From 77fafa6bf3089085e0b248a92887e5148086f03d Mon Sep 17 00:00:00 2001 From: Alexa Date: Thu, 30 Jul 2026 11:37:28 -0500 Subject: [PATCH 01/12] docs: restructure roles and permissions custom roles IA Remove the core-roles alias that redirected the section overview, and split custom roles into conceptual, manage, and permissions-reference pages. Co-authored-by: Cursor --- .../manuals/ai/sandboxes/governance/org.md | 2 +- content/manuals/build-cloud/_index.md | 6 +- .../security/roles-and-permissions/_index.md | 2 +- .../roles-and-permissions/core-roles.md | 3 +- .../roles-and-permissions/custom-roles.md | 200 ------------------ .../custom-roles/_index.md | 50 +++++ .../custom-roles/manage.md | 143 +++++++++++++ .../custom-roles/permissions-reference.md | 54 +++++ 8 files changed, 253 insertions(+), 207 deletions(-) delete mode 100644 content/manuals/enterprise/security/roles-and-permissions/custom-roles.md create mode 100644 content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md create mode 100644 content/manuals/enterprise/security/roles-and-permissions/custom-roles/manage.md create mode 100644 content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md diff --git a/content/manuals/ai/sandboxes/governance/org.md b/content/manuals/ai/sandboxes/governance/org.md index bedf5c56fa78..b1fe254ee072 100644 --- a/content/manuals/ai/sandboxes/governance/org.md +++ b/content/manuals/ai/sandboxes/governance/org.md @@ -22,7 +22,7 @@ By default, only organization [owners](/manuals/enterprise/security/roles-and-permissions/core-roles.md) can view and manage AI Governance policies. To let someone other than an owner manage policies, create a -[custom role](/manuals/enterprise/security/roles-and-permissions/custom-roles.md) +[custom role](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md) with the **Governance** permissions and assign it to a user or team. > [!NOTE] diff --git a/content/manuals/build-cloud/_index.md b/content/manuals/build-cloud/_index.md index 85a2308b52b7..37901cdc6028 100644 --- a/content/manuals/build-cloud/_index.md +++ b/content/manuals/build-cloud/_index.md @@ -56,12 +56,12 @@ To get started with Docker Build Cloud, to get access to Docker Build Cloud: - Users with a free Personal account can opt-in to a 7-day free trial, with the option -to subscribe for access. To start your free trial, sign in to [Docker Build Cloud Dashboard](https://app.docker.com/build/) and follow the on-screen instructions. + to subscribe for access. To start your free trial, sign in to [Docker Build Cloud Dashboard](https://app.docker.com/build/) and follow the on-screen instructions. - All users with a paid Docker subscription have access to Docker Build Cloud included -with their Docker suite of products. See [Docker subscriptions and features](https://www.docker.com/pricing?ref=Docs&refAction=DocsBuildCloud) for more information. + with their Docker suite of products. See [Docker subscriptions and features](https://www.docker.com/pricing?ref=Docs&refAction=DocsBuildCloud) for more information. Once you've signed up and created a builder, continue by [setting up the builder in your local environment](./setup.md). For information about roles and permissions related to Docker Build Cloud, see -[Roles and Permissions](/manuals/enterprise/security/roles-and-permissions.md#docker-build-cloud-permissions). +[Roles and Permissions](/manuals/enterprise/security/roles-and-permissions/core-roles.md#docker-build-cloud-permissions). diff --git a/content/manuals/enterprise/security/roles-and-permissions/_index.md b/content/manuals/enterprise/security/roles-and-permissions/_index.md index 93e8e8472d4f..e8ea75482616 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/_index.md +++ b/content/manuals/enterprise/security/roles-and-permissions/_index.md @@ -27,7 +27,7 @@ Roles control what users can do in your Docker organization. When you invite use Docker provides two types of roles to meet different organizational needs: - [Core roles](/manuals/enterprise/security/roles-and-permissions/core-roles.md) with predefined permissions -- [Custom roles](/manuals/enterprise/security/roles-and-permissions/custom-roles.md) that you can tailor to your specific requirements +- [Custom roles](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md) that you can tailor to your specific requirements ## Docker roles diff --git a/content/manuals/enterprise/security/roles-and-permissions/core-roles.md b/content/manuals/enterprise/security/roles-and-permissions/core-roles.md index d4ff86b699c8..d01b301547bb 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/core-roles.md +++ b/content/manuals/enterprise/security/roles-and-permissions/core-roles.md @@ -3,8 +3,7 @@ title: Core roles and permissions linkTitle: Core roles description: Compare Member, Editor, and Owner permissions for content, registry, and organization management. keywords: core roles, member, editor, owner, permissions, organization, company, docker hub, docker home, security, oidc connections, teams -aliases: - - /enterprise/security/roles-and-permissions/ +weight: 10 --- {{< summary-bar feature_name="General admin" >}} diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles.md b/content/manuals/enterprise/security/roles-and-permissions/custom-roles.md deleted file mode 100644 index fb94ec2e18cd..000000000000 --- a/content/manuals/enterprise/security/roles-and-permissions/custom-roles.md +++ /dev/null @@ -1,200 +0,0 @@ ---- -title: Custom roles -description: Create tailored permission sets for your organization with custom roles -keywords: custom roles, permissions, access control, organization management, docker hub, docker home, security ---- - -{{< summary-bar feature_name="General admin" >}} - -Custom roles allow you to create tailored permission sets that match your -organization's specific needs. This page covers custom roles and steps -to create and manage them. - -## What are custom roles? - -Custom roles let you create tailored permission sets for your organization. You -can assign custom roles to individual users or teams. -Users and teams get either a core role or custom role, but not both. - -Use custom roles when Docker's core roles don't fit your needs. - -## Prerequisites - -To configure custom roles, you need owner permissions in your Docker -organization. - -## Create a custom role - -Before you can assign a custom role to users, you must create one: - -1. Sign in to [Docker Home](https://app.docker.com). -2. Select **Roles**, then **Create role**. -3. Create a name and describe what the role is for: - - Provide a **Label** - - Enter a unique **Name** identifier (can't be changed later) - - Add an optional **Description** -4. Set permissions for the role by expanding permission categories and selecting - the checkboxes for permissions. For a full list of available permissions, see - the [custom roles permissions reference](#custom-roles-permissions-reference). -5. Select **Review** to review your custom roles configuration and see a summary - of selected permissions. -6. Select **Create**. - -With a custom role created, you can now [assign custom roles to users](#assign-custom-roles). - -## Edit a custom role - -1. Sign in to [Docker Home](https://app.docker.com). -2. Select **Roles**. -3. Find your custom role from the list, and select the **Actions menu**. -4. Select **Edit**. -5. You can edit the following custom role settings: - - Label - - Description - - Permissions -6. After you have finished editing, select **Save**. - -## Assign custom roles - -{{< tabs >}} -{{< tab name="Individual users" >}} - -1. Sign in to [Docker Home](https://app.docker.com). -2. Select **Members**. -3. Locate the member you want to assign a custom role to, then select the - **Actions menu**. -4. In the drop-down, select **Change role**. -5. In the **Select a role** drop-down, select your custom role. -6. Select **Save**. - -{{< /tab >}} -{{< tab name="Bulk users" >}} - -1. Sign in to [Docker Home](https://app.docker.com). -2. Select **Members**. -3. Use the checkboxes in the username column to select all users you want - to assign a custom role to. -4. Select **Change role**. -5. In the **Select a role** drop-down, select your custom role or a core role. -6. Select **Save**. - -{{< /tab >}} -{{< tab name="Teams" >}} - -1. Sign in to [Docker Home](https://app.docker.com). -2. Select **Teams**. -3. Locate the team you want to assign a custom role to, then select - the **Actions menu**. -4. Select **Assign role**. -5. Select your custom role, then select **Assign**. - -The role column will update to the newly assigned role. - -{{< /tab >}} -{{< /tabs >}} - -## View role assignments - -To see which users and teams are assigned to roles: - -1. Sign in to [Docker Home](https://app.docker.com). -2. Select **Roles** -3. In the roles list, view the **Users** and **Teams** columns to see - assignment counts. -4. Select a specific role to view its permissions and assignments in detail. - -## Reassign custom roles - -{{< tabs >}} -{{< tab name="Individual users" >}} - -1. Sign in to [Docker Home](https://app.docker.com). -2. Select **Members**. -3. Locate the member you want to reassign, then select the **Actions menu**. -4. Select **Change role**. -5. In the **Select a role** drop-down, select the new role. -6. Select **Save**. - -{{< /tab >}} -{{< tab name="Bulk users" >}} - -1. Sign in to [Docker Home](https://app.docker.com). -2. Select **Members**. -3. Use the checkboxes in the username column to select all users you want - to reassign. -4. Select **Change role**. -5. In the **Select a role** drop-down, select the new role. -6. Select **Save**. - -{{< /tab >}} -{{< tab name="Teams" >}} - -1. Sign in to [Docker Home](https://app.docker.com). -2. Select **Teams**. -3. Locate the team, then select the **Actions menu**. -4. Select **Change role**. -5. In the pop-up window, select a role from the drop-down menu, then - select **Save**. - -{{< /tab >}} -{{< /tabs >}} - -## Delete a custom role - -Before deleting a custom role, you must reassign all users and teams to different roles. - -1. Sign in to [Docker Home](https://app.docker.com). -2. Select **Roles**. -3. Find your custom role from the list, and select the **Actions menu**. -4. If the role has assigned users or teams: - - Navigate to the **Members** page and change the role for all users assigned to this custom role - - Navigate to the **Teams** page and reassign all teams that have this custom role -5. Once no users or teams are assigned, return to **Roles**. -6. Find your custom role and select the **Actions menu**. -7. Select **Delete**. -8. In the confirmation window, select **Delete** to confirm. - -## Custom roles permissions reference - -Custom roles are built by selecting specific permissions across different categories. The following tables list all available permissions you can assign to a custom role. - -### Organization management - -| Permission | Description | -| :-------------------------------- | :---------------------------------------------------------------------------------------------- | -| View teams | View teams and team members | -| Manage teams | Create, update, and delete teams and team members | -| Manage registry access | Control which registries members can access | -| Manage image access | Set policies for which images members can pull and use | -| Update organization information | Update organization information such as name and location | -| Member management | Manage organization members, invites, and roles | -| View custom roles | View existing custom roles and their permissions | -| Manage custom roles | Full access to custom role management and assignment | -| Manage organization access tokens | Create, update, and delete repositories in this org. Push/pull or registry actions not included | -| View activity logs | Access organization audit logs and activity history | -| View domains | View domains and domain audit settings | -| Manage domains | Manage verified domains and domain audit settings | -| View SSO and SCIM | View single sign-on and user provisioning configurations | -| Manage SSO and SCIM | Full access to SSO and SCIM management | -| Manage Desktop settings | Configure Docker Desktop settings policies and view usage reports | - -### Docker Hub - -| Permission | Description | -| :------------------ | :--------------------------------------------------------- | -| View repositories | View repository details and contents | -| Manage repositories | Create, update, and delete repositories and their contents | - -### Billing - -| Permission | Description | -| :------------- | :----------------------------------------------- | -| View billing | View organization billing information | -| Manage billing | Complete access to managing organization billing | - -### Governance - -| Permission | Description | -| :-------------- | :--------------------------------------------------- | -| View policies | View existing AI Governance policies and their rules | -| Manage policies | Full access to AI Governance policy management | diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md new file mode 100644 index 000000000000..90325c397a05 --- /dev/null +++ b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md @@ -0,0 +1,50 @@ +--- +title: Custom roles +linkTitle: Custom roles +description: Create tailored permission sets that match your organization's specific needs +keywords: custom roles, permissions, access control, organization management, docker hub, docker home, security +weight: 20 +grid: + - title: "Manage custom roles" + description: Create, edit, assign, and delete custom roles for users and teams. + icon: adjustments-horizontal + link: /enterprise/security/roles-and-permissions/custom-roles/manage/ + - title: "Permissions reference" + description: Review all permissions you can assign when building a custom role. + icon: list-bullet + link: /enterprise/security/roles-and-permissions/custom-roles/permissions-reference/ +--- + +{{< summary-bar feature_name="General admin" >}} + +Custom roles let you create tailored permission sets that match your +organization's specific needs. Use custom roles when Docker's core roles +don't fit your access control requirements. + +## What are custom roles? + +Custom roles let you select specific permissions from categories like user +management, team management, billing, and Hub permissions. You can assign +custom roles to individual users or teams. + +Users and teams get either a core role or a custom role, but not both. + +## Prerequisites + +To configure custom roles, you need owner permissions in your Docker +organization. + +## When to use custom roles + +Use custom roles when: + +- You need specific permission combinations not available in core roles +- You want specialized roles like billing administrators, security auditors, + or repository managers +- You need department-specific access control +- You want to implement the principle of least privilege with precise + permission grants + +## Next steps + +{{< grid >}} diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/manage.md b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/manage.md new file mode 100644 index 000000000000..9435bfff5c3f --- /dev/null +++ b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/manage.md @@ -0,0 +1,143 @@ +--- +title: Manage custom roles +linkTitle: Manage +description: Create, edit, assign, reassign, and delete custom roles in your Docker organization +keywords: custom roles, manage roles, create role, assign role, delete role, access control, docker hub, docker home, security +weight: 10 +--- + +{{< summary-bar feature_name="General admin" >}} + +This page covers how to create and manage custom roles, including assigning +them to users and teams. + +## Create a custom role + +Before you can assign a custom role to users, you must create one: + +1. Sign in to [Docker Home](https://app.docker.com). +2. Select **Roles**, then **Create role**. +3. Create a name and describe what the role is for: + - Provide a **Label** + - Enter a unique **Name** identifier (can't be changed later) + - Add an optional **Description** +4. Set permissions for the role by expanding permission categories and selecting + the checkboxes for permissions. For a full list of available permissions, see + the [custom roles permissions reference](permissions-reference.md). +5. Select **Review** to review your custom roles configuration and see a summary + of selected permissions. +6. Select **Create**. + +With a custom role created, you can now [assign custom roles to users](#assign-custom-roles). + +## Edit a custom role + +1. Sign in to [Docker Home](https://app.docker.com). +2. Select **Roles**. +3. Find your custom role from the list, and select the **Actions menu**. +4. Select **Edit**. +5. You can edit the following custom role settings: + - Label + - Description + - Permissions +6. After you have finished editing, select **Save**. + +## Assign custom roles + +{{< tabs >}} +{{< tab name="Individual users" >}} + +1. Sign in to [Docker Home](https://app.docker.com). +2. Select **Members**. +3. Locate the member you want to assign a custom role to, then select the + **Actions menu**. +4. In the drop-down, select **Change role**. +5. In the **Select a role** drop-down, select your custom role. +6. Select **Save**. + +{{< /tab >}} +{{< tab name="Bulk users" >}} + +1. Sign in to [Docker Home](https://app.docker.com). +2. Select **Members**. +3. Use the checkboxes in the username column to select all users you want + to assign a custom role to. +4. Select **Change role**. +5. In the **Select a role** drop-down, select your custom role or a core role. +6. Select **Save**. + +{{< /tab >}} +{{< tab name="Teams" >}} + +1. Sign in to [Docker Home](https://app.docker.com). +2. Select **Teams**. +3. Locate the team you want to assign a custom role to, then select + the **Actions menu**. +4. Select **Assign role**. +5. Select your custom role, then select **Assign**. + +The role column will update to the newly assigned role. + +{{< /tab >}} +{{< /tabs >}} + +## View role assignments + +To see which users and teams are assigned to roles: + +1. Sign in to [Docker Home](https://app.docker.com). +2. Select **Roles**. +3. In the roles list, view the **Users** and **Teams** columns to see + assignment counts. +4. Select a specific role to view its permissions and assignments in detail. + +## Reassign custom roles + +{{< tabs >}} +{{< tab name="Individual users" >}} + +1. Sign in to [Docker Home](https://app.docker.com). +2. Select **Members**. +3. Locate the member you want to reassign, then select the **Actions menu**. +4. Select **Change role**. +5. In the **Select a role** drop-down, select the new role. +6. Select **Save**. + +{{< /tab >}} +{{< tab name="Bulk users" >}} + +1. Sign in to [Docker Home](https://app.docker.com). +2. Select **Members**. +3. Use the checkboxes in the username column to select all users you want + to reassign. +4. Select **Change role**. +5. In the **Select a role** drop-down, select the new role. +6. Select **Save**. + +{{< /tab >}} +{{< tab name="Teams" >}} + +1. Sign in to [Docker Home](https://app.docker.com). +2. Select **Teams**. +3. Locate the team, then select the **Actions menu**. +4. Select **Change role**. +5. In the pop-up window, select a role from the drop-down menu, then + select **Save**. + +{{< /tab >}} +{{< /tabs >}} + +## Delete a custom role + +Before deleting a custom role, you must reassign all users and teams to different roles. + +1. Sign in to [Docker Home](https://app.docker.com). +2. Select **Roles**. +3. Find your custom role from the list, and select the **Actions menu**. +4. If the role has assigned users or teams: + - Navigate to the **Members** page and change the role for all users assigned to this custom role + - Navigate to the **Teams** page and reassign all teams that have this custom role +5. Once no users or teams are assigned, return to **Roles**. +6. Find your custom role and select the **Actions menu**. +7. Select **Delete**. +8. In the confirmation window, select **Delete** to confirm. diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md new file mode 100644 index 000000000000..0a20ebb24f3a --- /dev/null +++ b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md @@ -0,0 +1,54 @@ +--- +title: Custom roles permissions reference +linkTitle: Permissions reference +description: Reference of all permissions available when creating custom roles in Docker +keywords: custom roles, permissions reference, organization management, billing, docker hub, governance, access control, security +weight: 20 +--- + +{{< summary-bar feature_name="General admin" >}} + +Custom roles are built by selecting specific permissions across different +categories. The following tables list all available permissions you can assign +to a custom role. + +## Organization management + +| Permission | Description | +| :-------------------------------- | :---------------------------------------------------------------------------------------------- | +| View teams | View teams and team members | +| Manage teams | Create, update, and delete teams and team members | +| Manage registry access | Control which registries members can access | +| Manage image access | Set policies for which images members can pull and use | +| Update organization information | Update organization information such as name and location | +| Member management | Manage organization members, invites, and roles | +| View custom roles | View existing custom roles and their permissions | +| Manage custom roles | Full access to custom role management and assignment | +| Manage organization access tokens | Create, update, and delete repositories in this org. Push/pull or registry actions not included | +| View activity logs | Access organization audit logs and activity history | +| View domains | View domains and domain audit settings | +| Manage domains | Manage verified domains and domain audit settings | +| View SSO and SCIM | View single sign-on and user provisioning configurations | +| Manage SSO and SCIM | Full access to SSO and SCIM management | +| Manage Desktop settings | Configure Docker Desktop settings policies and view usage reports | + +## Docker Hub + +| Permission | Description | +| :------------------ | :--------------------------------------------------------- | +| View repositories | View repository details and contents | +| Manage repositories | Create, update, and delete repositories and their contents | + +## Billing + +| Permission | Description | +| :------------- | :----------------------------------------------- | +| View billing | View organization billing information | +| Manage billing | Complete access to managing organization billing | + +## Governance + +| Permission | Description | +| :-------------- | :--------------------------------------------------- | +| View policies | View existing AI Governance policies and their rules | +| Manage policies | Full access to AI Governance policy management | From 703c4aa3e34e4ba811337bb55dad4b97ed4e48a0 Mon Sep 17 00:00:00 2001 From: Alexa Date: Thu, 30 Jul 2026 11:44:06 -0500 Subject: [PATCH 02/12] docs: freshen roles and permissions content Apply tier 1 and tier 2 freshness to the roles section: tighten SEO and style, clarify structure, and fix the org access token permission text. Co-authored-by: Cursor --- .../security/roles-and-permissions/_index.md | 78 +++++---- .../roles-and-permissions/core-roles.md | 63 ++++---- .../custom-roles/_index.md | 34 ++-- .../custom-roles/manage.md | 149 ++++++++++-------- .../custom-roles/permissions-reference.md | 53 ++++--- 5 files changed, 217 insertions(+), 160 deletions(-) diff --git a/content/manuals/enterprise/security/roles-and-permissions/_index.md b/content/manuals/enterprise/security/roles-and-permissions/_index.md index e8ea75482616..7283bd0445e6 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/_index.md +++ b/content/manuals/enterprise/security/roles-and-permissions/_index.md @@ -1,8 +1,8 @@ --- -title: Roles and permissions +title: Roles and permissions overview linkTitle: Roles and permissions -description: Control access to content, registry, and organization management with Docker's role system -keywords: roles, permissions, custom roles, core roles, access control, organization management, docker hub, docker home , security +description: Choose core or custom roles to control access to repositories, teams, and organization settings +keywords: roles, permissions, core roles, custom roles, member, editor, owner, access control, organization, docker hub, docker home, security tags: [admin] aliases: - /admin/organization/roles/ @@ -22,54 +22,72 @@ weight: 40 {{< summary-bar feature_name="General admin" >}} -Roles control what users can do in your Docker organization. When you invite users or create teams, you assign them roles that determine their permissions for repositories, teams, and organization settings. +Roles control what users can do in your Docker organization. When you invite +users or create teams, you assign roles that determine their permissions for +repositories, teams, and organization settings. -Docker provides two types of roles to meet different organizational needs: +Docker provides two role types: -- [Core roles](/manuals/enterprise/security/roles-and-permissions/core-roles.md) with predefined permissions -- [Custom roles](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md) that you can tailor to your specific requirements +- [Core roles](/manuals/enterprise/security/roles-and-permissions/core-roles.md): + Built-in Member, Editor, and Owner roles with predefined permissions +- [Custom roles](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md): + Permission sets you define for your organization's needs -## Docker roles +## Core roles -### Core roles +Core roles are Docker's built-in roles: -Core roles are Docker's built-in roles with predefined permission sets: +- **Member**: Basic access. Members can view other organization members and + pull images from repositories they have access to. +- **Editor**: Partial administrative access. Editors can create, edit, and + delete repositories, and manage team permissions for repositories. +- **Owner**: Full administrative access. Owners can manage all organization + settings, including repositories, teams, members, billing, and security + features. -- **Member**: Non-administrative role with basic access. Members can view other organization members and pull images from repositories they have access to. -- **Editor**: Partial administrative access. Editors can create, edit, and delete repositories, and manage team permissions for repositories. -- **Owner**: Full administrative access. Owners can manage all organization settings, including repositories, teams, members, billing, and security features. +For a full permission comparison, see +[Core roles and permissions](/manuals/enterprise/security/roles-and-permissions/core-roles.md). -### Custom roles +## Custom roles -Custom roles allow you to create tailored permission sets by selecting specific permissions from categories like user management, team management, billing, and Hub permissions. Use custom roles when Docker's core roles don't fit your needs. +Custom roles let you select specific permissions from categories such as +user management, team management, billing, and Hub. Use them when core roles +don't match your access control needs. -## When to use each role +Custom roles require a Docker Business subscription and owner permissions. +For details, see +[Custom roles](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md). + +## When to use each role type Use core roles when: -- Docker's predefined permission sets match your organizational structure -- You want simple, straightforward role assignments -- You're getting started with Docker organization management -- Your access control needs are standard and don't require fine-grained permissions +- Docker's predefined permission sets match your structure +- You want simple role assignments +- Your access control needs are standard Use custom roles when: -- You need specific permission combinations not available in core roles -- You want to create specialized roles like billing administrators, security auditors, or repository managers -- You need department-specific access control -- You want to implement the principle of least privilege with precise permission grants +- You need permission combinations not available in core roles +- You want specialized roles such as billing administrators or security + auditors +- You need department-specific or least-privilege access control -## How roles work together +## How roles work with team permissions -You can assign users and teams either a core role or a custom role, but not both. However, roles work in combination with team permissions: +You can assign users and teams either a core role or a custom role, but not +both. Roles also work with team permissions: -1. **Role permissions**: Applied organization-wide (core or custom role). Custom roles can grant permissions to both organization-wide settings and repository access. -2. **Team permissions**: Additional repository-specific permissions when users are added to teams. This is a separate permission system from role-based permissions. +1. **Role permissions**: Apply organization-wide. Custom roles can grant + organization settings and repository management permissions. +1. **Team permissions**: Grant additional repository-specific access when + users join teams. This is separate from role-based permissions. -This layered approach gives you flexibility to provide broad organizational access through roles and specific repository access through team memberships. +This layered model lets you grant broad organizational access through roles +and specific repository access through team memberships. ## Next steps -Choose the role type that best fits your organization's needs: +Choose the role type that fits your organization: {{< grid >}} diff --git a/content/manuals/enterprise/security/roles-and-permissions/core-roles.md b/content/manuals/enterprise/security/roles-and-permissions/core-roles.md index d01b301547bb..4900636322d3 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/core-roles.md +++ b/content/manuals/enterprise/security/roles-and-permissions/core-roles.md @@ -1,37 +1,38 @@ --- title: Core roles and permissions linkTitle: Core roles -description: Compare Member, Editor, and Owner permissions for content, registry, and organization management. -keywords: core roles, member, editor, owner, permissions, organization, company, docker hub, docker home, security, oidc connections, teams +description: Compare Member, Editor, and Owner permissions for content, registry, organization, Scout, and Build Cloud +keywords: core roles, member, editor, owner, permissions, organization, company, docker hub, docker scout, docker build cloud, oidc, teams, security weight: 10 --- {{< summary-bar feature_name="General admin" >}} -Core roles are Docker's built-in roles with predefined permission sets. -This page summarizes permissions for each core role. +Core roles are Docker's built-in roles with predefined permission sets. This +page compares what Member, Editor, and Owner can do across content, registry, +organization management, Docker Scout, and Docker Build Cloud. -## What are core roles? +## Core role summary Docker organizations have three core roles: -- **Member**: Non-administrative role with basic access. Members can - view other organization members and pull images from repositories - they have access to. -- **Editor**: Partial administrative access. Editors can create, edit, - and delete repositories. They can also manage team permissions for +- **Member**: Non-administrative role with basic access. Members can view + other organization members and pull images from repositories they have + access to. +- **Editor**: Partial administrative access. Editors can create, edit, and + delete repositories. They can also manage team permissions for repositories. -- **Owner**: Full administrative access. Owners can manage all - organization settings, including repositories, teams, members, - billing, and security features. +- **Owner**: Full administrative access. Owners can manage all organization + settings, including repositories, teams, members, billing, and security + features. A company owner has the same organization management permissions as an -organization owner, but there are some content and registry permissions -that company owners don't have (for example, repository pull/push). For -more information, see +organization owner, but some content and registry permissions don't apply +to company owners (for example, repository pull and push). For more +information, see [Company overview](/manuals/admin/company/_index.md). -### Content and registry permissions +## Content and registry permissions These permissions apply organization-wide. @@ -56,18 +57,17 @@ These permissions apply organization-wide. | Assign team permissions to repositories | ❌ | ✅ | ✅ | | Manage OIDC connections | ❌ | ✅ | ✅ | -You can grant repository permissions to members beyond their -organization role: +You can grant repository permissions beyond a member's organization role: - Role permissions: Applied organization-wide (member or editor) - Team permissions: Additional permissions for specific repositories To extend access to private repositories, configure team permissions. -Custom roles can grant organization-wide permissions to manage -repositories (create, edit, delete) but do not grant pull access to -private repositories — use team permissions for that. +Custom roles can grant organization-wide permissions to manage repositories +(create, edit, delete) but don't grant pull access to private repositories. +Use team permissions for that. -### Organization management permissions +## Organization management permissions | Permission | Member | Editor | Owner | | :---------------------------------------------------------------- | :----- | :----- | :---- | @@ -94,13 +94,13 @@ private repositories — use team permissions for that. > [!TIP] > -> If you want more granular access control, you can +> For more granular access control, > [upgrade to a Docker Business plan](https://www.docker.com/pricing?ref=Docs&refAction=DocsEnterpriseCoreRoles) -> for custom roles and advanced permissions. +> to use [custom roles](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md). _\* If not part of a company_ -### Docker Scout permissions +## Docker Scout permissions | Permission | Member | Editor | Owner | | :---------------------------------------------------- | :----- | :----- | :---- | @@ -110,7 +110,7 @@ _\* If not part of a company_ | Create environments | ❌ | ❌ | ✅ | | Manage registry integrations | ❌ | ❌ | ✅ | -### Docker Build Cloud permissions +## Docker Build Cloud permissions | Permission | Member | Editor | Owner | | -------------------------- | :----- | :----- | :---- | @@ -119,3 +119,12 @@ _\* If not part of a company_ | Configure builder settings | ✅ | ✅ | ✅ | | Buy minutes | ❌ | ❌ | ✅ | | Manage subscription | ❌ | ❌ | ✅ | + +## Next steps + +- [Custom roles](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md): + Create tailored permission sets on a Docker Business plan +- [Manage organization members](/manuals/admin/organization/manage/members.md): + Invite users and assign roles +- [Company overview](/manuals/admin/company/_index.md): Understand company + owner permissions versus organization owner permissions diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md index 90325c397a05..d8c47d4179c4 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md +++ b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md @@ -1,8 +1,8 @@ --- -title: Custom roles +title: Custom roles overview linkTitle: Custom roles -description: Create tailored permission sets that match your organization's specific needs -keywords: custom roles, permissions, access control, organization management, docker hub, docker home, security +description: Learn when to use custom roles and how they differ from Docker's built-in core roles +keywords: custom roles, permissions, access control, least privilege, docker business, organization management, docker hub, docker home, security weight: 20 grid: - title: "Manage custom roles" @@ -17,33 +17,35 @@ grid: {{< summary-bar feature_name="General admin" >}} -Custom roles let you create tailored permission sets that match your -organization's specific needs. Use custom roles when Docker's core roles -don't fit your access control requirements. +Custom roles let you build permission sets that match your organization's +access control needs. Use them when Docker's +[core roles](/manuals/enterprise/security/roles-and-permissions/core-roles.md) +don't provide the right combination of permissions. ## What are custom roles? -Custom roles let you select specific permissions from categories like user -management, team management, billing, and Hub permissions. You can assign -custom roles to individual users or teams. +With custom roles, you select permissions from categories such as user +management, team management, billing, Hub, and governance. You can assign a +custom role to individual users or to teams. Users and teams get either a core role or a custom role, but not both. ## Prerequisites -To configure custom roles, you need owner permissions in your Docker -organization. +To configure custom roles, you need: + +- A Docker Business subscription +- Owner permissions in your Docker organization ## When to use custom roles Use custom roles when: -- You need specific permission combinations not available in core roles -- You want specialized roles like billing administrators, security auditors, - or repository managers +- You need permission combinations not available in core roles +- You want specialized roles such as billing administrators, security + auditors, or repository managers - You need department-specific access control -- You want to implement the principle of least privilege with precise - permission grants +- You want least-privilege access with precise permission grants ## Next steps diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/manage.md b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/manage.md index 9435bfff5c3f..bc7a7721d269 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/manage.md +++ b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/manage.md @@ -1,46 +1,50 @@ --- -title: Manage custom roles +title: Create and manage custom roles linkTitle: Manage -description: Create, edit, assign, reassign, and delete custom roles in your Docker organization -keywords: custom roles, manage roles, create role, assign role, delete role, access control, docker hub, docker home, security +description: Create, edit, assign, reassign, and delete custom roles for users and teams +keywords: custom roles, create role, assign role, edit role, delete role, reassign role, manage roles, access control, docker home, security weight: 10 --- {{< summary-bar feature_name="General admin" >}} -This page covers how to create and manage custom roles, including assigning -them to users and teams. +This page shows how to create custom roles, change their permissions, and +assign them to users and teams. For the full list of permissions you can +grant, see the +[custom roles permissions reference](permissions-reference.md). ## Create a custom role -Before you can assign a custom role to users, you must create one: +Before you can assign a custom role, create one: 1. Sign in to [Docker Home](https://app.docker.com). -2. Select **Roles**, then **Create role**. -3. Create a name and describe what the role is for: +1. Select **Roles**, then **Create role**. +1. Create a name and describe what the role is for: - Provide a **Label** - Enter a unique **Name** identifier (can't be changed later) - Add an optional **Description** -4. Set permissions for the role by expanding permission categories and selecting - the checkboxes for permissions. For a full list of available permissions, see - the [custom roles permissions reference](permissions-reference.md). -5. Select **Review** to review your custom roles configuration and see a summary - of selected permissions. -6. Select **Create**. +1. Set permissions for the role by expanding permission categories and + selecting the checkboxes for permissions. For a full list of available + permissions, see the + [custom roles permissions reference](permissions-reference.md). +1. Select **Review** to review your configuration and see a summary of + selected permissions. +1. Select **Create**. -With a custom role created, you can now [assign custom roles to users](#assign-custom-roles). +After you create a custom role, you can +[assign it to users or teams](#assign-custom-roles). ## Edit a custom role 1. Sign in to [Docker Home](https://app.docker.com). -2. Select **Roles**. -3. Find your custom role from the list, and select the **Actions menu**. -4. Select **Edit**. -5. You can edit the following custom role settings: +1. Select **Roles**. +1. Find your custom role in the list, then select the **Actions** menu. +1. Select **Edit**. +1. Edit any of the following settings: - Label - Description - Permissions -6. After you have finished editing, select **Save**. +1. Select **Save**. ## Assign custom roles @@ -48,35 +52,36 @@ With a custom role created, you can now [assign custom roles to users](#assign-c {{< tab name="Individual users" >}} 1. Sign in to [Docker Home](https://app.docker.com). -2. Select **Members**. -3. Locate the member you want to assign a custom role to, then select the - **Actions menu**. -4. In the drop-down, select **Change role**. -5. In the **Select a role** drop-down, select your custom role. -6. Select **Save**. +1. Select **Members**. +1. Locate the member you want to assign a custom role to, then select the + **Actions** menu. +1. Select **Change role**. +1. In the **Select a role** drop-down, select your custom role. +1. Select **Save**. {{< /tab >}} {{< tab name="Bulk users" >}} 1. Sign in to [Docker Home](https://app.docker.com). -2. Select **Members**. -3. Use the checkboxes in the username column to select all users you want +1. Select **Members**. +1. Use the checkboxes in the username column to select the users you want to assign a custom role to. -4. Select **Change role**. -5. In the **Select a role** drop-down, select your custom role or a core role. -6. Select **Save**. +1. Select **Change role**. +1. In the **Select a role** drop-down, select your custom role or a core + role. +1. Select **Save**. {{< /tab >}} {{< tab name="Teams" >}} 1. Sign in to [Docker Home](https://app.docker.com). -2. Select **Teams**. -3. Locate the team you want to assign a custom role to, then select - the **Actions menu**. -4. Select **Assign role**. -5. Select your custom role, then select **Assign**. +1. Select **Teams**. +1. Locate the team you want to assign a custom role to, then select the + **Actions** menu. +1. Select **Assign role**. +1. Select your custom role, then select **Assign**. -The role column will update to the newly assigned role. +The role column updates to the newly assigned role. {{< /tab >}} {{< /tabs >}} @@ -86,10 +91,10 @@ The role column will update to the newly assigned role. To see which users and teams are assigned to roles: 1. Sign in to [Docker Home](https://app.docker.com). -2. Select **Roles**. -3. In the roles list, view the **Users** and **Teams** columns to see +1. Select **Roles**. +1. In the roles list, view the **Users** and **Teams** columns for assignment counts. -4. Select a specific role to view its permissions and assignments in detail. +1. Select a role to view its permissions and assignments in detail. ## Reassign custom roles @@ -97,47 +102,61 @@ To see which users and teams are assigned to roles: {{< tab name="Individual users" >}} 1. Sign in to [Docker Home](https://app.docker.com). -2. Select **Members**. -3. Locate the member you want to reassign, then select the **Actions menu**. -4. Select **Change role**. -5. In the **Select a role** drop-down, select the new role. -6. Select **Save**. +1. Select **Members**. +1. Locate the member you want to reassign, then select the **Actions** + menu. +1. Select **Change role**. +1. In the **Select a role** drop-down, select the new role. +1. Select **Save**. {{< /tab >}} {{< tab name="Bulk users" >}} 1. Sign in to [Docker Home](https://app.docker.com). -2. Select **Members**. -3. Use the checkboxes in the username column to select all users you want +1. Select **Members**. +1. Use the checkboxes in the username column to select the users you want to reassign. -4. Select **Change role**. -5. In the **Select a role** drop-down, select the new role. -6. Select **Save**. +1. Select **Change role**. +1. In the **Select a role** drop-down, select the new role. +1. Select **Save**. {{< /tab >}} {{< tab name="Teams" >}} 1. Sign in to [Docker Home](https://app.docker.com). -2. Select **Teams**. -3. Locate the team, then select the **Actions menu**. -4. Select **Change role**. -5. In the pop-up window, select a role from the drop-down menu, then - select **Save**. +1. Select **Teams**. +1. Locate the team, then select the **Actions** menu. +1. Select **Change role**. +1. In the pop-up window, select a role from the drop-down, then select + **Save**. {{< /tab >}} {{< /tabs >}} ## Delete a custom role -Before deleting a custom role, you must reassign all users and teams to different roles. +> [!IMPORTANT] +> +> Before you delete a custom role, reassign every user and team that uses +> it to a different role. 1. Sign in to [Docker Home](https://app.docker.com). -2. Select **Roles**. -3. Find your custom role from the list, and select the **Actions menu**. -4. If the role has assigned users or teams: - - Navigate to the **Members** page and change the role for all users assigned to this custom role - - Navigate to the **Teams** page and reassign all teams that have this custom role -5. Once no users or teams are assigned, return to **Roles**. -6. Find your custom role and select the **Actions menu**. -7. Select **Delete**. -8. In the confirmation window, select **Delete** to confirm. +1. Select **Roles**. +1. Find your custom role in the list, then select the **Actions** menu. +1. If the role has assigned users or teams: + - On the **Members** page, change the role for every user assigned to + this custom role + - On the **Teams** page, reassign every team that has this custom role +1. When no users or teams are assigned, return to **Roles**. +1. Find your custom role and select the **Actions** menu. +1. Select **Delete**. +1. In the confirmation window, select **Delete** to confirm. + +## Next steps + +- [Custom roles permissions reference](permissions-reference.md): Review + permissions you can grant to a custom role +- [Core roles and permissions](/manuals/enterprise/security/roles-and-permissions/core-roles.md): + Compare built-in Member, Editor, and Owner permissions +- [Manage organization members](/manuals/admin/organization/manage/members.md): + Invite and manage users in your organization diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md index 0a20ebb24f3a..863114db6dcb 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md +++ b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md @@ -1,36 +1,36 @@ --- title: Custom roles permissions reference linkTitle: Permissions reference -description: Reference of all permissions available when creating custom roles in Docker -keywords: custom roles, permissions reference, organization management, billing, docker hub, governance, access control, security +description: Reference of permissions you can assign when creating custom roles in Docker +keywords: custom roles, permissions reference, organization management, billing, docker hub, governance, access tokens, sso, scim, security weight: 20 --- {{< summary-bar feature_name="General admin" >}} -Custom roles are built by selecting specific permissions across different -categories. The following tables list all available permissions you can assign -to a custom role. +Custom roles are built from permissions across several categories. Use the +tables on this page when you +[create or edit a custom role](manage.md). ## Organization management -| Permission | Description | -| :-------------------------------- | :---------------------------------------------------------------------------------------------- | -| View teams | View teams and team members | -| Manage teams | Create, update, and delete teams and team members | -| Manage registry access | Control which registries members can access | -| Manage image access | Set policies for which images members can pull and use | -| Update organization information | Update organization information such as name and location | -| Member management | Manage organization members, invites, and roles | -| View custom roles | View existing custom roles and their permissions | -| Manage custom roles | Full access to custom role management and assignment | -| Manage organization access tokens | Create, update, and delete repositories in this org. Push/pull or registry actions not included | -| View activity logs | Access organization audit logs and activity history | -| View domains | View domains and domain audit settings | -| Manage domains | Manage verified domains and domain audit settings | -| View SSO and SCIM | View single sign-on and user provisioning configurations | -| Manage SSO and SCIM | Full access to SSO and SCIM management | -| Manage Desktop settings | Configure Docker Desktop settings policies and view usage reports | +| Permission | Description | +| :-------------------------------- | :---------------------------------------------------------------- | +| View teams | View teams and team members | +| Manage teams | Create, update, and delete teams and team members | +| Manage registry access | Control which registries members can access | +| Manage image access | Set policies for which images members can pull and use | +| Update organization information | Update organization information such as name and location | +| Member management | Manage organization members, invites, and roles | +| View custom roles | View existing custom roles and their permissions | +| Manage custom roles | Full access to custom role management and assignment | +| Manage organization access tokens | Create, update, and delete organization access tokens | +| View activity logs | Access organization audit logs and activity history | +| View domains | View domains and domain audit settings | +| Manage domains | Manage verified domains and domain audit settings | +| View SSO and SCIM | View single sign-on and user provisioning configurations | +| Manage SSO and SCIM | Full access to SSO and SCIM management | +| Manage Desktop settings | Configure Docker Desktop settings policies and view usage reports | ## Docker Hub @@ -52,3 +52,12 @@ to a custom role. | :-------------- | :--------------------------------------------------- | | View policies | View existing AI Governance policies and their rules | | Manage policies | Full access to AI Governance policy management | + +## Next steps + +- [Create and manage custom roles](manage.md): Create roles and assign them + to users and teams +- [Organization access tokens](/manuals/enterprise/security/access-tokens.md): + Learn how OATs provide programmatic Hub access +- [Core roles and permissions](/manuals/enterprise/security/roles-and-permissions/core-roles.md): + Compare built-in Member, Editor, and Owner permissions From 53116b68377f634c6b9720f16a092f656313e2c4 Mon Sep 17 00:00:00 2001 From: Alexa Date: Thu, 30 Jul 2026 12:12:00 -0500 Subject: [PATCH 03/12] docs: consolidate roles and permissions overview Reduce the overview to role concepts and choosing between core and custom roles, and group the core roles tables under a permissions reference heading. Update the Build Cloud deep link for the renamed anchor. Co-authored-by: Cursor --- content/manuals/build-cloud/_index.md | 2 +- .../security/roles-and-permissions/_index.md | 89 ++++++------------- .../roles-and-permissions/core-roles.md | 33 +++---- 3 files changed, 47 insertions(+), 77 deletions(-) diff --git a/content/manuals/build-cloud/_index.md b/content/manuals/build-cloud/_index.md index 37901cdc6028..80458665e99d 100644 --- a/content/manuals/build-cloud/_index.md +++ b/content/manuals/build-cloud/_index.md @@ -64,4 +64,4 @@ Once you've signed up and created a builder, continue by [setting up the builder in your local environment](./setup.md). For information about roles and permissions related to Docker Build Cloud, see -[Roles and Permissions](/manuals/enterprise/security/roles-and-permissions/core-roles.md#docker-build-cloud-permissions). +[Roles and Permissions](/manuals/enterprise/security/roles-and-permissions/core-roles.md#docker-build-cloud). diff --git a/content/manuals/enterprise/security/roles-and-permissions/_index.md b/content/manuals/enterprise/security/roles-and-permissions/_index.md index 7283bd0445e6..7f93c0b3cfc0 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/_index.md +++ b/content/manuals/enterprise/security/roles-and-permissions/_index.md @@ -1,7 +1,7 @@ --- title: Roles and permissions overview linkTitle: Roles and permissions -description: Choose core or custom roles to control access to repositories, teams, and organization settings +description: Choose between core and custom roles to control access to repositories, teams, and organization settings keywords: roles, permissions, core roles, custom roles, member, editor, owner, access control, organization, docker hub, docker home, security tags: [admin] aliases: @@ -9,85 +9,52 @@ aliases: - /security/for-admins/roles-and-permissions/ - /docker-hub/roles-and-permissions/ grid: - - title: "Core roles" - description: Learn about Docker's built-in Member, Editor, and Owner roles with predefined permissions. + - title: Core roles + description: Compare the permissions granted by the built-in Member, Editor, and Owner roles. icon: shield-check link: /enterprise/security/roles-and-permissions/core-roles/ - - title: "Custom roles" - description: Create tailored permission sets that match your organization's specific needs. + - title: Custom roles + description: Build permission sets that match your organization's access control needs. icon: adjustments-horizontal link: /enterprise/security/roles-and-permissions/custom-roles/ + - title: Custom roles permissions + description: Reference documentation for every permission you can assign to a custom role. + icon: list-bullet + link: /enterprise/security/roles-and-permissions/custom-roles/permissions-reference/ weight: 40 --- {{< summary-bar feature_name="General admin" >}} -Roles control what users can do in your Docker organization. When you invite -users or create teams, you assign roles that determine their permissions for -repositories, teams, and organization settings. +Roles determine what members can do in your Docker organization. When you +invite a user or create a team, you assign a role that grants permissions +for repositories, teams, and organization settings. -Docker provides two role types: - -- [Core roles](/manuals/enterprise/security/roles-and-permissions/core-roles.md): - Built-in Member, Editor, and Owner roles with predefined permissions -- [Custom roles](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md): - Permission sets you define for your organization's needs +Docker provides two role types. Users and teams get either a core role or a +custom role, but not both. ## Core roles -Core roles are Docker's built-in roles: - -- **Member**: Basic access. Members can view other organization members and - pull images from repositories they have access to. -- **Editor**: Partial administrative access. Editors can create, edit, and - delete repositories, and manage team permissions for repositories. -- **Owner**: Full administrative access. Owners can manage all organization - settings, including repositories, teams, members, billing, and security - features. - -For a full permission comparison, see -[Core roles and permissions](/manuals/enterprise/security/roles-and-permissions/core-roles.md). +Core roles are Docker's built-in Member, Editor, and Owner roles. Their +permissions are predefined and can't be changed. Use core roles when +Docker's permission sets match how your organization works and you want +straightforward role assignments. ## Custom roles -Custom roles let you select specific permissions from categories such as -user management, team management, billing, and Hub. Use them when core roles -don't match your access control needs. - -Custom roles require a Docker Business subscription and owner permissions. -For details, see -[Custom roles](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md). - -## When to use each role type - -Use core roles when: +Custom roles are permission sets you build by selecting individual +permissions, such as billing or team management. Use custom roles when you +need a combination that core roles don't offer, for example a billing +administrator or a security auditor, or when you want to grant +least-privilege access. Custom roles require a Docker Business subscription. -- Docker's predefined permission sets match your structure -- You want simple role assignments -- Your access control needs are standard +## Roles and team permissions -Use custom roles when: - -- You need permission combinations not available in core roles -- You want specialized roles such as billing administrators or security - auditors -- You need department-specific or least-privilege access control - -## How roles work with team permissions - -You can assign users and teams either a core role or a custom role, but not -both. Roles also work with team permissions: - -1. **Role permissions**: Apply organization-wide. Custom roles can grant - organization settings and repository management permissions. -1. **Team permissions**: Grant additional repository-specific access when - users join teams. This is separate from role-based permissions. - -This layered model lets you grant broad organizational access through roles -and specific repository access through team memberships. +Roles apply organization-wide, and team permissions apply to specific +repositories. The two systems work together: a user's role sets their +organization-wide access, and team membership can extend their access to +individual repositories. ## Next steps -Choose the role type that fits your organization: - {{< grid >}} diff --git a/content/manuals/enterprise/security/roles-and-permissions/core-roles.md b/content/manuals/enterprise/security/roles-and-permissions/core-roles.md index 4900636322d3..8edd95d0e872 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/core-roles.md +++ b/content/manuals/enterprise/security/roles-and-permissions/core-roles.md @@ -8,23 +8,24 @@ weight: 10 {{< summary-bar feature_name="General admin" >}} -Core roles are Docker's built-in roles with predefined permission sets. This -page compares what Member, Editor, and Owner can do across content, registry, -organization management, Docker Scout, and Docker Build Cloud. +Core roles are Docker's built-in roles with predefined permission sets. This page defines the core roles and compares what each core role can do across Docker products. If you need a +different combination of permissions, use +[custom roles](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md) +instead. -## Core role summary +## Core roles Docker organizations have three core roles: -- **Member**: Non-administrative role with basic access. Members can view - other organization members and pull images from repositories they have - access to. -- **Editor**: Partial administrative access. Editors can create, edit, and - delete repositories. They can also manage team permissions for - repositories. -- **Owner**: Full administrative access. Owners can manage all organization +- Owner provides full administrative access. Owners can manage all organization settings, including repositories, teams, members, billing, and security features. +- Editor extends partial administrative access. Editors can create, edit, and + delete repositories. They can also manage team permissions for + repositories. +- Member is a non-administrative role with basic access. Members can view + other organization members and pull images from repositories they have + access to. A company owner has the same organization management permissions as an organization owner, but some content and registry permissions don't apply @@ -32,7 +33,9 @@ to company owners (for example, repository pull and push). For more information, see [Company overview](/manuals/admin/company/_index.md). -## Content and registry permissions +## Permissions reference + +### Content and registry These permissions apply organization-wide. @@ -67,7 +70,7 @@ Custom roles can grant organization-wide permissions to manage repositories (create, edit, delete) but don't grant pull access to private repositories. Use team permissions for that. -## Organization management permissions +### Organization management | Permission | Member | Editor | Owner | | :---------------------------------------------------------------- | :----- | :----- | :---- | @@ -100,7 +103,7 @@ Use team permissions for that. _\* If not part of a company_ -## Docker Scout permissions +### Docker Scout | Permission | Member | Editor | Owner | | :---------------------------------------------------- | :----- | :----- | :---- | @@ -110,7 +113,7 @@ _\* If not part of a company_ | Create environments | ❌ | ❌ | ✅ | | Manage registry integrations | ❌ | ❌ | ✅ | -## Docker Build Cloud permissions +### Docker Build Cloud | Permission | Member | Editor | Owner | | -------------------------- | :----- | :----- | :---- | From bc7f155d53d70a6fe2241563f521762cf580cb3a Mon Sep 17 00:00:00 2001 From: Alexa Date: Thu, 30 Jul 2026 12:25:46 -0500 Subject: [PATCH 04/12] docs: align custom roles overview with core roles pattern Match the core roles intro structure, correct the permission category list to the categories in the reference, and refresh the description, keywords, and wording. Co-authored-by: Cursor --- .../custom-roles/_index.md | 45 +++++++++---------- .../custom-roles/permissions-reference.md | 9 ---- 2 files changed, 21 insertions(+), 33 deletions(-) diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md index d8c47d4179c4..48e2dbc51eaf 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md +++ b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md @@ -1,51 +1,48 @@ --- title: Custom roles overview linkTitle: Custom roles -description: Learn when to use custom roles and how they differ from Docker's built-in core roles -keywords: custom roles, permissions, access control, least privilege, docker business, organization management, docker hub, docker home, security +description: Build permission sets for your Docker organization by selecting individual permissions and assigning them to users or teams +keywords: custom roles, permission sets, access control, least privilege, docker business, organization management, role assignment, teams, security weight: 20 grid: - - title: "Manage custom roles" + - title: Manage custom roles description: Create, edit, assign, and delete custom roles for users and teams. icon: adjustments-horizontal link: /enterprise/security/roles-and-permissions/custom-roles/manage/ - - title: "Permissions reference" - description: Review all permissions you can assign when building a custom role. + - title: Permissions reference + description: Review every permission you can assign when building a custom role. icon: list-bullet link: /enterprise/security/roles-and-permissions/custom-roles/permissions-reference/ --- {{< summary-bar feature_name="General admin" >}} -Custom roles let you build permission sets that match your organization's -access control needs. Use them when Docker's +Custom roles are permission sets you build by selecting individual +permissions. This page defines custom roles and explains when to use them. +If Docker's predefined permission sets meet your needs, use [core roles](/manuals/enterprise/security/roles-and-permissions/core-roles.md) -don't provide the right combination of permissions. +instead. -## What are custom roles? +## Custom roles -With custom roles, you select permissions from categories such as user -management, team management, billing, Hub, and governance. You can assign a -custom role to individual users or to teams. +With custom roles, you select permissions from categories such as +organization management, Docker Hub, billing, and governance. You can assign +a custom role to individual users or to teams. Users and teams get either a +core role or a custom role, but not both. -Users and teams get either a core role or a custom role, but not both. - -## Prerequisites - -To configure custom roles, you need: +Before configuring custom roles, you need: - A Docker Business subscription - Owner permissions in your Docker organization -## When to use custom roles +## Using custom roles -Use custom roles when: +Core roles satisfy most organizations. Use custom roles when you need: -- You need permission combinations not available in core roles -- You want specialized roles such as billing administrators, security - auditors, or repository managers -- You need department-specific access control -- You want least-privilege access with precise permission grants +- Specialized roles such as billing administrators, security auditors, or + repository managers +- Department-specific access control +- Least-privilege access with precise permission grants ## Next steps diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md index 863114db6dcb..35b0978eff89 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md +++ b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md @@ -52,12 +52,3 @@ tables on this page when you | :-------------- | :--------------------------------------------------- | | View policies | View existing AI Governance policies and their rules | | Manage policies | Full access to AI Governance policy management | - -## Next steps - -- [Create and manage custom roles](manage.md): Create roles and assign them - to users and teams -- [Organization access tokens](/manuals/enterprise/security/access-tokens.md): - Learn how OATs provide programmatic Hub access -- [Core roles and permissions](/manuals/enterprise/security/roles-and-permissions/core-roles.md): - Compare built-in Member, Editor, and Owner permissions From b3d037a00cbe01f6e8886d097a89e8774f6380ea Mon Sep 17 00:00:00 2001 From: Alexa Date: Tue, 11 Aug 2026 12:12:23 -0500 Subject: [PATCH 05/12] docs: refresh roles and permissions titles and copy Co-authored-by: Cursor --- .../security/roles-and-permissions/_index.md | 24 +++++++++------ .../roles-and-permissions/core-roles.md | 27 +++++++++-------- .../custom-roles/_index.md | 12 ++++---- .../custom-roles/manage.md | 18 +++++------- .../custom-roles/permissions-reference.md | 29 ++++++++++--------- 5 files changed, 60 insertions(+), 50 deletions(-) diff --git a/content/manuals/enterprise/security/roles-and-permissions/_index.md b/content/manuals/enterprise/security/roles-and-permissions/_index.md index 7f93c0b3cfc0..dcac1b8e338f 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/_index.md +++ b/content/manuals/enterprise/security/roles-and-permissions/_index.md @@ -1,8 +1,12 @@ --- -title: Roles and permissions overview +title: Docker organization roles and permissions linkTitle: Roles and permissions -description: Choose between core and custom roles to control access to repositories, teams, and organization settings -keywords: roles, permissions, core roles, custom roles, member, editor, owner, access control, organization, docker hub, docker home, security +description: >- + Choose core or custom roles to control access to repositories, teams, and + organization settings +keywords: >- + Docker organization roles, permissions, core roles, custom roles, Member, + Editor, Owner, access control, least privilege, Docker Business, security tags: [admin] aliases: - /admin/organization/roles/ @@ -10,15 +14,18 @@ aliases: - /docker-hub/roles-and-permissions/ grid: - title: Core roles - description: Compare the permissions granted by the built-in Member, Editor, and Owner roles. + description: >- + Compare permissions for the built-in Member, Editor, and Owner roles. icon: shield-check link: /enterprise/security/roles-and-permissions/core-roles/ - title: Custom roles - description: Build permission sets that match your organization's access control needs. + description: >- + Build permission sets that match your organization's access control needs. icon: adjustments-horizontal link: /enterprise/security/roles-and-permissions/custom-roles/ - title: Custom roles permissions - description: Reference documentation for every permission you can assign to a custom role. + description: >- + Review every permission you can assign to a custom role. icon: list-bullet link: /enterprise/security/roles-and-permissions/custom-roles/permissions-reference/ weight: 40 @@ -36,9 +43,8 @@ custom role, but not both. ## Core roles Core roles are Docker's built-in Member, Editor, and Owner roles. Their -permissions are predefined and can't be changed. Use core roles when -Docker's permission sets match how your organization works and you want -straightforward role assignments. +permissions are predefined. Use core roles when Docker's permission sets match +your organization's needs. ## Custom roles diff --git a/content/manuals/enterprise/security/roles-and-permissions/core-roles.md b/content/manuals/enterprise/security/roles-and-permissions/core-roles.md index 8edd95d0e872..7418be32f73a 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/core-roles.md +++ b/content/manuals/enterprise/security/roles-and-permissions/core-roles.md @@ -1,36 +1,39 @@ --- -title: Core roles and permissions +title: Docker core roles and permissions linkTitle: Core roles -description: Compare Member, Editor, and Owner permissions for content, registry, organization, Scout, and Build Cloud -keywords: core roles, member, editor, owner, permissions, organization, company, docker hub, docker scout, docker build cloud, oidc, teams, security +description: Compare Member, Editor, and Owner permissions across Docker products +keywords: >- + Docker roles, core roles, Member role, Editor role, Owner role, organization + permissions, company owner, Docker Hub, Docker Scout, Docker Build Cloud, + OIDC, teams, access control weight: 10 --- {{< summary-bar feature_name="General admin" >}} -Core roles are Docker's built-in roles with predefined permission sets. This page defines the core roles and compares what each core role can do across Docker products. If you need a -different combination of permissions, use +Docker organizations use built-in Member, Editor, and Owner roles with +predefined permissions. This reference compares their permissions across Docker +products. To assign a different combination of permissions, use [custom roles](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md) instead. -## Core roles +## Core roles Docker organizations have three core roles: - Owner provides full administrative access. Owners can manage all organization settings, including repositories, teams, members, billing, and security features. -- Editor extends partial administrative access. Editors can create, edit, and +- Editor has partial administrative access. Editors can create, edit, and delete repositories. They can also manage team permissions for repositories. -- Member is a non-administrative role with basic access. Members can view +- Member has basic, non-administrative access. Members can view other organization members and pull images from repositories they have access to. -A company owner has the same organization management permissions as an -organization owner, but some content and registry permissions don't apply -to company owners (for example, repository pull and push). For more -information, see +A company owner has the same organization-management permissions as an +organization owner. Content and registry permissions, such as repository pull +and push, don't apply to company owners. For more information, see [Company overview](/manuals/admin/company/_index.md). ## Permissions reference diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md index 48e2dbc51eaf..868f02c20560 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md +++ b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md @@ -1,8 +1,8 @@ --- -title: Custom roles overview +title: Custom roles and permissions overview linkTitle: Custom roles -description: Build permission sets for your Docker organization by selecting individual permissions and assigning them to users or teams -keywords: custom roles, permission sets, access control, least privilege, docker business, organization management, role assignment, teams, security +description: Use custom roles to assign tailored permissions to users and teams in your Docker organization +keywords: custom roles, custom permissions, permission sets, access control, least privilege, docker business, docker home, organization management, role assignment, teams, security weight: 20 grid: - title: Manage custom roles @@ -17,8 +17,8 @@ grid: {{< summary-bar feature_name="General admin" >}} -Custom roles are permission sets you build by selecting individual -permissions. This page defines custom roles and explains when to use them. +Custom roles are permission sets built from individual permissions. This page +defines custom roles and explains when to use them. If Docker's predefined permission sets meet your needs, use [core roles](/manuals/enterprise/security/roles-and-permissions/core-roles.md) instead. @@ -37,7 +37,7 @@ Before configuring custom roles, you need: ## Using custom roles -Core roles satisfy most organizations. Use custom roles when you need: +Use custom roles when you need: - Specialized roles such as billing administrators, security auditors, or repository managers diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/manage.md b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/manage.md index bc7a7721d269..ab1446b7b319 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/manage.md +++ b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/manage.md @@ -1,16 +1,15 @@ --- -title: Create and manage custom roles +title: Manage custom roles in Docker linkTitle: Manage -description: Create, edit, assign, reassign, and delete custom roles for users and teams -keywords: custom roles, create role, assign role, edit role, delete role, reassign role, manage roles, access control, docker home, security +description: Create, edit, assign, reassign, and delete custom roles in Docker Home for organization users and teams +keywords: custom roles, manage custom roles, role assignments, access control, Docker Home, organization roles, permissions weight: 10 --- {{< summary-bar feature_name="General admin" >}} -This page shows how to create custom roles, change their permissions, and -assign them to users and teams. For the full list of permissions you can -grant, see the +Create custom roles, manage their permissions, and assign them to users and +teams. For a full list of permissions, see the [custom roles permissions reference](permissions-reference.md). ## Create a custom role @@ -19,16 +18,15 @@ Before you can assign a custom role, create one: 1. Sign in to [Docker Home](https://app.docker.com). 1. Select **Roles**, then **Create role**. -1. Create a name and describe what the role is for: +1. Define the role: - Provide a **Label** - - Enter a unique **Name** identifier (can't be changed later) + - Enter a unique **Name** identifier. You can't change it later. - Add an optional **Description** 1. Set permissions for the role by expanding permission categories and selecting the checkboxes for permissions. For a full list of available permissions, see the [custom roles permissions reference](permissions-reference.md). -1. Select **Review** to review your configuration and see a summary of - selected permissions. +1. Select **Review** to review the configuration and selected permissions. 1. Select **Create**. After you create a custom role, you can diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md index 35b0978eff89..32b387f89117 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md +++ b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md @@ -1,16 +1,19 @@ --- -title: Custom roles permissions reference +title: Custom role permissions reference linkTitle: Permissions reference -description: Reference of permissions you can assign when creating custom roles in Docker -keywords: custom roles, permissions reference, organization management, billing, docker hub, governance, access tokens, sso, scim, security +description: >- + Permissions available for Docker custom roles across organization management, + Docker Hub, billing, and AI Governance. +keywords: >- + custom roles, custom role permissions, Docker, Docker Hub, organization + management, billing, AI Governance, access tokens, SSO, SCIM, security weight: 20 --- {{< summary-bar feature_name="General admin" >}} -Custom roles are built from permissions across several categories. Use the -tables on this page when you -[create or edit a custom role](manage.md). +Custom roles use permissions from several categories. Use the following tables +to [create or edit a custom role](manage.md). ## Organization management @@ -23,13 +26,13 @@ tables on this page when you | Update organization information | Update organization information such as name and location | | Member management | Manage organization members, invites, and roles | | View custom roles | View existing custom roles and their permissions | -| Manage custom roles | Full access to custom role management and assignment | +| Manage custom roles | Manage and assign custom roles | | Manage organization access tokens | Create, update, and delete organization access tokens | | View activity logs | Access organization audit logs and activity history | | View domains | View domains and domain audit settings | | Manage domains | Manage verified domains and domain audit settings | | View SSO and SCIM | View single sign-on and user provisioning configurations | -| Manage SSO and SCIM | Full access to SSO and SCIM management | +| Manage SSO and SCIM | Manage single sign-on and user provisioning configurations | | Manage Desktop settings | Configure Docker Desktop settings policies and view usage reports | ## Docker Hub @@ -41,14 +44,14 @@ tables on this page when you ## Billing -| Permission | Description | -| :------------- | :----------------------------------------------- | -| View billing | View organization billing information | -| Manage billing | Complete access to managing organization billing | +| Permission | Description | +| :------------- | :------------------------------------ | +| View billing | View organization billing information | +| Manage billing | Manage organization billing | ## Governance | Permission | Description | | :-------------- | :--------------------------------------------------- | | View policies | View existing AI Governance policies and their rules | -| Manage policies | Full access to AI Governance policy management | +| Manage policies | Manage AI Governance policies and their rules | From 8ff15a435685548d6e4925e7316e9b90c8abdd55 Mon Sep 17 00:00:00 2001 From: Alexa Date: Tue, 18 Aug 2026 10:06:35 -0500 Subject: [PATCH 06/12] docs: mark custom roles as Docker Business Custom roles pages used the General admin summary bar, which only showed Administrators. Added a Custom roles summary.yaml entry so the banner shows Business and Administrators. Co-authored-by: Cursor --- .../security/roles-and-permissions/custom-roles/_index.md | 2 +- .../security/roles-and-permissions/custom-roles/manage.md | 2 +- .../custom-roles/permissions-reference.md | 2 +- data/summary.yaml | 3 +++ 4 files changed, 6 insertions(+), 3 deletions(-) diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md index 868f02c20560..1b8c49907fca 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md +++ b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md @@ -15,7 +15,7 @@ grid: link: /enterprise/security/roles-and-permissions/custom-roles/permissions-reference/ --- -{{< summary-bar feature_name="General admin" >}} +{{< summary-bar feature_name="Custom roles" >}} Custom roles are permission sets built from individual permissions. This page defines custom roles and explains when to use them. diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/manage.md b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/manage.md index ab1446b7b319..921a9e9d44bf 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/manage.md +++ b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/manage.md @@ -6,7 +6,7 @@ keywords: custom roles, manage custom roles, role assignments, access control, D weight: 10 --- -{{< summary-bar feature_name="General admin" >}} +{{< summary-bar feature_name="Custom roles" >}} Create custom roles, manage their permissions, and assign them to users and teams. For a full list of permissions, see the diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md index 32b387f89117..e7e792b2b8fe 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md +++ b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md @@ -10,7 +10,7 @@ keywords: >- weight: 20 --- -{{< summary-bar feature_name="General admin" >}} +{{< summary-bar feature_name="Custom roles" >}} Custom roles use permissions from several categories. Use the following tables to [create or edit a custom role](manage.md). diff --git a/data/summary.yaml b/data/summary.yaml index ed5507d44058..b4cdd2d638a9 100644 --- a/data/summary.yaml +++ b/data/summary.yaml @@ -148,6 +148,9 @@ Compose sbom: requires: Docker Compose [2.39.0](https://github.com/docker/compose/releases/tag/v2.39.0) and later Compose SDK: requires: Docker Compose [5.0.0](https://github.com/docker/compose/releases/tag/v5.0.0) and later +Custom roles: + subscription: [Business] + for: Administrators Dev Environments: availability: Beta Docker Build Cloud: From bc1d333754b5ed7257042c149b1d2f7bc6a6cf52 Mon Sep 17 00:00:00 2001 From: Alexa Date: Tue, 18 Aug 2026 10:07:23 -0500 Subject: [PATCH 07/12] docs: sync custom role permissions with the product UI The permissions reference omitted categories and descriptions shown in Docker Home. Updated the tables to match the current custom role permission picker. Co-authored-by: Cursor --- .../custom-roles/permissions-reference.md | 96 ++++++++++++------- 1 file changed, 62 insertions(+), 34 deletions(-) diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md index e7e792b2b8fe..fe210416c740 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md +++ b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/permissions-reference.md @@ -3,55 +3,83 @@ title: Custom role permissions reference linkTitle: Permissions reference description: >- Permissions available for Docker custom roles across organization management, - Docker Hub, billing, and AI Governance. + Docker Hub, billing, AI Governance, Docker Hardened Images, and Docker + Offload. keywords: >- custom roles, custom role permissions, Docker, Docker Hub, organization - management, billing, AI Governance, access tokens, SSO, SCIM, security + management, billing, AI Governance, access tokens, SSO, SCIM, OIDC, DHI, + Docker Offload, security weight: 20 --- {{< summary-bar feature_name="Custom roles" >}} -Custom roles use permissions from several categories. Use the following tables -to [create or edit a custom role](manage.md). +Custom roles use permissions from organization management, Docker Hub, +billing, AI Governance, Docker Hardened Images, and Docker Offload. Use +the following tables to [create or edit a custom role](manage.md). ## Organization management -| Permission | Description | -| :-------------------------------- | :---------------------------------------------------------------- | -| View teams | View teams and team members | -| Manage teams | Create, update, and delete teams and team members | -| Manage registry access | Control which registries members can access | -| Manage image access | Set policies for which images members can pull and use | -| Update organization information | Update organization information such as name and location | -| Member management | Manage organization members, invites, and roles | -| View custom roles | View existing custom roles and their permissions | -| Manage custom roles | Manage and assign custom roles | -| Manage organization access tokens | Create, update, and delete organization access tokens | -| View activity logs | Access organization audit logs and activity history | -| View domains | View domains and domain audit settings | -| Manage domains | Manage verified domains and domain audit settings | -| View SSO and SCIM | View single sign-on and user provisioning configurations | -| Manage SSO and SCIM | Manage single sign-on and user provisioning configurations | -| Manage Desktop settings | Configure Docker Desktop settings policies and view usage reports | +| Permission | Description | +| :-------------------------------- | :---------------------------------------------------------------------------------------------- | +| View teams | View teams and team members | +| Manage teams | Create, update, and delete teams and team members | +| Manage registry access | Control which registries members can access | +| Manage image access | Set policies for which images members can pull and use | +| Update organization information | Update organization information such as name and location | +| Member management | Manage organization members, invites, and roles | +| View custom roles | View existing custom roles and their permissions | +| Manage custom roles | Full access to custom role management and assignment | +| Manage organization access tokens | Create, update, and delete repositories in this org. Push/pull or registry actions not included | +| View activity logs | Access organization audit logs and activity history | +| View usage reports | Download organization usage reports (pulls, storage) | +| View domains | View domains and domain audit settings | +| Manage domains | Manage verified domains and domain audit settings | +| View SSO and SCIM | View single sign-on and user provisioning configurations | +| Manage SSO and SCIM | Full access to SSO and SCIM management | +| Manage Desktop settings | Configure Docker Desktop settings policies and view usage reports | +| View OIDC connections | View OIDC connections and their configuration | +| Manage OIDC connections | View, create, edit, and delete OIDC connections | ## Docker Hub -| Permission | Description | -| :------------------ | :--------------------------------------------------------- | -| View repositories | View repository details and contents | -| Manage repositories | Create, update, and delete repositories and their contents | +| Permission | Description | +| :--------------------------------- | :------------------------------------------------------------------------------------------- | +| View repositories | View repository details and contents | +| Manage repositories | Full repository management including settings, webhooks, privacy, Dockerfile, immutable tags | +| Manage repository team permissions | Add and remove teams from a repository, and manage team access level | ## Billing -| Permission | Description | -| :------------- | :------------------------------------ | -| View billing | View organization billing information | -| Manage billing | Manage organization billing | +| Permission | Description | +| :------------- | :----------------------------------------------- | +| View billing | View organization billing information | +| Manage billing | Complete access to managing organization billing | -## Governance +## AI Governance -| Permission | Description | -| :-------------- | :--------------------------------------------------- | -| View policies | View existing AI Governance policies and their rules | -| Manage policies | Manage AI Governance policies and their rules | +| Permission | Description | +| :-------------------- | :--------------------------------------------------- | +| View policies | View existing AI Governance policies and their rules | +| Manage policies | Full access to AI Governance policy management | +| View audit logs | View audit events for the organization | +| Manage audit settings | Update audit configuration for the organization | + +## DHI (Docker Hardened Images) + +| Permission | Description | +| :----------------- | :----------------------------------------------- | +| Create DHI mirrors | Create Docker Hardened Image mirror repositories | + +## Docker Offload + +| Permission | Description | +| :---------------- | :--------------------------------------------- | +| Offload Read-Only | View Offload account status, leases, and zones | + +## Next steps + +- [Manage custom roles](manage.md): Create, assign, and delete custom + roles +- [Core roles and permissions](/manuals/enterprise/security/roles-and-permissions/core-roles.md): + Compare built-in Member, Editor, and Owner permissions From 2f6dd197018c61d474f5a93d036c824f3d7e0da2 Mon Sep 17 00:00:00 2001 From: Alexa Date: Tue, 18 Aug 2026 10:08:04 -0500 Subject: [PATCH 08/12] docs: freshness pass on roles and custom roles pages Titles, keywords, and UI wording were inconsistent with the style guide. Refreshed copy, headings, and navigation instructions on the custom roles and core roles pages. Co-authored-by: Cursor --- .../roles-and-permissions/core-roles.md | 19 +++++----- .../custom-roles/_index.md | 26 ++++++++------ .../custom-roles/manage.md | 36 ++++++++++--------- 3 files changed, 46 insertions(+), 35 deletions(-) diff --git a/content/manuals/enterprise/security/roles-and-permissions/core-roles.md b/content/manuals/enterprise/security/roles-and-permissions/core-roles.md index 7418be32f73a..fe2036836c77 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/core-roles.md +++ b/content/manuals/enterprise/security/roles-and-permissions/core-roles.md @@ -1,19 +1,20 @@ --- title: Docker core roles and permissions linkTitle: Core roles -description: Compare Member, Editor, and Owner permissions across Docker products +description: >- + Compare Member, Editor, and Owner permissions across Docker products keywords: >- Docker roles, core roles, Member role, Editor role, Owner role, organization permissions, company owner, Docker Hub, Docker Scout, Docker Build Cloud, - OIDC, teams, access control + OIDC, teams, access control, Docker Business, custom roles weight: 10 --- {{< summary-bar feature_name="General admin" >}} Docker organizations use built-in Member, Editor, and Owner roles with -predefined permissions. This reference compares their permissions across Docker -products. To assign a different combination of permissions, use +predefined permissions. This reference compares their permissions across +Docker products. To assign a different combination of permissions, use [custom roles](/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md) instead. @@ -21,9 +22,9 @@ instead. Docker organizations have three core roles: -- Owner provides full administrative access. Owners can manage all organization - settings, including repositories, teams, members, billing, and security - features. +- Owner provides full administrative access. Owners can manage all + organization settings, including repositories, teams, members, billing, + and security features. - Editor has partial administrative access. Editors can create, edit, and delete repositories. They can also manage team permissions for repositories. @@ -32,8 +33,8 @@ Docker organizations have three core roles: access to. A company owner has the same organization-management permissions as an -organization owner. Content and registry permissions, such as repository pull -and push, don't apply to company owners. For more information, see +organization owner. Content and registry permissions, such as repository +pull and push, don't apply to company owners. For more information, see [Company overview](/manuals/admin/company/_index.md). ## Permissions reference diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md index 1b8c49907fca..941e934c0ad8 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md +++ b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md @@ -1,8 +1,14 @@ --- title: Custom roles and permissions overview linkTitle: Custom roles -description: Use custom roles to assign tailored permissions to users and teams in your Docker organization -keywords: custom roles, custom permissions, permission sets, access control, least privilege, docker business, docker home, organization management, role assignment, teams, security +description: >- + Use custom roles to assign tailored permissions to users and teams in + your Docker organization +keywords: >- + custom roles, custom permissions, permission sets, access control, + least privilege, Docker Business, Docker Home, organization + management, role assignment, teams, AI Governance, Docker Offload, + security weight: 20 grid: - title: Manage custom roles @@ -17,20 +23,20 @@ grid: {{< summary-bar feature_name="Custom roles" >}} -Custom roles are permission sets built from individual permissions. This page -defines custom roles and explains when to use them. -If Docker's predefined permission sets meet your needs, use +Custom roles are permission sets built from individual permissions, so you +can grant only the access a user or team needs. If Docker's predefined +permission sets meet your needs, use [core roles](/manuals/enterprise/security/roles-and-permissions/core-roles.md) instead. ## Custom roles -With custom roles, you select permissions from categories such as -organization management, Docker Hub, billing, and governance. You can assign -a custom role to individual users or to teams. Users and teams get either a -core role or a custom role, but not both. +With custom roles, you select permissions from organization management, +Docker Hub, billing, AI Governance, Docker Hardened Images, and Docker +Offload. You can assign a custom role to individual users or to teams. +Users and teams get either a core role or a custom role, but not both. -Before configuring custom roles, you need: +## Prerequisites - A Docker Business subscription - Owner permissions in your Docker organization diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/manage.md b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/manage.md index 921a9e9d44bf..3dbf85e77731 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/manage.md +++ b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/manage.md @@ -1,15 +1,20 @@ --- -title: Manage custom roles in Docker +title: Manage custom roles in Docker Home linkTitle: Manage -description: Create, edit, assign, reassign, and delete custom roles in Docker Home for organization users and teams -keywords: custom roles, manage custom roles, role assignments, access control, Docker Home, organization roles, permissions +description: >- + Create, edit, assign, reassign, and delete custom roles in Docker Home + for organization users and teams +keywords: >- + custom roles, manage custom roles, role assignments, access control, + Docker Home, Docker Business, organization roles, permissions, teams weight: 10 --- {{< summary-bar feature_name="Custom roles" >}} -Create custom roles, manage their permissions, and assign them to users and -teams. For a full list of permissions, see the +Create custom roles, manage their permissions, and assign them to users +and teams. Use a custom role to grant only the permissions a user or +team needs. For a full list of permissions, see the [custom roles permissions reference](permissions-reference.md). ## Create a custom role @@ -20,7 +25,7 @@ Before you can assign a custom role, create one: 1. Select **Roles**, then **Create role**. 1. Define the role: - Provide a **Label** - - Enter a unique **Name** identifier. You can't change it later. + - Enter a unique **Name** identifier. The identifier is permanent. - Add an optional **Description** 1. Set permissions for the role by expanding permission categories and selecting the checkboxes for permissions. For a full list of available @@ -39,9 +44,9 @@ After you create a custom role, you can 1. Find your custom role in the list, then select the **Actions** menu. 1. Select **Edit**. 1. Edit any of the following settings: - - Label - - Description - - Permissions + - **Label** + - **Description** + - **Permissions** 1. Select **Save**. ## Assign custom roles @@ -54,7 +59,7 @@ After you create a custom role, you can 1. Locate the member you want to assign a custom role to, then select the **Actions** menu. 1. Select **Change role**. -1. In the **Select a role** drop-down, select your custom role. +1. From the **Select a role** drop-down list, select your custom role. 1. Select **Save**. {{< /tab >}} @@ -65,8 +70,8 @@ After you create a custom role, you can 1. Use the checkboxes in the username column to select the users you want to assign a custom role to. 1. Select **Change role**. -1. In the **Select a role** drop-down, select your custom role or a core - role. +1. From the **Select a role** drop-down list, select your custom role or + a core role. 1. Select **Save**. {{< /tab >}} @@ -104,7 +109,7 @@ To see which users and teams are assigned to roles: 1. Locate the member you want to reassign, then select the **Actions** menu. 1. Select **Change role**. -1. In the **Select a role** drop-down, select the new role. +1. From the **Select a role** drop-down list, select the new role. 1. Select **Save**. {{< /tab >}} @@ -115,7 +120,7 @@ To see which users and teams are assigned to roles: 1. Use the checkboxes in the username column to select the users you want to reassign. 1. Select **Change role**. -1. In the **Select a role** drop-down, select the new role. +1. From the **Select a role** drop-down list, select the new role. 1. Select **Save**. {{< /tab >}} @@ -125,8 +130,7 @@ To see which users and teams are assigned to roles: 1. Select **Teams**. 1. Locate the team, then select the **Actions** menu. 1. Select **Change role**. -1. In the pop-up window, select a role from the drop-down, then select - **Save**. +1. From the drop-down list, select a role, then select **Save**. {{< /tab >}} {{< /tabs >}} From d56c0d4c1783f68922ad4205fa5243edb598101f Mon Sep 17 00:00:00 2001 From: Alexa Date: Tue, 18 Aug 2026 10:21:23 -0500 Subject: [PATCH 09/12] docs: move custom roles prerequisites above Custom roles Prerequisites sat after the Custom roles section, so subscription and owner requirements appeared after the feature definition. Moved Prerequisites to follow the intro. Co-authored-by: Cursor --- .../roles-and-permissions/custom-roles/_index.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md index 941e934c0ad8..71c8d59e75c3 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md +++ b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md @@ -29,6 +29,11 @@ permission sets meet your needs, use [core roles](/manuals/enterprise/security/roles-and-permissions/core-roles.md) instead. +## Prerequisites + +- A Docker Business subscription +- Owner permissions in your Docker organization + ## Custom roles With custom roles, you select permissions from organization management, @@ -36,11 +41,6 @@ Docker Hub, billing, AI Governance, Docker Hardened Images, and Docker Offload. You can assign a custom role to individual users or to teams. Users and teams get either a core role or a custom role, but not both. -## Prerequisites - -- A Docker Business subscription -- Owner permissions in your Docker organization - ## Using custom roles Use custom roles when you need: From f9e57fcc688be1c38e8cf000a8e563bca30b5a36 Mon Sep 17 00:00:00 2001 From: Alexa Date: Tue, 18 Aug 2026 10:49:50 -0500 Subject: [PATCH 10/12] some light copy modifications --- .../security/roles-and-permissions/_index.md | 10 ++++++---- .../roles-and-permissions/custom-roles/_index.md | 9 ++++++--- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/content/manuals/enterprise/security/roles-and-permissions/_index.md b/content/manuals/enterprise/security/roles-and-permissions/_index.md index dcac1b8e338f..54d7e0239879 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/_index.md +++ b/content/manuals/enterprise/security/roles-and-permissions/_index.md @@ -50,15 +50,17 @@ your organization's needs. Custom roles are permission sets you build by selecting individual permissions, such as billing or team management. Use custom roles when you -need a combination that core roles don't offer, for example a billing +need a combination that core roles don't offer. For example, you may create a custom role for a billing administrator or a security auditor, or when you want to grant -least-privilege access. Custom roles require a Docker Business subscription. +least-privilege access. + +Custom roles require a Docker Business subscription. ## Roles and team permissions -Roles apply organization-wide, and team permissions apply to specific +Roles apply organization-wide. Team permissions apply to specific repositories. The two systems work together: a user's role sets their -organization-wide access, and team membership can extend their access to +organization-wide access and team membership can extend their access to individual repositories. ## Next steps diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md index 71c8d59e75c3..1340ad6fb656 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md +++ b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md @@ -24,7 +24,9 @@ grid: {{< summary-bar feature_name="Custom roles" >}} Custom roles are permission sets built from individual permissions, so you -can grant only the access a user or team needs. If Docker's predefined +can grant only the access a user or team needs. + +If Docker's predefined permission sets meet your needs, use [core roles](/manuals/enterprise/security/roles-and-permissions/core-roles.md) instead. @@ -36,9 +38,10 @@ instead. ## Custom roles -With custom roles, you select permissions from organization management, +To create a custom role, you select permissions from organization management, Docker Hub, billing, AI Governance, Docker Hardened Images, and Docker -Offload. You can assign a custom role to individual users or to teams. +Offload. You then assign custom roles you created to individual users or to teams. + Users and teams get either a core role or a custom role, but not both. ## Using custom roles From 5eceb83be3f8ccee84be9ca8d7c51e3829d54b3b Mon Sep 17 00:00:00 2001 From: Alexa Kristensen <81787716+akristen@users.noreply.github.com> Date: Wed, 19 Aug 2026 09:15:40 -0500 Subject: [PATCH 11/12] Update content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md Co-authored-by: Allie Sadler <102604716+aevesdocker@users.noreply.github.com> --- .../security/roles-and-permissions/custom-roles/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md index 1340ad6fb656..4e033ec0f947 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md +++ b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md @@ -36,7 +36,7 @@ instead. - A Docker Business subscription - Owner permissions in your Docker organization -## Custom roles +## Creating custom roles To create a custom role, you select permissions from organization management, Docker Hub, billing, AI Governance, Docker Hardened Images, and Docker From a656b3ba786f0266717b57231d817c04402b7575 Mon Sep 17 00:00:00 2001 From: Alexa Date: Wed, 19 Aug 2026 10:32:06 -0500 Subject: [PATCH 12/12] tw peer review --- .../custom-roles/_index.md | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-) diff --git a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md index 4e033ec0f947..5df1b9ac6ef5 100644 --- a/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md +++ b/content/manuals/enterprise/security/roles-and-permissions/custom-roles/_index.md @@ -23,8 +23,12 @@ grid: {{< summary-bar feature_name="Custom roles" >}} -Custom roles are permission sets built from individual permissions, so you -can grant only the access a user or team needs. +Custom roles are permission sets that you choose to grant access to users or teams based on specific use cases. Use custom roles when you need: + +- Specialized roles such as billing administrators, security auditors, or + repository managers +- Department-specific access control +- Least-privilege access with precise permission grants If Docker's predefined permission sets meet your needs, use @@ -44,15 +48,6 @@ Offload. You then assign custom roles you created to individual users or to team Users and teams get either a core role or a custom role, but not both. -## Using custom roles - -Use custom roles when you need: - -- Specialized roles such as billing administrators, security auditors, or - repository managers -- Department-specific access control -- Least-privilege access with precise permission grants - ## Next steps {{< grid >}}