The Personal Access Token endpoints lets you manage personal access tokens. For more information, see [Access Tokens](https://docs.docker.com/security/access-tokens/). + The Personal Access Token endpoints lets you manage personal access tokens. For more information, see [Access Tokens](https://docs.docker.com/security/access-tokens/personal-access-tokens/). You can use a personal access token instead of a password in the [Docker CLI](https://docs.docker.com/engine/reference/commandline/cli/) or in the [Create an authentication token](#operation/PostUsersLogin) route to obtain a bearer token. diff --git a/data/redirects.yml b/data/redirects.yml index 31a717e98e1d..97358aafd940 100644 --- a/data/redirects.yml +++ b/data/redirects.yml @@ -10,7 +10,7 @@ # in its help output, which can be redirected to elsewhere in the documentation. "/learn/": - /learn -"/security/access-tokens/": +"/security/access-tokens/personal-access-tokens/": - /go/access-tokens/ "/agentic-platform/": - /go/dap/ @@ -320,7 +320,7 @@ - /go/settings-management/ # Billing - cancellation -"/subscription/desktop-license/": +"/subscription-billing/desktop-license/": - /go/desktop-license/ "/docker-hub/usage/pulls/": - /go/hub-pull-limits/ diff --git a/data/summary.yaml b/data/summary.yaml index 3aa4b6c78eeb..8bd05925c54b 100644 --- a/data/summary.yaml +++ b/data/summary.yaml @@ -1,3 +1,6 @@ +2FA: + subscription: [Personal, Pro] + for: Individuals AI Governance Audit Logs: subscription: [AI Governance] requires: Docker Sandboxes [0.39.0](/manuals/ai/sandboxes/release-notes.md) or later @@ -261,6 +264,10 @@ MSI installer: for: Administrators OATs: subscription: [Team, Business] + for: Administrators +PATs: + subscription: [Personal, Pro] + for: Individuals Pay by invoice: subscription: [Team, Business] PKG installer: diff --git a/data/whats-new.json b/data/whats-new.json index f70ab9553ee9..a819220b6b45 100644 --- a/data/whats-new.json +++ b/data/whats-new.json @@ -6,7 +6,7 @@ "product": "Docker Verified Publisher", "title": "Join Docker Verified Publisher through self-service plans", "description": "Apply for DVP Starter or Growth, complete checkout after approval, and manage publisher analytics, tracked companies, and billing.", - "url": "/subscription/plans/docker-verified-publisher/", + "url": "/subscription-billing/plans/docker-verified-publisher/", "published": "2026-08-20", "source_prs": [25891, 25903], "featured": true diff --git a/layouts/_shortcodes/summary-bar.html b/layouts/_shortcodes/summary-bar.html index 98f037117756..aa434c1dd17c 100644 --- a/layouts/_shortcodes/summary-bar.html +++ b/layouts/_shortcodes/summary-bar.html @@ -23,12 +23,13 @@ "Retired" "archive-box" }} {{ $requiresIcon := "arrow-down-circle" }} - {{ $forIcon := "shield-check" }} + {{ $forIcons := dict + "Administrators" "shield-check" + "Individuals" "user-circle" + }} -
+
{{ with $feature.subscription }}
Subscription: @@ -75,9 +76,9 @@
For: {{ . }} - {{ if eq . "Administrators" }} + {{ with index $forIcons . }} - {{ partialCached "icon" $forIcon $forIcon }} + {{ partialCached "icon" . . }} {{ end }}